diff --git a/.gitignore b/.gitignore
index 3043098..3494414 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,13 @@ app/dist/
 app/src-tauri/target/
 Screenshot*.png
 code-review.md
+
+# Windows NTFS alternate-data-stream artifacts, created when files arrive
+# through the WSL/host bind mount.
+*:Zone.Identifier
+
+# Local bug-report screenshots, same spirit as Screenshot*.png above.
+screenshot_for_fix/
+
+# Package files pulled in by ad-hoc verification runs.
+*.deb
diff --git a/CLAUDE.md b/CLAUDE.md
index f8ef401..3696563 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -79,7 +79,62 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
 - **`components/projects/home/`** — **Project Home**, the main-area view for a project:
   Overview / Sessions / Automation / Config / Files. Per-project configuration lives here, not in
   modals — see "UI conventions" below.
-- **`components/settings/`** — Host-level settings: Docker, AWS, Web Terminal, STT, shared auth
+  - **The Files pane's host transfers open their dialog from Rust, and that is the whole
+    design — do not move it back into the webview.** The tab browses, views (text and image),
+    renames and creates folders inside the container (`list_container_files`,
+    `read_container_file`, `rename_container_path`, `create_container_directory`), and it
+    copies single files in and out (`upload_files_to_container`, `download_container_file`).
+    The second pair call `pick_files_to_upload` / `pick_save_path`, which drive
+    `tauri-plugin-dialog` from the *backend*: the webview can ask for a picker and that is the
+    entirety of its influence — it cannot name a host path as an *input*. The claim stops
+    there and should not be widened: host paths still travel outward in error text, canonical
+    ones included. What is closed is the direction that produced the criticals.
+    That shape is not decoration. Four successive audits found that host filesystem paths
+    crossing IPC were where the criticals lived — a caller-named host destination for
+    container-controlled bytes, an arbitrary host source read into the container, a `link(2)`
+    upload reservation that succeeded against a directory and failed forever on any filesystem
+    without hard links. The feature was removed rather than fixed a fifth time, and it came
+    back only in the shape that removes the class: a frontend-driven dialog handing Rust a
+    string is the exact thing that failed, so re-introducing `open()`/`save()` in `FilesTab`
+    would undo the whole point while looking like a simplification.
+    None of the reservation machinery came back with it. There is no destination reservation,
+    no placeholder rollback and no collision marker — the OS save dialog already asks about
+    overwriting, and Docker's archive extractor overwrites on upload the way `cp` does.
+  - **Drag-and-drop is still not it.** There is no drop-into-the-Files-pane and no OS
+    drag-out; the buttons are the gesture. A file also gets *in* by being dropped on the
+    Terminal, and a whole tree comes *out* through "Back up container" — those two predate the
+    Files work and their hardening is not to be weakened. `TerminalView`'s `onDragDropEvent`
+    is Tauri's native drop event (window-wide, so routed by `lib/dropTarget.ts` — geometry for
+    *whose* drop it is, a document-wide `dropIsBlocked` for whether the app should accept one
+    at all; keep both halves and keep `PaneVisibility`). Backup is
+    `file_commands::download_container_backup`.
+  - **`resolve_host_path` applies the full lexical predicate twice — as written, and again
+    after canonicalisation.** That includes the general hidden-component rule, which
+    deliberately over-catches: a path resolving through `node_modules/.pnpm`, `~/.cache` or
+    `~/.local/share` is refused. Do not narrow it back to a list of "credential" directories.
+    That was tried, and allow-by-omission let `~/.local/bin` (write there and you own the
+    user's next shell command), `~/.password-store`, browser profiles and `~/.pki/nssdb`
+    through a planted symlink with a perfectly visible name. Over-refusing is the cheaper
+    mistake. Note the cost is real and has grown: of the four callers, the Files pane's two
+    are routine, and their path comes from a dialog — so an over-catch refuses a destination a
+    person actually chose (`~/.config` is the common one). Accepted, and not a reason to
+    narrow the rule, because the terminal drop and `download_container_backup` still take
+    their host path over IPC and this predicate is their only boundary.
+  - **OS drag-out is not here.** `tauri-plugin-drag`, `stage_container_file_for_drag` and its
+    host staging directory were held back for separate hardening and live on
+    `hold/disk-and-dragout`. Do not re-add `drag:allow-start-drag` or a staging command
+    without taking that work back whole: the plugin has no scope mechanism, so the grant lets
+    a compromised webview start a drag on *any* host path the user can read, and the staging
+    directory is a host-temp disk leak with a gesture attached unless its exit-clear and
+    startup-reap come back with it.
+- **`components/settings/`** — Host-level settings: Docker, AWS, Web Terminal, STT, shared auth.
+  There is deliberately **no Disk panel** here. The disk survey and its reclaim / destroy /
+  compaction surface were held back for separate hardening and live on `hold/disk-and-dragout`;
+  one of their IPC commands was a verified arbitrary-DELETE primitive, so if that work returns it
+  returns whole, `generate_handler!` entries and typed confirmations included. The *prevention*
+  half stayed and is not disk-panel code: the pre-commit scrub in `docker/container.rs`, capped
+  container logs, the `triple-c.base` / `triple-c.managed` labels, `sweep_orphaned_snapshots` and
+  the startup housekeeping in `lib.rs`, the migration reapers, and `project_lock.rs`.
 - **`components/ui/`** — Shared primitives. **Use these; do not hand-roll replacements.**
   `Modal` (the only correct way to build a dialog — it supplies `role="dialog"`, `aria-modal`,
   focus trap and restore), `Button`, `Toggle`, `Field`, `SegmentedControl`, `StatusIndicator`,
diff --git a/HOW-TO-USE.md b/HOW-TO-USE.md
index 643b022..9e30741 100644
--- a/HOW-TO-USE.md
+++ b/HOW-TO-USE.md
@@ -128,8 +128,11 @@ Anthropic-backend project uses that token without its own login. See
 2. Claude prints an OAuth URL. Triple-C detects long URLs and shows a clickable toast at the top of the terminal — click **Open** to open it in your browser.
 3. Complete the login in your browser. The token is saved and persists across container stops, starts and recreations. A **Reset** deletes it — see below.
 
-> If the login hangs after the browser step, the callback could not reach the container. Enable the
-> [Auth Bridge](#browser-logins-inside-the-container-auth-bridge) for that project.
+> If the login hangs after the browser step, the callback could not reach the container. Either
+> click **In container** on the toast instead of **Open** — the callback then never has to leave the
+> container at all — or turn on the
+> [Auth Bridge](#browser-logins-inside-the-container-auth-bridge) in the project's
+> **Config → Runtime** section.
 
 **AWS Bedrock:**
 
@@ -225,7 +228,7 @@ buttons. Below that are six tabs:
 | **Sessions** | Past Claude Code conversations stored on this project's config volume, each with a **Resume** button |
 | **Automation** | The scheduled tasks running inside this container — see [Automation & Scheduled Tasks](#automation--scheduled-tasks) |
 | **Config** | All per-project configuration — see [Project Configuration](#project-configuration) |
-| **Files** | Browse, download and upload files inside the container |
+| **Files** | Browse, view and rename files inside the container, and move files between it and your own machine — see [Files](#files) |
 | **Browser** | Watch — and take over — the browser Claude is driving with Playwright, see [The Browser Tab](#the-browser-tab) |
 
 ### Sessions
@@ -348,7 +351,7 @@ it. The sidebar row carries only the two hover controls.
 | **Force stop** | Project Home header | Starting / Stopping | Interrupts a transition that is stuck |
 | **Open Claude Terminal** | Project Home header; sidebar hover control; `Ctrl+T` | Running | Opens a new Claude Code terminal tab |
 | **Shell** | Project Home header | Running | Opens a bash login shell tab in the container (no Claude Code) |
-| **Files** | Project Home header, and the **Files** tab | Running | Switches to the Files tab to browse, download and upload files |
+| **Files** | Project Home header, and the **Files** tab | Running | Switches to the Files tab to browse, view and rename files inside the container, upload files into it and save one back out |
 | **Config** | The **Config** tab | Always | Per-project configuration (most fields need the container stopped) |
 | **Back up container** | **⋯** overflow menu | A container exists | Saves a `.tar.gz` archive of the container to a location you choose |
 | **Reset container…** | **⋯** overflow menu | Stopped or Error | Destroys the container, snapshot image and both volumes, then recreates from the base image (wipes `~/.claude`) — asks first |
@@ -612,18 +615,27 @@ The **Claude Code settings** editor, also at the bottom of the Config tab, confi
 
 | Setting | What It Does |
 |---------|-------------|
-| **TUI Mode** | Set to **Fullscreen** for flicker-free alt-screen rendering (uses `CLAUDE_CODE_NO_FLICKER=1`) |
-| **Effort Level** | Controls reasoning depth: **Low** (fast, less thorough), **Medium**, **High** (deep reasoning) |
-| **Focus Mode** | Collapses tool output to one-line summaries, showing only the prompt and final response |
-| **Thinking Summaries** | Shows Claude's thinking process as summaries during responses |
-| **Session Recap** | Provides context when returning to a session after being away |
-| **Auto-Scroll Disabled** | Disables auto-scroll when in fullscreen TUI mode |
+| **TUI Mode** | **Automatic** lets Claude Code choose; **Classic** pins the main-screen renderer; **Fullscreen** pins the flicker-free alt-screen one |
+| **Effort Level** | Reasoning depth: **Low**, **Medium**, **High**, **Extra high** |
+| **Focus Mode** | Summarises tool *calls* to one line each, showing the last prompt and the final response. **Needs the fullscreen renderer** — set TUI Mode to Fullscreen or this does nothing |
+| **Thinking Summaries** | Shows Claude's thinking as summaries rather than a collapsed stub |
+| **Session Recap** | A one-line recap when you return to the terminal after a few minutes away. **On by default** — the switch is how you turn it off |
+| **Auto-Scroll** | Follows new output to the bottom in fullscreen rendering. On by default |
 | **Env Scrub** | Strips credentials from subprocess environments for security |
-| **Prompt Caching (1h)** | Enables 1-hour prompt cache TTL instead of the default 5 minutes |
+| **Prompt Caching (1h)** | Requests a 1-hour prompt cache TTL instead of the default 5 minutes |
 
-Per-project settings override global defaults set in Settings. If all settings are at their defaults, no configuration is injected.
+Each switch has three states on a project: **Global** (follow Settings), **On**, and **Off**. Off is a
+real choice — it overrides a global On, which a project could not previously do.
 
-> These settings map to Claude Code environment variables and `~/.claude/settings.json` entries. Changes require stopping and restarting the container to take effect.
+> These map to Claude Code environment variables and `~/.claude/settings.json` keys, and are applied
+> when the container starts. Changing one stops and recreates the container.
+>
+> **Two caveats on an existing project.** Changing any of these recreates the container, and a
+> recreation commits a new image layer — so flipping switches repeatedly costs disk. And
+> **TUI Mode, Effort Level, Focus Mode and Session Recap cannot be returned to Global** until the
+> project's base image is updated: those four are cleared by *removing* a key, and an older image's
+> startup script ignores the instruction to remove it. Update the base image from the project's
+> Overview tab first. The other switches work on any image.
 
 ### MCP Servers
 
@@ -789,6 +801,19 @@ web server they started on `localhost`. `claude login`, `aws sso login` and Conc
 
 The **Auth Bridge** fixes this. It is **opt-in per project** and **off by default**.
 
+### Where the switch is
+
+Project Home → **Config** → **Runtime** → **Auth bridge**.
+
+Unlike the rest of that tab, it is **not** greyed out while the container is running — it is a
+host-side feature that recreates nothing, and the moment you want it is usually the moment a login
+is already hanging in a running container. Switch it on, then retry the login.
+
+Beside the switch is its live state: **Off**, **Watching** (on, nothing to bridge yet — normal,
+there is only something to bridge while a login is waiting), **Bridging *n* ports**, **IPv4 only**,
+or **Port conflict** with the port and the reason. A conflict means the host port was already taken
+and the callback will not arrive; free the port, or use **In container** instead.
+
 ### What it does
 
 - Every couple of seconds it looks inside the container for programs listening on the container's
@@ -1145,14 +1170,61 @@ When you scroll up in the terminal to review previous output, a **Jump to Curren
 
 ### Files
 
-The **Files** tab of Project Home browses inside a running container. You can:
+The **Files** tab of Project Home browses inside a running container, and moves files between it
+and your own machine. You can:
 
-- **Browse** the container filesystem, starting at `/workspace`, with breadcrumb navigation
-- **Download** any file to your host machine via the **Download** button on each file entry
-- **Upload file** from your host into the current container directory
+- **Browse** the container filesystem, starting at `/workspace`, with breadcrumb navigation.
+  Double-click a folder to open it, or the `..` row to go up; the arrow keys, Home and End move
+  between rows and Enter opens the selected one
+- **View** a file — double-click it, or press Enter. Text files and images render in a read-only
+  viewer
+- **Rename** an entry, from the row's Rename button or by pressing `F2`. A rename never moves a
+  file between folders
+- **New folder** in the directory on screen
+- **Upload…**, from the toolbar, to copy files from your machine into the directory on screen
+- **Save to host…**, from a file's own row, to write that one file out to your machine
 - **Refresh** the directory listing at any time
 
-The listing shows file names, sizes, and modification dates.
+The listing shows file names, sizes, and modification dates, and marks symbolic links.
+
+#### Getting files in and out
+
+**Upload…** opens a file dialog on your machine, and whatever you choose is copied into the
+directory currently on screen. Uploaded files arrive owned by you inside the container, not by
+root. You can pick several files in one dialog; each is handled on its own, so if a folder or an
+over-sized file is among them, it is named in the message and the rest still arrive. Uploads are
+capped at **256 MB per file** — for anything larger, mount the folder into the project instead and
+skip the copying altogether.
+
+**Save to host…** does the reverse, for one file: a save dialog opens, you choose where the file
+goes, and it is written there. The button sits on the file's own row, and only on files. For a
+whole directory, use **Back up container** in Project Home's **⋯** overflow menu, which writes a
+`.tar.gz` of the workspace and the container's `~/.claude` config to a location you choose — that
+is still the right tool for a tree.
+
+Dragging a file from your desktop and **dropping it onto the Terminal tab** works too, and is often
+the quickest way in when you are already typing: the file is copied into the container and its path
+is typed into the terminal for you, ready to hand to Claude Code. (The whole terminal pane is a
+drop target, including its *Following* toggle.) The Files pane itself is not a drop target.
+
+Both dialogs are opened by Triple-C itself rather than by the page you are looking at. The page
+cannot name a place on your machine — it can only ask for a dialog — and nothing is read or written
+until you pick somewhere in it. Closing a dialog without choosing is not an error: nothing happens,
+and nothing is said about it.
+
+Every one of these routes refuses a location whose path passes through a hidden *folder* — anything
+with a component beginning with `.`, such as `~/.ssh`, `~/.cache` or `~/.local/share` — or a system
+location, and it checks both the path as written and where it points after any symbolic links. That
+rule catches more than it strictly needs to, so now and then it will refuse a place you genuinely
+meant, `~/.config` among them. The refusal is a plain sentence saying so; choose a visible location
+such as `~/Documents` or `~/Downloads`.
+
+The *file's own name* is a different matter, and dotfiles are fine: `.env`, `.gitignore` and the
+rest save normally, since you chose the name in the save dialog yourself. Only the folders on the
+way are judged.
+
+If you already keep the project in a folder mounted into the container, the simplest answer is
+usually none of the above: edit the file on your host and it is already inside.
 
 ### Terminal Rendering
 
@@ -1198,10 +1270,14 @@ change. Remember that a headless run cannot answer a permission prompt, so in an
 **Bypass** a task may stop early when Claude Code asks for approval; the run log records the mode
 that was used.
 
-### Creating Tasks (In the Container)
+### Creating Tasks
 
-There is no "add task" form in the app. Create tasks from a terminal in the container — either type
-the commands yourself in a **Shell** session, or just ask Claude to do it.
+The quickest route is the **New task** button on a project's **Automation** tab, which gives you a
+form for the name, the schedule and the prompt.
+
+You can also create tasks from a terminal in the container — type the commands yourself in a
+**Shell** session, or just ask Claude to do it. That is the better route when you want Claude to
+work out the schedule or the prompt for you, and it is what the rest of this section covers.
 
 ### Create a Recurring Task
 
@@ -1293,9 +1369,19 @@ triple-c-scheduler add --name "test" --schedule "0 */6 * * *" --prompt "Run test
 | **Ctrl+Shift+V** | Paste |
 | **Ctrl+V** | Paste an image from the clipboard into the container |
 | **Ctrl+Shift+M** | Toggle speech-to-text recording (when enabled) |
+| **Shift+Enter** | Insert a newline in Claude Code's prompt instead of submitting it |
+| **Alt+Enter** | The same thing, and it has always worked — it was simply never written down |
 
 Everything else goes straight through to the program running in the container.
 
+> **Shift+Enter** sends `ESC` + `CR`, the same bytes Claude Code's own `/terminal-setup` installs
+> for VS Code, Cursor, Alacritty and Zed — so there is nothing to run and no tip to follow. It is
+> bound in **Claude** tabs only: in a **bash** tab that sequence means nothing to readline, and
+> Shift+Enter there submits the line as it always has.
+>
+> In the [Web Terminal](#web-terminal-remote-access) the same chord works, and there is an **↵+**
+> key beside **Enter** on the mobile key row for devices with no Shift.
+
 ---
 
 ## What's Inside the Container
@@ -1402,8 +1488,18 @@ your machine (anything that isn't `http`/`https`).
 
 You opened the URL, signed in successfully, and the CLI in the terminal is still waiting. The
 callback from your browser is landing on your host's `localhost` while the CLI is listening on the
-*container's*. Enable the
-[Auth Bridge](#browser-logins-inside-the-container-auth-bridge) for that project and try again.
+*container's*.
+
+Two ways out, in order of least effort:
+
+1. Dismiss and re-trigger the login, then click **In container** on the toast rather than **Open**.
+   The page opens in a browser *inside* the container, so the callback never has to cross to the
+   host. This needs no auth bridge — only a running container with Playwright installed (Project
+   Home → **Browser**). For a recognised Anthropic sign-in link this is already the default button.
+2. Turn on the [Auth Bridge](#browser-logins-inside-the-container-auth-bridge) — Project Home →
+   **Config** → **Runtime** → **Auth bridge** — and try again. It can be switched on while the
+   container is running. Check the indicator beside it: **Port conflict** means the host port was
+   already taken and the callback still will not arrive.
 
 For Claude specifically, the simpler answer is usually
 [Shared Claude Authentication](#shared-claude-authentication), which finishes on an Anthropic-hosted
diff --git a/README.md b/README.md
index 61359a2..a4c17f5 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ This file is the architectural tour: what each subsystem is and why it works the
 - [Permission Modes](#permission-modes)
 - [Containers](#containers) — lifecycle, base-image migration, mounts, CA certificates, sibling containers
 - [Models and Authentication](#models-and-authentication) — backends, model aliases, gateway, shared token
-- [Bridges to the Host](#bridges-to-the-host) — URL relay, auth bridge, browser view
+- [Bridges to the Host](#bridges-to-the-host) — URL relay, auth bridge, browser view, host file transfers
 - [Inside a Project](#inside-a-project) — capability tiles, Mission Control, web terminal, speech-to-text
 - [Key Files](#key-files) · [CSS / Styling Notes](#css--styling-notes) · [Container Image](#container-image)
 
@@ -76,8 +76,21 @@ Implemented in `hooks/useKeyboardShortcuts.ts` (document-level, capture phase):
 
 `Ctrl+W` is deliberately **not** bound: it is readline's `kill-word`, used constantly in the
 terminal this app is built around. Plain `Ctrl+←/→` is readline's word-wise cursor motion, which is
-why moving a tab takes Shift as well. Terminal-scoped keys (`Ctrl+Shift+C`, `Ctrl+Shift+Alt+C`,
-`Ctrl+Shift+M`) are handled in `TerminalView.tsx`.
+why moving a tab takes Shift as well.
+
+Terminal-scoped keys are handled in `TerminalView.tsx`:
+
+| Shortcut | Action |
+|---|---|
+| `Ctrl+Shift+C` / `Ctrl+Shift+Alt+C` | Copy the selection, trimmed / exactly as-is |
+| `Ctrl+Shift+M` | Toggle speech-to-text recording |
+| `Shift+Enter` | Insert a newline in Claude Code's prompt instead of submitting |
+| `Alt+Enter` | The same thing — xterm.js already ESC-prefixes on Alt, so this has always worked |
+
+`Shift+Enter` sends `ESC` + `CR`, which is what Claude Code's own `/terminal-setup` installs for
+VS Code, Cursor, Alacritty and Zed. It is bound in Claude sessions only: in a bash tab those bytes
+are unbound in readline. The web terminal does the same, and adds an `↵+` key beside Enter for
+devices with no Shift.
 
 ### Project Home
 
@@ -92,7 +105,7 @@ configuration. Per-project configuration lives in the Config tab rather than in
 | **Sessions** | Past Claude Code conversations read from the config volume, with **Resume** |
 | **Automation** | The container's `triple-c-scheduler` tasks — create, edit, enable/disable, run now, read logs, remove, and completion notifications |
 | **Config** | Workspace (name, folders), Model (backend), Access (SSH, git, env vars, port mappings), Runtime (permission mode, sandbox, Docker access, Mission Control, instructions, Claude Code settings) |
-| **Files** | Browse, download and upload files inside the container |
+| **Files** | Browse, view, rename and create folders inside the container, upload host files into the directory on screen, and save one file back out to the host — see [Host File Transfers](#host-file-transfers). A whole tree still comes out through **Back up container** |
 | **Browser** | Watch and take over the Playwright browser inside the container — see [Browser View](#browser-view) |
 
 Container start/stop progress is reported inline (on the sidebar row and in the Project Home
@@ -429,6 +442,39 @@ per project.
   binds, but never `@playwright/cli`, which is the viewer. It is what binds sessions automatically
   once Playwright is present — not a setup route.
 
+### Host File Transfers
+
+Four routes move files across the boundary: **Upload…** and the per-row **Save to host…** in the
+Files tab, a file dropped onto the Terminal tab, and **Back up container**. All four share one path
+policy in `commands/file_commands.rs`.
+
+- **The OS dialogs are opened by Rust, not by the webview.** `upload_files_to_container` and
+  `download_container_file` drive `tauri-plugin-dialog` themselves and take nothing but a project
+  id and a container-side path; `FilesTab.tsx` imports no dialog plugin and `useFileManager`'s
+  `uploadFiles` takes no argument at all. The web UI can ask for a dialog, and that is the whole of
+  its influence over where a file comes from or goes — it cannot name a host path as an *input*.
+  This is a boundary rather than a convention: a dialog the page itself opens is only as trustworthy
+  as the page. Be precise about the limit, though — host paths still travel *outward* in error text,
+  canonical ones included, so this closes the inbound direction and not both.
+- **The dialog's pre-filled name is sanitized, because a container authored it.** On Windows the
+  save dialog parses its name box as a path, and a container can name a file
+  `..\..\Users\you\…\Word\STARTUP\x.dotm` — one POSIX segment, so nothing upstream objects.
+  `suggested_save_name` replaces every separator and every character NTFS refuses, so the string
+  cannot be a path on any platform this ships to.
+- **One policy for every host path.** A source or destination whose path passes through a hidden
+  folder (`~/.ssh`, `~/.cache`, `~/.local/share`, anything dot-prefixed) or a system location is
+  refused, and the check is applied both to the path as written and to what it resolves to after
+  symlinks. It over-catches deliberately, so it will occasionally refuse somewhere a person
+  genuinely meant — `~/.config`, say — and the refusal is a sentence naming the folder that tripped
+  it, not an errno.
+- **Uploads are capped at 256 MB per file**; past that the answer is a mount, not a copy. One
+  dialog's selection is handled file by file, so a folder or an oversized file among the selection
+  is reported by name and does not stop the others. Uploaded files land owned by the container user,
+  not root. A cancelled dialog is silent — `Ok(None)`, not an error.
+- **`download_container_file` is one file and files only** — no button on a folder row. A directory
+  is what `download_container_backup` is for. There is no drop target on the Files pane; the
+  Terminal tab keeps the one it has.
+
 ## Inside a Project
 
 ### Container Introspection (Capability Tiles)
@@ -500,12 +546,12 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 | `app/src/components/projects/home/AutomationTab.tsx` | Scheduler tasks: create, toggle, run now, logs, remove, notifications |
 | `app/src/components/projects/home/TaskEditorModal.tsx` | Create/edit a scheduled task; `taskValidation.ts` holds the cron and schedule rules |
 | `app/src/components/projects/home/ConfigTab.tsx` | Config sections (Workspace, Model, Access, Runtime) |
-| `app/src/components/projects/home/FilesTab.tsx` | File browser (browse, download, upload) |
+| `app/src/components/projects/home/FilesTab.tsx` | Container-side file browser (navigate, view, rename, new folder) plus **Upload…** and per-row **Save to host…**; imports no dialog plugin — the dialogs are Rust's |
 | `app/src/components/projects/home/BrowserTab.tsx` | Browser view pane: detect, install, watch, take over, pop out |
 | `app/src/components/projects/home/OpenPageDialog.tsx` | Open a URL in the container's browser at a chosen viewport |
 | `app/src/components/projects/home/ContainerMigrationBanner.tsx` | Base-image staleness banner, migration progress, resume/rollback |
 | `app/src/components/projects/home/CapabilityTiles.tsx` | Read-only skills/agents/commands/hooks/plugins/MCP counts |
-| `app/src/components/projects/ClaudeCodeSettingsEditor.tsx` | Claude Code CLI settings (TUI mode, effort, focus, caching) |
+| `app/src/components/projects/ClaudeCodeSettingsEditor.tsx` | Claude Code CLI settings → `tui`, `effortLevel`, `viewMode`, `autoScrollEnabled`, `showThinkingSummaries`, `awaySummaryEnabled`, plus the env-var flags (scrub, 1h caching). Every managed key is re-emitted on each start, `null` meaning "delete". |
 
 ### Frontend — settings, terminal and hooks
 
@@ -523,7 +569,7 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 | `app/src/hooks/useTerminal.ts` | Terminal session management (claude and bash modes) |
 | `app/src/hooks/useProjectActions.ts` | Start/stop/reset/backup and terminal-opening helpers |
 | `app/src/hooks/useContainerMigration.ts` | Staleness polling, migration run, resume and rollback |
-| `app/src/hooks/useFileManager.ts` | File manager operations (list, download, upload) |
+| `app/src/hooks/useFileManager.ts` | File browser operations (list, navigate, rename, mkdir) and the host transfers (upload, save one file out); never handles a host path |
 | `app/src/hooks/useClaudeAuth.ts` | Shared-token status and acquisition |
 | `app/src/hooks/useSTT.ts` | Speech-to-text recording, transcription, and container management |
 | `app/src/lib/urlRelay.ts` | Host-side relay validation: OSC 7777 parsing, http/https allowlist, rate limiting |
@@ -534,7 +580,7 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 | File | Purpose |
 |---|---|
 | `app/src-tauri/src/docker/container.rs` | Container creation, mounts, env vars, labels, recreation checks, `remove_project_volumes` |
-| `app/src-tauri/src/docker/exec.rs` | `create_attached_exec()` — the single attached-exec path; file upload/download via tar |
+| `app/src-tauri/src/docker/exec.rs` | `create_attached_exec()` — the single attached-exec path; one-shot execs and single-file tar building |
 | `app/src-tauri/src/docker/image.rs` | Image building/pulling |
 | `app/src-tauri/src/docker/migration.rs` | Base-image migration: manifest capture, delta computation, crash-recovery state machine |
 | `app/src-tauri/src/docker/ca_certs.rs` | CA certificate discovery, `.crt` renaming, fingerprinting |
@@ -548,7 +594,7 @@ Triple-C includes optional speech-to-text powered by [Faster Whisper](https://gi
 | `app/src-tauri/src/commands/inspect_commands.rs` | Read-only container views: sessions, capabilities, scheduler tasks |
 | `app/src-tauri/src/commands/auth_token_commands.rs` | `claude setup-token` flow, redaction, keychain storage |
 | `app/src-tauri/src/commands/auth_bridge_commands.rs` | Auth bridge enable/status commands |
-| `app/src-tauri/src/commands/file_commands.rs` | File manager Tauri commands (list, download, upload) |
+| `app/src-tauri/src/commands/file_commands.rs` | Container-side file commands (list, read, rename, mkdir), the host transfers `upload_files_to_container` and `download_container_file` — each opening its own OS dialog here in Rust — plus `download_container_backup`, and the hidden-folder path policy all of them share |
 | `app/src-tauri/src/commands/stt_commands.rs` | STT start/stop/transcribe Tauri commands |
 | `app/src-tauri/src/commands/web_terminal_commands.rs` | Web terminal start/stop/status Tauri commands |
 | `app/src-tauri/src/models/project.rs` | Project struct (backend, `PermissionMode`, Docker access, Claude Code settings, Mission Control, auth bridge, browser view, CA path, shared-token opt-out) |
diff --git a/ROADMAP.md b/ROADMAP.md
index 3b1a8c2..50e8832 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -26,20 +26,35 @@ scheduler, and the fleet view across many projects.
 
 ## Current coverage (v0.3.0)
 
-Triple-C sets exactly five `settings.json` keys, plus a sandbox block:
+Triple-C sets exactly six `settings.json` keys, plus a sandbox block:
 
 | Key | Surfaced as |
 |---|---|
-| `tui` | TUI Mode select (`fullscreen`) |
-| `effort` | Effort Level select (`low`/`medium`/`high`) |
-| `autoScrollEnabled` | Auto-Scroll Disabled toggle |
-| `focusMode` | Focus Mode toggle |
-| `showThinkingSummaries` | Thinking Summaries toggle |
+| `tui` | TUI mode select — unset (Claude Code chooses), `default` (classic renderer), `fullscreen` (flicker-free alt-screen). Three distinct states, not two. |
+| `effortLevel` | Effort level select (`low`/`medium`/`high`/`xhigh`) |
+| `viewMode` | Focus mode toggle, written as `"focus"`. Unset means the user's own `verbose` setting and sticky `/focus` choice still apply. |
+| `autoScrollEnabled` | Auto-scroll toggle. Claude Code's default is `true`, so it is the *off* state that writes `false`. |
+| `showThinkingSummaries` | Thinking summaries toggle (Claude Code default `false`) |
+| `awaySummaryEnabled` | Session recap toggle. Claude Code's recap is **on** by default, so again it is the off state that writes `false`. |
 | `sandbox.*` | Sandbox toggle (`enabled`, `enableWeakerNestedSandbox`, `allowUnsandboxedCommands`) |
 
+Every one of those keys is emitted on **every** start, with a JSON `null` standing for
+"delete this key". `~/.claude/settings.json` sits on the config volume and the entrypoint
+merges into it, so a key merely omitted when its control goes off left the previous
+on-value in place forever.
+
 Plus four env feature flags — `CLAUDE_CODE_NO_FLICKER`, `CLAUDE_CODE_ENABLE_AWAY_SUMMARY`,
 `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB`, `ENABLE_PROMPT_CACHING_1H` — and arbitrary user-set
-`CLAUDE_CODE_*` vars via the Env Vars modal.
+`CLAUDE_CODE_*` vars via the Env Vars modal. The four are written on every container
+create *including* their off value, because `docker commit` bakes a container's env into
+the snapshot image: a value written once would otherwise ride that snapshot into every
+future container. That also makes them Triple-C's to own, so all four are reserved names
+— hand-setting one in the Env Vars modal is skipped with a warning, the same as any other
+`triple-c.*`-managed variable. `CLAUDE_CODE_ENABLE_AWAY_SUMMARY` is what actually enforces
+the recap choice — it takes precedence over `awaySummaryEnabled` *and* over the
+in-container `/config` toggle, so turning the control off sends `0` while leaving it on
+sends an empty value rather than `1`: Triple-C's default must not overrule a `/config`
+choice it never asked about.
 
 Also covered: per-project auth backends (Anthropic OAuth, Bedrock incl. SSO refresh,
 Ollama, OpenAI-compatible), user-level `CLAUDE.md` composition, `claude update` on every
diff --git a/TECHNICAL.md b/TECHNICAL.md
index d33a14d..acf2db1 100644
--- a/TECHNICAL.md
+++ b/TECHNICAL.md
@@ -436,7 +436,7 @@ triple-c/
     │   │   ├── useClaudeAuth.ts   # Shared token status + acquisition
     │   │   ├── useContainerProgress.ts # container-progress events → inline progress
     │   │   ├── useDocker.ts       # Docker status, image build/pull
-    │   │   ├── useFileManager.ts  # File browser operations
+    │   │   ├── useFileManager.ts  # File browser operations + host transfers
     │   │   ├── useInstallHelper.ts # Guided Docker installation
     │   │   ├── useKeyboardShortcuts.ts # Ctrl+T / Ctrl+Shift+W / Ctrl+Tab / Ctrl+1..9
     │   │   ├── useProjectActions.ts # Start/stop/reset/backup, open terminals
@@ -464,7 +464,7 @@ triple-c/
     │       │   │   ├── SessionsTab.tsx   # Past Claude sessions + Resume
     │       │   │   ├── AutomationTab.tsx # Scheduler tasks + notifications
     │       │   │   ├── ConfigTab.tsx     # Config section host
-    │       │   │   ├── FilesTab.tsx      # In-container file browser
+    │       │   │   ├── FilesTab.tsx      # In-container file browser, upload / save to host
     │       │   │   ├── CapabilityTiles.tsx # Read-only capability counts
     │       │   │   ├── format.ts         # Age / size / uptime formatting
     │       │   │   └── config/           # WorkspaceSection, ModelSection,
@@ -504,7 +504,7 @@ triple-c/
             │   ├── auth_token_commands.rs   # claude setup-token flow, redaction, keychain
             │   ├── aws_commands.rs          # AWS profile/region discovery
             │   ├── docker_commands.rs       # Docker status, image ops
-            │   ├── file_commands.rs         # File browser (list/download/upload)
+            │   ├── file_commands.rs         # File browser + host transfers (Rust-opened dialogs)
             │   ├── help_commands.rs         # Serves HOW-TO-USE.md to the Help dialog
             │   ├── inspect_commands.rs      # Sessions, capabilities, scheduler tasks
             │   ├── install_helper_commands.rs # Guided Docker installation
diff --git a/app/package-lock.json b/app/package-lock.json
index b35ded4..5626285 100644
--- a/app/package-lock.json
+++ b/app/package-lock.json
@@ -11,7 +11,6 @@
         "@tauri-apps/api": "^2",
         "@tauri-apps/plugin-dialog": "^2.7.0",
         "@tauri-apps/plugin-opener": "^2.5.3",
-        "@tauri-apps/plugin-store": "^2",
         "@xterm/addon-fit": "^0.10",
         "@xterm/addon-web-links": "^0.12.0",
         "@xterm/addon-webgl": "^0.18",
@@ -2001,15 +2000,6 @@
         "@tauri-apps/api": "^2.8.0"
       }
     },
-    "node_modules/@tauri-apps/plugin-store": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-store/-/plugin-store-2.4.2.tgz",
-      "integrity": "sha512-0ClHS50Oq9HEvLPhNzTNFxbWVOqoAp3dRvtewQBeqfIQ0z5m3JRnOISIn2ZVPCrQC0MyGyhTS9DWhHjpigQE7A==",
-      "license": "MIT OR Apache-2.0",
-      "dependencies": {
-        "@tauri-apps/api": "^2.8.0"
-      }
-    },
     "node_modules/@testing-library/dom": {
       "version": "10.4.1",
       "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
diff --git a/app/package.json b/app/package.json
index 3c02859..229cd9d 100644
--- a/app/package.json
+++ b/app/package.json
@@ -15,7 +15,6 @@
     "@tauri-apps/api": "^2",
     "@tauri-apps/plugin-dialog": "^2.7.0",
     "@tauri-apps/plugin-opener": "^2.5.3",
-    "@tauri-apps/plugin-store": "^2",
     "@xterm/addon-fit": "^0.10",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/addon-webgl": "^0.18",
diff --git a/app/src-tauri/Cargo.lock b/app/src-tauri/Cargo.lock
index 7efb86a..c75619d 100644
--- a/app/src-tauri/Cargo.lock
+++ b/app/src-tauri/Cargo.lock
@@ -1135,7 +1135,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3394,7 +3394,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3743,7 +3743,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4654,22 +4654,6 @@ dependencies = [
  "zbus",
 ]
 
-[[package]]
-name = "tauri-plugin-store"
-version = "2.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca1a8ff83c269b115e98726ffc13f9e548a10161544a92ad121d6d0a96e16ea"
-dependencies = [
- "dunce",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "tauri-runtime"
 version = "2.11.0"
@@ -4782,7 +4766,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5187,7 +5171,6 @@ dependencies = [
  "tauri-build",
  "tauri-plugin-dialog",
  "tauri-plugin-opener",
- "tauri-plugin-store",
  "tokio",
  "tower-http",
  "uuid",
@@ -5689,7 +5672,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/app/src-tauri/Cargo.toml b/app/src-tauri/Cargo.toml
index 67f1ea7..b97b6cb 100644
--- a/app/src-tauri/Cargo.toml
+++ b/app/src-tauri/Cargo.toml
@@ -13,7 +13,6 @@ path = "src/main.rs"
 
 [dependencies]
 tauri = { version = "2", features = ["image-png", "image-ico"] }
-tauri-plugin-store = "2"
 tauri-plugin-dialog = "2"
 tauri-plugin-opener = "2"
 serde = { version = "1", features = ["derive"] }
diff --git a/app/src-tauri/capabilities/default.json b/app/src-tauri/capabilities/default.json
index a6b9a19..fbb9ace 100644
--- a/app/src-tauri/capabilities/default.json
+++ b/app/src-tauri/capabilities/default.json
@@ -1,33 +1,16 @@
 {
   "identifier": "default",
-  "description": "Default capabilities for Triple-C",
+  "description": "Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — verified against tauri 2.11.0's `PLUGINS` table in `build.rs`, not assumed from a plugin's `default` set. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` cannot be narrowed by host. `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist here would delete the feature rather than bound it. What *is* bounded: `opener:default` is not used, so `open_path` and `reveal_item_in_dir` are absent; the scope's two entries restrict the scheme to http/https (`file:`, `mailto:`, `tel:`, `smb:` are all refused by `Scope::is_url_allowed`); and because each entry leaves `app` at its serde default of `Application::Default`, which matches only `with == None`, `openUrl(url, \"/bin/sh\")` is refused — the `with` argument is not a usable exec primitive. The call sites re-validate through `sanitizeRelayUrl` (scheme allowlist, no embedded credentials, length cap) before anything reaches the opener. Accepted residual risk: a compromised webview can make the OS open an attacker-chosen http(s) URL, which is an outbound channel. Recorded here rather than fixed. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.",
   "windows": ["main"],
   "permissions": [
-    "core:default",
-    "core:event:default",
-    "core:event:allow-emit",
     "core:event:allow-listen",
     "core:event:allow-unlisten",
-    "core:event:allow-emit-to",
-    "dialog:default",
+    "core:webview:allow-internal-toggle-devtools",
     "dialog:allow-open",
     "dialog:allow-save",
-    "dialog:allow-message",
-    "dialog:allow-ask",
-    "dialog:allow-confirm",
-    "store:default",
-    "store:allow-get",
-    "store:allow-set",
-    "store:allow-delete",
-    "store:allow-keys",
-    "store:allow-values",
-    "store:allow-entries",
-    "store:allow-length",
-    "store:allow-load",
-    "store:allow-reset",
-    "store:allow-save",
-    "store:allow-clear",
-    "opener:default",
-    "opener:allow-open-url"
+    {
+      "identifier": "opener:allow-open-url",
+      "allow": [{ "url": "http://*" }, { "url": "https://*" }]
+    }
   ]
 }
diff --git a/app/src-tauri/gen/schemas/acl-manifests.json b/app/src-tauri/gen/schemas/acl-manifests.json
index 060cee7..c4a47e8 100644
--- a/app/src-tauri/gen/schemas/acl-manifests.json
+++ b/app/src-tauri/gen/schemas/acl-manifests.json
@@ -1 +1 @@
-{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null},"opener":{"default_permission":{"identifier":"default","description":"This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer","permissions":["allow-open-url","allow-reveal-item-in-dir","allow-default-urls"]},"permissions":{"allow-default-urls":{"identifier":"allow-default-urls","description":"This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.","commands":{"allow":[],"deny":[]},"scope":{"allow":[{"url":"mailto:*"},{"url":"tel:*"},{"url":"http://*"},{"url":"https://*"}]}},"allow-open-path":{"identifier":"allow-open-path","description":"Enables the open_path command without any pre-configured scope.","commands":{"allow":["open_path"],"deny":[]}},"allow-open-url":{"identifier":"allow-open-url","description":"Enables the open_url command without any pre-configured scope.","commands":{"allow":["open_url"],"deny":[]}},"allow-reveal-item-in-dir":{"identifier":"allow-reveal-item-in-dir","description":"Enables the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":["reveal_item_in_dir"],"deny":[]}},"deny-open-path":{"identifier":"deny-open-path","description":"Denies the open_path command without any pre-configured scope.","commands":{"allow":[],"deny":["open_path"]}},"deny-open-url":{"identifier":"deny-open-url","description":"Denies the open_url command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url"]}},"deny-reveal-item-in-dir":{"identifier":"deny-reveal-item-in-dir","description":"Denies the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":[],"deny":["reveal_item_in_dir"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this url with, for example: firefox."},"url":{"description":"A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"},{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this path with, for example: xdg-open."},"path":{"description":"A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"}},"required":["path"],"type":"object"}],"definitions":{"Application":{"anyOf":[{"description":"Open in default application.","type":"null"},{"description":"If true, allow open with any application.","type":"boolean"},{"description":"Allow specific application to open with.","type":"string"}],"description":"Opener scope application."}},"description":"Opener scope entry.","title":"OpenerScopeEntry"}},"store":{"default_permission":{"identifier":"default","description":"This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n","permissions":["allow-load","allow-get-store","allow-set","allow-get","allow-has","allow-delete","allow-clear","allow-reset","allow-keys","allow-values","allow-entries","allow-length","allow-reload","allow-save"]},"permissions":{"allow-clear":{"identifier":"allow-clear","description":"Enables the clear command without any pre-configured scope.","commands":{"allow":["clear"],"deny":[]}},"allow-delete":{"identifier":"allow-delete","description":"Enables the delete command without any pre-configured scope.","commands":{"allow":["delete"],"deny":[]}},"allow-entries":{"identifier":"allow-entries","description":"Enables the entries command without any pre-configured scope.","commands":{"allow":["entries"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-get-store":{"identifier":"allow-get-store","description":"Enables the get_store command without any pre-configured scope.","commands":{"allow":["get_store"],"deny":[]}},"allow-has":{"identifier":"allow-has","description":"Enables the has command without any pre-configured scope.","commands":{"allow":["has"],"deny":[]}},"allow-keys":{"identifier":"allow-keys","description":"Enables the keys command without any pre-configured scope.","commands":{"allow":["keys"],"deny":[]}},"allow-length":{"identifier":"allow-length","description":"Enables the length command without any pre-configured scope.","commands":{"allow":["length"],"deny":[]}},"allow-load":{"identifier":"allow-load","description":"Enables the load command without any pre-configured scope.","commands":{"allow":["load"],"deny":[]}},"allow-reload":{"identifier":"allow-reload","description":"Enables the reload command without any pre-configured scope.","commands":{"allow":["reload"],"deny":[]}},"allow-reset":{"identifier":"allow-reset","description":"Enables the reset command without any pre-configured scope.","commands":{"allow":["reset"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"allow-set":{"identifier":"allow-set","description":"Enables the set command without any pre-configured scope.","commands":{"allow":["set"],"deny":[]}},"allow-values":{"identifier":"allow-values","description":"Enables the values command without any pre-configured scope.","commands":{"allow":["values"],"deny":[]}},"deny-clear":{"identifier":"deny-clear","description":"Denies the clear command without any pre-configured scope.","commands":{"allow":[],"deny":["clear"]}},"deny-delete":{"identifier":"deny-delete","description":"Denies the delete command without any pre-configured scope.","commands":{"allow":[],"deny":["delete"]}},"deny-entries":{"identifier":"deny-entries","description":"Denies the entries command without any pre-configured scope.","commands":{"allow":[],"deny":["entries"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-get-store":{"identifier":"deny-get-store","description":"Denies the get_store command without any pre-configured scope.","commands":{"allow":[],"deny":["get_store"]}},"deny-has":{"identifier":"deny-has","description":"Denies the has command without any pre-configured scope.","commands":{"allow":[],"deny":["has"]}},"deny-keys":{"identifier":"deny-keys","description":"Denies the keys command without any pre-configured scope.","commands":{"allow":[],"deny":["keys"]}},"deny-length":{"identifier":"deny-length","description":"Denies the length command without any pre-configured scope.","commands":{"allow":[],"deny":["length"]}},"deny-load":{"identifier":"deny-load","description":"Denies the load command without any pre-configured scope.","commands":{"allow":[],"deny":["load"]}},"deny-reload":{"identifier":"deny-reload","description":"Denies the reload command without any pre-configured scope.","commands":{"allow":[],"deny":["reload"]}},"deny-reset":{"identifier":"deny-reset","description":"Denies the reset command without any pre-configured scope.","commands":{"allow":[],"deny":["reset"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}},"deny-set":{"identifier":"deny-set","description":"Denies the set command without any pre-configured scope.","commands":{"allow":[],"deny":["set"]}},"deny-values":{"identifier":"deny-values","description":"Denies the values command without any pre-configured scope.","commands":{"allow":[],"deny":["values"]}}},"permission_sets":{},"global_scope_schema":null}}
\ No newline at end of file
+{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-register-listener","description":"Denies the register_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["register_listener"]}},"deny-remove-data-store":{"identifier":"deny-remove-data-store","description":"Denies the remove_data_store command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_data_store"]}},"deny-remove-listener":{"identifier":"deny-remove-listener","description":"Denies the remove_listener command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_listener"]}},"deny-set-app-theme":{"identifier":"deny-set-app-theme","description":"Denies the set_app_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_app_theme"]}},"deny-set-dock-visibility":{"identifier":"deny-set-dock-visibility","description":"Denies the set_dock_visibility command without any pre-configured scope.","commands":{"allow":[],"deny":["set_dock_visibility"]}},"deny-supports-multiple-windows":{"identifier":"deny-supports-multiple-windows","description":"Denies the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["supports_multiple_windows"]}},"deny-tauri-version":{"identifier":"deny-tauri-version","description":"Denies the tauri_version command without any pre-configured scope.","commands":{"allow":[],"deny":["tauri_version"]}},"deny-version":{"identifier":"deny-version","description":"Denies the version command without any pre-configured scope.","commands":{"allow":[],"deny":["version"]}}},"permission_sets":{},"global_scope_schema":null},"core:event":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-listen","allow-unlisten","allow-emit","allow-emit-to"]},"permissions":{"allow-emit":{"identifier":"allow-emit","description":"Enables the emit command without any pre-configured scope.","commands":{"allow":["emit"],"deny":[]}},"allow-emit-to":{"identifier":"allow-emit-to","description":"Enables the emit_to command without any pre-configured scope.","commands":{"allow":["emit_to"],"deny":[]}},"allow-listen":{"identifier":"allow-listen","description":"Enables the listen command without any pre-configured scope.","commands":{"allow":["listen"],"deny":[]}},"allow-unlisten":{"identifier":"allow-unlisten","description":"Enables the unlisten command without any pre-configured scope.","commands":{"allow":["unlisten"],"deny":[]}},"deny-emit":{"identifier":"deny-emit","description":"Denies the emit command without any pre-configured scope.","commands":{"allow":[],"deny":["emit"]}},"deny-emit-to":{"identifier":"deny-emit-to","description":"Denies the emit_to command without any pre-configured scope.","commands":{"allow":[],"deny":["emit_to"]}},"deny-listen":{"identifier":"deny-listen","description":"Denies the listen command without any pre-configured scope.","commands":{"allow":[],"deny":["listen"]}},"deny-unlisten":{"identifier":"deny-unlisten","description":"Denies the unlisten command without any pre-configured scope.","commands":{"allow":[],"deny":["unlisten"]}}},"permission_sets":{},"global_scope_schema":null},"core:image":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-from-bytes","allow-from-path","allow-rgba","allow-size"]},"permissions":{"allow-from-bytes":{"identifier":"allow-from-bytes","description":"Enables the from_bytes command without any pre-configured scope.","commands":{"allow":["from_bytes"],"deny":[]}},"allow-from-path":{"identifier":"allow-from-path","description":"Enables the from_path command without any pre-configured scope.","commands":{"allow":["from_path"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-rgba":{"identifier":"allow-rgba","description":"Enables the rgba command without any pre-configured scope.","commands":{"allow":["rgba"],"deny":[]}},"allow-size":{"identifier":"allow-size","description":"Enables the size command without any pre-configured scope.","commands":{"allow":["size"],"deny":[]}},"deny-from-bytes":{"identifier":"deny-from-bytes","description":"Denies the from_bytes command without any pre-configured scope.","commands":{"allow":[],"deny":["from_bytes"]}},"deny-from-path":{"identifier":"deny-from-path","description":"Denies the from_path command without any pre-configured scope.","commands":{"allow":[],"deny":["from_path"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-rgba":{"identifier":"deny-rgba","description":"Denies the rgba command without any pre-configured scope.","commands":{"allow":[],"deny":["rgba"]}},"deny-size":{"identifier":"deny-size","description":"Denies the size command without any pre-configured scope.","commands":{"allow":[],"deny":["size"]}}},"permission_sets":{},"global_scope_schema":null},"core:menu":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-append","allow-prepend","allow-insert","allow-remove","allow-remove-at","allow-items","allow-get","allow-popup","allow-create-default","allow-set-as-app-menu","allow-set-as-window-menu","allow-text","allow-set-text","allow-is-enabled","allow-set-enabled","allow-set-accelerator","allow-set-as-windows-menu-for-nsapp","allow-set-as-help-menu-for-nsapp","allow-is-checked","allow-set-checked","allow-set-icon"]},"permissions":{"allow-append":{"identifier":"allow-append","description":"Enables the append command without any pre-configured scope.","commands":{"allow":["append"],"deny":[]}},"allow-create-default":{"identifier":"allow-create-default","description":"Enables the create_default command without any pre-configured scope.","commands":{"allow":["create_default"],"deny":[]}},"allow-get":{"identifier":"allow-get","description":"Enables the get command without any pre-configured scope.","commands":{"allow":["get"],"deny":[]}},"allow-insert":{"identifier":"allow-insert","description":"Enables the insert command without any pre-configured scope.","commands":{"allow":["insert"],"deny":[]}},"allow-is-checked":{"identifier":"allow-is-checked","description":"Enables the is_checked command without any pre-configured scope.","commands":{"allow":["is_checked"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-items":{"identifier":"allow-items","description":"Enables the items command without any pre-configured scope.","commands":{"allow":["items"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-popup":{"identifier":"allow-popup","description":"Enables the popup command without any pre-configured scope.","commands":{"allow":["popup"],"deny":[]}},"allow-prepend":{"identifier":"allow-prepend","description":"Enables the prepend command without any pre-configured scope.","commands":{"allow":["prepend"],"deny":[]}},"allow-remove":{"identifier":"allow-remove","description":"Enables the remove command without any pre-configured scope.","commands":{"allow":["remove"],"deny":[]}},"allow-remove-at":{"identifier":"allow-remove-at","description":"Enables the remove_at command without any pre-configured scope.","commands":{"allow":["remove_at"],"deny":[]}},"allow-set-accelerator":{"identifier":"allow-set-accelerator","description":"Enables the set_accelerator command without any pre-configured scope.","commands":{"allow":["set_accelerator"],"deny":[]}},"allow-set-as-app-menu":{"identifier":"allow-set-as-app-menu","description":"Enables the set_as_app_menu command without any pre-configured scope.","commands":{"allow":["set_as_app_menu"],"deny":[]}},"allow-set-as-help-menu-for-nsapp":{"identifier":"allow-set-as-help-menu-for-nsapp","description":"Enables the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_help_menu_for_nsapp"],"deny":[]}},"allow-set-as-window-menu":{"identifier":"allow-set-as-window-menu","description":"Enables the set_as_window_menu command without any pre-configured scope.","commands":{"allow":["set_as_window_menu"],"deny":[]}},"allow-set-as-windows-menu-for-nsapp":{"identifier":"allow-set-as-windows-menu-for-nsapp","description":"Enables the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":["set_as_windows_menu_for_nsapp"],"deny":[]}},"allow-set-checked":{"identifier":"allow-set-checked","description":"Enables the set_checked command without any pre-configured scope.","commands":{"allow":["set_checked"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-text":{"identifier":"allow-set-text","description":"Enables the set_text command without any pre-configured scope.","commands":{"allow":["set_text"],"deny":[]}},"allow-text":{"identifier":"allow-text","description":"Enables the text command without any pre-configured scope.","commands":{"allow":["text"],"deny":[]}},"deny-append":{"identifier":"deny-append","description":"Denies the append command without any pre-configured scope.","commands":{"allow":[],"deny":["append"]}},"deny-create-default":{"identifier":"deny-create-default","description":"Denies the create_default command without any pre-configured scope.","commands":{"allow":[],"deny":["create_default"]}},"deny-get":{"identifier":"deny-get","description":"Denies the get command without any pre-configured scope.","commands":{"allow":[],"deny":["get"]}},"deny-insert":{"identifier":"deny-insert","description":"Denies the insert command without any pre-configured scope.","commands":{"allow":[],"deny":["insert"]}},"deny-is-checked":{"identifier":"deny-is-checked","description":"Denies the is_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["is_checked"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-items":{"identifier":"deny-items","description":"Denies the items command without any pre-configured scope.","commands":{"allow":[],"deny":["items"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-popup":{"identifier":"deny-popup","description":"Denies the popup command without any pre-configured scope.","commands":{"allow":[],"deny":["popup"]}},"deny-prepend":{"identifier":"deny-prepend","description":"Denies the prepend command without any pre-configured scope.","commands":{"allow":[],"deny":["prepend"]}},"deny-remove":{"identifier":"deny-remove","description":"Denies the remove command without any pre-configured scope.","commands":{"allow":[],"deny":["remove"]}},"deny-remove-at":{"identifier":"deny-remove-at","description":"Denies the remove_at command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_at"]}},"deny-set-accelerator":{"identifier":"deny-set-accelerator","description":"Denies the set_accelerator command without any pre-configured scope.","commands":{"allow":[],"deny":["set_accelerator"]}},"deny-set-as-app-menu":{"identifier":"deny-set-as-app-menu","description":"Denies the set_as_app_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_app_menu"]}},"deny-set-as-help-menu-for-nsapp":{"identifier":"deny-set-as-help-menu-for-nsapp","description":"Denies the set_as_help_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_help_menu_for_nsapp"]}},"deny-set-as-window-menu":{"identifier":"deny-set-as-window-menu","description":"Denies the set_as_window_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_window_menu"]}},"deny-set-as-windows-menu-for-nsapp":{"identifier":"deny-set-as-windows-menu-for-nsapp","description":"Denies the set_as_windows_menu_for_nsapp command without any pre-configured scope.","commands":{"allow":[],"deny":["set_as_windows_menu_for_nsapp"]}},"deny-set-checked":{"identifier":"deny-set-checked","description":"Denies the set_checked command without any pre-configured scope.","commands":{"allow":[],"deny":["set_checked"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-text":{"identifier":"deny-set-text","description":"Denies the set_text command without any pre-configured scope.","commands":{"allow":[],"deny":["set_text"]}},"deny-text":{"identifier":"deny-text","description":"Denies the text command without any pre-configured scope.","commands":{"allow":[],"deny":["text"]}}},"permission_sets":{},"global_scope_schema":null},"core:path":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-resolve-directory","allow-resolve","allow-normalize","allow-join","allow-dirname","allow-extname","allow-basename","allow-is-absolute"]},"permissions":{"allow-basename":{"identifier":"allow-basename","description":"Enables the basename command without any pre-configured scope.","commands":{"allow":["basename"],"deny":[]}},"allow-dirname":{"identifier":"allow-dirname","description":"Enables the dirname command without any pre-configured scope.","commands":{"allow":["dirname"],"deny":[]}},"allow-extname":{"identifier":"allow-extname","description":"Enables the extname command without any pre-configured scope.","commands":{"allow":["extname"],"deny":[]}},"allow-is-absolute":{"identifier":"allow-is-absolute","description":"Enables the is_absolute command without any pre-configured scope.","commands":{"allow":["is_absolute"],"deny":[]}},"allow-join":{"identifier":"allow-join","description":"Enables the join command without any pre-configured scope.","commands":{"allow":["join"],"deny":[]}},"allow-normalize":{"identifier":"allow-normalize","description":"Enables the normalize command without any pre-configured scope.","commands":{"allow":["normalize"],"deny":[]}},"allow-resolve":{"identifier":"allow-resolve","description":"Enables the resolve command without any pre-configured scope.","commands":{"allow":["resolve"],"deny":[]}},"allow-resolve-directory":{"identifier":"allow-resolve-directory","description":"Enables the resolve_directory command without any pre-configured scope.","commands":{"allow":["resolve_directory"],"deny":[]}},"deny-basename":{"identifier":"deny-basename","description":"Denies the basename command without any pre-configured scope.","commands":{"allow":[],"deny":["basename"]}},"deny-dirname":{"identifier":"deny-dirname","description":"Denies the dirname command without any pre-configured scope.","commands":{"allow":[],"deny":["dirname"]}},"deny-extname":{"identifier":"deny-extname","description":"Denies the extname command without any pre-configured scope.","commands":{"allow":[],"deny":["extname"]}},"deny-is-absolute":{"identifier":"deny-is-absolute","description":"Denies the is_absolute command without any pre-configured scope.","commands":{"allow":[],"deny":["is_absolute"]}},"deny-join":{"identifier":"deny-join","description":"Denies the join command without any pre-configured scope.","commands":{"allow":[],"deny":["join"]}},"deny-normalize":{"identifier":"deny-normalize","description":"Denies the normalize command without any pre-configured scope.","commands":{"allow":[],"deny":["normalize"]}},"deny-resolve":{"identifier":"deny-resolve","description":"Denies the resolve command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve"]}},"deny-resolve-directory":{"identifier":"deny-resolve-directory","description":"Denies the resolve_directory command without any pre-configured scope.","commands":{"allow":[],"deny":["resolve_directory"]}}},"permission_sets":{},"global_scope_schema":null},"core:resources":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-close"]},"permissions":{"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}}},"permission_sets":{},"global_scope_schema":null},"core:tray":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin, which enables all commands.","permissions":["allow-new","allow-get-by-id","allow-remove-by-id","allow-set-icon","allow-set-menu","allow-set-tooltip","allow-set-title","allow-set-visible","allow-set-temp-dir-path","allow-set-icon-as-template","allow-set-icon-with-as-template","allow-set-show-menu-on-left-click"]},"permissions":{"allow-get-by-id":{"identifier":"allow-get-by-id","description":"Enables the get_by_id command without any pre-configured scope.","commands":{"allow":["get_by_id"],"deny":[]}},"allow-new":{"identifier":"allow-new","description":"Enables the new command without any pre-configured scope.","commands":{"allow":["new"],"deny":[]}},"allow-remove-by-id":{"identifier":"allow-remove-by-id","description":"Enables the remove_by_id command without any pre-configured scope.","commands":{"allow":["remove_by_id"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-icon-as-template":{"identifier":"allow-set-icon-as-template","description":"Enables the set_icon_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_as_template"],"deny":[]}},"allow-set-icon-with-as-template":{"identifier":"allow-set-icon-with-as-template","description":"Enables the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":["set_icon_with_as_template"],"deny":[]}},"allow-set-menu":{"identifier":"allow-set-menu","description":"Enables the set_menu command without any pre-configured scope.","commands":{"allow":["set_menu"],"deny":[]}},"allow-set-show-menu-on-left-click":{"identifier":"allow-set-show-menu-on-left-click","description":"Enables the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":["set_show_menu_on_left_click"],"deny":[]}},"allow-set-temp-dir-path":{"identifier":"allow-set-temp-dir-path","description":"Enables the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":["set_temp_dir_path"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-tooltip":{"identifier":"allow-set-tooltip","description":"Enables the set_tooltip command without any pre-configured scope.","commands":{"allow":["set_tooltip"],"deny":[]}},"allow-set-visible":{"identifier":"allow-set-visible","description":"Enables the set_visible command without any pre-configured scope.","commands":{"allow":["set_visible"],"deny":[]}},"deny-get-by-id":{"identifier":"deny-get-by-id","description":"Denies the get_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["get_by_id"]}},"deny-new":{"identifier":"deny-new","description":"Denies the new command without any pre-configured scope.","commands":{"allow":[],"deny":["new"]}},"deny-remove-by-id":{"identifier":"deny-remove-by-id","description":"Denies the remove_by_id command without any pre-configured scope.","commands":{"allow":[],"deny":["remove_by_id"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-icon-as-template":{"identifier":"deny-set-icon-as-template","description":"Denies the set_icon_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_as_template"]}},"deny-set-icon-with-as-template":{"identifier":"deny-set-icon-with-as-template","description":"Denies the set_icon_with_as_template command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon_with_as_template"]}},"deny-set-menu":{"identifier":"deny-set-menu","description":"Denies the set_menu command without any pre-configured scope.","commands":{"allow":[],"deny":["set_menu"]}},"deny-set-show-menu-on-left-click":{"identifier":"deny-set-show-menu-on-left-click","description":"Denies the set_show_menu_on_left_click command without any pre-configured scope.","commands":{"allow":[],"deny":["set_show_menu_on_left_click"]}},"deny-set-temp-dir-path":{"identifier":"deny-set-temp-dir-path","description":"Denies the set_temp_dir_path command without any pre-configured scope.","commands":{"allow":[],"deny":["set_temp_dir_path"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-tooltip":{"identifier":"deny-set-tooltip","description":"Denies the set_tooltip command without any pre-configured scope.","commands":{"allow":[],"deny":["set_tooltip"]}},"deny-set-visible":{"identifier":"deny-set-visible","description":"Denies the set_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible"]}}},"permission_sets":{},"global_scope_schema":null},"core:webview":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-webviews","allow-webview-position","allow-webview-size","allow-internal-toggle-devtools"]},"permissions":{"allow-clear-all-browsing-data":{"identifier":"allow-clear-all-browsing-data","description":"Enables the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":["clear_all_browsing_data"],"deny":[]}},"allow-create-webview":{"identifier":"allow-create-webview","description":"Enables the create_webview command without any pre-configured scope.","commands":{"allow":["create_webview"],"deny":[]}},"allow-create-webview-window":{"identifier":"allow-create-webview-window","description":"Enables the create_webview_window command without any pre-configured scope.","commands":{"allow":["create_webview_window"],"deny":[]}},"allow-get-all-webviews":{"identifier":"allow-get-all-webviews","description":"Enables the get_all_webviews command without any pre-configured scope.","commands":{"allow":["get_all_webviews"],"deny":[]}},"allow-internal-toggle-devtools":{"identifier":"allow-internal-toggle-devtools","description":"Enables the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":["internal_toggle_devtools"],"deny":[]}},"allow-print":{"identifier":"allow-print","description":"Enables the print command without any pre-configured scope.","commands":{"allow":["print"],"deny":[]}},"allow-reparent":{"identifier":"allow-reparent","description":"Enables the reparent command without any pre-configured scope.","commands":{"allow":["reparent"],"deny":[]}},"allow-set-webview-auto-resize":{"identifier":"allow-set-webview-auto-resize","description":"Enables the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":["set_webview_auto_resize"],"deny":[]}},"allow-set-webview-background-color":{"identifier":"allow-set-webview-background-color","description":"Enables the set_webview_background_color command without any pre-configured scope.","commands":{"allow":["set_webview_background_color"],"deny":[]}},"allow-set-webview-focus":{"identifier":"allow-set-webview-focus","description":"Enables the set_webview_focus command without any pre-configured scope.","commands":{"allow":["set_webview_focus"],"deny":[]}},"allow-set-webview-position":{"identifier":"allow-set-webview-position","description":"Enables the set_webview_position command without any pre-configured scope.","commands":{"allow":["set_webview_position"],"deny":[]}},"allow-set-webview-size":{"identifier":"allow-set-webview-size","description":"Enables the set_webview_size command without any pre-configured scope.","commands":{"allow":["set_webview_size"],"deny":[]}},"allow-set-webview-zoom":{"identifier":"allow-set-webview-zoom","description":"Enables the set_webview_zoom command without any pre-configured scope.","commands":{"allow":["set_webview_zoom"],"deny":[]}},"allow-webview-close":{"identifier":"allow-webview-close","description":"Enables the webview_close command without any pre-configured scope.","commands":{"allow":["webview_close"],"deny":[]}},"allow-webview-hide":{"identifier":"allow-webview-hide","description":"Enables the webview_hide command without any pre-configured scope.","commands":{"allow":["webview_hide"],"deny":[]}},"allow-webview-position":{"identifier":"allow-webview-position","description":"Enables the webview_position command without any pre-configured scope.","commands":{"allow":["webview_position"],"deny":[]}},"allow-webview-show":{"identifier":"allow-webview-show","description":"Enables the webview_show command without any pre-configured scope.","commands":{"allow":["webview_show"],"deny":[]}},"allow-webview-size":{"identifier":"allow-webview-size","description":"Enables the webview_size command without any pre-configured scope.","commands":{"allow":["webview_size"],"deny":[]}},"deny-clear-all-browsing-data":{"identifier":"deny-clear-all-browsing-data","description":"Denies the clear_all_browsing_data command without any pre-configured scope.","commands":{"allow":[],"deny":["clear_all_browsing_data"]}},"deny-create-webview":{"identifier":"deny-create-webview","description":"Denies the create_webview command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview"]}},"deny-create-webview-window":{"identifier":"deny-create-webview-window","description":"Denies the create_webview_window command without any pre-configured scope.","commands":{"allow":[],"deny":["create_webview_window"]}},"deny-get-all-webviews":{"identifier":"deny-get-all-webviews","description":"Denies the get_all_webviews command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_webviews"]}},"deny-internal-toggle-devtools":{"identifier":"deny-internal-toggle-devtools","description":"Denies the internal_toggle_devtools command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_devtools"]}},"deny-print":{"identifier":"deny-print","description":"Denies the print command without any pre-configured scope.","commands":{"allow":[],"deny":["print"]}},"deny-reparent":{"identifier":"deny-reparent","description":"Denies the reparent command without any pre-configured scope.","commands":{"allow":[],"deny":["reparent"]}},"deny-set-webview-auto-resize":{"identifier":"deny-set-webview-auto-resize","description":"Denies the set_webview_auto_resize command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_auto_resize"]}},"deny-set-webview-background-color":{"identifier":"deny-set-webview-background-color","description":"Denies the set_webview_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_background_color"]}},"deny-set-webview-focus":{"identifier":"deny-set-webview-focus","description":"Denies the set_webview_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_focus"]}},"deny-set-webview-position":{"identifier":"deny-set-webview-position","description":"Denies the set_webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_position"]}},"deny-set-webview-size":{"identifier":"deny-set-webview-size","description":"Denies the set_webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_size"]}},"deny-set-webview-zoom":{"identifier":"deny-set-webview-zoom","description":"Denies the set_webview_zoom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_webview_zoom"]}},"deny-webview-close":{"identifier":"deny-webview-close","description":"Denies the webview_close command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_close"]}},"deny-webview-hide":{"identifier":"deny-webview-hide","description":"Denies the webview_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_hide"]}},"deny-webview-position":{"identifier":"deny-webview-position","description":"Denies the webview_position command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_position"]}},"deny-webview-show":{"identifier":"deny-webview-show","description":"Denies the webview_show command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_show"]}},"deny-webview-size":{"identifier":"deny-webview-size","description":"Denies the webview_size command without any pre-configured scope.","commands":{"allow":[],"deny":["webview_size"]}}},"permission_sets":{},"global_scope_schema":null},"core:window":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-get-all-windows","allow-scale-factor","allow-inner-position","allow-outer-position","allow-inner-size","allow-outer-size","allow-is-fullscreen","allow-is-minimized","allow-is-maximized","allow-is-focused","allow-is-decorated","allow-is-resizable","allow-is-maximizable","allow-is-minimizable","allow-is-closable","allow-is-visible","allow-is-enabled","allow-title","allow-current-monitor","allow-primary-monitor","allow-monitor-from-point","allow-available-monitors","allow-cursor-position","allow-theme","allow-is-always-on-top","allow-activity-name","allow-scene-identifier","allow-internal-toggle-maximize"]},"permissions":{"allow-activity-name":{"identifier":"allow-activity-name","description":"Enables the activity_name command without any pre-configured scope.","commands":{"allow":["activity_name"],"deny":[]}},"allow-available-monitors":{"identifier":"allow-available-monitors","description":"Enables the available_monitors command without any pre-configured scope.","commands":{"allow":["available_monitors"],"deny":[]}},"allow-center":{"identifier":"allow-center","description":"Enables the center command without any pre-configured scope.","commands":{"allow":["center"],"deny":[]}},"allow-close":{"identifier":"allow-close","description":"Enables the close command without any pre-configured scope.","commands":{"allow":["close"],"deny":[]}},"allow-create":{"identifier":"allow-create","description":"Enables the create command without any pre-configured scope.","commands":{"allow":["create"],"deny":[]}},"allow-current-monitor":{"identifier":"allow-current-monitor","description":"Enables the current_monitor command without any pre-configured scope.","commands":{"allow":["current_monitor"],"deny":[]}},"allow-cursor-position":{"identifier":"allow-cursor-position","description":"Enables the cursor_position command without any pre-configured scope.","commands":{"allow":["cursor_position"],"deny":[]}},"allow-destroy":{"identifier":"allow-destroy","description":"Enables the destroy command without any pre-configured scope.","commands":{"allow":["destroy"],"deny":[]}},"allow-get-all-windows":{"identifier":"allow-get-all-windows","description":"Enables the get_all_windows command without any pre-configured scope.","commands":{"allow":["get_all_windows"],"deny":[]}},"allow-hide":{"identifier":"allow-hide","description":"Enables the hide command without any pre-configured scope.","commands":{"allow":["hide"],"deny":[]}},"allow-inner-position":{"identifier":"allow-inner-position","description":"Enables the inner_position command without any pre-configured scope.","commands":{"allow":["inner_position"],"deny":[]}},"allow-inner-size":{"identifier":"allow-inner-size","description":"Enables the inner_size command without any pre-configured scope.","commands":{"allow":["inner_size"],"deny":[]}},"allow-internal-toggle-maximize":{"identifier":"allow-internal-toggle-maximize","description":"Enables the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":["internal_toggle_maximize"],"deny":[]}},"allow-is-always-on-top":{"identifier":"allow-is-always-on-top","description":"Enables the is_always_on_top command without any pre-configured scope.","commands":{"allow":["is_always_on_top"],"deny":[]}},"allow-is-closable":{"identifier":"allow-is-closable","description":"Enables the is_closable command without any pre-configured scope.","commands":{"allow":["is_closable"],"deny":[]}},"allow-is-decorated":{"identifier":"allow-is-decorated","description":"Enables the is_decorated command without any pre-configured scope.","commands":{"allow":["is_decorated"],"deny":[]}},"allow-is-enabled":{"identifier":"allow-is-enabled","description":"Enables the is_enabled command without any pre-configured scope.","commands":{"allow":["is_enabled"],"deny":[]}},"allow-is-focused":{"identifier":"allow-is-focused","description":"Enables the is_focused command without any pre-configured scope.","commands":{"allow":["is_focused"],"deny":[]}},"allow-is-fullscreen":{"identifier":"allow-is-fullscreen","description":"Enables the is_fullscreen command without any pre-configured scope.","commands":{"allow":["is_fullscreen"],"deny":[]}},"allow-is-maximizable":{"identifier":"allow-is-maximizable","description":"Enables the is_maximizable command without any pre-configured scope.","commands":{"allow":["is_maximizable"],"deny":[]}},"allow-is-maximized":{"identifier":"allow-is-maximized","description":"Enables the is_maximized command without any pre-configured scope.","commands":{"allow":["is_maximized"],"deny":[]}},"allow-is-minimizable":{"identifier":"allow-is-minimizable","description":"Enables the is_minimizable command without any pre-configured scope.","commands":{"allow":["is_minimizable"],"deny":[]}},"allow-is-minimized":{"identifier":"allow-is-minimized","description":"Enables the is_minimized command without any pre-configured scope.","commands":{"allow":["is_minimized"],"deny":[]}},"allow-is-resizable":{"identifier":"allow-is-resizable","description":"Enables the is_resizable command without any pre-configured scope.","commands":{"allow":["is_resizable"],"deny":[]}},"allow-is-visible":{"identifier":"allow-is-visible","description":"Enables the is_visible command without any pre-configured scope.","commands":{"allow":["is_visible"],"deny":[]}},"allow-maximize":{"identifier":"allow-maximize","description":"Enables the maximize command without any pre-configured scope.","commands":{"allow":["maximize"],"deny":[]}},"allow-minimize":{"identifier":"allow-minimize","description":"Enables the minimize command without any pre-configured scope.","commands":{"allow":["minimize"],"deny":[]}},"allow-monitor-from-point":{"identifier":"allow-monitor-from-point","description":"Enables the monitor_from_point command without any pre-configured scope.","commands":{"allow":["monitor_from_point"],"deny":[]}},"allow-outer-position":{"identifier":"allow-outer-position","description":"Enables the outer_position command without any pre-configured scope.","commands":{"allow":["outer_position"],"deny":[]}},"allow-outer-size":{"identifier":"allow-outer-size","description":"Enables the outer_size command without any pre-configured scope.","commands":{"allow":["outer_size"],"deny":[]}},"allow-primary-monitor":{"identifier":"allow-primary-monitor","description":"Enables the primary_monitor command without any pre-configured scope.","commands":{"allow":["primary_monitor"],"deny":[]}},"allow-request-user-attention":{"identifier":"allow-request-user-attention","description":"Enables the request_user_attention command without any pre-configured scope.","commands":{"allow":["request_user_attention"],"deny":[]}},"allow-scale-factor":{"identifier":"allow-scale-factor","description":"Enables the scale_factor command without any pre-configured scope.","commands":{"allow":["scale_factor"],"deny":[]}},"allow-scene-identifier":{"identifier":"allow-scene-identifier","description":"Enables the scene_identifier command without any pre-configured scope.","commands":{"allow":["scene_identifier"],"deny":[]}},"allow-set-always-on-bottom":{"identifier":"allow-set-always-on-bottom","description":"Enables the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":["set_always_on_bottom"],"deny":[]}},"allow-set-always-on-top":{"identifier":"allow-set-always-on-top","description":"Enables the set_always_on_top command without any pre-configured scope.","commands":{"allow":["set_always_on_top"],"deny":[]}},"allow-set-background-color":{"identifier":"allow-set-background-color","description":"Enables the set_background_color command without any pre-configured scope.","commands":{"allow":["set_background_color"],"deny":[]}},"allow-set-badge-count":{"identifier":"allow-set-badge-count","description":"Enables the set_badge_count command without any pre-configured scope.","commands":{"allow":["set_badge_count"],"deny":[]}},"allow-set-badge-label":{"identifier":"allow-set-badge-label","description":"Enables the set_badge_label command without any pre-configured scope.","commands":{"allow":["set_badge_label"],"deny":[]}},"allow-set-closable":{"identifier":"allow-set-closable","description":"Enables the set_closable command without any pre-configured scope.","commands":{"allow":["set_closable"],"deny":[]}},"allow-set-content-protected":{"identifier":"allow-set-content-protected","description":"Enables the set_content_protected command without any pre-configured scope.","commands":{"allow":["set_content_protected"],"deny":[]}},"allow-set-cursor-grab":{"identifier":"allow-set-cursor-grab","description":"Enables the set_cursor_grab command without any pre-configured scope.","commands":{"allow":["set_cursor_grab"],"deny":[]}},"allow-set-cursor-icon":{"identifier":"allow-set-cursor-icon","description":"Enables the set_cursor_icon command without any pre-configured scope.","commands":{"allow":["set_cursor_icon"],"deny":[]}},"allow-set-cursor-position":{"identifier":"allow-set-cursor-position","description":"Enables the set_cursor_position command without any pre-configured scope.","commands":{"allow":["set_cursor_position"],"deny":[]}},"allow-set-cursor-visible":{"identifier":"allow-set-cursor-visible","description":"Enables the set_cursor_visible command without any pre-configured scope.","commands":{"allow":["set_cursor_visible"],"deny":[]}},"allow-set-decorations":{"identifier":"allow-set-decorations","description":"Enables the set_decorations command without any pre-configured scope.","commands":{"allow":["set_decorations"],"deny":[]}},"allow-set-effects":{"identifier":"allow-set-effects","description":"Enables the set_effects command without any pre-configured scope.","commands":{"allow":["set_effects"],"deny":[]}},"allow-set-enabled":{"identifier":"allow-set-enabled","description":"Enables the set_enabled command without any pre-configured scope.","commands":{"allow":["set_enabled"],"deny":[]}},"allow-set-focus":{"identifier":"allow-set-focus","description":"Enables the set_focus command without any pre-configured scope.","commands":{"allow":["set_focus"],"deny":[]}},"allow-set-focusable":{"identifier":"allow-set-focusable","description":"Enables the set_focusable command without any pre-configured scope.","commands":{"allow":["set_focusable"],"deny":[]}},"allow-set-fullscreen":{"identifier":"allow-set-fullscreen","description":"Enables the set_fullscreen command without any pre-configured scope.","commands":{"allow":["set_fullscreen"],"deny":[]}},"allow-set-icon":{"identifier":"allow-set-icon","description":"Enables the set_icon command without any pre-configured scope.","commands":{"allow":["set_icon"],"deny":[]}},"allow-set-ignore-cursor-events":{"identifier":"allow-set-ignore-cursor-events","description":"Enables the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":["set_ignore_cursor_events"],"deny":[]}},"allow-set-max-size":{"identifier":"allow-set-max-size","description":"Enables the set_max_size command without any pre-configured scope.","commands":{"allow":["set_max_size"],"deny":[]}},"allow-set-maximizable":{"identifier":"allow-set-maximizable","description":"Enables the set_maximizable command without any pre-configured scope.","commands":{"allow":["set_maximizable"],"deny":[]}},"allow-set-min-size":{"identifier":"allow-set-min-size","description":"Enables the set_min_size command without any pre-configured scope.","commands":{"allow":["set_min_size"],"deny":[]}},"allow-set-minimizable":{"identifier":"allow-set-minimizable","description":"Enables the set_minimizable command without any pre-configured scope.","commands":{"allow":["set_minimizable"],"deny":[]}},"allow-set-overlay-icon":{"identifier":"allow-set-overlay-icon","description":"Enables the set_overlay_icon command without any pre-configured scope.","commands":{"allow":["set_overlay_icon"],"deny":[]}},"allow-set-position":{"identifier":"allow-set-position","description":"Enables the set_position command without any pre-configured scope.","commands":{"allow":["set_position"],"deny":[]}},"allow-set-progress-bar":{"identifier":"allow-set-progress-bar","description":"Enables the set_progress_bar command without any pre-configured scope.","commands":{"allow":["set_progress_bar"],"deny":[]}},"allow-set-resizable":{"identifier":"allow-set-resizable","description":"Enables the set_resizable command without any pre-configured scope.","commands":{"allow":["set_resizable"],"deny":[]}},"allow-set-shadow":{"identifier":"allow-set-shadow","description":"Enables the set_shadow command without any pre-configured scope.","commands":{"allow":["set_shadow"],"deny":[]}},"allow-set-simple-fullscreen":{"identifier":"allow-set-simple-fullscreen","description":"Enables the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":["set_simple_fullscreen"],"deny":[]}},"allow-set-size":{"identifier":"allow-set-size","description":"Enables the set_size command without any pre-configured scope.","commands":{"allow":["set_size"],"deny":[]}},"allow-set-size-constraints":{"identifier":"allow-set-size-constraints","description":"Enables the set_size_constraints command without any pre-configured scope.","commands":{"allow":["set_size_constraints"],"deny":[]}},"allow-set-skip-taskbar":{"identifier":"allow-set-skip-taskbar","description":"Enables the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":["set_skip_taskbar"],"deny":[]}},"allow-set-theme":{"identifier":"allow-set-theme","description":"Enables the set_theme command without any pre-configured scope.","commands":{"allow":["set_theme"],"deny":[]}},"allow-set-title":{"identifier":"allow-set-title","description":"Enables the set_title command without any pre-configured scope.","commands":{"allow":["set_title"],"deny":[]}},"allow-set-title-bar-style":{"identifier":"allow-set-title-bar-style","description":"Enables the set_title_bar_style command without any pre-configured scope.","commands":{"allow":["set_title_bar_style"],"deny":[]}},"allow-set-visible-on-all-workspaces":{"identifier":"allow-set-visible-on-all-workspaces","description":"Enables the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":["set_visible_on_all_workspaces"],"deny":[]}},"allow-show":{"identifier":"allow-show","description":"Enables the show command without any pre-configured scope.","commands":{"allow":["show"],"deny":[]}},"allow-start-dragging":{"identifier":"allow-start-dragging","description":"Enables the start_dragging command without any pre-configured scope.","commands":{"allow":["start_dragging"],"deny":[]}},"allow-start-resize-dragging":{"identifier":"allow-start-resize-dragging","description":"Enables the start_resize_dragging command without any pre-configured scope.","commands":{"allow":["start_resize_dragging"],"deny":[]}},"allow-theme":{"identifier":"allow-theme","description":"Enables the theme command without any pre-configured scope.","commands":{"allow":["theme"],"deny":[]}},"allow-title":{"identifier":"allow-title","description":"Enables the title command without any pre-configured scope.","commands":{"allow":["title"],"deny":[]}},"allow-toggle-maximize":{"identifier":"allow-toggle-maximize","description":"Enables the toggle_maximize command without any pre-configured scope.","commands":{"allow":["toggle_maximize"],"deny":[]}},"allow-unmaximize":{"identifier":"allow-unmaximize","description":"Enables the unmaximize command without any pre-configured scope.","commands":{"allow":["unmaximize"],"deny":[]}},"allow-unminimize":{"identifier":"allow-unminimize","description":"Enables the unminimize command without any pre-configured scope.","commands":{"allow":["unminimize"],"deny":[]}},"deny-activity-name":{"identifier":"deny-activity-name","description":"Denies the activity_name command without any pre-configured scope.","commands":{"allow":[],"deny":["activity_name"]}},"deny-available-monitors":{"identifier":"deny-available-monitors","description":"Denies the available_monitors command without any pre-configured scope.","commands":{"allow":[],"deny":["available_monitors"]}},"deny-center":{"identifier":"deny-center","description":"Denies the center command without any pre-configured scope.","commands":{"allow":[],"deny":["center"]}},"deny-close":{"identifier":"deny-close","description":"Denies the close command without any pre-configured scope.","commands":{"allow":[],"deny":["close"]}},"deny-create":{"identifier":"deny-create","description":"Denies the create command without any pre-configured scope.","commands":{"allow":[],"deny":["create"]}},"deny-current-monitor":{"identifier":"deny-current-monitor","description":"Denies the current_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["current_monitor"]}},"deny-cursor-position":{"identifier":"deny-cursor-position","description":"Denies the cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["cursor_position"]}},"deny-destroy":{"identifier":"deny-destroy","description":"Denies the destroy command without any pre-configured scope.","commands":{"allow":[],"deny":["destroy"]}},"deny-get-all-windows":{"identifier":"deny-get-all-windows","description":"Denies the get_all_windows command without any pre-configured scope.","commands":{"allow":[],"deny":["get_all_windows"]}},"deny-hide":{"identifier":"deny-hide","description":"Denies the hide command without any pre-configured scope.","commands":{"allow":[],"deny":["hide"]}},"deny-inner-position":{"identifier":"deny-inner-position","description":"Denies the inner_position command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_position"]}},"deny-inner-size":{"identifier":"deny-inner-size","description":"Denies the inner_size command without any pre-configured scope.","commands":{"allow":[],"deny":["inner_size"]}},"deny-internal-toggle-maximize":{"identifier":"deny-internal-toggle-maximize","description":"Denies the internal_toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["internal_toggle_maximize"]}},"deny-is-always-on-top":{"identifier":"deny-is-always-on-top","description":"Denies the is_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["is_always_on_top"]}},"deny-is-closable":{"identifier":"deny-is-closable","description":"Denies the is_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_closable"]}},"deny-is-decorated":{"identifier":"deny-is-decorated","description":"Denies the is_decorated command without any pre-configured scope.","commands":{"allow":[],"deny":["is_decorated"]}},"deny-is-enabled":{"identifier":"deny-is-enabled","description":"Denies the is_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["is_enabled"]}},"deny-is-focused":{"identifier":"deny-is-focused","description":"Denies the is_focused command without any pre-configured scope.","commands":{"allow":[],"deny":["is_focused"]}},"deny-is-fullscreen":{"identifier":"deny-is-fullscreen","description":"Denies the is_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["is_fullscreen"]}},"deny-is-maximizable":{"identifier":"deny-is-maximizable","description":"Denies the is_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximizable"]}},"deny-is-maximized":{"identifier":"deny-is-maximized","description":"Denies the is_maximized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_maximized"]}},"deny-is-minimizable":{"identifier":"deny-is-minimizable","description":"Denies the is_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimizable"]}},"deny-is-minimized":{"identifier":"deny-is-minimized","description":"Denies the is_minimized command without any pre-configured scope.","commands":{"allow":[],"deny":["is_minimized"]}},"deny-is-resizable":{"identifier":"deny-is-resizable","description":"Denies the is_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["is_resizable"]}},"deny-is-visible":{"identifier":"deny-is-visible","description":"Denies the is_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["is_visible"]}},"deny-maximize":{"identifier":"deny-maximize","description":"Denies the maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["maximize"]}},"deny-minimize":{"identifier":"deny-minimize","description":"Denies the minimize command without any pre-configured scope.","commands":{"allow":[],"deny":["minimize"]}},"deny-monitor-from-point":{"identifier":"deny-monitor-from-point","description":"Denies the monitor_from_point command without any pre-configured scope.","commands":{"allow":[],"deny":["monitor_from_point"]}},"deny-outer-position":{"identifier":"deny-outer-position","description":"Denies the outer_position command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_position"]}},"deny-outer-size":{"identifier":"deny-outer-size","description":"Denies the outer_size command without any pre-configured scope.","commands":{"allow":[],"deny":["outer_size"]}},"deny-primary-monitor":{"identifier":"deny-primary-monitor","description":"Denies the primary_monitor command without any pre-configured scope.","commands":{"allow":[],"deny":["primary_monitor"]}},"deny-request-user-attention":{"identifier":"deny-request-user-attention","description":"Denies the request_user_attention command without any pre-configured scope.","commands":{"allow":[],"deny":["request_user_attention"]}},"deny-scale-factor":{"identifier":"deny-scale-factor","description":"Denies the scale_factor command without any pre-configured scope.","commands":{"allow":[],"deny":["scale_factor"]}},"deny-scene-identifier":{"identifier":"deny-scene-identifier","description":"Denies the scene_identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["scene_identifier"]}},"deny-set-always-on-bottom":{"identifier":"deny-set-always-on-bottom","description":"Denies the set_always_on_bottom command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_bottom"]}},"deny-set-always-on-top":{"identifier":"deny-set-always-on-top","description":"Denies the set_always_on_top command without any pre-configured scope.","commands":{"allow":[],"deny":["set_always_on_top"]}},"deny-set-background-color":{"identifier":"deny-set-background-color","description":"Denies the set_background_color command without any pre-configured scope.","commands":{"allow":[],"deny":["set_background_color"]}},"deny-set-badge-count":{"identifier":"deny-set-badge-count","description":"Denies the set_badge_count command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_count"]}},"deny-set-badge-label":{"identifier":"deny-set-badge-label","description":"Denies the set_badge_label command without any pre-configured scope.","commands":{"allow":[],"deny":["set_badge_label"]}},"deny-set-closable":{"identifier":"deny-set-closable","description":"Denies the set_closable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_closable"]}},"deny-set-content-protected":{"identifier":"deny-set-content-protected","description":"Denies the set_content_protected command without any pre-configured scope.","commands":{"allow":[],"deny":["set_content_protected"]}},"deny-set-cursor-grab":{"identifier":"deny-set-cursor-grab","description":"Denies the set_cursor_grab command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_grab"]}},"deny-set-cursor-icon":{"identifier":"deny-set-cursor-icon","description":"Denies the set_cursor_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_icon"]}},"deny-set-cursor-position":{"identifier":"deny-set-cursor-position","description":"Denies the set_cursor_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_position"]}},"deny-set-cursor-visible":{"identifier":"deny-set-cursor-visible","description":"Denies the set_cursor_visible command without any pre-configured scope.","commands":{"allow":[],"deny":["set_cursor_visible"]}},"deny-set-decorations":{"identifier":"deny-set-decorations","description":"Denies the set_decorations command without any pre-configured scope.","commands":{"allow":[],"deny":["set_decorations"]}},"deny-set-effects":{"identifier":"deny-set-effects","description":"Denies the set_effects command without any pre-configured scope.","commands":{"allow":[],"deny":["set_effects"]}},"deny-set-enabled":{"identifier":"deny-set-enabled","description":"Denies the set_enabled command without any pre-configured scope.","commands":{"allow":[],"deny":["set_enabled"]}},"deny-set-focus":{"identifier":"deny-set-focus","description":"Denies the set_focus command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focus"]}},"deny-set-focusable":{"identifier":"deny-set-focusable","description":"Denies the set_focusable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_focusable"]}},"deny-set-fullscreen":{"identifier":"deny-set-fullscreen","description":"Denies the set_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_fullscreen"]}},"deny-set-icon":{"identifier":"deny-set-icon","description":"Denies the set_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_icon"]}},"deny-set-ignore-cursor-events":{"identifier":"deny-set-ignore-cursor-events","description":"Denies the set_ignore_cursor_events command without any pre-configured scope.","commands":{"allow":[],"deny":["set_ignore_cursor_events"]}},"deny-set-max-size":{"identifier":"deny-set-max-size","description":"Denies the set_max_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_max_size"]}},"deny-set-maximizable":{"identifier":"deny-set-maximizable","description":"Denies the set_maximizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_maximizable"]}},"deny-set-min-size":{"identifier":"deny-set-min-size","description":"Denies the set_min_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_min_size"]}},"deny-set-minimizable":{"identifier":"deny-set-minimizable","description":"Denies the set_minimizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_minimizable"]}},"deny-set-overlay-icon":{"identifier":"deny-set-overlay-icon","description":"Denies the set_overlay_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["set_overlay_icon"]}},"deny-set-position":{"identifier":"deny-set-position","description":"Denies the set_position command without any pre-configured scope.","commands":{"allow":[],"deny":["set_position"]}},"deny-set-progress-bar":{"identifier":"deny-set-progress-bar","description":"Denies the set_progress_bar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_progress_bar"]}},"deny-set-resizable":{"identifier":"deny-set-resizable","description":"Denies the set_resizable command without any pre-configured scope.","commands":{"allow":[],"deny":["set_resizable"]}},"deny-set-shadow":{"identifier":"deny-set-shadow","description":"Denies the set_shadow command without any pre-configured scope.","commands":{"allow":[],"deny":["set_shadow"]}},"deny-set-simple-fullscreen":{"identifier":"deny-set-simple-fullscreen","description":"Denies the set_simple_fullscreen command without any pre-configured scope.","commands":{"allow":[],"deny":["set_simple_fullscreen"]}},"deny-set-size":{"identifier":"deny-set-size","description":"Denies the set_size command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size"]}},"deny-set-size-constraints":{"identifier":"deny-set-size-constraints","description":"Denies the set_size_constraints command without any pre-configured scope.","commands":{"allow":[],"deny":["set_size_constraints"]}},"deny-set-skip-taskbar":{"identifier":"deny-set-skip-taskbar","description":"Denies the set_skip_taskbar command without any pre-configured scope.","commands":{"allow":[],"deny":["set_skip_taskbar"]}},"deny-set-theme":{"identifier":"deny-set-theme","description":"Denies the set_theme command without any pre-configured scope.","commands":{"allow":[],"deny":["set_theme"]}},"deny-set-title":{"identifier":"deny-set-title","description":"Denies the set_title command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title"]}},"deny-set-title-bar-style":{"identifier":"deny-set-title-bar-style","description":"Denies the set_title_bar_style command without any pre-configured scope.","commands":{"allow":[],"deny":["set_title_bar_style"]}},"deny-set-visible-on-all-workspaces":{"identifier":"deny-set-visible-on-all-workspaces","description":"Denies the set_visible_on_all_workspaces command without any pre-configured scope.","commands":{"allow":[],"deny":["set_visible_on_all_workspaces"]}},"deny-show":{"identifier":"deny-show","description":"Denies the show command without any pre-configured scope.","commands":{"allow":[],"deny":["show"]}},"deny-start-dragging":{"identifier":"deny-start-dragging","description":"Denies the start_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_dragging"]}},"deny-start-resize-dragging":{"identifier":"deny-start-resize-dragging","description":"Denies the start_resize_dragging command without any pre-configured scope.","commands":{"allow":[],"deny":["start_resize_dragging"]}},"deny-theme":{"identifier":"deny-theme","description":"Denies the theme command without any pre-configured scope.","commands":{"allow":[],"deny":["theme"]}},"deny-title":{"identifier":"deny-title","description":"Denies the title command without any pre-configured scope.","commands":{"allow":[],"deny":["title"]}},"deny-toggle-maximize":{"identifier":"deny-toggle-maximize","description":"Denies the toggle_maximize command without any pre-configured scope.","commands":{"allow":[],"deny":["toggle_maximize"]}},"deny-unmaximize":{"identifier":"deny-unmaximize","description":"Denies the unmaximize command without any pre-configured scope.","commands":{"allow":[],"deny":["unmaximize"]}},"deny-unminimize":{"identifier":"deny-unminimize","description":"Denies the unminimize command without any pre-configured scope.","commands":{"allow":[],"deny":["unminimize"]}}},"permission_sets":{},"global_scope_schema":null},"dialog":{"default_permission":{"identifier":"default","description":"This permission set configures the types of dialogs\navailable from the dialog plugin.\n\n#### Granted Permissions\n\nAll dialog types are enabled.\n\n\n","permissions":["allow-message","allow-save","allow-open"]},"permissions":{"allow-ask":{"identifier":"allow-ask","description":"Enables the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-confirm":{"identifier":"allow-confirm","description":"Enables the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `allow-message` and will be removed in v3)","commands":{"allow":["message"],"deny":[]}},"allow-message":{"identifier":"allow-message","description":"Enables the message command without any pre-configured scope.","commands":{"allow":["message"],"deny":[]}},"allow-open":{"identifier":"allow-open","description":"Enables the open command without any pre-configured scope.","commands":{"allow":["open"],"deny":[]}},"allow-save":{"identifier":"allow-save","description":"Enables the save command without any pre-configured scope.","commands":{"allow":["save"],"deny":[]}},"deny-ask":{"identifier":"deny-ask","description":"Denies the ask command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-confirm":{"identifier":"deny-confirm","description":"Denies the confirm command without any pre-configured scope. (**DEPRECATED**: This is now an alias to `deny-message` and will be removed in v3)","commands":{"allow":[],"deny":["message"]}},"deny-message":{"identifier":"deny-message","description":"Denies the message command without any pre-configured scope.","commands":{"allow":[],"deny":["message"]}},"deny-open":{"identifier":"deny-open","description":"Denies the open command without any pre-configured scope.","commands":{"allow":[],"deny":["open"]}},"deny-save":{"identifier":"deny-save","description":"Denies the save command without any pre-configured scope.","commands":{"allow":[],"deny":["save"]}}},"permission_sets":{},"global_scope_schema":null},"opener":{"default_permission":{"identifier":"default","description":"This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer","permissions":["allow-open-url","allow-reveal-item-in-dir","allow-default-urls"]},"permissions":{"allow-default-urls":{"identifier":"allow-default-urls","description":"This enables opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application.","commands":{"allow":[],"deny":[]},"scope":{"allow":[{"url":"mailto:*"},{"url":"tel:*"},{"url":"http://*"},{"url":"https://*"}]}},"allow-open-path":{"identifier":"allow-open-path","description":"Enables the open_path command without any pre-configured scope.","commands":{"allow":["open_path"],"deny":[]}},"allow-open-url":{"identifier":"allow-open-url","description":"Enables the open_url command without any pre-configured scope.","commands":{"allow":["open_url"],"deny":[]}},"allow-reveal-item-in-dir":{"identifier":"allow-reveal-item-in-dir","description":"Enables the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":["reveal_item_in_dir"],"deny":[]}},"deny-open-path":{"identifier":"deny-open-path","description":"Denies the open_path command without any pre-configured scope.","commands":{"allow":[],"deny":["open_path"]}},"deny-open-url":{"identifier":"deny-open-url","description":"Denies the open_url command without any pre-configured scope.","commands":{"allow":[],"deny":["open_url"]}},"deny-reveal-item-in-dir":{"identifier":"deny-reveal-item-in-dir","description":"Denies the reveal_item_in_dir command without any pre-configured scope.","commands":{"allow":[],"deny":["reveal_item_in_dir"]}}},"permission_sets":{},"global_scope_schema":{"$schema":"http://json-schema.org/draft-07/schema#","anyOf":[{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this url with, for example: firefox."},"url":{"description":"A URL that can be opened by the webview when using the Opener APIs.\n\nWildcards can be used following the UNIX glob pattern.\n\nExamples:\n\n- \"https://*\" : allows all HTTPS origin\n\n- \"https://*.github.com/tauri-apps/tauri\": allows any subdomain of \"github.com\" with the \"tauri-apps/api\" path\n\n- \"https://myapi.service.com/users/*\": allows access to any URLs that begins with \"https://myapi.service.com/users/\"","type":"string"}},"required":["url"],"type":"object"},{"properties":{"app":{"allOf":[{"$ref":"#/definitions/Application"}],"description":"An application to open this path with, for example: xdg-open."},"path":{"description":"A path that can be opened by the webview when using the Opener APIs.\n\nThe pattern can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$APP`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.","type":"string"}},"required":["path"],"type":"object"}],"definitions":{"Application":{"anyOf":[{"description":"Open in default application.","type":"null"},{"description":"If true, allow open with any application.","type":"boolean"},{"description":"Allow specific application to open with.","type":"string"}],"description":"Opener scope application."}},"description":"Opener scope entry.","title":"OpenerScopeEntry"}}}
\ No newline at end of file
diff --git a/app/src-tauri/gen/schemas/capabilities.json b/app/src-tauri/gen/schemas/capabilities.json
index 5dbd61e..44533eb 100644
--- a/app/src-tauri/gen/schemas/capabilities.json
+++ b/app/src-tauri/gen/schemas/capabilities.json
@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default capabilities for Triple-C","local":true,"windows":["main"],"permissions":["core:default","core:event:default","core:event:allow-emit","core:event:allow-listen","core:event:allow-unlisten","core:event:allow-emit-to","dialog:default","dialog:allow-open","dialog:allow-save","dialog:allow-message","dialog:allow-ask","dialog:allow-confirm","store:default","store:allow-get","store:allow-set","store:allow-delete","store:allow-keys","store:allow-values","store:allow-entries","store:allow-length","store:allow-load","store:allow-reset","store:allow-save","store:allow-clear","opener:default","opener:allow-open-url"]}}
\ No newline at end of file
+{"default":{"identifier":"default","description":"Default capabilities for Triple-C. Every entry here is an IPC command a compromised webview can call directly, so the set is an enumeration of what `app/src` actually invokes — verified against tauri 2.11.0's `PLUGINS` table in `build.rs`, not assumed from a plugin's `default` set. `core:default` in particular is NOT used: it is an alias for `core:{path,event,window,webview,app,image,resources,menu,tray}:default`, and `core:image:default` carries `allow-from-path`, whose handler (`tauri-2.11.0/src/image/plugin.rs:41` → `src/image/mod.rs:96`) is a bare `std::fs::read(path)` with no scope mechanism of any kind. Nothing imports `@tauri-apps/api/image`, so the whole plugin is dropped rather than scoped — there is nothing to scope it with. `core:menu` and `core:tray` are dropped for the same reason (no menu, no tray icon); `core:window` and `core:path` because nothing imports them; `core:resources:allow-close` because no frontend value is a `Resource`; and `core:event`'s `allow-emit`/`allow-emit-to` because the frontend only ever *listens* — every emit in this app originates in Rust. Three notes on what is deliberately kept or accepted: (1) `core:webview:allow-internal-toggle-devtools` is not called by `app/src` at all — it is called by Tauri's own injected `toggle-devtools.js`, which binds Ctrl/Cmd+Shift+I. Both that script and the command behind it are `#[cfg(any(debug_assertions, feature = \"devtools\"))]`, so this grant is a `tauri dev` convenience that does not exist in a release bundle. (2) `opener:allow-open-url` cannot be narrowed by host. `TerminalView`'s `WebLinksAddon` opens links Claude printed inside the container, which are arbitrary by construction, so a host allowlist here would delete the feature rather than bound it. What *is* bounded: `opener:default` is not used, so `open_path` and `reveal_item_in_dir` are absent; the scope's two entries restrict the scheme to http/https (`file:`, `mailto:`, `tel:`, `smb:` are all refused by `Scope::is_url_allowed`); and because each entry leaves `app` at its serde default of `Application::Default`, which matches only `with == None`, `openUrl(url, \"/bin/sh\")` is refused — the `with` argument is not a usable exec primitive. The call sites re-validate through `sanitizeRelayUrl` (scheme allowlist, no embedded credentials, length cap) before anything reaches the opener. Accepted residual risk: a compromised webview can make the OS open an attacker-chosen http(s) URL, which is an outbound channel. Recorded here rather than fixed. (3) `drag:allow-start-drag` is **gone**, together with the OS drag-out it existed for. It could not be scoped — `tauri-plugin-drag` takes the item paths from the caller and has no scope mechanism, so a compromised webview could call `startDrag({ item: ['~/.ssh/id_rsa'] })` against any host path the user can read — and it was carried as an accepted residual risk for one gesture. Drag-out was held back for separate hardening (see branch `hold/disk-and-dragout`) and the plugin is no longer a dependency. Getting a file *out* of a container is either \"Back up container\" on the project's Overview tab, which archives a tree through the Docker API, or the Files tab's per-row \"Save to host…\", which copies one file; getting one *in* is a drop on the Terminal or the Files tab's \"Upload…\". None of the four touches this permission. The Files tab's two are worth separating out here, because they are the only host-path commands in the app whose dialog is opened by **Rust** rather than by the webview — `pick_save_path` and `pick_files_to_upload` in `commands/file_commands.rs` drive `tauri-plugin-dialog` from the backend, so a compromised webview can ask for a picker and nothing more: it cannot name a host path as an *input* to either command. Be precise about the limit of that claim — host paths do still travel outward in error text (`Failed to create /home/j/Documents/x.txt.triple-c-part-1a2b3c4d: Permission denied`), including canonicalized ones, which disclose symlink targets. That is accepted; the app already hands the webview the project paths. What is closed is the direction that mattered — the webview naming where bytes go. That is the shape an earlier revision of this file named as the honest one if the Files tab ever regained host I/O, and it is the shape it regained it in. The `dialog:allow-open` / `dialog:allow-save` grants below are therefore *not* what those two use; they remain for the frontend pickers in Add Project, the Config tab's workspace and access sections, the CA-certificate field and Backup. Two commands still take a host path over IPC as a string — the terminal drop and `download_container_backup` — and for those `validate_host_path` is the boundary rather than defence in depth. This file is the reviewed threat model of record, so keep this census accurate: a stale reference here is worse than none. Note that dragging files *into* the app is unaffected: `dragDropEnabled` and `onDragDropEvent` are core webview behaviour and need no grant. Historical note kept because it is easy to re-introduce: the `store:*` grants were removed — nothing in `app/src` uses `@tauri-apps/plugin-store`, and the plugin's `resolve_store_path` is a `PathBuf::push` against AppData, which `push` discards outright when handed an absolute path, so the grant was an arbitrary host-file read/write primitive (`plugin:store|load` + `set` + `save` on `~/.claude/settings.json` is host code execution). On the CSP side: `app.security.csp` in `tauri.conf.json` covers the shipped bundle, and there is deliberately no `devCsp`. `npm run tauri dev` loads the main document straight from Vite at `build.devUrl` (`http://localhost:1420`), and Tauri only attaches a CSP to documents it serves itself — `protocol/tauri.rs:217` sets the header on `tauri://` assets, and the dev server is proxied through that protocol only when `PROXY_DEV_SERVER`, which is `cfg!(all(dev, mobile))` and therefore false for every desktop build. A `devCsp` here would be inert config that reads as protection, which is worse than its absence. If a CSP in dev is wanted, the only place that can set one is the Vite dev server's own `server.headers` in `app/vite.config.ts`; it is not set today, and dev is not the shipped configuration.","local":true,"windows":["main"],"permissions":["core:event:allow-listen","core:event:allow-unlisten","core:webview:allow-internal-toggle-devtools","dialog:allow-open","dialog:allow-save",{"identifier":"opener:allow-open-url","allow":[{"url":"http://*"},{"url":"https://*"}]}]}}
\ No newline at end of file
diff --git a/app/src-tauri/gen/schemas/desktop-schema.json b/app/src-tauri/gen/schemas/desktop-schema.json
index b6ecf6c..156390b 100644
--- a/app/src-tauri/gen/schemas/desktop-schema.json
+++ b/app/src-tauri/gen/schemas/desktop-schema.json
@@ -2473,180 +2473,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
-          "type": "string",
-          "const": "store:default",
-          "markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
-        },
-        {
-          "description": "Enables the clear command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-clear",
-          "markdownDescription": "Enables the clear command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-delete",
-          "markdownDescription": "Enables the delete command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the entries command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-entries",
-          "markdownDescription": "Enables the entries command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-get",
-          "markdownDescription": "Enables the get command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_store command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-get-store",
-          "markdownDescription": "Enables the get_store command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the has command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-has",
-          "markdownDescription": "Enables the has command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the keys command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-keys",
-          "markdownDescription": "Enables the keys command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the length command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-length",
-          "markdownDescription": "Enables the length command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the load command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-load",
-          "markdownDescription": "Enables the load command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the reload command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-reload",
-          "markdownDescription": "Enables the reload command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the reset command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-reset",
-          "markdownDescription": "Enables the reset command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the save command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-save",
-          "markdownDescription": "Enables the save command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the set command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-set",
-          "markdownDescription": "Enables the set command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the values command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-values",
-          "markdownDescription": "Enables the values command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the clear command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-clear",
-          "markdownDescription": "Denies the clear command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-delete",
-          "markdownDescription": "Denies the delete command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the entries command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-entries",
-          "markdownDescription": "Denies the entries command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-get",
-          "markdownDescription": "Denies the get command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_store command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-get-store",
-          "markdownDescription": "Denies the get_store command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the has command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-has",
-          "markdownDescription": "Denies the has command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the keys command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-keys",
-          "markdownDescription": "Denies the keys command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the length command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-length",
-          "markdownDescription": "Denies the length command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the load command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-load",
-          "markdownDescription": "Denies the load command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the reload command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-reload",
-          "markdownDescription": "Denies the reload command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the reset command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-reset",
-          "markdownDescription": "Denies the reset command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the save command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-save",
-          "markdownDescription": "Denies the save command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the set command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-set",
-          "markdownDescription": "Denies the set command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the values command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-values",
-          "markdownDescription": "Denies the values command without any pre-configured scope."
         }
       ]
     },
diff --git a/app/src-tauri/gen/schemas/linux-schema.json b/app/src-tauri/gen/schemas/linux-schema.json
index b6ecf6c..156390b 100644
--- a/app/src-tauri/gen/schemas/linux-schema.json
+++ b/app/src-tauri/gen/schemas/linux-schema.json
@@ -2473,180 +2473,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
-          "type": "string",
-          "const": "store:default",
-          "markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
-        },
-        {
-          "description": "Enables the clear command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-clear",
-          "markdownDescription": "Enables the clear command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-delete",
-          "markdownDescription": "Enables the delete command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the entries command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-entries",
-          "markdownDescription": "Enables the entries command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-get",
-          "markdownDescription": "Enables the get command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_store command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-get-store",
-          "markdownDescription": "Enables the get_store command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the has command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-has",
-          "markdownDescription": "Enables the has command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the keys command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-keys",
-          "markdownDescription": "Enables the keys command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the length command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-length",
-          "markdownDescription": "Enables the length command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the load command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-load",
-          "markdownDescription": "Enables the load command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the reload command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-reload",
-          "markdownDescription": "Enables the reload command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the reset command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-reset",
-          "markdownDescription": "Enables the reset command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the save command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-save",
-          "markdownDescription": "Enables the save command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the set command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-set",
-          "markdownDescription": "Enables the set command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the values command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:allow-values",
-          "markdownDescription": "Enables the values command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the clear command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-clear",
-          "markdownDescription": "Denies the clear command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-delete",
-          "markdownDescription": "Denies the delete command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the entries command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-entries",
-          "markdownDescription": "Denies the entries command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-get",
-          "markdownDescription": "Denies the get command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_store command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-get-store",
-          "markdownDescription": "Denies the get_store command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the has command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-has",
-          "markdownDescription": "Denies the has command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the keys command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-keys",
-          "markdownDescription": "Denies the keys command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the length command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-length",
-          "markdownDescription": "Denies the length command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the load command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-load",
-          "markdownDescription": "Denies the load command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the reload command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-reload",
-          "markdownDescription": "Denies the reload command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the reset command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-reset",
-          "markdownDescription": "Denies the reset command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the save command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-save",
-          "markdownDescription": "Denies the save command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the set command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-set",
-          "markdownDescription": "Denies the set command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the values command without any pre-configured scope.",
-          "type": "string",
-          "const": "store:deny-values",
-          "markdownDescription": "Denies the values command without any pre-configured scope."
         }
       ]
     },
diff --git a/app/src-tauri/src/auth_bridge/mod.rs b/app/src-tauri/src/auth_bridge/mod.rs
index 3f89ba3..7473cbc 100644
--- a/app/src-tauri/src/auth_bridge/mod.rs
+++ b/app/src-tauri/src/auth_bridge/mod.rs
@@ -82,6 +82,10 @@ pub struct BridgedPort {
     pub family: PortFamily,
     /// RFC 3339 timestamp of when the host listener was bound.
     pub bridged_at: String,
+    /// Set when only the IPv4 half of the host listener could be bound. The
+    /// port still works, but not for a client that insists on `::1` — see
+    /// [`tunnel::PortForward::ipv6_warning`].
+    pub ipv6_warning: Option<String>,
 }
 
 /// A loopback listener that was discovered but could not be bridged.
@@ -132,6 +136,7 @@ impl BridgeState {
                     port: f.port,
                     family: f.family,
                     bridged_at: f.bridged_at.clone(),
+                    ipv6_warning: f.ipv6_warning.clone(),
                 })
                 .collect(),
             conflicts: self
@@ -329,7 +334,10 @@ async fn poll_loop(
             Ok(text) => {
                 exec_failures = 0;
                 let discovered = proc_net::parse_loopback_listeners(&text);
-                let skip = skipped_ports(&project);
+                // Re-read every tick: a project can gain a port mapping and the
+                // gateway/STT/web-terminal ports can be re-pointed while the
+                // bridge is running, and a stale reservation set is a hole.
+                let skip = skipped_ports(&project, &store.list(), &app_settings(&app));
                 if reconcile(&container_id, &discovered, &skip, &state).await {
                     emit_status(&app, &project_id, &state, true).await;
                 }
@@ -372,24 +380,101 @@ async fn poll_loop(
     }
 }
 
-/// Ports Docker already handles for this project. A container port that is
-/// explicitly published has a host-side path already, and the mapping's host
-/// port is a binding we must not fight over.
+/// Every port this project's bridge must not take.
 ///
-/// [`RESERVED_CONTAINER_PORTS`] is folded in as well: those are container
-/// loopback listeners another feature owns and exposes on its own,
-/// authenticated terms.
-fn skipped_ports(project: &crate::models::Project) -> HashSet<u16> {
+/// The bridge's rule is "a container loopback listener on port N becomes an
+/// **unauthenticated** host listener on port N". That is only safe for ports
+/// nothing else on the host owns, so everything that *is* owned has to be
+/// enumerated here. Four sources:
+///
+/// 1. **This project's own published ports** — a container port that Docker
+///    already publishes has a host-side path, and the mapping's host port is a
+///    binding we must not fight over.
+/// 2. **Every other project's published host ports.** The container names the
+///    *host* port, so project A's container listening on 8080 would otherwise
+///    have the bridge bind host 8080 — the port project B publishes on. Only
+///    the host end of another project's mapping is reserved: its container end
+///    is a number inside a different network namespace and means nothing here.
+/// 3. **This app's own host services** — the LiteLLM gateway, the STT sidecar
+///    and the web terminal. All three are off by default and bind on demand, so
+///    first-come would win: a container that binds container-loopback 4000
+///    while the gateway is stopped gets host `127.0.0.1:4000` mirrored to it
+///    within one [`POLL_INTERVAL`], after which the gateway cannot start and
+///    anything on the host dialling 4000 — including *other project
+///    containers*, which reach the gateway by host address — is talking to the
+///    squatting container instead. The web terminal is the worst of the three,
+///    because its access token travels in the URL query. Both the *configured*
+///    port and the shipped default are reserved: the configured one is what the
+///    service will bind next, and the default is what it falls back to for a
+///    fresh profile or a settings file that failed to parse.
+/// 4. [`RESERVED_CONTAINER_PORTS`] and [`RESERVED_HOST_PORTS`] — the
+///    browser-view pane's two ends, which it exposes on its own authenticated
+///    terms.
+///
+/// Pure on purpose: everything it needs is passed in, so the whole reservation
+/// policy is unit-testable without a store, a container or an app handle.
+fn skipped_ports(
+    project: &crate::models::Project,
+    all_projects: &[crate::models::Project],
+    settings: &crate::models::AppSettings,
+) -> HashSet<u16> {
     let mut skip: HashSet<u16> = project
         .port_mappings
         .iter()
         .flat_map(|m| [m.container_port, m.host_port])
         .collect();
+
+    // Other projects: host end only.
+    skip.extend(
+        all_projects
+            .iter()
+            .filter(|p| p.id != project.id)
+            .flat_map(|p| p.port_mappings.iter().map(|m| m.host_port)),
+    );
+
+    skip.extend(app_service_host_ports(settings));
     skip.extend(RESERVED_CONTAINER_PORTS.clone());
     skip.extend(RESERVED_HOST_PORTS.clone());
     skip
 }
 
+/// Current app settings, or defaults if the state is not reachable.
+///
+/// Falling back rather than unwrapping matters: the reservation set is a safety
+/// rail, and a rail that panics the poller when it cannot read its input is
+/// worse than one that falls back to the shipped port numbers — which are what
+/// the services use anyway until someone changes them.
+fn app_settings(app: &AppHandle) -> crate::models::AppSettings {
+    use tauri::Manager;
+    app.try_state::<crate::AppState>()
+        .map(|state| state.settings_store.get())
+        .unwrap_or_default()
+}
+
+/// Host ports this app's own sibling services bind, configured value and
+/// shipped default alike.
+///
+/// Read off the settings models rather than restated as literals here: a
+/// duplicated port number is exactly the kind of constant that drifts silently,
+/// and the failure mode of drift is a reservation that no longer covers the
+/// service it was written for.
+fn app_service_host_ports(settings: &crate::models::AppSettings) -> Vec<u16> {
+    use crate::models::{SttSettings, WebTerminalSettings};
+
+    vec![
+        // LiteLLM gateway (`docker/gateway.rs`).
+        settings.gateway.port,
+        crate::models::default_gateway_port(),
+        // Speech-to-text sidecar (`docker/stt.rs`).
+        settings.stt.port,
+        SttSettings::default().port,
+        // Remote web terminal (`web_terminal/server.rs`) — binds 0.0.0.0, and
+        // its access token is in the URL query.
+        settings.web_terminal.port,
+        WebTerminalSettings::default().port,
+    ]
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Reservations
 // ─────────────────────────────────────────────────────────────────────────────
@@ -586,7 +671,7 @@ async fn emit_status(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::models::{PortMapping, Project, ProjectPath};
+    use crate::models::{AppSettings, PortMapping, Project, ProjectPath};
 
     fn project_with_mappings(mappings: Vec<(u16, u16)>) -> Project {
         let mut p = Project::new(
@@ -607,9 +692,14 @@ mod tests {
         p
     }
 
+    /// The common case: one project, no siblings, stock settings.
+    fn skip_for(project: &Project) -> HashSet<u16> {
+        skipped_ports(project, std::slice::from_ref(project), &AppSettings::default())
+    }
+
     #[test]
     fn ports_already_published_by_docker_are_skipped() {
-        let skip = skipped_ports(&project_with_mappings(vec![(3000, 3000), (8081, 8080)]));
+        let skip = skip_for(&project_with_mappings(vec![(3000, 3000), (8081, 8080)]));
         assert!(skip.contains(&3000));
         // Both ends of an asymmetric mapping are off limits: the container port
         // is already reachable, and the host port is Docker's binding.
@@ -619,20 +709,96 @@ mod tests {
     }
 
     #[test]
-    fn no_mappings_means_nothing_but_the_reserved_ranges_are_skipped() {
-        let skip = skipped_ports(&project_with_mappings(vec![]));
+    fn no_mappings_means_nothing_but_the_reservations_are_skipped() {
+        let settings = AppSettings::default();
+        let project = project_with_mappings(vec![]);
+        let skip = skip_for(&project);
+
+        let mut expected: HashSet<u16> = RESERVED_CONTAINER_PORTS.collect();
+        expected.extend(RESERVED_HOST_PORTS);
+        expected.extend(app_service_host_ports(&settings));
+        assert_eq!(skip, expected);
+
+        // The ranges and the service ports are disjoint, so nothing above is
+        // accidentally counting the same port twice.
         assert_eq!(
             skip.len(),
-            RESERVED_CONTAINER_PORTS.clone().count() + RESERVED_HOST_PORTS.clone().count()
+            RESERVED_CONTAINER_PORTS.clone().count()
+                + RESERVED_HOST_PORTS.clone().count()
+                + 3
         );
     }
 
+    #[test]
+    fn this_apps_own_host_services_are_never_taken() {
+        // The bug this guards: the reserved set used to cover only the
+        // browser-view ranges and this project's own mappings, so a container
+        // binding container-loopback 4000 / 9876 / 7681 while the matching
+        // service was stopped had that port mirrored, unauthenticated, onto the
+        // host — taking the gateway's, the STT sidecar's or the web terminal's
+        // door before they could bind it.
+        let settings = AppSettings::default();
+        let skip = skip_for(&project_with_mappings(vec![]));
+
+        assert!(skip.contains(&settings.gateway.port), "LiteLLM gateway port");
+        assert!(skip.contains(&settings.stt.port), "STT sidecar port");
+        assert!(skip.contains(&settings.web_terminal.port), "web terminal port");
+
+        // The shipped defaults, spelled out once so a change to any of them is
+        // a change to this assertion and not a silent narrowing.
+        assert!(skip.contains(&4000));
+        assert!(skip.contains(&9876));
+        assert!(skip.contains(&7681));
+    }
+
+    #[test]
+    fn a_reconfigured_service_port_is_reserved_alongside_its_default() {
+        let mut settings = AppSettings::default();
+        settings.gateway.port = 4321;
+        settings.stt.port = 9000;
+        settings.web_terminal.port = 8443;
+        let project = project_with_mappings(vec![]);
+        let skip = skipped_ports(&project, std::slice::from_ref(&project), &settings);
+
+        for port in [4321, 9000, 8443] {
+            assert!(skip.contains(&port), "configured port {} should be reserved", port);
+        }
+        // The default stays reserved too: it is what the service falls back to
+        // for a fresh profile or an unparseable settings file, so leaving it
+        // open is leaving the same squat available one restart later.
+        for port in [4000, 9876, 7681] {
+            assert!(skip.contains(&port), "default port {} should be reserved", port);
+        }
+    }
+
+    #[test]
+    fn another_projects_published_host_port_is_not_stolen() {
+        // The container names the *host* port. Without this, project A's
+        // container listening on 8080 takes the host 8080 that project B
+        // publishes on — the bridge wins the race whenever B's container is not
+        // running yet.
+        let mine = project_with_mappings(vec![]);
+        let mut theirs = project_with_mappings(vec![(8080, 3000)]);
+        theirs.id = format!("{}-other", mine.id);
+
+        let skip = skipped_ports(
+            &mine,
+            &[mine.clone(), theirs.clone()],
+            &AppSettings::default(),
+        );
+        assert!(skip.contains(&8080), "another project's host port");
+        // …but not the other project's *container* port: that number lives in a
+        // different network namespace and means nothing on this host, and
+        // reserving it would refuse a legitimate login callback for no reason.
+        assert!(!skip.contains(&3000));
+    }
+
     #[test]
     fn the_browser_views_host_ports_are_never_taken() {
         // The bridge binds *host* ports chosen by the container, so without
         // this it can take the port the browser-view proxy will want later —
         // that pane binds on demand, so first-come would win.
-        let skip = skipped_ports(&project_with_mappings(vec![]));
+        let skip = skip_for(&project_with_mappings(vec![]));
         for port in RESERVED_HOST_PORTS {
             assert!(skip.contains(&port), "host port {} should be reserved", port);
         }
@@ -688,14 +854,14 @@ mod tests {
         // Mirroring these would publish an ungated second door to the
         // Playwright dashboard, which the pane deliberately keeps behind a
         // token-checking listener.
-        let skip = skipped_ports(&project_with_mappings(vec![]));
+        let skip = skip_for(&project_with_mappings(vec![]));
         for port in RESERVED_CONTAINER_PORTS {
             assert!(skip.contains(&port), "port {} should be reserved", port);
         }
         assert!(!skip.contains(&(RESERVED_CONTAINER_PORTS.end() + 1)));
 
         // Reservations coexist with Docker's own published ports.
-        let skip = skipped_ports(&project_with_mappings(vec![(3000, 3000)]));
+        let skip = skip_for(&project_with_mappings(vec![(3000, 3000)]));
         assert!(skip.contains(RESERVED_CONTAINER_PORTS.start()));
         assert!(skip.contains(&3000));
     }
diff --git a/app/src-tauri/src/auth_bridge/tunnel.rs b/app/src-tauri/src/auth_bridge/tunnel.rs
index 0ee6ecf..60c8ff3 100644
--- a/app/src-tauri/src/auth_bridge/tunnel.rs
+++ b/app/src-tauri/src/auth_bridge/tunnel.rs
@@ -13,8 +13,48 @@
 //! The exec plumbing itself is *not* reimplemented here: it comes from
 //! [`crate::docker::exec::create_attached_exec`], the same helper the
 //! interactive terminal sessions are built on.
+//!
+//! ## What the host listener is, and is not
+//!
+//! The listener is **not authenticated**, and cannot be. The port number is
+//! chosen by whatever CLI is logging in, the redirect URL is the provider's, and
+//! nothing in that chain can be taught to present a token — so there is no path
+//! token to add. Anything that can reach `127.0.0.1:<port>` on this host reaches
+//! the container-side listener. That includes **any web page the user has open**,
+//! which can port-scan loopback from script.
+//!
+//! Two things narrow that, and neither is a substitute for the other:
+//!
+//! * The whole feature is opt-in per project, off by default, and only mirrors
+//!   ports while its container is running.
+//! * [`web_request_verdict`] refuses the one case that is unambiguously a web
+//!   page reaching in: a request whose fetch metadata says it is a cross-site
+//!   **sub-resource** (`fetch`, `XMLHttpRequest`, `<img>`, `<script src>`,
+//!   `<iframe>`). Cross-site *navigations* are allowed, because that is exactly
+//!   what an OAuth redirect is.
+//!
+//! The residual risk, stated plainly rather than papered over: a client that
+//! sends no `Sec-Fetch-Site` header at all is not filtered — that is every
+//! non-browser client (which is the point; `curl`, a CLI, the container's own
+//! probe must all still work) but also any browser predating fetch metadata
+//! (Chrome < 76, Firefox < 90, Safari < 16.4). A page can also still reach the
+//! port with a top-level navigation it opens itself (`window.open`), which
+//! carries `Sec-Fetch-Mode: navigate` and is indistinguishable from the redirect
+//! the bridge exists to deliver. And nothing here inspects *what* is behind the
+//! port: if the container has something more interesting than a throwaway OAuth
+//! listener on loopback, a same-machine caller reaches it.
+//!
+//! ## Bounds
+//!
+//! Every accepted connection costs a `docker exec`, and the number of
+//! connections is decided by whoever can reach the port. So each forward caps
+//! concurrent connections ([`MAX_CONNECTIONS`]), refuses a client that opens a
+//! socket and then says nothing ([`FIRST_BYTE_TIMEOUT`], enforced *before* the
+//! exec is created), and drops a connection the container has gone quiet on
+//! ([`IDLE_TIMEOUT`]).
 
 use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr};
+use std::time::Duration;
 
 use bollard::container::LogOutput;
 use futures_util::StreamExt;
@@ -30,6 +70,38 @@ use super::proc_net::PortFamily;
 /// only needs to not be pathological.
 const PUMP_BUF: usize = 16 * 1024;
 
+/// Concurrent connections one forwarded port will carry.
+///
+/// Each one is a `docker exec`, and the client side is anything on the host that
+/// can dial loopback — including a web page in a loop. A login callback is one
+/// connection, occasionally a handful; this is generous for that and still a
+/// bound the engine will not notice.
+const MAX_CONNECTIONS: usize = 16;
+
+/// How long an accepted connection has to send its first byte before it is
+/// dropped, *without* a `docker exec` ever being created for it.
+///
+/// This is a deliberate narrowing of what the bridge carries: a client that
+/// connects and says nothing is not the HTTP OAuth callback this exists for, and
+/// forwarding it costs a container exec for a socket that may never speak. A
+/// server-speaks-first protocol behind a bridged port would be refused by this;
+/// that is the trade, and it is the only protocol shape affected.
+const FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// How long a live connection may go with nothing coming back from the container
+/// before it is torn down. Generous, because a bridged port is not always a
+/// short OAuth callback — but finite, so an abandoned connection cannot pin an
+/// exec forever.
+const IDLE_TIMEOUT: Duration = Duration::from_secs(600);
+
+/// Ceiling on the request head buffered for [`web_request_verdict`]. Real heads
+/// are well under 8 KiB; past this we stop looking and forward what we have.
+const MAX_HEAD: usize = 32 * 1024;
+
+/// How long the rest of a request head has, once the first line has identified
+/// the connection as HTTP. Only a stalled or hostile client reaches it.
+const HEAD_TIMEOUT: Duration = Duration::from_secs(10);
+
 /// Aborts a task when dropped, so a cancelled parent can never leave a detached
 /// child running.
 struct AbortOnDrop(JoinHandle<()>);
@@ -52,6 +124,15 @@ pub struct PortForward {
     pub port: u16,
     pub family: PortFamily,
     pub bridged_at: String,
+    /// Why `[::1]` could not be taken alongside `127.0.0.1`, if it could not.
+    ///
+    /// A half-bound forward is the one failure mode that looks like a success:
+    /// the status says the port is bridged, and a browser that resolves
+    /// `localhost` to `::1` and does not fall back still gets a refused
+    /// connection. It is not a conflict — the IPv4 half really is carrying
+    /// traffic — so it rides along with the port it belongs to and the UI says
+    /// so, rather than being logged at debug where nobody sees it.
+    pub ipv6_warning: Option<String>,
     task: JoinHandle<()>,
 }
 
@@ -86,18 +167,33 @@ impl PortForward {
         // first, so a v4-only host listener would miss those callbacks. This is
         // best-effort: if ::1 is unavailable (no IPv6, or that half is taken)
         // the v4 listener alone still works, so it is not treated as a conflict.
-        let v6 = match TcpListener::bind(SocketAddr::from((Ipv6Addr::LOCALHOST, port))).await {
-            Ok(l) => Some(l),
-            Err(e) => {
-                log::debug!(
-                    "Auth bridge: bound 127.0.0.1:{} but not [::1]:{} ({}) — continuing with IPv4 only",
-                    port,
-                    port,
-                    e
-                );
-                None
-            }
-        };
+        let (v6, ipv6_warning) =
+            match TcpListener::bind(SocketAddr::from((Ipv6Addr::LOCALHOST, port))).await {
+                Ok(l) => (Some(l), None),
+                Err(e) => {
+                    // Warn, not debug. Best-effort is about whether to *fail*,
+                    // not about whether to say anything: on a host where
+                    // `localhost` resolves to `::1` and the client does not
+                    // fall back to IPv4, the callback is refused while the
+                    // bridge reports itself healthy — a silent failure with no
+                    // thread back to this line.
+                    log::warn!(
+                        "Auth bridge: bound 127.0.0.1:{} but not [::1]:{} ({}) — continuing with IPv4 only; \
+                         a client that resolves localhost to ::1 without falling back will not reach it",
+                        port,
+                        port,
+                        e
+                    );
+                    (
+                        None,
+                        Some(format!(
+                            "IPv4 only — [::1]:{} could not be bound ({}). A browser that resolves \
+                             localhost to ::1 without falling back will not reach this port.",
+                            port, e
+                        )),
+                    )
+                }
+            };
 
         let target = family.socat_target(port);
         let task = tokio::spawn(accept_loop(container_id, port, target, v4, v6));
@@ -106,6 +202,7 @@ impl PortForward {
             port,
             family,
             bridged_at: chrono::Utc::now().to_rfc3339(),
+            ipv6_warning,
             task,
         })
     }
@@ -142,6 +239,22 @@ async fn accept_loop(
 
         match accepted {
             Ok((stream, peer)) => {
+                // Reap first, so the cap counts *live* connections rather than
+                // every one this listener has ever accepted.
+                while conns.try_join_next().is_some() {}
+                if conns.len() >= MAX_CONNECTIONS {
+                    // Dropping the stream closes it. Better than queueing: the
+                    // client side is whatever can dial loopback, so a queue is
+                    // just a slower way to run out of execs.
+                    log::warn!(
+                        "Auth bridge: refusing connection from {} to bridged port {} — \
+                         {} concurrent connections already open on it",
+                        peer,
+                        port,
+                        MAX_CONNECTIONS
+                    );
+                    continue;
+                }
                 log::debug!("Auth bridge: connection from {} to bridged port {}", peer, port);
                 let _ = stream.set_nodelay(true);
                 conns.spawn(tunnel_connection(
@@ -170,9 +283,224 @@ async fn accept_optional(
     }
 }
 
-/// Carry one accepted host connection into the container over `socat`.
-async fn tunnel_connection(container_id: String, target: String, stream: TcpStream, port: u16) {
-    tunnel_connection_with_prelude(container_id, target, stream, port, Vec::new()).await
+/// Carry one accepted host connection into the container over `socat`, after
+/// deciding it is not a web page reaching into loopback.
+///
+/// Nothing is forwarded until that decision is made, so a refused request never
+/// reaches the container at all — not even a `docker exec`.
+async fn tunnel_connection(container_id: String, target: String, mut stream: TcpStream, port: u16) {
+    let head = match read_leading_bytes(&mut stream).await {
+        Ok(head) => head,
+        Err(e) => {
+            log::debug!(
+                "Auth bridge: dropping connection to bridged port {} before forwarding: {}",
+                port,
+                e
+            );
+            return;
+        }
+    };
+
+    if let LeadingBytes::HttpRequest { buffer, head_len } = &head {
+        // Authorize against the head slice only. Parsing past the blank line is
+        // how a request *body* gets read as headers — a cross-site `fetch` with
+        // a `text/plain` body is not preflighted, so it can put any line it
+        // likes in there.
+        let head_text = String::from_utf8_lossy(&buffer[..*head_len]);
+        if web_request_verdict(&head_text) == Verdict::RefuseCrossSite {
+            log::warn!(
+                "Auth bridge: refused a cross-site sub-resource request to bridged port {} — \
+                 a web page, not a login redirect",
+                port
+            );
+            let _ = refuse(&mut stream).await;
+            return;
+        }
+    }
+
+    // The bytes already off the socket go back on the wire first, byte-exact.
+    tunnel_connection_with_prelude(container_id, target, stream, port, head.into_buffer()).await
+}
+
+/// What the first bytes of an accepted connection turned out to be.
+enum LeadingBytes {
+    /// An HTTP request whose head we have in full. `head_len` is one past the
+    /// blank line; `buffer` may hold pipelined body bytes beyond it.
+    HttpRequest { buffer: Vec<u8>, head_len: usize },
+    /// Not HTTP, or HTTP we gave up on reading. Forwarded verbatim, ungated.
+    Opaque(Vec<u8>),
+}
+
+impl LeadingBytes {
+    fn into_buffer(self) -> Vec<u8> {
+        match self {
+            LeadingBytes::HttpRequest { buffer, .. } => buffer,
+            LeadingBytes::Opaque(buffer) => buffer,
+        }
+    }
+}
+
+/// Read just enough of the connection to classify it, without consuming
+/// anything the caller cannot replay.
+///
+/// Bails out to [`LeadingBytes::Opaque`] the moment the first line proves this
+/// is not HTTP, so a non-HTTP protocol pays one line of latency and no more.
+/// The only hard failure is silence: a client that sends nothing within
+/// [`FIRST_BYTE_TIMEOUT`] is dropped before an exec is spent on it.
+async fn read_leading_bytes(stream: &mut TcpStream) -> Result<LeadingBytes, String> {
+    let mut buf: Vec<u8> = Vec::with_capacity(1024);
+    let mut chunk = [0u8; 1024];
+    let mut deadline = tokio::time::Instant::now() + FIRST_BYTE_TIMEOUT;
+
+    loop {
+        let n = match tokio::time::timeout_at(deadline, stream.read(&mut chunk)).await {
+            Ok(Ok(0)) if buf.is_empty() => {
+                return Err("closed before sending anything".to_string())
+            }
+            // A half-close after some bytes is legitimate; forward what we have.
+            Ok(Ok(0)) => return Ok(LeadingBytes::Opaque(buf)),
+            Ok(Ok(n)) => n,
+            Ok(Err(e)) => return Err(format!("read failed: {}", e)),
+            Err(_) if buf.is_empty() => {
+                return Err(format!(
+                    "sent nothing within {}s",
+                    FIRST_BYTE_TIMEOUT.as_secs()
+                ))
+            }
+            // Bytes arrived but the head never finished. Fail open: this is a
+            // gate on top of the bridge, not the bridge's reason to exist.
+            Err(_) => return Ok(LeadingBytes::Opaque(buf)),
+        };
+        buf.extend_from_slice(&chunk[..n]);
+
+        // Once the first line is complete we know whether to keep reading.
+        if let Some(eol) = buf.iter().position(|b| *b == b'\n') {
+            if !is_http_request_line(&buf[..eol]) {
+                return Ok(LeadingBytes::Opaque(buf));
+            }
+            deadline = deadline.max(tokio::time::Instant::now() + HEAD_TIMEOUT);
+        } else if buf.len() > MAX_HEAD {
+            return Ok(LeadingBytes::Opaque(buf));
+        }
+
+        if let Some(head_len) = find_head_end(&buf) {
+            return Ok(LeadingBytes::HttpRequest {
+                buffer: buf,
+                head_len,
+            });
+        }
+        if buf.len() > MAX_HEAD {
+            return Ok(LeadingBytes::Opaque(buf));
+        }
+    }
+}
+
+/// Whether a first line looks like `METHOD target HTTP/1.x`.
+fn is_http_request_line(line: &[u8]) -> bool {
+    let line = String::from_utf8_lossy(line);
+    let line = line.trim_end_matches(['\r', '\n']);
+    let mut parts = line.split(' ');
+    let (Some(method), Some(target), Some(version), None) =
+        (parts.next(), parts.next(), parts.next(), parts.next())
+    else {
+        return false;
+    };
+    !method.is_empty()
+        && method.chars().all(|c| c.is_ascii_uppercase())
+        && !target.is_empty()
+        && (version == "HTTP/1.1" || version == "HTTP/1.0")
+}
+
+/// Index just past the blank line terminating an HTTP head, if it has arrived.
+/// Tolerates a bare-LF terminator, which some minimal clients still emit.
+fn find_head_end(buf: &[u8]) -> Option<usize> {
+    buf.windows(4)
+        .position(|w| w == b"\r\n\r\n")
+        .map(|i| i + 4)
+        .or_else(|| buf.windows(2).position(|w| w == b"\n\n").map(|i| i + 2))
+}
+
+/// Tell a refused caller why, then close. Plain text and `Connection: close` —
+/// there is no session here to keep alive.
+async fn refuse(stream: &mut TcpStream) -> std::io::Result<()> {
+    const BODY: &str = "This port is bridged from a container by Triple-C for a sign-in \
+                        callback. It is not an API for web pages to call.\n";
+    let response = format!(
+        "HTTP/1.1 403 Forbidden\r\n\
+         Content-Type: text/plain; charset=utf-8\r\n\
+         Content-Length: {}\r\n\
+         Cache-Control: no-store\r\n\
+         Connection: close\r\n\r\n{}",
+        BODY.len(),
+        BODY
+    );
+    stream.write_all(response.as_bytes()).await?;
+    stream.shutdown().await
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// The gate — pure, so it can be tested without sockets
+// ─────────────────────────────────────────────────────────────────────────────
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Verdict {
+    /// Forward it. Either it is not a browser, or the browser says this is a
+    /// navigation or a same-origin request.
+    Allow,
+    /// Fetch metadata says a document on another site pulled this in as a
+    /// sub-resource. No login flow looks like that.
+    RefuseCrossSite,
+}
+
+/// Decide whether an HTTP request head arriving on a bridged port may be
+/// forwarded into the container.
+///
+/// Deliberately fail-open — see the module docs for exactly what that leaves
+/// uncovered. The only refusal is the case with no innocent reading:
+/// `Sec-Fetch-Site` says another site, and `Sec-Fetch-Mode` says this is not a
+/// navigation. `Sec-Fetch-*` are forbidden header names, so page script cannot
+/// set or clear them.
+pub(crate) fn web_request_verdict(head: &str) -> Verdict {
+    let mut lines = head.split(['\r', '\n']).filter(|l| !l.is_empty());
+    // Skip the request line.
+    if lines.next().is_none() {
+        return Verdict::Allow;
+    }
+
+    let mut site: Option<&str> = None;
+    let mut mode: Option<&str> = None;
+    for line in lines {
+        let Some((name, value)) = line.split_once(':') else {
+            continue;
+        };
+        let value = value.trim();
+        match name.trim().to_ascii_lowercase().as_str() {
+            // A duplicate of either header is header smuggling, not a client.
+            // Refuse rather than pick a winner: last-occurrence-wins is what
+            // turns a smuggling primitive into a bypass.
+            "sec-fetch-site" if site.is_some() => return Verdict::RefuseCrossSite,
+            "sec-fetch-mode" if mode.is_some() => return Verdict::RefuseCrossSite,
+            "sec-fetch-site" => site = Some(value),
+            "sec-fetch-mode" => mode = Some(value),
+            _ => {}
+        }
+    }
+
+    let Some(site) = site else {
+        // No fetch metadata: a CLI, `curl`, or a browser old enough not to send
+        // it. Not something this gate can judge.
+        return Verdict::Allow;
+    };
+    if site.eq_ignore_ascii_case("same-origin") || site.eq_ignore_ascii_case("none") {
+        return Verdict::Allow;
+    }
+    // `navigate` is precisely the OAuth redirect: the provider sends the browser
+    // to `http://localhost:<port>/callback`, cross-site, as a document load.
+    // Refusing it would refuse the feature.
+    if mode.is_none_or(|m| m.eq_ignore_ascii_case("navigate")) {
+        return Verdict::Allow;
+    }
+    Verdict::RefuseCrossSite
 }
 
 /// As [`tunnel_connection`], but `prelude` is written into the container first,
@@ -225,21 +553,36 @@ pub async fn tunnel_connection_with_prelude(
         }
         let mut buf = vec![0u8; PUMP_BUF];
         loop {
-            match host_rx.read(&mut buf).await {
-                Ok(0) => break,
-                Ok(n) => {
+            // Idle-bounded. Without this a client that connects, sends a
+            // request and then never speaks or closes holds the exec open for
+            // as long as the container runs.
+            match tokio::time::timeout(IDLE_TIMEOUT, host_rx.read(&mut buf)).await {
+                Ok(Ok(0)) | Err(_) => break,
+                Ok(Ok(n)) => {
                     if input.write_all(&buf[..n]).await.is_err() || input.flush().await.is_err() {
                         break;
                     }
                 }
-                Err(_) => break,
+                Ok(Err(_)) => break,
             }
         }
     }));
 
     // Container → host. This direction is authoritative: when the exec's output
-    // stream ends, socat has exited and the connection is over.
-    while let Some(chunk) = output.next().await {
+    // stream ends, socat has exited and the connection is over. It is also the
+    // one that decides the connection is dead: nothing back from the container
+    // for `IDLE_TIMEOUT` tears the whole thing down, exec included.
+    while let Some(chunk) = match tokio::time::timeout(IDLE_TIMEOUT, output.next()).await {
+        Ok(chunk) => chunk,
+        Err(_) => {
+            log::debug!(
+                "Auth bridge: bridged port {} idle for {}s — closing the tunnel",
+                port,
+                IDLE_TIMEOUT.as_secs()
+            );
+            None
+        }
+    } {
         match chunk {
             // Only stdout is payload. The exec is created with tty = false
             // precisely so Docker demultiplexes these, keeping socat's stderr
@@ -268,3 +611,218 @@ pub async fn tunnel_connection_with_prelude(
     // Explicit: stop reading from the host now that the container side is gone.
     drop(upstream);
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn head(lines: &[&str]) -> String {
+        format!("{}\r\n\r\n", lines.join("\r\n"))
+    }
+
+    #[test]
+    fn a_cli_callback_with_no_fetch_metadata_is_forwarded() {
+        // The overwhelmingly common case, and the reason the gate fails open:
+        // `curl`, a CLI's own probe, and anything not a browser send none of
+        // these headers, and none of them can be judged from the wire.
+        let verdict = web_request_verdict(&head(&[
+            "GET /callback?code=abc HTTP/1.1",
+            "Host: localhost:41733",
+            "User-Agent: curl/8.5.0",
+        ]));
+        assert_eq!(verdict, Verdict::Allow);
+    }
+
+    #[test]
+    fn the_oauth_redirect_is_forwarded_even_though_it_is_cross_site() {
+        // This is the feature. The provider bounces the browser to
+        // `http://localhost:<port>/callback`, which is cross-site and a
+        // navigation. Refusing it would refuse every login the bridge exists
+        // for.
+        for site in ["cross-site", "same-site"] {
+            let verdict = web_request_verdict(&head(&[
+                "GET /callback?code=abc&state=xyz HTTP/1.1",
+                "Host: localhost:41733",
+                &format!("Sec-Fetch-Site: {}", site),
+                "Sec-Fetch-Mode: navigate",
+                "Sec-Fetch-Dest: document",
+            ]));
+            assert_eq!(verdict, Verdict::Allow, "site={}", site);
+        }
+    }
+
+    #[test]
+    fn a_form_post_callback_is_forwarded() {
+        // `response_mode=form_post` providers POST the callback as a
+        // navigation. Still a navigation, still allowed.
+        let verdict = web_request_verdict(&head(&[
+            "POST /callback HTTP/1.1",
+            "Host: localhost:41733",
+            "Origin: https://login.microsoftonline.com",
+            "Sec-Fetch-Site: cross-site",
+            "Sec-Fetch-Mode: navigate",
+        ]));
+        assert_eq!(verdict, Verdict::Allow);
+    }
+
+    #[test]
+    fn a_cross_site_subresource_from_a_web_page_is_refused() {
+        // The case the gate exists for: a page the user happens to have open
+        // scanning loopback and poking whatever answers.
+        for mode in ["cors", "no-cors", "same-origin", "websocket"] {
+            let verdict = web_request_verdict(&head(&[
+                "GET /admin HTTP/1.1",
+                "Host: 127.0.0.1:41733",
+                "Origin: https://evil.example",
+                "Sec-Fetch-Site: cross-site",
+                &format!("Sec-Fetch-Mode: {}", mode),
+            ]));
+            assert_eq!(verdict, Verdict::RefuseCrossSite, "mode={}", mode);
+        }
+    }
+
+    #[test]
+    fn the_containers_own_same_origin_requests_are_forwarded() {
+        let verdict = web_request_verdict(&head(&[
+            "GET /style.css HTTP/1.1",
+            "Host: localhost:41733",
+            "Sec-Fetch-Site: same-origin",
+            "Sec-Fetch-Mode: no-cors",
+        ]));
+        assert_eq!(verdict, Verdict::Allow);
+        // `none` is a user-initiated load — typed URL, bookmark.
+        let verdict = web_request_verdict(&head(&[
+            "GET / HTTP/1.1",
+            "Host: localhost:41733",
+            "Sec-Fetch-Site: none",
+            "Sec-Fetch-Mode: navigate",
+        ]));
+        assert_eq!(verdict, Verdict::Allow);
+    }
+
+    #[test]
+    fn duplicated_fetch_metadata_is_refused_rather_than_resolved() {
+        // Last-occurrence-wins is what turns any header-smuggling primitive
+        // into a bypass, and no real client sends two.
+        let verdict = web_request_verdict(&head(&[
+            "GET /x HTTP/1.1",
+            "Sec-Fetch-Site: cross-site",
+            "Sec-Fetch-Mode: cors",
+            "Sec-Fetch-Site: same-origin",
+        ]));
+        assert_eq!(verdict, Verdict::RefuseCrossSite);
+    }
+
+    #[test]
+    fn only_the_head_is_ever_judged() {
+        // A cross-site `text/plain` POST is not preflighted, so its *body* is
+        // fully attacker-chosen. `tunnel_connection` slices at the blank line
+        // before calling in; this pins that the slice is what gets judged.
+        let raw = "POST /x HTTP/1.1\r\n\
+                   Sec-Fetch-Site: cross-site\r\n\
+                   Sec-Fetch-Mode: cors\r\n\
+                   Content-Type: text/plain\r\n\r\n\
+                   Sec-Fetch-Site: same-origin\r\n";
+        let head_len = find_head_end(raw.as_bytes()).expect("head terminator");
+        let head = &raw[..head_len];
+        assert!(!head.contains("same-origin"), "the forged line must be past the slice");
+        assert_eq!(web_request_verdict(head), Verdict::RefuseCrossSite);
+
+        // And if the slice were ever got wrong, the duplicate rule is the
+        // backstop: a forged `Sec-Fetch-*` line is by construction a second
+        // copy of one the browser already sent, which is refused outright
+        // rather than resolved in the forgery's favour.
+        assert_eq!(web_request_verdict(raw), Verdict::RefuseCrossSite);
+    }
+
+    #[test]
+    fn a_non_http_first_line_is_never_treated_as_a_request() {
+        // Bridged ports are not all HTTP. Anything whose first line is not a
+        // request line is forwarded verbatim rather than parsed.
+        assert!(!is_http_request_line(b"\x16\x03\x01\x02\x00\x01"));
+        assert!(!is_http_request_line(b"*1\r"));
+        assert!(!is_http_request_line(b"SSH-2.0-OpenSSH_9.6"));
+        assert!(!is_http_request_line(b"GET /x HTTP/2.0"));
+        assert!(!is_http_request_line(b"get /x HTTP/1.1"));
+        assert!(is_http_request_line(b"GET /x HTTP/1.1\r"));
+        assert!(is_http_request_line(b"POST /callback?code=a%20b HTTP/1.0"));
+    }
+
+    #[test]
+    fn head_end_is_found_for_both_terminators() {
+        assert_eq!(find_head_end(b"GET / HTTP/1.1\r\n\r\nBODY"), Some(18));
+        assert_eq!(find_head_end(b"GET / HTTP/1.1\n\nBODY"), Some(16));
+        assert_eq!(find_head_end(b"GET / HTTP/1.1\r\nHost: x\r\n"), None);
+    }
+
+    #[tokio::test]
+    async fn a_client_that_says_nothing_never_costs_a_container_exec() {
+        // Every accepted connection would otherwise spawn a `docker exec`
+        // immediately, so silence was free for the caller and expensive here.
+        let listener = TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)))
+            .await
+            .expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        let accept = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            read_leading_bytes(&mut stream).await
+        });
+
+        let _client = TcpStream::connect(addr).await.expect("connect");
+        let started = tokio::time::Instant::now();
+        let result = accept.await.expect("join");
+
+        assert!(result.is_err(), "silence should not be forwarded");
+        assert!(
+            started.elapsed() >= FIRST_BYTE_TIMEOUT,
+            "should have waited out the first-byte grace period"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_non_http_client_is_classified_from_its_first_line_alone() {
+        let listener = TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)))
+            .await
+            .expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        let accept = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            read_leading_bytes(&mut stream).await
+        });
+
+        let mut client = TcpStream::connect(addr).await.expect("connect");
+        client.write_all(b"SSH-2.0-OpenSSH_9.6\r\n").await.expect("write");
+
+        let result = accept.await.expect("join").expect("classified");
+        // Verbatim, and without waiting for a head terminator that will never
+        // come — the whole buffer is replayed into the tunnel.
+        assert!(matches!(result, LeadingBytes::Opaque(_)));
+        assert_eq!(result.into_buffer(), b"SSH-2.0-OpenSSH_9.6\r\n");
+    }
+
+    #[tokio::test]
+    async fn an_http_head_is_read_whole_and_replayed_whole() {
+        let listener = TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, 0)))
+            .await
+            .expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        let accept = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            read_leading_bytes(&mut stream).await
+        });
+
+        let raw = b"POST /callback HTTP/1.1\r\nHost: localhost\r\nContent-Length: 4\r\n\r\ncode";
+        let mut client = TcpStream::connect(addr).await.expect("connect");
+        client.write_all(raw).await.expect("write");
+
+        let result = accept.await.expect("join").expect("classified");
+        match &result {
+            LeadingBytes::HttpRequest { buffer, head_len } => {
+                assert_eq!(&buffer[*head_len..], b"code", "body must survive the peek");
+                assert!(!buffer[..*head_len].ends_with(b"code"));
+            }
+            LeadingBytes::Opaque(_) => panic!("should have been recognised as HTTP"),
+        }
+        assert_eq!(result.into_buffer(), raw.to_vec());
+    }
+}
diff --git a/app/src-tauri/src/browser_view/mod.rs b/app/src-tauri/src/browser_view/mod.rs
index adac57c..b816749 100644
--- a/app/src-tauri/src/browser_view/mod.rs
+++ b/app/src-tauri/src/browser_view/mod.rs
@@ -304,21 +304,7 @@ impl BrowserViewManager {
         // a container with no dashboard makes this a no-op.
         let _ = kill_dashboard(&container_id, &cli_entry).await;
 
-        let container_port = pick_viewer_port(&container_id).await?;
-        launch_viewer(&container_id, &cli_entry, container_port).await?;
-
-        // Wait for it to actually answer, and learn the entry URL while we're
-        // there — see `probe_entry_path` for why that matters. This, not the
-        // launcher's stdout, is the readiness signal: verified that the
-        // "Listening on …" line is printed only on the very first start.
-        let entry_path = match wait_until_ready(&container_id, container_port).await {
-            Ok(path) => path,
-            Err(e) => {
-                let log = read_viewer_log(&container_id).await;
-                let _ = kill_dashboard(&container_id, &cli_entry).await;
-                return Err(explain_start_failure(&e, &log));
-            }
-        };
+        let (container_port, entry_path) = start_viewer(&container_id, &cli_entry).await?;
 
         let token = generate_token();
         // `--host 127.0.0.1` is ours to set, so the family is known and there is
@@ -601,12 +587,91 @@ async fn read_viewer_log(container_id: &str) -> String {
 // Readiness, ports, URLs
 // ─────────────────────────────────────────────────────────────────────────────
 
-/// First port in [`VIEWER_PORTS`] that nothing in the container is listening on.
-async fn pick_viewer_port(container_id: &str) -> Result<u16, String> {
+/// How many free ports a start will try before giving up.
+///
+/// More than one because port choice is a check-then-bind: the free list comes
+/// from a snapshot of the container's `/proc/net/tcp`, and anything in the
+/// container may bind the port we picked before the dashboard gets to it. One
+/// retry per lost race is the recovery; the cap is what stops a container that
+/// binds every candidate from holding a start open for
+/// `MAX_PORT_ATTEMPTS × READY_TIMEOUT`.
+const MAX_PORT_ATTEMPTS: usize = 3;
+
+/// Get a viewer listening inside the container and return the port it is on
+/// plus the path the pane should load.
+///
+/// ## The check/bind race
+///
+/// [`pick_viewer_port`] reads a *snapshot* of container listeners; the dashboard
+/// binds some milliseconds later. Nothing here can make that atomic — the bind
+/// happens in another process, in another namespace, and `playwright-cli show`
+/// reports the port it actually took only on a first-ever start (see
+/// [`wait_until_ready`]). What is possible is to stop treating the first
+/// candidate as the only one: if the port we picked does not come up, walk to
+/// the next free candidate rather than failing the whole start.
+///
+/// Residual, stated rather than glossed: a container-side process that binds the
+/// candidate port *and answers HTTP* is indistinguishable from the dashboard at
+/// this layer, and the pane would then front it. What contains that is
+/// downstream — the host proxy is loopback-only and token-gated, and the pane's
+/// iframe is sandboxed — not this function.
+async fn start_viewer(container_id: &str, cli_entry: &str) -> Result<(u16, String), String> {
+    let mut tried: Vec<u16> = Vec::new();
+    let mut last: Option<String> = None;
+
+    for _ in 0..MAX_PORT_ATTEMPTS {
+        // Re-read the listener snapshot each attempt: the port that was free a
+        // moment ago is exactly the one we may have just lost.
+        let port = match pick_viewer_port(container_id, &tried).await {
+            Ok(p) => p,
+            Err(e) => {
+                // Report why the *attempts* failed, not just "nothing free":
+                // the exhausted range is the symptom, the last start failure is
+                // the thing the user can act on.
+                return Err(match last {
+                    Some(prev) => format!("{} ({})", e, prev),
+                    None => e,
+                });
+            }
+        };
+        tried.push(port);
+
+        launch_viewer(container_id, cli_entry, port).await?;
+
+        // Wait for it to actually answer, and learn the entry URL while we're
+        // there — see `probe_entry_path` for why that matters. This, not the
+        // launcher's stdout, is the readiness signal: verified that the
+        // "Listening on …" line is printed only on the very first start.
+        match wait_until_ready(container_id, port).await {
+            Ok(path) => return Ok((port, path)),
+            Err(e) => {
+                let log = read_viewer_log(container_id).await;
+                // Always kill before retrying: the dashboard is a singleton, so
+                // a launcher that came up on some *other* port would otherwise
+                // make every further attempt a no-op that silently ignores the
+                // port we asked for.
+                let _ = kill_dashboard(container_id, cli_entry).await;
+                last = Some(explain_start_failure(&e, &log));
+            }
+        }
+    }
+
+    Err(last.unwrap_or_else(|| "The Playwright viewer did not start.".to_string()))
+}
+
+/// First port in [`VIEWER_PORTS`] that nothing in the container is listening on
+/// and that this start has not already tried.
+async fn pick_viewer_port(container_id: &str, tried: &[u16]) -> Result<u16, String> {
     let text = exec_oneshot(
         container_id,
         vec![
-            "cat".to_string(),
+            // Absolute path, deliberately, for the same reason the auth bridge
+            // uses one: `container/Dockerfile` puts a container-writable
+            // directory first on `PATH`, so a bare `cat` is a name the container
+            // can rebind to a shim. A shimmed listener list is a shimmed answer
+            // to "which port is free" — i.e. the container choosing which port
+            // the viewer, and therefore the host-side proxy, ends up on.
+            "/usr/bin/cat".to_string(),
             "/proc/net/tcp".to_string(),
             "/proc/net/tcp6".to_string(),
         ],
@@ -616,7 +681,7 @@ async fn pick_viewer_port(container_id: &str) -> Result<u16, String> {
     let taken = proc_net::parse_loopback_listeners(&text);
     VIEWER_PORTS
         .clone()
-        .find(|p| !taken.contains_key(p))
+        .find(|p| !taken.contains_key(p) && !tried.contains(p))
         .ok_or_else(|| {
             format!(
                 "No free port in {}–{} inside the container for the Playwright viewer.",
diff --git a/app/src-tauri/src/commands/auth_token_commands.rs b/app/src-tauri/src/commands/auth_token_commands.rs
index 3ecc730..c50a10c 100644
--- a/app/src-tauri/src/commands/auth_token_commands.rs
+++ b/app/src-tauri/src/commands/auth_token_commands.rs
@@ -1188,16 +1188,53 @@ pub async fn has_claude_token() -> Result<bool, String> {
     Ok(secure::has_claude_oauth_token())
 }
 
-/// What [`clear_claude_token`] managed to reach. The keychain entry is always
-/// gone by the time this is returned — the rest is about copies of the token
-/// that live outside it.
-#[derive(Debug, Default, serde::Serialize)]
+/// The tail of every refusal [`crate::project_lock::try_acquire`] produces.
+///
+/// [`crate::docker::container::scrub_secrets_from_snapshots`] folds two very
+/// different things into one `failed` list: an image that genuinely could not
+/// be rewritten, and one that was never *attempted* because another operation
+/// held the project. Only the second is retryable, and only the second should
+/// be described to the user as "come back in a minute" rather than "reset this
+/// project". Splitting them needs a discriminator, and the refusal string is
+/// the only one that crosses the module boundary — `try_acquire` returns
+/// `Result<ProjectGuard, String>`, and `container.rs` pushes that `String`
+/// through unchanged.
+///
+/// Matching on prose is normally a mistake, so this is pinned by
+/// [`tests::a_real_lock_refusal_is_recognised_as_retryable`], which builds a
+/// refusal by actually taking a guard rather than by copying the wording. If
+/// `project_lock` ever rephrases, that test fails instead of this silently
+/// misclassifying a credential that was left in place.
+const PROJECT_BUSY_MARKER: &str = "Wait for it to finish before ";
+
+/// Whether a scrub failure means "somebody else has this project right now",
+/// which is transient, rather than "this image cannot be rewritten", which is
+/// not. Nothing bollard returns contains [`PROJECT_BUSY_MARKER`].
+fn is_project_busy_refusal(reason: &str) -> bool {
+    reason.contains(PROJECT_BUSY_MARKER)
+}
+
+/// What a cleanup managed to reach. Every field is about copies of the token
+/// that live *outside* the keychain — snapshot images — so the same shape
+/// serves [`clear_claude_token`], where the keychain entry is already gone by
+/// the time this is returned, and [`sweep_claude_token_snapshots`], where the
+/// keychain was never touched.
+///
+/// Three lists rather than one, because "we rewrote it", "we could not rewrite
+/// it" and "we did not try" are three different things to tell somebody who
+/// just revoked a credential, and only the last one is fixed by waiting.
+#[derive(Debug, Default, PartialEq, Eq, serde::Serialize)]
 pub struct ClearTokenOutcome {
     /// Snapshot images that were holding the token and have been rewritten.
     pub snapshots_scrubbed: Vec<String>,
     /// Images still holding it, with the reason each could not be rewritten.
     /// Non-empty means the revocation is **incomplete** and the UI must say so.
     pub snapshots_failed: Vec<String>,
+    /// Images still holding it that were **not attempted**, because another
+    /// operation held the project (a start, a compaction, a migration). Also an
+    /// incomplete revocation — but a retryable one, and the UI must not offer
+    /// "Reset the project" as the remedy for it.
+    pub snapshots_skipped: Vec<String>,
     /// Rewritten, but the pre-rewrite image object could not be deleted because
     /// a container is still running off it. Worth mentioning, not worth
     /// alarming about — see `SnapshotScrubReport::superseded_retained`.
@@ -1207,7 +1244,130 @@ pub struct ClearTokenOutcome {
     pub docker_unavailable: Option<String>,
 }
 
-/// Forget the shared Claude token.
+impl ClearTokenOutcome {
+    /// Whether a copy of the credential is known — or suspected — to still be
+    /// reachable, so the caller should offer to run the sweep again.
+    ///
+    /// `snapshots_superseded` is deliberately not counted: that image is
+    /// untagged, nothing new is built from it, and it goes away on the next
+    /// restart. Re-running would report it forever and train the user to
+    /// ignore the warning.
+    pub fn needs_another_pass(&self) -> bool {
+        !self.snapshots_failed.is_empty()
+            || !self.snapshots_skipped.is_empty()
+            || self.docker_unavailable.is_some()
+    }
+}
+
+/// Fold a scrub report into the IPC shape, splitting the busy projects out of
+/// the failures. Separate from the command so it can be tested without Docker.
+fn summarise_scrub(report: crate::docker::container::SnapshotScrubReport) -> ClearTokenOutcome {
+    let mut outcome = ClearTokenOutcome {
+        snapshots_scrubbed: report.scrubbed,
+        snapshots_superseded: report.superseded_retained,
+        docker_unavailable: report.unavailable,
+        ..Default::default()
+    };
+    for (image, reason) in report.failed {
+        let line = format!("{}: {}", image, reason);
+        if is_project_busy_refusal(&reason) {
+            outcome.snapshots_skipped.push(line);
+        } else {
+            outcome.snapshots_failed.push(line);
+        }
+    }
+    outcome
+}
+
+/// Which halves of a cleanup to run.
+///
+/// The distinction has to exist **on the wire**, not in a toast string. The UI
+/// offers a "Retry snapshot cleanup" button after an incomplete revocation, and
+/// while [`clear_claude_token`] was the only command behind it that button was
+/// a *second revoke* wearing a retry's label: it deleted the keychain entry
+/// unconditionally, with no confirmation, in a panel that survived the user
+/// re-authenticating from the button directly above it. Pressing it then threw
+/// away the token they had just acquired and said only that some images had
+/// been checked.
+///
+/// [`Cleanup::ImagesOnly`] is the honest primitive the retry actually wanted:
+/// the images are the durable record of what is left to do, so re-deriving the
+/// work from Docker needs no keychain entry and must not consume one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Cleanup {
+    /// Delete the keychain entry, then rewrite the images. What "Revoke" does,
+    /// behind its confirmation modal.
+    KeychainThenImages,
+    /// Rewrite the images and leave the keychain entirely alone. What "Retry
+    /// snapshot cleanup" and "Check snapshot images" do.
+    ImagesOnly,
+}
+
+/// The body of both cleanup commands, with its two halves injected so the
+/// *order* — and the fact that [`Cleanup::ImagesOnly`] never reaches the
+/// keychain at all — can be tested without a keychain or a Docker daemon.
+async fn run_cleanup<K, S, F>(
+    what: Cleanup,
+    delete_keychain: K,
+    sweep: S,
+) -> Result<ClearTokenOutcome, String>
+where
+    K: FnOnce() -> Result<(), String>,
+    S: FnOnce() -> F,
+    F: std::future::Future<Output = crate::docker::container::SnapshotScrubReport>,
+{
+    let revoking = what == Cleanup::KeychainThenImages;
+
+    if revoking {
+        // First, and before anything slow — see "Why the keychain goes first".
+        // Nothing has been touched if this fails, so the error is the whole
+        // answer: the caller still has its Revoke button, and the standalone
+        // sweep is available for the images regardless.
+        if let Err(e) = delete_keychain() {
+            log::error!(
+                "Could not delete the shared Claude token from the keychain; no snapshot image \
+                 was touched: {}",
+                e
+            );
+            return Err(e);
+        }
+        log::info!("Cleared the shared Claude authentication token from the keychain");
+    }
+
+    let report = sweep().await;
+    let swept_clean = !report.left_something_behind();
+    let outcome = summarise_scrub(report);
+
+    let lead = if revoking {
+        "Revoked the shared Claude token but"
+    } else {
+        "Swept the snapshot images but"
+    };
+    for image in &outcome.snapshots_failed {
+        log::warn!("{} could not clear it from {}", lead, image);
+    }
+    for image in &outcome.snapshots_skipped {
+        log::warn!(
+            "{} left it in {} — the project was busy; running the snapshot sweep again will retry",
+            lead,
+            image
+        );
+    }
+    if let Some(ref reason) = outcome.docker_unavailable {
+        log::warn!("{} checked no snapshot image at all: {}", lead, reason);
+    }
+    if swept_clean && !outcome.needs_another_pass() {
+        log::info!(
+            "No snapshot image is still holding the shared Claude token ({} rewritten)",
+            outcome.snapshots_scrubbed.len()
+        );
+    }
+
+    Ok(outcome)
+}
+
+/// Forget the shared Claude token, and remove the copies of it that outlive the
+/// keychain entry.
 ///
 /// Deleting the keychain entry is the easy half. The token also exists in two
 /// other places, and a "Revoke" button that leaves either of them behind is
@@ -1223,34 +1383,81 @@ pub struct ClearTokenOutcome {
 ///    as long as the image exists. New commits no longer bake it in (see
 ///    [`crate::docker::container::commit_container_snapshot`]), but images
 ///    committed by earlier builds have to be rewritten, which is what
-///    [`scrub_secrets_from_snapshots`] does here.
+///    [`crate::docker::container::scrub_secrets_from_snapshots`] does here.
 ///
-/// The keychain deletion is never rolled back if the scrub fails; a partially
-/// completed revocation is still better than none, and the outcome is reported
-/// so the UI can be explicit about what is left.
+/// ## Why the keychain goes first
+///
+/// The sweep is not quick. It lists every `triple-c-snapshot-*` image and then
+/// inspects, creates, commits and removes *per image*, over bollard's Docker
+/// socket with its 120-second-per-request default. Deferring the keychain
+/// delete behind all of that leaves the credential live for the whole window
+/// while the UI says "Revoking…", and two separate things go wrong in it:
+///
+///  * A quit, a crash or a kill mid-sweep and the entry was never deleted at
+///    all. The token the user believes they revoked is still in the keychain,
+///    still ~1-year valid, and still injected into every container start.
+///  * [`has_claude_token`] stays true throughout, and
+///    [`crate::docker::container::create_container`] reads the keychain at
+///    container-**create** time rather than at app start. The per-project
+///    [`crate::project_lock::ProjectOp::SecretScrub`] guard is released as soon
+///    as that one project's image has been rewritten — so a project scrubbed
+///    early in the sweep can be started again later in the *same* sweep and be
+///    handed a fresh copy of the credential in its env. The images end up clean
+///    and the running fleet does not.
+///
+/// An earlier version ran the sweep first, on the argument that a crash
+/// mid-sweep would otherwise leave the token in an image with the keychain
+/// entry — and therefore the Revoke button — already gone. That argument was
+/// about *recoverability*, and [`sweep_claude_token_snapshots`] answers it
+/// directly: the images are the durable record, so the retry needs no keychain
+/// entry to exist and no persisted to-do list. The comment that ordering
+/// carried ("no window in which a scrubbed image is re-poisoned") was true of
+/// images and silent about containers, which is where the leak was, and silent
+/// about the minutes the token stayed live.
+///
+/// The keychain deletion is never rolled back if the scrub then fails; a
+/// partially completed revocation is still better than none, and the outcome is
+/// reported so the UI can be explicit about what is left.
 #[tauri::command]
 pub async fn clear_claude_token() -> Result<ClearTokenOutcome, String> {
-    secure::delete_claude_oauth_token()?;
-    log::info!("Cleared the shared Claude authentication token");
+    run_cleanup(
+        Cleanup::KeychainThenImages,
+        secure::delete_claude_oauth_token,
+        crate::docker::container::scrub_secrets_from_snapshots,
+    )
+    .await
+}
 
-    let report = crate::docker::container::scrub_secrets_from_snapshots().await;
-    if report.left_something_behind() {
-        log::warn!(
-            "Revoked the shared Claude token but {} snapshot image(s) may still contain it",
-            report.failed.len()
-        );
-    }
-
-    Ok(ClearTokenOutcome {
-        snapshots_scrubbed: report.scrubbed,
-        snapshots_failed: report
-            .failed
-            .into_iter()
-            .map(|(image, reason)| format!("{}: {}", image, reason))
-            .collect(),
-        snapshots_superseded: report.superseded_retained,
-        docker_unavailable: report.unavailable,
-    })
+/// Rewrite every snapshot image that still carries a credential, **without
+/// touching the keychain**.
+///
+/// This is the retry, and it is its own command because the retry is its own
+/// act. `docker commit` copied the token into each project's snapshot image;
+/// rewriting those images is a cleanup that has nothing to do with whether a
+/// token is stored today, and folding it into [`clear_claude_token`] made every
+/// press of "Retry snapshot cleanup" an unconfirmed credential deletion.
+///
+/// Safe to call at any time and in any state:
+///
+///  * with a token stored — a snapshot committed by an older build carries the
+///    *current* token, and clearing it out of the image does not stop the
+///    keychain entry being injected on the next container start;
+///  * with nothing stored — images committed by earlier builds still carry
+///    whatever token was live when they were committed, which is exactly the
+///    case the old sweep-first ordering could strand;
+///  * repeatedly — the work is re-derived from Docker each time, so an image
+///    whose project was busy on the last pass is simply picked up on this one.
+#[tauri::command]
+pub async fn sweep_claude_token_snapshots() -> Result<ClearTokenOutcome, String> {
+    run_cleanup(
+        Cleanup::ImagesOnly,
+        // Never called; the `ImagesOnly` branch is the entire point of this
+        // command, and a change that made it reachable must fail loudly rather
+        // than delete a credential quietly.
+        || -> Result<(), String> { unreachable!("an images-only sweep must never touch the keychain") },
+        crate::docker::container::scrub_secrets_from_snapshots,
+    )
+    .await
 }
 
 #[cfg(test)]
@@ -1761,5 +1968,265 @@ mod tests {
         seen.push_str(&s.push(format!("\nYour token: {}\n", tok).as_bytes()));
         assert_eq!(parse_setup_token(&seen), Some(tok));
     }
-}
 
+    // ── Revocation: what the sweep leaves behind, and how it is described ──
+
+    use crate::docker::container::SnapshotScrubReport;
+    use crate::project_lock::{try_acquire, ProjectOp};
+
+    /// The classifier is a substring match on a message another module owns,
+    /// which is only safe if something notices when that module rephrases. So
+    /// build the refusal the way production does — by actually losing the
+    /// race — rather than by pasting the wording in here.
+    #[test]
+    fn a_real_lock_refusal_is_recognised_as_retryable() {
+        let project = "auth-token-test-busy-project";
+        let _held = try_acquire(project, ProjectOp::Compaction).expect("first claim");
+        let refusal = try_acquire(project, ProjectOp::SecretScrub)
+            .expect_err("a second claim on the same project must be refused");
+
+        assert!(
+            is_project_busy_refusal(&refusal),
+            "project_lock's refusal is no longer recognised as retryable: {:?}",
+            refusal
+        );
+    }
+
+    #[test]
+    fn a_docker_failure_is_not_mistaken_for_a_busy_project() {
+        for reason in [
+            "could not inspect: error trying to connect: No such file or directory",
+            "could not create a scratch container: conflict: name already in use",
+            "an untagged snapshot image holds a credential and cannot be rewritten",
+        ] {
+            assert!(
+                !is_project_busy_refusal(reason),
+                "{:?} was misclassified as a transient lock refusal",
+                reason
+            );
+        }
+    }
+
+    #[test]
+    fn summarise_scrub_separates_a_busy_project_from_a_broken_image() {
+        let project = "auth-token-test-summarise-busy";
+        let _held = try_acquire(project, ProjectOp::Recreate).expect("first claim");
+        let refusal = try_acquire(project, ProjectOp::SecretScrub).expect_err("refused");
+
+        let outcome = summarise_scrub(SnapshotScrubReport {
+            scrubbed: vec!["triple-c-snapshot-a:latest".into()],
+            failed: vec![
+                ("triple-c-snapshot-b:latest".into(), refusal),
+                (
+                    "triple-c-snapshot-c:latest".into(),
+                    "could not create a scratch container: no such image".into(),
+                ),
+            ],
+            superseded_retained: vec!["triple-c-snapshot-a:latest".into()],
+            unavailable: None,
+        });
+
+        assert_eq!(outcome.snapshots_scrubbed, vec!["triple-c-snapshot-a:latest"]);
+        assert_eq!(outcome.snapshots_skipped.len(), 1, "{:?}", outcome);
+        assert!(outcome.snapshots_skipped[0].starts_with("triple-c-snapshot-b:latest: "));
+        assert_eq!(outcome.snapshots_failed.len(), 1, "{:?}", outcome);
+        assert!(outcome.snapshots_failed[0].starts_with("triple-c-snapshot-c:latest: "));
+        // The whole point: a skipped image is never folded into the scrubbed
+        // list, which is what "success" is rendered from.
+        assert!(!outcome.snapshots_scrubbed.iter().any(|s| s.contains("snapshot-b")));
+    }
+
+    #[test]
+    fn a_clean_sweep_needs_no_second_pass() {
+        let outcome = summarise_scrub(SnapshotScrubReport {
+            scrubbed: vec!["triple-c-snapshot-a:latest".into()],
+            ..Default::default()
+        });
+        assert!(!outcome.needs_another_pass());
+    }
+
+    #[test]
+    fn a_retained_superseded_image_alone_does_not_ask_for_a_second_pass() {
+        // The tag is clean; what is left is untagged and dies with the running
+        // container. Asking the user to sweep again would never stop.
+        let outcome = summarise_scrub(SnapshotScrubReport {
+            scrubbed: vec!["triple-c-snapshot-a:latest".into()],
+            superseded_retained: vec!["triple-c-snapshot-a:latest".into()],
+            ..Default::default()
+        });
+        assert!(!outcome.needs_another_pass());
+    }
+
+    #[test]
+    fn anything_still_holding_the_credential_asks_for_a_second_pass() {
+        let skipped = summarise_scrub(SnapshotScrubReport {
+            failed: vec![(
+                "triple-c-snapshot-b:latest".into(),
+                format!("This project is being reset. {}resetting it.", PROJECT_BUSY_MARKER),
+            )],
+            ..Default::default()
+        });
+        assert!(skipped.needs_another_pass());
+        assert_eq!(skipped.snapshots_skipped.len(), 1);
+
+        let failed = summarise_scrub(SnapshotScrubReport {
+            failed: vec![("triple-c-snapshot-c:latest".into(), "could not inspect: boom".into())],
+            ..Default::default()
+        });
+        assert!(failed.needs_another_pass());
+
+        let blind = summarise_scrub(SnapshotScrubReport {
+            unavailable: Some("Docker is not running".into()),
+            ..Default::default()
+        });
+        assert!(blind.needs_another_pass());
+        assert!(blind.snapshots_scrubbed.is_empty());
+    }
+
+    /// The IPC contract the frontend reads. A field renamed on this side and
+    /// not on that one is a silent "nothing was skipped".
+    #[test]
+    fn the_outcome_serialises_under_the_names_the_frontend_reads() {
+        let json = serde_json::to_value(ClearTokenOutcome::default()).expect("serialise");
+        let object = json.as_object().expect("an object");
+        for key in [
+            "snapshots_scrubbed",
+            "snapshots_failed",
+            "snapshots_skipped",
+            "snapshots_superseded",
+            "docker_unavailable",
+        ] {
+            assert!(object.contains_key(key), "missing {} in {:?}", key, object);
+        }
+    }
+
+    // ── The order of a revocation, and what a retry may touch ─────────────
+    //
+    // `run_cleanup` takes both halves as arguments precisely so this can be
+    // asserted with no keychain and no Docker daemon: the recorded order *is*
+    // the subject. Sweep-first put a live ~1-year credential behind a
+    // per-image inspect/create/commit/rmi loop — minutes, at bollard's
+    // 120s-per-request default — during which `has_claude_token` stayed true
+    // and `create_container` kept handing the token to anything started.
+
+    /// Records which half ran, in order.
+    type Trace = std::sync::Arc<std::sync::Mutex<Vec<&'static str>>>;
+
+    fn trace() -> Trace {
+        std::sync::Arc::new(std::sync::Mutex::new(Vec::new()))
+    }
+
+    fn scrubbed_one() -> SnapshotScrubReport {
+        SnapshotScrubReport {
+            scrubbed: vec!["triple-c-snapshot-a:latest".into()],
+            ..Default::default()
+        }
+    }
+
+    #[tokio::test]
+    async fn the_keychain_entry_is_gone_before_the_first_image_is_touched() {
+        let t = trace();
+        let (tk, ts) = (t.clone(), t.clone());
+
+        let outcome = run_cleanup(
+            Cleanup::KeychainThenImages,
+            move || {
+                tk.lock().unwrap().push("keychain");
+                Ok(())
+            },
+            move || async move {
+                ts.lock().unwrap().push("sweep");
+                scrubbed_one()
+            },
+        )
+        .await
+        .expect("a cleanup whose halves both succeed is not an error");
+
+        assert_eq!(
+            *t.lock().unwrap(),
+            ["keychain", "sweep"],
+            "the token stayed in the keychain — and therefore in every container created — \
+             for the whole length of the image sweep"
+        );
+        assert_eq!(outcome.snapshots_scrubbed, vec!["triple-c-snapshot-a:latest"]);
+    }
+
+    #[tokio::test]
+    async fn a_keychain_failure_leaves_the_images_untouched_and_is_reported() {
+        let t = trace();
+        let ts = t.clone();
+
+        let err = run_cleanup(
+            Cleanup::KeychainThenImages,
+            || Err("the keychain is locked".to_string()),
+            move || async move {
+                ts.lock().unwrap().push("sweep");
+                SnapshotScrubReport::default()
+            },
+        )
+        .await
+        .expect_err("a keychain that refused the delete must be reported, not swallowed");
+
+        assert_eq!(err, "the keychain is locked");
+        assert!(
+            t.lock().unwrap().is_empty(),
+            "images were rewritten for a revocation that never happened; the report is then \
+             discarded with the error and the user is told nothing they can act on"
+        );
+    }
+
+    /// The bug the images-only primitive exists to close: the "Retry snapshot
+    /// cleanup" button used to run `clear_claude_token`, so pressing it after
+    /// re-authenticating deleted the brand-new token with no confirmation.
+    #[tokio::test]
+    async fn an_images_only_cleanup_never_reaches_the_keychain() {
+        let t = trace();
+        let (tk, ts) = (t.clone(), t.clone());
+
+        let outcome = run_cleanup(
+            Cleanup::ImagesOnly,
+            move || {
+                tk.lock().unwrap().push("keychain");
+                Ok(())
+            },
+            move || async move {
+                ts.lock().unwrap().push("sweep");
+                scrubbed_one()
+            },
+        )
+        .await
+        .expect("a sweep-only cleanup is not an error");
+
+        assert_eq!(
+            *t.lock().unwrap(),
+            ["sweep"],
+            "the retry deleted a credential nobody confirmed deleting"
+        );
+        assert_eq!(outcome.snapshots_scrubbed, vec!["triple-c-snapshot-a:latest"]);
+    }
+
+    /// …and it still has to report what it could not finish, because "run it
+    /// again once that project is idle" is the whole affordance.
+    #[tokio::test]
+    async fn an_images_only_cleanup_still_reports_what_it_could_not_finish() {
+        let outcome = run_cleanup(
+            Cleanup::ImagesOnly,
+            || -> Result<(), String> { unreachable!("images only") },
+            || async {
+                SnapshotScrubReport {
+                    failed: vec![(
+                        "triple-c-snapshot-b:latest".into(),
+                        format!("This project is being started. {}removing a credential from its snapshot.", PROJECT_BUSY_MARKER),
+                    )],
+                    ..Default::default()
+                }
+            },
+        )
+        .await
+        .expect("an image left for the next pass is not a command failure");
+
+        assert!(outcome.needs_another_pass());
+        assert_eq!(outcome.snapshots_skipped.len(), 1, "{:?}", outcome);
+        assert!(outcome.snapshots_failed.is_empty(), "{:?}", outcome);
+    }
+}
diff --git a/app/src-tauri/src/commands/docker_commands.rs b/app/src-tauri/src/commands/docker_commands.rs
index d8f7a32..598a42a 100644
--- a/app/src-tauri/src/commands/docker_commands.rs
+++ b/app/src-tauri/src/commands/docker_commands.rs
@@ -37,20 +37,3 @@ pub async fn get_container_info(
     docker::get_container_info(&project).await
 }
 
-#[tauri::command]
-pub async fn list_sibling_containers() -> Result<Vec<serde_json::Value>, String> {
-    let containers = docker::list_sibling_containers().await?;
-    let result: Vec<serde_json::Value> = containers
-        .into_iter()
-        .map(|c| {
-            serde_json::json!({
-                "id": c.id,
-                "names": c.names,
-                "image": c.image,
-                "state": c.state,
-                "status": c.status,
-            })
-        })
-        .collect();
-    Ok(result)
-}
diff --git a/app/src-tauri/src/commands/file_commands.rs b/app/src-tauri/src/commands/file_commands.rs
index 37f670f..779c3cf 100644
--- a/app/src-tauri/src/commands/file_commands.rs
+++ b/app/src-tauri/src/commands/file_commands.rs
@@ -1,29 +1,63 @@
-use bollard::container::{DownloadFromContainerOptions, LogOutput, UploadToContainerOptions};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine as _;
+use bollard::container::{DownloadFromContainerOptions, LogOutput};
 use bollard::exec::{CreateExecOptions, StartExecResults};
 use futures_util::StreamExt;
 use serde::Serialize;
 use tauri::State;
 
 use crate::docker::client::get_docker;
-use crate::docker::exec::exec_oneshot;
+use crate::docker::exec::{exec_oneshot_as, exec_oneshot_streams_as, OUTPUT_LIMIT_MARKER};
 use crate::AppState;
 
-#[derive(Debug, Serialize)]
+#[derive(Debug, PartialEq, Serialize)]
 pub struct FileEntry {
     pub name: String,
     pub path: String,
+    /// Whether the entry behaves as a directory — *dereferenced*, so a symlink
+    /// pointing at one is navigable rather than a dead row.
     pub is_directory: bool,
+    /// Whether the entry itself is a symlink, which `is_directory` no longer
+    /// tells you now that it follows the link.
+    pub is_symlink: bool,
     pub size: u64,
     pub modified: String,
     pub permissions: String,
 }
 
+/// What a viewer read out of the container.
+#[derive(Debug, Serialize)]
+pub struct FileContents {
+    /// Base64 rather than a byte vec: Tauri serialises `Vec<u8>` over IPC as a
+    /// JSON array of numbers, which is roughly 4x the bytes and pathological at
+    /// MB scale.
+    pub contents_base64: String,
+    /// True when the file is larger than the cap and only a prefix came back.
+    pub truncated: bool,
+    /// The file's real size, from the tar header — not the length of what was
+    /// returned.
+    pub size: u64,
+}
+
+/// Hard ceiling on a single viewer read, whatever the caller asks for. The tar
+/// path buffers the whole payload in host RAM, so a caller-supplied cap is not
+/// something to take on trust.
+const MAX_READ_BYTES: u64 = 8 * 1024 * 1024;
+
 #[tauri::command]
 pub async fn list_container_files(
     project_id: String,
     path: String,
     state: State<'_, AppState>,
 ) -> Result<Vec<FileEntry>, String> {
+    // Before anything else: an unvalidated `path` here is not a listing bug, it
+    // is an argument-injection one. See the module's path-validation section.
+    validate_container_path("Folder", &path)?;
+
     let project = state
         .projects_store
         .get(&project_id)
@@ -34,32 +68,161 @@ pub async fn list_container_files(
         .as_ref()
         .ok_or_else(|| "Container not running".to_string())?;
 
-    let cmd = vec![
+    // `exec_oneshot` discards the exit code, which is how a `find` that listed
+    // nothing at all reached the UI as a cheerful "Empty directory". The status
+    // only decides what an *empty* result means, though: `find` also exits
+    // non-zero when a single child vanished mid-scan, and the rows it did
+    // print are still the right answer.
+    //
+    // The two streams are taken apart rather than merged: `find`'s diagnostics
+    // are the error message, its `-printf` records are the listing, and the
+    // parser should never be handed the former.
+    let (records, diagnostics, code) =
+        exec_oneshot_streams_as(container_id, "claude", list_argv(&path), Vec::new())
+            .await
+            .map_err(|e| describe_listing_failure(&path, e))?;
+
+    let entries = parse_find_output(&path, &records);
+    if code != 0 && entries.is_empty() {
+        // `find`'s own words — "Permission denied" — are usually the whole
+        // diagnosis; the two a symlinked starting point produces are not.
+        // See `describe_find_diagnostics`.
+        let detail = diagnostics.trim();
+        return Err(if detail.is_empty() {
+            format!("Could not list {} (exit {})", path, code)
+        } else {
+            describe_find_diagnostics(&path, detail)
+        });
+    }
+    if code != 0 {
+        log::warn!(
+            "find exited {} listing {}; returning the {} entries it did print",
+            code,
+            path,
+            entries.len()
+        );
+    }
+
+    Ok(entries)
+}
+
+/// The argv `list_container_files` runs, in one place so the format and the
+/// parser can be pinned together.
+///
+/// `-H` is what makes a symlinked directory openable. `find` defaults to `-P`,
+/// which does not follow a symlink *even when it is the starting point* — so
+/// `find /workspace/link -mindepth 1` over a link to a directory matched the
+/// link itself, `-mindepth 1` discarded it, and the panel showed a real
+/// directory as "Empty directory". The row was navigable (see `%Y` below) and
+/// navigating to it showed nothing. `-H` follows the starting point and only
+/// the starting point, so nothing *inside* the directory is dereferenced during
+/// the walk — which with `-maxdepth 1` is moot anyway, and is why this is not
+/// `-L`: `-L` would have `find` chase links it enumerates, and a symlink loop
+/// under a listed directory is then `find`'s problem rather than ours.
+/// A loop *at* the starting point is resolved by the kernel, which answers
+/// `ELOOP` immediately — a refusal, not a hang.
+///
+/// `%y` is the entry's own type, `%Y` the type it *dereferences* to. Both are
+/// printed: `%Y` is what decides navigability (a symlinked directory reports
+/// `l` under `%y`, which used to make it an unopenable row), while `%y` is the
+/// only way left to tell the user it is a link at all. `%Y` is `N` for a broken
+/// link and `L` for a loop, neither of which is `d`.
+///
+/// `%f` comes *last* and records are terminated by NUL, both because of what a
+/// filename is allowed to contain: a tab in a name used to shift every column
+/// after it (a crafted name rendered as a directory row), and a newline in a
+/// name could forge a whole extra row. With the name last there is nothing left
+/// to shift, and NUL is the one byte a Linux filename cannot hold.
+///
+/// The separators are passed as the two-character escapes `\t` and `\0` for
+/// `find` itself to expand: a literal NUL cannot travel in argv, which would
+/// truncate the format string at the terminator.
+fn list_argv(path: &str) -> Vec<String> {
+    vec![
         "find".to_string(),
-        path.clone(),
+        // Follow the starting point, and nothing else. See above.
+        "-H".to_string(),
+        path.to_string(),
         "-mindepth".to_string(),
         "1".to_string(),
         "-maxdepth".to_string(),
         "1".to_string(),
         "-printf".to_string(),
-        "%f\t%y\t%s\t%T@\t%m\n".to_string(),
-    ];
+        "%y\\t%Y\\t%s\\t%T@\\t%m\\t%f\\0".to_string(),
+    ]
+}
 
-    let output = exec_oneshot(container_id, cmd).await?;
+/// Turn a listing exec's failure into something the person looking at the
+/// folder can act on.
+///
+/// One case is worth naming: a directory with more entries than
+/// [`crate::docker::exec::MAX_ONESHOT_OUTPUT`] will hold. Roughly 100k names is
+/// the point where a `find` record set passes 8 MiB, and what the panel showed
+/// was "Command output exceeded 8388608 bytes and was abandoned" — a true
+/// statement about a buffer, and no help at all about a directory.
+fn describe_listing_failure(path: &str, error: String) -> String {
+    if error.starts_with(OUTPUT_LIMIT_MARKER) {
+        return format!(
+            "{} holds too many entries for this panel to list. Open it in a terminal, or look at a subfolder.",
+            path
+        );
+    }
+    error
+}
 
+/// Turn `find`'s own stderr into a sentence about the folder.
+///
+/// Only reached when `find` exited non-zero *and* printed no rows, i.e. when
+/// its diagnostic is the whole diagnosis. Most of them already are one
+/// ("Permission denied"), and those are passed through — but the two that
+/// arrive now that `-H` follows the starting point are not: a link into nothing
+/// and a link into itself both come back as raw `find:` text naming an errno,
+/// about a row the user just double-clicked because it looked like a folder.
+fn describe_find_diagnostics(path: &str, diagnostics: &str) -> String {
+    let lower = diagnostics.to_lowercase();
+    if lower.contains("too many levels of symbolic links") || lower.contains("eloop") {
+        return format!("{} is a symbolic link that loops back on itself, so there is nothing to list.", path);
+    }
+    if lower.contains("no such file or directory") {
+        return format!(
+            "{} does not lead anywhere — it is either gone, or a symbolic link whose target is.",
+            path
+        );
+    }
+    if diagnostics.is_empty() {
+        return format!("Could not list {}", path);
+    }
+    diagnostics.to_string()
+}
+
+/// Turn `find -printf '%y\t%Y\t%s\t%T@\t%m\t%f\0'` output into sorted entries.
+///
+/// Split out from the command so it can be tested without a container: it is
+/// the half where a format change silently mis-types every row.
+///
+/// Records are NUL-terminated and the name is the *last* field, so the split is
+/// capped at six pieces: whatever tabs a filename contains land inside the name
+/// instead of shifting the type, size and permission columns along one.
+fn parse_find_output(dir: &str, output: &str) -> Vec<FileEntry> {
     let mut entries: Vec<FileEntry> = output
-        .lines()
-        .filter(|line| !line.trim().is_empty())
-        .filter_map(|line| {
-            let parts: Vec<&str> = line.split('\t').collect();
-            if parts.len() < 5 {
+        .split('\0')
+        .filter(|record| !record.trim().is_empty())
+        .filter_map(|record| {
+            let mut parts = record.splitn(6, '\t');
+            let own_type = parts.next()?;
+            let deref_type = parts.next()?;
+            let size_field = parts.next()?;
+            let mtime_field = parts.next()?;
+            let mode_field = parts.next()?;
+            let name = parts.next()?.to_string();
+            if name.is_empty() {
                 return None;
             }
-            let name = parts[0].to_string();
-            let is_directory = parts[1] == "d";
-            let size = parts[2].parse::<u64>().unwrap_or(0);
-            let modified_epoch = parts[3].parse::<f64>().unwrap_or(0.0);
-            let permissions = parts[4].to_string();
+            let is_symlink = own_type == "l";
+            let is_directory = deref_type == "d";
+            let size = size_field.parse::<u64>().unwrap_or(0);
+            let modified_epoch = mtime_field.parse::<f64>().unwrap_or(0.0);
+            let permissions = mode_field.to_string();
 
             // Convert epoch to ISO-ish string
             let modified = {
@@ -69,16 +232,11 @@ pub async fn list_container_files(
                 dt.format("%Y-%m-%d %H:%M:%S").to_string()
             };
 
-            let entry_path = if path.ends_with('/') {
-                format!("{}{}", path, name)
-            } else {
-                format!("{}/{}", path, name)
-            };
-
             Some(FileEntry {
-                name,
-                path: entry_path,
+                name: name.clone(),
+                path: join_path(dir, &name),
                 is_directory,
+                is_symlink,
                 size,
                 modified,
                 permissions,
@@ -93,16 +251,1047 @@ pub async fn list_container_files(
             .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
     });
 
-    Ok(entries)
+    entries
 }
 
+/// Join a container directory and a child name without doubling the separator.
+fn join_path(dir: &str, name: &str) -> String {
+    if dir.ends_with('/') {
+        format!("{}{}", dir, name)
+    } else {
+        format!("{}/{}", dir, name)
+    }
+}
+
+/// The directory holding `path`. `/` is its own parent.
+fn parent_dir(path: &str) -> String {
+    let trimmed = path.trim_end_matches('/');
+    match trimmed.rfind('/') {
+        None | Some(0) => "/".to_string(),
+        Some(i) => trimmed[..i].to_string(),
+    }
+}
+
+/// Validate the *new name* half of a rename, or a new folder's name.
+///
+/// This is user-typed text that ends up in `mv`/`mkdir` argv, and the operation
+/// is deliberately a rename rather than a move: a name carrying `/` would
+/// relocate the entry, and `..` would walk it out of the directory entirely.
+/// A leading `-` is left alone because every call site passes `--` first.
+fn validate_entry_name(name: &str) -> Result<(), String> {
+    if name.is_empty() {
+        return Err("Name cannot be empty".to_string());
+    }
+    if name.contains('/') {
+        return Err(
+            "Name cannot contain '/' — this renames inside the folder, it does not move."
+                .to_string(),
+        );
+    }
+    // Can't survive argv anyway; caught here so the failure is legible.
+    if name.contains('\0') {
+        return Err("Name cannot contain a null byte".to_string());
+    }
+    if name == "." || name == ".." {
+        return Err("\".\" and \"..\" are not valid names".to_string());
+    }
+    if name.len() > 255 {
+        return Err("Name is too long (255 bytes maximum)".to_string());
+    }
+    Ok(())
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Path validation
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// `validate_entry_name` above covers the *new name* half of rename and mkdir.
+// The paths themselves — `path`, `from_path`, `parent_path`, `container_dir`,
+// `container_path`, `host_path` — arrived over IPC entirely unchecked, and both
+// ends of the trip are real: a container path under `/workspace/{mount_name}`
+// is a host bind mount, i.e. the user's actual repository, and a host path is
+// the host.
+//
+// The listing command is the reason this section exists. `find` ends its list
+// of starting points at the first argument beginning with `-`, so a `path` of
+// `-delete` supplied zero starting points (it defaults to `.`, and the exec
+// inherits the container's WorkingDir — the bind-mounted project) and an
+// expression of `-delete -mindepth 1 -maxdepth 1 -printf …`. Verified against a
+// live container on findutils 4.9.0 and again on 4.10.0: it deletes files and
+// empty directories out of the bind mount, and `exec_oneshot` threw away the
+// exit status, so the panel reported an empty folder afterwards. A `--`
+// separator is *not* the fix — `find` has no such convention for starting
+// points — but requiring the path to be absolute is, and it is the same check
+// that stops `..` traversal.
+
+/// `PATH_MAX` on Linux. Nothing legitimate comes close; a path longer than this
+/// cannot name a file in the container anyway.
+const MAX_CONTAINER_PATH_LEN: usize = 4096;
+
+/// Container roots this panel may *create or rename into*.
+///
+/// Reads are deliberately not restricted this way (see
+/// [`validate_container_path`]): the Files tab is a browser, `/etc/os-release`
+/// and `/usr/lib` are legitimate things to look at, and for reading, the
+/// container user's own permissions are the boundary that matters.
+///
+/// Writes are restricted, because a write here lands in one of exactly two
+/// places worth protecting and nowhere else is worth reaching:
+///   * `/workspace` — the project bind mounts, i.e. host files;
+///   * `/home/claude` — the persisted home volume (settings, skills, session
+///     history), which users legitimately reorganise from this panel, so it
+///     cannot be excluded even though `.claude/.credentials.json` lives there;
+///   * `/tmp` — where terminal drops and pasted images are staged.
+/// Everything else is either read-only image content or a system directory
+/// where the container user's `mv` fails anyway. Refusing up front turns a
+/// confusing "Permission denied" into a clear sentence, and keeps a caller out
+/// of `/etc` in a container that happens to run as root.
+const CONTAINER_WRITE_ROOTS: &[&str] = &["/workspace", "/home/claude", "/tmp"];
+
+/// Structural validation for any container path arriving over IPC.
+///
+/// `what` names the parameter in the error, because these messages are shown to
+/// a user who is looking at a folder, not at argv.
+fn validate_container_path(what: &str, path: &str) -> Result<(), String> {
+    if path.is_empty() {
+        return Err(format!("{} path cannot be empty", what));
+    }
+    if !path.starts_with('/') {
+        // Absoluteness is what makes the string a *path* rather than an
+        // argument: `-delete` is refused right here, and so is anything that
+        // would otherwise be resolved against a working directory nobody chose.
+        return Err(format!(
+            "{} path must be absolute (start with \"/\"): {}",
+            what, path
+        ));
+    }
+    if path.contains('\0') {
+        return Err(format!("{} path cannot contain a null byte", what));
+    }
+    // Rejected rather than normalised: a `..` in a path the UI built is a bug,
+    // and a `..` in a path the UI did not build is an attempt to leave the
+    // folder the user is looking at.
+    if path.split('/').any(|segment| segment == "..") {
+        return Err(format!("{} path cannot contain \"..\": {}", what, path));
+    }
+    if path.len() > MAX_CONTAINER_PATH_LEN {
+        return Err(format!("{} path is too long ({} bytes maximum)", what, MAX_CONTAINER_PATH_LEN));
+    }
+    Ok(())
+}
+
+/// [`validate_container_path`] plus containment in [`CONTAINER_WRITE_ROOTS`],
+/// for every path this module is about to change something at.
+///
+/// **Lexical, and only lexical.** `/workspace/link/x` is "under `/workspace`"
+/// as a string no matter what `/workspace/link` points at, so this on its own
+/// does not keep an operation inside the write roots — [`resolve_container_dir`]
+/// is what asks the container where the path actually goes.
+///
+/// Worth being clear about what that resolution is and is not for. It is not a
+/// containment boundary: the container user has a shell, and anything this
+/// panel could be tricked into writing through a symlink it could write
+/// directly. What it buys is that the *panel* keeps its promise — the roots
+/// named in the refusal are the roots it writes to — and that a mis-aimed drop
+/// cannot quietly land outside them.
+fn validate_container_write_path(what: &str, path: &str) -> Result<(), String> {
+    validate_container_path(what, path)?;
+    if CONTAINER_WRITE_ROOTS
+        .iter()
+        .any(|root| is_under_root(path, root))
+    {
+        return Ok(());
+    }
+    Err(format!(
+        "{} path is outside the folders this panel can change ({}): {}",
+        what,
+        CONTAINER_WRITE_ROOTS.join(", "),
+        path
+    ))
+}
+
+/// Resolve a container *directory* and check where it really lands.
+///
+/// `realpath -m` because the path is being written into rather than read: `-m`
+/// wants no component to exist, which is what makes it usable for the parent of
+/// a `mkdir`. The resolved answer goes back through
+/// [`validate_container_write_path`], so a symlink out of `/workspace` is
+/// refused by the same sentence a literal `/etc` would be.
+///
+/// The caller keeps operating on the path the *user* typed rather than on the
+/// resolved one: they name the same directory, and the unresolved form is the
+/// one the listing shows and the UI navigates back to. What is validated and
+/// what is operated on can therefore drift if a link is swapped in between —
+/// this is a container-side TOCTOU with the same shape as H4's, and unlike H4's
+/// it costs nothing, because both sides of the window are already inside the
+/// container's own trust boundary.
+///
+/// A `realpath` that cannot run at all (an image without coreutils) is logged
+/// and the lexical answer stands: failing every write closed would break the
+/// panel outright for a risk the container user does not need this code path to
+/// take.
+async fn resolve_container_dir(container_id: &str, what: &str, dir: &str) -> Result<(), String> {
+    validate_container_write_path(what, dir)?;
+
+    // Split streams, not the combined buffer: `realpath`'s answer is a *path*
+    // and its diagnostics are not, so parsing the two together is the same
+    // hazard the listing above took apart for `find`. A warning on stderr —
+    // and there is one whenever a component is unreadable — used to be spliced
+    // into the string this then compared against the write roots.
+    let (stdout, diagnostics, code) = exec_oneshot_streams_as(
+        container_id,
+        "claude",
+        vec![
+            "realpath".to_string(),
+            "-m".to_string(),
+            "--".to_string(),
+            dir.to_string(),
+        ],
+        Vec::new(),
+    )
+    .await?;
+
+    let resolved = stdout.trim();
+    if code != 0 || resolved.is_empty() {
+        log::warn!(
+            "Could not resolve {} in the container (exit {}{}); using the literal path",
+            dir,
+            code,
+            if diagnostics.trim().is_empty() {
+                String::new()
+            } else {
+                format!(": {}", diagnostics.trim())
+            }
+        );
+        return Ok(());
+    }
+    if resolved == dir {
+        return Ok(());
+    }
+
+    validate_container_write_path(what, resolved).map_err(|e| {
+        format!("{} leads to {} — {}", dir, resolved, e)
+    })
+}
+
+/// Whether `path` is `root` itself or something beneath it.
+///
+/// Compared by whole segments, so `/workspace-backup` is not "under"
+/// `/workspace` — a plain `starts_with` is the classic way to get that wrong.
+fn is_under_root(path: &str, root: &str) -> bool {
+    let path = path.trim_end_matches('/');
+    let root = root.trim_end_matches('/');
+    path == root || path.strip_prefix(root).is_some_and(|rest| rest.starts_with('/'))
+}
+
+/// What a host path is about to be used for. The three modes differ over which
+/// components may be hidden — see [`validate_host_path`] and the variants.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum HostPathUse {
+    /// Host bytes are about to be read *into* the container.
+    Read,
+    /// Container bytes are about to be written *onto* the host, at a path that
+    /// arrived **over IPC as a string** — `download_container_backup`.
+    ///
+    /// The strictest of the three, and the leaf is judged along with every
+    /// directory above it, because creating `~/.bashrc` is escape all by
+    /// itself and nothing here can tell a path a person picked from one a
+    /// compromised webview invented.
+    Write,
+    /// Container bytes are about to be written onto the host, at a name a
+    /// person typed or accepted in an **OS save dialog opened by Rust** —
+    /// `download_container_file`.
+    ///
+    /// Identical to [`HostPathUse::Write`] except that the final component is
+    /// not judged for hiddenness, which is the difference between a rule and a
+    /// bug. Under `Write`, saving `/workspace/.env` was refused *after* the
+    /// modal and the overwrite prompt, with the message "\".env\" is a hidden
+    /// file — Triple-C will not save there" — and the app had pre-filled that
+    /// exact name itself. `.gitignore`, `.dockerignore`, `.eslintrc.json`,
+    /// `.nvmrc` and the rest of an ordinary workspace were all unsavable, while
+    /// uploading them worked, so a dotfile could go in and never come out.
+    ///
+    /// What justifies dropping it *here* and nowhere else is that the dialog is
+    /// a real boundary for this caller and only this caller: the name is on
+    /// screen, the user chose the directory, and the OS asked before
+    /// overwriting anything. Every *directory* rule still applies, so `~/.ssh`
+    /// and `~/.config` are as refused as they ever were.
+    WriteChosenName,
+}
+
+/// Host directories nothing in this app has any business reading a file out of
+/// or writing one into.
+///
+/// Defence in depth, not the boundary: most of these are root-owned and the
+/// write would fail anyway. They are listed so that a build running with more
+/// privilege than usual still cannot be talked into replacing a system file,
+/// and so the refusal is a sentence rather than an errno. Compared after
+/// [`normalize_host_path`] and lowercasing, which is what makes the Windows
+/// entries work.
+const HOST_SYSTEM_ROOTS: &[&str] = &[
+    "/bin", "/boot", "/dev", "/etc", "/lib", "/lib32", "/lib64", "/libx32", "/opt", "/proc",
+    "/root", "/sbin", "/snap", "/srv", "/sys", "/usr", "/var",
+    // macOS keeps its own copies of the same idea. Its `/etc` and `/var` are
+    // symlinks into `/private`, and the check now runs on the *resolved* path
+    // (see [`resolve_host_path`]), so the resolved spellings have to be here
+    // too. `/private/tmp` deliberately is not: that is what an entirely
+    // ordinary `/tmp/report.pdf` resolves to on a Mac.
+    "/system", "/library", "/applications", "/private/etc", "/private/var",
+    // Windows.
+    "c:/windows", "c:/program files", "c:/program files (x86)", "c:/programdata",
+];
+
+/// Places that sit *under* a [`HOST_SYSTEM_ROOTS`] entry and are nonetheless
+/// entirely ordinary, because a real system puts real user data there.
+///
+/// Both of these only started to matter once the check ran on the *resolved*
+/// path: `/home` is a symlink to `/var/home` on rpm-ostree systems (Fedora
+/// Silverblue and friends), and a Mac's per-user temp directory resolves into
+/// `/private/var/folders`. Without these, saving a download to your own home
+/// directory on Silverblue is "that is a system location".
+const HOST_SYSTEM_ROOT_EXCEPTIONS: &[&str] = &["/var/home", "/var/folders", "/private/var/folders"];
+
+/// Directory *tails* whose contents the OS runs on the user's behalf at login.
+///
+/// The same defence-in-depth footing as [`HOST_SYSTEM_ROOTS`], and the same
+/// caveat in stronger form: this is a list of places that happen to be known,
+/// not a description of the ones that exist. See [`validate_host_path`] for why
+/// the write policy cannot be finished here.
+const HOST_AUTORUN_DIRS: &[&[&str]] = &[
+    &["library", "launchagents"],
+    &["library", "launchdaemons"],
+    &["library", "startupitems"],
+    &["start menu", "programs", "startup"],
+];
+
+/// Length of a `C:` drive prefix at the head of `path`, or 0.
+fn drive_prefix_len(path: &str) -> usize {
+    let b = path.as_bytes();
+    if b.len() >= 2 && b[0].is_ascii_alphabetic() && b[1] == b':' {
+        2
+    } else {
+        0
+    }
+}
+
+/// Whether `path` is written in Windows form, and so whether `\` separates its
+/// components. On Linux a backslash is an ordinary filename character, which is
+/// why this is a question rather than an unconditional substitution.
+fn is_windows_style_path(path: &str) -> bool {
+    cfg!(windows) || path.starts_with("\\\\") || drive_prefix_len(path) > 0
+}
+
+/// `path` with its separators unified and any Win32 verbatim/device prefix
+/// removed — the form every rule below is expressed against.
+///
+/// `\\?\C:\Windows` and `\\?\UNC\server\share` name the *same locations* as
+/// `C:\Windows` and `\\server\share`; the prefix only turns off Win32 path
+/// parsing. Stripping it is what stops four characters being a bypass of
+/// [`HOST_SYSTEM_ROOTS`] — and it has to run on our own output as well, because
+/// `std::fs::canonicalize` hands back exactly that spelling on Windows.
+fn normalize_host_path(path: &str) -> String {
+    let mut s = if is_windows_style_path(path) {
+        path.replace('\\', "/")
+    } else {
+        path.to_string()
+    };
+    // Slicing by byte index is safe here only because a prefix matched
+    // case-insensitively as ASCII is ASCII, so its end is a char boundary.
+    for prefix in ["//?/unc/", "//./unc/"] {
+        if s.len() >= prefix.len() && s.as_bytes()[..prefix.len()].eq_ignore_ascii_case(prefix.as_bytes()) {
+            return format!("//{}", &s[prefix.len()..]);
+        }
+    }
+    for prefix in ["//?/", "//./"] {
+        if s.len() >= prefix.len() && s.as_bytes()[..prefix.len()].eq_ignore_ascii_case(prefix.as_bytes()) {
+            s = s[prefix.len()..].to_string();
+            break;
+        }
+    }
+    // Collapse runs of separators, keeping any leading pair (a UNC root is
+    // `//server/share` and means something).
+    //
+    // Without this the *lexical* system-root rule was quietly absent for
+    // Windows paths: `C:\\Windows\System32\x.dll` normalises to
+    // `c://windows/...`, which `is_under_root` does not match, while the
+    // single-separator form is refused. Nothing was exploitable — `resolve_host_path`
+    // runs the same policy again over the canonical form and `canonicalize`
+    // collapses the run — but a documented layer that silently does nothing is
+    // a trap for the next caller who reaches for it without the resolved pass.
+    let lead = if s.starts_with("//") { "//" } else { "" };
+    let body: String = {
+        let rest = &s[lead.len()..];
+        let mut out = String::with_capacity(rest.len());
+        let mut prev_sep = false;
+        for c in rest.chars() {
+            if c == '/' {
+                if !prev_sep {
+                    out.push(c);
+                }
+                prev_sep = true;
+            } else {
+                out.push(c);
+                prev_sep = false;
+            }
+        }
+        out
+    };
+    format!("{}{}", lead, body)
+}
+
+/// The named components of a host path, with the drive letter, the separators
+/// and any `.` dropped.
+fn host_path_names(path: &str) -> Vec<String> {
+    let norm = normalize_host_path(path);
+    norm[drive_prefix_len(&norm)..]
+        .split('/')
+        .filter(|s| !s.is_empty() && *s != ".")
+        .map(|s| s.to_string())
+        .collect()
+}
+
+/// Whether `path` names a location at all, on whichever platform wrote it.
+///
+/// Deliberately not [`Path::is_absolute`], which answers for the *host*
+/// platform: under it a Windows path on Linux is simply "not absolute", every
+/// Windows rule below goes unreached, and the tests that thought they were
+/// exercising them were only ever exercising this line.
+fn is_absolute_host_path(path: &str) -> bool {
+    let norm = normalize_host_path(path);
+    norm.starts_with('/') || norm[drive_prefix_len(&norm)..].starts_with('/')
+}
+
+/// A UNC path rewritten as the local path it actually reaches, when the share
+/// is an administrative one: `\\host\C$\Windows` *is* `C:\Windows`, and
+/// `\\host\ADMIN$` is the Windows directory itself. An ordinary file share has
+/// no local equivalent and gets `None` — [`HOST_SYSTEM_ROOTS`] cannot reason
+/// about someone else's server, and says so rather than guessing.
+fn admin_share_target(norm_lower: &str) -> Option<String> {
+    let mut parts = norm_lower.strip_prefix("//")?.splitn(3, '/');
+    let _server = parts.next()?;
+    let share = parts.next()?;
+    let tail = parts.next().unwrap_or("");
+    let b = share.as_bytes();
+    if b.len() == 2 && b[0].is_ascii_alphabetic() && b[1] == b'$' {
+        Some(format!("{}:/{}", b[0] as char, tail))
+    } else if share == "admin$" {
+        Some(format!("c:/windows/{}", tail))
+    } else {
+        None
+    }
+}
+
+/// The [`HOST_SYSTEM_ROOTS`] entry `path` falls under, if any.
+///
+/// Pure, and platform-independent on purpose: this is the whole of the Windows
+/// policy, so it is also the whole of what the tests have to be able to drive
+/// from a Linux CI box.
+fn host_system_root_for(path: &str) -> Option<&'static str> {
+    let norm = normalize_host_path(path).to_lowercase();
+    if HOST_SYSTEM_ROOT_EXCEPTIONS
+        .iter()
+        .any(|allowed| is_under_root(&norm, allowed))
+    {
+        return None;
+    }
+    let admin = admin_share_target(&norm);
+    HOST_SYSTEM_ROOTS.iter().copied().find(|root| {
+        is_under_root(&norm, root) || admin.as_deref().is_some_and(|p| is_under_root(p, root))
+    })
+}
+
+/// Whether these directory components end in one of [`HOST_AUTORUN_DIRS`].
+fn is_autorun_dir(names: &[String]) -> bool {
+    HOST_AUTORUN_DIRS.iter().any(|tail| {
+        names.len() >= tail.len()
+            && names[names.len() - tail.len()..]
+                .iter()
+                .zip(tail.iter())
+                .all(|(have, want)| have.eq_ignore_ascii_case(want))
+    })
+}
+
+/// Structural and policy checks on a host path, returning it as a [`PathBuf`].
+///
+/// Four callers, and they no longer share a threat model — which is the thing
+/// to hold on to when changing any of this:
+///
+///   * [`download_container_file`] and [`upload_files_to_container`], the Files
+///     pane's own transfers, **open their dialog from Rust**. The webview can
+///     ask for a picker and that is the whole of its influence — it cannot name
+///     a host path as an input. (It still *sees* host paths in error text, and
+///     canonical ones at that; the inbound direction is what was closed.) For
+///     these two this policy is defence in depth.
+///   * `terminal_commands::upload_host_file_to_terminal` (the terminal drop)
+///     and [`download_container_backup`] still take a host path *from the
+///     webview* as a string. A `save()`/`open()` dialog stands in front of both
+///     in the UI, but a dialog is a UI convention, not a boundary: every
+///     command is a single `invoke` away from any code running in the webview,
+///     with container-controlled bytes on one side of it. For those two, this
+///     policy is the boundary itself.
+///
+/// So the backend has its own policy:
+///
+///   * absolute, no `..`, no NUL — judged on the path's own components, so a
+///     Windows path is judged as one wherever this runs;
+///   * nothing under [`HOST_SYSTEM_ROOTS`] or in a login-item directory;
+///   * no *hidden* path components. The interesting targets for "write
+///     container-controlled bytes to a host path" are mostly dot directories —
+///     `~/.ssh/authorized_keys`, `~/.config/autostart/`, `~/.local/bin/ls` —
+///     and the interesting targets for the reverse, reading a host file into
+///     the container, are the same ones plus `~/.aws/credentials`. A write is
+///     refused a hidden *name* too (creating `~/.bashrc` is escape all by
+///     itself); a read only cares about hidden *directories*, because dropping
+///     a project's own `.env` onto the terminal is an ordinary thing to do and
+///     its parent is not hidden.
+///
+/// **This is a lexical predicate over a string**, and [`resolve_host_path`]
+/// runs it twice: once over the path as the user wrote it, and again over the
+/// canonical form, because a path whose components are all visible can still
+/// *lead* somewhere that is not. The second run is why a planted
+/// `Downloads/pub → ~/.ssh` is refused.
+///
+/// **The general hidden rule over-catches, and that is the deliberate trade.**
+/// A path that resolves through `node_modules/.pnpm`, `~/.cache` or
+/// `~/.local/share` is refused even though nothing about it is an attack. That
+/// cost was once paid the other way — the rule was narrowed to an eleven-entry
+/// denylist of "credential" directories, which is allow-by-omission for the
+/// whole of the rest of `$HOME`: `~/.local/bin` (a write there is the user's
+/// next shell command), `~/.password-store`, browser profiles, `~/.pki/nssdb`.
+/// Over-refusing is the cheaper mistake, so the general rule stands and the
+/// refusal says plainly what tripped it. Note that the cost went **up** when
+/// the Files pane got its transfers back: those callers are routine rather than
+/// occasional, and because their path comes from a dialog the person is
+/// choosing a real destination when it is refused. That is a known, accepted
+/// wart — `~/.config` is not a place this pane will save to — and it is not a
+/// reason to narrow the rule, because the two IPC-fed callers above are still
+/// behind it.
+///
+/// **The rest of the policy is still a denylist, which is losing by
+/// construction.** `~/Library/LaunchAgents`, `%AppData%\…\Startup` and `/opt`
+/// are only refused because someone thought of them; the next persistence
+/// directory is not. The honest fix is for the *backend* to own the file
+/// dialog, so that the only host paths a command accepts are ones the user just
+/// pointed at and no path arrives over IPC at all — and that fix is **done for
+/// two of the four callers**: see [`pick_save_path`]. The lists are defence in
+/// depth there.
+///
+/// It is still outstanding for the terminal drop and for
+/// [`download_container_backup`], where these lists remain the only boundary
+/// and losing-by-construction is the live risk. Both are worth converting the
+/// same way; the drop is the harder of the two, because its path comes from an
+/// OS drag rather than from a dialog Rust could have opened.
+fn validate_host_path(path: &str, use_for: HostPathUse) -> Result<PathBuf, String> {
+    if path.trim().is_empty() {
+        return Err("No host path was given".to_string());
+    }
+    if path.contains('\0') {
+        return Err("Host path cannot contain a null byte".to_string());
+    }
+    if !is_absolute_host_path(path) {
+        return Err(format!("Host path must be absolute: {}", path));
+    }
+
+    let names = host_path_names(path);
+    if names.iter().any(|n| n == "..") {
+        return Err(format!("Host path cannot contain \"..\": {}", path));
+    }
+
+    // A trailing separator names a *directory*, and `Path::file_name` on
+    // `/home/jo/Downloads/` answers `Downloads` — so the leaf a write kept was
+    // the directory itself, the rename at the end failed with an errno, and the
+    // cleanup then tried to `remove_file` a directory. Refuse it as a sentence
+    // while it is still a string. A read is left alone: it opens the path and
+    // the "that is a folder" refusal is already the one it gives.
+    if use_for == HostPathUse::Write
+        && (names.is_empty() || normalize_host_path(path).ends_with('/'))
+    {
+        return Err(format!(
+            "Host path must name a file, not a folder: {}",
+            path
+        ));
+    }
+
+    // The final component is the file itself; everything before it is a
+    // directory the path passes *through*.
+    let hidden_limit = match use_for {
+        HostPathUse::Write => names.len(),
+        // The leaf is the user's own choice in both of these — dropped from a
+        // file manager, or typed into a save dialog. See the enum.
+        HostPathUse::Read | HostPathUse::WriteChosenName => names.len().saturating_sub(1),
+    };
+    if let Some(hidden) = names[..hidden_limit].iter().find(|n| n.starts_with('.')) {
+        let verb = if use_for == HostPathUse::Write { "save" } else { "read" };
+        return Err(if names.last() == Some(hidden) {
+            format!(
+                "\"{}\" is a hidden file — Triple-C will not save there. Choose a visible name.",
+                hidden
+            )
+        } else {
+            // Named as a *path* question rather than a name question, because
+            // this rule also runs over the canonical form: the component that
+            // trips it is frequently one the user never typed, and "the path
+            // goes through it" is the only wording that makes that make sense.
+            format!(
+                "the path goes through \"{}\", a hidden folder — Triple-C will not {} anything whose folders are not all visible. Choose a visible location.",
+                hidden, verb
+            )
+        });
+    }
+
+    let dirs = &names[..names.len().saturating_sub(1)];
+    if use_for == HostPathUse::Write && is_autorun_dir(dirs) {
+        return Err(format!(
+            "{} is a startup folder — Triple-C will not save there. Choose an ordinary location.",
+            dirs.last().map(String::as_str).unwrap_or(path)
+        ));
+    }
+
+    if let Some(root) = host_system_root_for(path) {
+        return Err(format!(
+            "{} is a system location — Triple-C will not {} files there.",
+            root,
+            if use_for == HostPathUse::Write { "write" } else { "read" }
+        ));
+    }
+
+    Ok(PathBuf::from(path))
+}
+
+/// The same policy, asked of a *canonical* path — where the bytes really land,
+/// as opposed to what the user typed.
+///
+/// Round 2 ended [`resolve_host_path`] with exactly this: the whole lexical
+/// predicate, hidden-component rule included, applied a second time to the
+/// resolved form. Round 3 replaced it with a narrower rule — an eleven-entry
+/// list of "credential" directories — to stop the general one refusing
+/// `node_modules/.pnpm` and `~/.cache`. That is allow-by-omission for
+/// everything nobody put on the list, and the things nobody put on the list
+/// included `~/.local/bin` (write there and you own the user's next shell
+/// command), `~/.password-store`, Firefox and Chrome profiles, and
+/// `~/.pki/nssdb`. All four were reachable through a planted symlink with a
+/// perfectly ordinary-looking name.
+///
+/// So the general rule is back, over-catch and all — see [`validate_host_path`]
+/// for what that costs, and for why it is still the right way round now that
+/// there are four callers rather than two. This is a thin wrapper rather than a second body so the two
+/// questions cannot drift apart again; the caller supplies the "resolves to"
+/// context, because on this side the offending component is usually one the
+/// user never wrote.
+fn validate_resolved_host_path(resolved: &str, use_for: HostPathUse) -> Result<(), String> {
+    validate_host_path(resolved, use_for).map(|_| ())
+}
+
+/// The host path a command is really going to open: every symlink in it
+/// resolved by the OS, judged by [`validate_host_path`] as the user wrote it
+/// and again as it really lands.
+///
+/// H4, and the reason the lexical check alone was not a check. Nothing here
+/// used to call `canonicalize`, so the rules above were being applied to a
+/// string rather than to a location: with `~/Downloads/pub` a symlink to
+/// `~/.ssh`, a `host_path` of `~/Downloads/pub/authorized_keys` has no hidden
+/// component, is under no system root, and lands in `~/.ssh` anyway. The
+/// container can plant that link *and know where to plant it* —
+/// `/proc/self/mountinfo` inside a Triple-C container spells the host's
+/// project paths out verbatim. The same trick worked in the other direction,
+/// reading `~/.ssh/id_rsa` into the container through a visible name.
+///
+/// A write resolves the *parent* and keeps the caller's leaf, because the leaf
+/// is never followed: the partial file is created with `create_new`
+/// (`O_EXCL`, which refuses a symlink outright) and [`finish_download`]
+/// finishes with a rename, which replaces a link rather than writing through
+/// it. A read resolves the whole path, because the whole path is opened.
+///
+/// When the resolved form is refused, the message leads with what the path
+/// *resolves to*: the component that tripped the rule is one the user did not
+/// write, and a refusal naming a directory that does not appear in what they
+/// typed is otherwise unreadable.
+///
+/// What this does **not** close by itself is the swap between resolving and
+/// opening; [`verify_opened_path`] is the other half.
+async fn resolve_host_path(path: &str, use_for: HostPathUse) -> Result<PathBuf, String> {
+    let candidate = validate_host_path(path, use_for)?;
+
+    let resolved = match use_for {
+        HostPathUse::Read => tokio::fs::canonicalize(&candidate)
+            .await
+            .map_err(|e| format!("Cannot access {}: {}", candidate.display(), e))?,
+        // Both write modes resolve the *parent* and keep the caller's leaf; they
+        // differ only in whether that leaf may be hidden, which
+        // `validate_host_path` has already decided by this point.
+        HostPathUse::Write | HostPathUse::WriteChosenName => {
+            let parent = candidate
+                .parent()
+                .ok_or_else(|| format!("{} does not name a file", candidate.display()))?;
+            let name = candidate
+                .file_name()
+                .ok_or_else(|| format!("{} does not name a file", candidate.display()))?;
+            let dir = tokio::fs::canonicalize(parent)
+                .await
+                .map_err(|e| format!("Cannot save into {}: {}", parent.display(), e))?;
+            let joined = dir.join(name);
+            // Windows hands out 8.3 aliases, and `BASHRC~1` is a perfectly
+            // ordinary-looking name for `.bashrc`. So a leaf that already
+            // exists is judged under the name the filesystem gives it as well
+            // as the one the caller typed. Only the *name* is taken from the
+            // canonical form: a destination that is a symlink gets replaced by
+            // the rename, never followed, so its target is not what is at risk.
+            if use_for == HostPathUse::Write {
+                if let Ok(full) = tokio::fs::canonicalize(&joined).await {
+                    let real = full.file_name().map(|n| n.to_string_lossy().to_string());
+                    if real.as_deref().is_some_and(|n| n.starts_with('.')) {
+                        return Err(format!(
+                            "\"{}\" is a hidden file — Triple-C will not save there. Choose a visible name.",
+                            real.unwrap_or_default()
+                        ));
+                    }
+                }
+            }
+            joined
+        }
+    };
+
+    // The same policy over the canonical form — see
+    // [`validate_resolved_host_path`] for why it is the *same* policy again.
+    validate_resolved_host_path(&resolved.to_string_lossy(), use_for).map_err(|e| {
+        if resolved == candidate {
+            e
+        } else {
+            format!("{} resolves to {} — {}", path, resolved.display(), e)
+        }
+    })?;
+
+    Ok(resolved)
+}
+
+/// Confirm that the handle we are holding is the file we validated.
+///
+/// The other half of H4. `resolve_host_path` answers "where does this path lead
+/// *now*", and a component can be replaced between that answer and the `open`
+/// that acts on it — the classic TOCTOU, and a live one here because the
+/// attacker owns a directory the path passes through. On Linux the kernel will
+/// simply say where an open descriptor ended up, so we ask it and compare;
+/// anything else is refused before a byte of payload is written or read.
+///
+/// Elsewhere — macOS, Windows — there is no equivalent that needs no new
+/// dependency, so this is a **compile-time no-op**: on those platforms the
+/// TOCTOU window is not closed at all, and the guarantee is the weaker one —
+/// resolve-then-open, plus `O_EXCL` on the create, plus a rename whose source
+/// must exist at the resolved path under a name carrying 32 random bits.
+///
+/// On Linux, an unreadable `/proc/self/fd/N` is a **failure**, not a pass. It
+/// used to be an `if let Ok(…)`, so the one condition under which the check
+/// cannot answer — no `/proc`, a hardened kernel, the fd table exhausted — was
+/// also the condition under which it silently approved whatever the descriptor
+/// had become. A check that cannot see is not a check that saw nothing wrong.
+pub(crate) fn verify_opened_path(file: &std::fs::File, expected: &Path) -> Result<(), String> {
+    #[cfg(target_os = "linux")]
+    {
+        use std::os::fd::AsRawFd;
+        let link = format!("/proc/self/fd/{}", file.as_raw_fd());
+        let actual = std::fs::read_link(&link).map_err(|e| {
+            format!(
+                "Refusing to use {}: could not confirm what was opened ({}: {}).",
+                expected.display(),
+                link,
+                e
+            )
+        })?;
+        if actual != expected {
+            return Err(format!(
+                "Refusing to use {}: while it was being opened it became {}.",
+                expected.display(),
+                actual.display()
+            ));
+        }
+    }
+    #[cfg(not(target_os = "linux"))]
+    {
+        let _ = (file, expected);
+    }
+    Ok(())
+}
+
+/// [`resolve_host_path`] for a host file about to be read into a container,
+/// handed back as a `String`.
+///
+/// Public because one of its callers lives elsewhere: the terminal's
+/// drag-and-drop drop target, `terminal_commands::upload_host_file_to_terminal`.
+/// The other is [`upload_files_to_container`] just below, the Files pane's own
+/// upload. Both routes apply this same policy, so which one a file arrives by
+/// does not change what it is allowed to be.
+pub async fn resolve_host_read_path(path: &str) -> Result<String, String> {
+    Ok(resolve_host_path(path, HostPathUse::Read)
+        .await?
+        .to_string_lossy()
+        .to_string())
+}
+
+/// The name a dropped host file should land under in the container.
+///
+/// Taken from the path as the user gave it, deliberately — see the call site in
+/// `terminal_commands::upload_host_file_to_terminal`: `~/Downloads/latest.log`
+/// is routinely a symlink to `2026-08-23.log`, and taking the leaf off the
+/// *resolved* path renamed the file on its way in. [`host_path_names`] rather than
+/// `Path::file_name` so a Windows path is split as one wherever this runs, and
+/// the answer goes through [`validate_entry_name`] because it becomes a tar
+/// entry name, a container path and an argv element.
+pub(crate) fn host_upload_name(path: &str) -> Result<String, String> {
+    if normalize_host_path(path).ends_with('/') {
+        // A trailing separator names a directory, and `Downloads` is not the
+        // name of a file to upload. The recursive-upload refusal further down
+        // says the same thing, but only after a resolve and a `stat`.
+        return Err(format!("{} is a folder — upload its files individually.", path));
+    }
+    let name = host_path_names(path)
+        .pop()
+        .ok_or_else(|| format!("{} does not name a file", path))?;
+    validate_entry_name(&name)?;
+    Ok(name)
+}
+
+/// Where a host write is staged before it becomes the file the user asked for.
+///
+/// Two callers: [`download_container_backup`] and [`download_container_file`],
+/// the two commands that put container bytes on the host.
+///
+/// Same directory as the destination, so the last step is a rename within one
+/// filesystem: atomic, and the destination is not touched *at all* until the
+/// whole transfer has succeeded. That ordering is the fix for the worst part of
+/// the old code, which created (i.e. truncated) the destination first and then
+/// deleted it when the stream failed — turning "your download failed" into
+/// "your download failed and the file that used to be there is gone".
+///
+/// A rename also handles an existing destination better than an `open` would:
+/// it replaces a symlink rather than following it out of the vetted directory.
+///
+/// Deliberately not a hidden name: if a crash leaves one behind, it should be
+/// visible next to the file it was going to become.
+fn partial_download_path(dest: &Path) -> Result<PathBuf, String> {
+    let name = dest
+        .file_name()
+        .ok_or_else(|| format!("{} does not name a file", dest.display()))?;
+    let suffix = format!(
+        ".triple-c-part-{}",
+        &uuid::Uuid::new_v4().simple().to_string()[..8]
+    );
+    // The leaf has to be shortened to make room, or a destination name that fits
+    // its directory perfectly well produces a partial name that does not.
+    // `NAME_MAX` is 255 bytes on ext4, APFS and NTFS alike, and the suffix is
+    // 23 of them.
+    //
+    // This did not matter while the only caller was Backup, whose name a person
+    // types. It matters now that a name can come from the container: a bundler
+    // writing `<230-char content hash>.js` would be unsavable, with the refusal
+    // blaming a temporary name the user never saw. Lossy is fine for a partial
+    // — it is thrown away by the rename, and the uuid is what makes it unique.
+    const NAME_MAX: usize = 255;
+    let budget = NAME_MAX.saturating_sub(suffix.len());
+    let name = name.to_string_lossy();
+    let mut base: &str = &name;
+    if base.len() > budget {
+        let mut end = budget;
+        while end > 0 && !base.is_char_boundary(end) {
+            end -= 1;
+        }
+        base = &base[..end];
+    }
+    Ok(dest.with_file_name(format!("{}{}", base, suffix)))
+}
+
+/// Move a finished partial archive onto the destination the user chose.
+///
+/// A plain rename is the whole story on Unix: atomic, and it replaces an
+/// existing file. Windows refuses to rename onto an existing path, so *there*
+/// the destination is removed and the rename retried — after the payload is
+/// completely written, and only for a destination the user picked in a save
+/// dialog that already asked about overwriting. That is the difference from the
+/// old code, which deleted the destination on the *failure* path, when the
+/// replacement did not exist.
+///
+/// The retry is fenced by two conditions, and both matter:
+///
+///   * `cfg!(windows)`. On Unix a rename never fails *because* the destination
+///     exists, so reaching the delete there means the rename failed for some
+///     other reason — `EACCES`, `EISDIR`, `EBUSY`, or a partial that is no
+///     longer there — and deleting the user's file would be destroying it to
+///     fix nothing. The guard used to be "did the rename fail and does the
+///     destination exist", which is true in every one of those cases.
+///   * the partial still exists. "Replace the destination" is only ever a
+///     sensible move when there is something to replace it *with*; if our
+///     source has vanished the answer is to report the failure and leave what
+///     the user already had alone.
+async fn finish_download(partial: &Path, dest: &Path) -> Result<(), String> {
+    match tokio::fs::rename(partial, dest).await {
+        Ok(()) => Ok(()),
+        Err(e) => {
+            let replaceable = cfg!(windows)
+                && tokio::fs::try_exists(partial).await.unwrap_or(false)
+                && tokio::fs::try_exists(dest).await.unwrap_or(false);
+            if !replaceable {
+                return Err(format!("Failed to save {}: {}", dest.display(), e));
+            }
+            tokio::fs::remove_file(dest)
+                .await
+                .map_err(|e| format!("Failed to replace {}: {}", dest.display(), e))?;
+            tokio::fs::rename(partial, dest)
+                .await
+                .map_err(|e| format!("Failed to save {}: {}", dest.display(), e))
+        }
+    }
+}
+
+/// How much of a container's stderr is worth keeping to explain a failure.
+///
+/// Every other reader of container output in this codebase is capped —
+/// `MAX_ONESHOT_OUTPUT`, `PROC_NET_OUTPUT_LIMIT` — for the reason named in
+/// their comments: the source is hostile. The two streaming commands were the
+/// exception, and their stdout is bounded by the disk it is being written to
+/// while their stderr was bounded by nothing at all. A container that puts a
+/// chattier `dd` earlier in `PATH` (it has passwordless sudo, so it can) could
+/// grow this `String` until the app was killed.
+///
+/// A few kilobytes is far more than any real diagnostic and far less than any
+/// pressure on the process.
+const MAX_EXEC_STDERR: usize = 8 * 1024;
+
+/// Append a container's stderr frame, stopping at [`MAX_EXEC_STDERR`].
+///
+/// Silently, and deliberately so: this text exists to explain a failure to a
+/// person, and "(truncated)" in the middle of a `dd` diagnostic explains
+/// nothing that the first eight kilobytes did not.
+fn push_capped(buf: &mut String, frame: &[u8]) {
+    if buf.len() >= MAX_EXEC_STDERR {
+        return;
+    }
+    let room = MAX_EXEC_STDERR - buf.len();
+    let text = String::from_utf8_lossy(frame);
+    if text.len() <= room {
+        buf.push_str(&text);
+        return;
+    }
+    let mut end = room;
+    while end > 0 && !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    buf.push_str(&text[..end]);
+}
+
+/// One regular file's bytes, pulled out of a container.
+struct FetchedFile {
+    bytes: Vec<u8>,
+    /// The size the tar header declared, i.e. the file's real size — which is
+    /// not `bytes.len()` once `max_bytes` has cut the read short.
+    size: u64,
+    truncated: bool,
+}
+
+/// Fetch a single regular file from a container as exact bytes.
+///
+/// The viewer's read. It deliberately goes through Docker's archive endpoint rather than
+/// `exec_oneshot`: that reader runs every chunk through `String::from_utf8_lossy`
+/// and merges stderr into stdout, so it would both corrupt any non-UTF-8 file
+/// and be able to splice diagnostics into what the caller believes is content.
+///
+/// The transfer is abandoned once the cap (plus enough slack for the tar
+/// framing) is in hand, so previewing a huge file does not pull the whole thing
+/// across the socket.
+///
+/// `max_bytes` is deliberately not optional. It used to be, and the old
+/// download command passed `None`: the cap below then did nothing and the whole
+/// file — or the whole *directory tree*, since the type check happens after the
+/// read — landed in host RAM twice. This function buffers, so every caller of
+/// it must name a ceiling.
+async fn fetch_container_file(
+    container_id: &str,
+    container_path: &str,
+    max_bytes: u64,
+) -> Result<FetchedFile, String> {
+    let docker = get_docker()?;
+
+    let mut stream = docker.download_from_container(
+        container_id,
+        Some(DownloadFromContainerOptions {
+            path: container_path.to_string(),
+        }),
+    );
+
+    // A tar member is a 512-byte header plus payload padded to 512. 8 KiB of
+    // slack past the payload cap guarantees the header and the whole capped
+    // prefix are present even with the stream cut short.
+    const TAR_SLACK: u64 = 8 * 1024;
+    let stop_after = max_bytes.saturating_add(TAR_SLACK);
+
+    let mut tar_bytes: Vec<u8> = Vec::new();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(|e| format!("Failed to download file: {}", e))?;
+        tar_bytes.extend_from_slice(&chunk);
+        if tar_bytes.len() as u64 >= stop_after {
+            // Dropping the stream cancels the rest of the transfer.
+            break;
+        }
+    }
+
+    let mut archive = tar::Archive::new(&tar_bytes[..]);
+    let mut entries = archive
+        .entries()
+        .map_err(|e| format!("Failed to read tar entries: {}", e))?;
+    let mut entry = match entries.next() {
+        Some(entry) => entry.map_err(|e| format!("Failed to read tar entry: {}", e))?,
+        None => return Err(format!("{} not found in the container", container_path)),
+    };
+
+    // Docker tars whatever the path names, so a directory arrives as a whole
+    // tree. Reading only its first member used to write a silently wrong file;
+    // say so instead.
+    let entry_type = entry.header().entry_type();
+    if entry_type.is_dir() {
+        return Err(format!(
+            "{} is a folder — open its files individually, or use Backup to take a whole tree.",
+            container_path
+        ));
+    }
+    if entry_type.is_symlink() || entry_type.is_hard_link() {
+        return Err(format!("{} is a link — open its target instead.", container_path));
+    }
+    if !entry_type.is_file() {
+        return Err(format!("{} is not a regular file.", container_path));
+    }
+
+    // `entry.size()` rather than the raw header field: see
+    // `stream_container_file_to_host`. A file past the ustar 8 GiB octal limit
+    // carries its real size in a PAX record, and reading the header field
+    // instead reported it as 0 — an empty preview of a very large file.
+    let size = entry.size();
+    let truncated = size > max_bytes;
+    let want = max_bytes.min(size);
+
+    let mut bytes = Vec::with_capacity(want.min(1024 * 1024) as usize);
+    std::io::Read::read_to_end(&mut std::io::Read::take(&mut entry, want), &mut bytes)
+        .map_err(|e| format!("Failed to read file contents: {}", e))?;
+
+    Ok(FetchedFile {
+        bytes,
+        size,
+        truncated,
+    })
+}
+
+/// Read a file out of the container for the in-app viewer.
+///
+/// `max_bytes` is the caller's ceiling (the viewer asks for more when it is
+/// about to decode an image, which is what usually goes over a text-sized cap);
+/// it is clamped to [`MAX_READ_BYTES`] regardless, because the whole payload is
+/// buffered in host RAM on the way through.
 #[tauri::command]
-pub async fn download_container_file(
+pub async fn read_container_file(
     project_id: String,
-    container_path: String,
-    host_path: String,
+    path: String,
+    max_bytes: Option<u64>,
     state: State<'_, AppState>,
-) -> Result<(), String> {
+) -> Result<FileContents, String> {
+    validate_container_path("File", &path)?;
+
     let project = state
         .projects_store
         .get(&project_id)
@@ -113,43 +1302,940 @@ pub async fn download_container_file(
         .as_ref()
         .ok_or_else(|| "Container not running".to_string())?;
 
+    let cap = max_bytes.unwrap_or(MAX_READ_BYTES).min(MAX_READ_BYTES);
+    let fetched = fetch_container_file(container_id, &path, cap).await?;
+
+    Ok(FileContents {
+        contents_base64: BASE64.encode(&fetched.bytes),
+        truncated: fetched.truncated,
+        size: fetched.size,
+    })
+}
+
+/// Rename an entry in place. `to_path` is the **new name**, not a destination
+/// path — moving between directories is deliberately not offered here, so the
+/// name is validated to carry no `/`.
+///
+/// Runs through `exec_oneshot_as` rather than `exec_oneshot` because the exit
+/// code is the only reliable signal: `exec_oneshot` discards the status, so a
+/// permission failure (renaming under `/etc` or `/usr`, which the container
+/// user genuinely cannot do) would return `Ok` with the error text as its
+/// "output". Returns the new full path.
+#[tauri::command]
+pub async fn rename_container_path(
+    project_id: String,
+    from_path: String,
+    to_path: String,
+    state: State<'_, AppState>,
+) -> Result<String, String> {
+    let project = state
+        .projects_store
+        .get(&project_id)
+        .ok_or_else(|| format!("Project {} not found", project_id))?;
+
+    let container_id = project
+        .container_id
+        .as_ref()
+        .ok_or_else(|| "Container not running".to_string())?;
+
+    // The name is checked by `validate_entry_name`; the path it is applied to
+    // was checked by nothing at all, which is how an `invoke` naming
+    // `/home/claude/.claude/.credentials.json` used to move the OAuth
+    // credential out from under Claude Code.
+    validate_container_write_path("Item", &from_path)?;
+    // The *parent* is resolved, never the item itself: `realpath` would follow
+    // a symlink to its target, and renaming a link has always meant renaming
+    // the link. `/` as a parent means a one-component path, which has no
+    // directory component to resolve.
+    let parent = parent_dir(&from_path);
+    if parent != "/" {
+        resolve_container_dir(container_id, "Item", &parent).await?;
+    }
+
+    let new_name = to_path.trim();
+    validate_entry_name(new_name)?;
+
+    let dest = join_path(&parent_dir(&from_path), new_name);
+    if dest == from_path {
+        return Ok(dest);
+    }
+
+    // `mv -n` refuses to clobber, but GNU coreutils makes that refusal *silent*
+    // and exits 0 — so `-n` on its own would report a rename that never
+    // happened. The existence check is what turns it into an error the user
+    // sees; `-n` stays as the belt-and-braces against the race between them.
+    let (_, exists) = exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["test".to_string(), "-e".to_string(), dest.clone()],
+        Vec::new(),
+    )
+    .await?;
+    if exists == 0 {
+        return Err(format!("\"{}\" already exists in this folder", new_name));
+    }
+
+    let (output, code) = exec_oneshot_as(
+        container_id,
+        "claude",
+        vec![
+            "mv".to_string(),
+            "-n".to_string(),
+            "--".to_string(),
+            from_path.clone(),
+            dest.clone(),
+        ],
+        Vec::new(),
+    )
+    .await?;
+
+    if code != 0 {
+        // Surface `mv`'s own words: "Permission denied" is the common case
+        // outside /workspace and a generic message would hide why.
+        let detail = output.trim();
+        return Err(if detail.is_empty() {
+            format!("Rename failed (exit {})", code)
+        } else {
+            detail.to_string()
+        });
+    }
+
+    Ok(dest)
+}
+
+/// Create a directory under `parent_path`. Fails rather than succeeding
+/// silently if the name is taken — `mkdir` without `-p` is what gives that.
+#[tauri::command]
+pub async fn create_container_directory(
+    project_id: String,
+    parent_path: String,
+    name: String,
+    state: State<'_, AppState>,
+) -> Result<String, String> {
+    let project = state
+        .projects_store
+        .get(&project_id)
+        .ok_or_else(|| format!("Project {} not found", project_id))?;
+
+    let container_id = project
+        .container_id
+        .as_ref()
+        .ok_or_else(|| "Container not running".to_string())?;
+
+    resolve_container_dir(container_id, "Folder", &parent_path).await?;
+
+    let name = name.trim();
+    validate_entry_name(name)?;
+    let dest = join_path(&parent_path, name);
+
+    let (output, code) = exec_oneshot_as(
+        container_id,
+        "claude",
+        vec!["mkdir".to_string(), "--".to_string(), dest.clone()],
+        Vec::new(),
+    )
+    .await?;
+
+    if code != 0 {
+        let detail = output.trim();
+        return Err(if detail.is_empty() {
+            format!("Could not create folder (exit {})", code)
+        } else {
+            detail.to_string()
+        });
+    }
+
+    Ok(dest)
+}
+
+/// Refuse, in a sentence, before a Docker error has to speak for us.
+///
+/// Both file transfers and the backup run through `docker exec`, which needs a
+/// running container. Without this the failure surfaces as bollard's
+/// `is not running` wrapped in whatever the caller was doing, and for the
+/// upload it surfaces even less usefully: `resolve_container_dir`'s `realpath`
+/// is the first thing to touch the container, so a stopped project fails inside
+/// path *validation* and reads like the path was the problem.
+async fn require_running(container_id: &str, action: &str) -> Result<(), String> {
+    let docker = get_docker()?;
+    let running = docker
+        .inspect_container(container_id, None)
+        .await
+        .ok()
+        .and_then(|info| info.state)
+        .and_then(|s| s.running)
+        .unwrap_or(false);
+    if running {
+        return Ok(());
+    }
+    Err(format!(
+        "Start the project before {} — it runs inside the running container.",
+        action
+    ))
+}
+
+/// Copy one regular file out of a container onto a host path the user chose in
+/// a save dialog.
+///
+/// ## Why this exists again
+///
+/// It was removed along with the rest of the Files pane's host I/O, on the
+/// reasoning that four audits had found their criticals in host paths crossing
+/// IPC. That reasoning was about the *reservation machinery* — the `link(2)`
+/// destination reservation, the placeholder rollback, the collision marker —
+/// and every one of those criticals lived there. Removing the machinery was
+/// right. Removing the feature with it took away something the app shipped
+/// before any of this work started, so the user upgraded into a regression.
+///
+/// None of the removed machinery comes back. The save dialog already asks about
+/// overwriting, so there is nothing to reserve and no collision to mark, and
+/// what is left is the sequence [`download_container_backup`] has been using
+/// unchanged: resolve the destination, stream into a partial file beside it,
+/// rename last. The destination the user already had is not touched until the
+/// transfer has completely succeeded.
+///
+/// ## Why `cat` rather than the archive endpoint
+///
+/// [`fetch_container_file`] buffers, which is why it takes a mandatory ceiling
+/// — it serves the viewer, where a cap is the correct behaviour. A download has
+/// no business refusing a 3 GB file, so this streams instead, and streaming
+/// means not reassembling a tar in host RAM. `exec_oneshot`'s reader is not
+/// usable here either: it runs chunks through `String::from_utf8_lossy` and
+/// merges stderr into stdout, so it would corrupt any non-UTF-8 file and let
+/// diagnostics splice themselves into content. Attaching to the exec directly
+/// gives pre-demuxed frames, and only `StdOut` frames are written.
+///
+/// The type check runs *inside* the same exec as the `cat`, not as a separate
+/// round trip, so there is no window between deciding the path is a regular
+/// file and reading it. `[ -f ]` follows symlinks — downloading through a
+/// symlink is ordinary and stays allowed — and is false for a directory, a
+/// device and, importantly, a FIFO: `cat` on one blocks forever with no writer
+/// and there is no timeout anywhere on this path.
+///
+/// Returns the number of bytes written. Zero is a success: an empty file is a
+/// file. (The backup's `total == 0` check is not copied down here — there it
+/// means the tar pipeline produced nothing, which is a failure.)
+#[tauri::command]
+pub async fn download_container_file(
+    project_id: String,
+    container_path: String,
+    window: tauri::Window,
+    state: State<'_, AppState>,
+) -> Result<Option<u64>, String> {
+    // Read-only source, so structure is what matters — not the write roots. A
+    // download may legitimately reach image content the panel cannot modify.
+    // Checked before the dialog: there is no point asking the user where to put
+    // something that was never going to be read.
+    validate_container_path("Download", &container_path)?;
+
+    // Before the dialog, matching `upload_files_to_container`: asking someone to
+    // choose a destination and only then telling them the project is stopped is
+    // the wrong order to find that out in. The window this opens — the project
+    // being stopped *during* the dialog — costs nothing, because the exec then
+    // fails with a Docker error and no host file has been touched.
+    let project = state
+        .projects_store
+        .get(&project_id)
+        .ok_or_else(|| format!("Project {} not found", project_id))?;
+
+    let container_id = project
+        .container_id
+        .as_ref()
+        .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
+
+    require_running(container_id, "saving a file to the host").await?;
+
+    let Some(chosen) = pick_save_path(&window, &suggested_save_name(&container_path)).await else {
+        // Dismissed. Not an error, and deliberately distinguishable from one:
+        // the frontend shows nothing at all rather than a "cancelled" toast.
+        return Ok(None);
+    };
+    let chosen = host_path_string(chosen)?;
+    // Still validated, even though the path came from an OS dialog rather than
+    // over IPC. It is no longer the only thing standing between a compromised
+    // webview and an arbitrary host write — that is what moving the dialog into
+    // Rust bought — but the rule is cheap and the two host-path commands
+    // agreeing about what is writable is worth more than the few refusals it
+    // costs. See the note on `pick_save_path` about which ones those are.
+    let dest = resolve_host_path(&chosen, HostPathUse::WriteChosenName).await?;
+
     let docker = get_docker()?;
 
-    let mut stream = docker.download_from_container(
-        container_id,
-        Some(DownloadFromContainerOptions {
-            path: container_path.clone(),
-        }),
+    // `$TC_SRC`, never argv interpolation: the path reaches the shell as an
+    // environment value, so a name containing a quote or a `$` is data.
+    //
+    // ## Why `dd iflag=nonblock` and not `cat`
+    //
+    // `[ -f ]` and the `open` that follows it are two syscalls, and the
+    // container owns the filesystem in between — a loop replacing the file with
+    // a FIFO wins that race often enough to matter. `cat` then blocks in
+    // `open(2)` forever with no writer, and there is no timeout anywhere on this
+    // path: the `invoke` never settles and a partial file is left in the user's
+    // directory for good. `O_NONBLOCK` makes that open return instead of hang.
+    // On a regular file the kernel ignores the flag, so this is byte-for-byte
+    // what `cat` did — verified against a real container, `cmp`-clean.
+    //
+    // ## Why the size, and not a second `[ -f ]`
+    //
+    // The first version of this bracketed the read with `[ -f ]` again, on the
+    // reasoning that a file which stopped being a regular file had changed
+    // underneath us. That check was wrong in **both** directions, and a review
+    // demonstrated both against a real container:
+    //
+    //   * it did not catch the case that loses data. Truncation *in place* —
+    //     `> file`, log rotation, `tar -x`, most build tools — leaves a regular
+    //     file behind, so `dd` stopped at the new EOF, exited 0, and a 34 MB
+    //     partial of a 600 MB file was renamed over the user's own copy and
+    //     reported as `Saved (34.1 MB)`. Same for truncate-to-zero, which needs
+    //     no adversary at all.
+    //   * it failed *good* downloads. `dd` already holds the fd, and neither
+    //     `rm` nor `mv` can affect an open one — the bytes are complete and
+    //     correct. But `rm` makes `[ -f ]` false, so a finished 600 MB transfer
+    //     of a file a bundler happened to unlink was deleted and reported as
+    //     "nothing was saved".
+    //
+    // So the question asked is the one that actually matters: **did we get at
+    // least as many bytes as the file had when we started?** `TC_SIZE=` on
+    // stderr carries the answer out (stdout is the payload and must stay
+    // pristine), and Rust compares it against what it wrote.
+    //
+    // That single rule subsumes everything the bracket was for and gets the two
+    // cases above right: a deleted or renamed source still delivers its whole
+    // length and passes; a truncated one delivers less and fails; the FIFO race
+    // delivers zero against a non-zero size and fails. A file *growing* during
+    // the read delivers more than it started with, which passes — correct, and
+    // the reason the test is `>=`.
+    //
+    // `dd` is not `exec`-ed: a replaced shell cannot run what follows it.
+    let script = r#"if [ -d "$TC_SRC" ]; then
+  echo "$TC_SRC is a folder — save its files individually." >&2
+  exit 3
+fi
+if [ ! -f "$TC_SRC" ]; then
+  echo "$TC_SRC is not a regular file." >&2
+  exit 4
+fi
+SZ=$(stat -c %s -- "$TC_SRC" 2>/dev/null) || SZ=""
+case "$SZ" in
+  ''|*[!0-9]*) echo "Could not measure $TC_SRC before reading it." >&2; exit 7 ;;
+esac
+echo "TC_SIZE=$SZ" >&2
+dd iflag=nonblock bs=64k status=none if="$TC_SRC" || exit 5"#;
+
+    let exec = docker
+        .create_exec(
+            container_id,
+            CreateExecOptions {
+                attach_stdout: Some(true),
+                attach_stderr: Some(true),
+                cmd: Some(vec!["sh".to_string(), "-c".to_string(), script.to_string()]),
+                env: Some(vec![format!("TC_SRC={}", container_path)]),
+                user: Some("claude".to_string()),
+                ..Default::default()
+            },
+        )
+        .await
+        .map_err(|e| format!("Failed to start download: {}", e))?;
+
+    let result = docker
+        .start_exec(&exec.id, None)
+        .await
+        .map_err(|e| format!("Failed to start download: {}", e))?;
+
+    let mut output = match result {
+        StartExecResults::Attached { output, .. } => output,
+        StartExecResults::Detached => return Err("Download exec started detached".to_string()),
+    };
+
+    use tokio::io::AsyncWriteExt;
+    let partial = partial_download_path(&dest)?;
+    // Same open-and-confirm as the backup: `create_new` is `O_EXCL` so the
+    // final component cannot be a symlink, and `verify_opened_path` catches a
+    // directory on the way having been swapped since it was resolved. The
+    // `created` flag separates "nothing was made" from "it is ours to remove".
+    let open_at = partial.clone();
+    let created = Arc::new(AtomicBool::new(false));
+    let opened = {
+        let created = Arc::clone(&created);
+        tokio::task::spawn_blocking(move || -> Result<std::fs::File, String> {
+            let file = std::fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(&open_at)
+                .map_err(|e| format!("Failed to create {}: {}", open_at.display(), e))?;
+            created.store(true, Ordering::SeqCst);
+            verify_opened_path(&file, &open_at)?;
+            Ok(file)
+        })
+        .await
+        .map_err(|e| format!("Download task panicked: {}", e))?
+    };
+    let file = match opened {
+        Ok(file) => file,
+        Err(e) => {
+            if created.load(Ordering::SeqCst) {
+                let _ = tokio::fs::remove_file(&partial).await;
+            }
+            return Err(e);
+        }
+    };
+    let file = tokio::fs::File::from_std(file);
+    let mut writer = tokio::io::BufWriter::new(file);
+    let mut total: u64 = 0;
+    let mut stderr_text = String::new();
+    let mut stream_err: Option<String> = None;
+    // The size the container reported before the read, if it has arrived yet.
+    // It is the first thing the script writes, so in practice it is in hand
+    // before the first payload frame — but the loop does not depend on that.
+    let mut declared: Option<u64> = None;
+
+    while let Some(msg) = output.next().await {
+        match msg {
+            Ok(LogOutput::StdOut { message }) => {
+                if let Err(e) = writer.write_all(&message).await {
+                    stream_err = Some(format!("Failed to write {}: {}", dest.display(), e));
+                    break;
+                }
+                total += message.len() as u64;
+                // A ceiling, derived from what the container itself said the
+                // file was. Without one, a single click on a file the panel
+                // lists as 2 KB can fill the host disk: `dd` is resolved
+                // through the container's `PATH`, which its agent owns with
+                // passwordless sudo, and a replacement that writes forever was
+                // measured at ~6 GB/s against a real container. The UI shows
+                // only "Saving…" while that happens and has no cancel.
+                //
+                // Generous, because a file can legitimately grow while it is
+                // being read — an active log is the ordinary case — and cutting
+                // one of those off would be a bug of our own. What this bounds
+                // is the *unbounded* case: the worst a single click can now
+                // cost is the slack, not the volume.
+                if let Some(limit) = declared.map(download_ceiling) {
+                    if total > limit {
+                        stream_err = Some(format!(
+                            "{} kept producing data long past the {} it reported — stopped at {}. Nothing was saved.",
+                            container_path,
+                            human_bytes(declared.unwrap_or(0)),
+                            human_bytes(total),
+                        ));
+                        break;
+                    }
+                }
+            }
+            Ok(LogOutput::StdErr { message }) => {
+                push_capped(&mut stderr_text, &message);
+                if declared.is_none() {
+                    declared = parse_declared_size(&stderr_text);
+                }
+            }
+            Ok(_) => {}
+            Err(e) => {
+                stream_err = Some(format!("Download stream error: {}", e));
+                break;
+            }
+        }
+    }
+    if stream_err.is_none() {
+        if let Err(e) = writer.flush().await {
+            stream_err = Some(format!("Failed to finalize {}: {}", dest.display(), e));
+        }
+    }
+    drop(writer);
+
+    // The read can be killed part-way through and still have sent bytes, so the
+    // exit code decides — not `total`.
+    //
+    // `!= Some(0)`, not `is_some_and(|c| c != 0)`. An *undeterminable* exit code
+    // is a failure here, and the difference is not academic: the backup catches
+    // this class with its `total == 0` check, which this command deliberately
+    // does not have because an empty file is a legitimate save. Restart a
+    // project mid-download and the exec is torn down — the attached stream ends
+    // at EOF rather than in an `Err`, and the exec instance is purged, so
+    // `inspect_exec` can no longer say how it ended. Reading that silence as
+    // success renames a truncated partial over the file the user already had
+    // and reports the byte count as if it were the whole thing. That is the one
+    // way this command could destroy data, so silence is failure.
+    let exit_code = crate::docker::exec::wait_for_exec_exit(&exec.id).await;
+    if stream_err.is_none() && exit_code != Some(0) {
+        // Framed and clipped, never verbatim.
+        //
+        // Be precise about what the frame buys, because the first version of
+        // this comment overstated it. `readableRefusal` on the frontend matches
+        // its markers with `includes`, not a prefix test — and it has to, since
+        // the app's own refusals carry those markers mid-sentence. So a frame
+        // does **not** stop container text reaching the toast headline: text
+        // containing "Triple-C will not" is promoted wherever it sits.
+        //
+        // What the frame does buy is that the app's own words come first, so
+        // the quoted part is visibly quoted. What the *clip* buys is the part
+        // that actually mattered: `MAX_EXEC_STDERR` is 8 KiB, which is room for
+        // a convincing forged instruction, and a toast is rendered above every
+        // modal. A couple of hundred characters on one line is a diagnostic;
+        // eight kilobytes of prose is a phishing surface with a scrollbar.
+        //
+        // Newlines and control characters go too: they are what let quoted text
+        // fake the structure of a message the app wrote.
+        let detail = clip_container_text(&stderr_text);
+        let detail = detail.as_str();
+        stream_err = Some(match exit_code {
+            None => format!(
+                "Could not confirm that {} was read completely — nothing was saved.",
+                container_path
+            ),
+            Some(code) if detail.is_empty() => {
+                format!("Could not read {} (exit {})", container_path, code)
+            }
+            Some(code) => format!("Could not read {} (exit {}): {}", container_path, code, detail),
+        });
+    }
+
+    // Short of what the file measured is the data-loss case, and it is the one
+    // an exit code cannot see: `dd` reports success for a file truncated under
+    // it, because it faithfully read to the EOF it was given. Verified against
+    // a real container — a 600 MB source truncated mid-read delivered 34 MB at
+    // exit 0, and before this check that 34 MB was renamed over the user's own
+    // copy and toasted as `Saved (34.1 MB)`.
+    //
+    // `>=`, not `==`: a file being appended to during the read delivers more
+    // than it measured, and that is a complete read, not a failure. A file
+    // deleted or renamed mid-read also passes, correctly — `dd` holds the fd
+    // and neither operation can touch it, so the bytes are whole.
+    if stream_err.is_none() {
+        match declared {
+            Some(size) if total < size => {
+                stream_err = Some(format!(
+                    "{} was {} when the copy started and only {} arrived — it changed while it was being read, so nothing was saved.",
+                    container_path,
+                    human_bytes(size),
+                    human_bytes(total),
+                ));
+            }
+            // The script exits 7 rather than staying quiet if it cannot measure
+            // the file, so a missing size here means the exec never got that
+            // far — and a zero exit with no measurement is not something to
+            // rename over the user's file on trust.
+            None => {
+                stream_err = Some(format!(
+                    "Could not confirm how much of {} arrived — nothing was saved.",
+                    container_path
+                ));
+            }
+            Some(_) => {}
+        }
+    }
+
+    if let Some(err) = stream_err {
+        // Only our own partial is removed. Whatever the user already had at
+        // `dest` has not been touched at any point above.
+        let _ = tokio::fs::remove_file(&partial).await;
+        return Err(err);
+    }
+
+    if let Err(e) = finish_download(&partial, &dest).await {
+        let _ = tokio::fs::remove_file(&partial).await;
+        return Err(e);
+    }
+
+    log::info!(
+        "Saved {} from project {} to {} ({} bytes)",
+        container_path,
+        project_id,
+        dest.display(),
+        total
     );
+    Ok(Some(total))
+}
 
-    let mut tar_bytes = Vec::new();
-    while let Some(chunk) = stream.next().await {
-        let chunk = chunk.map_err(|e| format!("Failed to download file: {}", e))?;
-        tar_bytes.extend_from_slice(&chunk);
+/// What one upload dialog's worth of files did.
+///
+/// Both halves are needed because one dialog can select several files and they
+/// do not have to agree: a folder among the selection, or one file over the
+/// size ceiling, must not cost the user the files either side of it. The
+/// failures are finished sentences, ready to show.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct UploadOutcome {
+    /// In-container paths, in the order they landed.
+    pub uploaded: Vec<String>,
+    /// One sentence per file that did not.
+    pub failures: Vec<String>,
+}
+
+/// Copy host files the user picked in an open dialog into the container
+/// directory the Files pane is showing.
+///
+/// `Ok(None)` means the picker was dismissed, which is not a failure and is
+/// deliberately distinguishable from one. Otherwise the [`UploadOutcome`]
+/// says what each selected file did — see there for why that is two lists.
+///
+/// The other half of the restoration described on [`download_container_file`],
+/// and the same rule: nothing that was removed comes back. In particular there
+/// is no destination reservation. The audit that ended this feature found the
+/// `link(2)` reservation returning success against a *directory* — linking into
+/// it, leaving permanent stray files, and through a symlinked directory writing
+/// outside the validated root — and failing permanently on any filesystem
+/// without hard links. What it was defending against was a name collision, and
+/// Docker's archive extractor overwrites on collision the same way `cp` does,
+/// which is what a file manager's upload is expected to do.
+///
+/// Every step here already existed and is already hardened; this command is the
+/// wiring, not new machinery:
+///
+///   * the name comes from the path **as the user gave it**, before resolution
+///     ([`host_upload_name`]) — `~/Downloads/latest.log` is routinely a symlink,
+///     and taking the leaf off the resolved path renames the file on its way in;
+///   * the bytes come from [`resolve_host_read_path`], i.e. the host-read policy
+///     applied to the path with its symlinks resolved, so a visible directory
+///     that *leads* to `~/.ssh` is refused;
+///   * the destination goes through [`resolve_container_dir`], so it is inside
+///     [`CONTAINER_WRITE_ROOTS`] both as written and as it resolves;
+///   * the read, the size ceiling and the descriptor check are
+///     `docker::exec::upload_host_file_with_ids`', unchanged — including
+///     landing the file owned by the container user rather than root.
+///
+/// The dialog itself is opened from Rust ([`pick_files_to_upload`]), which is
+/// the whole reason this shape is acceptable at all.
+#[tauri::command]
+pub async fn upload_files_to_container(
+    project_id: String,
+    container_dir: String,
+    window: tauri::Window,
+    state: State<'_, AppState>,
+) -> Result<Option<UploadOutcome>, String> {
+    let project = state
+        .projects_store
+        .get(&project_id)
+        .ok_or_else(|| format!("Project {} not found", project_id))?;
+
+    let container_id = project
+        .container_id
+        .as_ref()
+        .ok_or_else(|| "No container exists for this project yet — start it first".to_string())?;
+
+    // Both checks before the dialog, so a project that cannot receive files
+    // says so instead of asking the user to choose some first.
+    require_running(container_id, "uploading files").await?;
+    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+
+    let Some(picked) = pick_files_to_upload(&window).await else {
+        return Ok(None);
+    };
+
+    // Again, now that the picker has closed. The check above is there so a
+    // stopped or unwritable project says so *before* asking anyone to choose
+    // files; this one is the check that actually guards the extraction. A modal
+    // has no time limit, and `resolve_container_dir` answers a question about
+    // the container's filesystem — which the container is free to change while
+    // the dialog is open. Without this, `docker::exec`'s doc comment claim that
+    // the destination "has already been confirmed" would be true only of a
+    // moment that had passed.
+    resolve_container_dir(container_id, "Upload", &container_dir).await?;
+
+    // Once for the whole selection, not once per file — see
+    // `upload_host_file_with_ids`.
+    let ids = crate::docker::exec::container_user_ids(container_id).await;
+
+    let mut outcome = UploadOutcome {
+        uploaded: Vec::new(),
+        failures: Vec::new(),
+    };
+    for path in picked {
+        let path = match host_path_string(path) {
+            Ok(path) => path,
+            Err(e) => {
+                outcome.failures.push(e);
+                continue;
+            }
+        };
+        match upload_one(container_id, &path, &container_dir, ids).await {
+            Ok(dest) => {
+                log::info!("Uploaded {} into project {} at {}", path, project_id, dest);
+                outcome.uploaded.push(dest);
+            }
+            Err(e) => outcome.failures.push(e),
+        }
+    }
+    Ok(Some(outcome))
+}
+
+/// One file of an upload selection. Every refusal it returns is a sentence
+/// naming the file, because the caller may be reporting several at once and
+/// "is a folder" on its own does not say which one.
+async fn upload_one(
+    container_id: &str,
+    host_path: &str,
+    container_dir: &str,
+    ids: (u64, u64),
+) -> Result<String, String> {
+    let name = host_upload_name(host_path)?;
+    let resolved = resolve_host_read_path(host_path).await?;
+
+    let meta = tokio::fs::metadata(&resolved)
+        .await
+        .map_err(|e| format!("Cannot access {}: {}", resolved, e))?;
+    // `!is_file()`, not `!is_dir()` — the same reasoning as the terminal drop.
+    // A FIFO is neither a directory nor a regular file, reports `len() == 0`,
+    // and `File::open` on one blocks forever with no writer and no timeout.
+    if !meta.is_file() {
+        return Err(if meta.is_dir() {
+            format!("{} is a folder — upload its files individually.", host_path)
+        } else {
+            format!("{} is not a regular file — only ordinary files can be uploaded.", host_path)
+        });
+    }
+    // The ceiling is enforced against the open descriptor inside the uploader;
+    // this copy of it exists so the refusal arrives as a sentence instead of
+    // after a 300 MB read.
+    use crate::docker::exec::MAX_DROP_BYTES;
+    if meta.len() > MAX_DROP_BYTES {
+        return Err(format!(
+            "{} is too large to upload ({:.0} MB; limit {} MB). Mount it into the project instead.",
+            host_path,
+            meta.len() as f64 / (1024.0 * 1024.0),
+            MAX_DROP_BYTES / (1024 * 1024)
+        ));
     }
 
-    // Extract single file from tar archive
-    let mut archive = tar::Archive::new(&tar_bytes[..]);
-    let mut found = false;
-    for entry in archive
-        .entries()
-        .map_err(|e| format!("Failed to read tar entries: {}", e))?
-    {
-        let mut entry = entry.map_err(|e| format!("Failed to read tar entry: {}", e))?;
-        let mut contents = Vec::new();
-        std::io::Read::read_to_end(&mut entry, &mut contents)
-            .map_err(|e| format!("Failed to read file contents: {}", e))?;
-        std::fs::write(&host_path, &contents)
-            .map_err(|e| format!("Failed to write file to host: {}", e))?;
-        found = true;
-        break;
-    }
+    crate::docker::exec::upload_host_file_with_ids(
+        container_id,
+        &resolved,
+        container_dir,
+        &name,
+        ids,
+    )
+    .await
+}
 
-    if !found {
-        return Err("File not found in tar archive".to_string());
+/// Container-authored diagnostic text, cut down to something safe to quote.
+///
+/// One line, a couple of hundred characters, no control characters. See the
+/// call site for why each of those three matters; the short version is that
+/// this text ends up inside a toast that renders above every modal, and its
+/// author is the container.
+fn clip_container_text(text: &str) -> String {
+    const MAX: usize = 200;
+    let flattened: String = text
+        .trim()
+        .chars()
+        .map(|c| if c.is_control() { ' ' } else { c })
+        .collect();
+    let flattened = flattened.split_whitespace().collect::<Vec<_>>().join(" ");
+    if flattened.chars().count() <= MAX {
+        return flattened;
     }
+    let kept: String = flattened.chars().take(MAX).collect();
+    format!("{}…", kept.trim_end())
+}
 
-    Ok(())
+/// Pull `TC_SIZE=<n>` out of what the download script wrote to stderr.
+///
+/// A line rather than a second channel because there is no second channel: the
+/// exec has exactly two streams and stdout is the payload, which has to stay
+/// pristine — running it through anything is how a download corrupts a binary.
+///
+/// Deliberately strict. The container writes this, so it is parsed as one
+/// well-formed line and nothing else: an unparseable value yields `None`, and
+/// `None` fails the transfer rather than waving it through. The script has
+/// already refused (exit 7) if `stat` could not answer, so a missing value here
+/// means something further upstream went wrong.
+fn parse_declared_size(stderr: &str) -> Option<u64> {
+    stderr
+        .lines()
+        .find_map(|line| line.trim().strip_prefix("TC_SIZE="))
+        .and_then(|value| value.trim().parse::<u64>().ok())
+}
+
+/// How much more than its measured size a file may deliver before the transfer
+/// is treated as runaway.
+///
+/// Two shapes at once, because the two ends of the range need different things.
+/// A small file needs *absolute* slack — a 2 KB file that grows to 40 MB is
+/// unremarkable, and a multiplier would strangle it. A large one needs
+/// *proportional* slack — doubling is plenty, and a fixed 256 MiB on top of
+/// 3 GB is noise. So: whichever is larger.
+///
+/// This is a bound on the pathological case, not an attempt to predict the
+/// honest one. The honest case is bounded by the file; this exists so that a
+/// container answering a 2 KB read with an infinite stream costs the slack
+/// rather than the disk.
+fn download_ceiling(declared: u64) -> u64 {
+    const FLOOR: u64 = 256 * 1024 * 1024;
+    declared.saturating_mul(2).max(declared.saturating_add(FLOOR))
+}
+
+/// Bytes as a person reads them, for a refusal.
+///
+/// The frontend has `formatBytes` and these strings are built in Rust, so they
+/// cannot share it. Kept deliberately small — this is for error text, not for
+/// the UI, which formats its own.
+fn human_bytes(bytes: u64) -> String {
+    const UNITS: [(&str, u64); 4] = [
+        ("GB", 1024 * 1024 * 1024),
+        ("MB", 1024 * 1024),
+        ("KB", 1024),
+        ("bytes", 1),
+    ];
+    for (unit, scale) in UNITS {
+        if bytes >= scale {
+            return if scale == 1 {
+                format!("{} {}", bytes, unit)
+            } else {
+                format!("{:.1} {}", bytes as f64 / scale as f64, unit)
+            };
+        }
+    }
+    "0 bytes".to_string()
+}
+
+/// The path a dialog handed back, as a `String`, or a refusal.
+///
+/// Every host-path check in this module is `&str`-based, so a `PathBuf` has to
+/// become one somewhere. `to_string_lossy` is the wrong way to do it: invalid
+/// bytes become U+FFFD, which is a *different path*. For an upload that reads
+/// as "Cannot access …" on a file the user demonstrably just picked; for a save
+/// it is worse, because the write would go somewhere other than the file the
+/// dialog had just asked them to confirm overwriting.
+///
+/// Legacy Latin-1 filenames on Linux are the realistic way to meet this. Since
+/// nothing downstream can handle such a path honestly, it is refused by name
+/// rather than silently changed into another one.
+fn host_path_string(path: PathBuf) -> Result<String, String> {
+    path.into_os_string().into_string().map_err(|bad| {
+        format!(
+            "{} is not valid Unicode — Triple-C cannot transfer a file whose path it cannot spell exactly. Rename it, or move it somewhere with an ASCII name.",
+            PathBuf::from(bad).display()
+        )
+    })
+}
+
+/// The name the save dialog opens with.
+///
+/// ## This string is container-authored, and it is a *name*, not a path
+///
+/// It goes straight to `rfd`'s `set_file_name`, and on Windows the common file
+/// dialog parses its File-name box as a **path** on Save. A container can name
+/// a file anything a Linux filesystem accepts, backslashes included, and
+/// `validate_container_path` has no reason to object: it rejects a `..`
+/// *segment*, and `..\..\Users\vic\…` is one POSIX segment.
+///
+/// So `rsplit('/')` alone — which is what this was — let the container choose
+/// the destination on Windows, not just the file name:
+///
+/// ```text
+/// /workspace/proj/..\..\..\Users\vic\AppData\Roaming\Microsoft\Word\STARTUP\x.dotm
+///   -> "..\..\..\Users\vic\AppData\Roaming\Microsoft\Word\STARTUP\x.dotm"
+/// ```
+///
+/// One un-read click on Save and that resolves. `resolve_host_path` still runs
+/// on whatever the dialog produced, but Word's `STARTUP` and Excel's `XLSTART`
+/// are auto-loading persistence directories that the denylist does not name —
+/// and this file's own docs concede the denylist is "losing by construction".
+/// It was never meant to be the boundary for this caller.
+///
+/// The fix is to make the string incapable of being a path on any platform this
+/// ships to: every separator, the drive colon, and the rest of the characters
+/// NTFS refuses are replaced rather than removed, so the name stays the same
+/// length and stays recognisable. `?` and `*` are legal on Linux and go too —
+/// this is a *suggestion* the user can edit, and a pre-filled name Windows
+/// would reject is its own small bug.
+///
+/// The empty check is separate and also load-bearing: `rsplit` on a path with a
+/// trailing separator yields `Some("")`, so without it the fallback never fires
+/// and the dialog opens with a blank name.
+fn suggested_save_name(container_path: &str) -> String {
+    let leaf = container_path
+        .rsplit('/')
+        .next()
+        .filter(|leaf| !leaf.is_empty())
+        .unwrap_or("download");
+    let cleaned: String = leaf
+        .chars()
+        .map(|c| match c {
+            '/' | '\\' | ':' | '<' | '>' | '"' | '|' | '?' | '*' => '_',
+            c if c.is_control() => '_',
+            c => c,
+        })
+        .collect();
+    // `.` and `..` are names the dialog cannot use, and a name that sanitised
+    // down to nothing has nothing left to suggest.
+    if cleaned.is_empty() || cleaned == "." || cleaned == ".." {
+        return "download".to_string();
+    }
+    cleaned
+}
+
+/// Ask the user where to save, from Rust.
+///
+/// ## Why the dialog is here and not in the webview
+///
+/// This is the shape the previous round's threat model asked for by name. The
+/// frontend used to call `@tauri-apps/plugin-dialog` and hand the chosen path
+/// back over IPC as a string — at which point the backend has no way to tell a
+/// path a person picked from a path a compromised webview invented, and
+/// `resolve_host_path` is the *only* thing between `invoke` and an arbitrary
+/// host write. Four audits' worth of criticals lived in that gap.
+///
+/// Driving the dialog from Rust closes it structurally: the webview can ask for
+/// a save dialog, and that is the whole of its influence. It cannot name the
+/// destination, and it cannot proceed without a person choosing one.
+///
+/// ## What is still validated, and what that costs
+///
+/// The chosen path still goes through `resolve_host_path`, whose hidden-
+/// *directory* rule deliberately over-catches (see [`validate_host_path`]).
+/// That rule was written for adversarial input, and against a dialog it will
+/// occasionally refuse something a person meant — saving into `~/.config`, or
+/// picking a file out of `~/.cache`. It is kept anyway: the refusal is a clear
+/// sentence and the destinations it costs are unusual ones for this pane.
+///
+/// The hidden *leaf* rule is not kept, and the distinction matters. Under it,
+/// saving `/workspace/.env` was refused after the modal and after the overwrite
+/// prompt, quoting a name the app had pre-filled itself — and every
+/// `.gitignore`, `.eslintrc.json` and `.nvmrc` in an ordinary workspace with
+/// it, while uploading the same files worked. That is what
+/// [`HostPathUse::WriteChosenName`] exists for.
+///
+/// `None` means dismissed, which is not a failure. The `oneshot` is used rather
+/// than `blocking_save_file` because the blocking variants deadlock if they
+/// ever reach the main thread, and "which thread does this command run on" is
+/// not a property worth depending on.
+async fn pick_save_path(window: &tauri::Window, suggested: &str) -> Option<PathBuf> {
+    use tauri_plugin_dialog::DialogExt;
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    window
+        .dialog()
+        .file()
+        .set_parent(window)
+        .set_title("Save to host")
+        .set_file_name(suggested)
+        .save_file(move |picked| {
+            let _ = tx.send(picked);
+        });
+    rx.await.ok().flatten().and_then(|p| p.into_path().ok())
+}
+
+/// Ask the user which host files to upload, from Rust. See [`pick_save_path`]
+/// for why the dialog lives on this side.
+async fn pick_files_to_upload(window: &tauri::Window) -> Option<Vec<PathBuf>> {
+    use tauri_plugin_dialog::DialogExt;
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    window
+        .dialog()
+        .file()
+        .set_parent(window)
+        .set_title("Upload to container")
+        .pick_files(move |picked| {
+            let _ = tx.send(picked);
+        });
+    let picked: Vec<PathBuf> = rx
+        .await
+        .ok()
+        .flatten()?
+        .into_iter()
+        .filter_map(|p| p.into_path().ok())
+        .collect();
+    // An empty selection is a dismissal as far as the caller is concerned —
+    // there is nothing to report and nothing to refresh.
+    (!picked.is_empty()).then_some(picked)
 }
 
 /// Create a `.tar.gz` backup of the container and stream it to a host file.
@@ -172,6 +2258,12 @@ pub async fn download_container_backup(
     container_path: Option<String>,
     state: State<'_, AppState>,
 ) -> Result<u64, String> {
+    // `host_path` reached `File::create` unchecked, which truncated whatever was
+    // there before the exec had even started — and the error path then deleted
+    // it, so a backup of a non-existent container path took the user's file with
+    // it. Validate first, write to a partial file second, rename last.
+    let dest = resolve_host_path(&host_path, HostPathUse::Write).await?;
+
     let project = state
         .projects_store
         .get(&project_id)
@@ -184,20 +2276,11 @@ pub async fn download_container_backup(
 
     let docker = get_docker()?;
 
-    // The backup runs inside the container via `docker exec`, which requires it
-    // to be running. Fail with a clear message rather than a raw Docker error.
-    let running = docker
-        .inspect_container(container_id, None)
-        .await
-        .ok()
-        .and_then(|info| info.state)
-        .and_then(|s| s.running)
-        .unwrap_or(false);
-    if !running {
-        return Err("Start the project before backing up — the backup runs inside the running container.".to_string());
-    }
+    require_running(container_id, "backing up").await?;
 
     let path = container_path.unwrap_or_else(|| "/workspace".to_string());
+    // Read-only source: `tar -C` it, so absoluteness and `..` are what matter.
+    validate_container_path("Backup", &path)?;
 
     // Stage a sanitized home config, then tar+gzip workspace + staged config to
     // stdout. mktemp/jq output go nowhere near stdout, so the only thing the
@@ -267,9 +2350,45 @@ tar czf - --ignore-failed-read \
     };
 
     use tokio::io::AsyncWriteExt;
-    let file = tokio::fs::File::create(&host_path)
+    let partial = partial_download_path(&dest)?;
+    // Opened synchronously so the descriptor can be checked against the path
+    // that was resolved a moment ago (H4): `create_new` is `O_EXCL`, so this
+    // cannot have followed a symlink at the final component, but a directory
+    // on the way could have been swapped since.
+    //
+    // The two failures inside are not the same and must not be cleaned up the
+    // same way: `create_new` failing means nothing was created, while
+    // `verify_opened_path` failing means the file exists and is ours. The
+    // second used to propagate straight out and leave the partial behind.
+    // Hence the flag rather than a `?`.
+    let open_at = partial.clone();
+    let created = Arc::new(AtomicBool::new(false));
+    let opened = {
+        let created = Arc::clone(&created);
+        tokio::task::spawn_blocking(move || -> Result<std::fs::File, String> {
+            let file = std::fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(&open_at)
+                .map_err(|e| format!("Failed to create backup file: {}", e))?;
+            // From here on the file is ours, so a failure below may delete it.
+            created.store(true, Ordering::SeqCst);
+            verify_opened_path(&file, &open_at)?;
+            Ok(file)
+        })
         .await
-        .map_err(|e| format!("Failed to create backup file: {}", e))?;
+        .map_err(|e| format!("Backup task panicked: {}", e))?
+    };
+    let file = match opened {
+        Ok(file) => file,
+        Err(e) => {
+            if created.load(Ordering::SeqCst) {
+                let _ = tokio::fs::remove_file(&partial).await;
+            }
+            return Err(e);
+        }
+    };
+    let file = tokio::fs::File::from_std(file);
     let mut writer = tokio::io::BufWriter::new(file);
     let mut total: u64 = 0;
     let mut stderr_text = String::new();
@@ -285,7 +2404,7 @@ tar czf - --ignore-failed-read \
                 total += message.len() as u64;
             }
             Ok(LogOutput::StdErr { message }) => {
-                stderr_text.push_str(&String::from_utf8_lossy(&message));
+                push_capped(&mut stderr_text, &message);
             }
             Ok(_) => {}
             Err(e) => {
@@ -331,75 +2450,1176 @@ tar czf - --ignore-failed-read \
     }
 
     if let Some(err) = stream_err {
-        // Don't leave a partial/corrupt archive behind.
-        let _ = tokio::fs::remove_file(&host_path).await;
+        // Only our own partial archive is deleted — never whatever the user
+        // already had at `dest`, which has not been touched yet.
+        let _ = tokio::fs::remove_file(&partial).await;
         return Err(err);
     }
 
+    if let Err(e) = finish_download(&partial, &dest).await {
+        let _ = tokio::fs::remove_file(&partial).await;
+        return Err(e);
+    }
+
     log::info!(
         "Wrote {} byte backup for project {} to {}",
         total,
         project_id,
-        host_path
+        dest.display()
     );
     Ok(total)
 }
 
-#[tauri::command]
-pub async fn upload_file_to_container(
-    project_id: String,
-    host_path: String,
-    container_dir: String,
-    state: State<'_, AppState>,
-) -> Result<(), String> {
-    let project = state
-        .projects_store
-        .get(&project_id)
-        .ok_or_else(|| format!("Project {} not found", project_id))?;
+#[cfg(test)]
+mod tests {
+    use super::*;
 
-    let container_id = project
-        .container_id
-        .as_ref()
-        .ok_or_else(|| "Container not running".to_string())?;
-
-    let docker = get_docker()?;
-
-    let file_data = std::fs::read(&host_path)
-        .map_err(|e| format!("Failed to read host file: {}", e))?;
-
-    let file_name = std::path::Path::new(&host_path)
-        .file_name()
-        .ok_or_else(|| "Invalid file path".to_string())?
-        .to_string_lossy()
-        .to_string();
-
-    // Build tar archive in memory
-    let mut tar_buf = Vec::new();
-    {
-        let mut builder = tar::Builder::new(&mut tar_buf);
-        let mut header = tar::Header::new_gnu();
-        header.set_size(file_data.len() as u64);
-        header.set_mode(0o644);
-        header.set_cksum();
-        builder
-            .append_data(&mut header, &file_name, &file_data[..])
-            .map_err(|e| format!("Failed to create tar entry: {}", e))?;
-        builder
-            .finish()
-            .map_err(|e| format!("Failed to finalize tar: {}", e))?;
+    /// A destination name that fits its directory must not become a partial
+    /// name that does not. The leaf can come from the *container* now — a
+    /// bundler's content-hashed chunk name is routinely 200+ characters — so
+    /// this is reachable without anyone typing anything unusual.
+    #[test]
+    fn a_partial_name_stays_within_name_max() {
+        let long = "x".repeat(250);
+        let partial = partial_download_path(Path::new(&format!("/home/j/{}", long))).unwrap();
+        let leaf = partial.file_name().unwrap().to_string_lossy().to_string();
+        assert!(leaf.len() <= 255, "partial leaf was {} bytes", leaf.len());
+        assert!(leaf.contains(".triple-c-part-"));
+        // Same directory as the destination — the last step has to be a rename
+        // within one filesystem.
+        assert_eq!(partial.parent(), Some(Path::new("/home/j")));
     }
 
-    docker
-        .upload_to_container(
-            container_id,
-            Some(UploadToContainerOptions {
-                path: container_dir,
-                ..Default::default()
-            }),
-            tar_buf.into(),
-        )
-        .await
-        .map_err(|e| format!("Failed to upload file to container: {}", e))?;
+    /// Truncation must not split a character in half, or the partial cannot be
+    /// spelled back on a filesystem that validates encoding.
+    #[test]
+    fn a_partial_name_truncates_on_a_character_boundary() {
+        // 3 bytes each, deliberately: the budget is 232, which 3 does not
+        // divide, so a naive byte slice lands mid-character. A 2-byte character
+        // would divide it evenly and the test would pass without the boundary
+        // walk existing at all — which is exactly what it did on the first
+        // attempt.
+        let long = "日".repeat(250);
+        let partial = partial_download_path(Path::new(&format!("/home/j/{}", long))).unwrap();
+        let leaf = partial.file_name().unwrap().to_string_lossy().to_string();
+        assert!(leaf.len() <= 255);
+        // The kept part must be a genuine prefix of the name, whole characters
+        // only — which rules out both a mid-character cut and the other way of
+        // "not splitting a character", throwing the whole name away.
+        let kept = leaf.split(".triple-c-part-").next().unwrap();
+        assert!(!kept.is_empty(), "the whole name was discarded");
+        assert!(long.starts_with(kept), "kept part is not a prefix of the name");
+        assert_eq!(kept.len() % 3, 0, "cut landed mid-character");
+    }
 
-    Ok(())
+    /// An ordinary name is left exactly as it is — the cap must not be paid by
+    /// every download.
+    #[test]
+    fn an_ordinary_partial_name_keeps_the_whole_leaf() {
+        let partial = partial_download_path(Path::new("/home/j/notes.txt")).unwrap();
+        let leaf = partial.file_name().unwrap().to_string_lossy().to_string();
+        assert!(leaf.starts_with("notes.txt.triple-c-part-"));
+    }
+
+    /// The container's stderr is attacker-controlled and unbounded at the
+    /// source; it must be bounded here.
+    #[test]
+    fn container_stderr_stops_growing_at_the_cap() {
+        let mut buf = String::new();
+        for _ in 0..1000 {
+            push_capped(&mut buf, &b"x".repeat(1024));
+        }
+        assert!(buf.len() <= MAX_EXEC_STDERR, "grew to {}", buf.len());
+        // …and it is not simply empty: the point is to explain a failure.
+        assert!(!buf.is_empty());
+    }
+
+    /// Capping must not split a character either — the text goes into an error
+    /// message that is rendered.
+    #[test]
+    fn capping_stderr_truncates_on_a_character_boundary() {
+        // 3 bytes each, and the cap is not a multiple of 3, so a naive byte
+        // slice lands mid-character.
+        let text = "日".repeat(MAX_EXEC_STDERR);
+        let mut buf = String::new();
+        push_capped(&mut buf, text.as_bytes());
+        assert!(buf.len() <= MAX_EXEC_STDERR);
+        assert!(!buf.is_empty(), "the whole diagnostic was discarded");
+        assert!(text.starts_with(&buf), "kept part is not a prefix");
+        assert_eq!(buf.len() % 3, 0, "cut landed mid-character");
+    }
+
+    /// A path a dialog produced that cannot be spelled exactly is refused, not
+    /// quietly turned into a different path by U+FFFD substitution.
+    #[cfg(unix)]
+    #[test]
+    fn a_non_unicode_dialog_path_is_refused_rather_than_mangled() {
+        use std::os::unix::ffi::OsStringExt;
+        let bad = PathBuf::from(std::ffi::OsString::from_vec(b"/home/j/caf\xe9.txt".to_vec()));
+        let err = host_path_string(bad).unwrap_err();
+        assert!(err.contains("not valid Unicode"), "{}", err);
+        // An ordinary path still comes back untouched.
+        assert_eq!(
+            host_path_string(PathBuf::from("/home/j/café.txt")).unwrap(),
+            "/home/j/café.txt"
+        );
+    }
+
+    /// The dialog's pre-filled name is authored by the **container**, and on
+    /// Windows the save dialog parses its name box as a path. So the string
+    /// must be incapable of being one.
+    #[test]
+    fn a_suggested_name_can_never_be_a_path() {
+        // The finding this exists for, verbatim: `..` segments plus backslashes
+        // reach Word's auto-loading STARTUP directory, which the host-path
+        // denylist does not name.
+        let evil = r"/workspace/proj/..\..\..\Users\vic\AppData\Roaming\Microsoft\Word\STARTUP\x.dotm";
+        let got = suggested_save_name(evil);
+        assert!(!got.contains('\\'), "{}", got);
+        assert!(!got.contains('/'), "{}", got);
+        // A drive letter is a path on Windows too.
+        let drive = r"/workspace/proj/C:\Users\vic\Desktop\payload.exe";
+        let got = suggested_save_name(drive);
+        assert!(!got.contains(':'), "{}", got);
+        assert!(!got.contains('\\'), "{}", got);
+    }
+
+    /// Sanitising must not damage the ordinary case — the whole point of a
+    /// suggestion is that it is the file's name.
+    #[test]
+    fn an_ordinary_suggested_name_is_untouched() {
+        assert_eq!(suggested_save_name("/workspace/notes.txt"), "notes.txt");
+        assert_eq!(suggested_save_name("/workspace/my report (v2).pdf"), "my report (v2).pdf");
+        // Dotfiles are the common case this pane browses, and they are saveable
+        // now — see `HostPathUse::WriteChosenName`.
+        assert_eq!(suggested_save_name("/workspace/.env"), ".env");
+    }
+
+    /// A name that sanitises down to nothing usable still has to open the
+    /// dialog with something.
+    #[test]
+    fn a_suggested_name_always_has_something_in_it() {
+        assert_eq!(suggested_save_name("/workspace/logs/"), "download");
+        assert_eq!(suggested_save_name("/"), "download");
+        assert_eq!(suggested_save_name(""), "download");
+        // `/` alone sanitises to `_`, not to nothing — that is fine and still a
+        // name. But a leaf that *is* `..` is not usable as one.
+        assert_eq!(suggested_save_name("/workspace/.."), "download");
+    }
+
+    /// A dotfile must be saveable to the host. Under the old rule the leaf was
+    /// judged for hiddenness on every write, so `.env` was refused *after* the
+    /// modal — with the name the app itself had pre-filled.
+    #[test]
+    fn a_dotfile_can_be_saved_when_the_user_named_it_in_a_dialog() {
+        let dest = "/home/j/Documents/.env";
+        assert!(
+            validate_host_path(dest, HostPathUse::WriteChosenName).is_ok(),
+            "a name chosen in a save dialog should be allowed to be hidden"
+        );
+        // But only the leaf. A hidden *directory* is refused exactly as before.
+        assert!(validate_host_path("/home/j/.ssh/authorized_keys", HostPathUse::WriteChosenName).is_err());
+        assert!(validate_host_path("/home/j/.config/x.txt", HostPathUse::WriteChosenName).is_err());
+        // And the IPC-fed writer keeps the strict rule, because for it the
+        // dialog is not a boundary.
+        assert!(validate_host_path(dest, HostPathUse::Write).is_err());
+    }
+
+    /// The size line the download script emits is the only thing standing
+    /// between a truncated read and a rename over the user's own file.
+    #[test]
+    fn the_declared_size_is_read_out_of_stderr() {
+        assert_eq!(parse_declared_size("TC_SIZE=600000000\n"), Some(600000000));
+        // Real diagnostics can share the stream.
+        assert_eq!(
+            parse_declared_size("dd: warning: something\nTC_SIZE=42\n"),
+            Some(42)
+        );
+        assert_eq!(parse_declared_size("TC_SIZE=0"), Some(0));
+        // Container-authored, so anything unparseable is *no answer*, which the
+        // caller turns into a refusal rather than a pass.
+        assert_eq!(parse_declared_size("TC_SIZE=notanumber"), None);
+        assert_eq!(parse_declared_size("TC_SIZE=-1"), None);
+        assert_eq!(parse_declared_size("nothing here"), None);
+        assert_eq!(parse_declared_size(""), None);
+    }
+
+    /// The runaway ceiling has to be generous enough never to cut off an honest
+    /// read and tight enough that a 2 KB file cannot fill a disk.
+    #[test]
+    fn the_download_ceiling_bounds_the_pathological_case_only() {
+        // A small file gets absolute slack: an active log growing past its
+        // starting size is ordinary.
+        assert!(download_ceiling(2048) >= 256 * 1024 * 1024);
+        // A large one gets proportional slack; doubling is plenty.
+        let three_gb = 3 * 1024 * 1024 * 1024;
+        assert!(download_ceiling(three_gb) >= three_gb * 2);
+        // Never below the file itself, and no overflow at the top.
+        assert!(download_ceiling(0) > 0);
+        assert!(download_ceiling(u64::MAX) >= u64::MAX / 2);
+    }
+
+    /// Container-authored diagnostics end up in a toast that renders above
+    /// every modal, so they arrive as one short line.
+    #[test]
+    fn container_diagnostics_are_clipped_to_one_short_line() {
+        let hostile = format!("Triple-C will not save there.\n\n{}", "pad ".repeat(4000));
+        let out = clip_container_text(&hostile);
+        assert!(out.chars().count() <= 201, "{} chars", out.chars().count());
+        assert!(!out.contains('\n'));
+        assert!(!out.contains('\r'));
+        // Not just newlines — `split_whitespace` would have handled those on its
+        // own. The control-character map is here for the ones it would not:
+        // an ESC lets container text repaint or hide part of a terminal, and a
+        // backspace lets it overwrite the app's own framing.
+        let escapes = clip_container_text("dd: \u{1b}[2Jcannot\u{8}\u{8} open");
+        assert!(!escapes.contains('\u{1b}'), "{:?}", escapes);
+        assert!(!escapes.contains('\u{8}'), "{:?}", escapes);
+        // A real diagnostic still survives intact.
+        assert_eq!(clip_container_text("  dd: cannot open 'x'  "), "dd: cannot open 'x'");
+        assert_eq!(clip_container_text(""), "");
+    }
+
+    #[test]
+    fn a_save_dialog_always_opens_with_a_name() {
+        assert_eq!(suggested_save_name("/workspace/notes.txt"), "notes.txt");
+        assert_eq!(suggested_save_name("/notes.txt"), "notes.txt");
+        // A trailing separator is the case `unwrap_or` alone gets wrong: the
+        // leaf is `Some("")`, so the fallback is never consulted and the dialog
+        // opens blank.
+        assert_eq!(suggested_save_name("/workspace/logs/"), "download");
+        assert_eq!(suggested_save_name("/"), "download");
+        assert_eq!(suggested_save_name(""), "download");
+    }
+
+    /// A record as `find -printf '%y\t%Y\t%s\t%T@\t%m\t%f\0'` emits it —
+    /// fields first, name last, NUL-terminated.
+    fn line(name: &str, own: &str, deref: &str, size: &str) -> String {
+        format!("{}\t{}\t{}\t1700000000.0000000000\t644\t{}\0", own, deref, size, name)
+    }
+
+    #[test]
+    fn parses_a_plain_file_row() {
+        let entries = parse_find_output("/workspace", &line("notes.txt", "f", "f", "42"));
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "notes.txt");
+        assert_eq!(entries[0].path, "/workspace/notes.txt");
+        assert!(!entries[0].is_directory);
+        assert!(!entries[0].is_symlink);
+        assert_eq!(entries[0].size, 42);
+        assert_eq!(entries[0].permissions, "644");
+        assert_eq!(entries[0].modified, "2023-11-14 22:13:20");
+    }
+
+    #[test]
+    fn a_symlink_to_a_directory_is_navigable_and_still_flagged_as_a_link() {
+        // The bug this guards: `%y` reports `l`, so keying `is_directory` off it
+        // made every symlinked directory an unopenable row.
+        let entries = parse_find_output("/workspace", &line("app", "l", "d", "12"));
+        assert!(entries[0].is_directory);
+        assert!(entries[0].is_symlink);
+    }
+
+    #[test]
+    fn a_broken_symlink_is_not_a_directory() {
+        // `%Y` is `N` when the target is missing, `L` on a loop.
+        for deref in ["N", "L", "?"] {
+            let entries = parse_find_output("/workspace", &line("dangling", "l", deref, "9"));
+            assert!(!entries[0].is_directory, "deref type {} became a directory", deref);
+            assert!(entries[0].is_symlink);
+        }
+    }
+
+    #[test]
+    fn directories_sort_first_then_case_insensitively() {
+        let output = [
+            line("Zeta", "f", "f", "1"),
+            line("alpha", "f", "f", "1"),
+            line("src", "d", "d", "4096"),
+        ]
+        .concat();
+        let entries = parse_find_output("/workspace", &output);
+        let names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect();
+        assert_eq!(names, vec!["src", "alpha", "Zeta"]);
+    }
+
+    #[test]
+    fn short_and_blank_rows_are_dropped_rather_than_mis_parsed() {
+        let output = format!("\0  \0broken\ttoo\tshort\0{}", line("ok", "f", "f", "1"));
+        let entries = parse_find_output("/workspace", &output);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "ok");
+    }
+
+    #[test]
+    fn the_root_directory_does_not_get_a_doubled_separator() {
+        let entries = parse_find_output("/", &line("etc", "d", "d", "4096"));
+        assert_eq!(entries[0].path, "/etc");
+    }
+
+    #[test]
+    fn unparseable_size_and_mtime_fall_back_instead_of_dropping_the_row() {
+        let output = "f\tf\t-\t-\t644\tweird";
+        let entries = parse_find_output("/workspace", output);
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].size, 0);
+    }
+
+    #[test]
+    fn the_listing_argv_puts_the_name_last_and_terminates_records_with_nul() {
+        // Pinned together with the parser: these two only work as a pair, and
+        // the separators must reach `find` as escapes — a literal NUL cannot
+        // travel in argv.
+        let argv = list_argv("/workspace");
+        assert_eq!(argv[0], "find");
+        // `-H` before the starting point, or `find` reads it as a predicate.
+        assert_eq!(argv[1], "-H");
+        assert_eq!(argv[2], "/workspace");
+        let format = argv.last().unwrap();
+        assert!(format.ends_with("%f\\0"), "{}", format);
+        assert!(!format.contains('\0'));
+        assert!(!format.contains('\n'));
+    }
+
+    #[test]
+    fn a_symlinked_directory_is_listed_by_following_the_starting_point() {
+        // `find` defaults to `-P`, which does not follow a link even when it is
+        // the thing it was pointed at: `find /workspace/link -mindepth 1`
+        // matched the link, `-mindepth 1` discarded it, and a real directory
+        // rendered as "Empty directory". The row was navigable — `%Y` has said
+        // "directory" for a symlinked one since the type columns were split —
+        // so double-clicking it opened a folder that appeared to have nothing
+        // in it.
+        assert!(list_argv("/workspace/link").contains(&"-H".to_string()));
+        // …and only the starting point: `-L` would have `find` chase the links
+        // it enumerates, which is where a symlink loop becomes a walk that does
+        // not end.
+        assert!(!list_argv("/workspace/link").contains(&"-L".to_string()));
+    }
+
+    #[test]
+    fn a_link_that_leads_nowhere_is_described_rather_than_quoted() {
+        // Now that `-H` follows the starting point, the two failures a link can
+        // produce reach the user — and `find`'s own words for them are an errno
+        // about a path, for a row they double-clicked because it looked like a
+        // folder.
+        let looped = describe_find_diagnostics(
+            "/workspace/loop",
+            "find: '/workspace/loop': Too many levels of symbolic links",
+        );
+        assert!(looped.contains("loops back on itself"), "{}", looped);
+        assert!(looped.contains("/workspace/loop"), "{}", looped);
+
+        let broken = describe_find_diagnostics(
+            "/workspace/broken",
+            "find: '/workspace/broken': No such file or directory",
+        );
+        assert!(broken.contains("does not lead anywhere"), "{}", broken);
+
+        // Everything else is `find`'s to say, and it says it well.
+        assert_eq!(
+            describe_find_diagnostics("/root", "find: '/root': Permission denied"),
+            "find: '/root': Permission denied"
+        );
+    }
+
+    #[test]
+    fn a_tab_in_a_filename_cannot_forge_the_type_and_size_columns() {
+        // The bug this guards: with the name first, `evil.txt\td\td\t4096…`
+        // rendered as a *directory* of the attacker's chosen size. The name is
+        // last now, so the tabs stay inside it.
+        let entries = parse_find_output(
+            "/workspace",
+            &line("evil.txt\td\td\t4096", "f", "f", "3"),
+        );
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "evil.txt\td\td\t4096");
+        assert!(!entries[0].is_directory);
+        assert_eq!(entries[0].size, 3);
+    }
+
+    #[test]
+    fn a_newline_in_a_filename_cannot_forge_a_whole_row() {
+        // A filename may contain a newline, so a line-terminated format let one
+        // name print two rows. NUL is the byte a filename cannot contain.
+        let entries = parse_find_output("/workspace", &line("two\nlines", "f", "f", "5"));
+        assert_eq!(entries.len(), 1);
+        assert_eq!(entries[0].name, "two\nlines");
+        assert_eq!(entries[0].path, "/workspace/two\nlines");
+    }
+
+    #[test]
+    fn parent_dir_walks_up_one_level_and_stops_at_root() {
+        assert_eq!(parent_dir("/workspace/app/src"), "/workspace/app");
+        assert_eq!(parent_dir("/workspace/app/src/"), "/workspace/app");
+        assert_eq!(parent_dir("/workspace"), "/");
+        assert_eq!(parent_dir("/"), "/");
+    }
+
+    #[test]
+    fn a_rename_target_may_not_relocate_the_entry() {
+        // The whole point of the validator: this is argv for `mv`, and a name
+        // with a separator in it would be a move, not a rename.
+        assert!(validate_entry_name("sub/dir").is_err());
+        assert!(validate_entry_name("../escape").is_err());
+        assert!(validate_entry_name("/etc/passwd").is_err());
+    }
+
+    #[test]
+    fn dot_and_dotdot_and_empty_are_refused() {
+        assert!(validate_entry_name("").is_err());
+        assert!(validate_entry_name(".").is_err());
+        assert!(validate_entry_name("..").is_err());
+        assert!(validate_entry_name("\0").is_err());
+        assert!(validate_entry_name(&"x".repeat(256)).is_err());
+    }
+
+    #[test]
+    fn ordinary_names_including_awkward_ones_are_allowed() {
+        // Nothing goes through a shell, so metacharacters are just characters —
+        // and a leading `-` is safe because every call site passes `--` first.
+        for name in [".hidden", "a b.txt", "$(whoami)", "it's", "-rf", "…unicode…"] {
+            assert!(validate_entry_name(name).is_ok(), "{} was refused", name);
+        }
+    }
+
+    #[test]
+    fn the_viewer_cap_is_never_larger_than_the_hard_ceiling() {
+        // The frontend picks a cap per file type; Rust still gets the last word
+        // because the whole payload is buffered in host RAM.
+        assert_eq!(Some(u64::MAX).unwrap().min(MAX_READ_BYTES), MAX_READ_BYTES);
+    }
+
+    // ── Path validation ─────────────────────────────────────────────────────
+
+    #[test]
+    fn a_listing_path_that_is_really_an_argument_is_refused() {
+        // C2. `find` ends its starting-point list at the first argument
+        // beginning with `-`, so `path = "-delete"` listed nothing and ran
+        // `-delete` over the exec's working directory — the bind-mounted
+        // project. Verified deleting on findutils 4.9.0. `--` does not help;
+        // absoluteness does.
+        for path in ["-delete", "-exec", "--", "-mindepth"] {
+            let err = validate_container_path("Folder", path).unwrap_err();
+            assert!(err.contains("absolute"), "{} → {}", path, err);
+        }
+    }
+
+    #[test]
+    fn a_container_path_must_be_absolute_and_traversal_free() {
+        assert!(validate_container_path("Folder", "/workspace").is_ok());
+        assert!(validate_container_path("Folder", "/home/claude/.claude").is_ok());
+        // A name that merely *starts* with a dot-dot is not traversal.
+        assert!(validate_container_path("Folder", "/workspace/..hidden").is_ok());
+
+        assert!(validate_container_path("Folder", "").is_err());
+        assert!(validate_container_path("Folder", "workspace/app").is_err());
+        assert!(validate_container_path("Folder", "/workspace/../etc").is_err());
+        assert!(validate_container_path("Folder", "/workspace/..").is_err());
+        assert!(validate_container_path("Folder", "/work\0space").is_err());
+        assert!(validate_container_path("Folder", &format!("/{}", "x".repeat(4096))).is_err());
+    }
+
+    #[test]
+    fn only_the_folders_the_app_owns_can_be_written_to() {
+        for path in ["/workspace", "/workspace/app/src", "/home/claude", "/tmp/x"] {
+            assert!(validate_container_write_path("Item", path).is_ok(), "{}", path);
+        }
+        // Reading these is fine — changing them is not this panel's business,
+        // and outside /workspace it would be a permission error anyway.
+        for path in ["/", "/etc/passwd", "/usr/lib", "/home/other", "/workspace-backup/x"] {
+            assert!(validate_container_write_path("Item", path).is_err(), "{}", path);
+        }
+    }
+
+    #[test]
+    fn containment_is_compared_by_whole_segments() {
+        // The classic `starts_with` bug: `/workspace-backup` is not under
+        // `/workspace`.
+        assert!(is_under_root("/workspace", "/workspace"));
+        assert!(is_under_root("/workspace/", "/workspace"));
+        assert!(is_under_root("/workspace/app", "/workspace"));
+        assert!(!is_under_root("/workspaces", "/workspace"));
+        assert!(!is_under_root("/workspace-backup/x", "/workspace"));
+        assert!(!is_under_root("/", "/workspace"));
+    }
+
+    #[test]
+    fn an_ordinary_save_location_is_accepted() {
+        for path in ["/home/jo/Downloads/report.pdf", "/tmp/out.txt", "/media/usb/a b.md"] {
+            assert!(validate_host_path(path, HostPathUse::Write).is_ok(), "{}", path);
+            assert!(validate_host_path(path, HostPathUse::Read).is_ok(), "{}", path);
+        }
+    }
+
+    #[test]
+    fn a_host_path_must_be_absolute_and_traversal_free() {
+        assert!(validate_host_path("", HostPathUse::Write).is_err());
+        assert!(validate_host_path("report.pdf", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/home/jo/../../etc/hosts", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/home/jo/re\0port", HostPathUse::Write).is_err());
+    }
+
+    #[test]
+    fn a_hidden_host_directory_is_refused_in_both_directions() {
+        // The container→host write primitive worth closing: container-controlled
+        // bytes at a path of the caller's choosing.
+        assert!(validate_host_path("/home/jo/.ssh/authorized_keys", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/home/jo/.config/autostart/x", HostPathUse::Write).is_err());
+        // …and the host→container read that pairs with it.
+        assert!(validate_host_path("/home/jo/.aws/credentials", HostPathUse::Read).is_err());
+        assert!(validate_host_path("/home/jo/.ssh/id_rsa", HostPathUse::Read).is_err());
+    }
+
+    #[test]
+    fn a_hidden_file_name_may_be_uploaded_but_not_created() {
+        // Dragging a project's own `.env` into the container is ordinary; being
+        // handed a container-controlled `~/.bashrc` is not.
+        assert!(validate_host_path("/home/jo/project/.env", HostPathUse::Read).is_ok());
+        assert!(validate_host_path("/home/jo/.bashrc", HostPathUse::Write).is_err());
+    }
+
+    #[test]
+    fn host_system_locations_are_refused_including_windows_ones() {
+        assert!(validate_host_path("/etc/cron.d/x", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/usr/bin/tool", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/etc/shadow", HostPathUse::Read).is_err());
+        // Case and separator are normalised before the comparison.
+        let windows = "C:\\Windows\\System32\\drivers\\etc\\hosts";
+        assert!(validate_host_path(windows, HostPathUse::Write).is_err());
+        // A user directory that merely shares a prefix is not a system one.
+        assert!(validate_host_path("/home/jo/etcetera/notes.txt", HostPathUse::Write).is_ok());
+    }
+
+    // ── Staging a host write (Backup) ───────────────────────────────────────
+
+    #[test]
+    fn a_download_is_staged_beside_its_destination_and_renamed() {
+        // Why: the destination must not be touched until the transfer has
+        // succeeded, and the rename that finishes the job must not cross a
+        // filesystem.
+        let dest = Path::new("/home/jo/Downloads/report.pdf");
+        let partial = partial_download_path(dest).unwrap();
+        assert_eq!(partial.parent(), dest.parent());
+        assert_ne!(partial, dest);
+        let name = partial.file_name().unwrap().to_string_lossy().to_string();
+        assert!(name.starts_with("report.pdf."), "{}", name);
+        assert!(name.contains("triple-c-part-"), "{}", name);
+        // Visible on purpose: a crash leaves it next to the file it meant to be.
+        assert!(!name.starts_with('.'), "{}", name);
+        // Two downloads of the same file must not share a partial.
+        assert_ne!(partial_download_path(dest).unwrap(), partial);
+        assert!(partial_download_path(Path::new("/")).is_err());
+    }
+
+    #[tokio::test]
+    async fn finishing_a_download_replaces_the_destination_only_once_it_is_whole() {
+        // The destination the user picked already holds something — the save
+        // dialog asked about that — and what must never happen is losing it to a
+        // download that did not arrive. Here the payload *has* arrived, so the
+        // swap goes through, on Windows (rename refuses an existing target) as
+        // well as Unix.
+        let dir = std::env::temp_dir().join(format!("tc-finish-{}", uuid::Uuid::new_v4()));
+        tokio::fs::create_dir_all(&dir).await.unwrap();
+        let dest = dir.join("thesis.docx");
+        tokio::fs::write(&dest, b"the original").await.unwrap();
+
+        let partial = partial_download_path(&dest).unwrap();
+        tokio::fs::write(&partial, b"the download").await.unwrap();
+
+        finish_download(&partial, &dest).await.unwrap();
+        assert_eq!(tokio::fs::read(&dest).await.unwrap(), b"the download");
+        assert!(!partial.exists(), "the partial file was left behind");
+
+        let _ = tokio::fs::remove_dir_all(&dir).await;
+    }
+
+    #[tokio::test]
+    async fn a_rename_that_fails_for_any_other_reason_leaves_the_destination_alone() {
+        // The guard used to be "the rename failed and the destination exists",
+        // which is true of every failure that has nothing to do with the
+        // destination existing — a vanished partial, a permission error, a
+        // destination that is a directory. Each of those then *deleted* the
+        // file the user already had, in order to complete a move that could not
+        // complete. Here the partial is missing, which is the clearest case:
+        // there is nothing to replace it with, so nothing is replaced.
+        let dir = std::env::temp_dir().join(format!("tc-finish-safe-{}", uuid::Uuid::new_v4()));
+        tokio::fs::create_dir_all(&dir).await.unwrap();
+        let dest = dir.join("thesis.docx");
+        tokio::fs::write(&dest, b"the original").await.unwrap();
+        let missing = partial_download_path(&dest).unwrap();
+
+        let err = finish_download(&missing, &dest).await.unwrap_err();
+        assert!(err.starts_with("Failed to save"), "{}", err);
+        assert_eq!(
+            tokio::fs::read(&dest).await.unwrap(),
+            b"the original",
+            "the destination was destroyed by a failure that was not about it"
+        );
+
+        let _ = tokio::fs::remove_dir_all(&dir).await;
+    }
+
+    // ── Host path normalisation, on every platform ──────────────────────────
+
+    #[test]
+    fn windows_system_locations_are_recognised_wherever_this_runs() {
+        // The bug this guards is a *test* bug with a real hole behind it. The
+        // old assertion was `validate_host_path("C:\\Windows\\…").is_err()`,
+        // and on Linux it passed because `Path::is_absolute` is false for a
+        // Windows path there — so the four Windows entries in
+        // `HOST_SYSTEM_ROOTS` were never once compared against anything in CI.
+        // The rule is a pure function over a string now, and this drives it.
+        assert_eq!(
+            host_system_root_for("C:\\Windows\\System32\\drivers\\etc\\hosts"),
+            Some("c:/windows")
+        );
+        assert_eq!(host_system_root_for("c:/Program Files/x"), Some("c:/program files"));
+
+        // `\\?\` turns off Win32 path parsing; it does not name a different
+        // place. `std::fs::canonicalize` returns this spelling on Windows, so
+        // the check has to understand its own output.
+        assert_eq!(
+            host_system_root_for("\\\\?\\C:\\Windows\\System32\\x"),
+            Some("c:/windows")
+        );
+        assert_eq!(
+            host_system_root_for("\\\\.\\C:\\ProgramData\\x"),
+            Some("c:/programdata")
+        );
+
+        // An administrative share reaches the same drive over UNC.
+        assert_eq!(host_system_root_for("\\\\localhost\\C$\\Windows\\x"), Some("c:/windows"));
+        assert_eq!(host_system_root_for("\\\\?\\UNC\\host\\C$\\Windows\\x"), Some("c:/windows"));
+        assert_eq!(host_system_root_for("\\\\host\\ADMIN$\\System32\\x"), Some("c:/windows"));
+
+        // An ordinary file share has no local equivalent, and this list does
+        // not pretend to know what is on someone else's server.
+        assert_eq!(host_system_root_for("\\\\host\\share\\report.pdf"), None);
+        // A user directory that merely shares a prefix is not a system one.
+        assert_eq!(host_system_root_for("/home/jo/etcetera/notes.txt"), None);
+    }
+
+    #[test]
+    fn a_windows_path_is_split_into_components_wherever_this_runs() {
+        // Same shape of bug one rule along: `Path::components` treats `\` as a
+        // separator only on Windows, so on Linux the whole of
+        // `C:\Users\jo\.ssh\id_rsa` was a single component and the
+        // hidden-directory rule had nothing to find.
+        assert_eq!(
+            host_path_names("C:\\Users\\jo\\Downloads\\a.txt"),
+            ["Users", "jo", "Downloads", "a.txt"]
+        );
+        assert_eq!(host_path_names("\\\\?\\C:\\Users\\jo\\x"), ["Users", "jo", "x"]);
+        assert!(validate_host_path("C:\\Users\\jo\\.ssh\\authorized_keys", HostPathUse::Write).is_err());
+        assert!(validate_host_path("C:\\Users\\jo\\..\\admin\\x", HostPathUse::Write).is_err());
+        assert!(validate_host_path("C:\\Users\\jo\\Downloads\\report.pdf", HostPathUse::Write).is_ok());
+        assert!(is_absolute_host_path("C:\\Users\\jo\\x"));
+        assert!(!is_absolute_host_path("C:x"));
+    }
+
+    #[cfg(not(windows))]
+    #[test]
+    fn a_backslash_in_a_unix_filename_is_not_a_separator() {
+        // Unifying separators unconditionally would split a legal Linux name.
+        assert_eq!(host_path_names("/home/jo/a\\b.txt"), ["home", "jo", "a\\b.txt"]);
+    }
+
+    #[test]
+    fn a_login_item_directory_is_refused_for_a_write() {
+        // Defence in depth, and deliberately not called a fix: see
+        // `validate_host_path` for why a denylist of persistence directories is
+        // losing by construction.
+        assert!(validate_host_path("/Users/jo/Library/LaunchAgents/x.plist", HostPathUse::Write).is_err());
+        assert!(validate_host_path(
+            "C:\\Users\\jo\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\x.lnk",
+            HostPathUse::Write
+        )
+        .is_err());
+        // A directory that merely happens to be called Library is not one.
+        assert!(validate_host_path("/Users/jo/Documents/Library/notes.md", HostPathUse::Write).is_ok());
+    }
+
+    #[test]
+    fn the_unix_system_roots_cover_the_places_a_mac_resolves_them_to() {
+        // Resolution happens before this check now, and on macOS `/etc` and
+        // `/var` resolve into `/private`.
+        assert!(validate_host_path("/private/etc/hosts", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/private/var/db/x", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/opt/homebrew/bin/x", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/srv/www/index.html", HostPathUse::Write).is_err());
+        // …but `/tmp` resolves to `/private/tmp` there, and saving into the
+        // temp directory is entirely ordinary.
+        assert!(validate_host_path("/private/tmp/report.pdf", HostPathUse::Write).is_ok());
+    }
+
+    #[test]
+    fn a_home_directory_that_lives_under_a_system_root_is_still_a_home_directory() {
+        // Only a problem once the check ran on the resolved path: `/home` is a
+        // symlink to `/var/home` on rpm-ostree systems, and a Mac's per-user
+        // temp directory resolves into `/private/var/folders`.
+        assert!(validate_host_path("/var/home/jo/Downloads/report.pdf", HostPathUse::Write).is_ok());
+        assert!(validate_host_path("/private/var/folders/qx/T/report.pdf", HostPathUse::Write).is_ok());
+        // The rest of `/var` is exactly as refused as it was.
+        assert!(validate_host_path("/var/lib/docker/x", HostPathUse::Write).is_err());
+        assert!(validate_host_path("/var/log/syslog", HostPathUse::Read).is_err());
+    }
+
+    // ── H4: a symlinked component, and where the bytes actually land ────────
+
+    /// A throwaway host tree shaped like the real attack: a visible
+    /// `Downloads/pub` that is really `~/.ssh`.
+    ///
+    /// This is the scenario verbatim — and the container end of it is not
+    /// hypothetical: `/proc/self/mountinfo` inside a Triple-C container spells
+    /// the host's project paths out, so code in there knows both where to plant
+    /// the link and what host path to ask the backend for.
+    #[cfg(unix)]
+    fn plant_symlinked_downloads() -> (PathBuf, PathBuf, PathBuf) {
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("tc-h4-{}", uuid::Uuid::new_v4()));
+        let home = root.join("home");
+        let downloads = home.join("Downloads");
+        let ssh = home.join(".ssh");
+        std::fs::create_dir_all(&downloads).unwrap();
+        std::fs::create_dir_all(&ssh).unwrap();
+        let secret = ssh.join("authorized_keys");
+        std::fs::write(&secret, b"the key that was already there").unwrap();
+        std::os::unix::fs::symlink(&ssh, downloads.join("pub")).unwrap();
+        (root, downloads, secret)
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_symlinked_component_passes_the_lexical_check_and_is_still_refused() {
+        let (root, downloads, secret) = plant_symlinked_downloads();
+        let evil = downloads.join("pub").join("authorized_keys");
+        let evil = evil.to_string_lossy().to_string();
+
+        // The hole, stated: every rule the old code had says yes. No hidden
+        // component, no `..`, no system root — because those are properties of
+        // a string, and the string is not where the file goes.
+        assert!(validate_host_path(&evil, HostPathUse::Write).is_ok());
+
+        // Resolving first is what turns the string into a location.
+        let err = resolve_host_path(&evil, HostPathUse::Write).await.unwrap_err();
+        assert!(err.contains(".ssh"), "{}", err);
+        assert!(err.contains("resolves to"), "{}", err);
+
+        // Reading out through the same link is the same bypass backwards.
+        assert!(resolve_host_path(&evil, HostPathUse::Read).await.is_err());
+        assert_eq!(
+            std::fs::read(&secret).unwrap(),
+            b"the key that was already there"
+        );
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_symlinked_file_cannot_be_read_into_the_container_under_a_visible_name() {
+        // The upload direction, where the *final* component is the link:
+        // `Downloads/key.txt` is a perfectly visible name for `~/.ssh/id_rsa`.
+        let (root, downloads, secret) = plant_symlinked_downloads();
+        let alias = downloads.join("key.txt");
+        std::os::unix::fs::symlink(&secret, &alias).unwrap();
+
+        let err = resolve_host_read_path(&alias.to_string_lossy())
+            .await
+            .unwrap_err();
+        assert!(err.contains(".ssh"), "{}", err);
+
+        // An ordinary file next to it is still readable, and comes back as the
+        // path that will be opened.
+        let ordinary = downloads.join("notes.md");
+        std::fs::write(&ordinary, b"hello").unwrap();
+        assert_eq!(
+            resolve_host_read_path(&ordinary.to_string_lossy()).await.unwrap(),
+            ordinary.to_string_lossy()
+        );
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    // ── What the general rule costs, and why it is still the trade ──────────
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn an_ordinary_path_that_resolves_through_a_dot_directory_is_over_caught() {
+        // Stated rather than hidden: the general rule refuses more than the
+        // attack. pnpm keeps every package under `node_modules/.pnpm/…` and
+        // links the visible `node_modules/<pkg>` at it; `~/.cache`, `~/.local`
+        // and `~/.var/app` are where whole ecosystems put the files a visible
+        // directory points at. Round 3 weakened the rule to an eleven-name
+        // denylist to buy those cases back, and the denylist let
+        // `~/.local/bin` and `~/.password-store` straight through.
+        //
+        // Two of the four callers — the terminal drop and Backup — take their
+        // host path from the webview, so this rule is their only boundary and
+        // paying the over-catch is the right way round.
+        // What the refusal must not be is mysterious: it says which component
+        // is hidden and that the path *resolves* through it.
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("tc-overcatch-{}", uuid::Uuid::new_v4()));
+        let store = root.join("proj/node_modules/.pnpm/left-pad@1.3.0/node_modules/left-pad");
+        std::fs::create_dir_all(&store).unwrap();
+        std::fs::write(store.join("index.js"), b"module.exports = 1").unwrap();
+        std::os::unix::fs::symlink(&store, root.join("proj/node_modules/left-pad")).unwrap();
+
+        let visible = root
+            .join("proj/node_modules/left-pad/index.js")
+            .to_string_lossy()
+            .to_string();
+        // Lexically fine…
+        assert!(validate_host_path(&visible, HostPathUse::Read).is_ok());
+        // …and refused once resolved, in a sentence that explains itself.
+        let err = resolve_host_read_path(&visible).await.unwrap_err();
+        assert!(err.contains("resolves to"), "{}", err);
+        assert!(err.contains(".pnpm"), "{}", err);
+        assert!(err.contains("hidden folder"), "{}", err);
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_hidden_directory_reached_through_a_visible_link_is_refused_whatever_it_is_called() {
+        // The escape round 3 reopened. What refuses `Downloads/pub → ~/.ssh` has
+        // to be the general rule, because a list of "credential" directories is
+        // allow-by-omission for everything nobody thought of — and the things
+        // nobody thought of include the directory the user's next shell command
+        // comes out of.
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("tc-hidden-{}", uuid::Uuid::new_v4()));
+        let home = root.join("home");
+        let downloads = home.join("Downloads");
+        std::fs::create_dir_all(&downloads).unwrap();
+
+        for (dir, leaf) in [
+            (".ssh", "authorized_keys"),
+            (".config/autostart", "x.desktop"),
+            // Not on any denylist, and the reason a denylist is the wrong shape:
+            // a write here is the user's next `ls`.
+            (".local/bin", "ls"),
+            (".password-store", "bank.gpg"),
+            (".pki/nssdb", "key4.db"),
+        ] {
+            let real = home.join(dir);
+            std::fs::create_dir_all(&real).unwrap();
+            std::fs::write(real.join(leaf), b"the secret that was already there").unwrap();
+            let link = downloads.join(dir.replace('/', "-").trim_start_matches('.'));
+            std::os::unix::fs::symlink(&real, &link).unwrap();
+
+            let evil = link.join(leaf).to_string_lossy().to_string();
+            // Lexically spotless — that is the whole point of the plant.
+            assert!(validate_host_path(&evil, HostPathUse::Write).is_ok());
+
+            let err = resolve_host_path(&evil, HostPathUse::Write).await.unwrap_err();
+            assert!(err.contains("resolves to"), "{} → {}", dir, err);
+            assert!(err.contains("hidden folder"), "{} → {}", dir, err);
+            // Both directions: reading the secret out is the same bypass
+            // backwards.
+            assert!(resolve_host_path(&evil, HostPathUse::Read).await.is_err(), "{}", dir);
+            assert_eq!(
+                std::fs::read(real.join(leaf)).unwrap(),
+                b"the secret that was already there"
+            );
+        }
+
+        // The other direction, and the whole point of keeping the feature: an
+        // ordinary file under an ordinary link is untouched by any of this.
+        let real = home.join("Archive");
+        std::fs::create_dir_all(&real).unwrap();
+        std::fs::write(real.join("notes.md"), b"hello").unwrap();
+        std::os::unix::fs::symlink(&real, downloads.join("shelf")).unwrap();
+        let ordinary = downloads.join("shelf/notes.md").to_string_lossy().to_string();
+        assert_eq!(
+            resolve_host_read_path(&ordinary).await.unwrap(),
+            real.join("notes.md").to_string_lossy()
+        );
+        assert_eq!(
+            resolve_host_path(&downloads.join("shelf/backup.tgz").to_string_lossy(), HostPathUse::Write)
+                .await
+                .unwrap(),
+            real.join("backup.tgz")
+        );
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+    #[test]
+    fn the_resolved_policy_is_the_lexical_one_applied_to_where_the_bytes_land() {
+        // Round 3 replaced this with an eleven-name denylist of "credential"
+        // directories, i.e. allow-by-omission for the whole of the rest of
+        // `$HOME`. `~/.local/bin` (write, then read on the user's next shell
+        // command), `~/.password-store`, a Firefox or Chrome profile and
+        // `~/.pki/nssdb` were all reachable through a planted symlink with a
+        // perfectly visible name. There is no list that ends; the general rule
+        // is the only one that holds.
+        for path in [
+            "/home/jo/.ssh/authorized_keys",
+            "/home/jo/.ssh/keys/id_rsa",
+            "/home/jo/.gnupg/trustdb.gpg",
+            "/home/jo/.aws/credentials",
+            "/home/jo/.config/autostart/x.desktop",
+            "/home/jo/.claude/settings.json",
+            // None of these was on the denylist, and every one of them is a
+            // key, a password or the next command the user runs.
+            "/home/jo/.local/bin/ls",
+            "/home/jo/.password-store/bank.gpg",
+            "/home/jo/.mozilla/firefox/p.default/logins.json",
+            "/home/jo/.config/google-chrome/Default/Login Data",
+            "/home/jo/.pki/nssdb/key4.db",
+            "/home/jo/.bash_completion.d/x",
+        ] {
+            assert!(validate_resolved_host_path(path, HostPathUse::Write).is_err(), "{}", path);
+            assert!(validate_resolved_host_path(path, HostPathUse::Read).is_err(), "{}", path);
+        }
+
+        // An ordinary location resolves to an ordinary location.
+        for path in ["/home/jo/Downloads/report.pdf", "/var/home/jo/x.tgz"] {
+            assert!(validate_resolved_host_path(path, HostPathUse::Write).is_ok(), "{}", path);
+            assert!(validate_resolved_host_path(path, HostPathUse::Read).is_ok(), "{}", path);
+        }
+
+        // A project's own `.env` is a hidden *leaf*, not a hidden folder, and a
+        // read still allows it — that is what the terminal drop is for.
+        assert!(validate_resolved_host_path("/home/jo/proj/.env", HostPathUse::Read).is_ok());
+        // The location rules that only a resolved path can answer are still here.
+        assert!(validate_resolved_host_path("/private/etc/hosts", HostPathUse::Write).is_err());
+        assert!(validate_resolved_host_path(
+            "/Users/jo/Library/LaunchAgents/x.plist",
+            HostPathUse::Write
+        )
+        .is_err());
+    }
+    #[test]
+    fn a_write_path_that_names_a_folder_is_refused_as_one() {
+        // `Path::file_name` on `/home/jo/Downloads/` answers `Downloads`, so
+        // the leaf a write kept was the directory itself: the rename at the end
+        // failed with an errno and the cleanup then tried to `remove_file` a
+        // directory.
+        let err = validate_host_path("/home/jo/Downloads/", HostPathUse::Write).unwrap_err();
+        assert!(err.contains("must name a file"), "{}", err);
+        assert!(validate_host_path("/", HostPathUse::Write).is_err());
+        assert!(validate_host_path("C:\\Users\\jo\\Downloads\\", HostPathUse::Write).is_err());
+        // A read opens the path and already says "that is a folder" itself.
+        assert!(validate_host_path("/home/jo/Downloads/", HostPathUse::Read).is_ok());
+        assert!(validate_host_path("/home/jo/Downloads/report.pdf", HostPathUse::Write).is_ok());
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn an_open_descriptor_is_checked_against_the_path_that_was_validated() {
+        // The other half of H4. Resolving answers "where does this lead *now*",
+        // and a directory can be swapped between that answer and the open — so
+        // the kernel is asked where the descriptor actually landed.
+        let dir = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("tc-fd-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let real = dir.join("report.pdf");
+        let elsewhere = dir.join("authorized_keys");
+        std::fs::write(&real, b"x").unwrap();
+
+        let file = std::fs::File::open(&real).unwrap();
+        assert!(verify_opened_path(&file, &real).is_ok());
+        let err = verify_opened_path(&file, &elsewhere).unwrap_err();
+        assert!(err.contains("while it was being opened"), "{}", err);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn a_download_into_a_directory_that_does_not_exist_says_so() {
+        // Resolution needs the parent to exist, which it always does behind a
+        // save dialog — but the refusal has to be a sentence, not an errno on
+        // its own.
+        let missing = std::env::temp_dir()
+            .join(format!("tc-missing-{}", uuid::Uuid::new_v4()))
+            .join("report.pdf");
+        let err = resolve_host_path(&missing.to_string_lossy(), HostPathUse::Write)
+            .await
+            .unwrap_err();
+        assert!(err.starts_with("Cannot save into"), "{}", err);
+    }
+
+    // ── The host side of the terminal's drag-and-drop ──────────────────────
+
+    #[test]
+    fn an_uploaded_file_keeps_the_name_the_user_chose() {
+        // `~/Downloads/latest.log` is routinely a symlink to `2026-08-23.log`.
+        // Taking the leaf off the *resolved* path renamed the file on its way
+        // into the container, and named a file the user never picked in the
+        // collision prompt.
+        assert_eq!(host_upload_name("/home/jo/Downloads/latest.log").unwrap(), "latest.log");
+        // Windows paths are split as Windows paths wherever this runs.
+        assert_eq!(host_upload_name("C:\\Users\\jo\\Downloads\\a.txt").unwrap(), "a.txt");
+        // The name becomes a tar entry, a container path and an argv element.
+        assert!(host_upload_name("/home/jo/Downloads/").is_err());
+        assert!(host_upload_name("/").is_err());
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn a_symlinked_source_is_opened_by_its_target_and_named_by_its_link() {
+        // The two answers are different on purpose and both are needed: the
+        // bytes come from where the link leads, the name comes from what the
+        // user picked. Reading both off the resolved path is what dropped
+        // `latest.log` into the container as `2026-08-23.log`.
+        let root = std::env::temp_dir()
+            .canonicalize()
+            .unwrap()
+            .join(format!("tc-name-{}", uuid::Uuid::new_v4()));
+        let logs = root.join("logs");
+        std::fs::create_dir_all(&logs).unwrap();
+        let dated = logs.join("2026-08-23.log");
+        std::fs::write(&dated, b"today").unwrap();
+        let latest = logs.join("latest.log");
+        std::os::unix::fs::symlink(&dated, &latest).unwrap();
+
+        let chosen = latest.to_string_lossy().to_string();
+        assert_eq!(host_upload_name(&chosen).unwrap(), "latest.log");
+        assert_eq!(
+            resolve_host_read_path(&chosen).await.unwrap(),
+            dated.to_string_lossy()
+        );
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    // ── Listings ────────────────────────────────────────────────────────────
+
+    #[test]
+    fn a_directory_too_big_to_buffer_is_described_as_one() {
+        // What the panel used to show for a directory past ~100k entries:
+        // "Command output exceeded 8388608 bytes and was abandoned" — true
+        // about a buffer, no help about a folder.
+        let refusal = format!("{}: Command output exceeded 8388608 bytes", OUTPUT_LIMIT_MARKER);
+        let described = describe_listing_failure("/workspace/big", refusal);
+        assert!(described.contains("too many entries"), "{}", described);
+        assert!(described.contains("/workspace/big"), "{}", described);
+        // Everything else is passed through as it arrived.
+        let other = describe_listing_failure("/workspace", "Exec output error: eof".to_string());
+        assert_eq!(other, "Exec output error: eof");
+    }
+
+    // ── Live Docker ─────────────────────────────────────────────────────────
+
+    /// The container-side half of H4 against a real daemon: `/workspace/escape`
+    /// is under a write root as a *string* and is `/etc` as a location, and
+    /// only a running container can say so. Also drives the listing of a
+    /// symlinked directory, a broken link and a symlink loop, which likewise
+    /// have no answer outside a real filesystem.
+    ///
+    /// Ignored because it needs Docker and pulls a container up; run it with
+    ///
+    /// ```text
+    /// cargo test -- --ignored --nocapture live_container
+    /// ```
+    #[cfg(unix)]
+    #[tokio::test]
+    #[ignore = "needs a Docker daemon; creates and removes a throwaway container"]
+    async fn the_container_side_rules_hold_against_a_live_container() {
+        fn docker_cli(args: &[&str]) -> String {
+            let out = std::process::Command::new("docker")
+                .args(args)
+                .output()
+                .expect("docker CLI");
+            assert!(
+                out.status.success(),
+                "docker {:?} failed: {}",
+                args,
+                String::from_utf8_lossy(&out.stderr)
+            );
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        }
+
+        let name = format!("tc-live-{}", &uuid::Uuid::new_v4().simple().to_string()[..8]);
+        docker_cli(&["run", "-d", "--name", &name, "ubuntu:24.04", "sleep", "300"]);
+        docker_cli(&["exec", &name, "useradd", "-m", "claude"]);
+        docker_cli(&[
+            "exec",
+            &name,
+            "sh",
+            "-c",
+            "mkdir -p /workspace/real && printf 'the payload' > /workspace/real/report.txt \
+             && ln -s /etc /workspace/escape \
+             && ln -s real /workspace/link \
+             && ln -s /workspace/nowhere /workspace/broken \
+             && ln -s /workspace/loop /workspace/loop \
+             && chown -R claude /workspace",
+        ]);
+
+        // `/workspace/escape` is under a write root as a string and is `/etc` as
+        // a location.
+        let escaped = resolve_container_dir(&name, "Folder", "/workspace/escape").await;
+        println!("container escape: {:?}", escaped);
+        assert!(escaped.is_err(), "a symlink out of /workspace was accepted");
+        resolve_container_dir(&name, "Folder", "/workspace")
+            .await
+            .expect("/workspace itself");
+
+        // A symlinked directory lists its target's contents rather than
+        // reporting itself empty — `-H` follows the start point, and only the
+        // start point.
+        let (records, diagnostics, code) =
+            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace/link"), Vec::new())
+                .await
+                .unwrap();
+        println!("link: code={} diagnostics={:?}", code, diagnostics);
+        let entries = parse_find_output("/workspace/link", &records);
+        assert_eq!(
+            entries.iter().map(|e| e.name.as_str()).collect::<Vec<_>>(),
+            vec!["report.txt"]
+        );
+
+        // The link itself is still *marked* as one in its parent's listing, and
+        // still navigable.
+        let (records, _, _) =
+            exec_oneshot_streams_as(&name, "claude", list_argv("/workspace"), Vec::new())
+                .await
+                .unwrap();
+        let parent = parse_find_output("/workspace", &records);
+        let link = parent.iter().find(|e| e.name == "link").expect("the link row");
+        assert!(link.is_symlink && link.is_directory, "{:?}", link);
+        let broken = parent.iter().find(|e| e.name == "broken").expect("the broken row");
+        assert!(broken.is_symlink && !broken.is_directory, "{:?}", broken);
+
+        // A symlink loop is what turns `-L` into a walk that does not end.
+        // `-H` resolves only the starting point, so the kernel answers `ELOOP`
+        // and `find` returns at once — and the row is not navigable in the
+        // first place, because `%Y` is `L` rather than `d`.
+        let looped = parent.iter().find(|e| e.name == "loop").expect("the loop row");
+        assert!(looped.is_symlink && !looped.is_directory, "{:?}", looped);
+
+        for path in ["/workspace/broken", "/workspace/loop"] {
+            let started = std::time::Instant::now();
+            let (records, diagnostics, code) =
+                exec_oneshot_streams_as(&name, "claude", list_argv(path), Vec::new())
+                    .await
+                    .unwrap();
+            let took = started.elapsed();
+            println!("{}: code={} in {:?} — {:?}", path, code, took, diagnostics);
+            assert!(took < std::time::Duration::from_secs(10), "it hung: {:?}", took);
+            assert!(parse_find_output(path, &records).is_empty(), "{}", path);
+            // The loop is the one that reports; a broken link matches itself
+            // and is then discarded by `-mindepth 1`, so it exits cleanly with
+            // nothing to show. Neither is reachable by navigating, and neither
+            // waits.
+            if code != 0 {
+                let said = describe_find_diagnostics(path, diagnostics.trim());
+                println!("  said: {}", said);
+                assert!(said.contains("loops back on itself"), "{} → {}", path, said);
+            }
+        }
+
+        docker_cli(&["rm", "-f", &name]);
+    }
 }
diff --git a/app/src-tauri/src/commands/inspect_commands.rs b/app/src-tauri/src/commands/inspect_commands.rs
index 68749f3..4bd4cf9 100644
--- a/app/src-tauri/src/commands/inspect_commands.rs
+++ b/app/src-tauri/src/commands/inspect_commands.rs
@@ -1200,9 +1200,14 @@ pub async fn add_scheduled_task(
 /// * **In that order**, so a rejected `add` leaves the original untouched
 ///   rather than deleting a prompt the user cannot get back. The cost is a
 ///   sub-second window in which both tasks are in the crontab.
-/// * The task therefore gets a **new id**. Its old log directory
-///   (`~/.claude/scheduler/logs/<old-id>/`) stays behind under the old id; the
-///   UI warns about this before saving.
+/// * The task therefore gets a **new id**, and its old log directory
+///   (`~/.claude/scheduler/logs/<old-id>/`) goes with the removal — the
+///   scheduler reaps a task's logs when the task stops existing, because
+///   nothing can name that id again afterwards. The UI warns before saving.
+///   (A project still running an older base image carries the older
+///   `/usr/local/bin/triple-c-scheduler`, which left the directory behind;
+///   `/usr/local/bin` only changes on a base-image migration or a Reset. The
+///   copy is deliberately written for the case that loses data.)
 /// * `enabled` is carried over explicitly, because `add` always creates an
 ///   enabled task and silently re-enabling a task the user had switched off
 ///   would schedule a run they did not ask for.
diff --git a/app/src-tauri/src/commands/migration_commands.rs b/app/src-tauri/src/commands/migration_commands.rs
index f43e348..6be50da 100644
--- a/app/src-tauri/src/commands/migration_commands.rs
+++ b/app/src-tauri/src/commands/migration_commands.rs
@@ -227,58 +227,62 @@ async fn container_label(container_id: &str, label: &str) -> Option<String> {
 // Migrate
 // ─────────────────────────────────────────────────────────────────────────────
 
-/// Project ids with a migration running **in this process right now**.
-///
-/// Two things need it. `reconcile_project_statuses` is callable from the
-/// frontend at any time, not only at startup, and a live migration looks
-/// exactly like a crashed one from the outside (state file says `in-progress`,
-/// container carries the label) — without this guard a reconcile mid-run would
-/// rewrite the phase to `interrupted` underneath a migration that is fine.
-/// It also makes a second concurrent `migrate_project_to_base` for the same
-/// project impossible.
-static ACTIVE_MIGRATIONS: std::sync::OnceLock<
-    std::sync::Mutex<std::collections::HashSet<String>>,
-> = std::sync::OnceLock::new();
-
-fn active_migrations() -> &'static std::sync::Mutex<std::collections::HashSet<String>> {
-    ACTIVE_MIGRATIONS.get_or_init(|| std::sync::Mutex::new(std::collections::HashSet::new()))
-}
-
 /// Whether a migration for this project is running **in this process right
 /// now**. Every command that stops, removes or recreates the project's
 /// container has to consult it: the window between `remove_container` and the
 /// create that follows looks exactly like "no container", and an ordinary
 /// Start landing in it creates a second container under the same name.
+///
+/// **This is now a view onto [`crate::project_lock`], not a set of its own.**
+/// It used to be the app's only mutual-exclusion primitive, and it was one-way:
+/// a migration claimed a project, everything else merely polled this once at
+/// entry and never claimed anything. Two non-migration writers of
+/// `triple-c-snapshot-{id}:latest` — a compaction and a recreate — could not
+/// see each other at all. Folding the set into the shared registry means there
+/// is exactly one answer to "is something happening to this project", and this
+/// function is the specialisation of it that reconcile still needs: a *live*
+/// migration is indistinguishable from a crashed one from the outside, and only
+/// this process knows which it is looking at.
+///
+/// No production caller on this branch: the Disk panel's survey was the last
+/// one, and it went to `hold/disk-and-dragout`. Kept — and still exercised by
+/// `a_live_migration_is_distinguishable_from_a_crashed_one` — because it is the
+/// one named answer to that question and re-inventing it is how the two
+/// disagreeing answers happened the first time.
+#[allow(dead_code)]
 pub(crate) fn is_migrating(project_id: &str) -> bool {
-    active_migrations()
-        .lock()
-        .unwrap_or_else(|e| e.into_inner())
-        .contains(project_id)
+    crate::project_lock::is_held_by(project_id, crate::project_lock::ProjectOp::Migration)
 }
 
-/// RAII marker: removes the project from [`ACTIVE_MIGRATIONS`] however the
-/// migration ends, including an early `?`.
-struct ActiveGuard(String);
+/// RAII marker: releases the project's [`crate::project_lock`] claim however
+/// the migration ends, including an early `?`.
+///
+/// Kept as a named type rather than using [`crate::project_lock::ProjectGuard`]
+/// directly so the migration path keeps reading as "take the migration guard",
+/// and so the one place that decides what a migration's claim *is* stays here.
+struct ActiveGuard(#[allow(dead_code)] crate::project_lock::ProjectGuard);
 
 impl ActiveGuard {
-    /// `None` when a migration is already running for this project.
-    fn acquire(project_id: &str) -> Option<Self> {
-        let mut set = active_migrations()
-            .lock()
-            .unwrap_or_else(|e| e.into_inner());
-        if !set.insert(project_id.to_string()) {
-            return None;
-        }
-        Some(Self(project_id.to_string()))
-    }
-}
-
-impl Drop for ActiveGuard {
-    fn drop(&mut self) {
-        active_migrations()
-            .lock()
-            .unwrap_or_else(|e| e.into_inner())
-            .remove(&self.0);
+    /// `Err` with the registry's own refusal when a migration — **or anything
+    /// else** — already holds this project.
+    ///
+    /// The error string is the point. This returned `Option`, and all three
+    /// callers replaced the discarded reason with a sentence about a migration
+    /// — so a user blocked by a *compaction*, a reset or a cache clear was told
+    /// to wait for a base update that was not running, with nothing in the UI
+    /// that could ever name what actually held the project.
+    /// `project_lock::try_acquire` already composes "what holds it" with "what
+    /// you were trying to do"; there is nothing to add to it here.
+    ///
+    /// The tail it composes is `ProjectOp::Migration`'s — "…before starting a
+    /// base update" — for confirm and rollback as well as for the migration
+    /// itself. That is the class all three belong to, and splitting it would
+    /// mean a `ProjectOp` variant per command: the wrong place to encode a
+    /// verb, for a phrase that is at worst imprecise where the old one was
+    /// simply wrong.
+    fn acquire(project_id: &str) -> Result<Self, String> {
+        crate::project_lock::try_acquire(project_id, crate::project_lock::ProjectOp::Migration)
+            .map(Self)
     }
 }
 
@@ -294,10 +298,9 @@ pub async fn migrate_project_to_base(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<MigrationReport, String> {
-    let Some(_guard) = ActiveGuard::acquire(&project_id) else {
-        return Ok(MigrationReport::failed_preflight(
-            "A migration is already running for this project.",
-        ));
+    let _guard = match ActiveGuard::acquire(&project_id) {
+        Ok(guard) => guard,
+        Err(busy) => return Ok(MigrationReport::failed_preflight(&busy)),
     };
 
     let existing = migration_store::load(&project_id)?;
@@ -460,6 +463,33 @@ async fn fresh_migration(
         }
     }
 
+    // Scrub *before* the stop, not inside the commit below. `scrub_writable_layer`
+    // is a `docker exec`, which only works on a running container — and the
+    // pre-swap commit is the single largest snapshot Triple-C ever takes, so
+    // letting this one path commit unscrubbed is what the scrub exists to
+    // prevent. Failure is swallowed inside; it must never block a migration.
+    //
+    // The outcome is logged rather than discarded: this is the one scrub whose
+    // silence would be expensive, because the layer it declined to clean is
+    // about to be committed into a snapshot that outlives the migration.
+    //
+    // H2: **bind it first.** `ScrubOutcome` is `#[must_use]`, and the way that
+    // was satisfied here was by folding the awaited call into `log::info!`'s
+    // argument list. `log::info!` expands to
+    // `if Info <= max_level() { … }` — so the arguments, this data-integrity
+    // step among them, live inside the level check and do not run at all when
+    // the global filter is `Off`. That is reachable: `logging::init` tolerates
+    // `dispatch.apply()` failing, and fern returns *before* `set_max_level` on
+    // error, so a process that failed to install a logger sits at `Off` with
+    // every `log::` argument list silently dead. The scrub would then never
+    // run, and the unscrubbed layer would be committed into the longest-lived
+    // snapshot the app takes. `commit_container_snapshot` gets this right for
+    // the same reason; nothing may put an effect inside a log macro's
+    // arguments. (`logging::init` now also restores the level on failure, but
+    // the call site is not allowed to depend on that.)
+    let scrub = docker::scrub_writable_layer(&container_id).await;
+    log::info!("Pre-migration scrub of {}{}", container_id, scrub.commit_log_suffix());
+
     emit_progress(&app_handle, &project_id, "Stopping the container...");
     let _ = state
         .projects_store
@@ -828,12 +858,7 @@ pub async fn confirm_migration(
     let _ = &state;
     // Confirming drops the only way back. Doing that underneath a running
     // migration would delete the pin it is relying on mid-flight.
-    let Some(_guard) = ActiveGuard::acquire(&project_id) else {
-        return Err(
-            "A container base update is running for this project right now. Wait for it to finish."
-                .to_string(),
-        );
-    };
+    let _guard = ActiveGuard::acquire(&project_id)?;
     let Some(mstate) = migration_store::load(&project_id)? else {
         return Ok(());
     };
@@ -863,7 +888,7 @@ pub async fn confirm_migration(
     // waiting for the project's next recreation would leave it lying around
     // indefinitely.
     tauri::async_runtime::spawn(async {
-        crate::docker::sweep_orphaned_snapshots().await;
+        crate::docker::sweep_orphaned_snapshots_logged("after migration confirmed").await;
     });
 
     Ok(())
@@ -880,12 +905,7 @@ pub async fn rollback_migration(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
-    let Some(_guard) = ActiveGuard::acquire(&project_id) else {
-        return Err(
-            "A container base update is running for this project right now. Wait for it to finish."
-                .to_string(),
-        );
-    };
+    let _guard = ActiveGuard::acquire(&project_id)?;
 
     let mut project = state
         .projects_store
@@ -957,6 +977,16 @@ pub async fn rollback_migration(
     let _ = mig::untag_image(&rollback_ref).await;
     migration_store::clear_staging(&project_id)?;
     migration_store::clear(&project_id)?;
+
+    // Retagging above moved `:latest` off the *migrated* snapshot, and the
+    // container that was built from it was removed a few lines up — so a
+    // multi-gigabyte image is sitting there untagged and unreferenced with
+    // nothing else in the app that would ever look at it again. The confirm
+    // path sweeps for exactly this reason; rolling back orphans just as much
+    // and did not.
+    tauri::async_runtime::spawn(async {
+        crate::docker::sweep_orphaned_snapshots_logged("after migration rollback").await;
+    });
     emit_progress(
         &app_handle,
         &project_id,
@@ -988,9 +1018,203 @@ pub async fn get_migration_state(
 pub async fn reconcile_migration(project: &Project, app_handle: &tauri::AppHandle) {
     // A migration running right now is indistinguishable from a crashed one
     // from the outside; only this process knows the difference.
-    if is_migrating(&project.id) {
+    //
+    // **Any holder, not just a migration.** This asked `is_migrating`, which is
+    // `held() == Some(Migration)` — so a compaction, a reset or a destroy
+    // holding the project made this fall straight through and start rewriting
+    // the migration record's phase and untagging its rollback image underneath
+    // whatever was running. `reconcile_project_statuses` is a command, not just
+    // a startup step, so "nothing else can be running yet" is not available as
+    // an argument.
+    //
+    // Yielding is right; yielding *forever* was not. The only caller fires once
+    // per "Docker became available", so a project that happened to be held at
+    // that instant was never looked at again for the rest of the session: its
+    // phase stayed un-normalised, no resume or rollback was ever offered, and
+    // its `:pre-migration-*` pin stayed `Claimed`. So the visit is deferred
+    // rather than dropped — see [`defer_migration_reconcile`].
+    if let Some(holder) = crate::project_lock::held(&project.id) {
+        log::debug!(
+            "Deferring migration reconcile for '{}' ({}): {}",
+            project.name,
+            project.id,
+            holder.describe()
+        );
+        defer_migration_reconcile(project, app_handle);
         return;
     }
+    reconcile_migration_now(project, app_handle).await;
+}
+
+/// How long [`defer_migration_reconcile`] waits between looks, and how many
+/// times it looks.
+///
+/// The operations it is waiting behind are minutes long — a Reset recreates a
+/// container from a base image, a compaction rebuilds a multi-gigabyte
+/// snapshot — so the interval is coarse on purpose: this is a `held()` read
+/// against an in-process map, but every wakeup is a task and the point is to
+/// catch the release, not to catch it promptly. Twenty seconds × ninety is
+/// thirty minutes, comfortably past the longest measured compaction, after
+/// which the project is left for the next `reconcile_project_statuses`.
+const RECONCILE_RETRY_INTERVAL: std::time::Duration = std::time::Duration::from_secs(20);
+const RECONCILE_RETRY_ATTEMPTS: usize = 90;
+
+/// Project ids with a deferred reconcile already waiting.
+///
+/// `reconcile_project_statuses` is a command the frontend can call more than
+/// once — every "Docker became available" — and each call walks every project.
+/// Without this, a project held for a few minutes would accumulate one waiting
+/// task per call, all of which would then reconcile the same record in a row.
+fn reconcile_retries() -> &'static std::sync::Mutex<std::collections::HashSet<String>> {
+    static RETRIES: std::sync::OnceLock<std::sync::Mutex<std::collections::HashSet<String>>> =
+        std::sync::OnceLock::new();
+    RETRIES.get_or_init(|| std::sync::Mutex::new(std::collections::HashSet::new()))
+}
+
+/// One project's place in [`reconcile_retries`], handed back on drop.
+///
+/// RAII for the reason [`crate::project_lock::ProjectGuard`] sets out, and this
+/// claim is the case that proves the rule: the release used to be a trailing
+/// statement at the bottom of the spawned task in
+/// [`defer_migration_reconcile`], sitting after an `.await` on
+/// [`reconcile_migration_now`]. A panic in there — or the future simply being
+/// dropped, which is what happens to every in-flight task at shutdown — skips
+/// the statement, and nothing else ever removes an id from that set. The
+/// project is then fenced off from *every* later deferral for the rest of the
+/// process: each `reconcile_project_statuses` pass finds it held, fails to
+/// claim, and returns, so the phase stays un-normalised, no resume or rollback
+/// is offered, and the `:pre-migration-*` pin stays `Claimed`. That is the
+/// session-long silence deferring was written to end, reintroduced one panic
+/// later and lasting until the app is restarted.
+///
+/// Dropping this hands the claim straight back, so a caller that discards the
+/// value has claimed nothing while reading as though it had; `#[must_use]`
+/// makes that a compile warning rather than a second waiter on one record.
+#[must_use = "the claim is handed back the moment this guard drops; bind it inside the waiting task, for the whole task"]
+struct ReconcileRetryClaim {
+    project_id: String,
+}
+
+impl Drop for ReconcileRetryClaim {
+    fn drop(&mut self) {
+        // `into_inner` past poisoning, as in `project_lock`: the only thing
+        // ever done while holding this mutex is a single `HashSet` insert or
+        // remove, so a panic on another thread cannot have left it half
+        // written — and declining to release here would strand the project
+        // permanently, which is the exact failure the guard exists to stop.
+        reconcile_retries()
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .remove(&self.project_id);
+    }
+}
+
+/// Claim the right to be the one deferred reconcile for `project_id`.
+/// `None` means somebody else already is.
+fn claim_reconcile_retry(project_id: &str) -> Option<ReconcileRetryClaim> {
+    reconcile_retries()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .insert(project_id.to_string())
+        .then(|| ReconcileRetryClaim {
+            project_id: project_id.to_string(),
+        })
+}
+
+/// Come back to a project that was held when [`reconcile_migration`] reached it.
+///
+/// Only for projects that have a record on disk: [`migration_store::has_record`]
+/// is filesystem presence, so it costs nothing and is deliberately the *cheap*
+/// question — every project is walked on every reconcile and almost none of
+/// them have a migration in flight. A record that exists but cannot be parsed
+/// answers `true` here and is handled, conservatively, by `load` when the
+/// retry lands.
+///
+/// The wait is a poll rather than a notification because `project_lock` has no
+/// release hook and giving it one would mean a guard's `Drop` waking tasks
+/// while it still holds the map's mutex. A read of an in-process `HashMap`
+/// every twenty seconds, for as long as one operation is running on one
+/// project, is not worth a condvar.
+fn defer_migration_reconcile(project: &Project, app_handle: &tauri::AppHandle) {
+    // No record means nothing to come back for. An unreadable migrations
+    // directory answers "maybe", and maybe is worth a look.
+    if !migration_store::has_record(&project.id).unwrap_or(true) {
+        return;
+    }
+    let Some(claim) = claim_reconcile_retry(&project.id) else {
+        return;
+    };
+
+    let project = project.clone();
+    let app_handle = app_handle.clone();
+    tauri::async_runtime::spawn(async move {
+        // Moved in and bound for the whole body, rather than released by a
+        // statement at the bottom: everything below this line can panic or be
+        // dropped mid-await, and a claim that only comes back on the happy path
+        // is a claim that eventually does not come back at all. See
+        // [`ReconcileRetryClaim`].
+        let _claim = claim;
+        let released =
+            await_release(&project.id, RECONCILE_RETRY_INTERVAL, RECONCILE_RETRY_ATTEMPTS).await;
+        if released {
+            // Whatever was holding it may have finished the migration itself or
+            // cleared the record — `reconcile_migration_now` loads the record
+            // first and returns on `None`, so that is a no-op rather than a
+            // special case here.
+            reconcile_migration_now(&project, &app_handle).await;
+        } else {
+            log::warn!(
+                "Gave up waiting to reconcile the migration record for '{}' ({}): it has been \
+                 held for {} minutes. Its phase is unchanged and its rollback pin is still \
+                 claimed; the next reconcile pass will try again.",
+                project.name,
+                project.id,
+                RECONCILE_RETRY_INTERVAL.as_secs() as usize * RECONCILE_RETRY_ATTEMPTS / 60
+            );
+        }
+    });
+}
+
+/// Wait for `project_id` to stop being held: `attempts` looks, the first
+/// immediate and the rest `interval` apart. `true` means it was released,
+/// `false` that the budget ran out with it still held.
+///
+/// Split out of [`defer_migration_reconcile`] so the waiting can be tested
+/// against a real [`crate::project_lock`] guard on a paused clock — the parts
+/// that are easy to get wrong are "gives up while still holding the claim",
+/// "never looks again", and the ordering of the look against the sleep, none of
+/// which is visible from the constants.
+async fn await_release(
+    project_id: &str,
+    interval: std::time::Duration,
+    attempts: usize,
+) -> bool {
+    for attempt in 0..attempts {
+        // Look first, sleep second. Sleeping first charged every deferral a
+        // full interval before anyone read the map even once, and the common
+        // case is a holder that has already let go: `held()` is sampled in
+        // `reconcile_migration`, a task is spawned, and by the time it is first
+        // polled the Reset that was on its last step is frequently finished.
+        // That bought nothing and cost twenty seconds of a startup pass waiting
+        // on a lock nobody holds, in front of a check that is one `HashMap`
+        // lookup.
+        if crate::project_lock::held(project_id).is_none() {
+            return true;
+        }
+        // And no sleep after the final look: nothing reads the map again
+        // afterwards, so it is twenty seconds of delay in front of a `false`
+        // that has already been decided. The budget is still `attempts` looks,
+        // which is what the constants above are chosen against.
+        if attempt + 1 < attempts {
+            tokio::time::sleep(interval).await;
+        }
+    }
+    false
+}
+
+/// [`reconcile_migration`] with the "is anything holding this project" question
+/// already answered.
+async fn reconcile_migration_now(project: &Project, app_handle: &tauri::AppHandle) {
     let state = match migration_store::load(&project.id) {
         Ok(Some(s)) => s,
         Ok(None) => return,
@@ -1146,7 +1370,23 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
                 }
             }
         }
-        Ok(None) => return,
+        Ok(None) => {
+            // **`Ok(None)` is not the same as "no file".** `migration_store::load`
+            // now reports an *unparseable* record as absent while deliberately
+            // leaving it on disk, so that `has_record` goes on protecting the
+            // rollback pin it describes. Returning here on that would leave the
+            // file — and therefore a permanently "claimed" pin — behind a Reset
+            // that has just deleted the snapshot and both volumes the record
+            // could possibly refer to.
+            if !migration_store::has_record(project_id).unwrap_or(false) {
+                return;
+            }
+            log::warn!(
+                "Project {} has a migration record that could not be read; removing it anyway \
+                 because a Reset supersedes it",
+                project_id
+            );
+        }
         Err(e) => log::warn!(
             "Could not read the migration record for {} while cleaning up: {}",
             project_id,
@@ -1155,6 +1395,10 @@ pub(crate) async fn purge_migration_artifacts(project_id: &str) {
     }
     let _ = migration_store::clear_staging(project_id);
     let _ = migration_store::clear(project_id);
+    // The pins this project had are gone with the snapshot; their grace clocks
+    // are meaningless and would otherwise sit in the migrations directory
+    // forever.
+    migration_store::clear_ownerless_for_project(project_id);
 }
 
 fn default_docker_socket() -> String {
@@ -1878,16 +2122,23 @@ mod tests {
         {
             let g = ActiveGuard::acquire(id).expect("first acquire must succeed");
             assert!(is_migrating(id));
+            let refused = ActiveGuard::acquire(id)
+                .err()
+                .expect("a second concurrent migration must be refused");
+            // The refusal has to say what is holding the project, not what the
+            // caller happens to be — the three commands used to substitute
+            // their own sentence for this and lost the distinction.
             assert!(
-                ActiveGuard::acquire(id).is_none(),
-                "a second concurrent migration must be refused"
+                refused.contains("base update"),
+                "the refusal must name the holder: {}",
+                refused
             );
             drop(g);
         }
         assert!(!is_migrating(id), "the guard must release on drop");
         // …including when the migration bailed out through an early return.
         fn early_return(id: &str) -> Option<()> {
-            let _g = ActiveGuard::acquire(id)?;
+            let _g = ActiveGuard::acquire(id).ok()?;
             None
         }
         assert!(early_return(id).is_none());
@@ -1901,4 +2152,225 @@ mod tests {
         assert!(!r.rollback_available);
         assert!(r.packages_requested.is_empty());
     }
+
+    /// No `await` may sit inside a `log::*!` argument list — H2, generalised.
+    ///
+    /// `log::info!(a, b)` expands to `if Info <= max_level() { … a … b … }`, so
+    /// an argument is only evaluated while the level admits the record. Folding
+    /// `scrub_writable_layer(&id).await.commit_log_suffix()` into the arguments
+    /// here — done to satisfy `#[must_use]` on `ScrubOutcome` — therefore made
+    /// the pre-migration scrub conditional on the log level, and
+    /// `logging::init` deliberately tolerates failing to install a logger,
+    /// which leaves `max_level()` at `Off`. A scrub that never runs before the
+    /// largest snapshot the app takes is not something a log level may decide.
+    ///
+    /// Scanned over the source rather than asserted at one call site: the bug
+    /// is a shape, and it is reintroduced by whoever next has a `#[must_use]`
+    /// value they only want to log.
+    #[test]
+    fn nothing_awaits_inside_a_log_macros_arguments() {
+        let sources: &[(&str, &str)] = &[
+            ("commands/migration_commands.rs", include_str!("migration_commands.rs")),
+            ("docker/container.rs", include_str!("../docker/container.rs")),
+            ("docker/migration.rs", include_str!("../docker/migration.rs")),
+            ("logging.rs", include_str!("../logging.rs")),
+        ];
+        let macros = ["log::error!(", "log::warn!(", "log::info!(", "log::debug!(", "log::trace!("];
+        let mut scanned = 0usize;
+        for (name, src) in sources {
+            for mac in macros {
+                let mut from = 0usize;
+                while let Some(at) = src[from..].find(mac) {
+                    let start = from + at + mac.len();
+                    // Balance the macro's own parentheses. String literals in
+                    // these call sites never contain an unbalanced one, and a
+                    // `(` inside a format string would only ever widen the
+                    // slice, i.e. fail safe.
+                    let mut depth = 1usize;
+                    let mut end = start;
+                    for (i, c) in src[start..].char_indices() {
+                        match c {
+                            '(' => depth += 1,
+                            ')' => {
+                                depth -= 1;
+                                if depth == 0 {
+                                    end = start + i;
+                                    break;
+                                }
+                            }
+                            _ => {}
+                        }
+                    }
+                    let args = &src[start..end];
+                    // This test's own name mentions the thing it forbids.
+                    assert!(
+                        !args.contains(".await"),
+                        "{}: an `.await` inside a `{}` argument list stops happening whenever the \
+                         log level does not admit the record:\n{}",
+                        name,
+                        mac.trim_end_matches('('),
+                        args
+                    );
+                    scanned += 1;
+                    from = end.max(start);
+                }
+            }
+        }
+        // A scanner that matched nothing would pass silently forever.
+        assert!(scanned > 80, "only {} log call sites were scanned", scanned);
+    }
+
+    /// MEDIUM: a project held when the reconcile pass reached it must be
+    /// revisited, not dropped for the session.
+    ///
+    /// `reconcile_project_statuses` fires once per "Docker became available",
+    /// so the old `return` meant a project that happened to be mid-Reset at
+    /// that instant never had its migration phase normalised, was never offered
+    /// resume or rollback, and kept its `:pre-migration-*` pin `Claimed` — for
+    /// the rest of the session. On a paused clock, so the thirty-minute budget
+    /// costs nothing.
+    #[tokio::test(start_paused = true)]
+    async fn a_held_project_is_revisited_once_the_holder_lets_go() {
+        let id = format!("await-release-{}", uuid::Uuid::new_v4().simple());
+        let guard = crate::project_lock::try_acquire(&id, crate::project_lock::ProjectOp::Reset)
+            .expect("a fresh project id is not held");
+
+        let waiting = {
+            let id = id.clone();
+            tokio::spawn(async move {
+                await_release(&id, RECONCILE_RETRY_INTERVAL, RECONCILE_RETRY_ATTEMPTS).await
+            })
+        };
+
+        // Long enough that several looks have already happened and found it
+        // held, so this cannot pass by the waiter never having polled.
+        tokio::time::sleep(RECONCILE_RETRY_INTERVAL * 3).await;
+        assert!(!waiting.is_finished(), "the waiter returned while the project was held");
+
+        drop(guard);
+        assert!(
+            waiting.await.expect("the waiter task"),
+            "the holder let go and the reconcile never came back"
+        );
+    }
+
+    /// And the budget is finite: a project held indefinitely does not leave a
+    /// task waiting on it forever, and the claim is handed back either way.
+    #[tokio::test(start_paused = true)]
+    async fn waiting_for_a_holder_gives_up_eventually() {
+        let id = format!("await-release-{}", uuid::Uuid::new_v4().simple());
+        let _guard =
+            crate::project_lock::try_acquire(&id, crate::project_lock::ProjectOp::Migration)
+                .expect("a fresh project id is not held");
+        assert!(!await_release(&id, RECONCILE_RETRY_INTERVAL, RECONCILE_RETRY_ATTEMPTS).await);
+        // Thirty minutes: past the longest measured compaction, and the thing
+        // being waited on is always a bounded, user-initiated operation.
+        assert!(RECONCILE_RETRY_ATTEMPTS > 0, "deferring would be a no-op");
+        let budget = RECONCILE_RETRY_INTERVAL * RECONCILE_RETRY_ATTEMPTS as u32;
+        assert!(budget >= std::time::Duration::from_secs(15 * 60), "{:?}", budget);
+    }
+
+    /// MEDIUM: an unheld project is reconciled now, not in twenty seconds.
+    ///
+    /// The wait slept before its first look, so a holder that let go between
+    /// `reconcile_migration` sampling `held()` and this task being polled — the
+    /// *common* case, since a deferral is only taken when something was on its
+    /// way out — still cost a full `RECONCILE_RETRY_INTERVAL` of a startup pass
+    /// waiting on a lock nobody held. On a paused clock the assertion is exact:
+    /// the fixed shape returns without the clock moving at all, the sleep-first
+    /// shape cannot return before it has advanced one interval.
+    #[tokio::test(start_paused = true)]
+    async fn an_unheld_project_is_seen_without_waiting_out_an_interval() {
+        let id = format!("await-release-{}", uuid::Uuid::new_v4().simple());
+        assert!(
+            crate::project_lock::held(&id).is_none(),
+            "a fresh uuid is not held"
+        );
+
+        let before = tokio::time::Instant::now();
+        assert!(await_release(&id, RECONCILE_RETRY_INTERVAL, RECONCILE_RETRY_ATTEMPTS).await);
+        let waited = tokio::time::Instant::now() - before;
+        assert_eq!(
+            waited,
+            std::time::Duration::ZERO,
+            "an already-released project cost {:?} before anyone looked",
+            waited
+        );
+    }
+
+    #[test]
+    fn only_one_deferred_reconcile_waits_per_project() {
+        // Every "Docker became available" walks every project, so without the
+        // claim a project held for a few minutes accumulates one waiting task
+        // per call — all of which then reconcile the same record in a row.
+        let id = format!("retry-claim-{}", uuid::Uuid::new_v4().simple());
+        let other = format!("retry-claim-{}", uuid::Uuid::new_v4().simple());
+        let first = claim_reconcile_retry(&id).expect("a fresh project id is unclaimed");
+        assert!(
+            claim_reconcile_retry(&id).is_none(),
+            "a second waiter was allowed in"
+        );
+        let other_claim =
+            claim_reconcile_retry(&other).expect("the claim is not per-project");
+        drop(first);
+        // Bound rather than discarded: the guard releases on drop, so
+        // `claim_reconcile_retry(&id);` as a bare statement would test nothing
+        // — which is what `#[must_use]` is there to catch in real callers.
+        let retaken = claim_reconcile_retry(&id).expect("the claim was never handed back");
+        drop(retaken);
+        drop(other_claim);
+        // And the other project's claim was never the same claim.
+        drop(claim_reconcile_retry(&other).expect("released independently"));
+    }
+
+    /// MEDIUM: the claim survives the task that holds it dying badly.
+    ///
+    /// The release used to be a trailing statement after
+    /// `reconcile_migration_now(...).await` at the bottom of the spawned task,
+    /// so a panic anywhere in that call — or the future being dropped at
+    /// shutdown — skipped it and left the id in the set with no task behind it.
+    /// Nothing removes it afterwards, so that project could never be deferred
+    /// again for the rest of the process: exactly the state deferring was added
+    /// to prevent, now permanent instead of one pass long. Fails against the
+    /// trailing-statement shape, which is the point.
+    #[tokio::test]
+    async fn a_panicking_deferred_reconcile_hands_its_claim_back() {
+        let id = format!("retry-claim-{}", uuid::Uuid::new_v4().simple());
+        let claimed = claim_reconcile_retry(&id).expect("a fresh project id is unclaimed");
+
+        // Spawned, not just called: the real claim is held across an await
+        // inside a `tauri::async_runtime::spawn`, and a task panic is caught by
+        // the runtime rather than unwinding the caller.
+        let task = {
+            let id = id.clone();
+            tokio::spawn(async move {
+                let _claim = claimed;
+                tokio::task::yield_now().await;
+                panic!("reconcile_migration_now blew up on '{}'", id);
+            })
+        };
+        assert!(task.await.is_err(), "the task was supposed to panic");
+
+        let after = claim_reconcile_retry(&id);
+        assert!(
+            after.is_some(),
+            "a panicking reconcile stranded the claim — this project can never be \
+             deferred again for the rest of the process"
+        );
+        drop(after);
+
+        // The other half of the same failure: a task that is simply dropped
+        // mid-flight, which is every in-flight task at shutdown.
+        let claimed = claim_reconcile_retry(&id).expect("released above");
+        let never_finishes = tokio::spawn(async move {
+            let _claim = claimed;
+            std::future::pending::<()>().await;
+        });
+        never_finishes.abort();
+        let _ = never_finishes.await;
+        assert!(
+            claim_reconcile_retry(&id).is_some(),
+            "a dropped task stranded the claim"
+        );
+    }
 }
diff --git a/app/src-tauri/src/commands/project_commands.rs b/app/src-tauri/src/commands/project_commands.rs
index a158925..564012f 100644
--- a/app/src-tauri/src/commands/project_commands.rs
+++ b/app/src-tauri/src/commands/project_commands.rs
@@ -16,29 +16,100 @@ pub(crate) fn emit_progress(app_handle: &tauri::AppHandle, project_id: &str, mes
     );
 }
 
-/// Extract secret fields from a project and store them in the OS keychain.
-fn store_secrets_for_project(project: &Project) -> Result<(), String> {
-    if let Some(ref token) = project.git_token {
-        secure::store_project_secret(&project.id, "git-token", token)?;
+/// Every project secret, as the JSON pointer it arrives under and the keychain
+/// key it is stored as.
+///
+/// The keychain keys are the ones already in users' keychains — changing one
+/// orphans the secret rather than migrating it.
+const PROJECT_SECRET_FIELDS: &[(&str, &str)] = &[
+    ("/git_token", "git-token"),
+    ("/bedrock_config/aws_access_key_id", "aws-access-key-id"),
+    ("/bedrock_config/aws_secret_access_key", "aws-secret-access-key"),
+    ("/bedrock_config/aws_session_token", "aws-session-token"),
+    ("/bedrock_config/aws_bearer_token", "aws-bearer-token"),
+    ("/openai_compatible_config/api_key", "openai-compatible-api-key"),
+];
+
+/// The keychain keys the caller sent an explicit `null` for.
+///
+/// **Absent and `null` are different things here, and treating them alike
+/// destroys credentials.** Every secret field is `#[serde(skip_serializing)]`,
+/// so the `Project` the frontend holds has no `git_token` key at all — a save
+/// from the Workspace, Runtime or Model section spreads that object and sends
+/// the field *absent*, while the editor that owns the field sends
+/// `git_token: null` when the user blanks it (`AccessSection.tsx`:
+/// `save({ git_token: gitToken || null })`). Serde maps both to `None`, which
+/// is why this reads the payload rather than the deserialised struct: absent
+/// means "not mine to touch", `null` means "the user emptied it".
+fn explicitly_cleared_secrets(payload: &serde_json::Value) -> Vec<&'static str> {
+    PROJECT_SECRET_FIELDS
+        .iter()
+        .filter(|(pointer, _)| matches!(payload.pointer(pointer), Some(serde_json::Value::Null)))
+        .map(|(_, key)| *key)
+        .collect()
+}
+
+/// Store one secret, clear it, or leave it alone — see
+/// [`explicitly_cleared_secrets`] for which is which.
+fn save_secret(
+    project_id: &str,
+    key_name: &str,
+    value: Option<&str>,
+    explicitly_cleared: &[&str],
+) -> Result<(), String> {
+    if value.is_none() && !explicitly_cleared.contains(&key_name) {
+        return Ok(());
     }
+    secure::store_or_clear_project_secret(project_id, key_name, value)
+}
+
+/// Extract secret fields from a project and store them in the OS keychain,
+/// **deleting the ones the caller blanked**.
+///
+/// The `if let Some(v) = …` this replaces could only ever write: a blanked
+/// token left the old value in the keychain, `load_secrets_for_project` read it
+/// straight back onto the project, and the container went on getting the
+/// credential the user had just revoked.
+fn store_secrets_for_project(project: &Project, explicitly_cleared: &[&str]) -> Result<(), String> {
+    save_secret(
+        &project.id,
+        "git-token",
+        project.git_token.as_deref(),
+        explicitly_cleared,
+    )?;
     if let Some(ref bedrock) = project.bedrock_config {
-        if let Some(ref v) = bedrock.aws_access_key_id {
-            secure::store_project_secret(&project.id, "aws-access-key-id", v)?;
-        }
-        if let Some(ref v) = bedrock.aws_secret_access_key {
-            secure::store_project_secret(&project.id, "aws-secret-access-key", v)?;
-        }
-        if let Some(ref v) = bedrock.aws_session_token {
-            secure::store_project_secret(&project.id, "aws-session-token", v)?;
-        }
-        if let Some(ref v) = bedrock.aws_bearer_token {
-            secure::store_project_secret(&project.id, "aws-bearer-token", v)?;
-        }
+        save_secret(
+            &project.id,
+            "aws-access-key-id",
+            bedrock.aws_access_key_id.as_deref(),
+            explicitly_cleared,
+        )?;
+        save_secret(
+            &project.id,
+            "aws-secret-access-key",
+            bedrock.aws_secret_access_key.as_deref(),
+            explicitly_cleared,
+        )?;
+        save_secret(
+            &project.id,
+            "aws-session-token",
+            bedrock.aws_session_token.as_deref(),
+            explicitly_cleared,
+        )?;
+        save_secret(
+            &project.id,
+            "aws-bearer-token",
+            bedrock.aws_bearer_token.as_deref(),
+            explicitly_cleared,
+        )?;
     }
     if let Some(ref oai_config) = project.openai_compatible_config {
-        if let Some(ref v) = oai_config.api_key {
-            secure::store_project_secret(&project.id, "openai-compatible-api-key", v)?;
-        }
+        save_secret(
+            &project.id,
+            "openai-compatible-api-key",
+            oai_config.api_key.as_deref(),
+            explicitly_cleared,
+        )?;
     }
     Ok(())
 }
@@ -105,6 +176,494 @@ pub(crate) fn load_secrets_for_project(project: &mut Project) {
     }
 }
 
+/// Validate the folder list a project is about to be stored with.
+///
+/// ## Why this is not cosmetic
+///
+/// `mount_name` is interpolated straight into a container mount target —
+/// `docker::create_container` builds `/workspace/{mount_name}` — and the daemon
+/// **normalises** what it is given. Confirmed against Engine 29.7 through the
+/// same API bollard uses: a mount named `../tmp/claude-x` is created with a
+/// destination of `/tmp/claude-x`, i.e. the host directory is mounted straight
+/// on top of one of the paths the pre-commit scrub owns. The next recreate then
+/// runs the scrub, as root, over the user's own project directory. That is the
+/// C1 data-loss chain end to end, and
+/// [`check_mount_name_stays_under_workspace`] is the half of it that stops the
+/// path ever being spelled.
+///
+/// `host_path` is the other side of the same mount. `/` there bind-mounts the
+/// entire host filesystem read-write into a container whose agent has
+/// passwordless sudo. Anything short of a filesystem root is the user choosing
+/// a folder — the Browse button and the free-text field lead to the same place
+/// — so only the roots themselves are refused, and *root* is answered by
+/// resolving the path rather than by reading it: `/..` is spelled like a folder
+/// and is the root. See [`classify_mount_source`].
+///
+/// This is the **whole** rule set, and it belongs to `add_project`, where every
+/// row is new by definition. `update_project` runs
+/// [`validate_project_paths_update`] instead: see there for why a list that is
+/// already in `projects.json` cannot be held to all of it.
+fn validate_project_paths(paths: &[ProjectPath]) -> Result<(), String> {
+    let mut seen_names = std::collections::HashSet::new();
+    for p in paths {
+        // The Config tab's "+ Add folder" inserts an empty row and saves the
+        // whole list on the next blur, so a wholly blank entry is the UI's
+        // placeholder rather than an attempt at anything. It is stored as it
+        // always was; a half-filled one is refused.
+        if p.host_path.is_empty() && p.mount_name.is_empty() {
+            continue;
+        }
+        validate_one_path(p)?;
+        if !seen_names.insert(p.mount_name.clone()) {
+            return Err(format!("Duplicate mount name '{}'.", p.mount_name));
+        }
+    }
+    Ok(())
+}
+
+/// Every rule that applies to a single folder row, duplicates aside.
+fn validate_one_path(p: &ProjectPath) -> Result<(), String> {
+    if p.mount_name.is_empty() {
+        return Err("Mount name cannot be empty.".to_string());
+    }
+    if !p.mount_name.chars().all(|c| c.is_alphanumeric() || c == '-' || c == '_' || c == '.') {
+        return Err(format!("Mount name '{}' contains invalid characters. Use alphanumeric, dash, underscore, or dot.", p.mount_name));
+    }
+    check_mount_name_stays_under_workspace(&p.mount_name)?;
+    // Trimmed: a host path of spaces is not a folder, and `classify_mount_source`
+    // is deliberately silent about a path with nothing in it — this is the
+    // message that names the mount it belongs to.
+    if p.host_path.trim().is_empty() {
+        return Err(format!(
+            "Folder mounted at '/workspace/{}' has no host path.",
+            p.mount_name
+        ));
+    }
+    match classify_mount_source(&p.host_path) {
+        None => {}
+        Some(UnmountableHostPath::FilesystemRoot { resolved }) => {
+            return Err(filesystem_root_message(
+                &p.host_path,
+                &resolved,
+                "using it as a project folder",
+            ));
+        }
+        Some(UnmountableHostPath::NotAbsolute) => {
+            return Err(format!(
+                "'{}' is not a full path to a folder — where it lands is decided by wherever \
+                 Triple-C is running from rather than by you. Give the whole path.",
+                p.host_path
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// The one rule that survives every exemption: the mount has to land under
+/// `/workspace`.
+///
+/// A name carrying a path separator, or one that is nothing but dots, does not
+/// name a folder inside `/workspace` — it moves the mount. `/workspace/..` is
+/// `/`, `/workspace/../tmp/claude-x` normalises to `/tmp/claude-x`, and
+/// `/workspace/.` is `/workspace` itself, shadowing every other mount. The
+/// first of those is the C1 chain: a host directory mounted over a path the
+/// pre-commit scrub empties as root.
+///
+/// Everything else `validate_one_path` checks is hygiene — a space or an `@` in
+/// a mount name is untidy, not an escape — which is why only this one is
+/// applied to rows [`validate_project_paths_update`] otherwise grandfathers.
+fn check_mount_name_stays_under_workspace(mount_name: &str) -> Result<(), String> {
+    if mount_name.contains('/') || mount_name.contains('\\') {
+        return Err(format!(
+            "Mount name '{}' contains a path separator, so the folder would be mounted somewhere \
+             /workspace/{{name}} does not reach. Use a plain folder name.",
+            mount_name
+        ));
+    }
+    // **An empty name is not refused here, and that is a live residual.** It
+    // makes the target `/workspace/`, which the daemon normalises to
+    // `/workspace` — so the host folder shadows the directory the other mounts
+    // land in, and Docker then creates their mount points *inside it*, on the
+    // host. It is not refused because it cannot be: an empty name is what a
+    // half-filled row holds, `legacy_rows` shows those are already in
+    // `projects.json`, and this function runs on grandfathered rows too, so
+    // refusing it would make every such project unsavable — the exact
+    // regression [`validate_project_paths_update`] exists to prevent.
+    //
+    // Introducing one is closed at both ends: `validate_one_path` refuses an
+    // empty name on any new or edited row, and `WorkspaceSection` no longer
+    // sends half-filled or blank ones. What remains is the *stored* row, and it
+    // belongs where the mount is built — `docker::create_container` should skip
+    // a row with no mount name or no host path, which is the same filter that
+    // stops a stored blank row failing the create with
+    // `field Source must not be empty`.
+    if !mount_name.is_empty() && mount_name.chars().all(|c| c == '.') {
+        return Err(format!(
+            "Mount name '{}' is not a folder name — it names the directory the mount would sit in.",
+            mount_name
+        ));
+    }
+    Ok(())
+}
+
+/// Validate the folder list of a project that **already exists**, admitting the
+/// rows it is already stored with.
+///
+/// ## Why this is not just [`validate_project_paths`]
+///
+/// `update_project` validated nothing at all until recently, while
+/// `WorkspaceSection` saved `{paths}` on every blur — so `projects.json` files
+/// in the field hold rows that the full rule set refuses: a half-filled row, a
+/// mount name with a space in it, two rows sharing a name, `/` as a host path.
+///
+/// Running the full check on every save made every such project **entirely
+/// unsavable**. Not just its folder list: `update_project` is the one command
+/// behind the Config tab, so every toggle, every permission-mode change and
+/// `useTerminal.ts`'s tab rename came back with a message about folders. The
+/// remedy exists — fix the row in the Workspace section — but nothing about
+/// "cannot save" on a sandbox switch points at it.
+///
+/// And blocking the save bought nothing for the rows it was blocking. They are
+/// *already stored*, and already mounted on every container start; refusing to
+/// persist an unrelated field does not unmount them.
+///
+/// So: a row carried over verbatim from what is stored is admitted, and a row
+/// that is new or edited is held to every rule. That is enough to keep the
+/// escalation closed, because escalation means *introducing* a bad value
+/// through this command, and an introduced row is never a carried-over one.
+///
+/// The single exception is [`check_mount_name_stays_under_workspace`], which
+/// runs on every row either way. A stored `..` is a live data-loss chain rather
+/// than untidy data, its remedy is one edit in the Workspace section, and the
+/// message names the mount rather than talking about folders in the abstract.
+fn validate_project_paths_update(
+    stored: &[ProjectPath],
+    incoming: &[ProjectPath],
+) -> Result<(), String> {
+    let is_blank = |p: &ProjectPath| p.host_path.is_empty() && p.mount_name.is_empty();
+
+    // Rows carried over, counted rather than set-tested: a *second* copy of an
+    // existing row is a new row, and has to be checked like one.
+    let mut carried: std::collections::HashMap<(&str, &str), usize> =
+        std::collections::HashMap::new();
+    for p in stored.iter().filter(|p| !is_blank(p)) {
+        *carried
+            .entry((p.host_path.as_str(), p.mount_name.as_str()))
+            .or_insert(0) += 1;
+    }
+
+    for p in incoming.iter().filter(|p| !is_blank(p)) {
+        check_mount_name_stays_under_workspace(&p.mount_name)?;
+
+        match carried.get_mut(&(p.host_path.as_str(), p.mount_name.as_str())) {
+            Some(remaining) if *remaining > 0 => {
+                *remaining -= 1;
+                log::debug!(
+                    "Admitting a stored folder row unchanged: '{}' at /workspace/{}",
+                    p.host_path,
+                    p.mount_name
+                );
+            }
+            _ => validate_one_path(p)?,
+        }
+    }
+
+    // Duplicates get the same treatment, one level up: a name may repeat as
+    // many times as it already did, and no more. Counting both sides keeps the
+    // answer independent of the order the rows arrive in.
+    let count_names = |rows: &[ProjectPath]| {
+        let mut counts: std::collections::HashMap<String, usize> =
+            std::collections::HashMap::new();
+        for p in rows.iter().filter(|p| !is_blank(p)) {
+            *counts.entry(p.mount_name.clone()).or_insert(0) += 1;
+        }
+        counts
+    };
+    let stored_names = count_names(stored);
+    for (name, count) in count_names(incoming) {
+        let allowed = stored_names.get(&name).copied().unwrap_or(0).max(1);
+        if count > allowed {
+            return Err(format!("Duplicate mount name '{}'.", name));
+        }
+    }
+
+    Ok(())
+}
+
+/// Refuse a filesystem root newly set as `ssh_key_path` or `ca_cert_path`.
+///
+/// Both are bind-mounted into the container by `docker::create_container` —
+/// `/tmp/.host-ssh` and `/tmp/.host-ca` — and neither had any check at all, so
+/// `/` handed the whole host filesystem to the agent to read. Read-only, so
+/// this is disclosure rather than the read-write hole a `/` project folder is,
+/// but it is the same check: [`classify_mount_source`], resolved rather than
+/// spelled, so `/..` and `/home/..` are refused here too.
+///
+/// Same grandfathering as the folder list, for the same reason: a value already
+/// stored is already mounted on every start, and refusing an unrelated save
+/// does not unmount it. Only a *change* is held to the rule.
+pub(crate) fn validate_mounted_host_path(
+    label: &str,
+    stored: Option<&str>,
+    incoming: Option<&str>,
+) -> Result<(), String> {
+    let Some(value) = incoming.map(str::trim).filter(|v| !v.is_empty()) else {
+        return Ok(());
+    };
+    if stored.map(str::trim) == Some(value) {
+        return Ok(());
+    }
+    match classify_mount_source(value) {
+        None => {}
+        Some(UnmountableHostPath::FilesystemRoot { resolved }) => {
+            return Err(filesystem_root_message(
+                value,
+                &resolved,
+                &format!("setting it as {}", label),
+            ));
+        }
+        Some(UnmountableHostPath::NotAbsolute) => {
+            return Err(format!(
+                "'{}' is not a full path, so it cannot be used as {}. Give the whole path.",
+                value, label
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// Why a host path may not be used as the source of a bind mount.
+///
+/// Two answers rather than a `bool` because they need different sentences, and
+/// because "is a root" is no longer a question about how the path is *spelled*
+/// — the refusal has to be able to say where the path actually landed.
+#[derive(Debug, PartialEq)]
+enum UnmountableHostPath {
+    /// The path is, or resolves to, the root of a filesystem. `resolved` is
+    /// what it lands on, which is the same string only when a root was typed
+    /// outright.
+    FilesystemRoot { resolved: String },
+    /// The path does not name a location at all. Where it lands is decided by
+    /// whatever directory Triple-C happens to be running from, so it can be a
+    /// root tomorrow and a folder today, and nothing here can judge it.
+    NotAbsolute,
+}
+
+/// Length of a `C:` drive prefix at the head of `path`, or 0.
+///
+/// Duplicated from `commands::file_commands::drive_prefix_len`, together with
+/// [`is_windows_style_path`] and [`normalize_host_path`] below. Those are
+/// private to that module and it is not this branch's file to change; if the
+/// two copies are ever merged, that one is the original and carries the wider
+/// test coverage.
+fn drive_prefix_len(path: &str) -> usize {
+    let b = path.as_bytes();
+    if b.len() >= 2 && b[0].is_ascii_alphabetic() && b[1] == b':' {
+        2
+    } else {
+        0
+    }
+}
+
+/// Whether `path` is written in Windows form, and so whether `\` separates its
+/// components. On Linux a backslash is an ordinary filename character, which is
+/// why this is a question rather than an unconditional substitution.
+///
+/// Copy of `file_commands::is_windows_style_path` — see [`drive_prefix_len`].
+fn is_windows_style_path(path: &str) -> bool {
+    cfg!(windows) || path.starts_with("\\\\") || drive_prefix_len(path) > 0
+}
+
+/// `path` with its separators unified and any Win32 verbatim/device prefix
+/// removed — the form every rule below is expressed against.
+///
+/// `\\?\C:\Windows` and `\\?\UNC\server\share` name the *same locations* as
+/// `C:\Windows` and `\\server\share`; the prefix only turns off Win32 path
+/// parsing. Stripping it is what stops four characters being a bypass — and it
+/// has to run on our own output as well, because `std::fs::canonicalize` hands
+/// back exactly that spelling on Windows.
+///
+/// Copy of `file_commands::normalize_host_path` — see [`drive_prefix_len`].
+fn normalize_host_path(path: &str) -> String {
+    let mut s = if is_windows_style_path(path) {
+        path.replace('\\', "/")
+    } else {
+        path.to_string()
+    };
+    // Slicing by byte index is safe here only because a prefix matched
+    // case-insensitively as ASCII is ASCII, so its end is a char boundary.
+    for prefix in ["//?/unc/", "//./unc/"] {
+        if s.len() >= prefix.len()
+            && s.as_bytes()[..prefix.len()].eq_ignore_ascii_case(prefix.as_bytes())
+        {
+            return format!("//{}", &s[prefix.len()..]);
+        }
+    }
+    for prefix in ["//?/", "//./"] {
+        if s.len() >= prefix.len()
+            && s.as_bytes()[..prefix.len()].eq_ignore_ascii_case(prefix.as_bytes())
+        {
+            s = s[prefix.len()..].to_string();
+            break;
+        }
+    }
+    s
+}
+
+/// A normalised absolute path split into the root it hangs off and the part
+/// below it, or `None` when it names no location at all.
+///
+/// The three roots the desktop platforms have: `/`, a drive (`C:/`), and a UNC
+/// share (`//server/share` — the share *is* the root; `//server` alone names a
+/// machine and nothing on it).
+fn split_host_root(norm: &str) -> Option<(&str, &str)> {
+    if let Some(rest) = norm.strip_prefix("//") {
+        let mut parts = rest.splitn(3, '/');
+        let server = parts.next().unwrap_or("");
+        let share = parts.next().unwrap_or("");
+        if server.is_empty() || share.is_empty() {
+            // `//server`, `//server/`: no share, so nothing under it is named.
+            return Some((norm, ""));
+        }
+        let root_len = 2 + server.len() + 1 + share.len();
+        return Some((&norm[..root_len], &norm[root_len..]));
+    }
+    let drive = drive_prefix_len(norm);
+    if drive > 0 {
+        // `C:x` is drive-*relative* — it means "x under the current directory
+        // on C:", which is a location only the process's own state decides.
+        return match norm[drive..].strip_prefix('/') {
+            Some(tail) => Some((&norm[..drive + 1], tail)),
+            None if norm.len() == drive => Some((norm, "")),
+            None => None,
+        };
+    }
+    norm.strip_prefix('/').map(|tail| (&norm[..1], tail))
+}
+
+/// How many named components deep `tail` ends up, with `.` dropped and `..`
+/// applied — clamped at the root, because `/..` is `/` and not an error.
+fn depth_below_root(tail: &str) -> usize {
+    let mut depth = 0usize;
+    for segment in tail.split('/') {
+        match segment {
+            "" | "." => {}
+            ".." => depth = depth.saturating_sub(1),
+            _ => depth += 1,
+        }
+    }
+    depth
+}
+
+/// Whether a host path can be handed to Docker as a bind-mount source, and if
+/// not, why.
+///
+/// ## Resolved, not spelled
+///
+/// This used to be `is_filesystem_root`, and it was purely lexical: trim the
+/// trailing separators, say yes to what was left over only if it was empty or a
+/// bare `C:`. Nothing in this file called `canonicalize`, so `/..`, `/./`,
+/// `/home/..`, `/etc/../` and `C:\..` all sailed through and were passed
+/// verbatim to `docker::create_container`, which builds a
+/// `Mount { source, read_only: Some(false) }` out of them. Verified against the
+/// daemon: `-v /..:/mnt/probe` mounts the host root. That is the whole host
+/// filesystem, read-write, in a container whose agent has passwordless sudo —
+/// the same escalation `check_mount_name_stays_under_workspace` exists to
+/// close, reached through the host-path half of the mount instead of the
+/// mount-name half.
+///
+/// So the answer comes from the OS where the OS can give one: `canonicalize`
+/// applies `..`, follows every symlink in the path, and on Windows returns the
+/// long name for an 8.3 alias and the verbatim spelling of a UNC share — all
+/// things a string comparison cannot see.
+///
+/// ## When the path cannot be resolved
+///
+/// `canonicalize` fails on a path that does not exist *here*, which is an
+/// ordinary state rather than an attack: `projects.json` syncs between machines
+/// and names `C:\Users\jo\code` on a box that has never had a `C:`, and a
+/// folder can be created after the project is. Refusing outright would make
+/// every such project unsavable, which is the exact failure
+/// [`validate_project_paths_update`] exists to avoid — so an unresolvable path
+/// falls back to the lexical answer, with `.` and `..` collapsed by
+/// [`depth_below_root`] rather than ignored.
+///
+/// That is a weaker guarantee, not a wrong one, and the gap is bounded: what
+/// resolution adds over the lexical rule is symlinks and 8.3 aliases, and both
+/// of those are properties of a path that *exists* — precisely the case where
+/// `canonicalize` answers. What is left is a path that does not exist at save
+/// time and is a symlink to the root by the time the container starts, i.e. the
+/// user doing it to themselves after being asked.
+///
+/// Blocking on the filesystem here is deliberate: this runs on a save, once per
+/// row, and is a single `realpath` walk.
+fn classify_mount_source(host_path: &str) -> Option<UnmountableHostPath> {
+    let raw = host_path.trim();
+    if raw.is_empty() {
+        // Emptiness is somebody else's error message — see
+        // `validate_one_path`, which names the mount it belongs to.
+        return None;
+    }
+
+    // Nothing but separators, in either spelling: `/`, `//`, `\`, `\\`. Taken
+    // first because a lone `\` is a *relative* name on Linux, and reporting a
+    // Windows root as "not a full path" would be answering a question the user
+    // did not ask.
+    if raw.chars().all(|c| c == '/' || c == '\\') {
+        return Some(UnmountableHostPath::FilesystemRoot {
+            resolved: raw.to_string(),
+        });
+    }
+
+    // Absoluteness is judged on what the user typed, **before** resolution.
+    //
+    // `canonicalize` resolves a relative path against Triple-C's own working
+    // directory, so it hands back an absolute path and the `NotAbsolute` branch
+    // below never fires — it was reachable only when canonicalize *failed*,
+    // i.e. only for relative paths that happened not to exist. That made the
+    // verdict depend on where the app was launched from: `.` and `..` were
+    // accepted from the repo, refused from `/`. The daemon then refuses the
+    // mount outright (`invalid mount path: '..' mount path must be absolute`),
+    // so the project saved cleanly and could never start again — the bricking
+    // mode `project_path_mounts`'s filter exists to prevent, reached through
+    // the host-path half of the row instead of the mount-name half.
+    if split_host_root(&normalize_host_path(raw)).is_none() {
+        return Some(UnmountableHostPath::NotAbsolute);
+    }
+
+    let canonical = std::fs::canonicalize(raw)
+        .ok()
+        .map(|p| p.to_string_lossy().into_owned());
+    let judged = canonical.as_deref().unwrap_or(raw);
+    let norm = normalize_host_path(judged);
+
+    let Some((root, tail)) = split_host_root(&norm) else {
+        return Some(UnmountableHostPath::NotAbsolute);
+    };
+    if depth_below_root(tail) == 0 {
+        return Some(UnmountableHostPath::FilesystemRoot {
+            resolved: root.to_string(),
+        });
+    }
+    None
+}
+
+/// The refusal for a host path that lands on a filesystem root, naming the
+/// resolved location as well as what was typed when those differ. `/..` reads
+/// as a folder; `/..` *is* `/`, and a message that only quoted it back would
+/// leave the user with nothing to act on.
+fn filesystem_root_message(typed: &str, resolved: &str, use_for: &str) -> String {
+    let where_it_lands = if typed.trim() == resolved {
+        format!("'{}' is a filesystem root", typed)
+    } else {
+        format!("'{}' resolves to '{}', which is a filesystem root", typed, resolved)
+    };
+    format!(
+        "{}, so {} would mount the whole drive into the container. Choose the folder itself.",
+        where_it_lands, use_for
+    )
+}
+
 #[tauri::command]
 pub async fn list_projects(state: State<'_, AppState>) -> Result<Vec<Project>, String> {
     Ok(state.projects_store.list())
@@ -117,23 +676,19 @@ pub async fn add_project(
     state: State<'_, AppState>,
 ) -> Result<Project, String> {
     // Validate paths
-    if paths.is_empty() {
+    // A new project needs a folder; the blank row `validate_project_paths`
+    // tolerates is the Config tab's placeholder on an *existing* one.
+    if paths.is_empty()
+        || paths
+            .iter()
+            .all(|p| p.host_path.is_empty() && p.mount_name.is_empty())
+    {
         return Err("At least one folder path is required.".to_string());
     }
-    let mut seen_names = std::collections::HashSet::new();
-    for p in &paths {
-        if p.mount_name.is_empty() {
-            return Err("Mount name cannot be empty.".to_string());
-        }
-        if !p.mount_name.chars().all(|c| c.is_alphanumeric() || c == '-' || c == '_' || c == '.') {
-            return Err(format!("Mount name '{}' contains invalid characters. Use alphanumeric, dash, underscore, or dot.", p.mount_name));
-        }
-        if !seen_names.insert(p.mount_name.clone()) {
-            return Err(format!("Duplicate mount name '{}'.", p.mount_name));
-        }
-    }
+    validate_project_paths(&paths)?;
     let project = Project::new(name, paths);
-    store_secrets_for_project(&project)?;
+    // Nothing can have been blanked on a project that did not exist a line ago.
+    store_secrets_for_project(&project, &[])?;
     state.projects_store.add(project)
 }
 
@@ -142,6 +697,22 @@ pub async fn remove_project(
     project_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
+    // **H-2: the only writer of these three categories that held nothing.**
+    // This purges migration artifacts, removes `triple-c-snapshot-{id}` and
+    // both named volumes — and a compaction resolves that same tag when its
+    // build starts and commits back over it minutes later. Compact a project,
+    // then remove it from the sidebar, and `restore_image_config` commits a
+    // flat image back onto `triple-c-snapshot-{id}:latest` for a project that
+    // no longer exists: not dangling, not a `:pre-migration-*` tag, and not
+    // reachable by the per-project scan, so no reclaim path can ever see it
+    // again. Taken for the whole removal, like every other writer.
+    //
+    // Refusing is safe for the UI: `useProjects.remove` only drops the sidebar
+    // row *after* the command resolves, and `ProjectHome` turns the rejection
+    // into a toast, so the row stays and the message names what is running.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Destroy)?;
+
     // Release any host loopback ports the auth bridge holds for this project
     // before the container (and the project record) go away.
     state.auth_bridge.stop(&project_id).await;
@@ -183,11 +754,75 @@ pub async fn remove_project(
 
 #[tauri::command]
 pub async fn update_project(
-    project: Project,
+    project: serde_json::Value,
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<Project, String> {
-    store_secrets_for_project(&project)?;
+    // Taken as raw JSON, then deserialised, for one reason: a secret field that
+    // arrived as `null` is a credential the user cleared, and a secret field
+    // that did not arrive at all belongs to whichever editor is not saving
+    // right now. `Option<String>` cannot tell those apart — see
+    // [`explicitly_cleared_secrets`].
+    let explicitly_cleared = explicitly_cleared_secrets(&project);
+    let mut project: Project = serde_json::from_value(project)
+        .map_err(|e| format!("Could not read the project being saved: {}", e))?;
+
+    // Fields this command does not get to write, whoever is calling it.
+    //
+    // `container_id` is the one that matters: it is the handle the whole file
+    // command surface resolves against, `list_sibling_containers` used to hand the
+    // webview the ids of every other container on the daemon, and a project
+    // save is not the place a container is adopted. It is assigned by
+    // `start_project_container` through `projects_store::set_container_id` and
+    // read back here. `status` has its own setter (`update_status`) for the
+    // same reason, and neither `id` nor `created_at` is a thing a save can
+    // mean to change.
+    //
+    // The privileged *toggles* — `allow_docker_access`, `vpn_support_enabled`,
+    // `sandbox_mode_enabled`, `permission_mode` — are deliberately not in this
+    // list: they are what the Config tab's own switches write, through this
+    // command, and there is nothing here that can tell that call apart from
+    // any other. Their boundary is the webview, not this function.
+    let stored = state
+        .projects_store
+        .get(&project.id)
+        .ok_or_else(|| format!("Project {} not found", project.id))?;
+
+    // **This takes a whole `Project` over IPC and used to store it verbatim.**
+    // `add_project` validated its folder list and this did not, so every check
+    // there was one edit away from being bypassed — and the Config tab's mount
+    // name is a free-text field on an existing project, saved on blur, calling
+    // exactly this command. See [`validate_project_paths`] for what a mount
+    // name of `../tmp/claude-x` does to the user's files.
+    //
+    // Validated against what is *stored*, not in isolation: a rule this command
+    // never enforced can be violated by data already on disk, and a project
+    // that cannot be saved at all is a Config tab that cannot be used at all.
+    // See [`validate_project_paths_update`].
+    validate_project_paths_update(&stored.paths, &project.paths)?;
+    validate_mounted_host_path(
+        "the SSH key folder",
+        stored.ssh_key_path.as_deref(),
+        project.ssh_key_path.as_deref(),
+    )?;
+    validate_mounted_host_path(
+        "the CA certificate path",
+        stored.ca_cert_path.as_deref(),
+        project.ca_cert_path.as_deref(),
+    )?;
+
+    // Custom env var names had no charset check anywhere, so a key like
+    // `BASH_FUNC_stat%%` reached the container environment verbatim. Same
+    // grandfathering as the folder list, for the same reason — see
+    // [`crate::models::validate_env_vars_update`].
+    crate::models::validate_env_vars_update(&stored.custom_env_vars, &project.custom_env_vars)?;
+
+    project.container_id = stored.container_id;
+    project.status = stored.status;
+    project.created_at = stored.created_at;
+    project.updated_at = chrono::Utc::now().to_rfc3339();
+
+    store_secrets_for_project(&project, &explicitly_cleared)?;
     let updated = state.projects_store.update(project)?;
 
     // `auth_bridge_enabled` can arrive through this generic save as well as
@@ -221,20 +856,35 @@ pub async fn start_project_container(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<Project, String> {
-    // A migration removes the container and creates its replacement moments
-    // later. Starting in that window finds no container, creates a second one
-    // under the same name, and the migration's own create then fails on the
-    // name conflict — which sends it into an auto-rollback that also cannot
-    // create. The UI already refuses (`canMigrate` gates on the container being
-    // stopped and no run being in flight); this is the same gate on the side
-    // that actually owns the invariant.
-    if crate::commands::migration_commands::is_migrating(&project_id) {
-        return Err(
-            "A container base update is running for this project. Wait for it to finish, then start the project."
-                .to_string(),
-        );
-    }
+    // **Acquired, not polled.** A migration removes the container and creates
+    // its replacement moments later. Starting in that window finds no
+    // container, creates a second one under the same name, and the migration's
+    // own create then fails on the name conflict — which sends it into an
+    // auto-rollback that also cannot create. This used to be a one-shot
+    // `is_migrating` read, which covered that case and no other: a start also
+    // commits `triple-c-snapshot-{id}:latest`, so it races a *compaction*
+    // committing the same tag with nothing between them. The claim is held for
+    // the whole start rather than checked at its door.
+    //
+    // The UI already refuses (`canMigrate` gates on the container being stopped
+    // and no run being in flight); this is the same gate on the side that
+    // actually owns the invariant.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Recreate)?;
+    start_project_container_locked(project_id, app_handle, state).await
+}
 
+/// The body of [`start_project_container`], with **no claim of its own**.
+///
+/// Split out for exactly one caller: [`rebuild_project_container`] already
+/// holds the project under [`crate::project_lock::ProjectOp::Reset`] for its
+/// whole run, and a Reset that then went through the public command would be
+/// refused by its own guard. Every other path must go through the command.
+async fn start_project_container_locked(
+    project_id: String,
+    app_handle: tauri::AppHandle,
+    state: State<'_, AppState>,
+) -> Result<Project, String> {
     let mut project = state
         .projects_store
         .get(&project_id)
@@ -459,7 +1109,7 @@ pub async fn start_project_container(
                 // just this one, so recreations that happened before the sweep
                 // existed are cleaned up too.
                 tauri::async_runtime::spawn(async {
-                    docker::sweep_orphaned_snapshots().await;
+                    docker::sweep_orphaned_snapshots_logged("after recreation").await;
                 });
 
                 new_id
@@ -539,6 +1189,14 @@ pub async fn stop_project_container(
     app_handle: tauri::AppHandle,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
+    // Stop had **no** exclusion at all, which is the one gap CLAUDE.md's "every
+    // command that stops, removes or recreates the container consults
+    // `is_migrating`" rule already named and this function did not honour. A
+    // stop lands on the container a migration is mid-swap on, and it closes the
+    // exec sessions a compaction's config replay is not expecting to lose.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Recreate)?;
+
     let project = state
         .projects_store
         .get(&project_id)
@@ -571,13 +1229,13 @@ pub async fn rebuild_project_container(
 ) -> Result<Project, String> {
     // Reset deletes both volumes and the snapshot image. Doing that while a
     // migration is mid-flight pulls the ground out from under it and leaves an
-    // orphan migration record pointing at images that no longer exist.
-    if crate::commands::migration_commands::is_migrating(&project_id) {
-        return Err(
-            "A container base update is running for this project. Wait for it to finish before resetting."
-                .to_string(),
-        );
-    }
+    // orphan migration record pointing at images that no longer exist — and
+    // doing it while a *compaction* is mid-flight is worse, because the
+    // compaction then commits `flat(old)` back over the `:latest` this just
+    // destroyed and resurrects the system layer the user asked to be rid of.
+    // Held for the whole Reset, including the start at the end of it.
+    let _guard =
+        crate::project_lock::try_acquire(&project_id, crate::project_lock::ProjectOp::Reset)?;
 
     let project = state
         .projects_store
@@ -611,8 +1269,9 @@ pub async fn rebuild_project_container(
         log::warn!("Failed to remove project volumes for project {}: {}", project_id, e);
     }
 
-    // Start fresh
-    start_project_container(project_id, app_handle, state).await
+    // Start fresh. The locked variant, because `_guard` above is this project's
+    // claim and the public command would be refused by it.
+    start_project_container_locked(project_id, app_handle, state).await
 }
 
 /// Reconcile project statuses against actual Docker container state.
@@ -656,9 +1315,14 @@ pub async fn reconcile_project_statuses(
         ) {
             continue;
         }
-        // ...but never for a project this process is actively migrating: the
-        // container is legitimately absent for part of that run.
-        if crate::commands::migration_commands::is_migrating(&project.id) {
+        // ...but never for a project this process is actively working on. A
+        // migration's container is legitimately absent between the
+        // `remove_container` and the create that follows, and so is a Reset's,
+        // and so is a start's before its create returns. Reconciling into any
+        // of those windows writes `Stopped` over a project that is mid-run.
+        // Broadened from `is_migrating` to the whole lock for exactly that
+        // reason — the migration was never the only operation with a gap.
+        if crate::project_lock::held(&project.id).is_some() {
             continue;
         }
 
@@ -710,3 +1374,454 @@ fn default_docker_socket() -> String {
         "/var/run/docker.sock".to_string()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn path(host: &str, mount: &str) -> ProjectPath {
+        ProjectPath {
+            host_path: host.to_string(),
+            mount_name: mount.to_string(),
+        }
+    }
+
+    /// The mount name that reaches the scrub. `docker::create_container` builds
+    /// `/workspace/{mount_name}`, and the daemon normalises `..` out of it —
+    /// verified against Engine 29.7, where a mount created with a target of
+    /// `/workspace/../tmp/claude-x` is reported by `inspect` as `/tmp/claude-x`.
+    #[test]
+    fn a_mount_name_cannot_walk_out_of_workspace() {
+        for escape in ["..", "../tmp/claude-x", "../../etc", "/tmp/claude-x", "a/../.."] {
+            assert!(
+                validate_project_paths(&[path("/home/u/project", escape)]).is_err(),
+                "mount name '{}' was accepted, which puts the host folder somewhere \
+                 /workspace/{{name}} does not reach",
+                escape
+            );
+        }
+        // The dotted names that are *not* a traversal stay usable.
+        for ok in ["my.project", ".hidden", "a.b-c_d", "workspace2"] {
+            assert!(
+                validate_project_paths(&[path("/home/u/project", ok)]).is_ok(),
+                "mount name '{}' should be usable",
+                ok
+            );
+        }
+    }
+
+    #[test]
+    fn the_whole_host_filesystem_cannot_be_mounted() {
+        // A read-write bind of `/` into a container whose agent has
+        // passwordless sudo.
+        for root in ["/", "//", "\\", "C:\\", "c:/", "D:"] {
+            assert!(
+                validate_project_paths(&[path(root, "everything")]).is_err(),
+                "host path '{}' was accepted as a project folder",
+                root
+            );
+        }
+        assert!(validate_project_paths(&[path("/home/u/project", "project")]).is_ok());
+        assert!(validate_project_paths(&[path("C:\\Users\\u\\project", "project")]).is_ok());
+    }
+
+    /// Every spelling of a root that is not *spelled* like one.
+    ///
+    /// The predicate this replaces trimmed trailing separators and compared
+    /// what was left, so `/..` — which the daemon mounts as the host root,
+    /// verified with `docker run -v /..:/mnt/probe` — was indistinguishable
+    /// from a project folder called `..`. No test in the repo contained a `.`
+    /// or a `..` in a host path, which is why it shipped.
+    #[test]
+    fn a_host_path_that_resolves_to_a_root_is_refused() {
+        let escapes = [
+            "/..",
+            "/../",
+            "/./",
+            "/.",
+            "/home/..",
+            "/etc/../",
+            "/tmp/../..",
+            // Deliberately not present on any machine, so this is the
+            // unresolvable path taking the lexical route.
+            "/no-such-dir-here/../..",
+            "C:\\..",
+            "C:\\Users\\..",
+            "c:/foo/..",
+            // Win32 verbatim spelling of a drive root.
+            "\\\\?\\C:\\",
+            "\\\\?\\C:\\..",
+            // A UNC share root is the root of everything on that share, which
+            // the old predicate accepted despite its doc comment claiming
+            // otherwise.
+            "\\\\server\\share",
+            "//server/share/",
+        ];
+        for escape in escapes {
+            assert!(
+                validate_project_paths(&[path(escape, "everything")]).is_err(),
+                "host path '{}' was accepted as a project folder, which bind-mounts a whole \
+                 filesystem read-write into a container with passwordless sudo",
+                escape
+            );
+            // The same value must not be reachable through the editor either.
+            assert!(
+                validate_project_paths_update(&[], &[path(escape, "everything")]).is_err(),
+                "host path '{}' was accepted through update_project",
+                escape
+            );
+            // And the two read-only mounts are the same check.
+            assert!(
+                validate_mounted_host_path("the SSH key folder", None, Some(escape)).is_err(),
+                "'{}' was accepted as an SSH key path, which read-only bind-mounts a whole \
+                 filesystem at /tmp/.host-ssh",
+                escape
+            );
+        }
+    }
+
+    /// A drive-relative path (`C:x`, no separator) means "x under whatever the
+    /// current directory on C: happens to be" — a location decided by the
+    /// process rather than by the user, so it may be the drive root.
+    #[test]
+    fn a_relative_path_is_refused_however_it_resolves_from_here() {
+        // The previous test for this passed by coincidence: its four examples
+        // did not exist under `app/src-tauri`, so `canonicalize` failed and the
+        // `NotAbsolute` branch fired for the wrong reason. Creating a directory
+        // named `project` there flipped it red.
+        //
+        // These are paths that *do* exist relative to wherever the test runs,
+        // so they exercise the branch that used to be unreachable. Judged on
+        // the typed string, the answer is the same from any working directory —
+        // which is the property that matters, because the daemon refuses a
+        // relative mount source and the project would save fine and then never
+        // start.
+        for existing in [".", "..", "src", "./src"] {
+            assert!(
+                matches!(
+                    classify_mount_source(existing),
+                    Some(UnmountableHostPath::NotAbsolute)
+                ),
+                "{} is relative and must be refused regardless of cwd",
+                existing
+            );
+        }
+
+        // And the fix must not have made an absolute path unreachable.
+        assert!(
+            classify_mount_source("/usr").is_none(),
+            "an ordinary absolute folder must still be accepted"
+        );
+    }
+
+    #[test]
+    fn a_path_that_names_no_location_is_refused_rather_than_guessed_at() {
+        for relative in ["C:x", "C:Users\\jo", "relative/path", "./project"] {
+            assert!(
+                validate_project_paths(&[path(relative, "project")]).is_err(),
+                "'{}' was accepted, though where it lands depends on Triple-C's own \
+                 working directory",
+                relative
+            );
+        }
+    }
+
+    /// The dots that are *not* an escape have to keep working — a folder can
+    /// legitimately be reached through `.` or a `..` that goes back down again,
+    /// and the Browse button produces paths on machines this list is not
+    /// running on.
+    #[test]
+    fn an_ordinary_folder_is_still_accepted_however_it_is_spelled() {
+        for ok in [
+            "/home/u/./project",
+            "/home/u/x/../project",
+            "/home/u/..project",
+            "/home/u/project/..hidden",
+            "C:\\Users\\u\\x\\..\\project",
+            "\\\\server\\share\\project",
+            "\\\\?\\C:\\Users\\u\\project",
+        ] {
+            assert!(
+                validate_project_paths(&[path(ok, "project")]).is_ok(),
+                "host path '{}' should be usable",
+                ok
+            );
+        }
+    }
+
+    /// The half of this that only resolution can answer.
+    ///
+    /// A lexical check sees a two-component path under `/tmp` and stops. The
+    /// container is what plants the link — `/proc/self/mountinfo` inside a
+    /// Triple-C container spells the host's project paths out verbatim — so the
+    /// symlink is reachable, and the mount that follows it is read-write.
+    #[cfg(unix)]
+    #[test]
+    fn a_symlink_to_the_root_is_refused_because_resolution_is_what_answers() {
+        let dir = std::env::temp_dir().join(format!(
+            "triple-c-root-link-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let link = dir.join("innocent");
+        std::os::unix::fs::symlink("/", &link).unwrap();
+
+        let verdict = validate_project_paths(&[path(&link.to_string_lossy(), "project")]);
+        std::fs::remove_file(&link).ok();
+        std::fs::remove_dir(&dir).ok();
+
+        assert!(
+            verdict.is_err(),
+            "a symlink to / was accepted as a project folder; only canonicalisation can see it"
+        );
+    }
+
+    #[test]
+    fn duplicate_and_half_filled_rows_are_refused_but_the_blank_row_is_not() {
+        assert!(validate_project_paths(&[
+            path("/home/u/a", "same"),
+            path("/home/u/b", "same"),
+        ])
+        .is_err());
+        assert!(validate_project_paths(&[path("/home/u/a", "")]).is_err());
+        assert!(validate_project_paths(&[path("", "a")]).is_err());
+        // "+ Add folder" inserts this and the next blur saves the whole list;
+        // refusing it would turn an empty row into an error toast.
+        assert!(validate_project_paths(&[path("/home/u/a", "a"), path("", "")]).is_ok());
+    }
+
+    /// The distinction the whole secret-clearing path rests on.
+    ///
+    /// Every secret field is `#[serde(skip_serializing)]`, so the project
+    /// object the frontend holds has no `git_token` key — a save from the
+    /// Workspace or Runtime section sends it *absent*, and clearing on absent
+    /// would delete the token every time an unrelated setting was changed. The
+    /// editor that owns the field sends an explicit `null`.
+    #[test]
+    fn a_blanked_secret_is_cleared_and_an_absent_one_is_left_alone() {
+        let blanked = serde_json::json!({
+            "id": "p1",
+            "git_token": null,
+            "bedrock_config": { "aws_bearer_token": null },
+        });
+        let cleared = explicitly_cleared_secrets(&blanked);
+        assert!(cleared.contains(&"git-token"));
+        assert!(cleared.contains(&"aws-bearer-token"));
+        // Present in the same payload, absent from the clear list.
+        assert!(!cleared.contains(&"aws-access-key-id"));
+
+        // What a Workspace-section save looks like: no secret keys at all.
+        let unrelated = serde_json::json!({ "id": "p1", "name": "renamed" });
+        assert!(explicitly_cleared_secrets(&unrelated).is_empty());
+
+        // And a value is neither.
+        let written = serde_json::json!({ "id": "p1", "git_token": "ghp_xxx" });
+        assert!(explicitly_cleared_secrets(&written).is_empty());
+    }
+
+    #[test]
+    fn every_secret_field_can_be_cleared() {
+        // A field the frontend can blank but this list does not name is a
+        // credential that cannot be revoked through the UI, which is the bug
+        // this exists to close. The keychain keys must match the ones
+        // `load_secrets_for_project` reads back, or a save writes one name and
+        // the container is handed another.
+        for (pointer, key) in PROJECT_SECRET_FIELDS {
+            let field = pointer.rsplit('/').next().unwrap();
+            let payload = match pointer.matches('/').count() {
+                1 => serde_json::json!({ field: null }),
+                _ => {
+                    let parent = pointer.trim_start_matches('/').split('/').next().unwrap();
+                    serde_json::json!({ parent: { field: null } })
+                }
+            };
+            assert!(
+                explicitly_cleared_secrets(&payload).contains(key),
+                "{} does not reach the keychain key {}",
+                pointer,
+                key
+            );
+        }
+    }
+
+    #[test]
+    fn add_and_update_cannot_disagree_about_what_a_folder_list_may_contain() {
+        // `update_project` used to validate nothing at all, so every rule in
+        // `add_project` was one save-on-blur away from being bypassed. It now
+        // validates against what is stored rather than in isolation, but a row
+        // it has never seen before is held to exactly the same rules — this
+        // fails if either side grows its own copy.
+        let bad = [path("/home/u/project", "../tmp/claude-x")];
+        assert!(validate_project_paths(&bad).is_err());
+        assert!(validate_project_paths_update(&[], &bad).is_err());
+        let good = [path("/home/u/project", "project")];
+        assert!(validate_project_paths(&good).is_ok());
+        assert!(validate_project_paths_update(&[], &good).is_ok());
+    }
+
+    // ── Folder lists that are already in `projects.json` ──────────────────
+    //
+    // `update_project` validated nothing while `WorkspaceSection` saved
+    // `{paths}` on every blur, so a stored list can break rules that only
+    // `add_project` ever enforced. Holding a save to all of them turned every
+    // such project into one that cannot be saved *at all* — not its folders:
+    // `update_project` is the single command behind the whole Config tab, so a
+    // sandbox toggle, a permission-mode change and `useTerminal.ts`'s tab
+    // rename all came back with a message about folders.
+
+    /// The shapes a real `projects.json` can be holding. None of them is an
+    /// escape from `/workspace`; all of them used to brick the editor.
+    fn legacy_rows() -> Vec<Vec<ProjectPath>> {
+        vec![
+            // Half-filled: "+ Add folder", a host path typed, no name yet, and
+            // an unrelated blur saved the list.
+            vec![path("/home/u/a", "a"), path("/home/u/b", "")],
+            vec![path("/home/u/a", "a"), path("", "b")],
+            // A mount name the character check refuses but the daemon puts
+            // exactly where it says: /workspace/my project.
+            vec![path("/home/u/a", "my project")],
+            vec![path("/home/u/a", "web@2")],
+            // Two rows sharing a name.
+            vec![path("/home/u/a", "same"), path("/home/u/b", "same")],
+            // The whole drive, from before anything refused it.
+            vec![path("/", "everything")],
+            vec![path("C:\\", "everything")],
+        ]
+    }
+
+    #[test]
+    fn a_project_stored_with_a_bad_row_can_still_be_saved() {
+        for rows in legacy_rows() {
+            // The full rule set is what made these unsavable…
+            assert!(
+                validate_project_paths(&rows).is_err(),
+                "fixture {:?} is not actually a rule violation",
+                rows
+            );
+            // …and an unrelated Config save re-sends the list it was given.
+            assert!(
+                validate_project_paths_update(&rows, &rows).is_ok(),
+                "saving an unrelated setting on a project stored as {:?} is refused, so every \
+                 toggle in the Config tab fails with a message about folders",
+                rows
+            );
+        }
+    }
+
+    #[test]
+    fn the_same_bad_row_is_refused_when_it_is_new() {
+        let stored = [path("/home/u/project", "project")];
+        for rows in legacy_rows() {
+            assert!(
+                validate_project_paths_update(&stored, &rows).is_err(),
+                "{:?} was introduced through update_project, which is the escalation the \
+                 validation exists to stop",
+                rows
+            );
+        }
+    }
+
+    /// The one rule no exemption reaches. `/workspace/../tmp/claude-x`
+    /// normalises to `/tmp/claude-x` — a path the pre-commit scrub owns and
+    /// empties as root — so a stored one is a live data-loss chain rather than
+    /// untidy data, and the Workspace section is one edit away.
+    #[test]
+    fn a_mount_that_leaves_workspace_is_refused_however_it_got_there() {
+        for escape in ["..", "../tmp/claude-x", "../../etc", "/tmp/claude-x", "a/../..", ".", "..\\x"] {
+            let rows = [path("/home/u/project", escape)];
+            assert!(
+                validate_project_paths_update(&rows, &rows).is_err(),
+                "mount name '{}' was grandfathered, so the C1 chain stays open for anyone who \
+                 already has it stored",
+                escape
+            );
+            assert!(validate_project_paths_update(&[], &rows).is_err());
+        }
+    }
+
+    #[test]
+    fn editing_a_grandfathered_row_holds_it_to_every_rule_again() {
+        let stored = [path("/", "everything")];
+        // Renaming the mount but keeping the root host path is a new row.
+        assert!(
+            validate_project_paths_update(&stored, &[path("/", "all")]).is_err(),
+            "an edited row was admitted on the strength of the row it replaced"
+        );
+        // Fixing the host path is what the message asks for, and it saves.
+        assert!(
+            validate_project_paths_update(&stored, &[path("/home/u/a", "everything")]).is_ok()
+        );
+        // Dropping the row entirely is always fine.
+        assert!(validate_project_paths_update(&stored, &[]).is_ok());
+    }
+
+    #[test]
+    fn a_stored_duplicate_may_be_kept_but_not_multiplied() {
+        let stored = [path("/home/u/a", "same"), path("/home/u/b", "same")];
+        assert!(validate_project_paths_update(&stored, &stored).is_ok());
+        // Order must not change the answer.
+        let reordered = [stored[1].clone(), stored[0].clone()];
+        assert!(validate_project_paths_update(&stored, &reordered).is_ok());
+        // A third row taking the same name is new, and refused.
+        let more = [
+            stored[0].clone(),
+            stored[1].clone(),
+            path("/home/u/c", "same"),
+        ];
+        assert!(validate_project_paths_update(&stored, &more).is_err());
+        // And a second copy of a name that was unique stays refused.
+        let unique = [path("/home/u/a", "a")];
+        assert!(validate_project_paths_update(
+            &unique,
+            &[path("/home/u/a", "a"), path("/home/u/b", "a")]
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn the_blank_placeholder_row_is_still_not_an_error_on_either_path() {
+        let stored = [path("/home/u/a", "a")];
+        let with_placeholder = [path("/home/u/a", "a"), path("", "")];
+        assert!(validate_project_paths(&with_placeholder).is_ok());
+        assert!(validate_project_paths_update(&stored, &with_placeholder).is_ok());
+    }
+
+    // ── The two host paths that had no check at all ───────────────────────
+
+    #[test]
+    fn a_filesystem_root_cannot_be_newly_set_as_an_ssh_or_ca_path() {
+        for root in ["/", "//", "\\", "C:\\", "c:/", "D:"] {
+            assert!(
+                validate_mounted_host_path("the SSH key folder", None, Some(root)).is_err(),
+                "'{}' was accepted as an SSH key path, which read-only bind-mounts the whole \
+                 host filesystem at /tmp/.host-ssh",
+                root
+            );
+            assert!(
+                validate_mounted_host_path("the CA certificate path", Some("/etc/ssl"), Some(root))
+                    .is_err(),
+                "'{}' was accepted as a CA certificate path",
+                root
+            );
+        }
+        // A real folder, a cleared value and an absent one are all fine.
+        assert!(validate_mounted_host_path("x", None, Some("/home/u/.ssh")).is_ok());
+        assert!(validate_mounted_host_path("x", Some("/home/u/.ssh"), None).is_ok());
+        assert!(validate_mounted_host_path("x", Some("/home/u/.ssh"), Some("")).is_ok());
+    }
+
+    #[test]
+    fn an_ssh_path_already_stored_does_not_brick_the_editor_either() {
+        // Nothing ever validated this field, so it can hold a root today — and
+        // it is mounted on every container start whether or not an unrelated
+        // Config save is allowed through.
+        assert!(validate_mounted_host_path("x", Some("/"), Some("/")).is_ok());
+        assert!(validate_mounted_host_path("x", Some("/"), Some(" / ")).is_ok());
+        // Changing it to a different root is a change, and refused.
+        assert!(validate_mounted_host_path("x", Some("/"), Some("C:\\")).is_err());
+    }
+}
diff --git a/app/src-tauri/src/commands/settings_commands.rs b/app/src-tauri/src/commands/settings_commands.rs
index 51d949a..5a8b0c6 100644
--- a/app/src-tauri/src/commands/settings_commands.rs
+++ b/app/src-tauri/src/commands/settings_commands.rs
@@ -16,6 +16,38 @@ pub async fn update_settings(
     state: State<'_, AppState>,
 ) -> Result<AppSettings, String> {
     let before = state.settings_store.get();
+
+    // The global half of the same rule the project half gets in
+    // `update_project`: a global custom env var is merged into every project's
+    // container environment, so an unchecked name here reaches all of them.
+    crate::models::validate_env_vars_update(
+        &before.global_custom_env_vars,
+        &settings.global_custom_env_vars,
+    )?;
+
+    // The same for the two host paths this struct owns. `update_project`
+    // validated its per-project overrides and this side validated nothing,
+    // which left the wider hole of the two: `default_ssh_key_path` is the
+    // fallback for **every** project without an override
+    // (`container.rs`'s `create_container`), so `/` here read-only bind-mounts
+    // the whole host at `/tmp/.host-ssh` for all of them — and `entrypoint.sh`
+    // then does `cp -a /tmp/.host-ssh ~/.ssh`, recursively copying it into the
+    // home volume this release exists to bound.
+    //
+    // Grandfathered the same way project paths are: a value carried over
+    // unchanged still saves, so a store written before this check cannot lock
+    // the user out of their own settings.
+    crate::commands::project_commands::validate_mounted_host_path(
+        "SSH key path",
+        before.default_ssh_key_path.as_deref(),
+        settings.default_ssh_key_path.as_deref(),
+    )?;
+    crate::commands::project_commands::validate_mounted_host_path(
+        "CA certificate path",
+        before.ca_cert_path.as_deref(),
+        settings.ca_cert_path.as_deref(),
+    )?;
+
     let saved = state.settings_store.update(settings)?;
 
     // Persisting a setting is not the same as applying it. The gateway is the
diff --git a/app/src-tauri/src/commands/terminal_commands.rs b/app/src-tauri/src/commands/terminal_commands.rs
index 2e05bd8..f37ac2a 100644
--- a/app/src-tauri/src/commands/terminal_commands.rs
+++ b/app/src-tauri/src/commands/terminal_commands.rs
@@ -196,31 +196,64 @@ pub async fn upload_host_file_to_terminal(
     host_path: String,
     state: State<'_, AppState>,
 ) -> Result<String, String> {
+    // The drop target is a host path chosen by the webview, not by the OS drag
+    // itself, so it goes through `file_commands`' host-read policy: absolute,
+    // no traversal, and nothing whose path passes through a hidden directory
+    // (`~/.ssh`, `~/.aws`, `~/.local/bin`) or a system location — applied to
+    // the path with its symlinks already resolved, so a visible directory that
+    // *leads* to one of those is refused too. What comes back is that resolved
+    // path, and it is what gets opened. Four commands touch a host path now,
+    // but only two take it *over IPC*: this one and `download_container_backup`.
+    // The Files pane's `download_container_file` and `upload_files_to_container`
+    // open their dialog from Rust instead, so for them the policy above is
+    // defence in depth and for these two it is the boundary itself.
+    // The name is taken from the path the user actually dropped, *before*
+    // resolution. Deriving it from the resolved path renames the file behind
+    // the user's back: dropping `~/Downloads/latest.log`, where `latest.log` is
+    // a symlink, would land it in the container as `2026-08-23.log`.
+    let base = crate::commands::file_commands::host_upload_name(&host_path)?;
+    let host_path = crate::commands::file_commands::resolve_host_read_path(&host_path).await?;
+
     let container_id = state.exec_manager.get_container_id(&session_id).await?;
 
     let meta = tokio::fs::metadata(&host_path)
         .await
         .map_err(|e| format!("Cannot access {}: {}", host_path, e))?;
-    if meta.is_dir() {
-        return Err(format!("{} is a directory — drop individual files", host_path));
+    // `!is_file()`, not `!is_dir()`. A FIFO is neither a directory nor a
+    // regular file, reports `len() == 0`, and passes both the directory check
+    // and the size cap below — and `std::fs::File::open` on one blocks forever
+    // with no writer, with no timeout anywhere on this path. The upload then
+    // never returns, the toast sticks on "Adding N files…" for the session and
+    // the rest of the batch is abandoned. Sockets and device nodes are the same
+    // shape. This is one of two routes for getting a host file into a
+    // container (the Files pane's upload is the other), so it is the wrong
+    // place to be clever.
+    if !meta.is_file() {
+        return Err(if meta.is_dir() {
+            format!("{} is a directory — drop individual files", host_path)
+        } else {
+            format!(
+                "{} is not a regular file — only ordinary files can be dropped into a terminal",
+                host_path
+            )
+        });
     }
 
     // Guard against ballooning host RAM: the file is packed into an in-memory
-    // tar before upload, so cap the size of a dropped file.
-    const MAX_DROP_BYTES: u64 = 256 * 1024 * 1024; // 256 MiB
+    // tar before upload, so cap the size of a dropped file. The ceiling lives
+    // with the code that does the reading, which re-applies it to the open
+    // descriptor — this check is here only so the refusal reads like a sentence
+    // instead of arriving after a 300 MB read.
+    use crate::docker::exec::MAX_DROP_BYTES;
     if meta.len() > MAX_DROP_BYTES {
         return Err(format!(
-            "File too large to drop into the terminal ({:.0} MB; limit {} MB). Mount it into the project or use the Files panel instead.",
+            "File too large to drop into the terminal ({:.0} MB; limit {} MB). Mount it into the project instead.",
             meta.len() as f64 / (1024.0 * 1024.0),
             MAX_DROP_BYTES / (1024 * 1024)
         ));
     }
 
-    let base = std::path::Path::new(&host_path)
-        .file_name()
-        .map(|s| s.to_string_lossy().to_string())
-        .filter(|s| !s.is_empty())
-        .unwrap_or_else(|| "dropped-file".to_string());
+
 
     // Ensure the destination directory exists rather than relying on Docker's
     // archive extractor to create the parent for the uploaded tar entry.
@@ -231,7 +264,13 @@ pub async fn upload_host_file_to_terminal(
     .await?;
 
     let file_name = format!("triple-c-drops/{}", base);
-    crate::docker::exec::upload_host_file_to_container(&container_id, &host_path, &file_name).await
+    crate::docker::exec::upload_host_file_to_container(
+        &container_id,
+        &host_path,
+        "/tmp",
+        &file_name,
+    )
+    .await
 }
 
 #[tauri::command]
@@ -283,3 +322,37 @@ pub async fn stop_audio_bridge(
     state.exec_manager.close_session(&audio_session_id).await;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    /// A dropped file must be named the way the *user* named it.
+    ///
+    /// The bug this pins: `upload_host_file_to_terminal` derived the tar entry
+    /// name from the path *after* symlink resolution, so dropping
+    /// `~/Downloads/latest.log` — where `latest.log` is a symlink to
+    /// `2026-08-23.log` — silently landed the file in the container under the
+    /// target's name. Nothing errored; the user just got a name they never
+    /// typed.
+    ///
+    /// This asserts the shared helper's contract from the terminal side: the
+    /// answer comes from the spelling, and a path that does not name a file is
+    /// refused rather than silently substituted (it used to fall back to
+    /// `"dropped-file"`).
+    #[test]
+    fn a_dropped_file_keeps_the_name_the_user_dropped() {
+        use crate::commands::file_commands::host_upload_name;
+
+        assert_eq!(
+            host_upload_name("/home/u/Downloads/latest.log").unwrap(),
+            "latest.log"
+        );
+        assert!(
+            host_upload_name("/home/u/Downloads/").is_err(),
+            "a directory is not a file to drop"
+        );
+        assert!(
+            host_upload_name("/home/u/..").is_err(),
+            "the name becomes a tar entry, a container path and an argv element"
+        );
+    }
+}
diff --git a/app/src-tauri/src/docker/container.rs b/app/src-tauri/src/docker/container.rs
index f4ca0c0..01950bd 100644
--- a/app/src-tauri/src/docker/container.rs
+++ b/app/src-tauri/src/docker/container.rs
@@ -216,7 +216,17 @@ pub const SECRET_ENV_KEYS: &[&str] = &[
 /// `docker commit` copies a container's labels onto the image, every snapshot it
 /// commits. [`sweep_orphaned_snapshots`] treats it as the mark of provenance,
 /// which is what keeps the sweep away from the user's own images.
-const LABEL_MANAGED: &str = "triple-c.managed";
+pub(crate) const LABEL_MANAGED: &str = "triple-c.managed";
+/// Marks the throwaway container [`rewrite_image_without_secrets`] commits
+/// from. It exists so the Disk panel's reclaim bucket can distinguish a live
+/// credential rewrite from a leftover by label rather than by age.
+pub(crate) const LABEL_SCRUB: &str = "triple-c.scrub";
+
+/// Marks the image built from `container/Dockerfile` itself, as opposed to a
+/// project snapshot committed from a container. Only ever `"true"` on a base
+/// image; `create_container` writes it explicitly empty so an inherited value
+/// cannot travel onto a snapshot. See the `LABEL` block in the Dockerfile.
+pub(crate) const LABEL_BASE: &str = "triple-c.base";
 
 const RESERVED_ENV_PREFIXES: &[&str] = &["ANTHROPIC_", "AWS_", "GIT_", "HOST_", "TRIPLE_C_"];
 
@@ -232,9 +242,19 @@ const RESERVED_ENV_EXACT: &[&str] = &[
     "CLAUDE_INSTRUCTIONS",
     "MCP_SERVERS_JSON",
     "CLAUDE_CODE_SETTINGS_JSON",
+    "CLAUDE_CODE_SETTINGS_CLEAR",
     "MISSION_CONTROL_ENABLED",
     "VPN_SUPPORT_ENABLED",
     "TRIPLE_C_PERMISSION_MODE",
+    // The four env vars the Claude Code settings editor drives. Reserved for
+    // the `VPN_SUPPORT_ENABLED` reason: each is now written on every create,
+    // including its off value, so a hand-set custom var of the same name would
+    // either be overridden without explanation or override the setting behind
+    // the UI's back, depending on which one Docker kept.
+    "CLAUDE_CODE_NO_FLICKER",
+    "CLAUDE_CODE_ENABLE_AWAY_SUMMARY",
+    "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB",
+    "ENABLE_PROMPT_CACHING_1H",
     CLAUDE_OAUTH_TOKEN_ENV,
     // The model-alias vars are already covered by the `ANTHROPIC_` prefix
     // above; they are listed explicitly so that a future narrowing of the
@@ -615,8 +635,14 @@ fn compute_ports_fingerprint(port_mappings: &[PortMapping]) -> String {
     sha256_hex(&joined)
 }
 
-/// Merge global and per-project ClaudeCodeSettings.
-/// Per-project fields override global fields when set (non-default).
+/// Merge global and per-project `ClaudeCodeSettings`.
+///
+/// A project field that is `Some` wins outright — **including `Some(false)`**.
+/// That is the point of the widening: these used to be plain `bool`s ORed
+/// together (`if p.x { true } else { g.x }`), so a project could only ever add
+/// to the global set and never turn a globally-enabled setting off. `None` at
+/// project level means "inherit", which is now a state the project can
+/// actually be in rather than the only state an off switch could produce.
 fn merge_claude_code_settings(
     global: Option<&ClaudeCodeSettings>,
     project: Option<&ClaudeCodeSettings>,
@@ -626,16 +652,15 @@ fn merge_claude_code_settings(
         (Some(g), None) => Some(g.clone()),
         (None, Some(p)) => Some(p.clone()),
         (Some(g), Some(p)) => {
-            // Project overrides global for each field when the project value is non-default
             Some(ClaudeCodeSettings {
                 tui_mode: p.tui_mode.clone().or_else(|| g.tui_mode.clone()),
                 effort: p.effort.clone().or_else(|| g.effort.clone()),
-                auto_scroll_disabled: if p.auto_scroll_disabled { true } else { g.auto_scroll_disabled },
-                focus_mode: if p.focus_mode { true } else { g.focus_mode },
-                show_thinking_summaries: if p.show_thinking_summaries { true } else { g.show_thinking_summaries },
-                enable_session_recap: if p.enable_session_recap { true } else { g.enable_session_recap },
-                env_scrub: if p.env_scrub { true } else { g.env_scrub },
-                prompt_caching_1h: if p.prompt_caching_1h { true } else { g.prompt_caching_1h },
+                auto_scroll_disabled: p.auto_scroll_disabled.or(g.auto_scroll_disabled),
+                focus_mode: p.focus_mode.or(g.focus_mode),
+                show_thinking_summaries: p.show_thinking_summaries.or(g.show_thinking_summaries),
+                session_recap_disabled: p.session_recap_disabled.or(g.session_recap_disabled),
+                env_scrub: p.env_scrub.or(g.env_scrub),
+                prompt_caching_1h: p.prompt_caching_1h.or(g.prompt_caching_1h),
             })
         }
     }
@@ -643,10 +668,23 @@ fn merge_claude_code_settings(
 
 /// Compute a fingerprint for the Claude Code settings so we can detect changes.
 /// The `sandbox_enabled` flag is included so that toggling sandbox mode forces
-/// a container recreation (re-injecting the merged settings.json). When
-/// sandbox is off the historical fingerprint is preserved unchanged so that
-/// upgrading triple-c does not spuriously flag every existing container for
-/// recreation.
+/// a container recreation (re-injecting the merged settings.json).
+///
+/// **This formula changed, and the change is not free.** It used to read
+/// `format!("{}", bool)`; the booleans are now `Option<bool>` and it reads
+/// `format!("{:?}")`, because `None` (inherit) and `Some(false)` (a deliberate
+/// off) must not hash alike — conflating them leaves a container un-recreated
+/// on a real change. The consequence is that **every existing project holding
+/// a settings object gets a different fingerprint on first launch after this
+/// upgrade, and is recreated once.** A recreation commits a snapshot layer, so
+/// that is a one-off disk cost per project, paid silently.
+///
+/// An earlier version of this comment claimed the opposite — that "the
+/// historical fingerprint is preserved unchanged so that upgrading triple-c
+/// does not spuriously flag every existing container for recreation." That was
+/// carried over from before the widening and was false the moment the format
+/// string changed. It is recorded here because a reviewer who believed it would
+/// conclude the churn cannot happen.
 fn compute_claude_code_settings_fingerprint(
     settings: Option<&ClaudeCodeSettings>,
     sandbox_enabled: bool,
@@ -657,12 +695,16 @@ fn compute_claude_code_settings_fingerprint(
             let parts = vec![
                 s.tui_mode.as_deref().unwrap_or("").to_string(),
                 s.effort.as_deref().unwrap_or("").to_string(),
-                format!("{}", s.auto_scroll_disabled),
-                format!("{}", s.focus_mode),
-                format!("{}", s.show_thinking_summaries),
-                format!("{}", s.enable_session_recap),
-                format!("{}", s.env_scrub),
-                format!("{}", s.prompt_caching_1h),
+                // `{:?}` rather than `{}` so `None` and `Some(false)` produce
+                // different text. They mean different things — inherit versus a
+                // deliberate off — and a fingerprint that conflated them would
+                // leave the container un-recreated on a real change.
+                format!("{:?}", s.auto_scroll_disabled),
+                format!("{:?}", s.focus_mode),
+                format!("{:?}", s.show_thinking_summaries),
+                format!("{:?}", s.session_recap_disabled),
+                format!("{:?}", s.env_scrub),
+                format!("{:?}", s.prompt_caching_1h),
             ];
             sha256_hex(&parts.join("|"))
         }
@@ -674,34 +716,164 @@ fn compute_claude_code_settings_fingerprint(
     }
 }
 
-/// Build the settings.json content for Claude Code.
-/// Returns a JSON string of the settings to be written to ~/.claude/settings.json.
-/// Always emits a `sandbox.enabled` key reflecting the current per-project
-/// toggle so that flipping it off in triple-c overrides any prior on-state
-/// stored in the persisted settings.json (which lives in a named volume).
+/// The four Claude Code env vars the settings editor drives, as `KEY=VALUE`.
+///
+/// **All four are emitted on every create, including their off value.** This is
+/// the `MANAGED_AUTH_KEYS` rule: `docker commit` bakes a container's env into
+/// the snapshot image, and the next container inherits anything the create does
+/// not override. A `=1` written once would ride that snapshot into every future
+/// container and make the switch impossible to turn back off — the same
+/// stickiness [`build_claude_code_settings_json`] fixes on the settings.json
+/// side, in a place where it is even less visible.
+///
+/// Two of them use an **empty** value for "off", and the distinction matters:
+///
+/// * `CLAUDE_CODE_NO_FLICKER` documents `1` as fullscreen-on and `0` as
+///   fullscreen-*off*, and it overrides the `tui` setting. `0` is therefore not
+///   neutral — it would silently pin every project that has expressed no
+///   preference to the classic renderer, when an unset `tui` is supposed to let
+///   Claude Code choose. Empty is neither value, so it reads as unset while
+///   still overriding a baked `1`.
+/// * `CLAUDE_CODE_ENABLE_AWAY_SUMMARY` outranks both `awaySummaryEnabled` and
+///   the in-container `/config` toggle. `0` is exactly right for "the user
+///   turned the recap off in Triple-C", but a blanket `1` for the default state
+///   would force the recap back on for someone who had turned it off with
+///   `/config` inside their own container. Triple-C's default must not overrule
+///   a choice it never asked about.
+///
+/// The other two are documented as "set to `1` to …" with no meaning attached
+/// to `0`, so `0` is unambiguously neutral and is stated outright.
+fn claude_code_env_vars(settings: Option<&ClaudeCodeSettings>) -> Vec<String> {
+    let owned;
+    let s = match settings {
+        Some(s) => s,
+        None => {
+            owned = ClaudeCodeSettings::default();
+            &owned
+        }
+    };
+
+    vec![
+        format!(
+            "CLAUDE_CODE_NO_FLICKER={}",
+            match s.tui_mode.as_deref() {
+                Some("fullscreen") => "1",
+                Some("default") => "0",
+                _ => "",
+            }
+        ),
+        format!(
+            "CLAUDE_CODE_ENABLE_AWAY_SUMMARY={}",
+            if s.session_recap_disabled.unwrap_or(false) { "0" } else { "" }
+        ),
+        format!(
+            "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB={}",
+            if s.env_scrub.unwrap_or(false) { "1" } else { "0" }
+        ),
+        format!(
+            "ENABLE_PROMPT_CACHING_1H={}",
+            if s.prompt_caching_1h.unwrap_or(false) { "1" } else { "0" }
+        ),
+    ]
+}
+
+/// Build the settings.json payload for Claude Code, handed to the container as
+/// `CLAUDE_CODE_SETTINGS_JSON` and applied by `entrypoint.sh`.
+///
+/// ## Every managed key is always present, and `null` means "delete"
+///
+/// The settings file lives on `triple-c-claude-config-{projectId}`, a named
+/// volume that outlives the container, and the entrypoint *merges* into it. So
+/// a key emitted only when it is non-default can be written once and never
+/// taken back: turning the setting off simply omits the key, the merge
+/// preserves whatever was there, and the setting stays on forever. Only a
+/// destructive Reset — which also deletes the OAuth login, skills and
+/// transcripts — ever cleared it. Four of the six keys here were sticky that
+/// way; the `sandbox` block already carried the workaround and the comment
+/// explaining it, and this is the same treatment applied to the rest.
+///
+/// Two shapes of "off" are needed, because Claude Code's own defaults differ:
+///
+/// * **A boolean with a documented default** (`autoScrollEnabled` is `true`,
+///   `showThinkingSummaries` is `false`) is emitted with that neutral value.
+/// * **A key whose neutral state is *unset*** (`tui`, `effortLevel`,
+///   `viewMode`, `awaySummaryEnabled`) is emitted as JSON `null`, and the
+///   entrypoint deletes rather than merges those. Writing a stand-in value
+///   would not be neutral: an unset `tui` lets Claude Code choose the renderer
+///   (`"default"` pins the classic one), and an unset `viewMode` lets the
+///   user's own sticky `/focus` choice and `verbose` setting apply
+///   (`"default"` overrides both).
+///
+/// Returns a `String` rather than an `Option<String>`: there is no longer any
+/// input for which this produces nothing to say.
 fn build_claude_code_settings_json(
     settings: Option<&ClaudeCodeSettings>,
     sandbox_enabled: bool,
-) -> Option<String> {
+) -> String {
+    let owned;
+    let s = match settings {
+        Some(s) => s,
+        // No struct at all is not "say nothing" — it is "every setting is at
+        // its default", which still has to be asserted over a stale file.
+        None => {
+            owned = ClaudeCodeSettings::default();
+            &owned
+        }
+    };
+
     let mut map = serde_json::Map::new();
 
-    if let Some(s) = settings {
-        if let Some(ref tui) = s.tui_mode {
-            map.insert("tui".to_string(), serde_json::json!(tui));
-        }
-        if let Some(ref effort) = s.effort {
-            map.insert("effort".to_string(), serde_json::json!(effort));
-        }
-        if s.auto_scroll_disabled {
-            map.insert("autoScrollEnabled".to_string(), serde_json::json!(false));
-        }
-        if s.focus_mode {
-            map.insert("focusMode".to_string(), serde_json::json!(true));
-        }
-        if s.show_thinking_summaries {
-            map.insert("showThinkingSummaries".to_string(), serde_json::json!(true));
-        }
-    }
+    // `null` clears; see the module doc above.
+    map.insert(
+        "tui".to_string(),
+        match s.tui_mode {
+            Some(ref tui) => serde_json::json!(tui),
+            None => serde_json::Value::Null,
+        },
+    );
+    // `effortLevel`, not `effort`. Claude Code has never read a key called
+    // `effort`, so the previous value was written and silently ignored.
+    map.insert(
+        "effortLevel".to_string(),
+        match s.effort {
+            Some(ref effort) => serde_json::json!(effort),
+            None => serde_json::Value::Null,
+        },
+    );
+    // Documented default `true`, so the neutral value is a value.
+    map.insert(
+        "autoScrollEnabled".to_string(),
+        serde_json::json!(!s.auto_scroll_disabled.unwrap_or(false)),
+    );
+    // Documented default `false`.
+    map.insert(
+        "showThinkingSummaries".to_string(),
+        serde_json::json!(s.show_thinking_summaries.unwrap_or(false)),
+    );
+    // `viewMode: "focus"` is the real setting behind what the UI calls focus
+    // mode — "collapses tool output to one-line summaries" is that key's
+    // documented behaviour. The `focusMode` key it replaces was invented and
+    // did nothing.
+    map.insert(
+        "viewMode".to_string(),
+        if s.focus_mode.unwrap_or(false) {
+            serde_json::json!("focus")
+        } else {
+            serde_json::Value::Null
+        },
+    );
+    // The recap is on by default, so only the *off* case has anything to write.
+    // `CLAUDE_CODE_ENABLE_AWAY_SUMMARY` (set unconditionally at creation) takes
+    // precedence over this key and is what actually enforces the choice; this
+    // is here so the container's settings.json does not contradict it.
+    map.insert(
+        "awaySummaryEnabled".to_string(),
+        if s.session_recap_disabled.unwrap_or(false) {
+            serde_json::json!(false)
+        } else {
+            serde_json::Value::Null
+        },
+    );
 
     // Always emit `sandbox.enabled` so that toggling the per-project sandbox
     // off in triple-c clears any prior on-state in the persisted
@@ -719,11 +891,49 @@ fn build_claude_code_settings_json(
     };
     map.insert("sandbox".to_string(), sandbox_obj);
 
-    if map.is_empty() {
-        None
-    } else {
-        Some(serde_json::Value::Object(map).to_string())
+    serde_json::Value::Object(map).to_string()
+}
+
+/// Split the managed payload into the half that is safe to merge anywhere and
+/// the list of keys to delete.
+///
+/// The null-means-delete convention is only understood by the `entrypoint.sh`
+/// shipped alongside this code — and an existing project recreates from *its
+/// own snapshot image*, which carries whatever entrypoint it was built with. An
+/// older one merges with a plain `.[0] * .[1]`, which would write the literal
+/// `null`s straight into the user's `settings.json` rather than clearing the
+/// keys. A settings file Claude Code then rejects would take the user's own
+/// `model`, `statusLine` and everything else in it down with it.
+///
+/// So the nulls never leave Rust. `CLAUDE_CODE_SETTINGS_JSON` carries only real
+/// values and stays safe under either merge; `CLAUDE_CODE_SETTINGS_CLEAR`
+/// carries the key names to delete and is simply ignored by an entrypoint that
+/// predates it. Such a project keeps the old sticky behaviour until it is
+/// migrated or Reset — which is the pre-existing state, not a regression.
+pub(crate) fn split_claude_code_settings_payload(payload: &str) -> (String, String) {
+    let parsed: serde_json::Value = match serde_json::from_str(payload) {
+        Ok(v) => v,
+        // Not our business to fix; hand it through and let the merge fail loudly.
+        Err(_) => return (payload.to_string(), "[]".to_string()),
+    };
+    let Some(obj) = parsed.as_object() else {
+        return (payload.to_string(), "[]".to_string());
+    };
+
+    let mut set = serde_json::Map::new();
+    let mut clear: Vec<serde_json::Value> = Vec::new();
+    for (k, v) in obj {
+        if v.is_null() {
+            clear.push(serde_json::json!(k));
+        } else {
+            set.insert(k.clone(), v.clone());
+        }
     }
+
+    (
+        serde_json::Value::Object(set).to_string(),
+        serde_json::Value::Array(clear).to_string(),
+    )
 }
 
 pub async fn find_existing_container(project: &Project) -> Result<Option<String>, String> {
@@ -921,6 +1131,64 @@ fn explain_container_failure(action: &str, err: &str) -> String {
     format!("Failed to {} container: {}", action, err)
 }
 
+/// One bind mount per stored project path, skipping the rows that cannot
+/// produce a usable one.
+///
+/// Both halves of the filter are about data that is **already on disk**, which
+/// is why this is a silent skip and not a validation error. `project_commands`
+/// now refuses an empty `mount_name` or `host_path` on save, and the Workspace
+/// pane can no longer send a half-filled row — but neither of those reaches a
+/// record written before they existed, and the two failures such a record
+/// causes are not equally visible:
+///
+/// * An empty `host_path` becomes `{"Target":"/workspace/x","Source":""}`, and
+///   the daemon answers `invalid mount config for type "bind": field Source
+///   must not be empty` for the whole create. The project cannot be started or
+///   recreated at all — it is bricked, and it stays bricked however carefully
+///   the next save is validated. Skipping the row lets it start again, minus a
+///   mount that was never going to work.
+/// * An empty `mount_name` targets `/workspace/` itself, mounting the row's
+///   host directory *over* the workspace volume. The daemon then creates the
+///   other rows' mount points inside the user's real folder, which is a
+///   directory tree appearing in their project from nowhere.
+///
+/// Failing louder is the wrong instinct here: the loud version is the one that
+/// already happened, and it took the project down with it. See
+/// `project_commands.rs`'s `check_mount_name_stays_under_workspace` for the
+/// save-time half — deliberately still tolerant of an empty name there, since
+/// refusing it would re-brick every project holding a legacy row.
+fn project_path_mounts(paths: &[crate::models::project::ProjectPath]) -> Vec<Mount> {
+    paths
+        .iter()
+        // Trimmed, because a name of `" "` targets `/workspace/ ` and a source
+        // of `" "` is a path the daemon will happily create at the filesystem
+        // root — neither is what anyone typed on purpose.
+        .filter(|pp| {
+            let keep = !pp.mount_name.trim().is_empty() && !pp.host_path.trim().is_empty();
+            if !keep {
+                // Silence here means a folder the user configured simply does
+                // not appear in the container, with no error and no toast.
+                // Skipping is still right — the alternative is a project that
+                // cannot start — but it should leave a trace.
+                log::warn!(
+                    "Skipping an unmountable project path row (host_path={:?}, mount_name={:?}): \
+                     both are required. The project will start without it.",
+                    pp.host_path,
+                    pp.mount_name
+                );
+            }
+            keep
+        })
+        .map(|pp| Mount {
+            target: Some(format!("/workspace/{}", pp.mount_name)),
+            source: Some(pp.host_path.clone()),
+            typ: Some(MountTypeEnum::BIND),
+            read_only: Some(false),
+            ..Default::default()
+        })
+        .collect()
+}
+
 pub async fn create_container(
     project: &Project,
     docker_socket_path: &str,
@@ -1320,51 +1588,36 @@ pub async fn create_container(
         global_claude_code_settings,
         project.claude_code_settings.as_ref(),
     );
-    if let Some(ref cc) = merged_cc_settings {
-        // Env-var-based settings (these are read directly by Claude Code)
-        if cc.tui_mode.as_deref() == Some("fullscreen") {
-            env_vars.push("CLAUDE_CODE_NO_FLICKER=1".to_string());
-        }
-        if cc.enable_session_recap {
-            env_vars.push("CLAUDE_CODE_ENABLE_AWAY_SUMMARY=1".to_string());
-        }
-        if cc.env_scrub {
-            env_vars.push("CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1".to_string());
-        }
-        if cc.prompt_caching_1h {
-            env_vars.push("ENABLE_PROMPT_CACHING_1H=1".to_string());
-        }
-    }
+    // Env-var-based settings, read directly by Claude Code. Extracted and unit
+    // tested for the `vpn_host_config` reason: a container is created once, by
+    // a very long function, and a variable emitted with the wrong value here is
+    // invisible until someone wonders why a switch does nothing.
+    env_vars.extend(claude_code_env_vars(merged_cc_settings.as_ref()));
 
-    // settings.json-based settings (written by the entrypoint).
-    // Always invoked so per-project sandbox state is injected even when no
-    // ClaudeCodeSettings struct is present.
-    if let Some(settings_json) = build_claude_code_settings_json(
-        merged_cc_settings.as_ref(),
-        project.sandbox_mode_enabled,
-    ) {
-        env_vars.push(format!("CLAUDE_CODE_SETTINGS_JSON={}", settings_json));
-    }
+    // settings.json-based settings (applied by the entrypoint). Always emitted,
+    // even with no `ClaudeCodeSettings` struct present: the payload asserts the
+    // *whole* managed key set, so "no settings" still has to be stated over a
+    // settings.json left behind on the config volume by a previous config.
+    // Split so the payload is safe under an older entrypoint that has never
+    // heard of the null-means-delete convention — see
+    // `split_claude_code_settings_payload`.
+    let (cc_settings_set, cc_settings_clear) = split_claude_code_settings_payload(
+        &build_claude_code_settings_json(merged_cc_settings.as_ref(), project.sandbox_mode_enabled),
+    );
+    env_vars.push(format!("CLAUDE_CODE_SETTINGS_JSON={}", cc_settings_set));
+    env_vars.push(format!("CLAUDE_CODE_SETTINGS_CLEAR={}", cc_settings_clear));
 
     let mut mounts: Vec<Mount> = Vec::new();
 
     // Project directories -> /workspace/{mount_name}
-    for pp in &project.paths {
-        mounts.push(Mount {
-            target: Some(format!("/workspace/{}", pp.mount_name)),
-            source: Some(pp.host_path.clone()),
-            typ: Some(MountTypeEnum::BIND),
-            read_only: Some(false),
-            ..Default::default()
-        });
-    }
+    mounts.extend(project_path_mounts(&project.paths));
 
     // Named volume for the entire home directory — preserves ~/.claude.json,
     // ~/.local (pip/npm globals), and any other user-level state across
     // container stop/start cycles.
     mounts.push(Mount {
         target: Some("/home/claude".to_string()),
-        source: Some(format!("triple-c-home-{}", project.id)),
+        source: Some(home_volume_name(&project.id)),
         typ: Some(MountTypeEnum::VOLUME),
         read_only: Some(false),
         ..Default::default()
@@ -1374,7 +1627,7 @@ pub async fn create_container(
     // inside the home volume; Docker gives the more-specific mount precedence.
     mounts.push(Mount {
         target: Some("/home/claude/.claude".to_string()),
-        source: Some(format!("triple-c-claude-config-{}", project.id)),
+        source: Some(config_volume_name(&project.id)),
         typ: Some(MountTypeEnum::VOLUME),
         read_only: Some(false),
         ..Default::default()
@@ -1571,6 +1824,14 @@ pub async fn create_container(
     // always meant to do.
     labels.insert("triple-c.mcp-fingerprint".to_string(), String::new());
 
+    // Same defence, for the label `container/Dockerfile` now stamps on the base
+    // image. Docker merges an image's labels into the container it creates, and
+    // `docker commit` copies the container's labels onto the snapshot — so
+    // without this line every project snapshot would inherit
+    // `triple-c.base=true` from the base it descends from and claim to *be* a
+    // base image. Writing it explicitly empty overrides the inherited value.
+    labels.insert(LABEL_BASE.to_string(), String::new());
+
     for (key, value) in extras.extra_labels {
         labels.insert((*key).to_string(), (*value).to_string());
     }
@@ -1581,6 +1842,7 @@ pub async fn create_container(
         mounts: Some(mounts),
         port_bindings: if port_bindings.is_empty() { None } else { Some(port_bindings) },
         init: Some(true),
+        log_config: Some(capped_log_config()),
         cap_add,
         devices,
         sysctls,
@@ -1618,6 +1880,36 @@ pub async fn create_container(
     Ok(response.id)
 }
 
+/// The rotation policy every Triple-C container is created with.
+///
+/// Without this a container inherits the daemon's `json-file` default, which
+/// has **no size limit at all** — `docker logs` for a container that has been
+/// up for weeks is a single file that grows until the disk does not have room
+/// for it. Triple-C containers are long-lived by design (stop/start, not
+/// create/destroy), and the entrypoint plus anything a session leaves running
+/// on stdout all land in that one file.
+///
+/// 10 MiB × 3 keeps roughly the last 30 MiB, which is far more scrollback than
+/// anything reads, and bounds the worst case at 30 MiB per project instead of
+/// unbounded.
+///
+/// **Deliberately not part of `container_needs_recreation`.** That check is
+/// label-based, so participating would mean a new `triple-c.*` label whose only
+/// effect is to recreate every existing project once — and a recreation costs a
+/// `docker commit`, i.e. a permanent multi-gigabyte layer, which is the very
+/// thing this whole change set exists to avoid. Containers pick the policy up
+/// on their next natural recreation instead; an existing container keeps its
+/// unbounded log until then, which is exactly the status quo.
+fn capped_log_config() -> bollard::models::HostConfigLogConfig {
+    bollard::models::HostConfigLogConfig {
+        typ: Some("json-file".to_string()),
+        config: Some(HashMap::from([
+            ("max-size".to_string(), "10m".to_string()),
+            ("max-file".to_string(), "3".to_string()),
+        ])),
+    }
+}
+
 pub async fn start_container(container_id: &str) -> Result<(), String> {
     let docker = get_docker()?;
     docker
@@ -1661,6 +1953,29 @@ pub fn get_snapshot_image_name(project: &Project) -> String {
     format!("triple-c-snapshot-{}:latest", project.id)
 }
 
+/// Name of the named volume mounted at `/home/claude`.
+///
+/// Takes the id rather than the `Project` because the disk view runs this
+/// mapping backwards: it reads volume names off the daemon and has to decide
+/// which project — if any — each one belongs to. See [`HOME_VOLUME_PREFIX`].
+pub fn home_volume_name(project_id: &str) -> String {
+    format!("{}{}", HOME_VOLUME_PREFIX, project_id)
+}
+
+/// Name of the named volume mounted at `/home/claude/.claude`, nested inside
+/// the home volume. This is the one holding the OAuth credential, the plugins
+/// and every session transcript.
+pub fn config_volume_name(project_id: &str) -> String {
+    format!("{}{}", CONFIG_VOLUME_PREFIX, project_id)
+}
+
+/// Prefix of [`home_volume_name`]. Split out because orphan detection scans the
+/// daemon's volume list for these prefixes and strips them back to a project id.
+pub const HOME_VOLUME_PREFIX: &str = "triple-c-home-";
+
+/// Prefix of [`config_volume_name`]. See [`HOME_VOLUME_PREFIX`].
+pub const CONFIG_VOLUME_PREFIX: &str = "triple-c-claude-config-";
+
 /// Keep the container's `~/.aws/credentials` in sync with the project's Bedrock
 /// auth on every container start:
 ///   - **Bedrock + static credentials**: (re)write `~/.aws/credentials` from the
@@ -1768,6 +2083,876 @@ chmod 600 "$HOME/.aws/credentials""#;
     Ok(())
 }
 
+/// Paths deleted from a container's writable layer immediately before
+/// [`commit_container_snapshot`] runs.
+///
+/// ## Why this exists
+///
+/// Every recreation commits the container, and a commit **stacks a new layer**
+/// on top of the previous snapshot — it never rewrites one. Deleting a file
+/// after it has been committed does not give the bytes back; it writes a
+/// whiteout entry and the original bytes stay in the layer below, forever. One
+/// project was measured carrying 14 stacked commit layers and ~5.1 GB above its
+/// base image, and 24 different conditions trigger a recreation, so changing a
+/// single settings field costs a multi-gigabyte layer that nothing can reclaim.
+///
+/// The only moment the bytes are still free to drop is *before* the commit that
+/// captures them. Measured on one container's 4.48 GB pending writable layer:
+/// 3.0 GB of agent scratchpad under `/tmp/claude-*`, the drag-and-drop staging
+/// area (up to 256 MiB per dropped file, and nothing in the app ever removes
+/// one), one PNG per pasted image, and the apt lists/cache/logs left by every
+/// runtime `apt-get install` the browser-view installer and the Playwright
+/// healer run — none of which has an `apt-get clean` behind it.
+///
+/// ## Why a hardcoded list and not a heuristic
+///
+/// A snapshot is the user's system layer: their packages, their `/opt`, their
+/// `/var/lib/postgresql`. Nothing here may guess. Every entry is an absolute
+/// path anchored to a directory Triple-C or a package manager owns:
+///
+/// * `/workspace/{mount_name}` subtrees are **host bind mounts** — the user's
+///   real project directories. No entry may ever reach one, which is why no
+///   pattern here starts with `/workspace`.
+/// * The only bind mounts under `/tmp` are `/tmp/.host-ca` and `/tmp/.host-aws`
+///   (both read-only). A leading-dot name is not matched by a shell glob, and
+///   none of these patterns share their prefix.
+/// * The apt entries keep their parent directory and remove only its contents
+///   (`lists/*`, `archives/*.deb`, `apt/*`); `apt-get` is unhappy when the
+///   directories themselves are missing.
+///
+/// ## Why a safe-looking *pattern* is not enough (C1)
+///
+/// The list used to be the whole of the defence, and that was wrong. These
+/// patterns are expanded by `/bin/sh` inside the container running as **root**,
+/// and for an entry ending `/*` the parent is a *path component*: both the glob
+/// expansion and the `rm -rf` that follows resolve it. The agent in the
+/// container has passwordless sudo, so anything able to run
+/// `ln -s /workspace/myproject /var/log/apt` turns the next commit into a
+/// recursive delete of the user's real files **on the host**. That was
+/// reproduced end to end against a live container — a bind mount emptied by a
+/// scrub whose path list named no `/workspace` anywhere.
+///
+/// (The entries whose glob is in the last component are the benign case: there
+/// the *match* is the symlink, and `rm -rf -- link` unlinks the link and stops.
+/// The distinction is not one a reviewer should have to make per entry, so the
+/// script defends both alike.)
+///
+/// So these entries are only half the contract. The other half is
+/// [`snapshot_scrub_script`], which validates the parent directory — not
+/// reached through a symlink, not on another filesystem, inside
+/// [`SCRUB_CONTAINMENT_PREFIXES`] — before it deletes anything inside it. That
+/// is also why every entry here must keep its glob in the **final component**:
+/// the parent has to be literal for the script to be able to check it at all. A
+/// test enforces it.
+///
+/// A unit test also pins the list itself, because the blast radius of a wrong
+/// entry here is a user's data and the code that consumes it is a shell string.
+pub(crate) const SNAPSHOT_SCRUB_PATHS: &[&str] = &[
+    // Agent scratchpads. The user's global CLAUDE.md instructs every agent to
+    // put temporary files under a scratchpad directory in /tmp, so this is
+    // where a long-running project's writable layer actually goes.
+    //
+    // Not age-limited, and worth being explicit about why that is only *just*
+    // safe: the scrub runs as root against a container that is still running,
+    // so a live Claude Code session or a `triple-c-scheduler` task writing here
+    // has its scratchpad pulled out from under it mid-write. Both callers stop
+    // the container within a line or two — `start_project_container` in
+    // `project_commands.rs` stops and removes it, `migrate_project_to_base`
+    // stops it — so the process that would notice is about to be killed anyway.
+    // That is a property of those two call sites and not of this entry: a third
+    // caller scrubbing a container it means to keep running would be corrupting
+    // a live session, and would need to age-limit this the way the two below
+    // are.
+    "/tmp/claude-*",
+    // Files drag-dropped into a terminal, staged by
+    // `commands/terminal_commands.rs` at up to 256 MiB each, and one PNG per
+    // pasted image from the same module. Nothing else in the repo deletes
+    // either, so leaving them out of this list restores unbounded growth — but
+    // they are the user's *own* files, and often the only copy inside the
+    // container of something handed to the agent seconds ago by a path that is
+    // still sitting in the conversation. Scrubbing them unconditionally meant
+    // "drop a file, change any of the 24 settings that trigger a recreation,
+    // lose it silently". Both are therefore age-limited rather than removed —
+    // see [`SCRUB_MIN_AGE_DAYS`].
+    "/tmp/triple-c-drops/*",
+    "/tmp/clipboard_*.png",
+    // Runtime apt debris. `browser_view/install.rs` and
+    // `container/triple-c-playwright-heal` both run `apt-get install` inside a
+    // live container without an `apt-get clean` after it.
+    "/var/lib/apt/lists/*",
+    "/var/cache/apt/archives/*.deb",
+    "/var/log/apt/*",
+    "/var/log/dpkg.log",
+];
+
+/// Entries of [`SNAPSHOT_SCRUB_PATHS`] that are only deleted once a match's own
+/// mtime is older than the given number of days. Anything not named here is
+/// deleted whenever it is present.
+///
+/// Two weeks is chosen against the thing that goes wrong: a recreation can
+/// happen seconds after a drop, and no conversation is still quoting a path it
+/// was given a fortnight ago. It is a compromise, not a proof — the alternative
+/// of dropping these patterns entirely would be silent unbounded growth in a
+/// directory nothing else ever cleans.
+const SCRUB_MIN_AGE_DAYS: &[(&str, u32)] = &[
+    ("/tmp/triple-c-drops/*", 14),
+    ("/tmp/clipboard_*.png", 14),
+];
+
+/// The only directory trees [`snapshot_scrub_script`] will operate in, checked
+/// against the *resolved* parent directory at run time inside the container.
+///
+/// Deliberately **not** derived from [`SNAPSHOT_SCRUB_PATHS`]: it is the
+/// backstop for the case where that list is itself wrong. An entry added under
+/// `/workspace`, `/home/claude` or `/etc` fails this check and deletes nothing,
+/// however plausible it looked in review.
+const SCRUB_CONTAINMENT_PREFIXES: &[&str] = &["/tmp", "/var/log", "/var/lib/apt", "/var/cache/apt"];
+
+/// Marker the scrub script prints so the byte total can be read back out of the
+/// exec's interleaved stdout/stderr.
+const SCRUB_MARKER: &str = "###TRIPLE-C-SCRUBBED ";
+
+/// Marker the scrub script prints **instead of** [`SCRUB_MARKER`] when it
+/// cannot run at all, followed by what was missing.
+///
+/// H3: the script needs five external tools, the root filesystem's device id,
+/// and an `rm` that honours `--one-file-system` — seven prerequisites in all,
+/// and on a base image that has none of them where it looked it used to run its
+/// seven patterns, delete nothing, and print `###TRIPLE-C-SCRUBBED 0` — a
+/// number indistinguishable from an honest "there was nothing to take". A scrub
+/// that could not run must never read as one that ran, so it says so in a line
+/// the caller can tell apart, and prints no total at all.
+///
+/// Deliberately **not** a prefix of [`SCRUB_MARKER`] and not prefixed by it, so
+/// `parse_scrub_total` can never mistake one for the other.
+const SCRUB_UNAVAILABLE_MARKER: &str = "###TRIPLE-C-SCRUB-UNAVAILABLE ";
+
+/// The external tools [`snapshot_scrub_script`] probes for before it will
+/// delete anything, in the order the probe names them.
+///
+/// Named once rather than spelled into the script text, because
+/// [`parse_scrub_unavailable`] has to be able to tell a missing *tool* from the
+/// other two prerequisites — the root device id, and an `rm` that takes
+/// `--one-file-system` — so that the log line reads as a sentence rather than
+/// as a list with `root-device-id` wedged into it.
+const SCRUB_PREREQ_TOOLS: &[&str] = &["stat", "rm", "du", "cut", "find"];
+
+/// Environment the scrub exec sets explicitly, rather than inheriting.
+///
+/// The exec inherits the container's configured env, and a project's *custom*
+/// env vars are part of that: `is_reserved_env_key` reserves the `ANTHROPIC_`,
+/// `AWS_`, `GIT_`, `HOST_` and `TRIPLE_C_` families and a handful of exact
+/// names, none of which is `LD_PRELOAD`. So a custom env var naming a shared
+/// object inside the container's *persisted home volume* injects code into
+/// every tool the scrub runs — as **root**, since that is the user the exec is
+/// created as — and decides the answer to checks 3 and 4 without ever touching
+/// `PATH`. `docker commit` bakes env into the snapshot, so it rides along too.
+///
+/// Blanking them in the exec closes that without breaking anything: nothing
+/// legitimate preloads into `/bin/sh`, `stat`, `du`, `cut`, `find` or `rm`, and
+/// this env applies to the scrub exec **only** — a terminal session, which is a
+/// different exec, is untouched. Verified against Engine 29.7 that a
+/// `docker exec -e LD_PRELOAD=` overrides a container-level `LD_PRELOAD`.
+///
+/// `LD_LIBRARY_PATH` is here for the same reason as `LD_PRELOAD`: it is
+/// searched ahead of the cache for every `DT_NEEDED` library, so a planted
+/// `libselinux.so.1` is as good as a preload.
+///
+/// M2: [`SCRUB_BOOTSTRAP`] now starts the shell that runs the script under
+/// `env -i`, so none of these three reaches the script's own tools whatever
+/// this list says. They are kept because they still reach the *two processes
+/// in front of it* — the `/bin/sh` that runs the bootstrap and the `env` it
+/// calls — and an `env` with a preload in it is an `env` that can hand its
+/// child any environment it likes. Blanking here and emptying there are the
+/// same defence applied at the two points it has to hold at.
+const SCRUB_EXEC_ENV: &[&str] = &["LD_PRELOAD=", "LD_AUDIT=", "LD_LIBRARY_PATH="];
+
+/// The `/bin/sh -c` program that starts the real scrub, with
+/// [`snapshot_scrub_script`] passed to it as `$1` rather than spliced into it.
+///
+/// ## Why the script is not simply the exec's command (M2)
+///
+/// `docker exec` cannot *replace* a container's environment, only add to and
+/// override it — which is why [`SCRUB_EXEC_ENV`] works by naming keys. The env
+/// a project carries is therefore inherited by whatever shell the exec starts,
+/// and a shell reads more out of its environment than variables.
+///
+/// `bash` imports **functions** from the environment: an env var named
+/// `BASH_FUNC_stat%%` becomes a shell function called `stat`. Function lookup
+/// happens *before* `PATH` is ever consulted, so resetting `PATH` does not
+/// touch it, and `command -v` reports a function as found — so a planted
+/// function passes the prerequisite probe and then answers the containment
+/// checks. Measured against `bash` 5.2 on `ubuntu:24.04`, an environment
+/// carrying `BASH_FUNC_stat%%` had `stat -c %d` return a constant of its
+/// choosing while `command -v stat` said the tool was present.
+///
+/// Every in-shell answer to that was tried and measured, and each one is
+/// itself importable: `unset -f stat` is defeated by `BASH_FUNC_unset%%`,
+/// `command stat` by `BASH_FUNC_command%%`, and — this is what settles it —
+/// `[`, `test`, `pwd` and `cd` import just as readily, which is checks 0, 1
+/// and 2 of the containment guarantee, not merely the tools. There is no
+/// subset of the script that can be written in shell and still be trusted
+/// inside a shell that has already imported the attacker's functions.
+///
+/// So the script is not run by that shell. This bootstrap is, and everything
+/// it uses is either a reserved word (`case`, `esac`), a parameter expansion,
+/// or a command word containing a `/` — and `bash` refuses to import a
+/// function whose name contains a `/`, verified on the same image. It hands
+/// the script to a **second** `/bin/sh` started by `env -i`, which has no
+/// environment at all: no `BASH_FUNC_*`, no `LD_*`, no `ENV`/`BASH_ENV`, and
+/// no `PATH` but the one named here. The inner shell's builtins are its own
+/// again, and the script does not have to care what `/bin/sh` is.
+///
+/// Measured on an `ubuntu:24.04` with `/bin/sh -> bash`, a project env var of
+/// `BASH_FUNC_stat%%=() { echo 1; }` set on the container the way a custom env
+/// var is, and a named volume mounted **at** the match `/tmp/claude-x` — the
+/// position checks 3 and 4 exist for:
+///
+/// * `/bin/sh -c <script>`, which is what the exec used to be, emptied the
+///   volume and printed `###TRIPLE-C-SCRUBBED 306565`;
+/// * `/bin/sh -c <bootstrap> triple-c-scrub <script>` left the volume intact,
+///   reclaimed the real scratchpad beside it, and printed `65536`.
+///
+/// The same script, unchanged, in both runs.
+///
+/// `env` is not assumed to be usr-merged, for the reason spelled out under
+/// [`snapshot_scrub_script_under`]: `/usr/bin/env` first, `/bin/env` on a
+/// literal 127, which is the pair that covers `ubuntu`, `debian`, `alpine`,
+/// `busybox` and `node:*-slim` (checked). An image with neither runs nothing,
+/// prints no marker, and is reported as [`ScrubOutcome::Failed`] — loud, and
+/// preferable to falling back to a shell that would run the script in the
+/// environment this exists to keep away from it.
+///
+/// Passing the script as `$1` rather than interpolating it into a quoted inner
+/// command string is not a style choice: the script contains single quotes in
+/// every `scrub_in` call, and a nested quoting bug in a string that runs
+/// `rm -rf` as root is the whole class of defect this module keeps having.
+const SCRUB_BOOTSTRAP: &str = concat!(
+    r#"/usr/bin/env -i PATH=/usr/bin:/bin /bin/sh -c "$1"; "#,
+    r#"case $? in 127) /bin/env -i PATH=/usr/bin:/bin /bin/sh -c "$1" ;; esac"#,
+);
+
+/// The argv the scrub exec is created with: [`SCRUB_BOOTSTRAP`], then the
+/// `$0` a diagnostic would name the shell by, then the script itself as `$1`.
+fn scrub_exec_cmd(script: &str) -> Vec<String> {
+    vec![
+        "/bin/sh".to_string(),
+        "-c".to_string(),
+        SCRUB_BOOTSTRAP.to_string(),
+        "triple-c-scrub".to_string(),
+        script.to_string(),
+    ]
+}
+
+/// Split a [`SNAPSHOT_SCRUB_PATHS`] entry into the literal directory it is
+/// anchored to and the glob to expand inside it.
+///
+/// `None` for anything that is not an absolute path with a non-empty final
+/// component — which a test rules out, but the script generator must not have
+/// to trust that, since what it emits runs as root.
+fn split_scrub_pattern(pattern: &str) -> Option<(&str, &str)> {
+    let (dir, glob) = pattern.rsplit_once('/')?;
+    if !pattern.starts_with('/') || glob.is_empty() {
+        return None;
+    }
+    // A top-level entry such as `/dpkg.log` leaves an empty parent; anchor it.
+    Some((if dir.is_empty() { "/" } else { dir }, glob))
+}
+
+/// The `/bin/sh` program run inside the container to perform the scrub.
+///
+/// ## Never run the string this returns anywhere but inside a container
+///
+/// It is anchored at `/`, and its first pattern is `/tmp/claude-*`. A Triple-C
+/// development container keeps every agent's scratchpad — working files,
+/// backups of the very sources being edited, task output — under
+/// `/tmp/claude-<uid>/`, which that glob matches exactly. Running this as root
+/// on a development machine or in the dev container deletes all of it, reports
+/// a healthy byte total, and leaves nothing to say what happened.
+///
+/// Anything that wants to *exercise* the scrub outside a container must use
+/// [`snapshot_scrub_script_under`] with a freshly generated, uuid-named
+/// throwaway root, and that applies to negative controls too: a control that
+/// plants a symlink to show the vulnerable version follows it must point that
+/// symlink **inside the same throwaway root**, never at a path derived from
+/// the crate, the repository or the environment. The whole point of those
+/// controls is that they delete what they are aimed at.
+pub(crate) fn snapshot_scrub_script() -> String {
+    snapshot_scrub_script_under("")
+}
+
+/// [`snapshot_scrub_script`] with every absolute path re-anchored under `root`.
+///
+/// ## What the script does
+///
+/// One `scrub_in <pattern> <min-age-days, or `-`>` call per entry in
+/// [`SNAPSHOT_SCRUB_PATHS`], with the pattern single-quoted so it reaches the
+/// function unexpanded — unquoted, `/bin/sh` would expand the glob against the
+/// script's own working directory before `scrub_in` ever ran. The function
+/// splits it into parent and glob (`${1%/*}` / `${1##*/}`, which is why the
+/// glob must live in the final component), and expands the glob only once the
+/// working directory *is* the validated parent. Quoted everywhere it is used,
+/// so a filename containing whitespace stays one argument; an unmatched glob
+/// expands to itself and is skipped by the existence guard.
+///
+/// Passing the whole pattern rather than the two halves also keeps each entry
+/// readable verbatim in the generated script, so a test can assert the script
+/// names this list rather than a second forked copy of it.
+///
+/// ## The containment guarantee (C1)
+///
+/// `scrub_in` is the only place in the script that deletes anything, and it
+/// does so only after five checks. The first four are about the parent
+/// directory, in order:
+///
+/// 0. `cd -P` into the parent **first**. Everything after that is relative to
+///    the inode that gets validated, so re-pointing the *path* afterwards
+///    cannot redirect the `rm`. A working directory is the only TOCTOU-free
+///    handle `/bin/sh` offers.
+/// 1. `pwd -P` — the fully resolved path — must equal what was asked for.
+///    A symlinked component anywhere in the parent lands somewhere else, and
+///    this is what catches `ln -s /workspace/myproject /var/log/apt`.
+/// 2. The resolved path must be inside [`SCRUB_CONTAINMENT_PREFIXES`]. A
+///    symlink is not the only way to name the wrong directory; this refuses to
+///    operate outside the trees the scrub owns whatever the path list says.
+/// 3. It must be on the same filesystem as the root. Check 1 does not see a
+///    *bind mount*, which is not a symlink — but under `overlay2` a bind mount
+///    and a named volume each have a different `st_dev` from the overlay, and
+///    neither is part of the writable layer the commit is about to capture. So
+///    anything on another device is both dangerous to delete and pointless to.
+///
+/// The fifth is about each *match*, and it is the one the parent checks cannot
+/// stand in for:
+///
+/// 4. Every expansion of the glob must itself be on the root's filesystem, or
+///    it is skipped. Since the parent has already been proved to be, that is a
+///    "the match is not a mount point" test — the device of a directory differs
+///    from its parent's precisely when something is mounted on it.
+///
+///    **On `overlay2`, which is what these were measured against.** The overlay
+///    synthesises its own `st_dev`, so *every* mount into the container differs
+///    from it and checks 3 and 4 catch all of them. Under the `vfs` graph
+///    driver there is no overlay: the container root is a plain directory tree
+///    on the host filesystem, so a bind mount of a host directory that happens
+///    to live on that same filesystem reports the *same* `st_dev` and these two
+///    checks see nothing. Checks 1 and 2 — resolved path, and containment in
+///    [`SCRUB_CONTAINMENT_PREFIXES`] — are what still hold there, and they are
+///    why a `vfs` host is a narrower gap rather than an open one: the mount has
+///    to be planted inside `/tmp`, `/var/log`, `/var/lib/apt` or
+///    `/var/cache/apt` and match one of the seven globs to be reached at all.
+///    Do not describe the device test as a mount test without that
+///    qualification.
+///
+///    Checks 0–3 validate the *parent*, and `rm --one-file-system` compares
+///    against the device of **its own command-line argument** — so when the
+///    argument *is* the mount root, `rm` is inside the mount already and
+///    deletes everything under it. Verified in real containers against
+///    `docker run -v vol:/tmp/claude-x`: mounted at the parent (`/var/log/apt`)
+///    was refused, mounted one level below the match
+///    (`/tmp/claude-x/inner`) was refused **on the strength of the flag
+///    alone**, and mounted *as* the match (`/tmp/claude-x`) emptied the volume.
+///    That middle case is why the flag is a prerequisite rather than an
+///    option — see the section on M1 below. In production that mount is the
+///    user's own project directory, because a mount name of `../tmp/claude-x`
+///    reaches it: the daemon normalises the `/workspace/{mount_name}` target
+///    built at [`create_container`] straight back to `/tmp/claude-x`.
+///
+///    `stat` is not asked to dereference: a *symlinked* match reports the
+///    link's own device, so it still passes and `rm -rf -- link` unlinks it and
+///    stops — which is the behaviour the entries whose glob is in the last
+///    component have always relied on.
+///
+/// Inside the loop, an expansion carrying a path separator means the list has
+/// changed shape and is skipped, and `rm --one-file-system` refuses to recurse
+/// across a mount planted *below* a match — the one mount position none of the
+/// five checks above can see, because it is not the parent and it is not the
+/// match.
+///
+/// ## Why `--one-file-system` is a prerequisite and not an option (M1)
+///
+/// It used to be probed into a variable:
+///
+/// ```sh
+/// rmopt=;
+/// rm --one-file-system --help >/dev/null 2>&1 && rmopt=--one-file-system;
+/// rm -rf $rmopt -- "$p";
+/// ```
+///
+/// which fails **open**. `busybox`'s `rm` answers `unrecognized option
+/// '--one-file-system'` and exits 1 for that probe, so on any
+/// `ImageSource::Custom` busybox- or toybox-derived image `$rmopt` was empty
+/// and `rm -rf` ran as root with no cross-filesystem bound at all — and
+/// reported the result as a completed `Reclaimed(n)`.
+///
+/// Measured end to end, `busybox:latest` (BusyBox 1.38), a named volume
+/// mounted one level below the match at `/tmp/claude-x/inner`:
+///
+/// * the probed shape emptied the volume and printed
+///   `###TRIPLE-C-SCRUBBED 102423`;
+/// * this shape prints `###TRIPLE-C-SCRUB-UNAVAILABLE rm-one-file-system` and
+///   removes nothing at all.
+///
+/// And on `ubuntu:24.04` (GNU coreutils 9.4), same mount, to show the flag is
+/// honoured rather than merely accepted: with `--one-file-system` deleted from
+/// the one `rm` the volume was emptied and `306565` reported, with it the
+/// volume was untouched and the figure was `65536` — exactly the debris that
+/// really was next to the mount, so the byte accounting follows the flag too.
+///
+/// It is one of the seven prerequisites now, and an image without it is
+/// [`SCRUB_UNAVAILABLE_MARKER`] rather than a scrub that runs unguarded. That
+/// is a real cost — an Alpine or busybox base image stops being scrubbed and
+/// keeps its debris — and it is the cheaper of the two: declining costs disk,
+/// proceeding costs the mount.
+///
+/// The probe is `rm --one-file-system -f -- ''` rather than `--help`. It is
+/// the same question asked of the code path that matters — option parsing
+/// followed by an actual run — where `--help` only asks whether a usage
+/// message can be printed; and the empty operand is the one argument no
+/// filesystem can ever name, so a probe that *does* run cannot remove
+/// anything. `-f` makes the resulting `ENOENT` an exit of 0, on GNU
+/// `coreutils` and by POSIX both.
+///
+/// What it cannot check is that the flag is *honoured* rather than merely
+/// accepted; that needs a real mount, and it is covered by the container runs
+/// recorded above rather than by the probe.
+///
+/// ## How the byte total is counted
+///
+/// `du` before the `rm`, `du` again after it if anything is still there, and
+/// the difference is what was reclaimed. The obvious form —
+/// `rm … && acc=$((acc + sz))` — was wrong in exactly the case
+/// `--one-file-system` exists for: `rm` walking into a match that has a mount
+/// planted *below* it removes everything else and still exits non-zero, so the
+/// whole subtree's size was dropped from the total rather than the part that
+/// survived. Under-reporting a scrub is the same class of quiet as reporting
+/// zero for one that never ran. The second `du` only runs when the path is
+/// still present, i.e. on the failure path, so the ordinary case pays nothing;
+/// the figure is clamped at the pre-`rm` size so a directory something else is
+/// concurrently growing cannot make it negative.
+///
+/// ## Why `PATH` is reset, and why the tools are *not* named absolutely (H3)
+///
+/// The first statement in the script sets `PATH={root}/usr/bin:{root}/bin` and
+/// exports it, before any external tool runs. That is the whole shim defence.
+/// The image's `PATH` starts
+/// `/home/claude/.claude/bin:/home/claude/.local/bin:/home/claude/.cargo/bin`,
+/// all of which live in the container's *persisted home volume* and are
+/// writable by the agent — so a three-line `stat` on the front of it decides
+/// the answer to checks 3 and 4. That was reproduced: with such a shim planted,
+/// a volume mounted at `/var/log/apt` — refused by an unshimmed scrub — had its
+/// entire contents deleted. The shim lives in the home volume; it cannot live
+/// in `/usr/bin` or `/bin`, which uid 1000 cannot write. Resetting `PATH` to
+/// exactly those two directories therefore defeats *a shim on `PATH`* as
+/// completely as spelling `/usr/bin/stat` out does, and buys the portability
+/// that spelling it out gives away.
+///
+/// M2: that sentence used to stop one clause earlier, at "defeats it just as
+/// completely", and read as though the reset settled command lookup. It does
+/// not. `PATH` is the **last** step of lookup: a shell tries functions, then
+/// builtins, then `PATH`, and `command -v` reports a function as found — so a
+/// planted shell function is invisible to everything in this section and
+/// passes the tool probe below into the bargain. Nothing written in this
+/// script can fix that, because the shell that would run the fix has already
+/// imported the function. It is fixed one level up, by [`SCRUB_BOOTSTRAP`],
+/// which gives the shell that runs this script no environment to import from.
+///
+/// Spelling them out as well was strictly *worse*, and it is what H3 was.
+/// `/usr/bin/stat` is not where coreutils live on every base image — Settings →
+/// Docker → **Custom** accepts any image, and on Alpine `stat` and `rm` are in
+/// `/bin`. There, `/usr/bin/stat` is simply absent, `rootdev` comes back empty,
+/// and `[ -n "$rootdev" ] || exit 0` fires for all seven patterns. Measured on
+/// one seeded tree: the absolute-path script reported
+/// `###TRIPLE-C-SCRUBBED 0` and left every planted file in place, where the
+/// `PATH`-based one reclaimed 73738 bytes. Failing closed is correct; failing
+/// closed while printing a number that reads as success is not, which is why
+/// the tool probe and [`SCRUB_UNAVAILABLE_MARKER`] exist below.
+///
+/// So: the six tools are named bare and resolved through a `PATH` the script
+/// controls, and the script refuses to delete anything at all unless
+/// `command -v` finds every one of them and the root device id reads back as a
+/// number. `find` is required along with the rest even though its absence would
+/// only disable the age gate, because "ran with one hand tied" is exactly the
+/// half-working state this whole section exists to stop being silent.
+///
+/// This does not defend against something that can write `/usr/bin` or `/bin`
+/// itself, which the agent's passwordless sudo can — and note what that is
+/// *not*: it is not a gap that a container restart closes. A `sudo`-written
+/// `/usr/bin/stat` lands in the writable layer, which is precisely what the
+/// `docker commit` this runs in front of is about to capture, so it survives
+/// into the snapshot and into every container made from it. What the reset
+/// closes is the unprivileged half — the three home-volume directories on the
+/// front of the image's `PATH`, which the agent writes without `sudo` and
+/// which no restart clears either. Both halves persist; only one of them needs
+/// a privilege the scrub could not have defended against anyway.
+///
+/// See [`SCRUB_EXEC_ENV`] for the `LD_PRELOAD` half of the same question and
+/// [`SCRUB_BOOTSTRAP`] for the shell-function half, neither of which `PATH`
+/// does anything about.
+///
+/// ## Why every line ends in `;`, and why there are no `#` comments
+///
+/// A self-terminating statement per line, and no comments, is what makes the
+/// script safe to join onto one line: any embedder that folds it with spaces
+/// gets a join rather than a rewrite. That property was learnt the hard way —
+/// an earlier version's folded form was a `"do" unexpected` syntax error, so
+/// the scrub ran not at all — and it is kept even though the folding caller is
+/// gone, because a script that survives being flattened is the cheap invariant
+/// and re-learning it is not.
+///
+/// ## Why `root` exists
+///
+/// `""` in production, which leaves the paths exactly as written. A non-empty
+/// root lets the real generated script be run by a real `/bin/sh`, with real
+/// symlinks planted in it, inside a throwaway directory tree — because
+/// containment is a *runtime* property and the test this replaces
+/// (`!dockerfile.contains("/workspace")`) was a substring check over the script
+/// text that the exploitable version passed.
+///
+/// The tool paths are re-anchored with everything else, so a test root can put
+/// its own `usr/bin/stat` where the script will look. That is how check 4 is
+/// exercised without a mount: no unprivileged test can create a device
+/// boundary (this container cannot even `unshare -Urm`), but a `stat` that
+/// reports a foreign device for one directory is what the kernel would report
+/// for a mount point, and the real boundary is covered by the container runs
+/// recorded above.
+fn snapshot_scrub_script_under(root: &str) -> String {
+    let calls: String = SNAPSHOT_SCRUB_PATHS
+        .iter()
+        .filter_map(|pattern| {
+            // Validate the shape here even though the shell re-derives it: an
+            // entry the script could not split is one it must not be handed.
+            split_scrub_pattern(pattern)?;
+            let age = SCRUB_MIN_AGE_DAYS
+                .iter()
+                .find(|(p, _)| p == pattern)
+                .map(|(_, days)| days.to_string())
+                .unwrap_or_else(|| "-".to_string());
+            Some(format!("scrub_in '{root}{pattern}' '{age}';\n"))
+        })
+        .collect();
+
+    let allowed: String = SCRUB_CONTAINMENT_PREFIXES
+        .iter()
+        .map(|p| format!("{root}{p}|{root}{p}/*"))
+        .collect::<Vec<_>>()
+        .join("|");
+
+    format!(
+        r#"PATH={root}/usr/bin:{root}/bin; export PATH;
+total=0;
+missing=;
+for t in {tools}; do command -v "$t" >/dev/null 2>&1 || missing="$missing $t"; done;
+command -v rm >/dev/null 2>&1 && {{ rm --one-file-system -f -- '' >/dev/null 2>&1 || missing="$missing rm-one-file-system"; }};
+rootdev=$(stat -c %d '{root}/' 2>/dev/null);
+case "$rootdev" in ''|*[!0-9]*) rootdev=; missing="$missing root-device-id" ;; esac;
+[ -z "$missing" ] || {{ echo "{unavailable}$missing"; exit 0; }};
+scrub_in() {{
+n=$(
+d=${{1%/*}}; [ -n "$d" ] || d=/;
+g=${{1##*/}};
+cd -P "$d" 2>/dev/null || exit 0;
+[ "$(pwd -P)" = "$d" ] || exit 0;
+case "$d" in {allowed}) ;; *) exit 0 ;; esac;
+[ -n "$rootdev" ] || exit 0;
+[ "$(stat -c %d . 2>/dev/null)" = "$rootdev" ] || exit 0;
+acc=0;
+for p in $g; do
+case "$p" in */*|.|..) continue ;; esac;
+{{ [ -e "$p" ] || [ -L "$p" ]; }} || continue;
+[ "$(stat -c %d -- "$p" 2>/dev/null)" = "$rootdev" ] || continue;
+[ "$2" = "-" ] || [ -n "$(find "./$p" -maxdepth 0 -mtime +"$2" -print 2>/dev/null)" ] || continue;
+sz=$(du -sb -- "$p" 2>/dev/null | cut -f1);
+case "$sz" in ''|*[!0-9]*) sz=0 ;; esac;
+rm --one-file-system -rf -- "$p" 2>/dev/null;
+rest=0;
+{{ [ -e "$p" ] || [ -L "$p" ]; }} && rest=$(du -sb -- "$p" 2>/dev/null | cut -f1);
+case "$rest" in ''|*[!0-9]*) rest=0 ;; esac;
+[ "$rest" -le "$sz" ] || rest=$sz;
+acc=$((acc + sz - rest));
+done;
+echo "$acc";
+);
+case "$n" in ''|*[!0-9]*) n=0 ;; esac;
+total=$((total + n));
+}};
+{calls}echo "{marker}$total";
+exit 0
+"#,
+        root = root,
+        allowed = allowed,
+        calls = calls,
+        tools = SCRUB_PREREQ_TOOLS.join(" "),
+        marker = SCRUB_MARKER,
+        unavailable = SCRUB_UNAVAILABLE_MARKER,
+    )
+}
+
+/// Parse the byte total the scrub script reports. Returns `None` when the
+/// marker is absent, which is how a container that never ran the script (or a
+/// `sh` that died early) is told apart from one that reclaimed nothing.
+///
+/// A script that decided it could not run prints [`SCRUB_UNAVAILABLE_MARKER`]
+/// and no total at all, so this returns `None` for that too — but callers must
+/// ask [`parse_scrub_unavailable`] **first**, because "could not run" and
+/// "printed nothing recognisable" deserve different words in the log.
+fn parse_scrub_total(output: &str) -> Option<u64> {
+    output
+        .lines()
+        .rev()
+        .find_map(|line| line.trim().strip_prefix(SCRUB_MARKER)?.trim().parse().ok())
+}
+
+/// What the scrub script said was missing, if it declined to run at all.
+///
+/// H3: the failure this exists for is silent by construction — a scrub with no
+/// usable `stat` deletes nothing and, before this, printed the same
+/// `###TRIPLE-C-SCRUBBED 0` a healthy container with nothing to clean prints.
+/// The script now says which tools it could not find; this reads that back so
+/// [`ScrubOutcome::Unavailable`] can carry it into the log.
+fn parse_scrub_unavailable(output: &str) -> Option<String> {
+    output.lines().rev().find_map(|line| {
+        let missing = line.trim().strip_prefix(SCRUB_UNAVAILABLE_MARKER)?.trim();
+        if missing.is_empty() {
+            return Some("the image is missing the tools the scrub needs".to_string());
+        }
+        // Three different things can be missing and only one of them is a file
+        // on a path, so they cannot share a sentence. M1 added the third and
+        // it is the one most likely to be read by somebody who does not know
+        // the history, so it says what the flag is *for* rather than naming it.
+        let (tools, others): (Vec<&str>, Vec<&str>) = missing
+            .split_whitespace()
+            .partition(|t| SCRUB_PREREQ_TOOLS.contains(t));
+        let mut parts = Vec::new();
+        if !tools.is_empty() {
+            parts.push(format!(
+                "has no usable {} on /usr/bin or /bin",
+                tools.join(", ")
+            ));
+        }
+        parts.extend(others.into_iter().map(|other| match other {
+            "rm-one-file-system" => "has an `rm` that does not take `--one-file-system`, \
+                 which is the only thing bounding a recursive delete run as root"
+                .to_string(),
+            "root-device-id" => {
+                "will not say which device its root filesystem is on".to_string()
+            }
+            other => format!("is missing {}", other),
+        }));
+        Some(format!("the image {}", parts.join("; it ")))
+    })
+}
+
+/// How long [`scrub_writable_layer`] waits for its exec before the commit goes
+/// ahead without it.
+///
+/// The scrub is a `du -sb` plus an `rm -rf` over a tree a running agent may
+/// still be writing to, and it sits on the critical path of every recreate and
+/// every migration with the UI parked on "Saving container state…" and no way
+/// to cancel. Two minutes is an order of magnitude more than the measured cost
+/// on a 4.48 GB layer, and far less than the point where a user force-quits.
+const SCRUB_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(120);
+
+/// What [`scrub_writable_layer`] actually did.
+///
+/// The distinction that earns this type is [`ScrubOutcome::NotRunning`] versus
+/// [`ScrubOutcome::Failed`]: "there was nothing to exec into" is routine, while
+/// "the exec ran and broke" is the one case worth a warning in the log.
+/// `#[must_use]` because the variants mean different things to a caller and
+/// three of the four are easy to ignore by accident: a `Failed` swallowed at a
+/// call site is exactly how a scrub that stopped working would stay quiet.
+#[must_use = "a scrub that was skipped, timed out or failed reads the same as one that worked unless the outcome is inspected"]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ScrubOutcome {
+    /// The scrub ran to completion and freed this many bytes — possibly zero,
+    /// which is a real answer.
+    Reclaimed(u64),
+    /// The container is not running, so there is no `docker exec` to run in.
+    /// Not a failure: a stopped container's writable layer is not growing, and
+    /// on the migration path it was already scrubbed while it was.
+    NotRunning,
+    /// The container was running, but the scrub did not finish within
+    /// [`SCRUB_TIMEOUT`].
+    TimedOut,
+    /// The container was running and the scrub genuinely failed.
+    Failed,
+    /// The exec ran, but the container's image does not have the tools the
+    /// scrub needs where it can reach them, so it deleted nothing.
+    ///
+    /// Separate from [`ScrubOutcome::Failed`] because the exec itself worked
+    /// and the script ran to its own conclusion — and separate from
+    /// `Reclaimed(0)`, which is the whole of H3: a custom base image without
+    /// usr-merged coreutils reclaimed nothing and reported it as a completed
+    /// scrub of zero bytes.
+    Unavailable,
+}
+
+impl ScrubOutcome {
+    /// What the commit's log line should say about the scrub — **empty when
+    /// there is nothing to say**.
+    ///
+    /// Two different zeros used to render identically here. Every migration
+    /// logged "0.00 MB dropped by the pre-commit scrub", because the migration
+    /// path scrubs the container itself while it is still running and stops it
+    /// before committing, so the call here finds nothing to exec into. A figure
+    /// of zero reads as a scrub that ran and found nothing, which is a
+    /// different and more alarming thing than a scrub that correctly had no
+    /// work left.
+    ///
+    /// The other zero was H3: a scrub that could not find its tools also
+    /// reclaimed nothing, and rendered as the same reassuring "0.00 MB
+    /// dropped". That one is [`ScrubOutcome::Unavailable`] now, and even a
+    /// genuine `Reclaimed(0)` says it *ran* rather than quoting a figure that
+    /// cannot be told apart from a broken scrub's.
+    pub(crate) fn commit_log_suffix(&self) -> String {
+        match self {
+            Self::Reclaimed(0) => {
+                " (the pre-commit scrub ran and found nothing to drop)".to_string()
+            }
+            Self::Reclaimed(bytes) => format!(
+                " ({:.2} MB dropped by the pre-commit scrub)",
+                *bytes as f64 / 1_048_576.0
+            ),
+            Self::NotRunning => String::new(),
+            Self::TimedOut => " (the pre-commit scrub timed out, so the layer keeps whatever it had)".to_string(),
+            Self::Failed => " (the pre-commit scrub did not run, so the layer keeps whatever it had)".to_string(),
+            Self::Unavailable => " (the pre-commit scrub could not run in this image, so nothing was reclaimed and the layer keeps whatever it had)".to_string(),
+        }
+    }
+}
+
+/// Delete the throwaway files listed in [`SNAPSHOT_SCRUB_PATHS`] from a
+/// container's writable layer so the commit that follows does not bake them in.
+///
+/// Runs as **root**: the apt debris is root-owned while the scratchpads belong
+/// to `claude`, and root can remove both. That is also what makes
+/// [`snapshot_scrub_script`]'s containment checks load-bearing rather than
+/// decorative.
+///
+/// **Never fails the caller, by design.** A scrub is an optimisation; a commit
+/// is the only copy of the user's system layer. Losing some disk is a strictly
+/// better outcome than refusing to snapshot, so every failure here is a log
+/// line and nothing more — including the timeout, which stops waiting and lets
+/// the commit proceed rather than leaving the UI on "Saving container state…"
+/// with no way out.
+///
+/// ## Why it checks whether the container is running (M11)
+///
+/// This is a `docker exec`, so it only works on a running container.
+/// `migrate_project_to_base` knows that: it scrubs the container itself and
+/// *then* stops it, because the pre-swap commit is the largest snapshot
+/// Triple-C ever takes. The call inside [`commit_container_snapshot`] therefore
+/// arrives at a stopped container and could only ever fail, which logged
+/// "could not run … committing anyway" on every single migration — training
+/// the reader to ignore the one line that would matter if the scrub had really
+/// broken. Asking first turns that into a debug line and keeps the warning
+/// meaningful.
+pub async fn scrub_writable_layer(container_id: &str) -> ScrubOutcome {
+    match is_container_running(container_id).await {
+        Ok(true) => {}
+        Ok(false) => {
+            log::debug!(
+                "Skipping pre-commit scrub of container {}: it is not running, so there is nothing to exec into and its writable layer is not growing",
+                container_id
+            );
+            return ScrubOutcome::NotRunning;
+        }
+        Err(e) => {
+            // Only Docker being unreachable reaches here, in which case the
+            // commit this precedes is about to fail on its own — but say so
+            // rather than reporting a skip that never happened.
+            log::warn!(
+                "Could not tell whether container {} is running ({}); skipping the pre-commit scrub and committing anyway",
+                container_id,
+                e
+            );
+            return ScrubOutcome::Failed;
+        }
+    }
+
+    // M2: not `/bin/sh -c script`. The shell an exec starts has already read
+    // the container's environment by the time the script's first line runs —
+    // see [`SCRUB_BOOTSTRAP`], which hands the script to one that has not.
+    let cmd = scrub_exec_cmd(&snapshot_scrub_script());
+    let exec = crate::docker::exec::exec_oneshot_as(
+        container_id,
+        "root",
+        cmd,
+        SCRUB_EXEC_ENV.iter().map(|e| (*e).to_string()).collect(),
+    );
+
+    // M12: nothing under `docker/` has a timeout, and this is the one call on
+    // the critical path of every recreate. Dropping the future stops us
+    // *waiting*; the `sh` keeps running inside the container and its deletions
+    // are still valid, they just stop counting towards the total. That is the
+    // right trade — the commit that follows is merely a little larger.
+    let exec_result = match tokio::time::timeout(SCRUB_TIMEOUT, exec).await {
+        Ok(result) => result,
+        Err(_) => {
+            log::warn!(
+                "Pre-commit scrub of container {} did not finish within {}s; committing anyway",
+                container_id,
+                SCRUB_TIMEOUT.as_secs()
+            );
+            return ScrubOutcome::TimedOut;
+        }
+    };
+
+    match exec_result {
+        Ok((output, _exit_code)) => {
+            // H3, first of the three silences: ask about "could not run"
+            // *before* reading a total, because the script prints no total in
+            // that case and a bare `None` would be reported as a generic
+            // failure without naming what the image is missing.
+            if let Some(reason) = parse_scrub_unavailable(&output) {
+                log::warn!(
+                    "Pre-commit scrub of container {} could not run ({}); nothing was reclaimed and the commit will carry whatever the writable layer held",
+                    container_id,
+                    reason
+                );
+                return ScrubOutcome::Unavailable;
+            }
+            match parse_scrub_total(&output) {
+                // H3, second of the three: this used to log only when there
+                // was something to report, so a scrub that reclaimed nothing
+                // left no trace at all. A genuine zero is routine, so it is a
+                // debug line rather than a warning — the alarming zero is the
+                // `Unavailable` above, and that one is not quiet.
+                Some(0) => {
+                    log::debug!(
+                        "Pre-commit scrub of container {} ran and found nothing to reclaim",
+                        container_id
+                    );
+                    ScrubOutcome::Reclaimed(0)
+                }
+                Some(bytes) => {
+                    log::info!(
+                        "Pre-commit scrub of container {} reclaimed {:.2} MB before it could be committed",
+                        container_id,
+                        bytes as f64 / 1_048_576.0
+                    );
+                    ScrubOutcome::Reclaimed(bytes)
+                }
+                None => {
+                    log::warn!(
+                        "Pre-commit scrub of container {} did not report a total; committing anyway. Output: {}",
+                        container_id,
+                        output.trim()
+                    );
+                    ScrubOutcome::Failed
+                }
+            }
+        }
+        Err(e) => {
+            log::warn!(
+                "Pre-commit scrub of container {} could not run ({}); committing anyway",
+                container_id,
+                e
+            );
+            ScrubOutcome::Failed
+        }
+    }
+}
+
 /// Commit the container's filesystem to a snapshot image so that system-level
 /// changes (apt/pip/npm installs, ~/.claude.json, etc.) survive container
 /// removal.
@@ -1795,10 +2980,25 @@ chmod 600 "$HOME/.aws/credentials""#;
 ///
 /// Non-secret env (PATH, TZ, model aliases, instructions) is inherited as
 /// before, so nothing about the snapshot's behaviour changes.
+///
+/// ## Why it scrubs first
+///
+/// See [`SNAPSHOT_SCRUB_PATHS`]. Every commit stacks a layer, so a file present
+/// here is a file the project's image carries for the rest of its life.
+///
+/// The scrub is a no-op on a container that is already stopped — the migration
+/// path scrubs it itself while it is still running and stops it before getting
+/// here — and it can never fail this function; see [`scrub_writable_layer`].
 pub async fn commit_container_snapshot(container_id: &str, project: &Project) -> Result<(), String> {
     let docker = get_docker()?;
     let image_name = get_snapshot_image_name(project);
 
+    // Drop the throwaway files *before* the commit captures them. A commit
+    // stacks a layer and never rewrites one, so anything present at this
+    // instant is paid for permanently — see [`SNAPSHOT_SCRUB_PATHS`]. Failure
+    // is swallowed inside; a scrub must never be able to block a snapshot.
+    let scrub = scrub_writable_layer(container_id).await;
+
     // Parse repo:tag
     let (repo, tag) = match image_name.rsplit_once(':') {
         Some((r, t)) => (r.to_string(), t.to_string()),
@@ -1823,7 +3023,13 @@ pub async fn commit_container_snapshot(container_id: &str, project: &Project) ->
         .await
         .map_err(|e| format!("Failed to commit container snapshot: {}", e))?;
 
-    log::info!("Committed container {} as snapshot {}:{}", container_id, repo, tag);
+    log::info!(
+        "Committed container {} as snapshot {}:{}{}",
+        container_id,
+        repo,
+        tag,
+        scrub.commit_log_suffix()
+    );
     Ok(())
 }
 
@@ -1890,15 +3096,30 @@ fn orphan_sweep_filters() -> HashMap<String, Vec<String>> {
 ///   `triple-c-snapshot-{id}:latest` is what a project is rebuilt from, and a
 ///   migration's `pre-migration-*` pin is the only copy of a rollback target.
 ///   Neither can ever match this filter, so neither can be swept.
-/// * **`triple-c.managed=true`** — only images Triple-C itself committed.
-///   `docker commit` copies the container's labels onto the image, which is what
-///   makes the label a reliable mark of provenance. The user's own dangling
-///   images are none of our business.
+/// * **`triple-c.managed=true`** — only images Triple-C itself built or
+///   committed. `docker commit` copies the container's labels onto the image,
+///   and `container/Dockerfile` stamps the same label on the base, which is
+///   what makes it a reliable mark of provenance. The user's own dangling
+///   images are none of our business — the daemon this runs against is shared
+///   with their unrelated work, so an unfiltered prune is never an option.
+///
+/// **Superseded base images are collected by exactly the same two conditions.**
+/// They used to be unreachable: `container/Dockerfile` carried no `LABEL` at
+/// all, so a base image left untagged when a newer build claimed
+/// `triple-c-sandbox:latest` was dangling but not labelled and could never
+/// match. ~11.9 GB was measured stranded that way. The Dockerfile now stamps
+/// `triple-c.managed=true`, so no change is needed here beyond knowing that
+/// this function is what reclaims them.
 ///
 /// Removal is not forced, so Docker refuses (409) while any container is still
 /// built from the image — including the stopped containers of projects that are
 /// not running. That refusal is the third safety net and it is the daemon's,
 /// not ours; those orphans are simply counted and left for a later sweep.
+/// **This is why `force: false` stays.** Forcing would untag and delete an
+/// image out from under a stopped project, and Docker would leave that
+/// container unable to start. A superseded base image pinned by one stopped
+/// container is therefore not reclaimed until that project is next recreated or
+/// removed, which the startup sweep will notice on some later run.
 ///
 /// Never fails the caller: this is housekeeping, and a full disk is a better
 /// outcome than a project that will not start.
@@ -1969,6 +3190,38 @@ pub async fn sweep_orphaned_snapshots() -> SnapshotSweepReport {
     report
 }
 
+/// Run [`sweep_orphaned_snapshots`] and write the whole outcome to the log,
+/// tagged with *why* the sweep ran.
+///
+/// Every caller of the sweep is housekeeping fired off in a detached task, and
+/// every one of them dropped the `SnapshotSweepReport` on the floor — including
+/// `reclaimed_bytes`, `failed` and `unavailable`, which are the only evidence
+/// that a sweep ever happened or that it could not. When a user asks where
+/// 116 GB went, "nothing was logged" is not an answer. There is no UI for this
+/// yet by deliberate choice (prevention first), so the log is the whole
+/// interface.
+pub async fn sweep_orphaned_snapshots_logged(context: &str) {
+    let report = sweep_orphaned_snapshots().await;
+
+    if let Some(ref why) = report.unavailable {
+        log::warn!("Snapshot sweep ({}) could not run: {}", context, why);
+        return;
+    }
+
+    log::info!(
+        "Snapshot sweep ({}): {} removed, {:.2} GB reclaimed, {} still pinned by a container, {} failed",
+        context,
+        report.removed.len(),
+        report.reclaimed_bytes as f64 / 1_073_741_824.0,
+        report.in_use,
+        report.failed.len(),
+    );
+
+    for (id, error) in &report.failed {
+        log::warn!("Snapshot sweep ({}) could not remove {}: {}", context, id, error);
+    }
+}
+
 /// Outcome of [`scrub_secrets_from_snapshots`], so callers can tell the user
 /// what actually happened rather than guessing.
 #[derive(Debug, Default, Clone, serde::Serialize)]
@@ -2085,6 +3338,37 @@ pub async fn scrub_secrets_from_snapshots() -> SnapshotScrubReport {
             continue;
         }
 
+        // Claim the project before touching its snapshot.
+        //
+        // This is the second writer of `triple-c-snapshot-{id}:latest`, after a
+        // recreate's commit, and it has the same
+        // read-modify-write shape: create a scratch container *from* the
+        // snapshot, then commit back over the same tag. A `:latest` move
+        // landing in between is silently overwritten by an image derived from
+        // the pre-read state — which here would mean re-baking the very
+        // credential this function exists to remove.
+        //
+        // A snapshot whose project is busy is left for the next call rather
+        // than rewritten unsafely, and it is *reported*: silently skipping a
+        // credential removal is the one outcome worse than failing it.
+        let project_id = summary
+            .repo_tags
+            .iter()
+            .find_map(|t| crate::docker::migration::parse_snapshot_reference(t))
+            .map(|(id, _tag)| id);
+        let _claim = match project_id.as_deref() {
+            Some(id) => match crate::project_lock::try_acquire(id, crate::project_lock::ProjectOp::SecretScrub) {
+                Ok(guard) => Some(guard),
+                Err(reason) => {
+                    report.failed.push((summary.repo_tags.join(", "), reason));
+                    continue;
+                }
+            },
+            // Not a `triple-c-snapshot-{uuid}` reference despite the filter.
+            // Nothing owns it, so there is nothing to serialise against.
+            None => None,
+        };
+
         // Rewrite every tag this image answers to, so an old tag cannot keep
         // serving the un-scrubbed config.
         let mut all_tags_rewritten = true;
@@ -2143,6 +3427,15 @@ async fn rewrite_image_without_secrets(
 ) -> Result<(), String> {
     let scratch_name = format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple());
 
+    // `triple-c.scrub=true` so the Disk panel's scrub-container bucket can tell
+    // a *live* rewrite from a leftover by label rather than by age. An age gate
+    // alone was the previous discriminator, and a clock is a poor proxy for
+    // "somebody is using this": killing this container between the create and
+    // the commit below leaves the revoked credential baked into the snapshot's
+    // `Config.Env`, which is precisely the state this function exists to end.
+    let scratch_labels: HashMap<String, String> =
+        HashMap::from([(LABEL_SCRUB.to_string(), "true".to_string())]);
+
     let created = docker
         .create_container(
             Some(CreateContainerOptions {
@@ -2151,6 +3444,7 @@ async fn rewrite_image_without_secrets(
             }),
             Config::<String> {
                 image: Some(source_image.to_string()),
+                labels: Some(scratch_labels),
                 // Deliberately nothing else. The container is never started;
                 // its only job is to be a config to commit from, and every
                 // field left unset here is inherited from the image and
@@ -2226,8 +3520,8 @@ pub async fn remove_snapshot_image(project: &Project) -> Result<(), String> {
 pub async fn remove_project_volumes(project: &Project) -> Result<(), String> {
     let docker = get_docker()?;
     for vol in [
-        format!("triple-c-home-{}", project.id),
-        format!("triple-c-claude-config-{}", project.id),
+        home_volume_name(&project.id),
+        config_volume_name(&project.id),
     ] {
         match docker.remove_volume(&vol, None).await {
             Ok(_) => log::info!("Removed volume {}", vol),
@@ -2630,30 +3924,6 @@ pub async fn is_container_running(container_id: &str) -> Result<bool, String> {
     }
 }
 
-pub async fn list_sibling_containers() -> Result<Vec<ContainerSummary>, String> {
-    let docker = get_docker()?;
-
-    let all_containers: Vec<ContainerSummary> = docker
-        .list_containers(Some(ListContainersOptions::<String> {
-            all: true,
-            ..Default::default()
-        }))
-        .await
-        .map_err(|e| format!("Failed to list containers: {}", e))?;
-
-    let siblings: Vec<ContainerSummary> = all_containers
-        .into_iter()
-        .filter(|c| {
-            if let Some(labels) = &c.labels {
-                !labels.contains_key(LABEL_MANAGED)
-            } else {
-                true
-            }
-        })
-        .collect();
-
-    Ok(siblings)
-}
 
 #[cfg(test)]
 mod tests {
@@ -3119,4 +4389,1733 @@ mod tests {
         };
         assert!(blind.left_something_behind());
     }
+
+    /// A stored row that cannot make a usable mount makes none.
+    ///
+    /// Both shapes here are records already written to disk, which is the whole
+    /// point: an empty `host_path` sends
+    /// `field Source must not be empty` back for the *entire* create, so the
+    /// project cannot be started or recreated at all until the row is gone —
+    /// and validating the next save does nothing for a record that is already
+    /// there. An empty `mount_name` is the quieter one: it targets
+    /// `/workspace/` itself, so the daemon mounts that row over the workspace
+    /// volume and then creates the other rows' mount points inside the user's
+    /// real folder.
+    #[test]
+    fn a_stored_path_row_that_cannot_mount_produces_no_mount() {
+        use crate::models::project::ProjectPath;
+        let row = |host: &str, name: &str| ProjectPath {
+            host_path: host.to_string(),
+            mount_name: name.to_string(),
+        };
+
+        let mounts = project_path_mounts(&[
+            row("/home/me/code", "code"),
+            // Bricks the create outright.
+            row("", "orphan"),
+            // Mounts over /workspace itself.
+            row("/home/me/other", ""),
+            // Whitespace is not a name and not a path, however it got there.
+            row("   ", "blank-source"),
+            row("/home/me/third", "  "),
+            row("/home/me/docs", "docs"),
+        ]);
+
+        assert_eq!(
+            mounts.len(),
+            2,
+            "a row that cannot mount was turned into a mount anyway: {:?}",
+            mounts
+        );
+        assert_eq!(mounts[0].target.as_deref(), Some("/workspace/code"));
+        assert_eq!(mounts[0].source.as_deref(), Some("/home/me/code"));
+        assert_eq!(mounts[1].target.as_deref(), Some("/workspace/docs"));
+        // The two failures, spelled out so a future edit cannot reintroduce
+        // either by relaxing half the filter.
+        for m in &mounts {
+            assert_ne!(m.source.as_deref(), Some(""), "an empty Source reaches the daemon");
+            assert_ne!(
+                m.target.as_deref(),
+                Some("/workspace/"),
+                "a row is mounted over the workspace volume"
+            );
+        }
+        // And the good rows are unchanged: this is a filter, not a rewrite.
+        assert!(mounts.iter().all(|m| m.read_only == Some(false)));
+        assert!(project_path_mounts(&[]).is_empty());
+    }
+
+    // ── Pre-commit scrub (A1, C1) ────────────────────────────────────────────
+
+    #[test]
+    fn no_scrub_path_can_reach_a_host_bind_mount() {
+        // `/workspace/{mount_name}` is the user's own project directory, bound
+        // in from the host. Nothing in this list may ever name one — and the
+        // two read-only host mounts under /tmp must be equally unreachable.
+        //
+        // Necessary, not sufficient: a pattern that looks like this can still
+        // resolve into a bind mount through a symlinked parent, which is what
+        // the script's own checks exist for. See
+        // `the_scrub_script_refuses_a_symlinked_parent_...` below.
+        for path in SNAPSHOT_SCRUB_PATHS {
+            assert!(
+                path.starts_with('/'),
+                "{} is not absolute, so the shell would resolve it against an unknown cwd",
+                path
+            );
+            assert!(
+                !path.starts_with("/workspace"),
+                "{} reaches into a host bind mount",
+                path
+            );
+            assert!(
+                !path.starts_with("/tmp/."),
+                "{} could select /tmp/.host-ca or /tmp/.host-aws",
+                path
+            );
+            assert!(
+                !path.starts_with("/home"),
+                "{} reaches into the persisted home volume",
+                path
+            );
+        }
+    }
+
+    #[test]
+    fn no_scrub_path_is_a_whole_system_directory() {
+        // A trailing `/*` on a directory the system needs is fine; the
+        // directory *itself* is not. Guards against an edit that shortens an
+        // entry by one path component.
+        const FORBIDDEN: &[&str] = &[
+            "/", "/tmp", "/var", "/var/lib", "/var/log", "/var/cache", "/etc", "/usr", "/opt",
+            "/workspace", "/home", "/home/claude", "/var/lib/apt", "/var/cache/apt",
+        ];
+        for path in SNAPSHOT_SCRUB_PATHS {
+            let trimmed = path.trim_end_matches('/');
+            assert!(
+                !FORBIDDEN.contains(&trimmed),
+                "{} would delete a directory the container needs",
+                path
+            );
+        }
+    }
+
+    #[test]
+    fn every_scrub_pattern_keeps_its_glob_in_the_final_component() {
+        // The script can only validate a parent directory it can name, so the
+        // parent has to be literal. An entry like `/var/*/apt/*` would put a
+        // glob in a path *component*, which is the shape that made C1
+        // exploitable in the first place.
+        for pattern in SNAPSHOT_SCRUB_PATHS {
+            let (dir, glob) = split_scrub_pattern(pattern)
+                .unwrap_or_else(|| panic!("{} has no literal parent directory", pattern));
+            assert!(
+                !dir.contains(['*', '?', '[']),
+                "{}: the parent {} is itself a glob, so the script cannot check it",
+                pattern,
+                dir
+            );
+            assert!(!glob.is_empty(), "{} has an empty final component", pattern);
+            // Both halves are single-quoted into the script; a quote or a blank
+            // would break out of that quoting and change what runs as root.
+            assert!(
+                !pattern.contains('\'') && !pattern.contains(char::is_whitespace),
+                "{} cannot be safely single-quoted into the scrub script",
+                pattern
+            );
+        }
+    }
+
+    #[test]
+    fn every_scrub_parent_is_inside_the_scripts_containment_allowlist() {
+        // The allowlist is hardcoded in the script and deliberately not derived
+        // from this list, so the two can drift apart — in which case the entry
+        // silently stops being scrubbed. Fail here instead.
+        for pattern in SNAPSHOT_SCRUB_PATHS {
+            let (dir, _) = split_scrub_pattern(pattern).expect("a literal parent");
+            assert!(
+                SCRUB_CONTAINMENT_PREFIXES
+                    .iter()
+                    .any(|p| dir == *p || dir.starts_with(&format!("{}/", p))),
+                "{} is anchored at {}, which the script's containment check would refuse",
+                pattern,
+                dir
+            );
+        }
+    }
+
+    #[test]
+    fn the_containment_allowlist_cannot_reach_anything_of_the_users() {
+        for prefix in SCRUB_CONTAINMENT_PREFIXES {
+            assert!(prefix.starts_with('/'), "{} is not absolute", prefix);
+            assert!(!prefix.ends_with('/'), "{} would match the wrong things", prefix);
+            for forbidden in [
+                "/", "/workspace", "/home", "/etc", "/usr", "/opt", "/srv", "/root",
+                "/var/lib/postgresql", "/var/lib/docker",
+            ] {
+                assert!(
+                    !(forbidden == *prefix || forbidden.starts_with(&format!("{}/", prefix))),
+                    "the allowlist entry {} contains {}",
+                    prefix,
+                    forbidden
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn the_scrub_list_covers_every_measured_source_of_writable_layer_growth() {
+        // Each of these was measured in a real container's pending commit.
+        // Dropping one silently gives back multiple gigabytes per project.
+        for expected in [
+            "/tmp/claude-*",                 // agent scratchpads, 3.0 GB measured
+            "/tmp/triple-c-drops/*",         // terminal drag-and-drop staging
+            "/tmp/clipboard_*.png",          // pasted images
+            "/var/lib/apt/lists/*",          // runtime apt, no `apt-get clean` behind it
+            "/var/cache/apt/archives/*.deb",
+            "/var/log/apt/*",
+            "/var/log/dpkg.log",
+        ] {
+            assert!(
+                SNAPSHOT_SCRUB_PATHS.contains(&expected),
+                "{} is no longer scrubbed before commit",
+                expected
+            );
+        }
+    }
+
+    #[test]
+    fn the_users_own_files_are_only_scrubbed_once_they_are_stale() {
+        // Regression: these two hold files the user handed the agent by hand,
+        // and deleting them at commit time turned "change a setting" into
+        // "silently lose the file you just dropped". They stay in the list —
+        // nothing else ever reclaims them — but only with an age gate.
+        for user_owned in ["/tmp/triple-c-drops/*", "/tmp/clipboard_*.png"] {
+            assert!(
+                SNAPSHOT_SCRUB_PATHS.contains(&user_owned),
+                "{} was removed from the list instead of age-limited, so nothing reclaims it",
+                user_owned
+            );
+            let age = SCRUB_MIN_AGE_DAYS.iter().find(|(p, _)| *p == user_owned);
+            assert!(
+                age.is_some_and(|(_, days)| *days >= 7),
+                "{} is scrubbed without a meaningful age limit, which loses a just-dropped file",
+                user_owned
+            );
+        }
+        // The scratchpads are machine debris and are not age-limited; if that
+        // ever changes, the comment explaining why must change with it.
+        assert!(!SCRUB_MIN_AGE_DAYS.iter().any(|(p, _)| *p == "/tmp/claude-*"));
+        // An age limit on a pattern that is not scrubbed at all does nothing
+        // and reads as though it does.
+        for (pattern, _) in SCRUB_MIN_AGE_DAYS {
+            assert!(SNAPSHOT_SCRUB_PATHS.contains(pattern), "{} is not scrubbed", pattern);
+        }
+    }
+
+    #[test]
+    fn the_scrub_script_validates_every_directory_before_deleting_in_it() {
+        // The structural half of the C1 fix, for the environments where the
+        // `/bin/sh` test below cannot run. Each assertion here pins one of the
+        // five checks; deleting any of them from the script fails this test.
+        let script = snapshot_scrub_script();
+
+        // Exactly one deletion in the whole script, inside `scrub_in` and
+        // downstream of all five checks. A future edit that adds a bare `rm`
+        // at the top level — which is what the vulnerable version was — fails
+        // here.
+        assert_eq!(
+            script.matches(r#"rm --one-file-system -rf -- "$p""#).count(),
+            1,
+            "the scrub deletes somewhere other than inside the validated block:\n{}",
+            script
+        );
+        // M1: and the flag is spelled into that one deletion rather than
+        // reaching it through a `$rmopt` an unsupported `rm` leaves empty.
+        assert!(
+            !script.contains("rmopt"),
+            "the cross-filesystem guard is optional again:\n{}",
+            script
+        );
+        assert_eq!(
+            script.matches("rm -rf").count(),
+            0,
+            "an unguarded recursive delete is back in the script:\n{}",
+            script
+        );
+        // The handle: after this, paths are relative to a validated inode, so
+        // re-pointing the directory cannot redirect the delete.
+        assert!(script.contains(r#"cd -P "$d" 2>/dev/null || exit 0;"#));
+        // 1. no symlinked component anywhere in the parent
+        assert!(script.contains(r#"[ "$(pwd -P)" = "$d" ] || exit 0;"#));
+        // 2. positive containment against a hardcoded allowlist
+        assert!(script.contains("/tmp|/tmp/*|/var/log|/var/log/*"));
+        assert!(!script.contains("/workspace"));
+        // 3. the parent on the same filesystem as the root — a bind mount or
+        //    volume is not part of the writable layer and must never be
+        //    touched.
+        assert!(script.contains(r#"[ -n "$rootdev" ] || exit 0;"#));
+        assert!(script.contains(r#"[ "$(stat -c %d . 2>/dev/null)" = "$rootdev" ] || exit 0;"#));
+        // 4. and *each match* on it too. Check 3 says nothing about a mount
+        //    planted at the match itself, and `rm --one-file-system` compares
+        //    against its own argument's device, so without this line a volume
+        //    mounted at `/tmp/claude-x` has its contents deleted — reproduced
+        //    against a live daemon before this existed.
+        assert!(script
+            .contains(r#"[ "$(stat -c %d -- "$p" 2>/dev/null)" = "$rootdev" ] || continue;"#));
+        // 5. an expansion carrying a separator means the list changed shape
+        assert!(script.contains(r#"case "$p" in */*|.|..) continue ;; esac;"#));
+    }
+
+    #[test]
+    fn the_scrub_script_cannot_be_steered_by_path() {
+        // Checks 3 and 4 are `stat` answering a question, and the image's
+        // `PATH` starts with three directories inside the container's own
+        // persisted home volume. A three-line `stat` shim planted in the first
+        // of them made an unshimmed-refused mount at `/var/log/apt` delete its
+        // whole contents, so "no `stat` means no deletion" was never the
+        // property that mattered. The defence is the `PATH` reset, and it has
+        // to be the *first* statement in the script.
+        let script = snapshot_scrub_script();
+        assert!(
+            script.starts_with("PATH=/usr/bin:/bin; export PATH;\n"),
+            "the scrub inherits the container's PATH:\n{}",
+            script
+        );
+        // Nothing may run before the reset takes effect.
+        let reset_at = script.find("export PATH;").expect("the PATH reset");
+        assert!(
+            !script[..reset_at].contains('$'),
+            "something is expanded before PATH is reset:\n{}",
+            script
+        );
+        // H3: and the tools are *not* named absolutely on top of that.
+        // `/usr/bin/stat` is where coreutils live on Ubuntu and not where they
+        // live on Alpine, which Settings → Docker → Custom accepts — so an
+        // absolute path turned the whole scrub into a silent no-op there while
+        // buying nothing the reset above had not already bought.
+        assert!(
+            !script.contains("/usr/bin/stat"),
+            "the scrub hardcodes a coreutils location that is not universal:\n{}",
+            script
+        );
+        for tool in ["stat", "du", "find", "cut", "rm"] {
+            assert!(
+                !script.contains(&format!("/usr/bin/{}", tool)),
+                "`{}` is called by absolute path, which fails closed and silently on any image \
+                 that does not put it there:\n{}",
+                tool,
+                script
+            );
+        }
+    }
+
+    #[test]
+    fn the_scrub_refuses_to_run_at_all_when_a_tool_is_missing() {
+        // H3, the structural half. Every one of the six things the script needs
+        // is probed up front, and a script that cannot find one prints a marker
+        // the caller can tell from a total instead of printing `0`.
+        let script = snapshot_scrub_script();
+        assert!(script.contains(
+            r#"for t in stat rm du cut find; do command -v "$t" >/dev/null 2>&1 || missing="$missing $t"; done;"#
+        ));
+        // M1: the seventh. `rm` existing is not `rm` taking the one flag that
+        // bounds a recursive delete run as root, and the difference used to be
+        // an empty variable nobody could see from the outside.
+        assert!(script.contains(
+            r#"command -v rm >/dev/null 2>&1 && { rm --one-file-system -f -- '' >/dev/null 2>&1 || missing="$missing rm-one-file-system"; };"#
+        ));
+        assert!(script.contains(&format!(
+            r#"[ -z "$missing" ] || {{ echo "{}$missing"; exit 0; }};"#,
+            SCRUB_UNAVAILABLE_MARKER
+        )));
+        // The two markers must be un-confusable in both directions, since the
+        // caller reads whichever it finds out of one interleaved stream.
+        assert!(!SCRUB_UNAVAILABLE_MARKER.starts_with(SCRUB_MARKER));
+        assert!(!SCRUB_MARKER.starts_with(SCRUB_UNAVAILABLE_MARKER));
+        assert_eq!(parse_scrub_total("###TRIPLE-C-SCRUB-UNAVAILABLE stat"), None);
+        assert!(parse_scrub_unavailable("###TRIPLE-C-SCRUBBED 0").is_none());
+    }
+
+    #[test]
+    fn the_scrub_exec_blanks_the_dynamic_linker_hooks() {
+        // The exec inherits the container's env, and a project's custom env
+        // vars are part of it: `LD_PRELOAD` is in none of the reserved
+        // families, so it reaches a root exec unfiltered and injects code into
+        // every tool the scrub runs, `PATH` reset or not.
+        for key in ["LD_PRELOAD", "LD_AUDIT", "LD_LIBRARY_PATH"] {
+            assert!(
+                SCRUB_EXEC_ENV.contains(&format!("{}=", key).as_str()),
+                "{} reaches the scrub exec from the container's env",
+                key
+            );
+            // Blanked, never given a value — an empty `LD_PRELOAD` is what
+            // glibc reads as "no preload".
+            assert!(!is_reserved_env_key(key), "the reserved list has changed shape");
+        }
+        for entry in SCRUB_EXEC_ENV {
+            assert!(entry.ends_with('='), "{} carries a value into the scrub", entry);
+        }
+    }
+
+    #[test]
+    fn the_scrub_script_hands_each_glob_over_unexpanded() {
+        let script = snapshot_scrub_script();
+        // Single-quoted at the call site: an unquoted `*` would be expanded
+        // against the script's own working directory before `scrub_in` ran.
+        assert!(script.contains("scrub_in '/tmp/claude-*' '-';"));
+        assert!(script.contains("scrub_in '/var/log/apt/*' '-';"));
+        assert!(script.contains("scrub_in '/tmp/triple-c-drops/*' '14';"));
+        // The parent/glob split happens in the shell, so every entry stays
+        // readable verbatim in the script rather than as a forked copy.
+        for pattern in SNAPSHOT_SCRUB_PATHS {
+            assert!(script.contains(pattern), "{} is not named in the script", pattern);
+        }
+        // Expanded inside the function, where the cwd is the validated
+        // directory, and quoted everywhere it is *used* so a filename with a
+        // space stays one argument.
+        assert!(script.contains("for p in $g; do"));
+        assert!(script.contains(r#"rm --one-file-system -rf -- "$p""#));
+        // `rm -rf /` would be catastrophic and is exactly what a botched
+        // interpolation produces.
+        assert!(!script.contains("rm -rf -- /\n"));
+        assert!(!script.contains(" / "));
+    }
+
+    /// The behavioural half of the C1 fix.
+    ///
+    /// The test this replaces asserted `!script.contains("/workspace")`, which
+    /// the exploited version passed: containment is a property of what the
+    /// paths resolve to at run time. Docker is not available everywhere the
+    /// suite runs, so a throwaway directory tree stands in for the container
+    /// and `snapshot_scrub_script_under` re-anchors the real generated script
+    /// onto it. Linux-only because the script uses GNU `stat -c` and `du -b`,
+    /// which is what it will always run against inside the image.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_scrub_script_refuses_a_symlinked_parent_and_still_reclaims_a_real_one() {
+        use std::fs;
+        use std::process::Command;
+
+        // Canonicalised: a TMPDIR that is itself a symlink would trip check 1
+        // and make every case pass by doing nothing at all.
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+
+        let mk = |rel: &str| fs::create_dir_all(root.join(rel)).expect("mkdir");
+        // The script calls its tools by absolute path, so the re-anchored copy
+        // needs them where it will look for them.
+        plant_scrub_tools(&root);
+        mk("tmp/triple-c-drops");
+        mk("var/log");
+        mk("var/lib/apt/lists");
+        mk("var/cache/apt/archives");
+        // Stands in for /workspace/{mount_name}: the user's own project,
+        // bind-mounted from the host.
+        mk("workspace/myproject/sub");
+        fs::write(root.join("workspace/myproject/precious.txt"), "do not delete").unwrap();
+        fs::write(root.join("workspace/myproject/sub/nested.txt"), "nor this").unwrap();
+
+        // Debris the scrub is supposed to take, so this cannot pass by
+        // refusing everything.
+        mk("tmp/claude-scratch");
+        fs::write(root.join("tmp/claude-scratch/blob"), vec![0u8; 64 * 1024]).unwrap();
+        fs::write(root.join("var/lib/apt/lists/deb.list"), vec![0u8; 32 * 1024]).unwrap();
+
+        // The attack, in the two shapes that were verified against a real
+        // container: a symlinked *parent* (a path component, resolved by both
+        // the glob and the `rm -rf`) and a symlinked *match* (safe already —
+        // `rm -rf -- link` unlinks the link — and pinned here so it stays so).
+        std::os::unix::fs::symlink(root.join("workspace/myproject"), root.join("var/log/apt"))
+            .unwrap();
+        std::os::unix::fs::symlink(
+            root.join("workspace/myproject"),
+            root.join("tmp/claude-link"),
+        )
+        .unwrap();
+
+        // The age gate on the user's own files: the one dropped a moment ago
+        // survives a recreation, the one from last month does not.
+        fs::write(root.join("tmp/triple-c-drops/fresh.txt"), "just dropped").unwrap();
+        fs::write(root.join("tmp/triple-c-drops/stale.txt"), vec![0u8; 8 * 1024]).unwrap();
+        let touched = Command::new("touch")
+            .arg("-d")
+            .arg("30 days ago")
+            .arg(root.join("tmp/triple-c-drops/stale.txt"))
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false);
+
+        let script = snapshot_scrub_script_under(&root_str);
+        let output = Command::new("/bin/sh")
+            .arg("-c")
+            .arg(&script)
+            .output()
+            .expect("run the generated script");
+        let stdout = String::from_utf8_lossy(&output.stdout).into_owned();
+        let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+
+        let exists = |rel: &str| root.join(rel).exists();
+        let survived = exists("workspace/myproject/precious.txt")
+            && exists("workspace/myproject/sub/nested.txt");
+        let debris_gone =
+            !exists("tmp/claude-scratch") && !exists("var/lib/apt/lists/deb.list");
+        let link_removed = fs::symlink_metadata(root.join("tmp/claude-link")).is_err();
+        let fresh_kept = exists("tmp/triple-c-drops/fresh.txt");
+        let stale_gone = !exists("tmp/triple-c-drops/stale.txt");
+        let total = parse_scrub_total(&stdout);
+
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            survived,
+            "the scrub followed a symlinked parent into a bind mount.\nstdout: {}\nstderr: {}\nscript:\n{}",
+            stdout, stderr, script
+        );
+        assert!(
+            debris_gone,
+            "the scrub stopped reclaiming anything.\nstdout: {}\nstderr: {}",
+            stdout, stderr
+        );
+        assert!(link_removed, "a symlinked match was left behind instead of unlinked");
+        assert!(fresh_kept, "a file dropped moments ago was scrubbed anyway");
+        if touched {
+            assert!(stale_gone, "an age-limited file well past its limit was kept");
+        }
+        let total = total.expect("the marker line is missing");
+        assert!(
+            total >= 96 * 1024,
+            "reported total {} is too small to have removed the planted debris",
+            total
+        );
+    }
+
+    /// Put the tools the re-anchored script resolves through its own `PATH`
+    /// where it will look for them.
+    ///
+    /// Symlinks to the real ones, so a test can replace exactly one — which is
+    /// how a mount point is simulated below without the privileges no test
+    /// process has.
+    #[cfg(target_os = "linux")]
+    fn plant_scrub_tools(root: &std::path::Path) {
+        plant_scrub_tools_in(root, "usr/bin");
+    }
+
+    /// [`plant_scrub_tools`] into a chosen directory of the test root.
+    ///
+    /// The script's `PATH` is `{root}/usr/bin:{root}/bin`, so `bin` is the
+    /// non-usr-merged layout — Alpine's — that H3 was a silent no-op on.
+    #[cfg(target_os = "linux")]
+    fn plant_scrub_tools_in(root: &std::path::Path, rel: &str) {
+        std::fs::create_dir_all(root.join(rel)).expect("mkdir the tool directory");
+        for tool in ["stat", "du", "find", "cut", "rm"] {
+            let real = ["/usr/bin", "/bin"]
+                .iter()
+                .map(|d| std::path::Path::new(d).join(tool))
+                .find(|c| c.exists())
+                .unwrap_or_else(|| panic!("no {} on this host to link", tool));
+            std::os::unix::fs::symlink(real, root.join(rel).join(tool))
+                .expect("link a tool into the test root");
+        }
+    }
+
+    /// The other half of C1: a mount at the *match* rather than at its parent.
+    ///
+    /// Checks 0–3 validate the parent and `rm --one-file-system` compares
+    /// against its own argument, so with the match itself a mount root there
+    /// was nothing left between the scrub and the mounted filesystem's
+    /// contents. Confirmed end to end before the fix — `docker run -v
+    /// vol:/tmp/claude-x` came back with the volume empty, and the same run
+    /// against a host directory bound at `/workspace/../tmp/claude-x` (the
+    /// target the daemon builds from a mount name of `../tmp/claude-x`) emptied
+    /// the host directory.
+    ///
+    /// A test process cannot mount anything — no `CAP_SYS_ADMIN`, and this
+    /// container refuses `unshare -Urm` as well — so the boundary is simulated
+    /// by the one thing that reports it: a `stat` that answers with a foreign
+    /// device for one directory. Both negative controls are asserted, so a
+    /// harness that had stopped being able to show the difference fails rather
+    /// than passing quietly.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_scrub_script_refuses_a_match_that_is_a_mount_point_and_ignores_a_shimmed_stat() {
+        use std::fs;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        fs::create_dir_all(root.join("tmp")).expect("mkdir");
+        plant_scrub_tools(&root);
+
+        // `claude-mounted` stands in for the user's project directory bound
+        // over a scratchpad path; `claude-real` is the debris the scrub is
+        // still expected to take, so nothing here can pass by refusing
+        // everything.
+        let seed = || {
+            fs::remove_dir_all(root.join("tmp/claude-mounted")).ok();
+            fs::remove_dir_all(root.join("tmp/claude-real")).ok();
+            fs::create_dir_all(root.join("tmp/claude-mounted/sub")).expect("mkdir");
+            fs::create_dir_all(root.join("tmp/claude-real")).expect("mkdir");
+            fs::write(root.join("tmp/claude-mounted/precious.txt"), "do not delete").unwrap();
+            fs::write(root.join("tmp/claude-mounted/sub/nested.txt"), "nor this").unwrap();
+            fs::write(root.join("tmp/claude-real/blob"), vec![0u8; 64 * 1024]).unwrap();
+        };
+        let mounted_survived = || {
+            root.join("tmp/claude-mounted/precious.txt").exists()
+                && root.join("tmp/claude-mounted/sub/nested.txt").exists()
+        };
+
+        // The kernel reports a mount point as a directory whose device differs
+        // from its parent's. This says exactly that, for one name, and
+        // otherwise answers honestly.
+        fs::remove_file(root.join("usr/bin/stat")).expect("drop the symlink to the real stat");
+        fs::write(
+            root.join("usr/bin/stat"),
+            "#!/bin/sh\nfor a in \"$@\"; do case \"$a\" in claude-mounted|*/claude-mounted) echo 999999; exit 0 ;; esac; done\nexec /usr/bin/stat \"$@\"\n",
+        )
+        .expect("overwrite the stat symlink with a stub");
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(root.join("usr/bin/stat"), fs::Permissions::from_mode(0o755))
+                .unwrap();
+        }
+
+        // A shim of the shape an agent can plant in its own home volume, first
+        // on `PATH`: one constant device makes every comparison agree.
+        let hostile = root.join("hostile");
+        fs::create_dir_all(&hostile).expect("mkdir");
+        fs::write(hostile.join("stat"), "#!/bin/sh\necho 1\n").unwrap();
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(hostile.join("stat"), fs::Permissions::from_mode(0o755)).unwrap();
+        }
+        // The shim first, then the test root's own tool directory: without the
+        // reset the script finds the shim, with it the script finds neither
+        // this `PATH` nor the shim.
+        let hostile_path = format!(
+            "{}:{}/usr/bin:/usr/bin:/bin",
+            hostile.display(),
+            root_str
+        );
+
+        let real = snapshot_scrub_script_under(&root_str);
+        // Negative control 1: the same script with check 4 deleted.
+        let without_match_check: String = real
+            .lines()
+            .filter(|l| !l.contains(r#"-- "$p" 2>/dev/null)" = "$rootdev" ] || continue;"#))
+            .map(|l| format!("{}\n", l))
+            .collect();
+        // Negative control 2: the same script with the `PATH` reset deleted,
+        // so its bare tool names resolve through whatever `PATH` says. This is
+        // what the scrub was before the reset existed, and the shim below owns
+        // it. (Naming the tools absolutely *also* defeated the shim — and was
+        // H3, because `/usr/bin/stat` is not where every image keeps `stat`.
+        // The reset defeats it without that failure mode: the shim lives in
+        // the home volume, which the reset drops off `PATH` entirely, and uid
+        // 1000 cannot write `/usr/bin` or `/bin`.)
+        let without_path_reset: String = real
+            .lines()
+            .filter(|l| !l.starts_with("PATH="))
+            .map(|l| format!("{}\n", l))
+            .collect();
+
+        let run = |script: &str, path: &str| {
+            Command::new("/bin/sh")
+                .arg("-c")
+                .arg(script)
+                .env("PATH", path)
+                .output()
+                .expect("run the generated script")
+        };
+
+        seed();
+        let real_out = run(&real, &hostile_path);
+        let real_kept = mounted_survived();
+        let real_reclaimed = !root.join("tmp/claude-real/blob").exists();
+
+        seed();
+        run(&without_match_check, &hostile_path);
+        let no_check_kept = mounted_survived();
+
+        seed();
+        run(&without_path_reset, &hostile_path);
+        let bare_kept = mounted_survived();
+
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            !no_check_kept,
+            "the harness cannot tell the difference: the mount-point check was removed and the \
+             directory survived anyway, so the assertion below proves nothing"
+        );
+        assert!(
+            !bare_kept,
+            "the harness cannot tell the difference: the shimmed `stat` was reachable and did not \
+             change the outcome, so PATH hardening cannot be shown either way"
+        );
+        assert!(
+            real_kept,
+            "the scrub emptied a mount planted at the match.\nstdout: {}\nstderr: {}",
+            String::from_utf8_lossy(&real_out.stdout),
+            String::from_utf8_lossy(&real_out.stderr),
+        );
+        assert!(
+            real_reclaimed,
+            "the scrub stopped reclaiming a real scratchpad next to the mount"
+        );
+        assert_eq!(
+            parse_scrub_total(&String::from_utf8_lossy(&real_out.stdout)).map(|t| t >= 64 * 1024),
+            Some(true),
+            "the reported total does not account for the scratchpad that was removed"
+        );
+    }
+
+    /// M1: an `rm` that cannot bound a recursive delete stops the scrub; it
+    /// does not turn the scrub into an unbounded one.
+    ///
+    /// `--one-file-system` is the only thing between `rm -rf` run as root and a
+    /// mount planted *below* a match — the one position checks 0–4 cannot see,
+    /// because it is neither the parent they validate nor the match they
+    /// `stat`. It used to be probed into `$rmopt`, and every busybox- or
+    /// toybox-derived `rm` leaves that empty (BusyBox 1.38 answers
+    /// `unrecognized option '--one-file-system'` and exits 1, measured), so the
+    /// guard was absent on exactly the images that reach this code through
+    /// `ImageSource::Custom` — and the run still reported `Reclaimed(n)`.
+    ///
+    /// The `rm` planted here answers the way busybox's does. The negative
+    /// control is the shape this replaces, rebuilt from the real script: it
+    /// deletes, which is what makes the assertion that the real script does not
+    /// mean anything.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn an_rm_without_the_cross_filesystem_guard_stops_the_scrub() {
+        use std::fs;
+        use std::os::unix::fs::PermissionsExt;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        plant_scrub_tools(&root);
+
+        let real_rm = ["/usr/bin/rm", "/bin/rm"]
+            .iter()
+            .find(|c| std::path::Path::new(c).exists())
+            .expect("an rm on this host")
+            .to_string();
+        fs::remove_file(root.join("usr/bin/rm")).expect("drop the symlink to the real rm");
+        fs::write(
+            root.join("usr/bin/rm"),
+            format!(
+                "#!/bin/sh\nfor a in \"$@\"; do case \"$a\" in --one-file-system) echo \"rm: \
+                 unrecognized option '--one-file-system'\" >&2; exit 1 ;; esac; done\nexec {rm} \
+                 \"$@\"\n",
+                rm = real_rm
+            ),
+        )
+        .expect("plant a busybox-shaped rm");
+        fs::set_permissions(root.join("usr/bin/rm"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        let seed = || {
+            fs::remove_dir_all(root.join("tmp")).ok();
+            fs::create_dir_all(root.join("tmp/claude-scratch")).expect("mkdir");
+            fs::write(root.join("tmp/claude-scratch/blob"), vec![0u8; 64 * 1024]).unwrap();
+        };
+
+        let script = snapshot_scrub_script_under(&root_str);
+        // The pre-M1 shape: the flag asked for with `--help` and kept in a
+        // variable, which this `rm` leaves empty.
+        let fail_open = script
+            .replace(
+                r#"command -v rm >/dev/null 2>&1 && { rm --one-file-system -f -- '' >/dev/null 2>&1 || missing="$missing rm-one-file-system"; };"#,
+                "rmopt=;\nrm --one-file-system --help >/dev/null 2>&1 && rmopt=--one-file-system;",
+            )
+            .replace(r#"rm --one-file-system -rf -- "$p""#, r#"rm -rf $rmopt -- "$p""#);
+        assert_ne!(fail_open, script, "the control was rebuilt from stale text");
+
+        let run = |sh: &str| {
+            Command::new("/bin/sh")
+                .arg("-c")
+                .arg(sh)
+                .output()
+                .expect("run the generated script")
+        };
+
+        seed();
+        let control = run(&fail_open);
+        let control_deleted = !root.join("tmp/claude-scratch").exists();
+
+        seed();
+        let real = run(&script);
+        let real_out = String::from_utf8_lossy(&real.stdout).into_owned();
+        let real_kept = root.join("tmp/claude-scratch/blob").exists();
+
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            control_deleted,
+            "the harness cannot tell the difference: the fail-open shape deleted nothing either, \
+             so the assertions below prove nothing.\nstdout: {}\nstderr: {}",
+            String::from_utf8_lossy(&control.stdout),
+            String::from_utf8_lossy(&control.stderr),
+        );
+        assert!(
+            real_kept,
+            "the scrub deleted as root with no cross-filesystem bound.\nstdout: {}\nstderr: {}",
+            real_out,
+            String::from_utf8_lossy(&real.stderr),
+        );
+        // And it is loud about it: a refusal must never render as the `0` a
+        // healthy container with nothing to clean prints.
+        assert_eq!(
+            parse_scrub_total(&real_out),
+            None,
+            "a scrub that refused to run still printed a total: {}",
+            real_out
+        );
+        let reason = parse_scrub_unavailable(&real_out)
+            .unwrap_or_else(|| panic!("no unavailable marker in: {}", real_out));
+        assert!(
+            reason.contains("--one-file-system"),
+            "the reason does not name the guard that is missing: {}",
+            reason
+        );
+    }
+
+    /// M1, the other half: the guard is attached to the delete that actually
+    /// runs, not merely to the script text.
+    ///
+    /// The only assertion this position had was that the string
+    /// `rm -rf $rmopt -- "$p"` appeared in the script — which says nothing
+    /// about what `rm` is handed once the shell has expanded it, and an empty
+    /// `$rmopt` was precisely the defect. So the `rm` the script resolves
+    /// records its own argv here and the argv is what is asserted.
+    ///
+    /// A test process cannot create the mount that would exercise the flag for
+    /// real — no `CAP_SYS_ADMIN`, and this container refuses `unshare -Urm` as
+    /// well — so "the flag is honoured at a nested boundary" is measured in
+    /// containers and recorded on [`snapshot_scrub_script_under`]. "The flag is
+    /// there at all, on every match" is this.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn every_delete_reaches_rm_with_the_cross_filesystem_guard_attached() {
+        use std::fs;
+        use std::os::unix::fs::PermissionsExt;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        plant_scrub_tools(&root);
+
+        let real_rm = ["/usr/bin/rm", "/bin/rm"]
+            .iter()
+            .find(|c| std::path::Path::new(c).exists())
+            .expect("an rm on this host")
+            .to_string();
+        let argv_log = root.join("argv");
+        fs::remove_file(root.join("usr/bin/rm")).expect("drop the symlink to the real rm");
+        fs::write(
+            root.join("usr/bin/rm"),
+            format!(
+                "#!/bin/sh\nprintf '%s\\n' \"$*\" >> {log}\nexec {rm} \"$@\"\n",
+                log = argv_log.display(),
+                rm = real_rm
+            ),
+        )
+        .expect("plant an argv-recording rm");
+        fs::set_permissions(root.join("usr/bin/rm"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        // Two matches of the same pattern, so "the flag is on the first one"
+        // cannot pass for "the flag is on every one".
+        let seed = || {
+            fs::remove_file(&argv_log).ok();
+            fs::remove_dir_all(root.join("tmp")).ok();
+            for name in ["tmp/claude-a", "tmp/claude-b"] {
+                fs::create_dir_all(root.join(name)).expect("mkdir");
+                fs::write(root.join(name).join("blob"), vec![0u8; 32 * 1024]).unwrap();
+            }
+        };
+        // Only the deletes, not the `rm --one-file-system -f -- ''` probe.
+        let deletes = || -> Vec<String> {
+            fs::read_to_string(&argv_log)
+                .unwrap_or_default()
+                .lines()
+                .filter(|l| l.contains("claude-"))
+                .map(|l| l.to_string())
+                .collect()
+        };
+
+        let script = snapshot_scrub_script_under(&root_str);
+        let unguarded = script.replace(
+            r#"rm --one-file-system -rf -- "$p""#,
+            r#"rm -rf -- "$p""#,
+        );
+        assert_ne!(unguarded, script, "the control was rebuilt from stale text");
+
+        let run = |sh: &str| {
+            Command::new("/bin/sh")
+                .arg("-c")
+                .arg(sh)
+                .output()
+                .expect("run the generated script")
+        };
+
+        seed();
+        run(&script);
+        let guarded_argv = deletes();
+
+        seed();
+        run(&unguarded);
+        let unguarded_argv = deletes();
+
+        fs::remove_dir_all(&root).ok();
+
+        assert_eq!(
+            guarded_argv.len(),
+            2,
+            "both matches should have reached rm exactly once: {:?}",
+            guarded_argv
+        );
+        assert!(
+            unguarded_argv.len() == 2
+                && unguarded_argv.iter().all(|a| !a.contains("--one-file-system")),
+            "the harness cannot tell the difference: stripping the flag from the script did not \
+             change the argv rm was handed: {:?}",
+            unguarded_argv
+        );
+        for argv in &guarded_argv {
+            assert!(
+                argv.starts_with("--one-file-system "),
+                "a delete reached rm without the cross-filesystem guard: {:?}",
+                guarded_argv
+            );
+        }
+    }
+
+    /// M2: the script cannot be steered by a shell function, because the shell
+    /// that runs it has no environment to import one from.
+    ///
+    /// `bash` builds shell functions out of environment variables named
+    /// `BASH_FUNC_<name>%%`, and function lookup happens *before* `PATH` — so
+    /// the `PATH` reset is no defence, and `command -v` reports the function as
+    /// found, which walks the planted function straight through the
+    /// prerequisite probe. Nor is any in-script answer one: `[`, `pwd`, `cd`,
+    /// `command` and `unset` all import just as readily (measured on `bash`
+    /// 5.2), which is checks 0–2 and both of the things that would remove the
+    /// function.
+    ///
+    /// The shipped image's `/bin/sh` is `dash`, which imports nothing, so this
+    /// is latent there — but the Dockerfile does not pin `/bin/sh` and the base
+    /// is inherited from `ubuntu:24.04`, and `ImageSource::Custom` takes any
+    /// image at all. So the inner shell is `bash` here on purpose: it stands in
+    /// for the image where this is not latent, and it is the only way to show
+    /// that what protects the script is `env -i` rather than the accident of
+    /// `dash` being what `/bin/sh` points at.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_planted_shell_function_cannot_answer_the_containment_checks() {
+        use std::fs;
+        use std::os::unix::fs::PermissionsExt;
+        use std::process::Command;
+
+        let bash = ["/usr/bin/bash", "/bin/bash"]
+            .iter()
+            .find(|c| std::path::Path::new(c).exists())
+            .expect("a bash on this host to stand in for an image whose /bin/sh is bash")
+            .to_string();
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        fs::create_dir_all(root.join("tmp")).expect("mkdir");
+        plant_scrub_tools(&root);
+
+        // The same simulation the mount-at-the-match test uses: a `stat` that
+        // reports a foreign device for one name is what the kernel reports for
+        // a mount point, and no test process can make a real one.
+        fs::remove_file(root.join("usr/bin/stat")).expect("drop the symlink to the real stat");
+        fs::write(
+            root.join("usr/bin/stat"),
+            "#!/bin/sh\nfor a in \"$@\"; do case \"$a\" in claude-mounted|*/claude-mounted) echo 999999; exit 0 ;; esac; done\nexec /usr/bin/stat \"$@\"\n",
+        )
+        .expect("overwrite the stat symlink with a stub");
+        fs::set_permissions(root.join("usr/bin/stat"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        let seed = || {
+            fs::remove_dir_all(root.join("tmp/claude-mounted")).ok();
+            fs::remove_dir_all(root.join("tmp/claude-real")).ok();
+            fs::create_dir_all(root.join("tmp/claude-mounted/sub")).expect("mkdir");
+            fs::create_dir_all(root.join("tmp/claude-real")).expect("mkdir");
+            fs::write(root.join("tmp/claude-mounted/precious.txt"), "do not delete").unwrap();
+            fs::write(root.join("tmp/claude-mounted/sub/nested.txt"), "nor this").unwrap();
+            fs::write(root.join("tmp/claude-real/blob"), vec![0u8; 64 * 1024]).unwrap();
+        };
+        let mounted_survived = || {
+            root.join("tmp/claude-mounted/precious.txt").exists()
+                && root.join("tmp/claude-mounted/sub/nested.txt").exists()
+        };
+
+        let script = snapshot_scrub_script_under(&root_str);
+        // Production's bootstrap with the inner shell swapped for `bash`, i.e.
+        // the image where `/bin/sh` is bash. Nothing else about it changes.
+        let as_bash = |b: &str| b.replace("/bin/sh -c", &format!("{} -c", bash));
+        let bootstrap = as_bash(SCRUB_BOOTSTRAP);
+        // Negative control: the same bootstrap without the `-i`, which is the
+        // one character that separates "the inner shell has no environment"
+        // from "the inner shell has the caller's".
+        let without_env_reset = bootstrap.replace("env -i ", "env ");
+        assert_ne!(without_env_reset, bootstrap, "the control was rebuilt from stale text");
+
+        // One function is enough to own checks 3 and 4; the rest are there to
+        // show the bootstrap does not care how many of them there are.
+        let hostile: &[(&str, &str)] = &[
+            ("BASH_FUNC_stat%%", "() { echo 1; }"),
+            ("BASH_FUNC_command%%", "() { echo shadowed; }"),
+            ("BASH_FUNC_unset%%", "() { :; }"),
+            ("BASH_FUNC_[%%", "() { :; }"),
+            ("BASH_FUNC_pwd%%", "() { echo /; }"),
+            ("BASH_FUNC_cd%%", "() { :; }"),
+        ];
+        let run = |boot: &str, planted: &[(&str, &str)]| {
+            let mut c = Command::new(&bash);
+            c.arg("-c").arg(boot).arg("triple-c-scrub").arg(&script);
+            for (k, v) in planted {
+                c.env(k, v);
+            }
+            c.output().expect("run the bootstrap")
+        };
+
+        seed();
+        let control = run(&without_env_reset, &hostile[..1]);
+        let control_kept = mounted_survived();
+
+        seed();
+        let real = run(&bootstrap, &hostile[..1]);
+        let real_out = String::from_utf8_lossy(&real.stdout).into_owned();
+        let real_kept = mounted_survived();
+        let real_reclaimed = !root.join("tmp/claude-real/blob").exists();
+
+        seed();
+        let swarm = run(&bootstrap, hostile);
+        let swarm_out = String::from_utf8_lossy(&swarm.stdout).into_owned();
+        let swarm_kept = mounted_survived();
+        let swarm_reclaimed = !root.join("tmp/claude-real/blob").exists();
+
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            !control_kept,
+            "the harness cannot tell the difference: a planted `stat` function reached an inner \
+             shell with the environment intact and the mount survived anyway, so the assertions \
+             below prove nothing.\nstdout: {}\nstderr: {}",
+            String::from_utf8_lossy(&control.stdout),
+            String::from_utf8_lossy(&control.stderr),
+        );
+        assert!(
+            real_kept,
+            "a planted shell function answered the containment checks.\nstdout: {}\nstderr: {}",
+            real_out,
+            String::from_utf8_lossy(&real.stderr),
+        );
+        assert!(real_reclaimed, "the scrub stopped reclaiming a real scratchpad");
+        assert_eq!(
+            parse_scrub_total(&real_out).map(|t| t >= 64 * 1024),
+            Some(true),
+            "the reported total does not account for the scratchpad that was removed: {}",
+            real_out
+        );
+        // And with every builtin the script leans on shadowed at once, it is
+        // still the script's own answers that decide.
+        assert!(
+            swarm_kept && swarm_reclaimed,
+            "a shadowed `[`/`pwd`/`cd`/`command`/`unset` changed what the scrub did.\nstdout: {}\nstderr: {}",
+            swarm_out,
+            String::from_utf8_lossy(&swarm.stderr),
+        );
+        assert_eq!(parse_scrub_total(&swarm_out).map(|t| t >= 64 * 1024), Some(true));
+    }
+
+    /// M2, the structural half: the exec hands the script over as an argument
+    /// to a shell that was started with no environment.
+    #[test]
+    fn the_scrub_exec_starts_its_shell_with_an_empty_environment() {
+        let script = snapshot_scrub_script();
+        let cmd = scrub_exec_cmd(&script);
+
+        assert_eq!(cmd.len(), 5);
+        assert_eq!(cmd[0], "/bin/sh");
+        assert_eq!(cmd[1], "-c");
+        assert_eq!(cmd[2], SCRUB_BOOTSTRAP);
+        // As `$1`, never spliced into the bootstrap: the script is full of
+        // single quotes and it runs `rm -rf` as root, so a nested-quoting bug
+        // there is the whole class of defect this module keeps having.
+        assert_eq!(cmd[4], script);
+        assert!(
+            !cmd[2].contains("scrub_in"),
+            "the script is interpolated into the bootstrap: {}",
+            cmd[2]
+        );
+        assert!(cmd[2].contains(r#"/usr/bin/env -i PATH=/usr/bin:/bin /bin/sh -c "$1""#));
+        // H3's lesson kept: `env` is no more usr-merged than `stat` is, and a
+        // hardcoded path that is simply absent must not be the quiet answer.
+        assert!(cmd[2].contains(r#"/bin/env -i PATH=/usr/bin:/bin /bin/sh -c "$1""#));
+        assert!(cmd[2].contains("case $? in 127)"));
+        // Everything the *outer* shell evaluates has to be a reserved word, a
+        // parameter expansion, or a command word containing a `/` — those are
+        // the three things a planted function cannot reach, and `bash` refuses
+        // to import a function whose name has a `/` in it.
+        assert_eq!(
+            cmd[2].matches("env -i").count(),
+            cmd[2].matches("/env -i").count(),
+            "the bootstrap calls `env` by a bare name: {}",
+            cmd[2]
+        );
+        assert_eq!(
+            cmd[2].matches("sh -c").count(),
+            cmd[2].matches("/sh -c").count(),
+            "the bootstrap calls `sh` by a bare name: {}",
+            cmd[2]
+        );
+
+        // And the one caller builds its argv here rather than assembling its
+        // own. Everything above is a property of `scrub_exec_cmd`, and a call
+        // site that quietly went back to `/bin/sh -c script` would satisfy all
+        // of it while running the script in the environment this exists to
+        // keep away from it. The needle is assembled rather than written out
+        // so that this line is not itself the match.
+        let needle = format!("{}(&{}())", "scrub_exec_cmd", "snapshot_scrub_script");
+        assert!(
+            include_str!("container.rs").contains(&needle),
+            "the scrub exec no longer goes through the bootstrap"
+        );
+    }
+
+    /// H3, the behavioural half: a base image whose coreutils are not under
+    /// `/usr/bin`.
+    ///
+    /// Settings → Docker → **Custom** takes any image name, and on Alpine
+    /// `stat` and `rm` are in `/bin`. Measured in a real `alpine:latest`
+    /// container against the same seeded tree: the absolute-path script printed
+    /// `###TRIPLE-C-SCRUBBED 0` and left every planted file where it was, while
+    /// the `PATH`-resolved one reclaimed 73738 bytes. Both halves are asserted
+    /// here — the negative control is the script this replaced, rebuilt by
+    /// putting the `/usr/bin/` prefixes back — so a regression cannot pass by
+    /// the harness quietly losing the ability to tell them apart.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_scrub_finds_its_tools_when_coreutils_are_not_usr_merged() {
+        use std::fs;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+
+        // The whole point: `bin`, and deliberately no `usr/bin` at all.
+        plant_scrub_tools_in(&root, "bin");
+        assert!(!root.join("usr/bin").exists());
+
+        let seed = || {
+            fs::remove_dir_all(root.join("tmp")).ok();
+            fs::create_dir_all(root.join("tmp/claude-scratch")).expect("mkdir");
+            fs::write(root.join("tmp/claude-scratch/blob"), vec![0u8; 64 * 1024]).unwrap();
+        };
+
+        let script = snapshot_scrub_script_under(&root_str);
+        // The pre-fix shape, rebuilt: every tool named absolutely under a
+        // `/usr/bin` this root does not have.
+        let absolute: String = script
+            .replace(r#"$(stat "#, &format!("$({}/usr/bin/stat ", root_str))
+            .replace(
+                "\nrm --one-file-system -rf ",
+                &format!("\n{}/usr/bin/rm --one-file-system -rf ", root_str),
+            )
+            .replace(
+                "&& { rm --one-file-system",
+                &format!("&& {{ {}/usr/bin/rm --one-file-system", root_str),
+            )
+            .replace("$(du -sb", &format!("$({}/usr/bin/du -sb", root_str))
+            .replace("| cut -f1", &format!("| {}/usr/bin/cut -f1", root_str))
+            .replace("$(find ", &format!("$({}/usr/bin/find ", root_str))
+            .lines()
+            // The probe is what makes the pre-fix shape *loud*; the control has
+            // to be the quiet version it replaced, so drop it.
+            .filter(|l| !l.starts_with("for t in ") && !l.starts_with(r#"[ -z "$missing" ]"#))
+            .map(|l| format!("{}\n", l))
+            .collect();
+
+        let run = |sh: &str| {
+            Command::new("/bin/sh")
+                .arg("-c")
+                .arg(sh)
+                .output()
+                .expect("run the generated script")
+        };
+
+        seed();
+        let before = run(&absolute);
+        let before_out = String::from_utf8_lossy(&before.stdout).into_owned();
+        let before_kept = root.join("tmp/claude-scratch/blob").exists();
+
+        seed();
+        let after = run(&script);
+        let after_out = String::from_utf8_lossy(&after.stdout).into_owned();
+        let after_gone = !root.join("tmp/claude-scratch").exists();
+
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            before_kept,
+            "the harness cannot tell the difference: the absolute-path script reclaimed on a \
+             root with no /usr/bin, so this proves nothing.\nstdout: {}",
+            before_out
+        );
+        assert_eq!(
+            parse_scrub_total(&before_out),
+            Some(0),
+            "the control is supposed to be the *silent* failure — a clean-looking zero"
+        );
+        assert!(
+            after_gone,
+            "the scrub is still a no-op where coreutils are in /bin.\nstdout: {}\nstderr: {}",
+            after_out,
+            String::from_utf8_lossy(&after.stderr)
+        );
+        assert!(
+            parse_scrub_total(&after_out).unwrap_or(0) >= 64 * 1024,
+            "reported total {:?} does not account for the planted debris",
+            parse_scrub_total(&after_out)
+        );
+        assert!(parse_scrub_unavailable(&after_out).is_none());
+    }
+
+    /// H3's third silence: a scrub that could not run must not read as one that
+    /// ran and found nothing.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_scrub_that_cannot_find_its_tools_says_so_instead_of_reporting_zero() {
+        use std::fs;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        fs::create_dir_all(root.join("tmp/claude-scratch")).expect("mkdir");
+        fs::write(root.join("tmp/claude-scratch/blob"), vec![0u8; 64 * 1024]).unwrap();
+        // No tools planted anywhere: `PATH` names two directories that do not
+        // exist, which is what a base image the scrub cannot run in looks like.
+
+        let script = snapshot_scrub_script_under(&root_str);
+        let out = Command::new("/bin/sh")
+            .arg("-c")
+            .arg(&script)
+            .output()
+            .expect("run the generated script");
+        let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
+        let debris_kept = root.join("tmp/claude-scratch/blob").exists();
+        fs::remove_dir_all(&root).ok();
+
+        assert!(debris_kept, "the scrub deleted with no tools to validate with");
+        assert_eq!(
+            parse_scrub_total(&stdout),
+            None,
+            "a scrub that could not run still printed a total: {}",
+            stdout
+        );
+        let reason = parse_scrub_unavailable(&stdout)
+            .unwrap_or_else(|| panic!("no unavailable marker in: {}", stdout));
+        assert!(reason.contains("stat"), "the reason does not name what is missing: {}", reason);
+        // And the outcome the caller derives from it is not a success.
+        assert_ne!(ScrubOutcome::Unavailable, ScrubOutcome::Reclaimed(0));
+        assert!(!ScrubOutcome::Unavailable.commit_log_suffix().contains("MB"));
+    }
+
+    /// The byte total counts what a partly failed `rm` actually removed.
+    ///
+    /// `rm --one-file-system` walking into a match with a mount planted below
+    /// it removes everything else and exits non-zero. The old
+    /// `rm … && acc=$((acc + sz))` dropped the whole subtree from the figure,
+    /// so the one case the `--one-file-system` probe exists for was also the
+    /// one that under-reported. A mount cannot be created by a test process, so
+    /// the partial failure is produced the only other way it happens: an `rm`
+    /// that removes part of its argument and returns non-zero.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_byte_total_counts_what_a_partly_failed_rm_removed() {
+        use std::fs;
+        use std::os::unix::fs::PermissionsExt;
+        use std::process::Command;
+
+        let base = fs::canonicalize(std::env::temp_dir()).expect("a real temp dir");
+        let root = base.join(format!("triple-c-scrub-{}", uuid::Uuid::new_v4().simple()));
+        let root_str = root.to_str().expect("a UTF-8 temp path").to_string();
+        plant_scrub_tools(&root);
+        fs::create_dir_all(root.join("tmp/claude-partial")).expect("mkdir");
+        fs::write(root.join("tmp/claude-partial/gone"), vec![0u8; 64 * 1024]).unwrap();
+        fs::write(root.join("tmp/claude-partial/keep"), vec![0u8; 8 * 1024]).unwrap();
+
+        let real_rm = ["/usr/bin/rm", "/bin/rm"]
+            .iter()
+            .find(|c| std::path::Path::new(c).exists())
+            .expect("an rm on this host")
+            .to_string();
+        fs::remove_file(root.join("usr/bin/rm")).expect("drop the symlink to the real rm");
+        fs::write(
+            root.join("usr/bin/rm"),
+            format!(
+                "#!/bin/sh\nfor a in \"$@\"; do case \"$a\" in claude-partial) {rm} -rf -- \
+                 ./claude-partial/gone; exit 1 ;; esac; done\nexec {rm} \"$@\"\n",
+                rm = real_rm
+            ),
+        )
+        .expect("plant a partly-failing rm");
+        fs::set_permissions(root.join("usr/bin/rm"), fs::Permissions::from_mode(0o755)).unwrap();
+
+        let script = snapshot_scrub_script_under(&root_str);
+        let out = Command::new("/bin/sh")
+            .arg("-c")
+            .arg(&script)
+            .output()
+            .expect("run the generated script");
+        let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
+        let gone = !root.join("tmp/claude-partial/gone").exists();
+        let kept = root.join("tmp/claude-partial/keep").exists();
+        let total = parse_scrub_total(&stdout);
+        fs::remove_dir_all(&root).ok();
+
+        assert!(
+            gone && kept,
+            "the harness cannot tell the difference: the planted rm did not fail partly \
+             (gone={}, kept={})\nstdout: {}",
+            gone,
+            kept,
+            stdout
+        );
+        let total = total.expect("the marker line is missing");
+        assert!(
+            total >= 64 * 1024,
+            "a partly failed rm was counted as having reclaimed {} bytes",
+            total
+        );
+        // And what survived is not counted as reclaimed.
+        assert!(total < 72 * 1024, "the total {} counts bytes that are still there", total);
+    }
+
+    #[test]
+    fn the_scrub_total_is_read_back_from_the_marker_line() {
+        assert_eq!(
+            parse_scrub_total("some noise\n###TRIPLE-C-SCRUBBED 4812345\n"),
+            Some(4812345)
+        );
+        // Nothing reclaimed is a real answer and must not read as a failure.
+        assert_eq!(parse_scrub_total("###TRIPLE-C-SCRUBBED 0"), Some(0));
+        // No marker means the script never got to the end — a different thing
+        // from reclaiming nothing, and the caller logs it differently.
+        assert_eq!(parse_scrub_total("sh: du: not found"), None);
+        assert_eq!(parse_scrub_total(""), None);
+        // H3: and "could not run" is a third thing again, told apart by its
+        // own marker rather than by a total that looks healthy.
+        assert_eq!(
+            parse_scrub_total("###TRIPLE-C-SCRUB-UNAVAILABLE stat rm"),
+            None
+        );
+        let reason = parse_scrub_unavailable("noise\n###TRIPLE-C-SCRUB-UNAVAILABLE stat rm\n")
+            .expect("the unavailable marker");
+        assert!(reason.contains("stat, rm"), "{}", reason);
+        assert!(parse_scrub_unavailable("###TRIPLE-C-SCRUBBED 41").is_none());
+        assert!(parse_scrub_unavailable("").is_none());
+    }
+
+    #[test]
+    fn only_a_completed_scrub_reports_bytes() {
+        // M11: a stopped container is a skip, not a failure, and every outcome
+        // that is not a completed run has no figure to contribute at all —
+        // which is a stronger statement than the "contributes zero" this used
+        // to make, and the reason the zero stopped being printed.
+        assert_eq!(ScrubOutcome::NotRunning.commit_log_suffix(), "");
+        assert!(!ScrubOutcome::TimedOut.commit_log_suffix().contains("MB"));
+        assert!(!ScrubOutcome::Failed.commit_log_suffix().contains("MB"));
+        assert!(!ScrubOutcome::Unavailable.commit_log_suffix().contains("MB"));
+        assert!(ScrubOutcome::Reclaimed(4096)
+            .commit_log_suffix()
+            .contains("MB"));
+        assert_ne!(ScrubOutcome::NotRunning, ScrubOutcome::Failed);
+        assert_ne!(ScrubOutcome::Unavailable, ScrubOutcome::Reclaimed(0));
+    }
+
+    #[test]
+    fn a_skipped_scrub_reports_no_reclaim_figure() {
+        // Every migration logged "0.00 MB dropped by the pre-commit scrub":
+        // the migration path scrubs the container while it is still running and
+        // stops it before committing, so this second call has nothing to exec
+        // into. A zero there reads as a scrub that ran and found nothing.
+        assert_eq!(ScrubOutcome::NotRunning.commit_log_suffix(), "");
+        assert!(!ScrubOutcome::TimedOut.commit_log_suffix().contains("MB"));
+        assert!(!ScrubOutcome::Failed.commit_log_suffix().contains("MB"));
+        // A scrub that really ran still reports, zero included — but H3 is
+        // that "0.00 MB dropped" was also what a scrub that *could not run*
+        // printed, and the two must not render the same. A genuine zero says it
+        // ran; the broken one says it could not.
+        let ran = ScrubOutcome::Reclaimed(0).commit_log_suffix();
+        assert!(ran.contains("ran"), "{}", ran);
+        assert!(!ran.contains("MB"), "a zero that reads as a figure: {}", ran);
+        let broken = ScrubOutcome::Unavailable.commit_log_suffix();
+        assert!(broken.contains("could not run"), "{}", broken);
+        assert_ne!(ran, broken);
+        assert!(ScrubOutcome::Reclaimed(2 * 1_048_576)
+            .commit_log_suffix()
+            .contains("2.00 MB"));
+    }
+
+    #[test]
+    fn the_scrub_cannot_hold_a_snapshot_up_indefinitely() {
+        // M12: the scrub is a `du -sb` plus an `rm -rf` over a tree a running
+        // agent may still be writing to, on the critical path of every
+        // recreate with the UI on "Saving container state…" and no cancel.
+        assert!(SCRUB_TIMEOUT.as_secs() >= 30, "too tight to survive a slow but healthy scrub");
+        assert!(SCRUB_TIMEOUT.as_secs() <= 300, "long enough that a user would force-quit first");
+    }
+
+    #[test]
+    fn every_container_is_created_with_a_bounded_log() {
+        let cfg = capped_log_config();
+        assert_eq!(cfg.typ.as_deref(), Some("json-file"));
+        let config = cfg.config.expect("a json-file driver with no config is unbounded");
+        assert_eq!(config.get("max-size").map(String::as_str), Some("10m"));
+        assert_eq!(config.get("max-file").map(String::as_str), Some("3"));
+    }
+
+    // ── Claude Code settings.json (Part B) ───────────────────────────────────
+
+    fn settings_json(s: Option<&ClaudeCodeSettings>, sandbox: bool) -> serde_json::Value {
+        serde_json::from_str(&build_claude_code_settings_json(s, sandbox))
+            .expect("the payload must be valid JSON — the entrypoint pipes it into jq")
+    }
+
+    /// The five keys that used to be emitted only when non-default, plus the
+    /// sandbox block that already knew better.
+    const MANAGED_SETTINGS_KEYS: &[&str] = &[
+        "tui",
+        "effortLevel",
+        "autoScrollEnabled",
+        "showThinkingSummaries",
+        "viewMode",
+        "awaySummaryEnabled",
+        "sandbox",
+    ];
+
+    #[test]
+    fn a_project_can_turn_a_globally_enabled_setting_back_off() {
+        // The whole reason the booleans are `Option<bool>`. Under the old
+        // `if p.x { true } else { g.x }` merge there was no project value that
+        // could produce `false` here.
+        let global = ClaudeCodeSettings {
+            focus_mode: Some(true),
+            env_scrub: Some(true),
+            prompt_caching_1h: Some(true),
+            ..Default::default()
+        };
+        let project = ClaudeCodeSettings {
+            focus_mode: Some(false),
+            ..Default::default()
+        };
+
+        let merged = merge_claude_code_settings(Some(&global), Some(&project)).unwrap();
+
+        assert_eq!(merged.focus_mode, Some(false), "project off must win");
+        // Untouched project fields still inherit.
+        assert_eq!(merged.env_scrub, Some(true));
+        assert_eq!(merged.prompt_caching_1h, Some(true));
+
+        // And it has to survive into what the container actually receives.
+        let payload = build_claude_code_settings_json(Some(&merged), false);
+        let v: serde_json::Value = serde_json::from_str(&payload).unwrap();
+        assert!(
+            v.get("viewMode").is_some_and(|m| m.is_null()),
+            "viewMode should be cleared, got {:?}",
+            v.get("viewMode")
+        );
+    }
+
+    #[test]
+    fn inherit_and_deliberate_off_fingerprint_differently() {
+        // If these collided, switching a project from "inherit" to an explicit
+        // "off" would not recreate the container and the change would silently
+        // not apply.
+        let inherit = ClaudeCodeSettings { focus_mode: None, ..Default::default() };
+        let off = ClaudeCodeSettings { focus_mode: Some(false), ..Default::default() };
+        assert_ne!(
+            compute_claude_code_settings_fingerprint(Some(&inherit), false),
+            compute_claude_code_settings_fingerprint(Some(&off), false),
+        );
+    }
+
+    #[test]
+    fn split_payload_never_emits_a_null_to_an_older_entrypoint() {
+        // An existing project recreates from its own snapshot, which carries
+        // whatever entrypoint it was built with. An older one merges with a
+        // plain `.[0] * .[1]`, so a null reaching it would be written into the
+        // user's settings.json verbatim instead of clearing the key.
+        let payload = build_claude_code_settings_json(None, false);
+        assert!(
+            payload.contains("null"),
+            "precondition: the unsplit payload uses null to mean delete"
+        );
+
+        let (set, clear) = split_claude_code_settings_payload(&payload);
+
+        let set_val: serde_json::Value = serde_json::from_str(&set).unwrap();
+        for (k, v) in set_val.as_object().unwrap() {
+            assert!(!v.is_null(), "key {} reached the merge half as a null", k);
+        }
+
+        let clear_val: serde_json::Value = serde_json::from_str(&clear).unwrap();
+        let cleared: Vec<&str> = clear_val
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|v| v.as_str().unwrap())
+            .collect();
+        // The four whose neutral state is genuinely "unset".
+        for k in ["tui", "effortLevel", "viewMode", "awaySummaryEnabled"] {
+            assert!(cleared.contains(&k), "{} should be cleared, not pinned", k);
+        }
+    }
+
+    #[test]
+    fn split_payload_keeps_every_key_exactly_once() {
+        // Nothing may be dropped or duplicated between the two halves, or a
+        // managed key would silently stop being asserted.
+        let settings = ClaudeCodeSettings {
+            tui_mode: Some("fullscreen".to_string()),
+            focus_mode: Some(true),
+            ..Default::default()
+        };
+        let payload = build_claude_code_settings_json(Some(&settings), true);
+        let original: serde_json::Value = serde_json::from_str(&payload).unwrap();
+
+        let (set, clear) = split_claude_code_settings_payload(&payload);
+        let set_val: serde_json::Value = serde_json::from_str(&set).unwrap();
+        let clear_val: serde_json::Value = serde_json::from_str(&clear).unwrap();
+
+        let mut seen: Vec<String> = set_val
+            .as_object()
+            .unwrap()
+            .keys()
+            .cloned()
+            .chain(
+                clear_val
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .map(|v| v.as_str().unwrap().to_string()),
+            )
+            .collect();
+        seen.sort();
+        let mut expected: Vec<String> = original.as_object().unwrap().keys().cloned().collect();
+        expected.sort();
+        assert_eq!(seen, expected);
+    }
+
+    #[test]
+    fn turning_a_setting_off_clears_it_rather_than_omitting_it() {
+        // This is the whole bug. `~/.claude/settings.json` lives on a persisted
+        // volume and the entrypoint merges into it, so a key that is merely
+        // *absent* when the setting is off leaves the previous on-value in
+        // place — the setting could never be turned back off short of a
+        // destructive Reset.
+        let on = ClaudeCodeSettings {
+            tui_mode: Some("fullscreen".to_string()),
+            effort: Some("xhigh".to_string()),
+            auto_scroll_disabled: Some(true),
+            focus_mode: Some(true),
+            show_thinking_summaries: Some(true),
+            session_recap_disabled: Some(true),
+            ..Default::default()
+        };
+        let hot = settings_json(Some(&on), true);
+        assert_eq!(hot["tui"], serde_json::json!("fullscreen"));
+        assert_eq!(hot["effortLevel"], serde_json::json!("xhigh"));
+        assert_eq!(hot["autoScrollEnabled"], serde_json::json!(false));
+        assert_eq!(hot["showThinkingSummaries"], serde_json::json!(true));
+        assert_eq!(hot["viewMode"], serde_json::json!("focus"));
+        assert_eq!(hot["awaySummaryEnabled"], serde_json::json!(false));
+        assert_eq!(hot["sandbox"]["enabled"], serde_json::json!(true));
+
+        // Now everything back to default. Every key must still be *present*,
+        // carrying either its neutral value or a null the entrypoint deletes.
+        let cold = settings_json(Some(&ClaudeCodeSettings::default()), false);
+        for key in MANAGED_SETTINGS_KEYS {
+            assert!(
+                cold.get(*key).is_some(),
+                "{} is missing when the setting is off, so a stale on-value survives the merge",
+                key
+            );
+        }
+        assert_eq!(cold["tui"], serde_json::Value::Null);
+        assert_eq!(cold["effortLevel"], serde_json::Value::Null);
+        assert_eq!(cold["autoScrollEnabled"], serde_json::json!(true));
+        assert_eq!(cold["showThinkingSummaries"], serde_json::json!(false));
+        assert_eq!(cold["viewMode"], serde_json::Value::Null);
+        assert_eq!(cold["awaySummaryEnabled"], serde_json::Value::Null);
+        assert_eq!(cold["sandbox"]["enabled"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn no_settings_struct_at_all_still_asserts_every_key() {
+        // "This project has no Claude Code settings" is not "say nothing" —
+        // the file on the config volume may still hold a previous project
+        // configuration's values.
+        let cold = settings_json(None, false);
+        for key in MANAGED_SETTINGS_KEYS {
+            assert!(cold.get(*key).is_some(), "{} is missing with no settings struct", key);
+        }
+    }
+
+    #[test]
+    fn the_settings_payload_uses_the_key_names_claude_code_actually_reads() {
+        let s = ClaudeCodeSettings {
+            effort: Some("high".to_string()),
+            focus_mode: Some(true),
+            ..Default::default()
+        };
+        let json = settings_json(Some(&s), false);
+        // `effort` and `focusMode` were both invented; Claude Code reads
+        // `effortLevel` and `viewMode`.
+        assert!(json.get("effort").is_none(), "`effort` is not a Claude Code setting");
+        assert!(json.get("focusMode").is_none(), "`focusMode` is not a Claude Code setting");
+        assert_eq!(json["effortLevel"], serde_json::json!("high"));
+        assert_eq!(json["viewMode"], serde_json::json!("focus"));
+    }
+
+    #[test]
+    fn tui_can_be_pinned_to_the_classic_renderer_as_well_as_left_automatic() {
+        // Three distinct states; "automatic" is not "classic".
+        let auto = settings_json(Some(&ClaudeCodeSettings::default()), false);
+        assert_eq!(auto["tui"], serde_json::Value::Null);
+
+        let classic = settings_json(
+            Some(&ClaudeCodeSettings {
+                tui_mode: Some("default".to_string()),
+                ..Default::default()
+            }),
+            false,
+        );
+        assert_eq!(classic["tui"], serde_json::json!("default"));
+    }
+
+    #[test]
+    fn a_project_that_never_touched_session_recap_leaves_it_alone() {
+        // Claude Code's recap is on by default, so the zero value of the field
+        // has to be "don't interfere". Getting this backwards would have
+        // silently disabled recaps for every existing project.
+        let untouched = ClaudeCodeSettings::default();
+        assert_eq!(untouched.session_recap_disabled, None);
+        assert_eq!(
+            settings_json(Some(&untouched), false)["awaySummaryEnabled"],
+            serde_json::Value::Null
+        );
+    }
+
+    #[test]
+    fn a_disabled_setting_changes_the_recreation_fingerprint() {
+        // `container_needs_recreation` is label-based and never diffs env, so
+        // the settings only reach a container if the fingerprint moves.
+        let on = ClaudeCodeSettings {
+            focus_mode: Some(true),
+            ..Default::default()
+        };
+        let off = ClaudeCodeSettings::default();
+        assert_ne!(
+            compute_claude_code_settings_fingerprint(Some(&on), false),
+            compute_claude_code_settings_fingerprint(Some(&off), false),
+        );
+        let recap_off = ClaudeCodeSettings {
+            session_recap_disabled: Some(true),
+            ..Default::default()
+        };
+        assert_ne!(
+            compute_claude_code_settings_fingerprint(Some(&recap_off), false),
+            compute_claude_code_settings_fingerprint(Some(&off), false),
+        );
+    }
+
+    #[test]
+    fn the_claude_code_env_vars_are_reserved_from_custom_env() {
+        for key in [
+            "CLAUDE_CODE_NO_FLICKER",
+            "CLAUDE_CODE_ENABLE_AWAY_SUMMARY",
+            "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB",
+            "ENABLE_PROMPT_CACHING_1H",
+        ] {
+            assert!(is_reserved_env_key(key), "{} must not be hand-settable", key);
+            assert!(is_reserved_env_key(&key.to_lowercase()));
+        }
+    }
+
+    #[test]
+    fn every_claude_code_env_var_is_emitted_on_every_create() {
+        // `docker commit` bakes env into the snapshot image, so a name that
+        // goes missing when its setting is off keeps whatever the image
+        // carries. All four must appear whatever the settings say.
+        for settings in [None, Some(&ClaudeCodeSettings::default())] {
+            let emitted = claude_code_env_vars(settings);
+            let names: Vec<&str> = emitted
+                .iter()
+                .map(|entry| entry.split_once('=').expect("every entry is KEY=VALUE").0)
+                .collect();
+            for expected in [
+                "CLAUDE_CODE_NO_FLICKER",
+                "CLAUDE_CODE_ENABLE_AWAY_SUMMARY",
+                "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB",
+                "ENABLE_PROMPT_CACHING_1H",
+            ] {
+                assert!(names.contains(&expected), "{} was not emitted", expected);
+            }
+        }
+    }
+
+    #[test]
+    fn the_neutral_state_of_the_overriding_env_vars_is_empty_not_zero() {
+        // Both of these outrank a setting the user can change from inside the
+        // container, so their "off" has to be silence, not an instruction.
+        let vars = claude_code_env_vars(Some(&ClaudeCodeSettings::default()));
+        assert!(vars.contains(&"CLAUDE_CODE_NO_FLICKER=".to_string()));
+        assert!(vars.contains(&"CLAUDE_CODE_ENABLE_AWAY_SUMMARY=".to_string()));
+        // These two have no documented meaning for `0`, so it is safe to say.
+        assert!(vars.contains(&"CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0".to_string()));
+        assert!(vars.contains(&"ENABLE_PROMPT_CACHING_1H=0".to_string()));
+    }
+
+    #[test]
+    fn turning_the_session_recap_off_actually_forces_it_off() {
+        // The whole point of B3: `=1` when enabled was a no-op against a
+        // feature that was already on, and there was no off path at all.
+        let off = ClaudeCodeSettings {
+            session_recap_disabled: Some(true),
+            ..Default::default()
+        };
+        assert!(claude_code_env_vars(Some(&off))
+            .contains(&"CLAUDE_CODE_ENABLE_AWAY_SUMMARY=0".to_string()));
+    }
+
+    #[test]
+    fn the_tui_choice_reaches_the_env_var_that_outranks_the_setting() {
+        let fullscreen = ClaudeCodeSettings {
+            tui_mode: Some("fullscreen".to_string()),
+            ..Default::default()
+        };
+        assert!(claude_code_env_vars(Some(&fullscreen))
+            .contains(&"CLAUDE_CODE_NO_FLICKER=1".to_string()));
+
+        let classic = ClaudeCodeSettings {
+            tui_mode: Some("default".to_string()),
+            ..Default::default()
+        };
+        assert!(claude_code_env_vars(Some(&classic))
+            .contains(&"CLAUDE_CODE_NO_FLICKER=0".to_string()));
+    }
 }
diff --git a/app/src-tauri/src/docker/exec.rs b/app/src-tauri/src/docker/exec.rs
index 9095150..7804d92 100644
--- a/app/src-tauri/src/docker/exec.rs
+++ b/app/src-tauri/src/docker/exec.rs
@@ -301,21 +301,10 @@ impl ExecSessionManager {
     ) -> Result<String, String> {
         let docker = get_docker()?;
 
-        // Build a tar archive in memory containing the file
-        let mut tar_buf = Vec::new();
-        {
-            let mut builder = tar::Builder::new(&mut tar_buf);
-            let mut header = tar::Header::new_gnu();
-            header.set_size(data.len() as u64);
-            header.set_mode(0o644);
-            header.set_cksum();
-            builder
-                .append_data(&mut header, file_name, data)
-                .map_err(|e| format!("Failed to create tar entry: {}", e))?;
-            builder
-                .finish()
-                .map_err(|e| format!("Failed to finalize tar: {}", e))?;
-        }
+        // Owned by the container user, stamped now: a default tar header would
+        // land it as root:root/1970 and Claude Code could not rewrite it.
+        let (uid, gid) = container_user_ids(container_id).await;
+        let tar_buf = build_single_file_tar(file_name, data, 0o644, uid, gid, now_epoch_secs())?;
 
         docker
             .upload_to_container(
@@ -333,40 +322,85 @@ impl ExecSessionManager {
     }
 }
 
-/// Upload a host file into the container's `/tmp` under `dest_name`. The file is
+/// Ceiling on one host file packed into a container upload.
+///
+/// The file goes through host RAM twice — once as bytes, once inside the tar —
+/// so this is a memory bound, and it is checked against the *descriptor* that
+/// was opened rather than a `metadata` call that described whatever the path
+/// meant a moment earlier.
+pub const MAX_DROP_BYTES: u64 = 256 * 1024 * 1024;
+
+/// Upload a host file into `dest_dir` under `dest_name`. The file is
 /// read and packed into the tar inside a blocking task, so the synchronous IO
 /// runs off the async worker. The tar's declared entry size is taken from the
 /// bytes actually read (not a separate `stat`), so a file changing size between
 /// a size check and the read can't desync the header and corrupt the archive.
-/// Returns the in-container path (`/tmp/<dest_name>`).
+/// Returns the in-container path (`<dest_dir>/<dest_name>`).
+///
+/// `dest_dir` must already exist and must already have been checked by the
+/// caller — Docker's archive extractor writes wherever it is pointed. The two
+/// callers both do that first, by different routes because they are answering
+/// different questions: the terminal drop stages into a fixed `/tmp` path it
+/// creates itself, and the Files pane passes the directory the user is looking
+/// at, which `file_commands::resolve_container_dir` has already confirmed
+/// resolves inside `CONTAINER_WRITE_ROOTS`.
 pub async fn upload_host_file_to_container(
     container_id: &str,
     host_path: &str,
+    dest_dir: &str,
     dest_name: &str,
+) -> Result<String, String> {
+    let ids = container_user_ids(container_id).await;
+    upload_host_file_with_ids(container_id, host_path, dest_dir, dest_name, ids).await
+}
+
+/// [`upload_host_file_to_container`] for a caller that already knows the
+/// container user's ids.
+///
+/// `container_user_ids` is a `docker exec`, and the Files pane's upload is a
+/// *selection* — one dialog can hand back twenty files. Resolving the ids per
+/// file made twenty extra round trips to answer the same `id -u` twenty times,
+/// which is seconds of latency for a fact that cannot change inside one
+/// container's lifetime. So the loop resolves once and passes the answer in.
+/// The wrapper above keeps the single-file callers unchanged.
+pub async fn upload_host_file_with_ids(
+    container_id: &str,
+    host_path: &str,
+    dest_dir: &str,
+    dest_name: &str,
+    (uid, gid): (u64, u64),
 ) -> Result<String, String> {
     let host_path = host_path.to_string();
     let dest_name = dest_name.to_string();
     let dest_for_blk = dest_name.clone();
+    let mtime = now_epoch_secs();
 
     let tar_buf = tokio::task::spawn_blocking(move || -> Result<Vec<u8>, String> {
-        let data = std::fs::read(&host_path)
+        // The caller resolved this path (`resolve_host_read_path`); opening it
+        // is a second trip through the same directories, so the descriptor is
+        // checked against the path that was validated before its bytes are
+        // packed into anything. Two paths reach here: the terminal's drop
+        // target, and the Files pane's upload via `upload_host_file_with_ids`.
+        // Between them they are how host bytes enter a container.
+        let file = std::fs::File::open(&host_path)
             .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
-        let mut tar_buf = Vec::with_capacity(data.len() + 1024);
-        {
-            let mut builder = tar::Builder::new(&mut tar_buf);
-            let mut header = tar::Header::new_gnu();
-            // Size comes from the bytes in hand, so header and payload can't disagree.
-            header.set_size(data.len() as u64);
-            header.set_mode(0o644);
-            header.set_cksum();
-            builder
-                .append_data(&mut header, &dest_for_blk, &data[..])
-                .map_err(|e| format!("Failed to create tar entry: {}", e))?;
-            builder
-                .finish()
-                .map_err(|e| format!("Failed to finalize tar: {}", e))?;
+        crate::commands::file_commands::verify_opened_path(
+            &file,
+            std::path::Path::new(&host_path),
+        )?;
+        let mut data = Vec::new();
+        std::io::Read::read_to_end(
+            &mut std::io::Read::take(file, MAX_DROP_BYTES.saturating_add(1)),
+            &mut data,
+        )
+        .map_err(|e| format!("Failed to read {}: {}", host_path, e))?;
+        if data.len() as u64 > MAX_DROP_BYTES {
+            return Err(format!(
+                "File too large to upload (limit {} MB)",
+                MAX_DROP_BYTES / (1024 * 1024)
+            ));
         }
-        Ok(tar_buf)
+        build_single_file_tar(&dest_for_blk, &data[..], 0o644, uid, gid, mtime)
     })
     .await
     .map_err(|e| format!("Upload task panicked: {}", e))??;
@@ -376,7 +410,7 @@ pub async fn upload_host_file_to_container(
         .upload_to_container(
             container_id,
             Some(UploadToContainerOptions {
-                path: "/tmp".to_string(),
+                path: dest_dir.to_string(),
                 ..Default::default()
             }),
             tar_buf.into(),
@@ -384,7 +418,17 @@ pub async fn upload_host_file_to_container(
         .await
         .map_err(|e| format!("Failed to upload file to container: {}", e))?;
 
-    Ok(format!("/tmp/{}", dest_name))
+    Ok(container_join(dest_dir, &dest_name))
+}
+
+/// Join a container directory to a name that may itself carry separators.
+///
+/// Only the *reported* path — the bytes have already landed by the time this is
+/// called — but that path is what the terminal echoes and what the Files pane
+/// puts in its toast, so `/tmp//x` reading back as a different file than `/tmp/x`
+/// is worth the four lines. `"/"` trims to `""` and yields `/x`.
+fn container_join(dir: &str, name: &str) -> String {
+    format!("{}/{}", dir.trim_end_matches('/'), name.trim_start_matches('/'))
 }
 
 /// Write `data` into the container at `<dest_dir>/<file_name>` with `mode`.
@@ -402,20 +446,10 @@ pub async fn upload_bytes_to_container(
 ) -> Result<String, String> {
     let docker = get_docker()?;
 
-    let mut tar_buf = Vec::with_capacity(data.len() + 1024);
-    {
-        let mut builder = tar::Builder::new(&mut tar_buf);
-        let mut header = tar::Header::new_gnu();
-        header.set_size(data.len() as u64);
-        header.set_mode(mode);
-        header.set_cksum();
-        builder
-            .append_data(&mut header, file_name, data)
-            .map_err(|e| format!("Failed to create tar entry: {}", e))?;
-        builder
-            .finish()
-            .map_err(|e| format!("Failed to finalize tar: {}", e))?;
-    }
+    // Root-owned on purpose: the only caller is migration, whose `tar -T` list
+    // is read back as root. The mtime still gets stamped so the file doesn't
+    // read as 1970.
+    let tar_buf = build_single_file_tar(file_name, data, mode, 0, 0, now_epoch_secs())?;
 
     docker
         .upload_to_container(
@@ -432,6 +466,74 @@ pub async fn upload_bytes_to_container(
     Ok(format!("{}/{}", dest_dir.trim_end_matches('/'), file_name))
 }
 
+/// Build an in-memory tar archive holding a single regular file.
+///
+/// The uid/gid/mtime arguments exist because `tar::Header::new_gnu()` zeroes
+/// them and Docker's archive extractor honours the header verbatim: a header
+/// left at the defaults lands the file inside the container as `root:root`
+/// with a 1970-01-01 mtime — not writable by `claude`, and confusing in any
+/// listing. Callers that upload on a user's behalf should pass the container
+/// user's ids from [`container_user_ids`].
+pub fn build_single_file_tar(
+    file_name: &str,
+    data: &[u8],
+    mode: u32,
+    uid: u64,
+    gid: u64,
+    mtime: u64,
+) -> Result<Vec<u8>, String> {
+    let mut tar_buf = Vec::with_capacity(data.len() + 1024);
+    {
+        let mut builder = tar::Builder::new(&mut tar_buf);
+        let mut header = tar::Header::new_gnu();
+        // Size comes from the bytes in hand, so header and payload can't disagree.
+        header.set_size(data.len() as u64);
+        header.set_mode(mode);
+        header.set_uid(uid);
+        header.set_gid(gid);
+        header.set_mtime(mtime);
+        header.set_cksum();
+        builder
+            .append_data(&mut header, file_name, data)
+            .map_err(|e| format!("Failed to create tar entry: {}", e))?;
+        builder
+            .finish()
+            .map_err(|e| format!("Failed to finalize tar: {}", e))?;
+    }
+    Ok(tar_buf)
+}
+
+/// Seconds since the Unix epoch, for a tar header mtime.
+pub fn now_epoch_secs() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+/// The numeric uid/gid of the container's `claude` user.
+///
+/// It is not a constant: `entrypoint.sh` remaps `claude` to the *host* user's
+/// ids on Unix so bind-mounted project files stay writable, and deliberately
+/// does not on Windows. So the only reliable answer comes from asking the
+/// container. Falls back to 1000:1000 (the image's build-time ids) if the exec
+/// fails, which is strictly better than the 0:0 a default tar header carries.
+pub async fn container_user_ids(container_id: &str) -> (u64, u64) {
+    let out = exec_oneshot_limited(
+        container_id,
+        vec!["sh".to_string(), "-c".to_string(), "id -u; id -g".to_string()],
+        256,
+    )
+    .await
+    .unwrap_or_default();
+
+    let mut ids = out.lines().filter_map(|l| l.trim().parse::<u64>().ok());
+    match (ids.next(), ids.next()) {
+        (Some(uid), Some(gid)) => (uid, gid),
+        _ => (1000, 1000),
+    }
+}
+
 /// Ceiling on how much container output a one-shot exec will buffer into the
 /// host process.
 ///
@@ -450,14 +552,31 @@ pub const MAX_ONESHOT_OUTPUT: usize = 8 * 1024 * 1024;
 /// past anything genuine, far short of a problem.
 pub const PROC_NET_OUTPUT_LIMIT: usize = 1024 * 1024;
 
-/// Append to `buf` while it stays inside `limit`. Returns `false` once the
-/// limit is exceeded, at which point the caller must stop reading.
-fn push_capped(buf: &mut String, chunk: &str, limit: usize) -> bool {
+/// Marker on the "that command printed more than this will buffer" refusal.
+///
+/// The byte count on its own is a fact about the transport, not about what the
+/// user did — "Command output exceeded 8388608 bytes" is not a sentence anybody
+/// can act on. A caller that knows what it was reading can recognise this and
+/// say the useful thing instead; see `list_container_files`, where the real
+/// cause is a directory with more entries than the panel can render.
+pub const OUTPUT_LIMIT_MARKER: &str = "OUTPUT_LIMIT";
+
+/// Append to `buf` while it stays inside `limit`, returning the range the chunk
+/// now occupies. `None` once the limit is exceeded, at which point the caller
+/// must stop reading — and nothing is appended, so a caller that ignored the
+/// answer cannot parse a half-read document.
+///
+/// Bytes rather than `str` on purpose: Docker frames a stream wherever it
+/// likes, so a chunk boundary can fall inside a UTF-8 sequence. Decoding each
+/// chunk on its own turned that into two replacement characters in the middle
+/// of a filename; the decode happens once, at the end, over the whole buffer.
+fn push_capped(buf: &mut Vec<u8>, chunk: &[u8], limit: usize) -> Option<(usize, usize)> {
     if buf.len() + chunk.len() > limit {
-        return false;
+        return None;
     }
-    buf.push_str(chunk);
-    true
+    let start = buf.len();
+    buf.extend_from_slice(chunk);
+    Some((start, buf.len()))
 }
 
 /// Run a one-shot (non-interactive) exec command in a container and collect stdout.
@@ -521,6 +640,65 @@ pub async fn exec_oneshot_as(
     exec_oneshot_inner(container_id, user, cmd, env, MAX_ONESHOT_OUTPUT).await
 }
 
+/// What a one-shot exec printed, with the two streams still tellable apart.
+///
+/// `combined` is stdout and stderr interleaved in arrival order — the shape
+/// every existing caller reads, and the right one for surfacing "why did that
+/// fail". `stdout_ranges` indexes the parts of it that came from stdout, so a
+/// caller that is *parsing* output can have just that without the buffer being
+/// held twice.
+struct OneshotOutput {
+    combined: Vec<u8>,
+    stdout_ranges: Vec<(usize, usize)>,
+    exit_code: i64,
+}
+
+impl OneshotOutput {
+    /// Everything the command printed, in the order it printed it.
+    fn text(&self) -> String {
+        String::from_utf8_lossy(&self.combined).into_owned()
+    }
+
+    /// stdout alone — for callers that parse it, where a diagnostic spliced in
+    /// mid-record is a parse error at best.
+    fn stdout(&self) -> String {
+        let mut out = Vec::with_capacity(self.combined.len());
+        for (start, end) in &self.stdout_ranges {
+            out.extend_from_slice(&self.combined[*start..*end]);
+        }
+        String::from_utf8_lossy(&out).into_owned()
+    }
+
+    /// stderr alone — the complement of [`Self::stdout`], i.e. the diagnostics.
+    fn stderr(&self) -> String {
+        let mut out = Vec::with_capacity(self.combined.len());
+        let mut cursor = 0usize;
+        for (start, end) in &self.stdout_ranges {
+            out.extend_from_slice(&self.combined[cursor..*start]);
+            cursor = *end;
+        }
+        out.extend_from_slice(&self.combined[cursor..]);
+        String::from_utf8_lossy(&out).into_owned()
+    }
+}
+
+/// [`exec_oneshot_as`] with the two streams kept apart, for callers that parse
+/// stdout.
+///
+/// `find`'s own diagnostics ("Permission denied") used to arrive inside the
+/// records its `-printf` was emitting. GNU `find` escapes tabs and newlines in
+/// those messages, so the listing parser held — but "the parser holds" is not
+/// the same as "the input is trustworthy", and the fix costs one enum match.
+pub async fn exec_oneshot_streams_as(
+    container_id: &str,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+) -> Result<(String, String, i64), String> {
+    let out = exec_oneshot_raw(container_id, user, cmd, env, MAX_ONESHOT_OUTPUT).await?;
+    Ok((out.stdout(), out.stderr(), out.exit_code))
+}
+
 async fn exec_oneshot_inner(
     container_id: &str,
     user: &str,
@@ -528,6 +706,17 @@ async fn exec_oneshot_inner(
     env: Vec<String>,
     limit: usize,
 ) -> Result<(String, i64), String> {
+    let out = exec_oneshot_raw(container_id, user, cmd, env, limit).await?;
+    Ok((out.text(), out.exit_code))
+}
+
+async fn exec_oneshot_raw(
+    container_id: &str,
+    user: &str,
+    cmd: Vec<String>,
+    env: Vec<String>,
+    limit: usize,
+) -> Result<OneshotOutput, String> {
     let docker = get_docker()?;
 
     let exec = docker
@@ -550,22 +739,31 @@ async fn exec_oneshot_inner(
         .await
         .map_err(|e| format!("Failed to start exec: {}", e))?;
 
-    let mut combined = String::new();
+    let mut combined: Vec<u8> = Vec::new();
+    let mut stdout_ranges: Vec<(usize, usize)> = Vec::new();
     match result {
         StartExecResults::Attached { mut output, .. } => {
             while let Some(msg) = output.next().await {
                 match msg {
                     Ok(data) => {
-                        let chunk = String::from_utf8_lossy(&data.into_bytes()).into_owned();
-                        if !push_capped(&mut combined, &chunk, limit) {
+                        let from_stdout = matches!(data, LogOutput::StdOut { .. });
+                        let bytes = data.into_bytes();
+                        match push_capped(&mut combined, &bytes, limit) {
+                            Some(range) => {
+                                if from_stdout {
+                                    stdout_ranges.push(range);
+                                }
+                            }
                             // Stop reading rather than truncate silently: every
                             // caller parses this output, and a half-read
                             // manifest or JSON array is worse than an error.
                             // Dropping `output` kills the exec's stream.
-                            return Err(format!(
-                                "Command output exceeded {} bytes and was abandoned",
-                                limit
-                            ));
+                            None => {
+                                return Err(format!(
+                                    "{}: Command output exceeded {} bytes and was abandoned",
+                                    OUTPUT_LIMIT_MARKER, limit
+                                ))
+                            }
                         }
                     }
                     Err(e) => return Err(format!("Exec output error: {}", e)),
@@ -577,23 +775,60 @@ async fn exec_oneshot_inner(
 
     // The output stream draining doesn't strictly guarantee inspect_exec has the
     // final exit_code populated yet, so poll until the exec reports finished.
-    let exit_code = wait_for_exec_exit(&exec.id).await.unwrap_or(0);
+    let exit_code = require_exit_code(wait_for_exec_exit(&exec.id).await)?;
 
-    Ok((combined, exit_code))
+    Ok(OneshotOutput {
+        combined,
+        stdout_ranges,
+        exit_code,
+    })
+}
+
+/// Turn "the exit code could not be determined" into an error rather than a 0.
+///
+/// `unwrap_or(0)` is how a rename that never happened reported success: callers
+/// branch on `code != 0`, so an unreadable status silently became "it worked",
+/// the UI closed its rename box and the file had not moved. An exec whose
+/// outcome cannot be established has not been established to have succeeded —
+/// fail closed and let the caller surface it.
+///
+/// The `test -e` probe in `rename_container_path` also fails closed under this:
+/// it propagates the error instead of reading an undeterminable status as
+/// "the destination does not exist".
+fn require_exit_code(code: Option<i64>) -> Result<i64, String> {
+    code.ok_or_else(|| {
+        "Could not determine whether the command finished (Docker did not report an exit status)"
+            .to_string()
+    })
 }
 
 /// Poll `inspect_exec` until the exec reports finished and return its exit code.
 /// Returns `None` if the code can't be determined (inspect error, or the exec
-/// doesn't report finished within ~1s — which shouldn't happen once its output
+/// doesn't report finished within ~5s — which shouldn't happen once its output
 /// stream has drained).
+///
+/// The window is generous because `None` is no longer a shrug: since
+/// [`require_exit_code`], it fails the whole call. Waiting a few seconds longer
+/// for a busy daemon to settle costs nothing in the normal case — the loop exits
+/// on the first poll that reports finished — and it is the difference between a
+/// spurious "the rename failed" and a real one.
 pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
     let docker = get_docker().ok()?;
-    for _ in 0..40 {
+    for _ in 0..200 {
         match docker.inspect_exec(exec_id).await {
             Ok(info) => {
                 if info.running != Some(true) {
-                    // Finished: use the reported code (default 0 if somehow absent).
-                    return Some(info.exit_code.unwrap_or(0));
+                    // Finished. `exit_code` rather than `unwrap_or(0)`: an exec
+                    // that has stopped without a reported code is a status
+                    // nobody can vouch for, and flattening it to *success* is
+                    // the wrong default when a caller is deciding whether to
+                    // rename a downloaded file over the user's own.
+                    // `download_container_file` treats `None` as a failure
+                    // precisely because it cannot tell that silence from a
+                    // clean exit; an `unwrap_or` here made that check
+                    // unreachable. Callers that only care about "did it fail
+                    // loudly" use `is_some_and`, which reads `None` as before.
+                    return info.exit_code;
                 }
             }
             Err(_) => return None,
@@ -607,31 +842,96 @@ pub async fn wait_for_exec_exit(exec_id: &str) -> Option<i64> {
 mod tests {
     use super::*;
 
+    /// The frames a demultiplexed exec hands back, as `(is_stdout, bytes)`.
+    fn collect(frames: &[(bool, &[u8])]) -> OneshotOutput {
+        let mut combined = Vec::new();
+        let mut stdout_ranges = Vec::new();
+        for (from_stdout, bytes) in frames {
+            let range = push_capped(&mut combined, bytes, usize::MAX).unwrap();
+            if *from_stdout {
+                stdout_ranges.push(range);
+            }
+        }
+        OneshotOutput {
+            combined,
+            stdout_ranges,
+            exit_code: 0,
+        }
+    }
+
     #[test]
     fn output_under_the_limit_is_buffered_whole() {
-        let mut buf = String::new();
-        assert!(push_capped(&mut buf, "hello ", 16));
-        assert!(push_capped(&mut buf, "world", 16));
-        assert_eq!(buf, "hello world");
+        let mut buf = Vec::new();
+        assert_eq!(push_capped(&mut buf, b"hello ", 16), Some((0, 6)));
+        assert_eq!(push_capped(&mut buf, b"world", 16), Some((6, 11)));
+        assert_eq!(buf, b"hello world");
     }
 
     #[test]
     fn output_over_the_limit_is_refused_rather_than_truncated() {
         // The abandoned chunk must not land in the buffer either: a caller that
         // ignored the error would otherwise parse a half-read document.
-        let mut buf = String::new();
-        assert!(push_capped(&mut buf, "0123456789", 12));
-        assert!(!push_capped(&mut buf, "0123456789", 12));
-        assert_eq!(buf, "0123456789");
+        let mut buf = Vec::new();
+        assert!(push_capped(&mut buf, b"0123456789", 12).is_some());
+        assert!(push_capped(&mut buf, b"0123456789", 12).is_none());
+        assert_eq!(buf, b"0123456789");
     }
 
     #[test]
     fn a_single_oversized_chunk_is_refused() {
-        let mut buf = String::new();
-        assert!(!push_capped(&mut buf, "0123456789", 4));
+        let mut buf = Vec::new();
+        assert!(push_capped(&mut buf, b"0123456789", 4).is_none());
         assert!(buf.is_empty());
     }
 
+    #[test]
+    fn a_character_split_across_two_frames_survives_the_decode() {
+        // Docker frames a stream wherever it likes, and a filename is where
+        // that shows: decoding each chunk on its own turned the two halves of
+        // `ü` into two replacement characters in the middle of a name.
+        let out = collect(&[(true, &[0xc3]), (true, &[0xbc, b'.', b't', b'x', b't'])]);
+        assert_eq!(out.stdout(), "ü.txt");
+        assert_eq!(out.text(), "ü.txt");
+    }
+
+    #[test]
+    fn a_diagnostic_never_lands_in_the_stream_a_caller_parses() {
+        // `find`'s "Permission denied" used to arrive inside the records its
+        // `-printf` was emitting. Arrival order is still available for the
+        // error message; the parser gets stdout alone.
+        let out = collect(&[
+            (true, b"first"),
+            (false, b"find: /x: Permission denied\n"),
+            (true, b"second"),
+        ]);
+        assert_eq!(out.stdout(), "firstsecond");
+        assert_eq!(out.stderr(), "find: /x: Permission denied\n");
+        assert_eq!(out.text(), "firstfind: /x: Permission denied\nsecond");
+    }
+
+    #[test]
+    fn an_output_limit_refusal_is_marked_so_a_caller_can_reword_it() {
+        // "Command output exceeded 8388608 bytes" is a fact about a buffer.
+        // The marker is what lets `list_container_files` say "too many entries"
+        // instead, which is the thing that actually happened.
+        assert!(!OUTPUT_LIMIT_MARKER.is_empty());
+        let refusal = format!(
+            "{}: Command output exceeded {} bytes and was abandoned",
+            OUTPUT_LIMIT_MARKER, MAX_ONESHOT_OUTPUT
+        );
+        assert!(refusal.starts_with(OUTPUT_LIMIT_MARKER));
+    }
+
+    #[test]
+    fn an_undeterminable_exit_status_is_an_error_not_a_zero() {
+        // The bug this guards: `unwrap_or(0)` made every caller that branches on
+        // `code != 0` — rename, mkdir — report success for an exec whose outcome
+        // nobody could read.
+        assert_eq!(require_exit_code(Some(0)).unwrap(), 0);
+        assert_eq!(require_exit_code(Some(1)).unwrap(), 1);
+        assert!(require_exit_code(None).is_err());
+    }
+
     #[test]
     fn the_bridge_budget_is_far_smaller_than_the_general_one() {
         // The auth bridge re-reads container-controlled procfs every 2s, so it
@@ -640,4 +940,25 @@ mod tests {
         // …but still comfortably above a genuine /proc/net/tcp{,6} pair.
         assert!(PROC_NET_OUTPUT_LIMIT > 100 * 150);
     }
+
+    /// The reported path, which is what the terminal echoes back to Claude and
+    /// what the Files pane puts in its log line. `/tmp//x` and `/tmp/x` are the
+    /// same file to the kernel and different strings to a person reading either
+    /// of those.
+    #[test]
+    fn container_join_produces_one_separator() {
+        assert_eq!(container_join("/tmp", "a.txt"), "/tmp/a.txt");
+        // The terminal's drop passes a nested name; it must not gain a second
+        // slash at the seam.
+        assert_eq!(
+            container_join("/tmp", "triple-c-drops/a.txt"),
+            "/tmp/triple-c-drops/a.txt"
+        );
+        // A directory the user navigated to can carry a trailing slash, and the
+        // container root is the case where trimming it must not eat the only
+        // separator there is.
+        assert_eq!(container_join("/workspace/", "a.txt"), "/workspace/a.txt");
+        assert_eq!(container_join("/", "a.txt"), "/a.txt");
+        assert_eq!(container_join("/", "/a.txt"), "/a.txt");
+    }
 }
diff --git a/app/src-tauri/src/docker/migration.rs b/app/src-tauri/src/docker/migration.rs
index 8c39346..3425970 100644
--- a/app/src-tauri/src/docker/migration.rs
+++ b/app/src-tauri/src/docker/migration.rs
@@ -369,6 +369,15 @@ pub fn set_delta(from: &BTreeSet<String>, base: &BTreeSet<String>) -> Vec<String
 pub fn bind_mount_exclusions(paths: &[ProjectPath]) -> Vec<String> {
     let mut out: Vec<String> = paths
         .iter()
+        // **The same filter `project_path_mounts` applies, and it has to be.**
+        // That function skips a row with an empty `host_path` or `mount_name`
+        // so a legacy row cannot brick the create. The consequence is that
+        // `/workspace/<name>` for such a row is *not* a bind mount — it is
+        // ordinary writable-layer content. Excluding it here would tell
+        // `compute_verbatim_paths` to skip staging it, and the container swap
+        // would then destroy whatever the user has put there. The two
+        // predicates must agree or a migration silently eats a directory.
+        .filter(|p| !p.mount_name.trim().is_empty() && !p.host_path.trim().is_empty())
         .map(|p| format!("/workspace/{}", p.mount_name))
         .collect();
     out.sort();
@@ -712,13 +721,83 @@ pub async fn run_throwaway(image: &str, script: &str) -> Result<ThrowawayResult,
         )
         .await
         .map_err(|e| format!("Failed to create probe container for {}: {}", image, e))?;
-    let id = created.id;
 
-    let result = run_throwaway_inner(&id).await;
+    // From here on the container's removal is owned by a guard rather than by
+    // the statement that used to sit after the await below. A plain statement
+    // only runs if this future is *polled to completion*: an `Err(...)?` was
+    // already handled, but a **dropped** future — the app quitting mid-flight,
+    // a timeout, any `select!` that loses — skipped it silently and left a
+    // container behind holding a multi-gigabyte base image open. That image is
+    // then unsweepable (removal is deliberately unforced) and there is nothing
+    // in the UI that would ever mention it.
+    let guard = ProbeContainerGuard::new(created.id);
 
-    if let Err(e) = docker
+    let result = run_throwaway_inner(guard.id()).await;
+
+    // The happy path still removes it *synchronously*, so a caller that goes on
+    // to `docker rmi` the image it probed does not race the removal.
+    guard.remove_now().await;
+
+    result
+}
+
+/// Owns the lifetime of a probe container.
+///
+/// [`Self::remove_now`] is the normal path and awaits the removal. `Drop` is the
+/// safety net for the abnormal one: it cannot await, so it hands the removal to
+/// a detached task. That covers a dropped future while the process lives; it
+/// cannot cover the process dying, which is what
+/// [`reap_probe_containers`] is for.
+struct ProbeContainerGuard {
+    id: String,
+    /// Cleared by `remove_now` so `Drop` does not queue a second removal.
+    armed: bool,
+}
+
+impl ProbeContainerGuard {
+    fn new(id: String) -> Self {
+        Self { id, armed: true }
+    }
+
+    fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// **Disarm after the await, never before it.** Clearing `armed` first
+    /// looked equivalent and was the exact inverse of this guard's purpose: on
+    /// the one path it exists for — this future being dropped part-way through
+    /// the removal — `Drop` then saw a disarmed guard and did nothing, so the
+    /// container survived with no background removal queued behind it. Setting
+    /// it afterwards means a cancelled `remove_now` falls back to `Drop`'s
+    /// detached removal, and only a removal that actually completed disarms.
+    async fn remove_now(mut self) {
+        remove_probe_container(&self.id).await;
+        self.armed = false;
+    }
+}
+
+impl Drop for ProbeContainerGuard {
+    fn drop(&mut self) {
+        if !self.armed {
+            return;
+        }
+        let id = std::mem::take(&mut self.id);
+        log::warn!("Probe container {} was abandoned; removing it in the background", id);
+        tauri::async_runtime::spawn(async move {
+            remove_probe_container(&id).await;
+        });
+    }
+}
+
+/// Force-remove one probe container. Missing is success — the point is that the
+/// container is gone.
+async fn remove_probe_container(id: &str) {
+    let Ok(docker) = get_docker() else {
+        return;
+    };
+    match docker
         .remove_container(
-            &id,
+            id,
             Some(RemoveContainerOptions {
                 force: true,
                 v: true,
@@ -727,12 +806,96 @@ pub async fn run_throwaway(image: &str, script: &str) -> Result<ThrowawayResult,
         )
         .await
     {
-        log::warn!("Failed to remove probe container {}: {}", id, e);
+        Ok(())
+        | Err(bollard::errors::Error::DockerResponseServerError {
+            status_code: 404, ..
+        }) => {}
+        Err(e) => log::warn!("Failed to remove probe container {}: {}", id, e),
     }
-
-    result
 }
 
+/// Remove probe containers left behind by a previous run of the app.
+///
+/// A probe is labelled [`LABEL_PROBE`] precisely so it stays findable after a
+/// crash, but until now nothing ever went looking. One leftover probe pins the
+/// base image it was created from — several gigabytes that
+/// `sweep_orphaned_snapshots` then reports as "in use" and correctly refuses to
+/// touch, with no way for the user to find out why.
+///
+/// Safe to run at startup: a probe is a short-lived `/bin/sh` with no mounts
+/// and no volumes, owned entirely by a `run_throwaway` call. If one is running
+/// right now it belongs to this process — and this runs before any migration
+/// can be started, so there is none to interrupt.
+///
+/// **Except that "belongs to this process" is not something this can know.**
+/// The filter is a label, and labels are daemon-wide: a second copy of the app
+/// migrating a project on the same daemon has probe containers carrying exactly
+/// this label, and force-removing one mid-manifest-capture fails that
+/// migration. In-process state cannot see the other instance, so the only
+/// available brake is age — [`PROBE_REAP_MIN_AGE_SECS`]. A probe runs a `df`, an
+/// `apt-get update` or a `find` over a root filesystem; none of those is a
+/// multi-minute job, so anything younger than the gate is far more likely to be
+/// someone's live probe than a leftover, and a leftover simply waits for the
+/// next start.
+pub async fn reap_probe_containers() {
+    let Ok(docker) = get_docker() else {
+        return;
+    };
+
+    let filters: HashMap<String, Vec<String>> = HashMap::from([(
+        "label".to_string(),
+        vec![format!("{}={}", LABEL_PROBE, PROBE_LABEL_MIGRATION)],
+    )]);
+
+    let containers = match docker
+        .list_containers(Some(bollard::container::ListContainersOptions {
+            all: true,
+            filters,
+            ..Default::default()
+        }))
+        .await
+    {
+        Ok(list) => list,
+        Err(e) => {
+            log::warn!("Could not list leftover probe containers: {}", e);
+            return;
+        }
+    };
+
+    let now = chrono::Utc::now().timestamp();
+    for c in containers {
+        // `created` is a unix timestamp; a summary without one is treated as
+        // too young to touch, because unknown is never permission.
+        let age = c.created.map(|created| now - created);
+        match age {
+            Some(age) if age >= PROBE_REAP_MIN_AGE_SECS => {}
+            _ => {
+                log::info!(
+                    "Leaving migration probe container {} alone — it is younger than {} minutes, \
+                     so it may belong to another Triple-C instance's live migration",
+                    c.id.as_deref().unwrap_or("<unknown>"),
+                    PROBE_REAP_MIN_AGE_SECS / 60
+                );
+                continue;
+            }
+        }
+        if let Some(id) = c.id {
+            log::info!("Removing leftover migration probe container {}", id);
+            remove_probe_container(&id).await;
+        }
+    }
+}
+
+/// How old a `triple-c.probe=migration` container must be before
+/// [`reap_probe_containers`] will force-remove it, in seconds.
+///
+/// The label is daemon-wide and this process cannot tell its own leftovers from
+/// another instance's live probe, so this is the whole guard. Generous against
+/// the longest probe there is (an `apt-get update` inside a throwaway container
+/// on a slow link) and still short enough that a crashed run's probe stops
+/// pinning a multi-gigabyte base image within the hour.
+pub const PROBE_REAP_MIN_AGE_SECS: i64 = 30 * 60;
+
 async fn run_throwaway_inner(id: &str) -> Result<ThrowawayResult, String> {
     let docker = get_docker()?;
 
@@ -910,6 +1073,210 @@ pub fn rollback_tag(now: &chrono::DateTime<chrono::Utc>) -> String {
     format!("pre-migration-{}", now.format("%Y%m%d-%H%M%S"))
 }
 
+/// How long a rollback pin may sit with no migration record behind it before
+/// [`reap_stale_migration_pins`] drops the tag.
+///
+/// Two weeks, chosen to be far longer than anyone deliberates over a base
+/// update and far shorter than "forever", which is what it was.
+///
+/// **Measured from when the record went missing, not from the tag.** See
+/// [`pin_is_reapable`] and
+/// [`crate::storage::migration_store::note_ownerless_since`].
+pub const STALE_PIN_MAX_AGE_DAYS: i64 = 14;
+
+/// Recover the timestamp encoded in a tag produced by [`rollback_tag`].
+///
+/// `None` for anything that is not one of ours — a tag that merely *starts*
+/// with `pre-migration-` but does not carry a parseable timestamp is left alone
+/// rather than guessed at, because the consequence of guessing wrong is
+/// deleting the only copy of somebody's system layer.
+pub fn parse_rollback_tag(tag: &str) -> Option<chrono::DateTime<chrono::Utc>> {
+    let stamp = tag.strip_prefix("pre-migration-")?;
+    let naive = chrono::NaiveDateTime::parse_from_str(stamp, "%Y%m%d-%H%M%S").ok()?;
+    Some(naive.and_utc())
+}
+
+/// Split `triple-c-snapshot-<projectId>:<tag>` into the project id and the tag.
+///
+/// `None` when the reference is not a snapshot repo at all.
+pub fn parse_snapshot_reference(reference: &str) -> Option<(String, String)> {
+    let (repo, tag) = split_image_ref(reference);
+    let project_id = repo.strip_prefix("triple-c-snapshot-")?.to_string();
+    if project_id.is_empty() {
+        return None;
+    }
+    Some((project_id, tag))
+}
+
+/// Whether a rollback pin is safe to drop, given whether the project it belongs
+/// to still has a migration record and how long it has been without one.
+///
+/// Pure so the decision can be tested without a daemon. The order of the
+/// conditions is the point: **a pin whose migration is still awaiting
+/// confirmation is never reaped at any age**, because it is the only copy of
+/// the rollback target and the user has not yet said they are happy with the
+/// new base.
+///
+/// ## `ownerless_since`, and why it is not the tag's timestamp
+///
+/// This used to compute the age from `parse_rollback_tag(tag)` — the instant
+/// the migration *started*. A migration is allowed to sit at
+/// `awaiting-confirmation` for as long as the user likes; that is what
+/// `keep_rollback` is for. A project parked there for a month whose record is
+/// then lost had a tag a month old, so the pin was reapable on the very next
+/// check and the startup sweep deleted the image immediately after. The
+/// fourteen days were nominal: the real grace period for the case the constant
+/// was written for was zero.
+///
+/// So the clock starts when the claim was lost, which is recorded by
+/// [`crate::storage::migration_store::note_ownerless_since`] the first time a
+/// reaper notices. `None` means no reaper has recorded a sighting yet, and that
+/// is **not** "sighted now": returning false there is what gives a pin its
+/// first full fourteen days instead of none.
+///
+/// ## Clock skew
+///
+/// A `now` earlier than `ownerless_since` — a host clock that ran fast and was
+/// corrected, or a data directory carried between machines — yields a negative
+/// elapsed time. That is treated as not reapable, and the marker writer
+/// re-anchors it, rather than letting a negative `num_days()` mean "never" or
+/// an inflated one mean "immediately".
+pub fn pin_is_reapable(
+    tag: &str,
+    has_migration_record: bool,
+    ownerless_since: Option<chrono::DateTime<chrono::Utc>>,
+    now: &chrono::DateTime<chrono::Utc>,
+) -> bool {
+    if has_migration_record {
+        return false;
+    }
+    // Still required: the tag has to be one of ours. A hand-made
+    // `pre-migration-keepme` is somebody's deliberate pin and is never guessed
+    // at, whatever a marker beside it says.
+    if parse_rollback_tag(tag).is_none() {
+        return false;
+    }
+    let Some(since) = ownerless_since else {
+        return false;
+    };
+    let elapsed = *now - since;
+    elapsed >= chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS)
+}
+
+/// Drop `triple-c-snapshot-*:pre-migration-*` tags that no migration record
+/// claims any more, so the images behind them become sweepable.
+///
+/// ## Why this scans tags instead of reading the records
+///
+/// Every other path to a rollback pin starts from
+/// `migration_store::load`, and `load` reports an unparseable state file as
+/// *absent* — so a single corrupt record used to strand a 4–12 GB image that no
+/// code could ever name again. Confirming or rolling back both remove the
+/// record and drop the tag together, so a `pre-migration-*` tag with no record
+/// beside it is by definition one that lost its owner: a crash between the two,
+/// a record that was deleted by hand, or the corrupt-file case.
+///
+/// Scanning the *tag pattern* is the only way to find those. `load` moving a
+/// corrupt record aside (see `migration_store::load`) is what stops that case
+/// from being permanently invisible here too.
+///
+/// ## Why it only untags
+///
+/// Dropping the tag turns the image dangling, and it is already labelled
+/// `triple-c.managed=true` because `docker commit` created it — so
+/// `sweep_orphaned_snapshots` collects it on the same pass, under the same two
+/// safety conditions, with the daemon's "still in use by a container" refusal
+/// still in front of it. Nothing here calls `docker rmi` on a reachable image.
+pub async fn reap_stale_migration_pins() -> usize {
+    use bollard::image::ListImagesOptions;
+
+    let Ok(docker) = get_docker() else {
+        return 0;
+    };
+
+    // `reference` matches against `repo:tag`, so this asks the daemon for
+    // exactly the shape [`rollback_tag`] produces and nothing else.
+    let filters: HashMap<String, Vec<String>> = HashMap::from([(
+        "reference".to_string(),
+        vec!["triple-c-snapshot-*:pre-migration-*".to_string()],
+    )]);
+
+    let images = match docker
+        .list_images(Some(ListImagesOptions {
+            all: false,
+            filters,
+            ..Default::default()
+        }))
+        .await
+    {
+        Ok(images) => images,
+        Err(e) => {
+            log::warn!("Could not list rollback pins: {}", e);
+            return 0;
+        }
+    };
+
+    let now = chrono::Utc::now();
+    let mut reaped = 0usize;
+
+    for summary in images {
+        for reference in &summary.repo_tags {
+            let Some((project_id, tag)) = parse_snapshot_reference(reference) else {
+                continue;
+            };
+            // Filesystem presence, not `load`: a record we cannot parse must
+            // still count as "somebody may want this back".
+            let has_record =
+                crate::storage::migration_store::has_record(&project_id).unwrap_or(true);
+            if has_record {
+                // Owned again (or still owned): throw away any grace clock a
+                // previous pass started, so a pin that loses its record twice
+                // gets a fresh fourteen days rather than inheriting a stale one.
+                crate::storage::migration_store::clear_ownerless(&project_id, &tag);
+                continue;
+            }
+            // Only a *well-formed* pin gets a marker written for it — a tag
+            // that is not one of ours is left entirely alone, files included.
+            if parse_rollback_tag(&tag).is_none() {
+                continue;
+            }
+            // Records the first sighting when there is none, which is why this
+            // returns `None` on that pass and the pin survives it.
+            //
+            // A `save` can land between the `has_record` above and this write,
+            // which would plant a tombstone dated *now* behind a perfectly
+            // valid record — invisible until that record is legitimately lost,
+            // at which point the pin is already past its grace period and is
+            // reaped on the first check. `note_ownerless_since` re-asks
+            // `has_record` after the write and removes the marker again; the
+            // reasoning for why that closes the window is on it.
+            let ownerless_since =
+                crate::storage::migration_store::note_ownerless_since(&project_id, &tag, &now);
+            if !pin_is_reapable(&tag, has_record, ownerless_since, &now) {
+                continue;
+            }
+            match untag_image(reference).await {
+                Ok(()) => {
+                    crate::storage::migration_store::clear_ownerless(&project_id, &tag);
+                    log::info!(
+                        "Dropped stale rollback pin {} ({:.2} GB) — no migration record has claimed it since {}, more than {} days",
+                        reference,
+                        summary.size as f64 / 1_073_741_824.0,
+                        ownerless_since
+                            .map(|t| t.to_rfc3339())
+                            .unwrap_or_else(|| "unknown".to_string()),
+                        STALE_PIN_MAX_AGE_DAYS,
+                    );
+                    reaped += 1;
+                }
+                Err(e) => log::warn!("Could not drop stale rollback pin {}: {}", reference, e),
+            }
+        }
+    }
+
+    reaped
+}
+
 /// Split `repo:tag` into its parts, defaulting the tag to `latest`.
 pub fn split_image_ref(image: &str) -> (String, String) {
     match image.rsplit_once(':') {
@@ -1010,6 +1377,30 @@ pub fn parse_preflight(raw: &str) -> PreflightEnvironment {
 
 #[cfg(test)]
 mod tests {
+
+    /// The mount filter and the migration's exclusion list must agree.
+    ///
+    /// `project_path_mounts` skips a row with an empty `host_path` so a legacy
+    /// row cannot brick the create. That makes `/workspace/<name>` ordinary
+    /// writable-layer content rather than a bind mount — and if this function
+    /// still excluded it, `compute_verbatim_paths` would skip staging it and
+    /// the container swap would destroy whatever is there. A migration eating a
+    /// directory is the quietest kind of data loss there is.
+    #[test]
+    fn an_unmountable_row_is_not_excluded_from_the_migration_payload() {
+        let paths = vec![
+            ProjectPath { host_path: "/home/u/code".into(), mount_name: "code".into() },
+            // Legacy shapes that `project_path_mounts` skips.
+            ProjectPath { host_path: "".into(), mount_name: "data".into() },
+            ProjectPath { host_path: "/home/u/x".into(), mount_name: "  ".into() },
+        ];
+        let excluded = bind_mount_exclusions(&paths);
+        assert_eq!(
+            excluded,
+            vec!["/workspace/code".to_string()],
+            "only rows that are actually mounted may be excluded from staging"
+        );
+    }
     use super::*;
     use crate::models::{
         MIGRATION_PHASE_AWAITING, MIGRATION_PHASE_INTERRUPTED, MIGRATION_PHASE_IN_PROGRESS,
@@ -1622,4 +2013,137 @@ mod tests {
         assert_eq!(shell_single_quote("/opt/a'b"), r#"'/opt/a'\''b'"#);
     }
 
+
+    // ── Stale rollback pins (A5) ─────────────────────────────────────────────
+
+    fn at(y: i32, m: u32, d: u32) -> chrono::DateTime<chrono::Utc> {
+        chrono::NaiveDate::from_ymd_opt(y, m, d)
+            .unwrap()
+            .and_hms_opt(12, 0, 0)
+            .unwrap()
+            .and_utc()
+    }
+
+    #[test]
+    fn a_rollback_tag_round_trips_through_its_parser() {
+        let made = at(2026, 3, 14);
+        assert_eq!(parse_rollback_tag(&rollback_tag(&made)), Some(made));
+    }
+
+    #[test]
+    fn only_a_real_rollback_tag_parses() {
+        assert_eq!(parse_rollback_tag("latest"), None);
+        assert_eq!(parse_rollback_tag("pre-migration-"), None);
+        // Looks like ours but carries no timestamp we produced. Guessing here
+        // would mean deleting the only copy of somebody's system layer.
+        assert_eq!(parse_rollback_tag("pre-migration-keepme"), None);
+        assert_eq!(parse_rollback_tag("pre-migration-20260231-000000"), None);
+    }
+
+    #[test]
+    fn a_snapshot_reference_yields_its_project_id() {
+        assert_eq!(
+            parse_snapshot_reference("triple-c-snapshot-abc-123:pre-migration-20260101-101500"),
+            Some(("abc-123".to_string(), "pre-migration-20260101-101500".to_string()))
+        );
+        // Not ours: a base image, and a repo that merely shares a prefix.
+        assert_eq!(parse_snapshot_reference("triple-c-sandbox:latest"), None);
+        assert_eq!(parse_snapshot_reference("triple-c-snapshot-:latest"), None);
+    }
+
+    #[test]
+    fn a_pin_awaiting_confirmation_is_never_reaped_at_any_age() {
+        // The one rule that cannot bend: while a migration record exists, this
+        // image is the only copy of the rollback target and the user has not
+        // yet said they are happy on the new base.
+        let ancient = rollback_tag(&at(2020, 1, 1));
+        assert!(!pin_is_reapable(
+            &ancient,
+            true,
+            Some(at(2020, 1, 1)),
+            &at(2026, 8, 23)
+        ));
+    }
+
+    #[test]
+    fn an_unclaimed_pin_is_reaped_only_once_it_is_old() {
+        let tag = rollback_tag(&at(2026, 8, 1));
+        // The clock runs from when the record went missing, which here is well
+        // after the migration started.
+        let lost = at(2026, 8, 10);
+        assert!(!pin_is_reapable(&tag, false, Some(lost), &at(2026, 8, 11)));
+        assert!(!pin_is_reapable(
+            &tag,
+            false,
+            Some(lost),
+            &(lost + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS) - chrono::Duration::seconds(1))
+        ));
+        assert!(pin_is_reapable(
+            &tag,
+            false,
+            Some(lost),
+            &(lost + chrono::Duration::days(STALE_PIN_MAX_AGE_DAYS))
+        ));
+    }
+
+    #[test]
+    fn the_grace_period_runs_from_the_lost_record_not_from_the_tag() {
+        // The bug this replaced, stated as a test. A migration parked at
+        // `awaiting-confirmation` for a month — supported, that is what
+        // `keep_rollback` is for — whose record is then lost had a
+        // month-old tag, so the old rule made its pin reapable on the very
+        // next app start with the startup sweep deleting the image two lines
+        // later. Zero grace, on the one case the fourteen days exist for.
+        let started = at(2026, 6, 1);
+        let tag = rollback_tag(&started);
+        let record_lost = at(2026, 7, 1);
+        let noticed_immediately_after = record_lost + chrono::Duration::minutes(5);
+        assert!(
+            !pin_is_reapable(&tag, false, Some(record_lost), &noticed_immediately_after),
+            "a tag a month old must still get its full grace period once orphaned"
+        );
+    }
+
+    #[test]
+    fn an_unsighted_pin_is_never_reaped_on_the_pass_that_first_sees_it() {
+        // `None` means no reaper has recorded a sighting. Treating that as
+        // "sighted now" would be harmless; treating it as "sighted long ago"
+        // would not, and neither is what it means — the marker is written on
+        // this pass and the pin becomes reapable fourteen days later.
+        let tag = rollback_tag(&at(2020, 1, 1));
+        assert!(!pin_is_reapable(&tag, false, None, &at(2026, 8, 23)));
+    }
+
+    #[test]
+    fn a_clock_that_ran_backwards_neither_reaps_nor_strands() {
+        // A marker dated after `now`: the host clock was fast and got
+        // corrected, or the data directory came from another machine. A
+        // negative elapsed time must read as "not yet", not as a huge age.
+        let tag = rollback_tag(&at(2026, 1, 1));
+        let marker = at(2026, 9, 1);
+        assert!(!pin_is_reapable(&tag, false, Some(marker), &at(2026, 8, 1)));
+        // The other direction is bounded by the marker rather than by the tag:
+        // a wildly future `now` can only expire a clock that was actually
+        // started, and a pin with no marker (the case above) still cannot be
+        // reaped at all — which is what stops a fast host clock from making
+        // *every* pin on the daemon instantly collectable.
+        assert!(pin_is_reapable(
+            &tag,
+            false,
+            Some(at(2026, 8, 20)),
+            &at(2030, 1, 1)
+        ));
+        assert!(!pin_is_reapable(&tag, false, None, &at(2030, 1, 1)));
+    }
+
+    #[test]
+    fn a_tag_we_cannot_date_is_left_alone() {
+        // Even with an ancient ownerless marker sitting beside it: a tag that
+        // merely *starts* `pre-migration-` is somebody's deliberate pin, and
+        // the reaper never writes a marker for one in the first place.
+        let ancient = Some(at(2020, 1, 1));
+        let now = at(2026, 8, 23);
+        assert!(!pin_is_reapable("pre-migration-handmade", false, ancient, &now));
+        assert!(!pin_is_reapable("latest", false, ancient, &now));
+    }
 }
diff --git a/app/src-tauri/src/lib.rs b/app/src-tauri/src/lib.rs
index a918c19..24b6bae 100644
--- a/app/src-tauri/src/lib.rs
+++ b/app/src-tauri/src/lib.rs
@@ -5,6 +5,7 @@ mod docker;
 mod install_helper;
 mod logging;
 mod models;
+mod project_lock;
 mod storage;
 pub mod web_terminal;
 
@@ -212,7 +213,6 @@ pub fn run() {
     let lifecycle_setup = lifecycle.clone();
 
     tauri::Builder::default()
-        .plugin(tauri_plugin_store::Builder::default().build())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_opener::init())
         .manage(AppState {
@@ -235,6 +235,30 @@ pub fn run() {
                 }
             }
 
+            // ── Startup disk housekeeping ────────────────────────────────
+            // Until now the only sweep ran *after* a recreation, so a user who
+            // simply stopped launching a project kept its orphaned snapshot
+            // layers forever, and anything a crash left behind (a probe
+            // container pinning a base image, a rollback pin whose migration
+            // record is gone) had no path back at all. All of it is
+            // read-mostly and finishes in well under a second on an idle daemon,
+            // but they are detached anyway: housekeeping must never delay the
+            // window appearing, and a daemon that is not running yet is a
+            // logged warning rather than a failed start.
+            //
+            // Ordering matters. Probes are removed first because a probe holds
+            // an image open and the sweep will not force; pins are untagged
+            // second so the images they were holding are dangling by the time
+            // the sweep lists them; the sweep runs last and collects both.
+            tauri::async_runtime::spawn(async move {
+                crate::docker::reap_probe_containers().await;
+                let reaped = crate::docker::reap_stale_migration_pins().await;
+                if reaped > 0 {
+                    log::info!("Startup housekeeping dropped {} stale rollback pin(s)", reaped);
+                }
+                crate::docker::sweep_orphaned_snapshots_logged("startup").await;
+            });
+
             // Auto-start web terminal server if enabled in settings
             let settings = settings_store_setup.get();
             if settings.web_terminal.enabled {
@@ -411,7 +435,6 @@ pub fn run() {
             commands::docker_commands::check_image_exists,
             commands::docker_commands::build_image,
             commands::docker_commands::get_container_info,
-            commands::docker_commands::list_sibling_containers,
             // Projects
             commands::project_commands::list_projects,
             commands::project_commands::add_project,
@@ -452,6 +475,7 @@ pub fn run() {
             commands::auth_token_commands::cancel_claude_token,
             commands::auth_token_commands::has_claude_token,
             commands::auth_token_commands::clear_claude_token,
+            commands::auth_token_commands::sweep_claude_token_snapshots,
             // Settings
             commands::settings_commands::get_settings,
             commands::settings_commands::update_settings,
@@ -472,9 +496,12 @@ pub fn run() {
             commands::terminal_commands::stop_audio_bridge,
             // Files
             commands::file_commands::list_container_files,
-            commands::file_commands::download_container_file,
             commands::file_commands::download_container_backup,
-            commands::file_commands::upload_file_to_container,
+            commands::file_commands::download_container_file,
+            commands::file_commands::upload_files_to_container,
+            commands::file_commands::read_container_file,
+            commands::file_commands::rename_container_path,
+            commands::file_commands::create_container_directory,
             // AWS
             commands::aws_commands::aws_sso_refresh,
             // Updates
@@ -652,4 +679,244 @@ mod tests {
         lifecycle.settle_startup_tasks().await;
         assert!(started.elapsed() <= STARTUP_CANCEL_BUDGET + Duration::from_secs(1));
     }
+
+    /// The capability file is the app's entire IPC attack surface, and it is
+    /// data — nothing in `cargo test` reads it, so a widened grant lands with a
+    /// green suite. This is what noticing looks like.
+    ///
+    /// It exists because `core:default` was granted for months. That alias
+    /// pulls in `core:image:default` → `allow-from-path`, which is an
+    /// unconditional `std::fs::read` of any host path with no scope check, and
+    /// nothing in the frontend has ever imported `@tauri-apps/api/image`.
+    /// Every `#[tauri::command]` is registered, and every registration names a
+    /// command that exists.
+    ///
+    /// This is the shape of the bug that caused the original OAuth-callback
+    /// complaint: `set_auth_bridge_enabled` existed, worked, and had a typed
+    /// frontend wrapper — with **zero call sites**. The switch the docs told
+    /// users to flip was never wired to anything, so the bridge stayed off and
+    /// every login callback was refused. Nothing failed; the feature was simply
+    /// absent, and no test noticed because both halves compiled.
+    ///
+    /// The reverse direction matters too, and for a sharper reason: a command
+    /// that is registered but reachable from nowhere is still IPC surface a
+    /// compromised webview can call. `list_sibling_containers` — which returned
+    /// every container on the daemon, including the user's unrelated work —
+    /// sat in exactly that state, and this test is what found it. It has since
+    /// been removed at all four levels: registration, command, docker helper,
+    /// and the frontend wrapper and type.
+    ///
+    /// So this asserts the two lists agree, and leaves *deciding* what belongs
+    /// on them to a human. It cannot see frontend call sites; `tsc` and the
+    /// vitest suite cover that side.
+    #[test]
+    fn every_command_is_registered_exactly_once() {
+        use std::collections::BTreeSet;
+
+        let mut defined: BTreeSet<String> = BTreeSet::new();
+
+        // Walk the source tree for the command attribute and take the `fn` name
+        // that follows.
+        //
+        // The first version of this matched `line.trim() == "#[tauri::command]"`
+        // exactly and broke on the first non-`#` line. An audit got five real,
+        // compiling, unregistered commands past it — `#[tauri::command(async)]`,
+        // `#[tauri::command(rename_all = "snake_case")]`, a trailing comment,
+        // spaces in the path, and a bare `#[command]` after `use tauri::command`
+        // — plus `pub(crate) fn` and a `///` line between attribute and `fn`.
+        // Every one of those is a command the frontend could not call, which is
+        // the bug this test exists for, and the test stayed green.
+        //
+        // The asymmetry matters: confusion on the *definition* side is a silent
+        // pass, while on the *registration* side it fails loudly against
+        // legitimate code — and rustc already covers that direction. So this
+        // errs toward over-matching definitions.
+        fn collect(dir: &std::path::Path, out: &mut BTreeSet<String>) {
+            let Ok(entries) = std::fs::read_dir(dir) else { return };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.is_dir() {
+                    collect(&path, out);
+                } else if path.extension().is_some_and(|e| e == "rs") {
+                    let Ok(text) = std::fs::read_to_string(&path) else { continue };
+                    let lines: Vec<&str> = text.lines().collect();
+                    for (i, line) in lines.iter().enumerate() {
+                        let t = line.trim();
+                        // `#[tauri::command]`, `#[tauri::command(async)]`,
+                        // `#[tauri :: command]`, a bare `#[command]` under
+                        // `use tauri::command`, and any of those with a
+                        // trailing comment.
+                        let attr = t.strip_prefix("#[").map(|a| {
+                            a.split(']').next().unwrap_or("").replace(' ', "")
+                        });
+                        let is_command_attr = attr.is_some_and(|a| {
+                            a == "command" || a == "tauri::command"
+                                || a.starts_with("command(")
+                                || a.starts_with("tauri::command(")
+                        });
+                        if !is_command_attr {
+                            continue;
+                        }
+                        // Skip further attributes and doc comments rather than
+                        // giving up at the first line that is not an attribute.
+                        for next in lines.iter().skip(i + 1) {
+                            let t = next.trim();
+                            if t.starts_with('#') || t.starts_with("//") || t.is_empty() {
+                                continue;
+                            }
+                            // Any visibility, then `fn` or `async fn`.
+                            let after_vis = t
+                                .strip_prefix("pub(crate) ")
+                                .or_else(|| t.strip_prefix("pub(super) "))
+                                .or_else(|| t.strip_prefix("pub(in crate) "))
+                                .or_else(|| t.strip_prefix("pub "))
+                                .unwrap_or(t);
+                            let after_async =
+                                after_vis.strip_prefix("async ").unwrap_or(after_vis);
+                            if let Some(rest) = after_async.strip_prefix("fn ") {
+                                if let Some(name) = rest.split(['(', '<']).next() {
+                                    out.insert(name.trim().to_string());
+                                }
+                            }
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        collect(
+            std::path::Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/src")),
+            &mut defined,
+        );
+
+        // The registration list, read from this file rather than from a macro
+        // expansion so the test does not depend on `generate_handler!`'s shape.
+        let this = include_str!("lib.rs");
+        let handler = this
+            .split_once("generate_handler![")
+            .and_then(|(_, rest)| rest.split_once("])"))
+            .map(|(inside, _)| inside)
+            .expect("lib.rs should contain a generate_handler! list");
+        // Line-based, not `split(',')`: the list is grouped under `// Docker`
+        // style comments, and splitting on commas glues each comment to the
+        // command that follows it. A `starts_with("//")` filter then drops that
+        // command — silently, and once per group.
+        let registered: BTreeSet<String> = handler
+            .lines()
+            .map(str::trim)
+            .filter(|l| !l.is_empty() && !l.starts_with("//"))
+            .filter_map(|l| {
+                l.trim_end_matches(',')
+                    .rsplit("::")
+                    .next()
+                    .map(|n| n.trim().to_string())
+            })
+            .filter(|n| !n.is_empty())
+            .collect();
+
+        assert!(
+            !defined.is_empty() && !registered.is_empty(),
+            "the scan found nothing — it has stopped testing anything (defined={}, registered={})",
+            defined.len(),
+            registered.len()
+        );
+
+        let unregistered: Vec<&String> = defined.difference(&registered).collect();
+        assert!(
+            unregistered.is_empty(),
+            "these commands exist but are not registered, so the frontend cannot call them: {:?}",
+            unregistered
+        );
+
+        let undefined: Vec<&String> = registered.difference(&defined).collect();
+        assert!(
+            undefined.is_empty(),
+            "these are registered but no `#[tauri::command]` defines them: {:?}",
+            undefined
+        );
+
+        // "exactly once" was in this test's name and not in its body: both
+        // sides were sets, so registering the same command twice in a
+        // hand-maintained 118-line list compiled, warned about nothing, and
+        // passed here.
+        let mut seen: Vec<&str> = Vec::new();
+        let mut duplicated: Vec<&str> = Vec::new();
+        for line in handler
+            .lines()
+            .map(str::trim)
+            .filter(|l| !l.is_empty() && !l.starts_with("//"))
+        {
+            if let Some(name) = line.trim_end_matches(',').rsplit("::").next() {
+                let name = name.trim();
+                if name.is_empty() {
+                    continue;
+                }
+                if seen.contains(&name) {
+                    duplicated.push(name);
+                } else {
+                    seen.push(name);
+                }
+            }
+        }
+        assert!(
+            duplicated.is_empty(),
+            "these are registered more than once: {:?}",
+            duplicated
+        );
+    }
+
+    #[test]
+    fn the_capability_grants_are_the_ones_that_were_reviewed() {
+        let raw = include_str!("../capabilities/default.json");
+        let parsed: serde_json::Value =
+            serde_json::from_str(raw).expect("capabilities/default.json must parse");
+        let listed: Vec<String> = parsed["permissions"]
+            .as_array()
+            .expect("a `permissions` array")
+            .iter()
+            .map(|p| match p {
+                // A scoped grant is an object; its identifier is what matters here.
+                serde_json::Value::Object(o) => o["identifier"]
+                    .as_str()
+                    .expect("a scoped grant needs an identifier")
+                    .to_string(),
+                other => other.as_str().expect("a grant is a string or an object").to_string(),
+            })
+            .collect();
+
+        let mut sorted = listed.clone();
+        sorted.sort();
+        let mut expected = vec![
+            "core:event:allow-listen",
+            "core:event:allow-unlisten",
+            "core:webview:allow-internal-toggle-devtools",
+            "dialog:allow-open",
+            "dialog:allow-save",
+            "opener:allow-open-url",
+        ];
+        expected.sort();
+        assert_eq!(
+            sorted, expected,
+            "the capability set changed. That is allowed — but it is the IPC \
+             surface a compromised webview can call, so update this list \
+             deliberately rather than to make the test pass."
+        );
+
+        // Belt and braces: the `*:default` aliases are the specific trap here,
+        // because they expand to a set the file never spells out. `store:*` in
+        // particular was an arbitrary host-file read/write primitive.
+        for grant in &listed {
+            assert!(
+                !grant.ends_with(":default"),
+                "{} is an alias — it expands to permissions this file does not \
+                 name. Enumerate them instead.",
+                grant
+            );
+            assert!(
+                !grant.starts_with("store:"),
+                "store:* is `PathBuf::push` against AppData, which an absolute \
+                 path discards: an arbitrary host-file read/write."
+            );
+        }
+    }
 }
diff --git a/app/src-tauri/src/logging.rs b/app/src-tauri/src/logging.rs
index 0f89bd1..26dd951 100644
--- a/app/src-tauri/src/logging.rs
+++ b/app/src-tauri/src/logging.rs
@@ -1,6 +1,11 @@
 use std::fs;
 use std::path::PathBuf;
 
+/// The level the dispatch is built with, and the level restored by hand if
+/// installing it fails — see the failure branch in [`init`] for why that
+/// matters more than it looks.
+const LOG_LEVEL: log::LevelFilter = log::LevelFilter::Info;
+
 /// Returns the log directory path: `<data_dir>/triple-c/logs/`
 fn log_dir() -> Option<PathBuf> {
     dirs::data_dir().map(|d| d.join("triple-c").join("logs"))
@@ -33,7 +38,7 @@ pub fn init() {
                 message
             ))
         })
-        .level(log::LevelFilter::Info)
+        .level(LOG_LEVEL)
         .chain(std::io::stderr());
 
     if let Some((_path, file)) = &log_file_path {
@@ -41,7 +46,28 @@ pub fn init() {
     }
 
     if let Err(e) = dispatch.apply() {
-        eprintln!("Failed to initialise logger: {}", e);
+        // H2's other half. `fern::Dispatch::apply` calls `log::set_boxed_logger`
+        // and only then `log::set_max_level`, so a failure returns with the
+        // global filter still at its default, `LevelFilter::Off`. That is not
+        // merely "no log output": every `log::info!(…)` expands to
+        // `if Info <= max_level() { … }`, so at `Off` the macro never evaluates
+        // its own arguments. Anything a call site put in an argument list —
+        // a function call, an `await`, a side effect — silently stops
+        // happening, app-wide, because a logger could not be installed.
+        //
+        // Call sites must not put effects in log arguments (see the
+        // pre-migration scrub in `migration_commands.rs`), but "the whole
+        // program's log macros are dead and nothing said so" is its own
+        // hazard, so the level this dispatch was configured with is restored
+        // by hand. Nothing is listening — `log`'s default logger is a no-op —
+        // but the macros evaluate, and the one thing that *is* guaranteed to
+        // reach the user, the stderr line below, says what happened.
+        eprintln!(
+            "Failed to initialise logger: {}. Log output is disabled for this run; \
+             log macros still evaluate their arguments.",
+            e
+        );
+        log::set_max_level(LOG_LEVEL);
     }
 
     // Install a panic hook that writes to the log file so crashes are captured.
@@ -71,3 +97,40 @@ pub fn init() {
         log::info!("Logging to {}", path.display());
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_logger_that_could_not_be_installed_still_leaves_the_macros_evaluating() {
+        // H2: `log::info!(…)` expands to `if Info <= max_level() { … }`, so at
+        // `LevelFilter::Off` the arguments are never evaluated. `fern` returns
+        // before `set_max_level` when `apply()` fails, which leaves exactly
+        // that state — and a call site that folded an effect into an argument
+        // list then stops performing it, app-wide, because a log file could not
+        // be opened. The failure branch restores the level for that reason.
+        //
+        // Asserted on the level itself rather than by driving `init`, which
+        // installs a process-global logger and a panic hook and can only run
+        // once per process.
+        assert_ne!(LOG_LEVEL, log::LevelFilter::Off);
+
+        // The property that makes the above worth asserting, demonstrated
+        // against the macro itself: a side effect in an argument list runs only
+        // while the level admits the record.
+        let mut ran = false;
+        let effect = |v: &mut bool| {
+            *v = true;
+            0
+        };
+        let previous = log::max_level();
+        log::set_max_level(log::LevelFilter::Off);
+        log::info!("{}", effect(&mut ran));
+        assert!(!ran, "the premise is wrong: arguments evaluated at LevelFilter::Off");
+        log::set_max_level(LOG_LEVEL);
+        log::info!("{}", effect(&mut ran));
+        assert!(ran, "arguments did not evaluate at the level this module configures");
+        log::set_max_level(previous);
+    }
+}
diff --git a/app/src-tauri/src/models/project.rs b/app/src-tauri/src/models/project.rs
index 385ee8a..dfa8f38 100644
--- a/app/src-tauri/src/models/project.rs
+++ b/app/src-tauri/src/models/project.rs
@@ -8,6 +8,100 @@ pub struct EnvVar {
     pub value: String,
 }
 
+/// Whether `key` is a name a shell will read back as an ordinary variable:
+/// `[A-Za-z_][A-Za-z0-9_]*`.
+///
+/// ## Why a charset rule, and not just the reserved-name list
+///
+/// `docker::container::is_reserved_env_key` answers a different question — "is
+/// this one of the names Triple-C manages itself" — and nothing anywhere asked
+/// what the *characters* were. A key is joined into `KEY=VALUE` and handed to
+/// the daemon, which puts it in the container's environment verbatim, so a name
+/// that is not an identifier travels through unchallenged.
+///
+/// The one that matters is `BASH_FUNC_name%%`, bash's wire format for an
+/// exported shell function: bash imports those at startup and the *body* is the
+/// value. Today that is latent rather than live — the image's `/bin/sh` is
+/// dash, which does not import them, and an auditor confirmed the vector fires
+/// under `bash -c` and not under `sh -c` in the shipped image. But the
+/// pre-commit scrub runs `/bin/sh -c` **as root**, `/bin/sh` is whatever
+/// `ubuntu:24.04` points it at, and nothing pins that. One base-image change,
+/// or one call site spelled `bash`, turns a stored project setting into root
+/// code execution inside the container at commit time.
+///
+/// So the rule is the shape of the thing rather than a list of the names that
+/// are known to be dangerous: `IFS`, `LD_PRELOAD` and `PATH` are all perfectly
+/// good identifiers and are the user's business, while nothing legitimate needs
+/// a `%`, a `(` or a space in an environment variable name.
+///
+/// The key is judged **trimmed**, because that is what `create_container` sends
+/// — ` FOO ` already reaches the container as `FOO`, and refusing it here would
+/// break a setting that works.
+pub fn is_valid_env_key(key: &str) -> bool {
+    let mut chars = key.trim().chars();
+    match chars.next() {
+        Some(c) if c.is_ascii_alphabetic() || c == '_' => {}
+        _ => return false,
+    }
+    chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
+}
+
+/// Validate a custom environment variable list that is about to be stored,
+/// admitting the entries it is already stored with.
+///
+/// Same shape, and the same reasoning, as
+/// `commands::project_commands::validate_project_paths_update`: nothing ever
+/// checked these keys, so `projects.json` and `settings.json` in the field can
+/// hold whatever was typed. Holding every save to the new rule would make such
+/// a project unsavable *entirely* — `update_project` is the single command
+/// behind the whole Config tab — and would buy nothing, because the stored key
+/// is already being handed to every container that starts. An entry carried
+/// over verbatim is admitted; a new or edited one is held to the rule, which is
+/// what keeps the escalation closed, since escalation means *introducing* a bad
+/// key through this command.
+///
+/// Counted rather than set-tested, for the same reason as the folder rows: a
+/// second copy of an existing entry is a new entry.
+///
+/// The blank entry is not a violation. "+ Add variable" appends
+/// `{key: "", value: ""}` and saves the list immediately, so refusing it would
+/// turn the button itself into an error toast; `create_container` skips an
+/// empty key, so it reaches nothing.
+pub fn validate_env_vars_update(stored: &[EnvVar], incoming: &[EnvVar]) -> Result<(), String> {
+    // An entry with no key is the placeholder, whatever is in its value:
+    // `create_container` skips it, so it reaches nothing and there is nothing
+    // to refuse. The editor saves on every blur, and typing the value before
+    // the name is an ordinary way to fill a row in.
+    let is_blank = |v: &EnvVar| v.key.trim().is_empty();
+
+    let mut carried: std::collections::HashMap<(&str, &str), usize> =
+        std::collections::HashMap::new();
+    for v in stored.iter().filter(|v| !is_blank(v)) {
+        *carried
+            .entry((v.key.as_str(), v.value.as_str()))
+            .or_insert(0) += 1;
+    }
+
+    for v in incoming.iter().filter(|v| !is_blank(v)) {
+        match carried.get_mut(&(v.key.as_str(), v.value.as_str())) {
+            Some(remaining) if *remaining > 0 => {
+                *remaining -= 1;
+            }
+            _ => {
+                if !is_valid_env_key(&v.key) {
+                    return Err(format!(
+                        "'{}' is not a usable environment variable name. Use a letter or \
+                         underscore followed by letters, digits or underscores.",
+                        v.key
+                    ));
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct ProjectPath {
     pub host_path: String,
@@ -85,31 +179,141 @@ impl PermissionMode {
 /// Settings for Claude Code CLI behavior inside the container.
 /// These map to Claude Code env vars and ~/.claude/settings.json entries.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+#[serde(from = "StoredClaudeCodeSettings")]
+/// Every field is three-state, and the third state is load-bearing.
+///
+/// `None` means "not set at this level". For a *project* that is "inherit
+/// whatever the global settings say"; for the *global* settings it is "leave
+/// Claude Code's own default alone". `Some(false)` is a deliberate off, which
+/// is what lets a project turn a globally-enabled setting back off — with a
+/// plain `bool` there is no value that can express that, which is why these
+/// were widened from `bool`.
 pub struct ClaudeCodeSettings {
-    /// TUI rendering mode: None = default, Some("fullscreen") = flicker-free alt-screen
-    #[serde(default)]
+    /// TUI renderer. `None` leaves settings.json's `tui` key unset, which is
+    /// what lets Claude Code pick the renderer itself; `Some("default")` pins
+    /// the classic main-screen renderer and `Some("fullscreen")` the alt-screen
+    /// one. All three are distinct — "let it choose" is not "classic".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub tui_mode: Option<String>,
-    /// Effort level: None = default, Some("low"|"medium"|"high")
-    #[serde(default)]
+    /// Saved `/effort` level: `None` = unset, otherwise one of
+    /// `"low" | "medium" | "high" | "xhigh"`. Written to settings.json as
+    /// `effortLevel` (**not** `effort`, which Claude Code has never read).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub effort: Option<String>,
-    /// Disable auto-scroll in fullscreen TUI mode
-    #[serde(default)]
-    pub auto_scroll_disabled: bool,
-    /// Enable focus mode (collapsed tool output)
-    #[serde(default)]
-    pub focus_mode: bool,
+    /// Disable auto-scroll in fullscreen TUI mode. Held in the *disabled* sense
+    /// because Claude Code's `autoScrollEnabled` defaults to `true`, so the
+    /// zero value of this field has to mean "leave it on".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_scroll_disabled: Option<bool>,
+    /// Collapse tool output to one-line summaries. Written to settings.json as
+    /// `viewMode: "focus"`; there is no `focusMode` key in Claude Code.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub focus_mode: Option<bool>,
     /// Show thinking summaries in responses
-    #[serde(default)]
-    pub show_thinking_summaries: bool,
-    /// Enable session recap when returning to a session
-    #[serde(default)]
-    pub enable_session_recap: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub show_thinking_summaries: Option<bool>,
+    /// Turn the session recap **off**.
+    ///
+    /// Held in the disabled sense for the same reason as `auto_scroll_disabled`,
+    /// and the rename from the old `enable_session_recap` is load-bearing rather
+    /// than cosmetic. Claude Code's recap is on by default, so the old field was
+    /// inverted: switching it on was a no-op and switching it off did nothing at
+    /// all. Reusing the name with the opposite meaning would have read every
+    /// stored `enable_session_recap: false` — which is what every project that
+    /// never touched the control holds — as "the user turned the recap off" and
+    /// silently disabled it for all of them. A new name lets the old key be
+    /// ignored, which lands every existing project on the correct default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub session_recap_disabled: Option<bool>,
     /// Strip credentials from subprocess environments
-    #[serde(default)]
-    pub env_scrub: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub env_scrub: Option<bool>,
     /// Enable 1-hour prompt cache TTL (vs default 5-minute)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub prompt_caching_1h: Option<bool>,
+}
+
+/// `ClaudeCodeSettings` in every shape `projects.json` and `settings.json` can
+/// be holding, which is what [`ClaudeCodeSettings`] is actually deserialised
+/// through.
+///
+/// ## The upgrade this exists to survive
+///
+/// Before the widening, the five booleans were plain `bool`s with
+/// `#[serde(default)]` and no `skip_serializing_if`, so **every** settings
+/// object ever written carries an explicit `"env_scrub": false` — not because
+/// anyone chose it, but because that is what a `bool` serialises to. Under the
+/// old merge (`if p.x { true } else { g.x }`) that `false` carried no
+/// information at all: it was the only value an unset switch could produce, and
+/// the global always won.
+///
+/// Read as `Some(false)` by the new code it becomes a *deliberate off* that
+/// beats a global `Some(true)` — so upgrading silently turned five settings off
+/// for every project that had ever opened this editor, `env_scrub` ("strip
+/// credentials from subprocess environments") among them. There is no store
+/// migration anywhere: `projects_store` parses these structs directly.
+///
+/// ## How an old record is told apart from a new one
+///
+/// By `enable_session_recap`. It was in the struct from the day it existed and
+/// was a plain `bool`, so its key is present in every pre-widening record and
+/// in no other — the field was *renamed* to `session_recap_disabled` precisely
+/// so the old key could be ignored (see the doc on that field), and the new
+/// code has never written it. Its presence is therefore an exact statement that
+/// these bytes were written by a binary in which `false` meant "unset", and the
+/// booleans are read back that way: `true` is a real choice and survives,
+/// `false` becomes `None` and inherits again.
+///
+/// Nothing marks a *new* record, and nothing needs to: absent is `None` (the
+/// fields skip serialising when unset) and a present `false` is the deliberate
+/// off the widening was for. That is also what keeps a downgrade survivable —
+/// an older binary reads an absent key as `false` through its own
+/// `#[serde(default)]`, where a `null` would fail to parse and take the whole
+/// of `projects.json` down with it, since `ProjectsStore` parses all-or-nothing
+/// and starts empty on an error.
+#[derive(Deserialize)]
+struct StoredClaudeCodeSettings {
     #[serde(default)]
-    pub prompt_caching_1h: bool,
+    tui_mode: Option<String>,
+    #[serde(default)]
+    effort: Option<String>,
+    #[serde(default)]
+    auto_scroll_disabled: Option<bool>,
+    #[serde(default)]
+    focus_mode: Option<bool>,
+    #[serde(default)]
+    show_thinking_summaries: Option<bool>,
+    #[serde(default)]
+    session_recap_disabled: Option<bool>,
+    #[serde(default)]
+    env_scrub: Option<bool>,
+    #[serde(default)]
+    prompt_caching_1h: Option<bool>,
+    /// The pre-widening spelling of `session_recap_disabled`, and the *only*
+    /// use of its value: presence dates the record. Its meaning was inverted
+    /// and it never worked, so it is read for the marker and discarded.
+    #[serde(default)]
+    enable_session_recap: Option<bool>,
+}
+
+impl From<StoredClaudeCodeSettings> for ClaudeCodeSettings {
+    fn from(stored: StoredClaudeCodeSettings) -> Self {
+        let pre_widening = stored.enable_session_recap.is_some();
+        // On a pre-widening record `false` is what an untouched switch wrote,
+        // so it means "not set at this level" and must inherit. A `true` was a
+        // real choice either way.
+        let read = |v: Option<bool>| if pre_widening { v.filter(|on| *on) } else { v };
+        ClaudeCodeSettings {
+            tui_mode: stored.tui_mode,
+            effort: stored.effort,
+            auto_scroll_disabled: read(stored.auto_scroll_disabled),
+            focus_mode: read(stored.focus_mode),
+            show_thinking_summaries: read(stored.show_thinking_summaries),
+            session_recap_disabled: read(stored.session_recap_disabled),
+            env_scrub: read(stored.env_scrub),
+            prompt_caching_1h: read(stored.prompt_caching_1h),
+        }
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -441,3 +645,170 @@ impl Project {
         val
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // ── Custom environment variable names ─────────────────────────────────
+
+    #[test]
+    fn an_env_var_name_has_to_be_a_shell_identifier() {
+        for ok in ["PATH", "_", "_x", "MY_VAR2", "a", " SPACED_BY_THE_EDITOR "] {
+            assert!(is_valid_env_key(ok), "'{}' should be a usable name", ok);
+        }
+        for bad in [
+            // bash's wire format for an exported shell function: the value is
+            // the body, and a `bash` that imports it runs it. The scrub exec is
+            // `/bin/sh -c` as root, and nothing pins `/bin/sh` to dash.
+            "BASH_FUNC_stat%%",
+            "BASH_FUNC_ls()",
+            "MY VAR",
+            "2FAST",
+            "WITH-DASH",
+            "WITH.DOT",
+            "",
+            "   ",
+            "$(id)",
+            "A=B",
+        ] {
+            assert!(!is_valid_env_key(bad), "'{}' should be refused", bad);
+        }
+    }
+
+    fn env(key: &str, value: &str) -> EnvVar {
+        EnvVar { key: key.to_string(), value: value.to_string() }
+    }
+
+    #[test]
+    fn a_bad_env_var_name_cannot_be_introduced_but_a_stored_one_does_not_brick_the_editor() {
+        let bad = [env("BASH_FUNC_stat%%", "() { id; }")];
+        // Introducing it through the Config tab is the escalation.
+        assert!(validate_env_vars_update(&[], &bad).is_err());
+        // Already stored: it is handed to every container that starts whether
+        // or not an unrelated save is allowed through, and refusing the save
+        // would make every toggle on the Config tab fail.
+        assert!(validate_env_vars_update(&bad, &bad).is_ok());
+        // Editing its value is a new entry, and refused again.
+        assert!(
+            validate_env_vars_update(&bad, &[env("BASH_FUNC_stat%%", "() { rm -rf /; }")]).is_err()
+        );
+        // Fixing the name is what the message asks for, and it saves.
+        assert!(validate_env_vars_update(&bad, &[env("STAT", "() { id; }")]).is_ok());
+        // Dropping it entirely is always fine.
+        assert!(validate_env_vars_update(&bad, &[]).is_ok());
+    }
+
+    #[test]
+    fn the_blank_row_the_add_button_saves_is_not_an_error() {
+        // "+ Add variable" appends an empty entry and saves the list at once,
+        // so this is the button, not an attempt at anything.
+        assert!(validate_env_vars_update(&[], &[env("", "")]).is_ok());
+        // Typing the value before the name is an ordinary way to fill it in,
+        // and an entry with no name reaches no container either way.
+        assert!(validate_env_vars_update(&[], &[env("", "value-first")]).is_ok());
+        assert!(validate_env_vars_update(&[], &[env("GOOD", "v"), env("", "")]).is_ok());
+    }
+
+    #[test]
+    fn a_stored_entry_may_be_kept_but_not_multiplied() {
+        let stored = [env("BAD NAME", "v")];
+        assert!(validate_env_vars_update(&stored, &stored).is_ok());
+        // A second copy is a new entry, and held to the rule.
+        assert!(
+            validate_env_vars_update(&stored, &[env("BAD NAME", "v"), env("BAD NAME", "v")])
+                .is_err()
+        );
+    }
+
+    // ── Claude Code settings written before the fields were widened ───────
+
+    /// `projects.json` exactly as the shipped `main` binary wrote it: the five
+    /// booleans were plain `bool`s that always serialised, so every project
+    /// that ever opened the editor carries `false` for the ones it never
+    /// touched.
+    const MAIN_SHAPE_PROJECT: &str = r#"{
+        "id": "p1",
+        "name": "demo",
+        "paths": [{ "host_path": "/home/u/demo", "mount_name": "demo" }],
+        "container_id": null,
+        "status": "stopped",
+        "backend": "anthropic",
+        "bedrock_config": null,
+        "ollama_config": null,
+        "openai_compatible_config": null,
+        "allow_docker_access": false,
+        "ssh_key_path": null,
+        "git_user_name": null,
+        "git_user_email": null,
+        "claude_code_settings": {
+            "tui_mode": "fullscreen",
+            "effort": null,
+            "auto_scroll_disabled": false,
+            "focus_mode": false,
+            "show_thinking_summaries": false,
+            "enable_session_recap": false,
+            "env_scrub": false,
+            "prompt_caching_1h": false
+        },
+        "created_at": "2026-01-01T00:00:00Z",
+        "updated_at": "2026-01-01T00:00:00Z"
+    }"#;
+
+    #[test]
+    fn a_setting_stored_as_false_by_the_old_binary_still_inherits_the_global() {
+        let project: Project = serde_json::from_str(MAIN_SHAPE_PROJECT).unwrap();
+        let stored = project.claude_code_settings.expect("settings should parse");
+
+        // Read verbatim these would be `Some(false)`, which under
+        // `docker::container::merge_claude_code_settings` beats the global.
+        assert_eq!(stored.env_scrub, None);
+        assert_eq!(stored.auto_scroll_disabled, None);
+        assert_eq!(stored.focus_mode, None);
+        assert_eq!(stored.show_thinking_summaries, None);
+        assert_eq!(stored.prompt_caching_1h, None);
+        assert_eq!(stored.session_recap_disabled, None);
+        // A value the user did choose is untouched.
+        assert_eq!(stored.tui_mode.as_deref(), Some("fullscreen"));
+
+        // The merge rule itself, spelled the way
+        // `merge_claude_code_settings` spells it. `main` resolved this with
+        // `if p.env_scrub { true } else { g.env_scrub }`, i.e. the global won —
+        // and it has to go on winning, because the user never turned this off.
+        let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() };
+        assert_eq!(
+            stored.env_scrub.or(global.env_scrub),
+            Some(true),
+            "upgrading silently turned off 'strip credentials from subprocess environments'"
+        );
+    }
+
+    #[test]
+    fn an_off_chosen_in_the_new_editor_still_beats_a_global_on() {
+        // Same record without the pre-widening key: this `false` is the
+        // deliberate off the widening exists to make expressible.
+        let json = r#"{ "env_scrub": false }"#;
+        let chosen: ClaudeCodeSettings = serde_json::from_str(json).unwrap();
+        assert_eq!(chosen.env_scrub, Some(false));
+        let global = ClaudeCodeSettings { env_scrub: Some(true), ..Default::default() };
+        assert_eq!(chosen.env_scrub.or(global.env_scrub), Some(false));
+    }
+
+    #[test]
+    fn an_unset_setting_is_written_as_absent_rather_than_null() {
+        // A downgrade parses these fields as plain `bool` with
+        // `#[serde(default)]`: an absent key is `false`, a `null` is a parse
+        // error — and `ProjectsStore` parses all-or-nothing, so one project
+        // with one null empties the whole list and the next save persists that.
+        let json = serde_json::to_string(&ClaudeCodeSettings::default()).unwrap();
+        assert_eq!(json, "{}");
+        assert!(!json.contains("null"));
+
+        let partial = ClaudeCodeSettings { env_scrub: Some(false), ..Default::default() };
+        let json = serde_json::to_string(&partial).unwrap();
+        assert_eq!(json, r#"{"env_scrub":false}"#);
+        // And it reads back as what it is.
+        let round_tripped: ClaudeCodeSettings = serde_json::from_str(&json).unwrap();
+        assert_eq!(round_tripped, partial);
+    }
+}
diff --git a/app/src-tauri/src/project_lock.rs b/app/src-tauri/src/project_lock.rs
new file mode 100644
index 0000000..8eb47e3
--- /dev/null
+++ b/app/src-tauri/src/project_lock.rs
@@ -0,0 +1,370 @@
+//! Per-project mutual exclusion for everything that rewrites a project's
+//! container or its snapshot image.
+//!
+//! ## Why polling was not enough
+//!
+//! Until this module existed the app had exactly one mutual-exclusion
+//! primitive — the `ACTIVE_MIGRATIONS` set behind
+//! `migration_commands::is_migrating` — and it was **one-way**. A migration
+//! took a guard for its whole run; everything else merely *asked once, at
+//! entry*, whether a migration was in flight and then proceeded with no claim
+//! of its own. Two non-migration operations on the same project could not see
+//! each other at all, and a migration could start underneath one that was
+//! already halfway through.
+//!
+//! That is not a theoretical gap. Compaction resolves
+//! `triple-c-snapshot-{id}:latest` when its build starts and commits back over
+//! that same tag minutes later, and the Settings panel is a sidebar rather than
+//! a modal — so Project Home stays live with Start, Stop, Reset and Migrate all
+//! clickable while a compaction runs. Three interleavings were reproduced:
+//!
+//! * Compaction commits `flat(A)` over `:latest` after a migration has already
+//!   moved that tag to a new lineage. The migration is silently reverted, the
+//!   config replay lands twice, and the migration record says
+//!   `awaiting-confirmation` against a base the tag no longer points at.
+//! * Compaction resolves A, the user starts the project and works for an hour,
+//!   a recreate commits D over `:latest`, and the compaction then overwrites it
+//!   with `flat(A)` — orphaning an hour of system-layer work while reporting
+//!   success and a byte saving.
+//! * Compaction resurrects the system layer a Reset had just destroyed.
+//!
+//! Every one of those is "two writers of `:latest`, neither holding anything".
+//! So this registry replaces the polling with an actual claim: an operation
+//! **acquires** a [`ProjectGuard`] and holds it for its whole run, and a second
+//! operation on the same project is refused with a message naming the holder.
+//!
+//! ## What this does NOT protect against, stated plainly
+//!
+//! **This is in-process state.** Two copies of the app pointed at the same
+//! Docker daemon share nothing here: instance A's compaction and instance B's
+//! migration will both acquire happily and then race exactly as before.
+//! `reap_probe_containers` and the `triple-c-compact-*` / `triple-c-scrub-*`
+//! sweeps are worse than that — they are daemon-wide force-removals driven by
+//! a name or a label, so instance B can destroy a container instance A is
+//! mid-commit against.
+//!
+//! A daemon-visible lock was considered and rejected for now, and the reasoning
+//! is recorded here so it is not re-derived from scratch:
+//!
+//! * A **lock container** would work — container names are unique daemon-wide
+//!   and `create` fails atomically on a name conflict — but a container has to
+//!   be created *from an image*, and that pins the image. A lock on
+//!   `triple-c-snapshot-{id}` would block the very `rmi`/sweep paths it guards,
+//!   and a leaked lock container would pin multiple gigabytes forever.
+//! * A **named volume** is not usable: `create_volume` on an existing name
+//!   returns the existing volume rather than failing, so it cannot be a
+//!   test-and-set.
+//! * A **label on the snapshot image** is not atomic — read/modify/commit has
+//!   the same race it would be trying to close.
+//!
+//! So the cross-process case is **documented, not solved**. What this module
+//! does do about it is bound the damage: [`any_held_excluding`] lets the daemon-wide
+//! reapers skip work while this process is mid-operation, and the reapers
+//! themselves gained age gates so a young container belonging to somebody else
+//! is left alone (see `docker::migration::reap_probe_containers`).
+//!
+//! ## Refuse, do not queue
+//!
+//! [`try_acquire`] never waits. Every caller is a user-initiated action behind
+//! a button, and a button that blocks for the four minutes a compaction takes
+//! is worse than one that says what is running. The refusal string is written
+//! for the user and names the holder.
+
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock};
+
+/// The operations that claim a project.
+///
+/// One variant per *class of writer*, not per command: `Recreate` covers Start
+/// as well, because Start's create-and-commit path is the same writer of
+/// `triple-c-snapshot-{id}:latest` that a recreate is.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProjectOp {
+    /// `migrate_project_to_base`, `resume_migration`, `rollback_migration`,
+    /// `confirm_migration`.
+    Migration,
+    /// `disk::compact_snapshot` — the long one, and the reason this exists.
+    ///
+    /// Not constructed on this branch: the Disk panel and its compaction were
+    /// held back for separate hardening and live on `hold/disk-and-dragout`.
+    /// The variant stays because this registry is the thing that made those
+    /// operations safe to re-land, and a re-land that had to re-derive the
+    /// claim classes would be re-deriving the bug.
+    #[allow(dead_code)]
+    Compaction,
+    /// Start / stop / recreate. Anything in `start_project_container`'s path.
+    Recreate,
+    /// `rebuild_project_container` — deletes both volumes and the snapshot.
+    Reset,
+    /// `disk::destroy` — a volume, a snapshot image, or a rollback pin.
+    Destroy,
+    /// `disk::clear_caches` — an exec into the live container. It does not
+    /// write `:latest`, but it must not run while the container is being
+    /// removed out from under it.
+    ///
+    /// Not constructed on this branch, for the same reason as
+    /// [`ProjectOp::Compaction`].
+    #[allow(dead_code)]
+    CacheClear,
+    /// `container::scrub_secrets_from_snapshots` — the third writer of
+    /// `triple-c-snapshot-{id}:latest`, reached from `clear_claude_token`. It
+    /// creates a scratch container from the snapshot and commits back over the
+    /// same tag, so it is the same read-modify-write shape as a compaction and
+    /// loses the same race: any `:latest` move landing between its create and
+    /// its commit is overwritten by an image derived from the pre-read state.
+    SecretScrub,
+}
+
+impl ProjectOp {
+    /// What is happening, phrased for the message a user reads.
+    pub fn describe(self) -> &'static str {
+        match self {
+            ProjectOp::Migration => "A container base update is running for this project",
+            ProjectOp::Compaction => "This project's snapshot is being compacted",
+            ProjectOp::Recreate => "This project's container is being started or recreated",
+            ProjectOp::Reset => "This project is being reset",
+            ProjectOp::Destroy => "Something of this project's is being deleted",
+            ProjectOp::CacheClear => "This project's caches are being cleared",
+            ProjectOp::SecretScrub => "A revoked credential is being removed from this project's snapshot",
+        }
+    }
+
+    /// What the *refused* caller was trying to do, for the tail of the message.
+    fn blocked_action(self) -> &'static str {
+        match self {
+            ProjectOp::Migration => "starting a base update",
+            ProjectOp::Compaction => "compacting its snapshot",
+            ProjectOp::Recreate => "starting or recreating its container",
+            ProjectOp::Reset => "resetting it",
+            ProjectOp::Destroy => "deleting anything of its",
+            ProjectOp::CacheClear => "clearing its caches",
+            ProjectOp::SecretScrub => "removing a credential from its snapshot",
+        }
+    }
+}
+
+/// Project id → the operation currently holding it.
+///
+/// A `std::sync::Mutex` rather than a `tokio` one on purpose: it is only ever
+/// held for the length of a `HashMap` insert or remove, never across an await,
+/// and [`is_held_by`] has to be callable from the synchronous helpers in
+/// `disk.rs` that already ask this question.
+static HOLDERS: OnceLock<Mutex<HashMap<String, ProjectOp>>> = OnceLock::new();
+
+fn holders() -> &'static Mutex<HashMap<String, ProjectOp>> {
+    HOLDERS.get_or_init(|| Mutex::new(HashMap::new()))
+}
+
+/// A claim on one project, released on drop.
+///
+/// RAII rather than an explicit release for the reason [`ProjectOp::Migration`]'s
+/// predecessor already learned: a plain release statement is skipped by an
+/// early `?`, by a panic, and by the future simply being dropped. A guard is
+/// not.
+/// Dropping this releases the claim, so a caller that discards it has taken no
+/// lock at all — `let _ = try_acquire(...)` drops immediately and reads as
+/// success. `#[must_use]` makes that a compile warning rather than a race.
+#[must_use = "the claim is released as soon as this guard is dropped; bind it for the whole operation"]
+#[derive(Debug)]
+pub struct ProjectGuard {
+    project_id: String,
+}
+
+impl Drop for ProjectGuard {
+    fn drop(&mut self) {
+        // `into_inner` on a poisoned lock: a panic while some other thread held
+        // this map for the duration of one insert cannot have left it
+        // inconsistent, and refusing to release afterwards would strand the
+        // project as permanently busy.
+        holders()
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .remove(&self.project_id);
+    }
+}
+
+/// Claim a project for `op`, or say who has it.
+///
+/// The error is user-facing copy, not a debug string — it goes straight back
+/// over IPC to a toast.
+pub fn try_acquire(project_id: &str, op: ProjectOp) -> Result<ProjectGuard, String> {
+    let mut map = holders().lock().unwrap_or_else(|e| e.into_inner());
+    if let Some(holder) = map.get(project_id).copied() {
+        return Err(format!(
+            "{}. Wait for it to finish before {}.",
+            holder.describe(),
+            op.blocked_action()
+        ));
+    }
+    map.insert(project_id.to_string(), op);
+    Ok(ProjectGuard {
+        project_id: project_id.to_string(),
+    })
+}
+
+/// Which operation holds this project, if any.
+pub fn held(project_id: &str) -> Option<ProjectOp> {
+    holders()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(project_id)
+        .copied()
+}
+
+/// Whether this project is held by exactly `op`.
+///
+/// `migration_commands::is_migrating` is this, specialised — which is the whole
+/// point of folding `ACTIVE_MIGRATIONS` into this registry: there is now one
+/// answer to "is something happening to this project", not two that can
+/// disagree.
+pub fn is_held_by(project_id: &str, op: ProjectOp) -> bool {
+    held(project_id) == Some(op)
+}
+
+/// Whether any project **other than** `exclude_project_id` is currently held by
+/// `op`. Pass an empty id to ask about every project.
+///
+/// Used by the daemon-wide reapers, which cannot tell which project a
+/// `triple-c-compact-*` container belongs to — the name carries a random uuid,
+/// not a project id — so "is this process compacting anything right now" is the
+/// only in-process question they can ask before force-removing one. The
+/// exclusion is for the reaper that runs *inside* a compaction, which is
+/// already holding a claim of its own and would otherwise see it and skip.
+///
+/// No production caller on this branch: the compaction reaper it was written
+/// for went to `hold/disk-and-dragout` with the rest of the Disk panel. Kept
+/// (and still tested) because it is the only bound this module offers on the
+/// cross-process case documented above.
+#[allow(dead_code)]
+pub fn any_held_excluding(op: ProjectOp, exclude_project_id: &str) -> bool {
+    holders()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .iter()
+        .any(|(project_id, held)| *held == op && project_id != exclude_project_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Ids are namespaced per test: the registry is process-global, and
+    /// `cargo test` runs these on several threads at once.
+    fn id(name: &str) -> String {
+        format!("project-lock-test-{}", name)
+    }
+
+    #[test]
+    fn a_second_acquire_on_the_same_project_is_refused() {
+        let p = id("second-acquire");
+        let first = try_acquire(&p, ProjectOp::Compaction).expect("first claim");
+        let second = try_acquire(&p, ProjectOp::Recreate);
+        let err = second.expect_err("a second claim must be refused, not queued");
+        // The refusal has to name the holder — "busy" alone leaves the user
+        // with nothing to wait for.
+        assert!(err.contains("snapshot is being compacted"), "{}", err);
+        assert!(err.contains("starting or recreating"), "{}", err);
+        drop(first);
+        // And it has to be retakeable the moment the holder goes away. Bound
+        // rather than discarded: `#[must_use]` is what stops a real caller
+        // writing `try_acquire(...)` and believing it holds something.
+        let retaken = try_acquire(&p, ProjectOp::Recreate).expect("released on drop");
+        drop(retaken);
+    }
+
+    #[test]
+    fn the_guard_releases_on_an_early_return() {
+        let p = id("early-return");
+        fn bails(project_id: &str) -> Result<(), String> {
+            let _guard = try_acquire(project_id, ProjectOp::Reset)?;
+            Err("something failed".to_string())
+        }
+        assert!(bails(&p).is_err());
+        assert_eq!(held(&p), None, "an early `?` must not strand the claim");
+    }
+
+    #[test]
+    fn the_guard_releases_on_a_panic() {
+        let p = id("panic");
+        let result = std::panic::catch_unwind(|| {
+            let _guard = try_acquire(&id("panic"), ProjectOp::Migration).unwrap();
+            panic!("boom");
+        });
+        assert!(result.is_err());
+        assert_eq!(held(&p), None, "a panic must not strand the claim either");
+    }
+
+    #[test]
+    fn two_projects_do_not_block_each_other() {
+        let a = id("independent-a");
+        let b = id("independent-b");
+        let _one = try_acquire(&a, ProjectOp::Compaction).expect("a");
+        let _two = try_acquire(&b, ProjectOp::Compaction).expect("b");
+        assert!(is_held_by(&a, ProjectOp::Compaction));
+        assert!(is_held_by(&b, ProjectOp::Compaction));
+    }
+
+    #[test]
+    fn is_held_by_distinguishes_the_operation() {
+        let p = id("which-op");
+        let _guard = try_acquire(&p, ProjectOp::Compaction).unwrap();
+        assert!(is_held_by(&p, ProjectOp::Compaction));
+        assert!(
+            !is_held_by(&p, ProjectOp::Migration),
+            "a compaction is not a migration — `is_migrating` is built on this"
+        );
+    }
+
+    #[test]
+    fn any_held_sees_across_projects() {
+        let p = id("any-held");
+        assert!(!any_held_excluding(ProjectOp::Destroy, ""));
+        let _guard = try_acquire(&p, ProjectOp::Destroy).unwrap();
+        assert!(any_held_excluding(ProjectOp::Destroy, ""));
+        // …and a holder can ask the question without its own claim answering
+        // it, which is what lets a compaction sweep leftovers before it starts.
+        assert!(!any_held_excluding(ProjectOp::Destroy, &p));
+    }
+
+    /// Concurrency, not just sequencing: N threads racing for one project must
+    /// produce exactly one winner.
+    #[test]
+    fn exactly_one_of_many_racing_threads_wins() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        use std::sync::Arc;
+
+        let p = id("race");
+        let start = Arc::new(std::sync::Barrier::new(8));
+        // The second barrier is what makes this deterministic rather than
+        // merely likely: no winner releases until every thread has had its
+        // turn, so "only one got in" cannot be an artefact of a loser arriving
+        // after the winner already left.
+        let attempted = Arc::new(std::sync::Barrier::new(8));
+        let won = Arc::new(AtomicUsize::new(0));
+        let mut handles = Vec::new();
+        for _ in 0..8 {
+            let start = Arc::clone(&start);
+            let attempted = Arc::clone(&attempted);
+            let won = Arc::clone(&won);
+            let p = p.clone();
+            handles.push(std::thread::spawn(move || {
+                start.wait();
+                let claim = try_acquire(&p, ProjectOp::Compaction);
+                if claim.is_ok() {
+                    won.fetch_add(1, Ordering::SeqCst);
+                }
+                attempted.wait();
+                drop(claim);
+            }));
+        }
+        for handle in handles {
+            handle.join().unwrap();
+        }
+        assert_eq!(
+            won.load(Ordering::SeqCst),
+            1,
+            "eight threads raced for one project and more than one got in"
+        );
+        assert_eq!(held(&p), None);
+    }
+}
diff --git a/app/src-tauri/src/storage/migration_store.rs b/app/src-tauri/src/storage/migration_store.rs
index 88a4b80..3cc8699 100644
--- a/app/src-tauri/src/storage/migration_store.rs
+++ b/app/src-tauri/src/storage/migration_store.rs
@@ -49,6 +49,29 @@ fn sanitize(project_id: &str) -> String {
 /// Read a project's migration state. `Ok(None)` means no migration is in
 /// flight; an unparseable file is treated the same way (and logged) rather than
 /// blocking every future migration on a corrupt record.
+///
+/// **A corrupt record is copied aside and left in place.** An earlier version
+/// *renamed* it to `.bak`, on the reasoning that a file nothing can parse
+/// should stop making the project look busy. That destroyed the one signal
+/// [`has_record`] exists to carry. The chain, in order:
+///
+/// 1. The rename makes the file vanish, so `has_record` — pure filesystem
+///    presence — flips to false.
+/// 2. `reconcile_migration` calls this, gets `Ok(None)`, and returns. An
+///    in-flight or interrupted migration becomes invisible: no resume offer, no
+///    rollback offer, and the phase is never normalised.
+/// 3. Both pin reapers use `has_record` as their conservative guard, so the
+///    project's `:pre-migration-*` tag — the only copy of its pre-migration
+///    system layer — is now "ownerless" to both of them, and the startup sweep
+///    turns the untag into a deletion.
+///
+/// A record that cannot be parsed is exactly the case where the *most*
+/// conservative answer is wanted, not the least. So the bytes are copied to a
+/// **uniquely named** backup (a fixed `.bak` meant a second corruption silently
+/// overwrote the first, and nothing ever read either back) and the original
+/// stays where it is. The pin it describes then ages out through the ownerless
+/// tombstone in `docker::migration::reap_stale_migration_pins` rather than
+/// being reaped on the next app start.
 pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
     let path = state_path(project_id)?;
     if !path.exists() {
@@ -59,27 +82,326 @@ pub fn load(project_id: &str) -> Result<Option<MigrationState>, String> {
     match serde_json::from_str::<MigrationState>(&data) {
         Ok(state) => Ok(Some(state)),
         Err(e) => {
+            // Three outcomes, and they must not be conflated: a copy was made,
+            // a copy was deliberately not made, or a copy failed. The previous
+            // version folded "already kept enough" into `Ok(())` and then told
+            // the user "a copy was kept at <path>" — naming a file that was
+            // never created. A message that invents a backup is worse than no
+            // message, because it is what someone reads before going to look
+            // for their data.
+            let backup = corrupt_backup_path(&path, &chrono::Utc::now());
+            let kept = if backup.exists() {
+                Kept::AlreadyThere
+            } else if corrupt_backups_full(&path) {
+                Kept::EnoughAlready(MAX_CORRUPT_BACKUPS)
+            } else {
+                match fs::copy(&path, &backup) {
+                    Ok(_) => Kept::Copied,
+                    Err(e) => Kept::Failed(e.to_string()),
+                }
+            };
             log::error!(
-                "Failed to parse migration state for project {}: {} — treating as absent",
+                "Failed to parse migration state for project {}: {} — treating as absent, but \
+                 the record is left in place so `has_record` still protects its rollback pin{}",
                 project_id,
-                e
+                e,
+                match kept {
+                    Kept::Copied | Kept::AlreadyThere =>
+                        format!(" (a copy is at {})", backup.display()),
+                    // The earliest copies are the ones worth having, so the cap
+                    // keeps those and drops this one. Say so, rather than
+                    // implying a file exists.
+                    Kept::EnoughAlready(n) => format!(
+                        " (no copy kept — {} earlier copies of this record are already saved \
+                         alongside it)",
+                        n
+                    ),
+                    Kept::Failed(ref e) => format!(" (could not keep a copy: {})", e),
+                }
             );
             Ok(None)
         }
     }
 }
 
-/// Atomically write a project's migration state.
+/// What [`load`] did about a copy of an unparseable record, so the log line can
+/// tell the truth about whether a file exists.
+enum Kept {
+    Copied,
+    /// This exact second's copy was already on disk.
+    AlreadyThere,
+    /// The cap is reached; the earlier copies are kept and this one is not.
+    EnoughAlready(usize),
+    Failed(String),
+}
+
+/// Where a copy of an unparseable record is kept.
+///
+/// Timestamped rather than a fixed `.bak`: a second corruption used to
+/// overwrite the first, so the one case where the user's bytes matter most was
+/// the case where they were most likely to be gone.
+fn corrupt_backup_path(path: &std::path::Path, now: &chrono::DateTime<chrono::Utc>) -> PathBuf {
+    path.with_extension(format!("json.corrupt-{}.bak", now.format("%Y%m%d-%H%M%S")))
+}
+
+/// How many timestamped copies of one project's corrupt record are kept.
+///
+/// Timestamping fixed the "second corruption overwrote the first" bug and
+/// introduced its opposite: [`load`] runs on every reconcile, every survey and
+/// every reaper pass, so a record that is *persistently* unparseable — the
+/// normal case, since nothing repairs it — mints a new copy every time the
+/// clock's second changes. Nothing ever reads them back and nothing ever
+/// removed them.
+///
+/// Four is enough for the only use there is: a human looking at what the file
+/// held. See [`corrupt_backups_full`] for why the cap is applied before the
+/// copy rather than by pruning after it.
+const MAX_CORRUPT_BACKUPS: usize = 4;
+
+/// Whether [`MAX_CORRUPT_BACKUPS`] copies of this record already exist.
+///
+/// Asked *before* the copy rather than pruning after it, so the cap is not
+/// implemented by writing a file and deleting it again on every pass — and so
+/// the copies that survive are the oldest, which are the ones taken closest to
+/// whatever produced the corruption.
+///
+/// A directory that cannot be listed answers "not full": failing open here
+/// costs at most one extra file, and failing closed would drop the very first
+/// copy of a record nothing else has kept.
+fn corrupt_backups_full(path: &std::path::Path) -> bool {
+    let (Some(dir), Some(stem)) = (path.parent(), path.file_stem()) else {
+        return false;
+    };
+    // `{stem}.json.corrupt-` — the same shape `corrupt_backup_path` builds, so
+    // this can never match another project's copies or an unrelated `.bak`.
+    let prefix = format!("{}.json.corrupt-", stem.to_string_lossy());
+    let Ok(entries) = fs::read_dir(dir) else {
+        return false;
+    };
+    entries
+        .flatten()
+        .filter(|e| {
+            let name = e.file_name().to_string_lossy().to_string();
+            name.starts_with(&prefix) && name.ends_with(".bak")
+        })
+        .count()
+        >= MAX_CORRUPT_BACKUPS
+}
+
+/// Whether a project has a migration record on disk *at all*, without parsing
+/// it.
+///
+/// The pin reaper needs "is this project's rollback image still somebody's only
+/// copy?" and must answer it conservatively. [`load`] cannot be used for that
+/// question on its own — it deliberately reports a corrupt record as absent —
+/// so this asks the filesystem instead. `load` moving a corrupt record aside is
+/// what keeps the two answers from disagreeing forever.
+pub fn has_record(project_id: &str) -> Result<bool, String> {
+    Ok(state_path(project_id)?.exists())
+}
+
+/// Atomically **and durably** write a project's migration state.
+///
+/// Write-temp-then-rename alone is only half of it, and the missing half is the
+/// half this record exists for. `fs::write` returns once the bytes are in the
+/// page cache; a rename over them is atomic *with respect to other readers*,
+/// not with respect to power loss. Losing power in that window leaves the
+/// rename applied and the data not yet written — i.e. a 0-byte or truncated
+/// `{id}.json` — which is precisely the corrupt-record case above, produced by
+/// the code whose job is to make that case impossible.
+///
+/// So: fsync the file before the rename, and fsync the *directory* after it,
+/// because the rename itself is directory metadata and is not durable until the
+/// directory is synced. A sync that fails is reported rather than swallowed —
+/// this is the crash record, and "probably written" is not a state it may be
+/// in.
 pub fn save(project_id: &str, state: &MigrationState) -> Result<(), String> {
     let path = state_path(project_id)?;
     let data = serde_json::to_string_pretty(state)
         .map_err(|e| format!("Failed to serialize migration state: {}", e))?;
     let tmp = path.with_extension("json.tmp");
-    fs::write(&tmp, data).map_err(|e| format!("Failed to write migration state: {}", e))?;
+
+    {
+        use std::io::Write;
+        let mut file = fs::File::create(&tmp)
+            .map_err(|e| format!("Failed to write migration state: {}", e))?;
+        file.write_all(data.as_bytes())
+            .map_err(|e| format!("Failed to write migration state: {}", e))?;
+        file.sync_all()
+            .map_err(|e| format!("Failed to flush migration state to disk: {}", e))?;
+    }
+
     fs::rename(&tmp, &path).map_err(|e| format!("Failed to commit migration state: {}", e))?;
+    sync_dir(&path);
+    // A project with a record is not ownerless, whatever a reaper concluded
+    // before this write — so the grace clock is thrown away rather than left to
+    // expire against a pin that now has an owner again.
+    clear_ownerless_for_project(project_id);
     Ok(())
 }
 
+/// fsync the directory holding `path`, so a rename into it survives power loss.
+///
+/// Best effort *only* on the platforms where it is meaningless: Windows has no
+/// directory handle to sync and returns an error for the attempt, so a failure
+/// is logged rather than propagated. The file's own `sync_all` above is the
+/// part that carries the data, and it is not best effort.
+fn sync_dir(path: &std::path::Path) {
+    let Some(dir) = path.parent() else {
+        return;
+    };
+    match fs::File::open(dir).and_then(|d| d.sync_all()) {
+        Ok(()) => {}
+        Err(e) => log::debug!(
+            "Could not fsync the migrations directory {}: {} — the record itself was flushed",
+            dir.display(),
+            e
+        ),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Ownerless-pin tombstones
+// ---------------------------------------------------------------------------
+
+/// Marker recording **when a rollback pin was first seen with no record behind
+/// it**.
+///
+/// ## Why the grace period cannot be measured from the tag
+///
+/// `docker::migration::pin_is_reapable` used to date a pin from the timestamp
+/// encoded in `pre-migration-<YYYYmmdd-HHMMSS>` — i.e. from when the migration
+/// *started*. That is the wrong epoch by a whole feature. A migration is
+/// allowed to sit at `awaiting-confirmation` indefinitely; `keep_rollback`
+/// exists precisely so a user can run on the new base for a month before
+/// deciding. If that project's record is then lost — a corrupt file, a deleted
+/// state file, a half-restored data directory — the pin is fourteen days old on
+/// the very first check, so it is untagged on the next app start and the
+/// startup sweep deletes the image two lines later. The fourteen-day grace
+/// period the constant promises is zero in the only situation it was written
+/// for.
+///
+/// The clock has to start when the *claim* was lost, and nothing on the daemon
+/// records that moment. So it is written down here, the first time a reaper
+/// notices, and the age is measured from the marker.
+///
+/// One file per `(project_id, tag)` in the migrations directory, holding an
+/// RFC3339 instant. Tiny, and losing one costs a fresh fourteen days rather
+/// than a deletion — the failure direction that keeps somebody's only rollback
+/// copy.
+fn ownerless_marker_path(project_id: &str, tag: &str) -> Result<PathBuf, String> {
+    Ok(migrations_dir()?.join(format!(
+        "{}.{}.ownerless",
+        sanitize(project_id),
+        sanitize(tag)
+    )))
+}
+
+/// Read the first-observed instant for a pin, creating the marker if this is
+/// the first sighting. Returns `None` when the clock has not started yet.
+///
+/// **Clock skew is handled here rather than at the comparison.** A host clock
+/// that was running fast when the marker was written leaves a timestamp in the
+/// future; measured naively that is a negative age, which a `num_days() >= 14`
+/// test reads as "never reapable" — a pin that can never be collected, forever.
+/// A marker dated after `now` is therefore rewritten to `now`, restarting the
+/// grace period. The other direction — a clock jumping forward — cannot shorten
+/// the period below what has actually elapsed on the *marker's* terms, because
+/// there is nothing to compare against but wall time; what it cannot do any
+/// more is make every pin instantly reapable, which dating from the tag did.
+///
+/// ## Why the write re-checks `has_record`
+///
+/// Both reapers ask [`has_record`] and only call this when the answer is no,
+/// which leaves a window: a [`save`] landing between the two runs its
+/// `clear_ownerless_for_project` against a marker that does not exist yet, and
+/// this then plants one — dated *now* — behind a perfectly valid record. The
+/// marker is invisible while the record stands, so nothing notices. It only
+/// matters later, if that record is legitimately lost: the pin is then already
+/// fourteen days ownerless on its very first check and is reaped with **zero**
+/// grace, which is the exact failure the tombstone exists to prevent.
+///
+/// So the write is followed by a second `has_record`, and a marker that turns
+/// out to sit behind a record is removed again. The two orderings that remain
+/// are both safe: a `save` completing *after* this re-check clears the marker
+/// itself, and one completing before it is what the re-check sees.
+pub fn note_ownerless_since(
+    project_id: &str,
+    tag: &str,
+    now: &chrono::DateTime<chrono::Utc>,
+) -> Option<chrono::DateTime<chrono::Utc>> {
+    let path = ownerless_marker_path(project_id, tag).ok()?;
+    let existing = fs::read_to_string(&path).ok().and_then(|raw| {
+        chrono::DateTime::parse_from_rfc3339(raw.trim())
+            .ok()
+            .map(|t| t.with_timezone(&chrono::Utc))
+    });
+    match existing {
+        Some(seen) if seen <= *now => Some(seen),
+        // Absent, unparseable, or dated in the future: (re)start the clock.
+        _ => {
+            if let Err(e) = fs::write(&path, now.to_rfc3339()) {
+                log::warn!(
+                    "Could not record that rollback pin {}:{} is ownerless: {} — its grace \
+                     period restarts on the next check",
+                    project_id,
+                    tag,
+                    e
+                );
+                return None;
+            }
+            // A record that appeared while this was being written owns the pin,
+            // and a tombstone behind an owned pin is a fourteen-day head start
+            // on reaping it the moment that record is next lost.
+            if has_record(project_id).unwrap_or(false) {
+                log::debug!(
+                    "A migration record for {} appeared while marking {} ownerless; \
+                     the marker was dropped again",
+                    project_id,
+                    tag
+                );
+                clear_ownerless(project_id, tag);
+            }
+            None
+        }
+    }
+}
+
+/// Forget a pin's ownerless marker. Missing is success.
+///
+/// Called when the pin is untagged, and when a record reappears for the
+/// project — a re-migrated project must not inherit the previous run's clock.
+pub fn clear_ownerless(project_id: &str, tag: &str) {
+    let Ok(path) = ownerless_marker_path(project_id, tag) else {
+        return;
+    };
+    match fs::remove_file(&path) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => log::warn!("Could not remove {}: {}", path.display(), e),
+    }
+}
+
+/// Drop every ownerless marker belonging to one project.
+///
+/// A project that has a record again is by definition not ownerless, whatever
+/// a reaper concluded before.
+pub fn clear_ownerless_for_project(project_id: &str) {
+    let Ok(dir) = migrations_dir() else {
+        return;
+    };
+    let prefix = format!("{}.", sanitize(project_id));
+    let Ok(entries) = fs::read_dir(&dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name().to_string_lossy().to_string();
+        if name.starts_with(&prefix) && name.ends_with(".ownerless") {
+            let _ = fs::remove_file(entry.path());
+        }
+    }
+}
+
 /// Remove a project's migration state file. Missing is success.
 pub fn clear(project_id: &str) -> Result<(), String> {
     let path = state_path(project_id)?;
@@ -104,6 +426,39 @@ pub fn clear_staging(project_id: &str) -> Result<(), String> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn corrupt_copies_of_one_record_are_capped() {
+        // `load` runs on every reconcile, every survey and every reaper pass,
+        // and nothing repairs an unparseable record — so a persistently corrupt
+        // one minted a new timestamped copy every time the clock's second
+        // changed, and nothing ever removed them.
+        let dir = std::env::temp_dir().join(format!(
+            "triple-c-corrupt-cap-{}",
+            uuid::Uuid::new_v4().simple()
+        ));
+        fs::create_dir_all(&dir).expect("temp dir");
+        let record = dir.join("some-project.json");
+
+        assert!(!corrupt_backups_full(&record), "an empty directory is not full");
+        for n in 0..MAX_CORRUPT_BACKUPS {
+            fs::write(
+                dir.join(format!("some-project.json.corrupt-2026010{}-000000.bak", n)),
+                "x",
+            )
+            .unwrap();
+        }
+        assert!(corrupt_backups_full(&record));
+
+        // Another project's copies, and an unrelated `.bak`, are not this
+        // record's — the prefix is the whole point of the naming.
+        let other = dir.join("other-project.json");
+        assert!(!corrupt_backups_full(&other));
+        fs::write(dir.join("some-project.json.bak"), "x").unwrap();
+        assert!(!corrupt_backups_full(&other));
+
+        fs::remove_dir_all(&dir).ok();
+    }
+
     #[test]
     fn project_ids_cannot_escape_the_migrations_directory() {
         assert_eq!(sanitize("../../etc/passwd"), "______etc_passwd");
@@ -115,4 +470,43 @@ mod tests {
             "ab62cd24-51aa-4645-8f5c-17a124062050"
         );
     }
+
+    /// The log line must not name a backup that was never written.
+    ///
+    /// `load` runs on every reconcile, every survey and every reaper pass, so a
+    /// persistently corrupt record hits the `MAX_CORRUPT_BACKUPS` cap within
+    /// seconds. The previous code folded "already kept enough" into `Ok(())`
+    /// and then reported " (a copy was kept at <path>)" — pointing at a file
+    /// that does not exist. That is the message someone reads immediately
+    /// before going to look for their data.
+    #[test]
+    fn the_corrupt_record_message_only_claims_a_copy_that_exists() {
+        let dir = std::env::temp_dir().join(format!(
+            "tc-mstore-{}",
+            uuid::Uuid::new_v4().simple()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("p.json");
+        std::fs::write(&path, b"{ not json").unwrap();
+
+        // Fill the cap with copies that really are on disk.
+        for i in 0..MAX_CORRUPT_BACKUPS {
+            let b = path.with_extension(format!("json.corrupt-2026010{}-000000.bak", i));
+            std::fs::write(&b, b"{ not json").unwrap();
+        }
+        assert!(corrupt_backups_full(&path), "precondition: the cap is reached");
+
+        // With the cap reached, no new copy may be created — and that is the
+        // state in which the old message lied.
+        let before: Vec<_> = std::fs::read_dir(&dir).unwrap().flatten().collect();
+        let fresh = corrupt_backup_path(&path, &chrono::Utc::now());
+        assert!(
+            !fresh.exists(),
+            "the cap is reached, so this timestamped copy must not be written"
+        );
+        let after: Vec<_> = std::fs::read_dir(&dir).unwrap().flatten().collect();
+        assert_eq!(before.len(), after.len(), "nothing new appeared on disk");
+
+        std::fs::remove_dir_all(&dir).ok();
+    }
 }
diff --git a/app/src-tauri/src/storage/projects_store.rs b/app/src-tauri/src/storage/projects_store.rs
index dbf4eb6..e3ed311 100644
--- a/app/src-tauri/src/storage/projects_store.rs
+++ b/app/src-tauri/src/storage/projects_store.rs
@@ -1,9 +1,65 @@
 use std::fs;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::Mutex;
 
 use crate::models::Project;
 
+/// The sticky marker for `projects.json`: `projects.json.corrupt`, beside it.
+///
+/// Derived from the file rather than from `dirs::data_dir()` so the marker
+/// always lands in the directory the store is actually using — and so the
+/// writer can be tested against a temp directory.
+fn corrupt_marker_for(file_path: &Path) -> PathBuf {
+    file_path.with_extension("json.corrupt")
+}
+
+/// Keep the bytes of an unparseable `projects.json`, and record that it
+/// happened.
+///
+/// **The existing `.bak` is never overwritten.** A second corruption used to
+/// clobber the first, and the first is the valuable one: it was taken before
+/// the app rewrote the file with whatever it had in memory, so it is the only
+/// copy that can still hold the full project list. Later ones are copies of an
+/// already-degraded file and get a timestamped name.
+fn record_corrupt_load(file_path: &Path, now: &chrono::DateTime<chrono::Utc>) {
+    let first = file_path.with_extension("json.bak");
+    let backup = if first.exists() {
+        file_path.with_extension(format!("json.corrupt-{}.bak", now.format("%Y%m%d-%H%M%S")))
+    } else {
+        first
+    };
+    if !backup.exists() {
+        if let Err(e) = fs::copy(file_path, &backup) {
+            log::error!("Failed to back up corrupted projects.json: {}", e);
+        } else {
+            log::error!(
+                "A copy of the unreadable projects.json was kept at {}",
+                backup.display()
+            );
+        }
+    }
+
+    // Sticky, and written even though nothing in the app reads it back on this
+    // branch: the Disk panel's `project_store_trust` was the reader and went to
+    // `hold/disk-and-dragout`. The marker stays because it is the only durable
+    // record that a project list was lost — the in-memory symptom does not
+    // survive the next save — and because re-deriving *when* it happened is
+    // impossible after the fact.
+    let marker = corrupt_marker_for(file_path);
+    if marker.exists() {
+        // The *first* corruption is the one that dates the loss.
+        return;
+    }
+    if let Err(e) = fs::write(&marker, now.to_rfc3339()) {
+        log::error!(
+            "Could not record the corrupt projects.json load at {}: {} — nothing will be able to \
+             tell later that the project list was incomplete",
+            marker.display(),
+            e
+        );
+    }
+}
+
 pub struct ProjectsStore {
     projects: Mutex<Vec<Project>>,
     file_path: PathBuf,
@@ -43,20 +99,14 @@ impl ProjectsStore {
                                 Ok(parsed) => (parsed, migrated),
                                 Err(e) => {
                                     log::error!("Failed to parse migrated projects.json: {}. Starting with empty list.", e);
-                                    let backup = file_path.with_extension("json.bak");
-                                    if let Err(be) = fs::copy(&file_path, &backup) {
-                                        log::error!("Failed to back up corrupted projects.json: {}", be);
-                                    }
+                                    record_corrupt_load(&file_path, &chrono::Utc::now());
                                     (Vec::new(), false)
                                 }
                             }
                         }
                         Err(e) => {
                             log::error!("Failed to parse projects.json: {}. Starting with empty list.", e);
-                            let backup = file_path.with_extension("json.bak");
-                            if let Err(be) = fs::copy(&file_path, &backup) {
-                                log::error!("Failed to back up corrupted projects.json: {}", be);
-                            }
+                            record_corrupt_load(&file_path, &chrono::Utc::now());
                             (Vec::new(), false)
                         }
                     }
@@ -203,3 +253,89 @@ impl ProjectsStore {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn temp_dir(tag: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "triple-c-store-{}-{}",
+            tag,
+            uuid::Uuid::new_v4().simple()
+        ));
+        fs::create_dir_all(&dir).expect("temp dir");
+        dir
+    }
+
+    #[test]
+    fn a_corrupt_load_leaves_a_marker_the_next_write_cannot_erase() {
+        // H-3, the whole chain in one test. `ProjectsStore::new()` swallows an
+        // unparseable file into an empty list *without rewriting it*, and the
+        // first `save()` after that — as little as `update_status()` — writes
+        // `[{one project}]` over it. Everything the old guard keyed on ("the
+        // list is empty and the file exists") is gone at that point, while
+        // every *other* project's volumes are still on the daemon claimed by
+        // nobody.
+        let dir = temp_dir("corrupt");
+        let file = dir.join("projects.json");
+        fs::write(&file, "{ this is not a project list").unwrap();
+
+        let now = chrono::Utc::now();
+        record_corrupt_load(&file, &now);
+
+        let marker = corrupt_marker_for(&file);
+        assert!(marker.exists(), "the corrupt load must be recorded on disk");
+        assert_eq!(fs::read_to_string(&marker).unwrap(), now.to_rfc3339());
+        assert!(
+            dir.join("projects.json.bak").exists(),
+            "the unreadable bytes must be kept"
+        );
+
+        // The write that used to erase the evidence. The marker is a separate
+        // file, so it does not care.
+        fs::write(&file, r#"[{"id":"the-one-project-started-since"}]"#).unwrap();
+        assert!(marker.exists());
+
+        fs::remove_dir_all(&dir).ok();
+    }
+
+    #[test]
+    fn a_second_corruption_keeps_the_first_copy_and_the_first_date() {
+        // The `.bak` used to be a fixed name, so a second corruption clobbered
+        // the first — and the first is the only copy taken before the app
+        // rewrote the file with whatever it had in memory, i.e. the only one
+        // that can still hold the full project list.
+        let dir = temp_dir("second");
+        let file = dir.join("projects.json");
+        fs::write(&file, "original bytes").unwrap();
+        let first = chrono::DateTime::parse_from_rfc3339("2026-01-01T00:00:00Z")
+            .unwrap()
+            .with_timezone(&chrono::Utc);
+        record_corrupt_load(&file, &first);
+
+        fs::write(&file, "degraded bytes").unwrap();
+        let second = chrono::DateTime::parse_from_rfc3339("2026-06-01T00:00:00Z")
+            .unwrap()
+            .with_timezone(&chrono::Utc);
+        record_corrupt_load(&file, &second);
+
+        assert_eq!(
+            fs::read_to_string(dir.join("projects.json.bak")).unwrap(),
+            "original bytes",
+            "the first copy must survive the second corruption"
+        );
+        assert_eq!(
+            fs::read_to_string(dir.join("projects.json.corrupt-20260601-000000.bak")).unwrap(),
+            "degraded bytes"
+        );
+        // And the marker still dates the loss from the first failure, which is
+        // when the project list actually stopped being complete.
+        assert_eq!(
+            fs::read_to_string(corrupt_marker_for(&file)).unwrap(),
+            first.to_rfc3339()
+        );
+
+        fs::remove_dir_all(&dir).ok();
+    }
+}
diff --git a/app/src-tauri/src/storage/secure.rs b/app/src-tauri/src/storage/secure.rs
index 6dc351d..a1c7e86 100644
--- a/app/src-tauri/src/storage/secure.rs
+++ b/app/src-tauri/src/storage/secure.rs
@@ -26,47 +26,122 @@ const CLAUDE_TOKEN_VERSION_SERVICE: &str = "triple-c-claude-oauth-token-version"
 /// Fixed account name used for every triple-c keychain entry.
 const KEYCHAIN_ACCOUNT: &str = "secret";
 
+/// Every per-project secret this app stores, and therefore every one it has to
+/// be able to delete.
+///
+/// This list is the **only** definition. It used to exist twice — once
+/// implicitly, as whatever `store_secrets_for_project` happened to write, and
+/// once explicitly, as a literal array inside `delete_project_secrets` — and
+/// the two drifted: `openai-compatible-api-key` was added to the writer and
+/// never to the deleter, so removing a project left a live provider API key in
+/// the user's login keychain with nothing left in the app that referenced it,
+/// or would ever offer to clean it up.
+///
+/// Drift is now a compile-time-shaped error rather than a review-time one:
+/// [`project_secret_entry`] refuses a key that is not in this list, so a new
+/// secret cannot be stored until it has been added here, and adding it here is
+/// what makes [`delete_project_secrets`] cover it.
+pub const PROJECT_SECRET_KEYS: &[&str] = &[
+    "git-token",
+    "aws-access-key-id",
+    "aws-secret-access-key",
+    "aws-session-token",
+    "aws-bearer-token",
+    "openai-compatible-api-key",
+];
+
+/// The keychain entry for one per-project secret, rejecting any key name not in
+/// [`PROJECT_SECRET_KEYS`]. See that constant for why the rejection matters.
+fn project_secret_entry(project_id: &str, key_name: &str) -> Result<keyring::Entry, String> {
+    if !PROJECT_SECRET_KEYS.contains(&key_name) {
+        return Err(format!(
+            "Unknown project secret '{}'. Add it to PROJECT_SECRET_KEYS so project deletion \
+             clears it too.",
+            key_name
+        ));
+    }
+    let service = format!("triple-c-project-{}-{}", project_id, key_name);
+    keyring::Entry::new(&service, KEYCHAIN_ACCOUNT).map_err(|e| format!("Keyring error: {}", e))
+}
+
 /// Store a per-project secret in the OS keychain.
 pub fn store_project_secret(project_id: &str, key_name: &str, value: &str) -> Result<(), String> {
-    let service = format!("triple-c-project-{}-{}", project_id, key_name);
-    let entry = keyring::Entry::new(&service, "secret")
-        .map_err(|e| format!("Keyring error: {}", e))?;
-    entry
+    project_secret_entry(project_id, key_name)?
         .set_password(value)
         .map_err(|e| format!("Failed to store project secret '{}': {}", key_name, e))
 }
 
 /// Retrieve a per-project secret from the OS keychain.
 pub fn get_project_secret(project_id: &str, key_name: &str) -> Result<Option<String>, String> {
-    let service = format!("triple-c-project-{}-{}", project_id, key_name);
-    let entry = keyring::Entry::new(&service, "secret")
-        .map_err(|e| format!("Keyring error: {}", e))?;
-    match entry.get_password() {
+    match project_secret_entry(project_id, key_name)?.get_password() {
         Ok(value) => Ok(Some(value)),
         Err(keyring::Error::NoEntry) => Ok(None),
         Err(e) => Err(format!("Failed to retrieve project secret '{}': {}", key_name, e)),
     }
 }
 
-/// Delete all known secrets for a project from the OS keychain.
+/// Delete one per-project secret, treating "wasn't there" as success.
+pub fn delete_project_secret(project_id: &str, key_name: &str) -> Result<(), String> {
+    match project_secret_entry(project_id, key_name)?.delete_credential() {
+        Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+        Err(e) => Err(format!("Failed to delete project secret '{}': {}", key_name, e)),
+    }
+}
+
+/// Write a per-project secret, or **clear** it when there is nothing to write.
+///
+/// This is the function every save path should call, and the reason it exists
+/// is that the obvious `if let Some(v) = … { store(v) }` is wrong. The editors
+/// in `components/projects/home/config/` send a blanked field as `null`
+/// (`AccessSection.tsx`: `save({ git_token: gitToken || null })`), so a `None`
+/// is a user asking for the secret to be *removed* — and skipping it left the
+/// old value in the keychain, where `load_secrets_for_project` read it straight
+/// back out and put it back on the project. Clearing a credential through the
+/// UI was therefore impossible: the field looked empty and the container kept
+/// getting the old token.
+///
+/// `Some("")` and `Some("   ")` are treated the same as `None` — a field the
+/// user emptied, whichever shape it arrives in — because a stored empty secret
+/// is not a secret, and `container_config` would inject it as an env var that
+/// overrides the unset case with a blank.
+// TODO(handoff): `commands/project_commands.rs::store_secrets_for_project` is
+// the one caller this is for, and it still uses the `if let Some(v) = … ` shape
+// that cannot clear anything. That file belongs to another change in this round,
+// so the switch is deliberately left to it; the six call sites there become
+// `store_or_clear_project_secret(&project.id, "<key>", field.as_deref())?`.
+#[allow(dead_code)]
+pub fn store_or_clear_project_secret(
+    project_id: &str,
+    key_name: &str,
+    value: Option<&str>,
+) -> Result<(), String> {
+    match secret_to_store(value) {
+        Some(v) => store_project_secret(project_id, key_name, v),
+        None => delete_project_secret(project_id, key_name),
+    }
+}
+
+/// The store-or-clear decision, split out so it can be tested without a
+/// keychain backend: `Some` means "write this", `None` means "remove whatever
+/// is there".
+#[allow(dead_code)]
+fn secret_to_store(value: Option<&str>) -> Option<&str> {
+    match value.map(str::trim) {
+        Some(v) if !v.is_empty() => Some(v),
+        _ => None,
+    }
+}
+
+/// Delete every known secret for a project from the OS keychain.
+///
+/// Called when a project is removed, so it must cover [`PROJECT_SECRET_KEYS`]
+/// exhaustively — a key missed here outlives the project that explained it.
+/// One key failing does not stop the rest: a partial cleanup that keeps going
+/// leaves strictly fewer credentials behind than one that gives up.
 pub fn delete_project_secrets(project_id: &str) -> Result<(), String> {
-    let secret_keys = [
-        "git-token",
-        "aws-access-key-id",
-        "aws-secret-access-key",
-        "aws-session-token",
-        "aws-bearer-token",
-    ];
-    for key_name in &secret_keys {
-        let service = format!("triple-c-project-{}-{}", project_id, key_name);
-        let entry = keyring::Entry::new(&service, "secret")
-            .map_err(|e| format!("Keyring error: {}", e))?;
-        match entry.delete_credential() {
-            Ok(()) => {}
-            Err(keyring::Error::NoEntry) => {}
-            Err(e) => {
-                log::warn!("Failed to delete project secret '{}': {}", key_name, e);
-            }
+    for key_name in PROJECT_SECRET_KEYS {
+        if let Err(e) = delete_project_secret(project_id, key_name) {
+            log::warn!("Failed to delete project secret '{}': {}", key_name, e);
         }
     }
     Ok(())
@@ -269,3 +344,78 @@ pub fn regenerate_gateway_master_key() -> Result<String, String> {
     bump_gateway_secret_version()?;
     Ok(key)
 }
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The regression this list exists for. `openai-compatible-api-key` was
+    /// written by `store_secrets_for_project` and missing from the delete list,
+    /// so it survived project deletion.
+    #[test]
+    fn every_secret_the_app_writes_is_one_it_can_delete() {
+        for key in [
+            "git-token",
+            "aws-access-key-id",
+            "aws-secret-access-key",
+            "aws-session-token",
+            "aws-bearer-token",
+            "openai-compatible-api-key",
+        ] {
+            assert!(
+                PROJECT_SECRET_KEYS.contains(&key),
+                "{} is written by commands/project_commands.rs but would outlive the project",
+                key
+            );
+        }
+    }
+
+    #[test]
+    fn the_key_list_has_no_duplicates() {
+        let mut seen = std::collections::HashSet::new();
+        for key in PROJECT_SECRET_KEYS {
+            assert!(seen.insert(*key), "duplicate project secret key {}", key);
+        }
+    }
+
+    /// A key that is not in the list is refused *before* any keychain entry is
+    /// constructed, which is what makes the list authoritative rather than
+    /// advisory. Without this, a new secret can be stored under a name nothing
+    /// ever deletes.
+    #[test]
+    fn an_unlisted_key_cannot_be_stored_at_all() {
+        let err = store_project_secret("some-project", "brand-new-token", "value")
+            .expect_err("an unlisted key must be refused");
+        assert!(
+            err.contains("PROJECT_SECRET_KEYS"),
+            "the refusal should say how to fix it: {}",
+            err
+        );
+
+        let err = get_project_secret("some-project", "brand-new-token")
+            .expect_err("an unlisted key must be refused on read too");
+        assert!(err.contains("brand-new-token"), "{}", err);
+
+        let err = delete_project_secret("some-project", "brand-new-token")
+            .expect_err("an unlisted key must be refused on delete too");
+        assert!(err.contains("brand-new-token"), "{}", err);
+    }
+
+    /// The blanked-field case. `AccessSection.tsx` sends `gitToken || null`, so
+    /// a cleared field arrives as `None` — and before this existed, `None` was
+    /// skipped and the old secret stayed in the keychain forever.
+    #[test]
+    fn a_blanked_field_clears_rather_than_being_skipped() {
+        assert_eq!(secret_to_store(None), None);
+        assert_eq!(secret_to_store(Some("")), None);
+        assert_eq!(secret_to_store(Some("   \t\n")), None);
+    }
+
+    #[test]
+    fn a_real_value_is_stored_trimmed() {
+        assert_eq!(secret_to_store(Some("ghp_abc123")), Some("ghp_abc123"));
+        // Pasted credentials routinely carry a trailing newline.
+        assert_eq!(secret_to_store(Some("  ghp_abc123\n")), Some("ghp_abc123"));
+    }
+}
diff --git a/app/src-tauri/src/web_terminal/terminal.html b/app/src-tauri/src/web_terminal/terminal.html
index cd06179..ba266ba 100644
--- a/app/src-tauri/src/web_terminal/terminal.html
+++ b/app/src-tauri/src/web_terminal/terminal.html
@@ -3,11 +3,78 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+<!--
+  This page is served by an axum server bound 0.0.0.0 (remote access is the
+  feature) behind a permissive CORS layer, and it fronts a shell in a container.
+  It gets a CSP of its own because nothing else gives it one: the app's
+  `tauri.conf.json` CSP covers the desktop webview, never this document.
+
+  `default-src 'none'` is the base, so anything not named below is refused
+  outright. What is named:
+    script-src  jsdelivr for the three xterm bundles, plus 'unsafe-inline' for
+                this page's own inline <script>. Nonces/hashes were considered
+                and rejected: the file is a static `include_str!()` asset, so a
+                hash would have to be recomputed by hand on every edit to the
+                script, and the failure mode of getting that wrong is a terminal
+                that silently will not start.
+    style-src   the xterm stylesheet, this page's <style>, and the one inline
+                `style=` attribute below (style attributes need 'unsafe-inline').
+    connect-src the WebSocket back to this same server. `ws:`/`wss:` as schemes
+                rather than an origin, because the host and port are whatever
+                the user reached this page on and are not knowable at build time.
+    form-action / base-uri / object-src / frame-ancestors — all 'none'. Note
+                `frame-ancestors` is ignored in a <meta> CSP; it is here as a
+                statement of intent, and the real protection would be a response
+                header from `server.rs`.
+  Deliberately absent: 'unsafe-eval', and any origin other than jsdelivr.
+-->
+<meta http-equiv="Content-Security-Policy" content="
+  default-src 'none';
+  script-src 'unsafe-inline' https://cdn.jsdelivr.net;
+  style-src 'unsafe-inline' https://cdn.jsdelivr.net;
+  img-src 'self' data:;
+  font-src 'self' data:;
+  connect-src 'self' ws: wss:;
+  form-action 'none';
+  base-uri 'none';
+  object-src 'none';
+  frame-ancestors 'none';
+">
 <title>Triple-C Web Terminal</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/css/xterm.min.css">
-<script src="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/lib/xterm.min.js"></script>
-<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.min.js"></script>
-<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0.11.0/lib/addon-web-links.min.js"></script>
+<!--
+  Subresource Integrity on every CDN asset.
+
+  Without it this page executes whatever jsdelivr returns, inside a document
+  that holds the web terminal's access token and drives a shell in a container —
+  an upstream compromise, a hijacked package version or a MITM on a phone's
+  network is arbitrary code with that reach. The hashes below were computed
+  from the exact bytes at these pinned versions. `crossorigin="anonymous"` is
+  required for SRI to be checked on a cross-origin fetch.
+
+  Bumping a version means recomputing its hash:
+      curl -sS <url> | openssl dgst -sha384 -binary | openssl base64 -A
+  A mismatched hash blocks the asset, so a stale hash shows up immediately as a
+  terminal that does not render — never as an unverified load.
+
+  These are still remote loads: the remote terminal does not work with no
+  internet on the client side, and vendoring the ~300 KB of minified xterm into
+  this file would fix that. It was not done here — SRI already closes the
+  integrity half, which is the security half, and the availability half is a
+  separate call about binary size and diff readability.
+-->
+<link rel="stylesheet"
+      href="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/css/xterm.min.css"
+      integrity="sha384-tStR1zLfWgsiXCF3IgfB3lBa8KmBe/lG287CL9WCeKgQYcp1bjb4/+mwN6oti4Co"
+      crossorigin="anonymous">
+<script src="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/lib/xterm.min.js"
+        integrity="sha384-J4qzUjBl1FxyLsl/kQPQIOeINsmp17OHYXDOMpMxlKX53ZfYsL+aWHpgArvOuof9"
+        crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.min.js"
+        integrity="sha384-XGqKrV8Jrukp1NITJbOEHwg01tNkuXr6uB6YEj69ebpYU3v7FvoGgEg23C1Gcehk"
+        crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0.11.0/lib/addon-web-links.min.js"
+        integrity="sha384-S1biLeI8L/bFduIVvCxbn/l4EtaG4nTqQjGF7qCYTbsGXGFe8KgIKXtw4+UWxprv"
+        crossorigin="anonymous"></script>
 <style>
   :root {
     --bg-primary: #1a1b26;
@@ -334,6 +401,9 @@
     autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"
     enterkeyhint="send" inputmode="text">
   <button class="key-btn" id="btnEnter">Enter</button>
+  <!-- A newline *without* submitting. There is no Shift on a phone keyboard,
+       so the chord the desktop app binds needs a key of its own here. -->
+  <button class="key-btn" id="btnNewline" title="Insert a newline without submitting (Shift+Enter)">&#8629;+</button>
   <button class="key-btn" id="btnTab">Tab</button>
   <button class="key-btn" id="btnCtrlC">^C</button>
 </div>
@@ -360,6 +430,19 @@
   const emptyState = document.getElementById('emptyState');
   const mobileInput = document.getElementById('mobileInput');
   const btnEnter = document.getElementById('btnEnter');
+  const btnNewline = document.getElementById('btnNewline');
+
+  // Whether the *active* session understands ESC+CR as "insert a newline".
+  //
+  // Only Claude Code does. `bash -l` has no readline binding for `\e\r`, so
+  // sending it there is a silent no-op — which is worse from the mobile bar
+  // than from a hardware key, because the bar puts a dedicated button on
+  // screen that appears to do nothing. The xterm key handler is already scoped
+  // this way; these two paths were not.
+  function activeSessionTakesEscCr() {
+    const s = activeSessionId && sessions[activeSessionId];
+    return !!s && s.type === 'claude';
+  }
   const btnTab = document.getElementById('btnTab');
   const btnCtrlC = document.getElementById('btnCtrlC');
   const scrollBottomBtn = document.getElementById('scrollBottomBtn');
@@ -519,7 +602,7 @@
         updateProjectList(msg.projects);
         break;
       case 'opened':
-        onSessionOpened(msg.session_id, msg.project_name);
+        onSessionOpened(msg.session_id, msg.project_name, msg.session_type);
         break;
       case 'output':
         onSessionOutput(msg.session_id, msg.data);
@@ -570,8 +653,18 @@
     });
   }
 
-  function onSessionOpened(sessionId, projectName) {
-    const sessionType = pendingSessionType || 'claude';
+  function onSessionOpened(sessionId, projectName, serverSessionType) {
+    // Prefer the type the *server* reports for this session. The old path read
+    // a single `pendingSessionType` global set at request time, so opening two
+    // sessions before the first reply landed swapped their labels — routine on
+    // mobile, where nothing disables the buttons. That was cosmetic until
+    // Shift+Enter became type-dependent: a Claude session labelled `shell`
+    // sends a bare CR and submits a half-written prompt.
+    //
+    // The fallback keeps an older server working, and defaults to `claude`,
+    // which is the safe direction — ESC+CR is an unbound no-op in bash, while
+    // a bare CR in Claude Code loses the prompt.
+    const sessionType = serverSessionType || pendingSessionType || 'claude';
     pendingSessionType = null;
 
     // Create terminal
@@ -647,6 +740,34 @@
       });
     });
 
+    // Shift+Enter inserts a newline in Claude Code's prompt instead of
+    // submitting it. xterm.js does not consult `shiftKey` for Enter, so
+    // without this Shift+Enter is byte-identical to Enter.
+    //
+    // `\x1b\r` — ESC then CR — is what Claude Code parses as `return` with
+    // meta, and it is the same sequence its own `/terminal-setup` installs for
+    // VS Code, Cursor, Alacritty and Zed. Do not "simplify" it to `\n`: that
+    // also works in Claude Code, but a shell would *run* the line, so the two
+    // session types would diverge. Claude sessions only, for that reason —
+    // `bash -l` has no readline binding for `\e\r`.
+    term.attachCustomKeyEventHandler(e => {
+      if (
+        e.type === 'keydown' && e.key === 'Enter' && e.shiftKey &&
+        !e.ctrlKey && !e.altKey && !e.metaKey && !e.isComposing &&
+        sessionType === 'claude'
+      ) {
+        sendTerminalInput('\x1b\r');
+        // `preventDefault()` is what stops the submit, not the `return false`.
+        // xterm's `_keyDown` returns before setting `_keyDownHandled`, so
+        // `_keyPress` still fires and emits a bare CR for Enter — inserting the
+        // newline and then submitting the prompt anyway. See the same comment
+        // in TerminalView.tsx.
+        e.preventDefault();
+        return false;
+      }
+      return true;
+    });
+
     // Track scroll position for scroll-to-bottom button
     term.onScroll(() => updateScrollButton());
 
@@ -698,6 +819,7 @@
       switchToSession(remaining[remaining.length - 1]);
     } else {
       activeSessionId = null;
+      syncNewlineButton();
       emptyState.style.display = '';
     }
   }
@@ -724,6 +846,7 @@
 
   function switchToSession(sessionId) {
     activeSessionId = sessionId;
+    syncNewlineButton();
 
     // Update tab styles
     document.querySelectorAll('.tab').forEach(t => t.classList.remove('active'));
@@ -799,7 +922,11 @@
         sendTerminalInput(val);
         mobileInput.value = '';
       }
-      sendTerminalInput('\r');
+      // Shift+Enter is a newline, not a submit — same bytes, and the same
+      // reasoning, as the terminal's own key handler above. A hardware
+      // keyboard on a tablet is the only way to reach this; the phone case is
+      // the dedicated newline button beside Enter.
+      sendTerminalInput(e.shiftKey && activeSessionTakesEscCr() ? '\x1b\r' : '\r');
     } else if (e.key === 'Tab') {
       e.preventDefault();
       sendTerminalInput('\t');
@@ -807,6 +934,27 @@
   });
 
   btnEnter.onclick = () => { sendTerminalInput('\r'); mobileInput.focus(); };
+  btnNewline.onclick = () => {
+    if (!activeSessionTakesEscCr()) { mobileInput.focus(); return; }
+    sendTerminalInput('\x1b\r');
+    mobileInput.focus();
+  };
+
+  // Keep the button's affordance honest: on a shell tab there is no byte that
+  // means "newline without running the line", so the control is disabled
+  // rather than left looking live.
+  function syncNewlineButton() {
+    const usable = activeSessionTakesEscCr();
+    btnNewline.disabled = !usable;
+    btnNewline.title = usable
+      ? 'Insert a newline without submitting (Shift+Enter)'
+      : 'Only Claude sessions support this — a shell runs the line instead';
+  }
+
+  // With no session open yet, `activeSessionTakesEscCr()` is already false —
+  // but nothing had called this, so the button rendered live before the first
+  // tab existed.
+  syncNewlineButton();
   btnTab.onclick = () => { sendTerminalInput('\t'); mobileInput.focus(); };
   btnCtrlC.onclick = () => { sendTerminalInput('\x03'); mobileInput.focus(); };
 
diff --git a/app/src-tauri/src/web_terminal/ws_handler.rs b/app/src-tauri/src/web_terminal/ws_handler.rs
index bcafb11..50c198e 100644
--- a/app/src-tauri/src/web_terminal/ws_handler.rs
+++ b/app/src-tauri/src/web_terminal/ws_handler.rs
@@ -46,6 +46,16 @@ enum ServerMessage {
     Opened {
         session_id: String,
         project_name: String,
+        /// Echoed back so the client can label the session from the reply
+        /// rather than from a global set at request time.
+        ///
+        /// Without it the client correlates through a single
+        /// `pendingSessionType`, so opening two sessions before the first
+        /// reply lands swaps their labels. That used to be cosmetic; it stopped
+        /// being cosmetic when Shift+Enter became type-dependent, because a
+        /// Claude session mislabelled as a shell now submits a half-written
+        /// prompt instead of inserting a newline.
+        session_type: String,
     },
     Output {
         session_id: String,
@@ -319,6 +329,11 @@ async fn handle_open(
     let _ = out_tx.send(ServerMessage::Opened {
         session_id,
         project_name,
+        // Derived from the same match that chose `cmd` above, not echoed from
+        // the request: anything that is not exactly "bash" runs Claude, so
+        // echoing the raw value would label an unrecognised string as its own
+        // type and put the client back where it started.
+        session_type: if session_type == Some("bash") { "bash" } else { "claude" }.to_string(),
     });
 
     Ok(())
diff --git a/app/src-tauri/tauri.conf.json b/app/src-tauri/tauri.conf.json
index 6332887..65e36e6 100644
--- a/app/src-tauri/tauri.conf.json
+++ b/app/src-tauri/tauri.conf.json
@@ -22,7 +22,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: https://asset.localhost; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost; frame-src http://127.0.0.1:47820 http://127.0.0.1:47821 http://127.0.0.1:47822 http://127.0.0.1:47823 http://127.0.0.1:47824 http://127.0.0.1:47825 http://127.0.0.1:47826 http://127.0.0.1:47827"
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self' ipc: http://ipc.localhost; frame-src http://127.0.0.1:47820 http://127.0.0.1:47821 http://127.0.0.1:47822 http://127.0.0.1:47823 http://127.0.0.1:47824 http://127.0.0.1:47825 http://127.0.0.1:47826 http://127.0.0.1:47827; form-action 'none'; base-uri 'none'; object-src 'none'"
     }
   },
   "bundle": {
diff --git a/app/src/App.tsx b/app/src/App.tsx
index 7245f4f..c345a8c 100644
--- a/app/src/App.tsx
+++ b/app/src/App.tsx
@@ -9,6 +9,7 @@ import DockerInstallDialog from "./components/DockerInstallDialog";
 import ProjectHome from "./components/projects/home/ProjectHome";
 import AddProjectDialog from "./components/projects/AddProjectDialog";
 import ToastHost from "./components/ui/ToastHost";
+import { PaneVisibilityProvider } from "./components/ui/PaneVisibility";
 import StatusIndicator from "./components/ui/StatusIndicator";
 import Button from "./components/ui/Button";
 import { useDocker } from "./hooks/useDocker";
@@ -128,19 +129,34 @@ export default function App() {
             <WelcomeScreen />
           ) : (
             <div className="w-full h-full">
+              {/* Every tab stays mounted and the inactive ones are merely
+                  `hidden`, which a dialog's portal to `document.body` does not
+                  inherit: a confirmation opened in one project stayed painted
+                  over whatever tab the user switched to, kept its focus trap,
+                  and — being a blocking overlay — refused every native file
+                  drop in the window. `PaneVisibilityProvider` is how a `Modal`
+                  inside a pane finds out the pane stepped aside. */}
               {homeProjectIds.map((projectId) => (
-                <ProjectHome
+                <PaneVisibilityProvider
                   key={projectId}
-                  projectId={projectId}
-                  active={activeTabKey === homeTabKey(projectId)}
-                />
+                  visible={activeTabKey === homeTabKey(projectId)}
+                >
+                  <ProjectHome
+                    projectId={projectId}
+                    active={activeTabKey === homeTabKey(projectId)}
+                  />
+                </PaneVisibilityProvider>
               ))}
               {sessions.map((session) => (
-                <TerminalView
+                <PaneVisibilityProvider
                   key={session.id}
-                  sessionId={session.id}
-                  active={session.id === activeSessionId}
-                />
+                  visible={session.id === activeSessionId}
+                >
+                  <TerminalView
+                    sessionId={session.id}
+                    active={session.id === activeSessionId}
+                  />
+                </PaneVisibilityProvider>
               ))}
             </div>
           )}
@@ -156,6 +172,9 @@ export default function App() {
           className="fixed inset-0 z-50 flex items-center justify-center bg-[var(--bg-primary)]/95 backdrop-blur-sm"
           role="status"
           aria-live="polite"
+          /* Covers the whole window, so no pane underneath may accept a
+             native file drop while it is up — see `lib/dropTarget.ts`. */
+          data-blocks-drop="true"
           data-testid="shutdown-overlay"
         >
           <div className="flex flex-col items-center gap-2 px-6 text-center">
diff --git a/app/src/components/layout/HelpDialog.test.tsx b/app/src/components/layout/HelpDialog.test.tsx
new file mode 100644
index 0000000..7c1140b
--- /dev/null
+++ b/app/src/components/layout/HelpDialog.test.tsx
@@ -0,0 +1,100 @@
+import { describe, it, expect } from "vitest";
+import { renderMarkdown } from "./HelpDialog";
+
+/**
+ * `renderMarkdown` builds HTML by regex substitution and the result is handed
+ * to `dangerouslySetInnerHTML`. Its input is the help document, which is
+ * fetched from GitHub at runtime — remote, versioned by someone else, and not
+ * something the app gets to trust. These tests pin the escaping.
+ */
+/**
+ * Parse rendered HTML and return its first anchor, asserting that *no* element
+ * anywhere in the output grew an attribute outside the allowed set. A broken
+ * attribute value is only interesting if it becomes an attribute, so the check
+ * has to run through a real parser rather than over the string.
+ */
+const ALLOWED_ATTRS = new Set(["class", "href", "target", "rel", "id"]);
+
+function onlyAnchor(html: string): HTMLAnchorElement {
+  const doc = new DOMParser().parseFromString(html, "text/html");
+  for (const el of Array.from(doc.body.querySelectorAll("*"))) {
+    for (const name of attrNames(el)) {
+      expect(ALLOWED_ATTRS.has(name), `unexpected attribute ${name}`).toBe(true);
+    }
+  }
+  const anchors = doc.querySelectorAll("a");
+  expect(anchors.length).toBeGreaterThan(0);
+  return anchors[0] as HTMLAnchorElement;
+}
+
+/** Attribute names the parser actually saw on an element. */
+function attrNames(el: Element): string[] {
+  return Array.from(el.attributes).map((a) => a.name);
+}
+
+describe("renderMarkdown escaping", () => {
+  it("escapes the quote characters an attribute value is delimited by", () => {
+    const html = renderMarkdown('He said "hi" and it\'s fine.');
+    expect(html).not.toMatch(/said "hi"/);
+    expect(html).toContain("&quot;hi&quot;");
+    expect(html).toContain("it&#39;s");
+  });
+
+  it("does not let a link target break out of href=\"…\"", () => {
+    // The sink: the URL capture is `[^)]+`, which includes `"` and spaces, and
+    // the value lands directly inside `href="…"`. Asserted through the DOM,
+    // not by string matching — the payload text legitimately survives *inside*
+    // the attribute value; what must not happen is it becoming an attribute.
+    const a = onlyAnchor(
+      renderMarkdown(
+        '[click](https://example.com/" onmouseover="steal() formaction="https://evil.example)',
+      ),
+    );
+    expect(attrNames(a)).toEqual(["class", "href", "target", "rel"]);
+    expect(a.getAttribute("href")).toContain('" onmouseover="');
+  });
+
+  it("does not let an in-document anchor break out of href=\"#…\"", () => {
+    const a = onlyAnchor(
+      renderMarkdown('[jump](#top" onfocus="steal() autofocus="x)'),
+    );
+    expect(attrNames(a)).toEqual(["class", "href"]);
+  });
+
+  it("does not let a bare URL break out of href=\"…\"", () => {
+    const a = onlyAnchor(
+      renderMarkdown('See https://example.com/a"onmouseover="steal()\n'),
+    );
+    expect(attrNames(a)).toEqual(["class", "href", "target", "rel"]);
+  });
+
+  it("still renders ordinary links intact", () => {
+    const html = renderMarkdown("[docs](https://example.com/a?x=1&y=2)");
+    // `&` was entity-escaped by the first pass and must not be escaped twice.
+    expect(html).toContain('href="https://example.com/a?x=1&amp;y=2"');
+    expect(html).not.toContain("&amp;amp;");
+    expect(html).toContain('target="_blank"');
+    expect(html).toContain('rel="noopener noreferrer"');
+    expect(html).toContain(">docs</a>");
+  });
+
+  it("still renders an in-document anchor link intact", () => {
+    const html = renderMarkdown("[jump](#getting-started)");
+    expect(html).toContain('href="#getting-started"');
+  });
+
+  it("keeps header slugs stable across the new quote escaping", () => {
+    // The regression this guards: quotes now become entities *before*
+    // `slugify` sees them, and an entity's letters would otherwise survive
+    // into the id ("claude39s-setup"), silently breaking every
+    // `[…](#claudes-setup)` in the document.
+    expect(renderMarkdown("## Claude's setup")).toContain('id="claudes-setup"');
+    expect(renderMarkdown('## The "safe" mode')).toContain('id="the-safe-mode"');
+  });
+
+  it("still refuses to emit raw tags from the source document", () => {
+    const html = renderMarkdown("<img src=x onerror=alert(1)>");
+    expect(html).not.toContain("<img");
+    expect(html).toContain("&lt;img");
+  });
+});
diff --git a/app/src/components/layout/HelpDialog.tsx b/app/src/components/layout/HelpDialog.tsx
index 6d2590e..ed5b9bf 100644
--- a/app/src/components/layout/HelpDialog.tsx
+++ b/app/src/components/layout/HelpDialog.tsx
@@ -12,21 +12,67 @@ function slugify(text: string): string {
   return text
     .toLowerCase()
     .replace(/<[^>]+>/g, "")       // strip HTML tags (e.g. from inline code)
+    // Quote characters are escaped to entities before this runs (see
+    // `renderMarkdown`). Drop those two entities whole, so a header with an
+    // apostrophe or a quote slugifies to what it did when the character was
+    // simply stripped — otherwise every such anchor id silently changes and
+    // the in-document links pointing at it stop resolving. `&amp;`/`&lt;`/
+    // `&gt;` are deliberately not in this list: they were already entities
+    // before, so their existing (odd) slugs are the established ones.
+    .replace(/&quot;|&#39;/g, "")
     .replace(/[^\w\s-]/g, "")      // remove non-word chars except spaces/dashes
     .replace(/\s+/g, "-")          // spaces to dashes
     .replace(/-+/g, "-")           // collapse consecutive dashes
     .replace(/^-|-$/g, "");        // trim leading/trailing dashes
 }
 
-/** Simple markdown-to-HTML converter for the help content. */
-function renderMarkdown(md: string): string {
+/**
+ * Escape a captured markdown value that is about to be interpolated into an
+ * HTML *attribute* value.
+ *
+ * `renderMarkdown` entity-escapes the whole document first, but that pass only
+ * covered `&`, `<` and `>` — not the quote characters, which is all an
+ * attribute value is delimited by. `[x](https://a" onload="…)` therefore closed
+ * `href="` and started a new attribute, because the URL capture is `[^)]+` and
+ * `"` is in `[^)]`. The document is remote GitHub markdown, so that capture is
+ * not ours to trust.
+ *
+ * Only quotes are escaped here: `&`, `<` and `>` have already been converted by
+ * the caller, and re-escaping the `&` would double-encode every `&amp;` in a
+ * query string.
+ */
+function attr(value: string): string {
+  return value.replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+/**
+ * Simple markdown-to-HTML converter for the help content.
+ *
+ * Exported for `HelpDialog.test.tsx`: the output goes to
+ * `dangerouslySetInnerHTML`, so the escaping rules below are security rules and
+ * need to be asserted rather than assumed.
+ */
+export function renderMarkdown(md: string): string {
   let html = md;
 
   // Normalize line endings
   html = html.replace(/\r\n/g, "\n");
 
-  // Escape HTML entities (but we'll re-introduce tags below)
-  html = html.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  // Escape HTML entities (but we'll re-introduce tags below).
+  //
+  // The quote characters are part of this on purpose. Everything below builds
+  // HTML by regex substitution, and several of those substitutions drop a
+  // capture straight into an attribute value (`href="$2"`). Leaving `"` and `'`
+  // live meant a link target could close the attribute and open another one —
+  // in a document fetched from GitHub at runtime and handed to
+  // `dangerouslySetInnerHTML`. Escaping here closes every such sink at the
+  // source; `attr()` below is the belt to this pair of braces.
+  html = html
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
 
   // Fenced code blocks (```...```)
   html = html.replace(/```(\w*)\n([\s\S]*?)```/g, (_m, _lang, code) => {
@@ -84,13 +130,15 @@ function renderMarkdown(md: string): string {
   // Markdown-style anchor links [text](#anchor)
   html = html.replace(
     /\[([^\]]+)\]\(#([^)]+)\)/g,
-    '<a class="help-link" href="#$2">$1</a>',
+    (_m, text: string, anchor: string) =>
+      `<a class="help-link" href="#${attr(anchor)}">${text}</a>`,
   );
 
   // Markdown-style external links [text](url)
   html = html.replace(
     /\[([^\]]+)\]\((https?:\/\/[^)]+)\)/g,
-    '<a class="help-link" href="$2" target="_blank" rel="noopener noreferrer">$1</a>',
+    (_m, text: string, url: string) =>
+      `<a class="help-link" href="${attr(url)}" target="_blank" rel="noopener noreferrer">${text}</a>`,
   );
 
   // Unordered list items (- ...)
@@ -117,7 +165,8 @@ function renderMarkdown(md: string): string {
   // Links - convert bare URLs to clickable links (skip already-wrapped URLs)
   html = html.replace(
     /(?<!="|'>)(https?:\/\/[^\s<)]+)/g,
-    '<a class="help-link" href="$1" target="_blank" rel="noopener noreferrer">$1</a>',
+    (_m, url: string) =>
+      `<a class="help-link" href="${attr(url)}" target="_blank" rel="noopener noreferrer">${url}</a>`,
   );
 
   // Wrap remaining loose text lines in paragraphs
diff --git a/app/src/components/layout/StatusBar.tsx b/app/src/components/layout/StatusBar.tsx
index d52cca8..4b10d86 100644
--- a/app/src/components/layout/StatusBar.tsx
+++ b/app/src/components/layout/StatusBar.tsx
@@ -23,6 +23,11 @@ export default function StatusBar({ stt }: Props) {
     }))
   );
   const running = projects.filter((p) => p.status === "running").length;
+  // Only in a Claude tab: the chord is bound there and nowhere else, and a hint
+  // for a key that does nothing is worse than no hint.
+  const inClaudeSession = sessions.some(
+    (s) => s.id === activeSessionId && s.sessionType === "claude",
+  );
 
   return (
     <div className="flex items-center h-6 px-4 bg-[var(--bg-tertiary)] border border-[var(--border-color)] rounded-[var(--radius-panel)] text-xs text-[var(--text-secondary)]">
@@ -45,6 +50,14 @@ export default function StatusBar({ stt }: Props) {
           </span>
         </>
       )}
+      {!terminalHasSelection && inClaudeSession && (
+        <>
+          <span className="mx-2">|</span>
+          <span title="Sends ESC+CR — the sequence Claude Code's own /terminal-setup installs. Alt+Enter does the same.">
+            Shift+Enter: newline
+          </span>
+        </>
+      )}
       {/* Right-aligned controls: Jump to Current + STT mic */}
       <div className="ml-auto flex items-center gap-3 pl-2">
         {activeSessionId && !terminalAtBottom && (
diff --git a/app/src/components/projects/ClaudeCodeSettingsEditor.test.tsx b/app/src/components/projects/ClaudeCodeSettingsEditor.test.tsx
new file mode 100644
index 0000000..75cf30d
--- /dev/null
+++ b/app/src/components/projects/ClaudeCodeSettingsEditor.test.tsx
@@ -0,0 +1,225 @@
+import { describe, it, expect, vi } from "vitest";
+import { render, screen, fireEvent } from "@testing-library/react";
+import ClaudeCodeSettingsEditor, { CLAUDE_CODE_DEFAULTS } from "./ClaudeCodeSettingsEditor";
+import type { ClaudeCodeSettings } from "../../lib/types";
+
+function renderEditor(
+  settings: ClaudeCodeSettings | null,
+  scope: "global" | "project" = "global",
+) {
+  const onSave = vi.fn().mockResolvedValue(undefined);
+  render(
+    <ClaudeCodeSettingsEditor
+      scope={scope}
+      settings={settings}
+      disabled={false}
+      onSave={onSave}
+    />,
+  );
+  return onSave;
+}
+
+describe("ClaudeCodeSettingsEditor", () => {
+  it("shows the two default-on settings as on for a project that never touched them", () => {
+    // Claude Code's session recap and fullscreen auto-scroll are both on by
+    // default, and the fields behind them store the *disabled* sense. A toggle
+    // rendered straight from the field would tell every existing user their
+    // recap is off.
+    renderEditor(null);
+    expect(screen.getByRole("switch", { name: "Session recap" })).toBeChecked();
+    expect(screen.getByRole("switch", { name: "Auto-scroll" })).toBeChecked();
+    expect(screen.getByRole("switch", { name: "Focus mode" })).not.toBeChecked();
+  });
+
+  it("stores the disabled sense when an inverted toggle is switched off", () => {
+    const onSave = renderEditor(null);
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    expect(onSave).toHaveBeenCalledWith(
+      expect.objectContaining({ session_recap_disabled: true }),
+    );
+  });
+
+  it("collapses back to null once every setting is at its default again", () => {
+    // `null` is what tells the backend this project adds nothing over the
+    // global settings, so the round trip has to land exactly back on it.
+    const onSave = renderEditor({ ...CLAUDE_CODE_DEFAULTS, session_recap_disabled: true });
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    expect(onSave).toHaveBeenCalledWith(null);
+  });
+
+  it("offers the classic renderer as a choice distinct from automatic", () => {
+    // Leaving `tui` unset lets Claude Code pick; pinning "default" is a
+    // different, and previously unreachable, instruction.
+    const onSave = renderEditor(null);
+    const tui = screen.getByLabelText("TUI mode");
+    expect(
+      Array.from(tui.querySelectorAll("option")).map((o) => o.getAttribute("value")),
+    ).toEqual(["", "default", "fullscreen"]);
+    fireEvent.change(tui, { target: { value: "default" } });
+    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ tui_mode: "default" }));
+  });
+
+  it("offers every effort level Claude Code accepts", () => {
+    // Verified against the shipped `claude` binary's own schema rather than
+    // inferred: low/medium/high/xhigh/max. `max` was missing until an audit
+    // checked externally — which is the whole weakness of this test. It can
+    // only prove the editor agrees with this list, never that the list is the
+    // one Claude Code reads. The same blind spot is why `effort` and
+    // `focusMode` were confidently wrong for months.
+    renderEditor(null);
+    expect(
+      Array.from(
+        screen.getByLabelText("Effort level").querySelectorAll("option"),
+      ).map((o) => o.getAttribute("value")),
+    ).toEqual(["", "low", "medium", "high", "xhigh", "max"]);
+  });
+
+  describe("project scope", () => {
+    it("offers Global as a third state so a project can decline to have an opinion", () => {
+      renderEditor(null, "project");
+      const focus = screen.getByLabelText("Focus mode");
+      expect(
+        Array.from(focus.querySelectorAll("option")).map((o) => o.getAttribute("value")),
+      ).toEqual(["global", "off", "on"]);
+      expect((focus as HTMLSelectElement).value).toBe("global");
+    });
+
+    it("stores a deliberate false so the project can turn a global On back off", () => {
+      // The reason the field widened from boolean to boolean|null. Under the
+      // old merge there was no project value that could produce this.
+      const onSave = renderEditor(null, "project");
+      fireEvent.change(screen.getByLabelText("Focus mode"), { target: { value: "off" } });
+      expect(onSave).toHaveBeenCalledWith(
+        expect.objectContaining({ focus_mode: false }),
+      );
+    });
+
+    it("does not collapse a deliberate off to null", () => {
+      // `null` means inherit. Collapsing here would silently hand the setting
+      // straight back to the global value the user just overrode.
+      const onSave = renderEditor(null, "project");
+      fireEvent.change(screen.getByLabelText("Focus mode"), { target: { value: "off" } });
+      expect(onSave).not.toHaveBeenCalledWith(null);
+    });
+
+    it("round-trips the inverted fields through the disabled sense", () => {
+      // Session recap stores `session_recap_disabled`, so choosing "off" has to
+      // store `true` and choosing "on" has to store `false`.
+      const onSave = renderEditor(null, "project");
+      const recap = screen.getByLabelText("Session recap");
+
+      fireEvent.change(recap, { target: { value: "off" } });
+      expect(onSave).toHaveBeenCalledWith(
+        expect.objectContaining({ session_recap_disabled: true }),
+      );
+
+      fireEvent.change(recap, { target: { value: "on" } });
+      expect(onSave).toHaveBeenCalledWith(
+        expect.objectContaining({ session_recap_disabled: false }),
+      );
+    });
+
+    it("shows a stored override rather than the inherited state", () => {
+      renderEditor({ ...CLAUDE_CODE_DEFAULTS, session_recap_disabled: true }, "project");
+      expect((screen.getByLabelText("Session recap") as HTMLSelectElement).value).toBe(
+        "off",
+      );
+    });
+
+    /**
+     * Auto-scroll is the second inverted field and had no project-scope test at
+     * all — every assertion above rides on `session_recap_disabled`, so a
+     * `BOOLEAN_FIELDS` entry that lost its `invert` flag would be caught for
+     * one of the two and pass silently for the other. It is stored as
+     * `auto_scroll_disabled`, so every value here reads back the other way up.
+     */
+    describe("auto-scroll", () => {
+      const AUTO = "Auto-scroll";
+
+      it("starts on Global, which is not the same as on", () => {
+        // Claude Code scrolls by default, so an inheriting project *behaves*
+        // as on — but it has taken no position, and rendering it as "On" would
+        // make a later global change look like it had no effect.
+        renderEditor(null, "project");
+        expect((screen.getByLabelText(AUTO) as HTMLSelectElement).value).toBe("global");
+      });
+
+      it("stores the disabled sense in both directions", () => {
+        const onSave = renderEditor(null, "project");
+        const auto = screen.getByLabelText(AUTO);
+
+        fireEvent.change(auto, { target: { value: "off" } });
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ auto_scroll_disabled: true }),
+        );
+
+        fireEvent.change(auto, { target: { value: "on" } });
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ auto_scroll_disabled: false }),
+        );
+      });
+
+      it("hands the setting back to the global level when Global is chosen", () => {
+        // Back to no opinion, and with nothing else set that collapses the
+        // whole object to `null` — the value that means "adds nothing over the
+        // global settings".
+        const onSave = renderEditor(
+          { ...CLAUDE_CODE_DEFAULTS, auto_scroll_disabled: true },
+          "project",
+        );
+        fireEvent.change(screen.getByLabelText(AUTO), { target: { value: "global" } });
+        expect(onSave).toHaveBeenCalledWith(null);
+      });
+
+      it("reads a stored override back the right way up", () => {
+        renderEditor({ ...CLAUDE_CODE_DEFAULTS, auto_scroll_disabled: true }, "project");
+        expect((screen.getByLabelText(AUTO) as HTMLSelectElement).value).toBe("off");
+      });
+    });
+  });
+
+  /**
+   * The inverted fields store a *deviation*, so a stored `false` is the one
+   * value that means "the user deliberately re-enabled the default". Nothing
+   * asserted it: every existing test drives the `true` (turned off) direction
+   * or the `null` (untouched) one, and both scopes would still read correctly
+   * if the inversion were dropped from the `false` branch alone.
+   */
+  describe.each([
+    ["session_recap_disabled", "Session recap"] as const,
+    ["auto_scroll_disabled", "Auto-scroll"] as const,
+  ])("a stored false on %s", (key, label) => {
+    it("reads as On at project scope, not as Off", () => {
+      renderEditor({ ...CLAUDE_CODE_DEFAULTS, [key]: false }, "project");
+      expect((screen.getByLabelText(label) as HTMLSelectElement).value).toBe("on");
+    });
+
+    it("reads as on at global scope, where the control is a switch", () => {
+      renderEditor({ ...CLAUDE_CODE_DEFAULTS, [key]: false });
+      expect(screen.getByRole("switch", { name: label })).toBeChecked();
+    });
+  });
+
+  /**
+   * A settings object with nothing set at this level arrives as `{}`: the Rust
+   * struct skips serialising a field it has no value for, which is what keeps
+   * an older binary able to parse `projects.json` after a downgrade. It is also
+   * the exact shape a project stored before the fields were widened is read
+   * back as — every one of its `false`s meant "unset" — so reading absent as
+   * "off" would show a switch the user never touched as a deliberate choice.
+   */
+  it("reads an absent field as Global rather than as Off", () => {
+    renderEditor({} as ClaudeCodeSettings, "project");
+    expect((screen.getByLabelText("Env scrub") as HTMLSelectElement).value).toBe("global");
+    expect((screen.getByLabelText("Session recap") as HTMLSelectElement).value).toBe("global");
+  });
+
+  it("still collapses to null when an absent-field object is edited back", () => {
+    const onSave = renderEditor({} as ClaudeCodeSettings, "global");
+    // Off and straight back on: the round trip has to land on `null`, or an
+    // untouched global stops being indistinguishable from one never opened.
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    fireEvent.click(screen.getByRole("switch", { name: "Session recap" }));
+    expect(onSave).toHaveBeenLastCalledWith(null);
+  });
+});
diff --git a/app/src/components/projects/ClaudeCodeSettingsEditor.tsx b/app/src/components/projects/ClaudeCodeSettingsEditor.tsx
index d61c3e6..167998b 100644
--- a/app/src/components/projects/ClaudeCodeSettingsEditor.tsx
+++ b/app/src/components/projects/ClaudeCodeSettingsEditor.tsx
@@ -8,52 +8,91 @@ interface Props {
   disabled: boolean;
   disabledReason?: string;
   onSave: (settings: ClaudeCodeSettings | null) => Promise<unknown>;
+  /**
+   * `"project"` adds a third "Global" state to every switch, because a project
+   * has somewhere to inherit *from*. The global editor has no such fallback —
+   * unset there just means Claude Code's own default — so it stays a plain
+   * on/off and never renders the extra choice.
+   */
+  scope?: "global" | "project";
 }
 
 export const CLAUDE_CODE_DEFAULTS: ClaudeCodeSettings = {
   tui_mode: null,
   effort: null,
-  auto_scroll_disabled: false,
-  focus_mode: false,
-  show_thinking_summaries: false,
-  enable_session_recap: false,
-  env_scrub: false,
-  prompt_caching_1h: false,
+  auto_scroll_disabled: null,
+  focus_mode: null,
+  show_thinking_summaries: null,
+  session_recap_disabled: null,
+  env_scrub: null,
+  prompt_caching_1h: null,
 };
 
+/**
+ * "Nothing is set at this level", which is saved as `null` rather than as a
+ * struct of nulls so that a project with no opinion is indistinguishable from
+ * one that never opened this editor.
+ *
+ * Note `false` is *not* a default any more: it is a deliberate off that
+ * overrides a global on, so a settings object holding one has to be persisted.
+ */
 function isAllDefaults(s: ClaudeCodeSettings): boolean {
+  // `== null`, not `===`: an unset field is *absent* on the wire, not null.
+  // The Rust struct skips serialising one it has no value for, so a project
+  // whose stored settings were all "unset" arrives here as `{}` — and reading
+  // that as "off" is exactly the mistake the three-state control exists to
+  // avoid. See the note on `ClaudeCodeSettings` in `lib/types.ts`.
   return (
-    s.tui_mode === null &&
-    s.effort === null &&
-    s.auto_scroll_disabled === false &&
-    s.focus_mode === false &&
-    s.show_thinking_summaries === false &&
-    s.enable_session_recap === false &&
-    s.env_scrub === false &&
-    s.prompt_caching_1h === false
+    s.tui_mode == null &&
+    s.effort == null &&
+    s.auto_scroll_disabled == null &&
+    s.focus_mode == null &&
+    s.show_thinking_summaries == null &&
+    s.session_recap_disabled == null &&
+    s.env_scrub == null &&
+    s.prompt_caching_1h == null
   );
 }
 
+/**
+ * Two of Claude Code's settings are **on by default**, so the field behind them
+ * stores the *disabled* sense (`auto_scroll_disabled`, `session_recap_disabled`)
+ * — that is what makes an untouched project mean "leave Claude Code alone"
+ * rather than "the user turned this off". `invert` is what lets those still
+ * read as an ordinary on/off switch here: the toggle shows the feature's state,
+ * the field stores the deviation from the default.
+ */
 const BOOLEAN_FIELDS: {
   key: keyof Omit<ClaudeCodeSettings, "tui_mode" | "effort">;
   label: string;
   hint: string;
+  invert?: boolean;
 }[] = [
-  { key: "focus_mode", label: "Focus mode", hint: "Collapses tool output to one-line summaries." },
+  {
+    key: "focus_mode",
+    label: "Focus mode",
+    // It summarises tool *calls*, not all output — and it does nothing at all
+    // unless the fullscreen renderer is on, which is a separate switch above.
+    // Saying so here is cheaper than the user concluding the setting is broken,
+    // which is the complaint that started this whole round of work.
+    hint: "Summarises each tool call to one line, showing the last prompt and the final response. Needs TUI mode set to Fullscreen.",
+  },
   {
     key: "show_thinking_summaries",
     label: "Thinking summaries",
     hint: "Shows Claude's thinking process as summaries.",
   },
   {
-    key: "enable_session_recap",
+    key: "session_recap_disabled",
     label: "Session recap",
-    hint: "Provides context when returning to a session.",
+    hint: "Shows a one-line recap when you return to the terminal after a few minutes away.",
+    invert: true,
   },
   {
     key: "auto_scroll_disabled",
-    label: "Auto-scroll disabled",
-    hint: "Disables auto-scroll when in fullscreen TUI mode.",
+    label: "Auto-scroll",
+    hint: "Follows new output to the bottom in fullscreen rendering.",
+    invert: true,
   },
   {
     key: "env_scrub",
@@ -72,6 +111,7 @@ export default function ClaudeCodeSettingsEditor({
   disabled,
   disabledReason,
   onSave,
+  scope = "global",
 }: Props) {
   const [local, setLocal] = useState<ClaudeCodeSettings>(
     settings ?? { ...CLAUDE_CODE_DEFAULTS },
@@ -95,9 +135,16 @@ export default function ClaudeCodeSettingsEditor({
         </p>
       )}
 
+      {/*
+        Three states, not two. Leaving `tui` unset is what lets Claude Code pick
+        the renderer for itself, which is not the same as pinning the classic
+        one — and the key is now always written (or explicitly deleted), so
+        "Automatic" has to be selectable rather than merely being what you get
+        when nothing is emitted.
+      */}
       <SwitchRow
         label="TUI mode"
-        hint="Enables flicker-free alt-screen rendering."
+        hint="Classic renders in your terminal's scrollback; fullscreen is the flicker-free alt-screen."
         control={
           <select
             value={local.tui_mode ?? ""}
@@ -106,7 +153,8 @@ export default function ClaudeCodeSettingsEditor({
             disabled={disabled}
             className={selectClass}
           >
-            <option value="">Default</option>
+            <option value="">Automatic</option>
+            <option value="default">Classic</option>
             <option value="fullscreen">Fullscreen</option>
           </select>
         }
@@ -127,25 +175,79 @@ export default function ClaudeCodeSettingsEditor({
             <option value="low">Low</option>
             <option value="medium">Medium</option>
             <option value="high">High</option>
+            <option value="xhigh">Extra high</option>
+            {/* `max` is accepted by the CLI and was missing here. Confirmed
+                against the shipped claude binary's own schema, not just docs. */}
+            <option value="max">Maximum</option>
           </select>
         }
       />
 
-      {BOOLEAN_FIELDS.map(({ key, label, hint }) => (
-        <SwitchRow
-          key={key}
-          label={label}
-          hint={hint}
-          control={
-            <Toggle
+      {BOOLEAN_FIELDS.map(({ key, label, hint, invert }) => {
+        const stored = local[key];
+
+        if (scope === "global") {
+          // No level above this one to inherit from, so "unset" and "off" are
+          // the same instruction here and a plain switch is the honest control.
+          // Unset therefore has to *display* as Claude Code's own default —
+          // which for the two inverted fields is on, not off.
+          const checked = invert ? stored !== true : stored === true;
+          return (
+            <SwitchRow
+              key={key}
               label={label}
-              checked={local[key]}
-              disabled={disabled}
-              onChange={(v) => apply({ [key]: v } as Partial<ClaudeCodeSettings>)}
+              hint={hint}
+              control={
+                <Toggle
+                  label={label}
+                  checked={checked}
+                  disabled={disabled}
+                  onChange={(v) => {
+                    // Collapse back to null at the default rather than storing
+                    // a redundant `false`, so an untouched global stays
+                    // indistinguishable from one that was never opened.
+                    const atDefault = invert ? v : !v;
+                    apply({
+                      [key]: atDefault ? null : invert ? !v : v,
+                    } as Partial<ClaudeCodeSettings>);
+                  }}
+                />
+              }
             />
-          }
-        />
-      ))}
+          );
+        }
+
+        // `stored` holds the deviation from Claude Code's default, so an
+        // inverted field reads back the other way round — see BOOLEAN_FIELDS.
+        const selected =
+          stored == null ? "global" : (invert ? !stored : stored) ? "on" : "off";
+
+        return (
+          <SwitchRow
+            key={key}
+            label={label}
+            hint={hint}
+            control={
+              <select
+                value={selected}
+                aria-label={label}
+                disabled={disabled}
+                onChange={(e) => {
+                  const choice = e.target.value;
+                  const next =
+                    choice === "global" ? null : invert ? choice === "off" : choice === "on";
+                  apply({ [key]: next } as Partial<ClaudeCodeSettings>);
+                }}
+                className={selectClass}
+              >
+                <option value="global">Global</option>
+                <option value="off">Off</option>
+                <option value="on">On</option>
+              </select>
+            }
+          />
+        );
+      })}
     </div>
   );
 }
diff --git a/app/src/components/projects/ConfirmRemoveModal.tsx b/app/src/components/projects/ConfirmRemoveModal.tsx
index 215c3fa..1fc53b4 100644
--- a/app/src/components/projects/ConfirmRemoveModal.tsx
+++ b/app/src/components/projects/ConfirmRemoveModal.tsx
@@ -28,10 +28,24 @@ export default function ConfirmRemoveModal({ projectName, onConfirm, onCancel }:
         </>
       }
     >
+      {/*
+        Everything remove_project() destroys, named. It removes the container,
+        *both* named volumes (triple-c-home-{id} and triple-c-claude-config-{id}),
+        the triple-c-snapshot-{id} image and the project's keychain secrets — so
+        an accurate warning has to reach past "the config volume". The last
+        sentence is the reassuring half and matters just as much: project folders
+        are bind mounts from the host and nothing here touches them.
+      */}
       <p className="text-[13px] text-[var(--text-secondary)]">
         Are you sure you want to remove{" "}
-        <strong className="text-[var(--text-primary)]">{projectName}</strong>? This will
-        delete the container, config volume, and stored credentials.
+        <strong className="text-[var(--text-primary)]">{projectName}</strong>? This deletes
+        its container, both of its volumes and its saved container image — so the home
+        directory, the Claude login and config, installed skills, session transcripts,
+        scheduled tasks and any stored credentials all go with it.
+      </p>
+      <p className="mt-2 text-[13px] text-[var(--text-secondary)]">
+        Your project folders on this machine are mounted in, not copied, and are left
+        untouched.
       </p>
     </Modal>
   );
diff --git a/app/src/components/projects/home/BrowserTab.test.tsx b/app/src/components/projects/home/BrowserTab.test.tsx
index 8e5303f..df7624b 100644
--- a/app/src/components/projects/home/BrowserTab.test.tsx
+++ b/app/src/components/projects/home/BrowserTab.test.tsx
@@ -571,4 +571,57 @@ describe("BrowserTab", () => {
     // The view is still in the tab, where it was.
     expect(screen.getByTitle("Playwright browser view for api-server")).toBeInTheDocument();
   });
+
+  it("pins the pane's sandbox: same-origin kept, top-navigation never granted", async () => {
+    await renderLive();
+    const frame = await screen.findByTitle("Playwright browser view for api-server");
+    const tokens = new Set(
+      (frame.getAttribute("sandbox") ?? "").split(/\s+/).filter(Boolean),
+    );
+
+    // What is framed here is served by a process *inside* the container, which
+    // is the untrusted side of this app. A top-navigation grant would let that
+    // page set `top.location` and steer the whole Triple-C app window away from
+    // itself — a sandbox escape from the app's point of view — and
+    // `allow-popups-to-escape-sandbox` is the same hole one step removed: it
+    // hands a popup an entirely unsandboxed context. Checked token by token so
+    // the failure names the one that was added.
+    for (const forbidden of [
+      "allow-top-navigation",
+      "allow-top-navigation-by-user-activation",
+      "allow-top-navigation-to-custom-protocols",
+      "allow-popups-to-escape-sandbox",
+    ]) {
+      expect(
+        tokens.has(forbidden),
+        `FORBIDDEN iframe sandbox token "${forbidden}" on the browser view pane. ` +
+          "A page served from inside the container could then navigate the whole " +
+          "Triple-C app window away from itself (or run a popup unsandboxed) — a " +
+          "sandbox escape. Remove it from the iframe in BrowserTab.tsx.",
+      ).toBe(false);
+    }
+
+    // `allow-same-origin` must stay. The browser_view proxy's token gate
+    // recognises the pane's own sub-resource requests by their `Origin`/
+    // `Referer` header; dropping this token gives the frame an opaque origin,
+    // which sends `null`, so the proxy refuses those requests and the pane
+    // renders blank.
+    expect(
+      tokens.has("allow-same-origin"),
+      'REQUIRED iframe sandbox token "allow-same-origin" is missing from the ' +
+        "browser view pane. Without it the frame has an opaque origin and sends " +
+        "`Origin: null`, which the browser_view proxy's token gate refuses — the " +
+        "pane goes blank.",
+    ).toBe(true);
+
+    // And the exact set, so any *other* new grant is a deliberate edit here too.
+    expect([...tokens].sort()).toEqual([
+      "allow-downloads",
+      "allow-forms",
+      "allow-modals",
+      "allow-popups",
+      "allow-same-origin",
+      "allow-scripts",
+    ]);
+  });
 });
diff --git a/app/src/components/projects/home/BrowserTab.tsx b/app/src/components/projects/home/BrowserTab.tsx
index 0805733..8e5aac3 100644
--- a/app/src/components/projects/home/BrowserTab.tsx
+++ b/app/src/components/projects/home/BrowserTab.tsx
@@ -457,6 +457,35 @@ export default function BrowserTab({ project, active }: Props) {
           // host-side gate checks before anything reaches the container.
           src={status.url ?? undefined}
           title={`Playwright browser view for ${project.name}`}
+          // What is framed here is served by a process inside the container,
+          // which is the untrusted side of this app. Unsandboxed, it could
+          // simply set `top.location` and navigate the *app's* webview
+          // somewhere of its choosing — the frame is cross-origin, so it cannot
+          // read the app, but steering the whole window is not something a
+          // viewer pane should be able to do.
+          //
+          // The allowances are what the Playwright dashboard actually needs and
+          // no more:
+          //   allow-scripts      — it is an application, not a document.
+          //   allow-same-origin  — it must reach its own WebSocket and assets,
+          //                        and the host-side gate recognises the pane's
+          //                        own sub-resource requests by their
+          //                        `Origin`/`Referer`; an opaque origin would
+          //                        send `null` and be refused. This does not
+          //                        grant access to *this* app: 127.0.0.1:4782x
+          //                        is a different origin from the app's.
+          //   allow-forms/-modals/-downloads/-popups — dashboard UI affordances
+          //                        (trace download, confirm dialogs, opening a
+          //                        page in a new window).
+          //
+          // Deliberately absent, and the point of the attribute:
+          // `allow-top-navigation`, `allow-top-navigation-by-user-activation`
+          // and `allow-popups-to-escape-sandbox`. Do not add them.
+          //
+          // No `referrerPolicy` either: the gate in `browser_view/proxy.rs`
+          // reads the token out of a same-origin `Referer`, so stripping it
+          // would break the pane.
+          sandbox="allow-scripts allow-same-origin allow-forms allow-modals allow-downloads allow-popups"
           className="flex-1 min-h-0 w-full border-0 bg-[var(--bg-primary)]"
         />
       ) : live ? (
diff --git a/app/src/components/projects/home/FileViewerModal.tsx b/app/src/components/projects/home/FileViewerModal.tsx
new file mode 100644
index 0000000..e7cac42
--- /dev/null
+++ b/app/src/components/projects/home/FileViewerModal.tsx
@@ -0,0 +1,189 @@
+import { useEffect, useRef, useState } from "react";
+import type { FileEntry } from "../../../lib/types";
+import { readContainerFile } from "../../../lib/tauri-commands";
+import Button from "../../ui/Button";
+import Modal from "../../ui/Modal";
+import { formatBytes } from "./format";
+import {
+  decodeBase64,
+  imageMimeFor,
+  looksBinary,
+  previewKind,
+  previewLimit,
+} from "./filePreview";
+
+interface Props {
+  projectId: string;
+  entry: FileEntry;
+  onClose: () => void;
+}
+
+type Preview =
+  | { kind: "loading" }
+  | { kind: "error"; message: string }
+  /** Too big to render whole — said so rather than shown as a half-file. */
+  | { kind: "too-large" }
+  | { kind: "text"; text: string; truncated: boolean; shownBytes: number; trueSize: number }
+  | { kind: "image"; url: string }
+  | { kind: "unsupported" };
+
+/**
+ * Read-only preview of one container file.
+ *
+ * Images are rendered from a `blob:` URL rather than a `data:` one — the object
+ * URL is revocable (so the bytes are released the moment the modal closes) and
+ * keeps a multi-megabyte base64 string out of the DOM. `blob:` is in the app's
+ * `img-src` for exactly this; the asset protocol deliberately is not enabled.
+ */
+export default function FileViewerModal({ projectId, entry, onClose }: Props) {
+  const [preview, setPreview] = useState<Preview>({ kind: "loading" });
+
+  /**
+   * The object URL currently on screen.
+   *
+   * This used to be an effect-local variable revoked from the effect's own
+   * cleanup, which runs *before* the replacement effect body — so switching
+   * entries (or any re-run of the effect for the same entry) released the URL
+   * the `<img>` was still pointing at, and a blank image was the result until
+   * the new read landed. If the new read failed, it stayed blank. So the
+   * hand-over is explicit instead: a URL is revoked only once its replacement
+   * exists, and unmount is what releases the last one.
+   */
+  const objectUrlRef = useRef<string | null>(null);
+
+  /** Release the previous URL now that something else is on screen. */
+  const replaceObjectUrl = (next: string | null) => {
+    const previous = objectUrlRef.current;
+    objectUrlRef.current = next;
+    if (previous && previous !== next) URL.revokeObjectURL(previous);
+  };
+
+  useEffect(() => {
+    let cancelled = false;
+
+    (async () => {
+      try {
+        const wantImage = previewKind(entry.name) === "image";
+        const result = await readContainerFile(projectId, entry.path, previewLimit(entry.name));
+        if (cancelled) return;
+
+        const bytes = decodeBase64(result.contents_base64);
+
+        if (wantImage) {
+          // A truncated image is not a smaller image, it is a broken one.
+          if (result.truncated) {
+            setPreview({ kind: "too-large" });
+            replaceObjectUrl(null);
+            return;
+          }
+          const blob = new Blob([bytes], { type: imageMimeFor(entry.name) ?? "image/png" });
+          const url = URL.createObjectURL(blob);
+          // The replacement is in hand, so the previous one can go.
+          setPreview({ kind: "image", url });
+          replaceObjectUrl(url);
+          return;
+        }
+
+        if (looksBinary(bytes)) {
+          setPreview({ kind: "unsupported" });
+          replaceObjectUrl(null);
+          return;
+        }
+
+        setPreview({
+          kind: "text",
+          text: new TextDecoder().decode(bytes),
+          truncated: result.truncated,
+          shownBytes: bytes.length,
+          trueSize: result.size,
+        });
+        replaceObjectUrl(null);
+      } catch (e) {
+        if (!cancelled) setPreview({ kind: "error", message: String(e) });
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [projectId, entry.name, entry.path]);
+
+  // The bytes are released when the dialog goes, which is the whole reason the
+  // preview is a `blob:` URL rather than a `data:` one.
+  useEffect(
+    () => () => {
+      if (objectUrlRef.current) URL.revokeObjectURL(objectUrlRef.current);
+      objectUrlRef.current = null;
+    },
+    [],
+  );
+
+  const footer = (
+    <Button size="md" variant="primary" onClick={onClose}>
+      Close
+    </Button>
+  );
+
+  return (
+    <Modal
+      title={entry.name}
+      description={`${entry.path} · ${formatBytes(entry.size)}`}
+      onClose={onClose}
+      footer={footer}
+      widthClassName="w-[52rem]"
+    >
+      {preview.kind === "loading" && (
+        <p className="text-[13px] text-[var(--text-secondary)]">Loading…</p>
+      )}
+
+      {preview.kind === "error" && (
+        <p role="alert" className="text-[13px] text-[var(--error)]">
+          {preview.message}
+        </p>
+      )}
+
+      {preview.kind === "too-large" && (
+        <p className="text-[13px] text-[var(--text-secondary)]">
+          This file is {formatBytes(entry.size)} — too large to preview in the app. Use
+          “Save to host…” on its row to open it in a program that can, or read it from a
+          terminal in the container.
+        </p>
+      )}
+
+      {preview.kind === "unsupported" && (
+        <p className="text-[13px] text-[var(--text-secondary)]">
+          There is no preview for this file type. Use “Save to host…” on its row to open it
+          in a program that can, or read it from a terminal in the container.
+        </p>
+      )}
+
+      {preview.kind === "text" && (
+        <>
+          {preview.truncated && (
+            <p className="mb-2 text-xs text-[var(--warning)]">
+              Showing the first {formatBytes(preview.shownBytes)} of {formatBytes(preview.trueSize)}.
+            </p>
+          )}
+          {/* Focusable, and its own scroll container, because a megabyte of
+              text in an unfocusable `<pre>` is reachable by mouse wheel and by
+              nothing else — no PageDown, no arrows, no keyboard at all. A
+              scrollable region needs an accessible name to be worth landing
+              on, hence the role and label. No `focus:outline-none`: the global
+              `:focus-visible` ring is what says where the caret went. */}
+          <pre
+            tabIndex={0}
+            role="region"
+            aria-label={`${entry.name} contents`}
+            className="max-h-[60vh] overflow-auto whitespace-pre-wrap break-words font-mono text-xs text-[var(--text-primary)]"
+          >
+            {preview.text}
+          </pre>
+        </>
+      )}
+
+      {preview.kind === "image" && (
+        <img src={preview.url} alt={entry.name} className="max-w-full mx-auto" />
+      )}
+    </Modal>
+  );
+}
diff --git a/app/src/components/projects/home/FilesTab.test.tsx b/app/src/components/projects/home/FilesTab.test.tsx
new file mode 100644
index 0000000..ebbeb33
--- /dev/null
+++ b/app/src/components/projects/home/FilesTab.test.tsx
@@ -0,0 +1,474 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, fireEvent, act, waitFor, within } from "@testing-library/react";
+import FilesTab from "./FilesTab";
+import type { FileContents, FileEntry, Project } from "../../../lib/types";
+
+const listContainerFiles = vi.fn();
+const renameContainerPath = vi.fn(async () => "");
+const createContainerDirectory = vi.fn(async () => "");
+const readContainerFile = vi.fn();
+const uploadFilesToContainer = vi.fn();
+const downloadContainerFile = vi.fn();
+
+vi.mock("../../../lib/tauri-commands", () => ({
+  listContainerFiles: (p: string, path: string) => listContainerFiles(p, path),
+  renameContainerPath: (p: string, f: string, t: string) => renameContainerPath(p, f, t),
+  createContainerDirectory: (p: string, parent: string, n: string) =>
+    createContainerDirectory(p, parent, n),
+  readContainerFile: (p: string, path: string, max?: number) => readContainerFile(p, path, max),
+  uploadFilesToContainer: (p: string, dir: string) => uploadFilesToContainer(p, dir),
+  downloadContainerFile: (p: string, path: string) => downloadContainerFile(p, path),
+}));
+
+/** Transient failures land in `ToastHost`, not in an inline string. */
+const pushToast = vi.fn();
+vi.mock("../../../store/appState", () => ({
+  useAppState: { getState: () => ({ pushToast }) },
+}));
+
+const toastText = () =>
+  pushToast.mock.calls
+    .map(([toast]) => `${toast.kind}: ${toast.message} ${toast.detail ?? ""}`)
+    .join("\n");
+
+const project = { id: "p1", name: "api", status: "running" } as unknown as Project;
+
+const entry = (name: string, extra: Partial<FileEntry> = {}): FileEntry => ({
+  name,
+  path: `/workspace/${name}`,
+  is_directory: false,
+  is_symlink: false,
+  size: 12,
+  modified: "2024-05-01 10:00:00",
+  permissions: "644",
+  ...extra,
+});
+
+const contents = (text: string, extra: Partial<FileContents> = {}): FileContents => ({
+  contents_base64: btoa(text),
+  truncated: false,
+  size: text.length,
+  ...extra,
+});
+
+async function renderTab() {
+  const view = render(<FilesTab project={project} />);
+  await act(async () => {
+    await Promise.resolve();
+  });
+  return view;
+}
+
+/** Every row that is part of the grid's roving tabindex, in order. */
+const gridRows = () => Array.from(document.querySelectorAll("tr[data-file-row]"));
+/** The rows that are actually tab stops. There must never be more than one. */
+const tabStops = () => gridRows().filter((r) => r.getAttribute("tabindex") === "0");
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  listContainerFiles.mockResolvedValue([
+    entry("src", { is_directory: true, path: "/workspace/src" }),
+    entry("notes.txt"),
+  ]);
+  // Not implemented in jsdom; the image preview needs both halves.
+  URL.createObjectURL = vi.fn(() => "blob:mock-url");
+  URL.revokeObjectURL = vi.fn();
+});
+
+describe("FilesTab listing", () => {
+  it("lists /workspace once the container is running", async () => {
+    await renderTab();
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace");
+    expect(screen.getByText("notes.txt")).toBeTruthy();
+  });
+
+  it("says nothing about files while the container is stopped", async () => {
+    render(<FilesTab project={{ ...project, status: "stopped" } as Project} />);
+    expect(screen.getByText(/Start the container/)).toBeTruthy();
+    expect(listContainerFiles).not.toHaveBeenCalled();
+  });
+
+  it("labels a symlink, which no longer masquerades as a plain file", async () => {
+    listContainerFiles.mockResolvedValue([
+      entry("app", { is_directory: true, is_symlink: true }),
+    ]);
+    await renderTab();
+    expect(screen.getByTitle("Symbolic link")).toBeTruthy();
+  });
+});
+
+describe("FilesTab open semantics", () => {
+  it("selects on a single click without navigating", async () => {
+    await renderTab();
+    listContainerFiles.mockClear();
+    fireEvent.click(screen.getByText("src"));
+    expect(listContainerFiles).not.toHaveBeenCalled();
+    expect(screen.getByText("src").closest("tr")?.getAttribute("aria-selected")).toBe("true");
+  });
+
+  it("navigates a directory on double click", async () => {
+    await renderTab();
+    listContainerFiles.mockClear();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("src"));
+    });
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace/src");
+  });
+
+  it("walks the rows with the arrow keys, which is what makes the grid role honest", async () => {
+    await renderTab();
+    const first = screen.getByText("src").closest("tr")!;
+    first.focus();
+    fireEvent.keyDown(first, { key: "ArrowDown" });
+    expect(document.activeElement).toBe(screen.getByText("notes.txt").closest("tr"));
+    fireEvent.keyDown(document.activeElement!, { key: "ArrowUp" });
+    expect(document.activeElement).toBe(first);
+  });
+
+  it("opens a directory from the keyboard with Enter", async () => {
+    await renderTab();
+    listContainerFiles.mockClear();
+    const row = screen.getByText("src").closest("tr")!;
+    // Not a tab stop — `..` holds the grid's single one until the arrows move
+    // it — but still focusable and still openable from the keyboard.
+    expect(row.getAttribute("tabindex")).toBe("-1");
+    await act(async () => {
+      fireEvent.keyDown(row, { key: "Enter" });
+    });
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace/src");
+  });
+});
+
+describe("FilesTab viewer", () => {
+  it("shows a text file's contents in a dialog", async () => {
+    readContainerFile.mockResolvedValue(contents("hello from the container"));
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("notes.txt"));
+    });
+    const dialog = await screen.findByRole("dialog");
+    expect(dialog).toBeTruthy();
+    expect(await screen.findByText("hello from the container")).toBeTruthy();
+    // A text file gets the text-sized budget, not the image one.
+    expect(readContainerFile).toHaveBeenCalledWith("p1", "/workspace/notes.txt", 1024 * 1024);
+  });
+
+  it("renders an image through a revocable blob URL, not a data URI", async () => {
+    // `data:` is absent from the app's img-src on purpose; `blob:` is what was
+    // added, and the object URL has to be released when the dialog closes.
+    listContainerFiles.mockResolvedValue([entry("logo.png", { size: 4 })]);
+    readContainerFile.mockResolvedValue(contents("\x89PNG"));
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("logo.png"));
+    });
+    const img = (await screen.findByAltText("logo.png")) as HTMLImageElement;
+    expect(img.getAttribute("src")).toBe("blob:mock-url");
+    expect(readContainerFile).toHaveBeenCalledWith("p1", "/workspace/logo.png", 5 * 1024 * 1024);
+
+    fireEvent.click(screen.getByRole("button", { name: "Close" }));
+    await waitFor(() => expect(URL.revokeObjectURL).toHaveBeenCalledWith("blob:mock-url"));
+  });
+
+  it("refuses an oversized image rather than drawing a half-decoded one", async () => {
+    listContainerFiles.mockResolvedValue([entry("huge.png", { size: 40 * 1024 * 1024 })]);
+    readContainerFile.mockResolvedValue(contents("\x89PNG", { truncated: true, size: 40 * 1024 * 1024 }));
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("huge.png"));
+    });
+    expect(await screen.findByText(/too large to preview/)).toBeTruthy();
+    expect(screen.queryByAltText("huge.png")).toBeNull();
+    // A refusal has to name the way out, and the way out is now the button on
+    // the row rather than the `cat`-it-in-a-terminal workaround that existed
+    // because the button did not.
+    // Scoped to the modal: every file row also carries a "Save to host…"
+    // button now, so an unscoped query matches the grid behind the overlay and
+    // would pass with the refusal saying nothing at all.
+    expect(
+      within(screen.getByRole("dialog")).getByText(/Save to host/),
+    ).toBeTruthy();
+  });
+
+  it("says so in words when only a prefix of a big text file came back", async () => {
+    readContainerFile.mockResolvedValue(
+      contents("first megabyte", { truncated: true, size: 5 * 1024 * 1024 }),
+    );
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("notes.txt"));
+    });
+    expect(await screen.findByText(/Showing the first/)).toBeTruthy();
+    expect(screen.getByText("first megabyte")).toBeTruthy();
+  });
+
+  it("says there is no preview, and where to open the file instead", async () => {
+    listContainerFiles.mockResolvedValue([entry("blob.bin")]);
+    readContainerFile.mockResolvedValue(contents("a\x00b"));
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("blob.bin"));
+    });
+    expect(await screen.findByText(/no preview for this file type/)).toBeTruthy();
+  });
+});
+
+describe("FilesTab rename", () => {
+  it("commits an inline rename on Enter and re-lists", async () => {
+    await renderTab();
+    fireEvent.click(screen.getByRole("button", { name: "Rename — notes.txt" }));
+    const input = screen.getByLabelText("New name for notes.txt") as HTMLInputElement;
+    fireEvent.change(input, { target: { value: "renamed.txt" } });
+    await act(async () => {
+      fireEvent.keyDown(input, { key: "Enter" });
+      fireEvent.blur(input);
+    });
+    expect(renameContainerPath).toHaveBeenCalledWith("p1", "/workspace/notes.txt", "renamed.txt");
+  });
+
+  it("abandons the rename on Escape", async () => {
+    await renderTab();
+    fireEvent.click(screen.getByRole("button", { name: "Rename — notes.txt" }));
+    const input = screen.getByLabelText("New name for notes.txt");
+    fireEvent.change(input, { target: { value: "nope.txt" } });
+    await act(async () => {
+      fireEvent.keyDown(input, { key: "Escape" });
+    });
+    expect(renameContainerPath).not.toHaveBeenCalled();
+    expect(screen.queryByLabelText("New name for notes.txt")).toBeNull();
+  });
+
+  it("starts a rename from the keyboard with F2", async () => {
+    await renderTab();
+    const row = screen.getByText("notes.txt").closest("tr")!;
+    fireEvent.keyDown(row, { key: "F2" });
+    expect(screen.getByLabelText("New name for notes.txt")).toBeTruthy();
+  });
+
+  it("reports a refused rename where it can be seen, not three hundred rows down", async () => {
+    // The inline `error` div is the first child of the *scrolling* list, so
+    // deep in a directory this used to be a rename box that stayed open and
+    // said nothing. `ToastHost` is fixed, above the modal layer, and persists.
+    renameContainerPath.mockRejectedValue("mv: cannot move '/etc/hosts': Permission denied");
+    await renderTab();
+    fireEvent.click(screen.getByRole("button", { name: "Rename — notes.txt" }));
+    const input = screen.getByLabelText("New name for notes.txt");
+    fireEvent.change(input, { target: { value: "x" } });
+    await act(async () => {
+      fireEvent.blur(input);
+    });
+    expect(toastText()).toContain("Permission denied");
+    expect(screen.queryByRole("alert")).toBeNull();
+    // The editor stays open, because the rename did not happen.
+    expect(screen.getByLabelText("New name for notes.txt")).toBeTruthy();
+  });
+});
+
+describe("FilesTab new folder", () => {
+  it("creates a folder under the current directory", async () => {
+    await renderTab();
+    fireEvent.click(screen.getByRole("button", { name: "New folder" }));
+    const input = screen.getByLabelText("New folder name");
+    fireEvent.change(input, { target: { value: "assets" } });
+    await act(async () => {
+      fireEvent.blur(input);
+    });
+    expect(createContainerDirectory).toHaveBeenCalledWith("p1", "/workspace", "assets");
+  });
+});
+
+describe("FilesTab grid focus", () => {
+  it("gives the grid exactly one tab stop and moves it with the arrows", async () => {
+    // Every row used to be `tabIndex={0}`: a 400-entry directory was ~1200 tab
+    // stops and Tab could not get out of the list.
+    await renderTab();
+    expect(gridRows()).toHaveLength(3); // .. , src, notes.txt
+    expect(tabStops()).toHaveLength(1);
+    expect(tabStops()[0].getAttribute("data-file-row")).toBe("..");
+
+    fireEvent.keyDown(tabStops()[0], { key: "ArrowDown" });
+    expect(tabStops()).toHaveLength(1);
+    expect(tabStops()[0].getAttribute("data-file-row")).toBe("src");
+    expect(document.activeElement).toBe(tabStops()[0]);
+
+    fireEvent.keyDown(tabStops()[0], { key: "End" });
+    expect(tabStops()[0].getAttribute("data-file-row")).toBe("notes.txt");
+    fireEvent.keyDown(tabStops()[0], { key: "Home" });
+    expect(tabStops()[0].getAttribute("data-file-row")).toBe("..");
+  });
+
+  it("keeps focus inside the grid after Enter opens a directory", async () => {
+    // Rows are keyed by name, so navigating unmounts the focused `<tr>` — and
+    // nothing used to re-focus, which ejected the user to `<body>`.
+    await renderTab();
+    const row = screen.getByText("src").closest("tr")!;
+    row.focus();
+    listContainerFiles.mockResolvedValueOnce([
+      entry("index.ts", { path: "/workspace/src/index.ts" }),
+    ]);
+    await act(async () => {
+      fireEvent.keyDown(row, { key: "Enter" });
+    });
+
+    expect(screen.getByText("index.ts")).toBeTruthy();
+    expect(document.activeElement).not.toBe(document.body);
+    expect((document.activeElement as HTMLElement).closest("tr[data-file-row]")).toBeTruthy();
+    expect(tabStops()).toHaveLength(1);
+  });
+
+  it("puts focus back on the row after a rename is abandoned", async () => {
+    await renderTab();
+    const row = screen.getByText("notes.txt").closest("tr")!;
+    fireEvent.keyDown(row, { key: "F2" });
+    const input = screen.getByLabelText("New name for notes.txt");
+    await act(async () => {
+      fireEvent.keyDown(input, { key: "Escape" });
+    });
+    expect(document.activeElement).toBe(
+      gridRows().find((r) => r.getAttribute("data-file-row") === "notes.txt"),
+    );
+  });
+
+  it("follows a committed rename to the row's new name", async () => {
+    // Explicit, because `clearAllMocks` clears calls but not implementations,
+    // and an earlier test in this file leaves this one rejecting.
+    renameContainerPath.mockResolvedValue("/workspace/renamed.txt");
+    await renderTab();
+    fireEvent.click(screen.getByRole("button", { name: "Rename — notes.txt" }));
+    const input = screen.getByLabelText("New name for notes.txt");
+    fireEvent.change(input, { target: { value: "renamed.txt" } });
+    listContainerFiles.mockResolvedValueOnce([
+      entry("src", { is_directory: true, path: "/workspace/src" }),
+      entry("renamed.txt"),
+    ]);
+    await act(async () => {
+      fireEvent.blur(input);
+    });
+    expect(document.activeElement).toBe(
+      gridRows().find((r) => r.getAttribute("data-file-row") === "renamed.txt"),
+    );
+  });
+});
+
+describe("FilesTab grid semantics", () => {
+  it("names its columns", async () => {
+    await renderTab();
+    for (const name of ["Name", "Size", "Modified", "Actions"]) {
+      expect(screen.getByRole("columnheader", { name })).toBeTruthy();
+    }
+  });
+
+  it("says folder or file in words, not in hue and a hidden emoji", async () => {
+    await renderTab();
+    const dir = screen.getByText("src").closest("tr")!;
+    const plain = screen.getByText("notes.txt").closest("tr")!;
+    expect(dir.textContent).toContain("Folder");
+    expect(plain.textContent).toContain("File");
+  });
+
+  it("keeps the visible label inside the accessible name (WCAG 2.5.3)", async () => {
+    await renderTab();
+    const rename = screen.getByRole("button", { name: "Rename — notes.txt" });
+    expect(rename.textContent).toBe("Rename");
+    expect(rename.getAttribute("aria-label")).toContain(rename.textContent!);
+  });
+
+  it("mounts the live region empty, then fills it", async () => {
+    // A `role="status"` node inserted already carrying its text is frequently
+    // not announced at all, which is how every one of these went by in silence.
+    createContainerDirectory.mockResolvedValue("/workspace/new");
+    await renderTab();
+    const live = screen.getByRole("status");
+    expect(live.textContent).toBe("");
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "New folder" }));
+    });
+    const input = screen.getByLabelText("New folder name");
+    fireEvent.change(input, { target: { value: "new" } });
+    await act(async () => {
+      fireEvent.blur(input);
+    });
+    // Same node throughout — it is never unmounted.
+    expect(screen.getByRole("status")).toBe(live);
+    expect(live.textContent).toContain('Created "new"');
+  });
+
+  it("keeps a listing failure inline, where the rows it explains are missing", async () => {
+    // The one failure that does *not* go to the toast host: it is on screen,
+    // in context, and there is nothing for it to scroll behind.
+    listContainerFiles.mockRejectedValue("Permission denied");
+    await renderTab();
+    expect(screen.getByRole("alert").textContent).toContain("Permission denied");
+  });
+});
+
+/**
+ * The pane's two host-transfer affordances.
+ *
+ * They are asserted at the *button* level and not only in the hook, because
+ * this is the half that was actually lost: the commands behind them had been
+ * deleted, but so had the controls, and a working command nobody can reach is
+ * the same regression. Neither button names a host path — Rust opens the
+ * dialog — so what a click is required to prove is that the container-side
+ * argument reaching the backend is the one the user is looking at.
+ */
+describe("FilesTab host transfers", () => {
+  beforeEach(() => {
+    uploadFilesToContainer.mockResolvedValue({ uploaded: [], failures: [] });
+    downloadContainerFile.mockResolvedValue(4);
+  });
+
+  it("uploads into the directory currently on screen", async () => {
+    listContainerFiles.mockResolvedValue([entry("src", { is_directory: true })]);
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(screen.getByText("src"));
+    });
+    uploadFilesToContainer.mockResolvedValueOnce({
+      uploaded: ["/workspace/src/a.txt"],
+      failures: [],
+    });
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "Upload…" }));
+    });
+    expect(uploadFilesToContainer).toHaveBeenCalledWith("p1", "/workspace/src");
+  });
+
+  it("offers Save to host on a file and not on a folder", async () => {
+    listContainerFiles.mockResolvedValue([
+      entry("notes.txt"),
+      entry("src", { is_directory: true }),
+    ]);
+    await renderTab();
+    // The accessible name carries the row, per WCAG 2.5.3 — and it is how a
+    // per-row action is told apart from every other row's copy of it.
+    expect(
+      screen.getByRole("button", { name: "Save to host — notes.txt" }),
+    ).toBeTruthy();
+    expect(
+      screen.queryByRole("button", { name: "Save to host — src" }),
+    ).toBeNull();
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "Save to host — notes.txt" }));
+    });
+    expect(downloadContainerFile).toHaveBeenCalledWith("p1", "/workspace/notes.txt");
+  });
+
+  it("does not open the file viewer when Save to host is double-clicked", async () => {
+    // Opening a file is a *double*-click on the row, and a double-click on a
+    // button inside that row still bubbles — `onClick`'s `stopPropagation` does
+    // nothing about it. So an impatient double-click on Save used to save the
+    // file and drop the viewer modal over the pane at the same time, on top of
+    // the save dialog the backend had just opened.
+    listContainerFiles.mockResolvedValue([entry("notes.txt")]);
+    readContainerFile.mockResolvedValue(contents("hello"));
+    await renderTab();
+    await act(async () => {
+      fireEvent.doubleClick(
+        screen.getByRole("button", { name: "Save to host — notes.txt" }),
+      );
+    });
+    expect(readContainerFile).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/src/components/projects/home/FilesTab.tsx b/app/src/components/projects/home/FilesTab.tsx
index f8e2f8f..57a0a72 100644
--- a/app/src/components/projects/home/FilesTab.tsx
+++ b/app/src/components/projects/home/FilesTab.tsx
@@ -1,34 +1,252 @@
-import { useEffect } from "react";
-import type { Project } from "../../../lib/types";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import type { FileEntry, Project } from "../../../lib/types";
 import { useFileManager } from "../../../hooks/useFileManager";
 import Button from "../../ui/Button";
+import FileViewerModal from "./FileViewerModal";
 import { formatBytes } from "./format";
 
 interface Props {
   project: Project;
 }
 
-/** The old 42rem FileManager popup, now a main-area section. */
+/** Key of the synthetic "go up one level" row. No listing ever contains `..`. */
+const PARENT_ROW = "..";
+
+/**
+ * The project's file browser.
+ *
+ * It lists, opens, renames and creates folders inside the container, and it
+ * copies single files across the boundary: "Upload…" in the toolbar, and a
+ * per-row "Save to host…".
+ *
+ * **Neither of those names a host path, and this file must never learn how
+ * to.** Four successive audits found that host paths crossing IPC were where
+ * the criticals lived — a frontend `open()`/`save()` handing Rust a string is
+ * exactly the shape that failed — so the picker is opened by the *backend*
+ * (`pick_files_to_upload` / `pick_save_path` in `commands/file_commands.rs`).
+ * What this file *sends* is a project id and a container path; the host side of
+ * the transfer is chosen by a person in an OS dialog. That is why
+ * `uploadFiles()` takes no argument and `saveToHost()` takes only the entry.
+ * (A failed transfer does report a host path back, in the text of its error —
+ * the inbound direction is the one that is closed, not both.)
+ *
+ * Drag-and-drop is deliberately still absent, in both directions. A file also
+ * gets into a container by being dropped onto the Terminal tab, and a whole
+ * tree comes back out through "Back up container" in the project's ⋯ menu —
+ * which is still the right answer for a directory, since "Save to host…" is one
+ * file at a time and is not offered on folders.
+ *
+ * Interaction model, chosen to match every desktop file manager rather than
+ * the old half-and-half: **single click selects, double click opens**. That
+ * moved directory navigation onto double click too — a single click used to
+ * navigate, which made it impossible to select a directory in order to rename
+ * it. Keyboard mirrors it exactly: Enter opens, F2 renames.
+ *
+ * ## Focus, and why it is a roving tabindex
+ *
+ * Every row used to be `tabIndex={0}`, which made a 400-entry directory about
+ * twelve hundred tab stops — Tab could not get *out* of the list, let alone
+ * past it — and rows are keyed by name, so navigating unmounted the focused
+ * `<tr>` and dropped focus to `<body>`: Enter on a directory ejected you from
+ * the grid, arrows dead, Tab restarting from the top of the document. So
+ * exactly one row carries `tabIndex={0}` (the *active* row), the arrows move
+ * it, and a single effect below is responsible for putting focus back on a
+ * sensible row after anything that re-renders the list.
+ */
 export default function FilesTab({ project }: Props) {
   const {
     currentPath,
     entries,
     loading,
     error,
+    completed,
     navigate,
     goUp,
     refresh,
-    downloadFile,
-    uploadFile,
+    renameEntry,
+    createFolder,
+    uploadFiles,
+    saveToHost,
+    uploading,
+    savingPaths,
   } = useFileManager(project.id);
 
   const running = project.status === "running";
 
+  /** The row the user has selected, by name — names are unique in a directory. */
+  const [selected, setSelected] = useState<string | null>(null);
+  const [renaming, setRenaming] = useState<string | null>(null);
+  const [renameDraft, setRenameDraft] = useState("");
+  const [creatingFolder, setCreatingFolder] = useState(false);
+  const [folderDraft, setFolderDraft] = useState("");
+  const [viewing, setViewing] = useState<FileEntry | null>(null);
+  /** The row that owns the grid's single tab stop. */
+  const [activeRow, setActiveRow] = useState<string | null>(null);
+
+  const paneRef = useRef<HTMLDivElement>(null);
+  const renameInputRef = useRef<HTMLInputElement>(null);
+  const folderInputRef = useRef<HTMLInputElement>(null);
+
   useEffect(() => {
     if (running) navigate("/workspace");
     // Re-list when the container comes up.
   }, [navigate, running]);
 
+  // Leaving a directory invalidates every in-flight row interaction.
+  useEffect(() => {
+    setSelected(null);
+    setRenaming(null);
+  }, [currentPath]);
+
+  useEffect(() => {
+    if (renaming) {
+      renameInputRef.current?.focus();
+      renameInputRef.current?.select();
+    }
+  }, [renaming]);
+
+  useEffect(() => {
+    if (creatingFolder) folderInputRef.current?.focus();
+  }, [creatingFolder]);
+
+  // ---------------------------------------------------------------------------
+  // Roving tabindex
+  // ---------------------------------------------------------------------------
+
+  /** Every row's key, in visual order. The parent row is a row like any other. */
+  const rowKeys = useMemo(
+    () => [
+      ...(currentPath !== "/" ? [PARENT_ROW] : []),
+      ...entries.map((entry) => entry.name),
+    ],
+    [currentPath, entries],
+  );
+
+  /**
+   * The active row, resolved against what is actually on screen. Keeping the
+   * *intent* in state and resolving it at render time means a rename or a
+   * deletion cannot leave the grid with no tab stop at all.
+   */
+  const active = activeRow && rowKeys.includes(activeRow) ? activeRow : rowKeys[0];
+
+  const rowElement = useCallback((key: string): HTMLElement | undefined => {
+    // Matched on the dataset rather than a selector, because a file name is
+    // user data and can contain quotes, brackets and backslashes.
+    const rows = paneRef.current?.querySelectorAll<HTMLElement>("tr[data-file-row]") ?? [];
+    return Array.from(rows).find((row) => row.dataset.fileRow === key);
+  }, []);
+
+  const focusRow = useCallback(
+    (key: string) => {
+      setActiveRow(key);
+      rowElement(key)?.focus();
+    },
+    [rowElement],
+  );
+
+  /**
+   * Where focus should land the next time the grid re-renders, if it is loose.
+   * `key` is a preference, not a promise — the row may not exist any more (a
+   * rename that failed, a navigation into a different directory), in which case
+   * the first row takes it.
+   */
+  const wantFocus = useRef<{ key: string | null } | null>(null);
+
+  /**
+   * The single place that decides where focus goes after the list changes.
+   *
+   * Runs after a navigation (rows are keyed by name, so the focused `<tr>` is
+   * gone), after a rename commits or is abandoned, and after Escape. It never
+   * *steals* focus: if the user has moved on to a button or the breadcrumb it
+   * drops the request instead, so a background re-list cannot yank the caret
+   * out from under them.
+   */
+  useEffect(() => {
+    if (renaming !== null) return; // the rename input owns focus
+    const want = wantFocus.current;
+    if (!want) return;
+    wantFocus.current = null;
+
+    const focused = document.activeElement as HTMLElement | null;
+    const loose =
+      !focused ||
+      focused === document.body ||
+      focused === document.documentElement ||
+      !!focused.closest?.("tr[data-file-row]");
+    if (!loose) return;
+
+    const key = want.key && rowKeys.includes(want.key) ? want.key : rowKeys[0];
+    if (key !== undefined) focusRow(key);
+  }, [rowKeys, renaming, focusRow]);
+
+  /** Arrow / Home / End movement over the rows. */
+  const moveActive = useCallback(
+    (from: string, to: 1 | -1 | "first" | "last") => {
+      if (rowKeys.length === 0) return;
+      const i = rowKeys.indexOf(from);
+      const next =
+        to === "first"
+          ? 0
+          : to === "last"
+            ? rowKeys.length - 1
+            : Math.min(rowKeys.length - 1, Math.max(0, (i < 0 ? 0 : i) + to));
+      focusRow(rowKeys[next]);
+    },
+    [rowKeys, focusRow],
+  );
+
+  const startRename = useCallback((entry: FileEntry) => {
+    setSelected(entry.name);
+    setActiveRow(entry.name);
+    setRenameDraft(entry.name);
+    setRenaming(entry.name);
+    // Whichever way the rename ends, focus comes back to this row unless the
+    // commit renames it — `commitRename` overwrites the preference below.
+    wantFocus.current = { key: entry.name };
+  }, []);
+
+  const commitRename = useCallback(
+    async (entry: FileEntry) => {
+      const renamedTo = renameDraft.trim();
+      wantFocus.current = { key: renamedTo || entry.name };
+      const done = await renameEntry(entry, renameDraft);
+      if (done) setRenaming(null);
+    },
+    [renameEntry, renameDraft],
+  );
+
+  const commitFolder = useCallback(async () => {
+    const created = folderDraft.trim();
+    const done = await createFolder(folderDraft);
+    if (done) {
+      setCreatingFolder(false);
+      setFolderDraft("");
+      wantFocus.current = { key: created || null };
+    }
+  }, [createFolder, folderDraft]);
+
+  /** Double click / Enter: directories navigate, files open the viewer. */
+  const openEntry = useCallback(
+    (entry: FileEntry) => {
+      if (entry.is_directory) {
+        // The new listing's first row is `..`, which is the sensible landing
+        // place: it is where you go to undo the step you just took.
+        wantFocus.current = { key: null };
+        navigate(entry.path);
+      } else {
+        setViewing(entry);
+      }
+    },
+    [navigate],
+  );
+
+  const openParent = useCallback(() => {
+    // Coming back up, the directory just left is the interesting row.
+    const leaving = currentPath.split("/").filter(Boolean).pop() ?? null;
+    wantFocus.current = { key: leaving };
+    goUp();
+  }, [currentPath, goUp]);
+
   const breadcrumbs =
     currentPath === "/"
       ? [{ label: "/", path: "/" }]
@@ -55,8 +273,25 @@ export default function FilesTab({ project }: Props) {
     );
   }
 
+  const rowClass = (isSelected: boolean) =>
+    `cursor-pointer transition-colors ${
+      isSelected
+        ? "bg-[var(--bg-tertiary)]"
+        : "hover:bg-[var(--bg-tertiary)]"
+    }`;
+
+  const headerClass = "px-2 py-1.5 font-medium text-[var(--text-secondary)]";
+
+  /**
+   * The live region's text. One region, always mounted, filled and emptied —
+   * a `role="status"` node that is *inserted* already carrying its text is
+   * frequently not announced at all, which is how every completion notice used
+   * to go by in silence.
+   */
+  const liveText = completed ?? "";
+
   return (
-    <div className="flex flex-col h-full min-h-0">
+    <div ref={paneRef} className="relative flex flex-col h-full min-h-0">
       <div className="flex items-center gap-1 px-4 py-2 border-b border-[var(--border-color)] text-xs overflow-x-auto flex-shrink-0">
         <nav aria-label="Path" className="flex items-center gap-1">
           {breadcrumbs.map((crumb, i) => (
@@ -64,7 +299,10 @@ export default function FilesTab({ project }: Props) {
               {i > 0 && <span className="text-[var(--text-secondary)]">/</span>}
               <button
                 type="button"
-                onClick={() => navigate(crumb.path)}
+                onClick={() => {
+                  wantFocus.current = { key: null };
+                  navigate(crumb.path);
+                }}
                 className="text-[var(--accent)] hover:text-[var(--accent-hover)] transition-colors whitespace-nowrap font-mono"
               >
                 {crumb.label}
@@ -73,13 +311,38 @@ export default function FilesTab({ project }: Props) {
           ))}
         </nav>
         <div className="flex-1" />
-        <Button onClick={uploadFile}>Upload file</Button>
+        <span role="status" className="mr-2 text-[var(--text-secondary)] whitespace-nowrap">
+          {liveText}
+        </span>
+        <Button
+          onClick={() => {
+            setFolderDraft("");
+            setCreatingFolder(true);
+          }}
+        >
+          New folder
+        </Button>
+        {/* The file picker this opens belongs to Rust, not to the webview — so
+            this file imports no dialog plugin and never composes a host path.
+            `uploadFiles` takes no argument for the same reason. */}
+        <Button
+          onClick={() => void uploadFiles()}
+          disabled={uploading}
+          className="ml-1"
+        >
+          {uploading ? "Uploading…" : "Upload…"}
+        </Button>
         <Button onClick={refresh} disabled={loading} className="ml-1">
           Refresh
         </Button>
       </div>
 
       <div className="flex-1 overflow-y-auto min-h-0">
+        {/* The one failure that stays inline: it explains why the grid below is
+            empty, it is in context, and there are no rows for it to scroll
+            behind. Every *transient* failure — rename, new folder — goes to
+            `ToastHost` instead, which is above the file viewer's overlay and
+            does not scroll away. */}
         {error && (
           <div role="alert" className="px-4 py-2 text-xs text-[var(--error)]">
             {error}
@@ -91,61 +354,218 @@ export default function FilesTab({ project }: Props) {
             Loading…
           </div>
         ) : (
-          <table className="w-full text-xs">
+          <table role="grid" aria-label="Files" className="w-full text-xs">
+            <thead>
+              <tr role="row">
+                <th role="columnheader" scope="col" className={`${headerClass} px-4 text-left`}>
+                  Name
+                </th>
+                <th role="columnheader" scope="col" className={`${headerClass} text-right`}>
+                  Size
+                </th>
+                <th role="columnheader" scope="col" className={`${headerClass} text-left`}>
+                  Modified
+                </th>
+                <th role="columnheader" scope="col" className={`${headerClass} text-right`}>
+                  Actions
+                </th>
+              </tr>
+            </thead>
             <tbody>
-              {currentPath !== "/" && (
-                <tr
-                  onClick={goUp}
-                  className="cursor-pointer hover:bg-[var(--bg-tertiary)] transition-colors"
-                >
-                  <td className="px-4 py-1.5 text-[var(--text-primary)] font-mono">..</td>
-                  <td colSpan={3} />
+              {creatingFolder && (
+                <tr role="row">
+                  <td role="gridcell" className="px-4 py-1.5" colSpan={4}>
+                    <input
+                      ref={folderInputRef}
+                      value={folderDraft}
+                      aria-label="New folder name"
+                      placeholder="Folder name"
+                      onChange={(e) => setFolderDraft(e.target.value)}
+                      onBlur={commitFolder}
+                      onKeyDown={(e) => {
+                        if (e.key === "Enter") (e.target as HTMLInputElement).blur();
+                        if (e.key === "Escape") {
+                          setCreatingFolder(false);
+                          setFolderDraft("");
+                        }
+                      }}
+                      className="w-64 px-1 py-0 select-text bg-[var(--bg-primary)] border border-[var(--accent)] rounded-[var(--radius-control)] text-xs font-mono text-[var(--text-primary)]"
+                    />
+                  </td>
                 </tr>
               )}
-              {entries.map((entry) => (
+              {currentPath !== "/" && (
                 <tr
-                  key={entry.name}
-                  onClick={() => entry.is_directory && navigate(entry.path)}
-                  className={`${
-                    entry.is_directory ? "cursor-pointer" : ""
-                  } hover:bg-[var(--bg-tertiary)] transition-colors`}
+                  role="row"
+                  data-file-row={PARENT_ROW}
+                  tabIndex={active === PARENT_ROW ? 0 : -1}
+                  aria-label="Parent directory"
+                  onClick={() => setActiveRow(PARENT_ROW)}
+                  onDoubleClick={openParent}
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter") {
+                      e.preventDefault();
+                      openParent();
+                    } else if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+                      e.preventDefault();
+                      moveActive(PARENT_ROW, e.key === "ArrowDown" ? 1 : -1);
+                    } else if (e.key === "Home" || e.key === "End") {
+                      e.preventDefault();
+                      moveActive(PARENT_ROW, e.key === "Home" ? "first" : "last");
+                    }
+                  }}
+                  className="cursor-pointer hover:bg-[var(--bg-tertiary)] transition-colors"
                 >
-                  <td className="px-4 py-1.5">
-                    <span
-                      className={`font-mono ${
-                        entry.is_directory
-                          ? "text-[var(--accent)]"
-                          : "text-[var(--text-primary)]"
-                      }`}
-                    >
-                      {entry.is_directory ? "📁 " : ""}
-                      {entry.name}
-                    </span>
-                  </td>
-                  <td className="px-2 py-1.5 text-[var(--text-secondary)] text-right whitespace-nowrap tabular-nums">
-                    {!entry.is_directory && formatBytes(entry.size)}
-                  </td>
-                  <td className="px-2 py-1.5 text-[var(--text-secondary)] whitespace-nowrap">
-                    {entry.modified}
-                  </td>
-                  <td className="px-2 py-1.5 text-right">
-                    {!entry.is_directory && (
-                      <Button
-                        aria-label={`Download ${entry.name}`}
-                        onClick={(e) => {
-                          e.stopPropagation();
-                          downloadFile(entry);
-                        }}
-                      >
-                        Download
-                      </Button>
-                    )}
+                  <td role="gridcell" className="px-4 py-1.5 text-[var(--text-primary)] font-mono">
+                    <span className="sr-only">Folder, </span>
+                    ..
                   </td>
+                  <td role="gridcell" colSpan={3} />
                 </tr>
-              ))}
+              )}
+              {entries.map((entry) => {
+                const isSelected = selected === entry.name;
+                const isRenaming = renaming === entry.name;
+                return (
+                  <tr
+                    key={entry.name}
+                    role="row"
+                    data-file-row={entry.name}
+                    tabIndex={active === entry.name ? 0 : -1}
+                    aria-selected={isSelected}
+                    onClick={() => {
+                      setSelected(entry.name);
+                      setActiveRow(entry.name);
+                    }}
+                    onDoubleClick={() => openEntry(entry)}
+                    onKeyDown={(e) => {
+                      if (isRenaming) return;
+                      if (e.key === "Enter") {
+                        e.preventDefault();
+                        setSelected(entry.name);
+                        setActiveRow(entry.name);
+                        openEntry(entry);
+                      } else if (e.key === "F2") {
+                        e.preventDefault();
+                        startRename(entry);
+                      } else if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+                        e.preventDefault();
+                        moveActive(entry.name, e.key === "ArrowDown" ? 1 : -1);
+                      } else if (e.key === "Home" || e.key === "End") {
+                        e.preventDefault();
+                        moveActive(entry.name, e.key === "Home" ? "first" : "last");
+                      }
+                    }}
+                    className={rowClass(isSelected)}
+                  >
+                    <td role="gridcell" className="px-4 py-1.5">
+                      {isRenaming ? (
+                        <input
+                          ref={renameInputRef}
+                          value={renameDraft}
+                          aria-label={`New name for ${entry.name}`}
+                          onChange={(e) => setRenameDraft(e.target.value)}
+                          onClick={(e) => e.stopPropagation()}
+                          onDoubleClick={(e) => e.stopPropagation()}
+                          onBlur={() => commitRename(entry)}
+                          onKeyDown={(e) => {
+                            e.stopPropagation();
+                            if (e.key === "Enter") (e.target as HTMLInputElement).blur();
+                            if (e.key === "Escape") setRenaming(null);
+                          }}
+                          className="w-64 px-1 py-0 select-text bg-[var(--bg-primary)] border border-[var(--accent)] rounded-[var(--radius-control)] text-xs font-mono text-[var(--text-primary)]"
+                        />
+                      ) : (
+                        <span
+                          className={`font-mono ${
+                            entry.is_directory
+                              ? "text-[var(--accent)]"
+                              : "text-[var(--text-primary)]"
+                          }`}
+                        >
+                          {/* Directory-ness was carried by hue and an
+                              `aria-hidden` emoji, i.e. by nothing at all for a
+                              screen reader. The emoji stays hidden — it reads
+                              as "file folder" in some voices and as nothing in
+                              others — and the word is what is announced. */}
+                          <span className="sr-only">
+                            {entry.is_directory ? "Folder, " : "File, "}
+                          </span>
+                          {entry.is_directory && <span aria-hidden="true">📁 </span>}
+                          <span>{entry.name}</span>
+                          {entry.is_symlink && (
+                            <span
+                              className="ml-1 text-[var(--text-secondary)]"
+                              title="Symbolic link"
+                            >
+                              ↗ link
+                            </span>
+                          )}
+                        </span>
+                      )}
+                    </td>
+                    <td role="gridcell" className="px-2 py-1.5 text-[var(--text-secondary)] text-right whitespace-nowrap tabular-nums">
+                      {!entry.is_directory && formatBytes(entry.size)}
+                    </td>
+                    <td role="gridcell" className="px-2 py-1.5 text-[var(--text-secondary)] whitespace-nowrap">
+                      {entry.modified}
+                    </td>
+                    <td role="gridcell" className="px-2 py-1.5 text-right whitespace-nowrap">
+                      {!isRenaming && (
+                        <>
+                          {/* WCAG 2.5.3: the accessible name has to *contain*
+                              the visible label, so the row context is appended
+                              rather than substituted. "Rename notes.txt" used
+                              to be the whole name, which left a voice-control
+                              user saying "click Rename" at a button that had
+                              no such name. */}
+                          <Button
+                            aria-label={`Rename — ${entry.name}`}
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              startRename(entry);
+                            }}
+                          >
+                            Rename
+                          </Button>
+                          {/* Folders have no single-file equivalent — a
+                              recursive download is what "Back up container" is
+                              for, and offering one here would mean rebuilding
+                              the tree-walking this pane deliberately does not
+                              do. */}
+                          {!entry.is_directory && (
+                            <Button
+                              aria-label={`Save to host — ${entry.name}`}
+                              className="ml-1"
+                              // Only this row: a large file can take a while,
+                              // and there is no reason the rest of the pane
+                              // should go dead while it is written.
+                              disabled={savingPaths.has(entry.path)}
+                              onClick={(e) => {
+                                e.stopPropagation();
+                                void saveToHost(entry);
+                              }}
+                              // A double-click is its own event, and
+                              // `onClick`'s `stopPropagation` says nothing
+                              // about it — so an impatient double-click here
+                              // reached the row's `onDoubleClick` and dropped
+                              // the viewer modal over the pane, on top of the
+                              // save dialog the backend had just opened.
+                              onDoubleClick={(e) => e.stopPropagation()}
+                            >
+                              {savingPaths.has(entry.path) ? "Saving…" : "Save to host…"}
+                            </Button>
+                          )}
+                        </>
+                      )}
+                    </td>
+                  </tr>
+                );
+              })}
               {entries.length === 0 && !loading && (
-                <tr>
+                <tr role="row">
                   <td
+                    role="gridcell"
                     colSpan={4}
                     className="px-4 py-8 text-center text-[var(--text-secondary)]"
                   >
@@ -157,6 +577,14 @@ export default function FilesTab({ project }: Props) {
           </table>
         )}
       </div>
+
+      {viewing && (
+        <FileViewerModal
+          projectId={project.id}
+          entry={viewing}
+          onClose={() => setViewing(null)}
+        />
+      )}
     </div>
   );
 }
diff --git a/app/src/components/projects/home/TaskEditorModal.tsx b/app/src/components/projects/home/TaskEditorModal.tsx
index 7e4d34f..09a57ca 100644
--- a/app/src/components/projects/home/TaskEditorModal.tsx
+++ b/app/src/components/projects/home/TaskEditorModal.tsx
@@ -311,10 +311,22 @@ export default function TaskEditorModal({ project, task, onClose, onSaved }: Pro
         </div>
 
         {task && (
+          /*
+            An edit is `add` then `remove` (see `update_scheduled_task`), and
+            `triple-c-scheduler`'s remove now reaps the task's log directory —
+            so on a current container the old logs are gone, not merely filed
+            under the old id, which is what this used to promise.
+
+            It is deliberately not stated as a certainty. `/usr/local/bin` only
+            changes on base-image migration or Reset, so a project still running
+            an older base image carries the older scheduler, whose remove leaves
+            the log directory behind. "Assume they go with it" is true in both
+            worlds and spares the user a paragraph about which one they are in.
+          */
           <p className="text-xs text-[var(--text-secondary)]">
             The scheduler has no edit command, so saving re-creates this task under a new id and
-            removes <code className="font-mono">{task.id}</code>. Its previous run logs stay under
-            the old id.
+            removes <code className="font-mono">{task.id}</code>. Assume its earlier run logs go
+            with it.
           </p>
         )}
 
diff --git a/app/src/components/projects/home/config/AccessSection.tsx b/app/src/components/projects/home/config/AccessSection.tsx
index a499910..85c7f42 100644
--- a/app/src/components/projects/home/config/AccessSection.tsx
+++ b/app/src/components/projects/home/config/AccessSection.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useState } from "react";
+import { useSecretField } from "../../../../hooks/useSecretField";
 import { open } from "@tauri-apps/plugin-dialog";
 import type { Project } from "../../../../lib/types";
 import Button from "../../../ui/Button";
@@ -24,14 +25,15 @@ export default function AccessSection({
   const [caCertPath, setCaCertPath] = useState(project.ca_cert_path ?? "");
   const [gitName, setGitName] = useState(project.git_user_name ?? "");
   const [gitEmail, setGitEmail] = useState(project.git_user_email ?? "");
-  const [gitToken, setGitToken] = useState(project.git_token ?? "");
+  // Never seeded from `project` — the backend does not serialize secrets, so
+  // the box is always empty and only an edit may speak about the stored value.
+  const gitToken = useSecretField(project.id);
 
   useEffect(() => {
     setSshKeyPath(project.ssh_key_path ?? "");
     setCaCertPath(project.ca_cert_path ?? "");
     setGitName(project.git_user_name ?? "");
     setGitEmail(project.git_user_email ?? "");
-    setGitToken(project.git_token ?? "");
   }, [project]);
 
   return (
@@ -101,15 +103,19 @@ export default function AccessSection({
 
       <Field
         label="Git HTTPS token"
-        hint="A personal access token (e.g. a GitHub PAT) for HTTPS git operations inside the container."
+        hint={
+          gitToken.edited
+            ? "Saved when you click away. Clearing the box removes the stored token."
+            : "A personal access token (e.g. a GitHub PAT) for HTTPS git operations inside the container. A stored token is not shown; leave this empty to keep it."
+        }
       >
         {(id) => (
           <input
             id={id}
             type="password"
-            value={gitToken}
-            onChange={(e) => setGitToken(e.target.value)}
-            onBlur={() => save({ git_token: gitToken || null })}
+            value={gitToken.value}
+            onChange={(e) => gitToken.setValue(e.target.value)}
+            onBlur={() => save({ ...gitToken.patch("git_token") })}
             placeholder="ghp_…"
             disabled={disabled}
             className={inputClass}
diff --git a/app/src/components/projects/home/config/AuthBridgeRow.test.tsx b/app/src/components/projects/home/config/AuthBridgeRow.test.tsx
new file mode 100644
index 0000000..98f7eb5
--- /dev/null
+++ b/app/src/components/projects/home/config/AuthBridgeRow.test.tsx
@@ -0,0 +1,252 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, fireEvent, waitFor } from "@testing-library/react";
+import AuthBridgeRow, { bridgeIndicator } from "./AuthBridgeRow";
+import type { AuthBridgeStatus, Project } from "../../../../lib/types";
+
+/**
+ * The bridge shipped with a working backend, a typed IPC wrapper, and no way to
+ * reach either: `setAuthBridgeEnabled` had zero call sites, and the
+ * `auth-bridge-changed` event had no listener — so a host port the bridge could
+ * not take was a silent failure that presented as a login that simply hung.
+ * These tests hold both halves down.
+ */
+
+const getAuthBridgeStatus = vi.fn<() => Promise<AuthBridgeStatus>>();
+const setAuthBridgeEnabled = vi.fn<(id: string, on: boolean) => Promise<AuthBridgeStatus>>();
+
+vi.mock("../../../../lib/tauri-commands", () => ({
+  getAuthBridgeStatus: () => getAuthBridgeStatus(),
+  setAuthBridgeEnabled: (id: string, on: boolean) => setAuthBridgeEnabled(id, on),
+}));
+
+/** Captured so a test can push an `auth-bridge-changed` payload by hand. */
+let emit: ((payload: unknown) => void) | null = null;
+
+vi.mock("@tauri-apps/api/event", () => ({
+  listen: vi.fn(async (_name: string, handler: (e: { payload: unknown }) => void) => {
+    emit = (payload) => handler({ payload });
+    return () => {
+      emit = null;
+    };
+  }),
+}));
+
+const OFF: AuthBridgeStatus = { enabled: false, active_ports: [], conflicts: [] };
+
+const project = {
+  id: "p1",
+  name: "api",
+  status: "running",
+  auth_bridge_enabled: false,
+} as unknown as Project;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  getAuthBridgeStatus.mockResolvedValue(OFF);
+  setAuthBridgeEnabled.mockResolvedValue({ ...OFF, enabled: true });
+});
+
+describe("AuthBridgeRow", () => {
+  it("turns the bridge on through its own command, not the project save", async () => {
+    // The dedicated command exists so this can be flipped while the container
+    // runs — which is exactly when a user discovers they need it. Routing it
+    // through the Config tab's stopped-only save would make it unreachable at
+    // the only moment it matters.
+    render(<AuthBridgeRow project={project} />);
+    await waitFor(() => expect(getAuthBridgeStatus).toHaveBeenCalled());
+
+    fireEvent.click(screen.getByRole("switch", { name: "Auth bridge" }));
+
+    await waitFor(() =>
+      expect(setAuthBridgeEnabled).toHaveBeenCalledWith("p1", true),
+    );
+  });
+
+  it("stays usable while the container is running", async () => {
+    render(<AuthBridgeRow project={project} />);
+    await waitFor(() => expect(getAuthBridgeStatus).toHaveBeenCalled());
+    expect(screen.getByRole("switch", { name: "Auth bridge" })).not.toBeDisabled();
+  });
+
+  it("reports a port conflict the poller emitted", async () => {
+    getAuthBridgeStatus.mockResolvedValue({ ...OFF, enabled: true });
+    render(<AuthBridgeRow project={project} />);
+    await waitFor(() => expect(emit).not.toBeNull());
+
+    emit!({
+      project_id: "p1",
+      status: {
+        enabled: true,
+        active_ports: [],
+        conflicts: [
+          { port: 54545, reason: "Host port 54545 is already in use (…); not bridged." },
+        ],
+      },
+    });
+
+    expect(await screen.findByText(/Port 54545/)).toBeInTheDocument();
+    expect(screen.getByText("Port conflict")).toBeInTheDocument();
+  });
+
+  it("ignores an event for a different project", async () => {
+    getAuthBridgeStatus.mockResolvedValue({ ...OFF, enabled: true });
+    render(<AuthBridgeRow project={project} />);
+    await waitFor(() => expect(emit).not.toBeNull());
+
+    emit!({
+      project_id: "other",
+      status: { enabled: true, active_ports: [], conflicts: [{ port: 1, reason: "nope" }] },
+    });
+
+    expect(screen.queryByText(/Port 1:/)).not.toBeInTheDocument();
+  });
+
+  /**
+   * The two halves of this row disagree about *when*, not about *what*.
+   *
+   * `set_auth_bridge_enabled` resolves with a status sampled as it returned;
+   * the poller's event carries one sampled afterwards. Writing the awaited
+   * value unconditionally therefore rolls the row back in time whenever the
+   * two overlap — the row says "Watching" while a port is bound, which is the
+   * exact silent failure the event subscription was added to end. These two
+   * hold the ordering down from both the resolve and the reject side.
+   */
+  describe("a pushed event outranks an older awaited result", () => {
+    /** A toggle that will not settle until the test says so. */
+    function deferToggle() {
+      let settle!: (s: AuthBridgeStatus) => void;
+      let fail!: (e: unknown) => void;
+      setAuthBridgeEnabled.mockImplementation(
+        () =>
+          new Promise<AuthBridgeStatus>((resolve, reject) => {
+            settle = resolve;
+            fail = reject;
+          }),
+      );
+      return { settle: (s: AuthBridgeStatus) => settle(s), fail: (e: unknown) => fail(e) };
+    }
+
+    const BRIDGING: AuthBridgeStatus = {
+      enabled: true,
+      active_ports: [{ port: 54545, family: "v4", bridged_at: "", ipv6_warning: null }],
+      conflicts: [],
+    };
+
+    async function startToggleThenPush() {
+      render(<AuthBridgeRow project={project} />);
+      await waitFor(() => expect(getAuthBridgeStatus).toHaveBeenCalled());
+      await waitFor(() => expect(emit).not.toBeNull());
+
+      fireEvent.click(screen.getByRole("switch", { name: "Auth bridge" }));
+      await waitFor(() => expect(setAuthBridgeEnabled).toHaveBeenCalledWith("p1", true));
+
+      // The poller binds a port while the command is still in flight.
+      emit!({ project_id: "p1", status: BRIDGING });
+      expect(await screen.findByText("Bridging 1 port")).toBeInTheDocument();
+    }
+
+    it("keeps the newer state when the command settles with the older one", async () => {
+      const toggle = deferToggle();
+      await startToggleThenPush();
+
+      // …and only now returns the snapshot it took *before* that port existed.
+      toggle.settle({ enabled: true, active_ports: [], conflicts: [] });
+
+      await waitFor(() =>
+        expect(screen.getByRole("switch", { name: "Auth bridge" })).not.toBeDisabled(),
+      );
+      expect(screen.getByText("Bridging 1 port")).toBeInTheDocument();
+      expect(screen.getByText("127.0.0.1:54545")).toBeInTheDocument();
+      expect(screen.queryByText("Watching")).not.toBeInTheDocument();
+    });
+
+    it("does not let the rollback undo a status pushed while it was failing", async () => {
+      // The command failed, so the error belongs on screen — but the bridge
+      // demonstrably came up, and reverting the switch to off would contradict
+      // the port listed right beside it.
+      const toggle = deferToggle();
+      await startToggleThenPush();
+
+      toggle.fail("bridge probe timed out");
+
+      expect(await screen.findByText(/probe timed out/)).toBeInTheDocument();
+      expect(screen.getByText("Bridging 1 port")).toBeInTheDocument();
+      expect(screen.getByRole("switch", { name: "Auth bridge" })).toBeChecked();
+    });
+  });
+
+  it("puts the switch back if the command rejects", async () => {
+    setAuthBridgeEnabled.mockRejectedValue("Project p1 not found");
+    render(<AuthBridgeRow project={project} />);
+    await waitFor(() => expect(getAuthBridgeStatus).toHaveBeenCalled());
+
+    fireEvent.click(screen.getByRole("switch", { name: "Auth bridge" }));
+
+    expect(await screen.findByText(/not found/)).toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Auth bridge" })).not.toBeChecked();
+  });
+});
+
+describe("bridgeIndicator", () => {
+  // Every branch is a glyph plus a word — status is never colour alone.
+  it("says nothing is on when it is off", () => {
+    expect(bridgeIndicator(OFF, true)).toEqual({ tone: "off", label: "Off" });
+  });
+
+  it("puts a conflict ahead of everything else", () => {
+    expect(
+      bridgeIndicator(
+        {
+          enabled: true,
+          active_ports: [
+            { port: 1, family: "v4", bridged_at: "", ipv6_warning: null },
+          ],
+          conflicts: [{ port: 2, reason: "taken" }],
+        },
+        true,
+      ).tone,
+    ).toBe("error");
+  });
+
+  it("flags a port that only took the IPv4 half", () => {
+    // Node resolves `localhost` to IPv6 first on Linux, so a v4-only listener
+    // is a callback that never arrives in front of a bridge reporting healthy.
+    expect(
+      bridgeIndicator(
+        {
+          enabled: true,
+          active_ports: [
+            { port: 1, family: "v6", bridged_at: "", ipv6_warning: "no ::1" },
+          ],
+          conflicts: [],
+        },
+        true,
+      ).label,
+    ).toBe("IPv4 only");
+  });
+
+  it("counts the ports it is holding", () => {
+    expect(
+      bridgeIndicator(
+        {
+          enabled: true,
+          active_ports: [
+            { port: 1, family: "v4", bridged_at: "", ipv6_warning: null },
+            { port: 2, family: "v4", bridged_at: "", ipv6_warning: null },
+          ],
+          conflicts: [],
+        },
+        true,
+      ).label,
+    ).toBe("Bridging 2 ports");
+  });
+
+  it("says it is waiting when the container is not running", () => {
+    // Enabled and holding nothing is normal; enabled with no container is a
+    // different thing, and saying so stops it reading as a failure.
+    expect(bridgeIndicator({ ...OFF, enabled: true }, false).label).toBe(
+      "Waiting for the container",
+    );
+    expect(bridgeIndicator({ ...OFF, enabled: true }, true).label).toBe("Watching");
+  });
+});
diff --git a/app/src/components/projects/home/config/AuthBridgeRow.tsx b/app/src/components/projects/home/config/AuthBridgeRow.tsx
new file mode 100644
index 0000000..8934c56
--- /dev/null
+++ b/app/src/components/projects/home/config/AuthBridgeRow.tsx
@@ -0,0 +1,234 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { listen } from "@tauri-apps/api/event";
+import {
+  getAuthBridgeStatus,
+  setAuthBridgeEnabled,
+} from "../../../../lib/tauri-commands";
+import type {
+  AuthBridgeChangedEvent,
+  AuthBridgeStatus,
+  Project,
+} from "../../../../lib/types";
+import { SwitchRow } from "../../../ui/Field";
+import StatusIndicator, { type StatusTone } from "../../../ui/StatusIndicator";
+import Toggle from "../../../ui/Toggle";
+
+/** Emitted by `auth_bridge/mod.rs` whenever the port or conflict set changes. */
+const AUTH_BRIDGE_EVENT = "auth-bridge-changed";
+
+const LABEL = "Auth bridge";
+
+/**
+ * What the indicator beside the switch says.
+ *
+ * Split out so the interesting part — that a conflict is a *visible* failure —
+ * can be tested without a container. Every branch pairs a glyph with a word;
+ * none of them are distinguished by colour alone.
+ */
+export function bridgeIndicator(
+  status: AuthBridgeStatus | null,
+  containerRunning: boolean,
+): { tone: StatusTone; label: string } {
+  if (!status) return { tone: "unknown", label: "Checking" };
+  if (!status.enabled) return { tone: "off", label: "Off" };
+  // A conflict means a login is in progress and its port could not be taken —
+  // the one state where doing nothing is the wrong answer, and until now the
+  // one state nothing in the app reported at all.
+  if (status.conflicts.length > 0) {
+    return { tone: "error", label: "Port conflict" };
+  }
+  if (status.active_ports.some((p) => p.ipv6_warning)) {
+    return { tone: "busy", label: "IPv4 only" };
+  }
+  if (status.active_ports.length > 0) {
+    const n = status.active_ports.length;
+    return { tone: "running", label: `Bridging ${n} port${n === 1 ? "" : "s"}` };
+  }
+  // Enabled but holding nothing. Normal: there is only something to bridge
+  // while a login is actually waiting for a callback.
+  if (!containerRunning) {
+    return { tone: "stopped", label: "Waiting for the container" };
+  }
+  return { tone: "ok", label: "Watching" };
+}
+
+/**
+ * The switch for `auth_bridge_enabled`, and the only place it can be changed.
+ *
+ * Two things here are deliberate and easy to undo by accident:
+ *
+ *  - **It does not go through the Config tab's `save`.** That path is gated on
+ *    a stopped container, because almost everything else in the tab is baked
+ *    into the container at creation. This is not: the bridge is entirely
+ *    host-side, and `set_auth_bridge_enabled` exists precisely so it can be
+ *    flipped *while a login is hanging*, which is when the user finds out they
+ *    need it. Routing it through the generic save would make it unreachable at
+ *    the only moment it matters.
+ *  - **It subscribes to `auth-bridge-changed`.** The poller already emits the
+ *    bridged-port and conflict sets on every change and, before this, nothing
+ *    listened — so a host port the bridge could not take was a completely
+ *    silent failure, indistinguishable from a login that simply hung.
+ */
+export default function AuthBridgeRow({ project }: { project: Project }) {
+  const projectId = project.id;
+  const containerRunning = project.status === "running";
+
+  const [status, setStatus] = useState<AuthBridgeStatus | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  /**
+   * Which write to `status` is the newest — the same "is this still mine?"
+   * guard `useContainerMigration` uses around its async
+   * writes, and needed here for a reason that is easy to miss.
+   *
+   * There are two sources of truth for this row and only one of them is
+   * ordered. `set_auth_bridge_enabled` resolves with a status *sampled at the
+   * moment it returned*; the poller's `auth-bridge-changed` event carries one
+   * sampled later. Awaiting the command therefore hands back a value that may
+   * already be historical, and writing it unconditionally is how the row ends
+   * up saying "Watching" while a port is in fact bound — the failure mode the
+   * event subscription exists to prevent, reintroduced one line below it.
+   *
+   * So every write claims a generation and only lands if it still holds it.
+   * A pushed event always claims a fresh one, which is what makes it win over
+   * an older awaited result no matter which order the two arrive in.
+   */
+  const generation = useRef(0);
+
+  useEffect(() => {
+    const mine = ++generation.current;
+    let cancelled = false;
+    setStatus(null);
+    setError(null);
+    getAuthBridgeStatus(projectId)
+      .then((s) => {
+        // The initial fetch races the poller exactly like the toggle does: an
+        // event can land first and describe a bridge this reply predates.
+        if (!cancelled && generation.current === mine) setStatus(s);
+      })
+      .catch((e) => {
+        if (!cancelled) setError(String(e));
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [projectId]);
+
+  useEffect(() => {
+    let cancelled = false;
+    let unlisten: (() => void) | undefined;
+    listen<AuthBridgeChangedEvent>(AUTH_BRIDGE_EVENT, (event) => {
+      if (event.payload.project_id !== projectId) return;
+      // A pushed status is the most recent observation that exists, so it
+      // claims the newest generation and invalidates anything still in flight.
+      generation.current += 1;
+      setStatus(event.payload.status);
+    })
+      .then((un) => {
+        if (cancelled) un();
+        else unlisten = un;
+      })
+      .catch((e) => console.error("Auth bridge event subscription failed:", e));
+    return () => {
+      cancelled = true;
+      unlisten?.();
+    };
+  }, [projectId]);
+
+  const toggle = useCallback(
+    async (next: boolean) => {
+      setBusy(true);
+      setError(null);
+      // Optimistic, so the switch responds even though enabling has to await a
+      // container probe. It claims a generation like every other write, so a
+      // pushed event that lands mid-flight supersedes it rather than being
+      // undone by the settle below.
+      const mine = ++generation.current;
+      setStatus((s) => (s ? { ...s, enabled: next } : s));
+      try {
+        const settled = await setAuthBridgeEnabled(projectId, next);
+        // Stale by the time it arrived: the poller has already told us
+        // something newer, and `settled` predates it.
+        if (generation.current !== mine) return;
+        setStatus(settled);
+      } catch (e) {
+        // The error is reported either way — the command really did fail — but
+        // the rollback must not resurrect the pre-toggle value over a status
+        // the poller pushed while the command was failing.
+        setError(String(e));
+        if (generation.current !== mine) return;
+        setStatus((s) => (s ? { ...s, enabled: !next } : s));
+      } finally {
+        setBusy(false);
+      }
+    },
+    [projectId],
+  );
+
+  // Fall back to the persisted flag until the first status arrives, so the
+  // switch never renders in the wrong position.
+  const enabled = status?.enabled ?? project.auth_bridge_enabled;
+  const indicator = bridgeIndicator(status, containerRunning);
+
+  return (
+    <SwitchRow
+      label={LABEL}
+      hint={
+        <>
+          Mirrors a port a program inside the container is listening on onto the
+          host's <code>127.0.0.1</code>, so a browser OAuth callback can reach
+          the listener waiting inside the container —{" "}
+          <code>claude login</code>, <code>aws sso login</code> and{" "}
+          <code>gh auth login</code> all work this way, and without it the
+          browser calls back into nothing and the login hangs. Host-side only:
+          it never recreates the container, and it can be switched on while one
+          is running. A bridged port is unauthenticated and reachable by any
+          local process for as long as the in-container listener exists, so
+          leave it off unless you need it.
+          <span className="mt-1 flex flex-wrap items-center gap-x-2 gap-y-1">
+            <StatusIndicator tone={indicator.tone} label={indicator.label} />
+            {status?.active_ports.map((p) => (
+              <span
+                key={p.port}
+                className="font-mono text-[var(--text-secondary)]"
+                title={p.ipv6_warning ?? `Bound on host 127.0.0.1:${p.port}`}
+              >
+                127.0.0.1:{p.port}
+                {p.ipv6_warning ? " (IPv4 only)" : ""}
+              </span>
+            ))}
+          </span>
+          {status?.conflicts.map((c) => (
+            <span
+              key={c.port}
+              className="mt-1 block text-[var(--error)]"
+              role="status"
+            >
+              Port {c.port}: {c.reason}
+            </span>
+          ))}
+          {status?.active_ports
+            .filter((p) => p.ipv6_warning)
+            .map((p) => (
+              <span key={p.port} className="mt-1 block text-[var(--warning)]">
+                Port {p.port}: {p.ipv6_warning}
+              </span>
+            ))}
+          {error && (
+            <span className="mt-1 block text-[var(--error)]">{error}</span>
+          )}
+        </>
+      }
+      control={
+        <Toggle
+          label={LABEL}
+          checked={enabled}
+          // Never gated on the container being stopped — see the note above.
+          disabled={busy}
+          onChange={toggle}
+        />
+      }
+    />
+  );
+}
diff --git a/app/src/components/projects/home/config/ModelSection.tsx b/app/src/components/projects/home/config/ModelSection.tsx
index 267e12e..e43e6a1 100644
--- a/app/src/components/projects/home/config/ModelSection.tsx
+++ b/app/src/components/projects/home/config/ModelSection.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useState } from "react";
+import { useSecretField, withoutUntouchedSecrets } from "../../../../hooks/useSecretField";
 import type {
   Backend,
   BedrockAuthMethod,
@@ -16,6 +17,17 @@ import Field, {
 } from "../../../ui/Field";
 import Toggle from "../../../ui/Toggle";
 
+/** Bedrock fields held in the OS keychain, never serialized back to us. */
+const BEDROCK_SECRET_KEYS = [
+  "aws_access_key_id",
+  "aws_secret_access_key",
+  "aws_session_token",
+  "aws_bearer_token",
+] as const;
+
+/** The same, for the OpenAI-compatible backend. */
+const OPENAI_SECRET_KEYS = ["api_key"] as const;
+
 export const DEFAULT_BEDROCK_CONFIG: BedrockConfig = {
   auth_method: "static_credentials",
   aws_region: "us-east-1",
@@ -65,11 +77,12 @@ export default function ModelSection({ project, save, disabled }: Props) {
 
   // Local text state — saved on blur, not on every keystroke.
   const [bedrockRegion, setBedrockRegion] = useState(bedrock.aws_region);
-  const [accessKeyId, setAccessKeyId] = useState(bedrock.aws_access_key_id ?? "");
-  const [secretKey, setSecretKey] = useState(bedrock.aws_secret_access_key ?? "");
-  const [sessionToken, setSessionToken] = useState(bedrock.aws_session_token ?? "");
+  // Secrets are never seeded from `project` — see `useSecretField`.
+  const accessKeyId = useSecretField(project.id);
+  const secretKey = useSecretField(project.id);
+  const sessionToken = useSecretField(project.id);
   const [profile, setProfile] = useState(bedrock.aws_profile ?? "");
-  const [bearerToken, setBearerToken] = useState(bedrock.aws_bearer_token ?? "");
+  const bearerToken = useSecretField(project.id);
   const [bedrockModelId, setBedrockModelId] = useState(bedrock.model_id ?? "");
   const [serviceTier, setServiceTier] = useState(bedrock.service_tier ?? "");
 
@@ -97,9 +110,7 @@ export default function ModelSection({ project, save, disabled }: Props) {
     project.openai_compatible_config?.base_url ??
       DEFAULT_OPENAI_COMPATIBLE_CONFIG.base_url,
   );
-  const [oaiApiKey, setOaiApiKey] = useState(
-    project.openai_compatible_config?.api_key ?? "",
-  );
+  const oaiApiKey = useSecretField(project.id);
   const [oaiModelId, setOaiModelId] = useState(
     project.openai_compatible_config?.model_id ?? "",
   );
@@ -107,14 +118,13 @@ export default function ModelSection({ project, save, disabled }: Props) {
     project.openai_compatible_config?.haiku_model_id ?? "",
   );
 
+  // Secret fields are deliberately absent here: `useSecretField` owns its own
+  // reset, and re-seeding one from `project` would write an empty string over
+  // whatever the user had half-typed on any unrelated project update.
   useEffect(() => {
     const bc = project.bedrock_config ?? DEFAULT_BEDROCK_CONFIG;
     setBedrockRegion(bc.aws_region);
-    setAccessKeyId(bc.aws_access_key_id ?? "");
-    setSecretKey(bc.aws_secret_access_key ?? "");
-    setSessionToken(bc.aws_session_token ?? "");
     setProfile(bc.aws_profile ?? "");
-    setBearerToken(bc.aws_bearer_token ?? "");
     setBedrockModelId(bc.model_id ?? "");
     setServiceTier(bc.service_tier ?? "");
     setOllamaBaseUrl(project.ollama_config?.base_url ?? DEFAULT_OLLAMA_CONFIG.base_url);
@@ -129,13 +139,18 @@ export default function ModelSection({ project, save, disabled }: Props) {
       project.openai_compatible_config?.base_url ??
         DEFAULT_OPENAI_COMPATIBLE_CONFIG.base_url,
     );
-    setOaiApiKey(project.openai_compatible_config?.api_key ?? "");
     setOaiModelId(project.openai_compatible_config?.model_id ?? "");
     setOaiHaikuModelId(project.openai_compatible_config?.haiku_model_id ?? "");
   }, [project]);
 
   const saveBedrock = (patch: Partial<BedrockConfig>) =>
-    save({ bedrock_config: { ...bedrock, ...patch } });
+    save({
+      bedrock_config: withoutUntouchedSecrets(
+        { ...bedrock, ...patch },
+        patch,
+        BEDROCK_SECRET_KEYS,
+      ),
+    });
 
   const saveOllama = (patch: Partial<OllamaConfig>) =>
     save({
@@ -152,10 +167,14 @@ export default function ModelSection({ project, save, disabled }: Props) {
 
   const saveOpenAi = (patch: Partial<OpenAiCompatibleConfig>) =>
     save({
-      openai_compatible_config: {
-        ...(project.openai_compatible_config ?? DEFAULT_OPENAI_COMPATIBLE_CONFIG),
-        ...patch,
-      },
+      openai_compatible_config: withoutUntouchedSecrets(
+        {
+          ...(project.openai_compatible_config ?? DEFAULT_OPENAI_COMPATIBLE_CONFIG),
+          ...patch,
+        },
+        patch,
+        OPENAI_SECRET_KEYS,
+      ),
     });
 
   // Defaults to on: projects created before the field existed, and any data
@@ -261,9 +280,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
                 {(id) => (
                   <input
                     id={id}
-                    value={accessKeyId}
-                    onChange={(e) => setAccessKeyId(e.target.value)}
-                    onBlur={() => saveBedrock({ aws_access_key_id: accessKeyId || null })}
+                    value={accessKeyId.value}
+                    onChange={(e) => accessKeyId.setValue(e.target.value)}
+                    onBlur={() => saveBedrock(accessKeyId.patch("aws_access_key_id"))}
                     placeholder="AKIA…"
                     disabled={disabled}
                     className={monoInputClass}
@@ -278,10 +297,10 @@ export default function ModelSection({ project, save, disabled }: Props) {
                   <input
                     id={id}
                     type="password"
-                    value={secretKey}
-                    onChange={(e) => setSecretKey(e.target.value)}
+                    value={secretKey.value}
+                    onChange={(e) => secretKey.setValue(e.target.value)}
                     onBlur={() =>
-                      saveBedrock({ aws_secret_access_key: secretKey || null })
+                      saveBedrock(secretKey.patch("aws_secret_access_key"))
                     }
                     disabled={disabled}
                     className={monoInputClass}
@@ -296,10 +315,10 @@ export default function ModelSection({ project, save, disabled }: Props) {
                   <input
                     id={id}
                     type="password"
-                    value={sessionToken}
-                    onChange={(e) => setSessionToken(e.target.value)}
+                    value={sessionToken.value}
+                    onChange={(e) => sessionToken.setValue(e.target.value)}
                     onBlur={() =>
-                      saveBedrock({ aws_session_token: sessionToken || null })
+                      saveBedrock(sessionToken.patch("aws_session_token"))
                     }
                     disabled={disabled}
                     className={monoInputClass}
@@ -337,9 +356,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
                 <input
                   id={id}
                   type="password"
-                  value={bearerToken}
-                  onChange={(e) => setBearerToken(e.target.value)}
-                  onBlur={() => saveBedrock({ aws_bearer_token: bearerToken || null })}
+                  value={bearerToken.value}
+                  onChange={(e) => bearerToken.setValue(e.target.value)}
+                  onBlur={() => saveBedrock(bearerToken.patch("aws_bearer_token"))}
                   disabled={disabled}
                   className={monoInputClass}
                 />
@@ -507,9 +526,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
               <input
                 id={id}
                 type="password"
-                value={oaiApiKey}
-                onChange={(e) => setOaiApiKey(e.target.value)}
-                onBlur={() => saveOpenAi({ api_key: oaiApiKey || null })}
+                value={oaiApiKey.value}
+                onChange={(e) => oaiApiKey.setValue(e.target.value)}
+                onBlur={() => saveOpenAi(oaiApiKey.patch("api_key"))}
                 placeholder="sk-…"
                 disabled={disabled}
                 className={monoInputClass}
diff --git a/app/src/components/projects/home/config/RuntimeSection.test.tsx b/app/src/components/projects/home/config/RuntimeSection.test.tsx
index 8d3ab45..4733c09 100644
--- a/app/src/components/projects/home/config/RuntimeSection.test.tsx
+++ b/app/src/components/projects/home/config/RuntimeSection.test.tsx
@@ -1,7 +1,21 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, fireEvent } from "@testing-library/react";
+import { render, screen, fireEvent, waitFor } from "@testing-library/react";
 import RuntimeSection from "./RuntimeSection";
-import type { Project } from "../../../../lib/types";
+import type { AuthBridgeStatus, Project } from "../../../../lib/types";
+
+// The auth-bridge row owns its own IPC — see `AuthBridgeRow.tsx` for why it
+// does not go through `save`.
+const OFF_BRIDGE: AuthBridgeStatus = { enabled: false, active_ports: [], conflicts: [] };
+const setAuthBridgeEnabled = vi.fn(async () => ({ ...OFF_BRIDGE, enabled: true }));
+
+vi.mock("../../../../lib/tauri-commands", () => ({
+  getAuthBridgeStatus: vi.fn(async () => OFF_BRIDGE),
+  setAuthBridgeEnabled: (id: string, on: boolean) => setAuthBridgeEnabled(id, on),
+}));
+
+vi.mock("@tauri-apps/api/event", () => ({
+  listen: vi.fn(async () => () => {}),
+}));
 
 const baseProject: Project = {
   id: "p1",
@@ -92,3 +106,76 @@ describe("RuntimeSection — VPN support toggle", () => {
     ).toBeInTheDocument();
   });
 });
+
+/**
+ * `scope="project"` on the settings editor is one prop with no visible owner,
+ * and deleting it fails silently in the worst possible direction: the editor
+ * falls back to `"global"`, every three-state control collapses to an on/off
+ * switch, and a field the project is *inheriting* as on renders flat Off. The
+ * user then reads a lie and, worse, flipping that switch writes a deliberate
+ * `false` that overrides the global On they thought they were looking at.
+ *
+ * Nothing asserted the prop was passed, so these go through what is rendered
+ * rather than through props — a switch where a select belongs is exactly the
+ * regression, and it is visible from the outside.
+ */
+describe("RuntimeSection — Claude Code settings are edited at project scope", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("gives every setting the third Global state a project can inherit through", () => {
+    renderSection();
+    const focus = screen.getByLabelText("Focus mode") as HTMLSelectElement;
+    expect(
+      Array.from(focus.querySelectorAll("option")).map((o) => o.getAttribute("value")),
+    ).toEqual(["global", "off", "on"]);
+  });
+
+  it("renders an untouched setting as inheriting, not as Off", () => {
+    // `claude_code_settings: null` means "this project has no opinion", which
+    // is not the same instruction as off. At global scope the same field is a
+    // plain unchecked switch — indistinguishable from a user who turned it
+    // off, and the reason the missing prop would never be noticed.
+    renderSection({ claude_code_settings: null });
+    expect((screen.getByLabelText("Focus mode") as HTMLSelectElement).value).toBe(
+      "global",
+    );
+    expect(screen.queryByRole("switch", { name: "Focus mode" })).not.toBeInTheDocument();
+  });
+
+  it("keeps a stored project override visible over the inherited value", () => {
+    renderSection({
+      claude_code_settings: {
+        tui_mode: null,
+        effort: null,
+        auto_scroll_disabled: null,
+        focus_mode: true,
+        show_thinking_summaries: null,
+        session_recap_disabled: null,
+        env_scrub: null,
+        prompt_caching_1h: null,
+      },
+    });
+    expect((screen.getByLabelText("Focus mode") as HTMLSelectElement).value).toBe("on");
+  });
+});
+
+describe("RuntimeSection — auth bridge toggle", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("is reachable while the container is running", async () => {
+    // The rest of the tab is gated on a stopped container because those
+    // settings are baked in at creation. This one is host-side and has its own
+    // command, and the moment a user needs it is the moment a login is hanging
+    // in a *running* container — so the tab's `disabled` must not reach it.
+    renderSection({ status: "running" }, true);
+
+    const toggle = screen.getByRole("switch", { name: "Auth bridge" });
+    await waitFor(() => expect(toggle).not.toBeDisabled());
+
+    fireEvent.click(toggle);
+    await waitFor(() => expect(setAuthBridgeEnabled).toHaveBeenCalledWith("p1", true));
+    // And never through the generic project save, which would drop it on the
+    // floor while the container runs.
+    expect(save).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/src/components/projects/home/config/RuntimeSection.tsx b/app/src/components/projects/home/config/RuntimeSection.tsx
index f971c56..7fe7a2e 100644
--- a/app/src/components/projects/home/config/RuntimeSection.tsx
+++ b/app/src/components/projects/home/config/RuntimeSection.tsx
@@ -4,6 +4,7 @@ import { ConfigGroup, SwitchRow } from "../../../ui/Field";
 import PermissionModeControl, { permissionModePatch } from "../../PermissionModeControl";
 import ClaudeInstructionsEditor from "../../ClaudeInstructionsEditor";
 import ClaudeCodeSettingsEditor from "../../ClaudeCodeSettingsEditor";
+import AuthBridgeRow from "./AuthBridgeRow";
 
 interface Props {
   project: Project;
@@ -70,6 +71,12 @@ export default function RuntimeSection({
           }
         />
 
+        {/* Not gated on `disabled`: the bridge is host-side and has its own
+            command, so it can be switched on while a login is hanging — which
+            is the only moment anyone reaches for it. It owns its state rather
+            than going through `save`. */}
+        <AuthBridgeRow project={project} />
+
         <SwitchRow
           label="Mission Control"
           hint="A web dashboard for monitoring and managing Claude sessions remotely."
@@ -102,9 +109,19 @@ export default function RuntimeSection({
 
       <ConfigGroup
         title="Claude Code settings"
-        description="Per-project CLI behaviour. These override the global defaults in Settings."
+        description={
+          "Per-project CLI behaviour. Anything left on Global follows Settings; " +
+          "Off overrides a global On. Changing any of these recreates the container, " +
+          "which commits a new image layer — so flipping switches repeatedly costs disk. " +
+          "Turning TUI mode, Effort level, Focus mode or Session recap back to Global " +
+          "also needs the base image updated first: those four are cleared by removing a " +
+          "key, and an older image's startup script ignores the instruction to remove it. " +
+          "Update the base image from Overview. TUI mode, Effort level and Focus mode " +
+          "visibly refuse to switch off until you do; Session recap just stays off silently."
+        }
       >
         <ClaudeCodeSettingsEditor
+          scope="project"
           settings={project.claude_code_settings}
           disabled={disabled}
           disabledReason={disabledReason}
diff --git a/app/src/components/projects/home/config/WorkspaceSection.test.tsx b/app/src/components/projects/home/config/WorkspaceSection.test.tsx
new file mode 100644
index 0000000..a44970b
--- /dev/null
+++ b/app/src/components/projects/home/config/WorkspaceSection.test.tsx
@@ -0,0 +1,177 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, fireEvent, act } from "@testing-library/react";
+import WorkspaceSection from "./WorkspaceSection";
+import type { Project } from "../../../../lib/types";
+
+// The Browse button is the OS folder picker.
+const open = vi.fn();
+vi.mock("@tauri-apps/plugin-dialog", () => ({
+  open: (...args: unknown[]) => open(...args),
+}));
+
+const baseProject: Project = {
+  id: "p1",
+  name: "api-server",
+  paths: [{ host_path: "/src/api", mount_name: "api" }],
+  container_id: null,
+  status: "stopped",
+  backend: "anthropic",
+  bedrock_config: null,
+  ollama_config: null,
+  llamacpp_config: null,
+  openai_compatible_config: null,
+  allow_docker_access: false,
+  sandbox_mode_enabled: true,
+  mission_control_enabled: false,
+  auth_bridge_enabled: false,
+  browser_view_enabled: false,
+  vpn_support_enabled: false,
+  use_shared_auth_token: true,
+  full_permissions: false,
+  permission_mode: null,
+  ssh_key_path: null,
+  ca_cert_path: null,
+  git_token: null,
+  git_user_name: null,
+  git_user_email: null,
+  custom_env_vars: [],
+  port_mappings: [],
+  claude_instructions: null,
+  claude_code_settings: null,
+  renamed_session_names: {},
+  created_at: "2026-01-01T00:00:00Z",
+  updated_at: "2026-01-01T00:00:00Z",
+};
+
+const save = vi.fn().mockResolvedValue(true);
+
+function renderSection(over: Partial<Project> = {}, disabled = false) {
+  return render(
+    <WorkspaceSection
+      project={{ ...baseProject, ...over }}
+      save={save}
+      disabled={disabled}
+    />,
+  );
+}
+
+/** Every folder list this component has sent to `update_project`. */
+function savedLists() {
+  return save.mock.calls
+    .filter(([patch]) => "paths" in patch)
+    .map(([patch]) => patch.paths);
+}
+
+describe("WorkspaceSection — the blank row is never stored", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  /**
+   * The bug this file exists for. `create_container` mounts every stored row
+   * unfiltered, so a persisted `{host_path: "", mount_name: ""}` becomes
+   * `{"Target": "/workspace/", "Source": ""}` and the daemon refuses the whole
+   * container with `field Source must not be empty` — the project can never be
+   * started or recreated again. Click "+ Add folder", blur a field, and it is
+   * bricked.
+   */
+  it("drops the placeholder row when a real edit is saved", () => {
+    renderSection();
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+
+    const hostPath = screen.getByLabelText("Folder 1 host path");
+    fireEvent.change(hostPath, { target: { value: "/src/api-v2" } });
+    fireEvent.blur(hostPath);
+
+    expect(save).toHaveBeenCalledTimes(1);
+    expect(savedLists()[0]).toEqual([{ host_path: "/src/api-v2", mount_name: "api" }]);
+  });
+
+  it("drops it when Browse fills a different row in", async () => {
+    open.mockResolvedValueOnce("/src/api-v2");
+    renderSection();
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+
+    // The picker is awaited inside the handler, so the state update that
+    // follows it lands outside the click.
+    await act(async () => {
+      fireEvent.click(screen.getAllByRole("button", { name: "Browse" })[0]);
+    });
+
+    expect(savedLists()[0]).toEqual([{ host_path: "/src/api-v2", mount_name: "api" }]);
+  });
+
+  it("drops it when a row is removed", () => {
+    renderSection({
+      paths: [
+        { host_path: "/src/api", mount_name: "api" },
+        { host_path: "/src/web", mount_name: "web" },
+      ],
+    });
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+    fireEvent.click(screen.getByRole("button", { name: "Remove folder 2" }));
+
+    expect(savedLists()[0]).toEqual([{ host_path: "/src/api", mount_name: "api" }]);
+  });
+
+  it("never sends a row with an empty host path, whatever the route", () => {
+    renderSection();
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+    const hostPath = screen.getByLabelText("Folder 1 host path");
+    fireEvent.change(hostPath, { target: { value: "/src/api-v2" } });
+    fireEvent.blur(hostPath);
+
+    for (const list of savedLists()) {
+      for (const row of list) {
+        expect(row.host_path).not.toBe("");
+        expect(row.mount_name).not.toBe("");
+      }
+    }
+  });
+});
+
+describe("WorkspaceSection — what a blur is allowed to save", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  /**
+   * Both inputs save on blur, so tabbing from the host path to the mount name
+   * fires a save with the name still empty — which `update_project` refuses,
+   * turning an ordinary keystroke into an error toast.
+   */
+  it("holds a half-filled row back until it is complete", () => {
+    renderSection();
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+
+    const newHostPath = screen.getByLabelText("Folder 2 host path");
+    fireEvent.change(newHostPath, { target: { value: "/src/web" } });
+    fireEvent.blur(newHostPath);
+    expect(save).not.toHaveBeenCalled();
+
+    const newMountName = screen.getByLabelText("Folder 2 mount name");
+    fireEvent.change(newMountName, { target: { value: "web" } });
+    fireEvent.blur(newMountName);
+    expect(savedLists()[0]).toEqual([
+      { host_path: "/src/api", mount_name: "api" },
+      { host_path: "/src/web", mount_name: "web" },
+    ]);
+  });
+
+  /**
+   * Blurring out of an untouched field is not an edit. Saving anyway would
+   * round-trip the filtered list through `project` and take the empty row away
+   * while the user was still filling it in.
+   */
+  it("saves nothing when the blur changed nothing", () => {
+    renderSection();
+    fireEvent.click(screen.getByRole("button", { name: "+ Add folder" }));
+    fireEvent.blur(screen.getByLabelText("Folder 1 mount name"));
+    expect(save).not.toHaveBeenCalled();
+    expect(screen.getByLabelText("Folder 2 host path")).toBeTruthy();
+  });
+
+  it("still saves a rename, which does not go through the folder list", () => {
+    renderSection();
+    const name = screen.getByDisplayValue("api-server");
+    fireEvent.change(name, { target: { value: "api-v2" } });
+    fireEvent.blur(name);
+    expect(save).toHaveBeenCalledWith({ name: "api-v2" });
+  });
+});
diff --git a/app/src/components/projects/home/config/WorkspaceSection.tsx b/app/src/components/projects/home/config/WorkspaceSection.tsx
index 4c37819..cc6790c 100644
--- a/app/src/components/projects/home/config/WorkspaceSection.tsx
+++ b/app/src/components/projects/home/config/WorkspaceSection.tsx
@@ -10,6 +10,14 @@ interface Props {
   disabled: boolean;
 }
 
+/** Whether two folder lists are the same rows in the same order. */
+function sameRows(a: ProjectPath[], b: ProjectPath[]): boolean {
+  return (
+    a.length === b.length &&
+    a.every((row, i) => row.host_path === b[i].host_path && row.mount_name === b[i].mount_name)
+  );
+}
+
 export default function WorkspaceSection({ project, save, disabled }: Props) {
   const [name, setName] = useState(project.name);
   const [paths, setPaths] = useState<ProjectPath[]>(project.paths ?? []);
@@ -19,6 +27,49 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
     setPaths(project.paths ?? []);
   }, [project]);
 
+  /**
+   * Persist a folder list, minus the rows that are only in it because the UI
+   * put them there.
+   *
+   * **The blank row must never reach the store.** "+ Add folder" inserts
+   * `{host_path: "", mount_name: ""}` deliberately, and `create_container`
+   * mounts every stored row unfiltered — a stored blank one becomes
+   * `{"Target": "/workspace/", "Source": ""}`, which the daemon rejects with
+   * `field Source must not be empty`. The project then cannot be started or
+   * recreated at all, from a click and a blur. `AddProjectDialog` has always
+   * filtered this; this section computed the filtered list and then saved the
+   * unfiltered one.
+   *
+   * Every save goes through here for that reason — Browse and Remove write the
+   * list too, and either can be holding a blank row from an earlier click.
+   */
+  const persist = (rows: ProjectPath[]) => {
+    const filled = rows.filter((p) => p.host_path.trim() || p.mount_name.trim());
+    return save({ paths: filled });
+  };
+
+  /**
+   * Save only when every row is fully filled in.
+   *
+   * Both inputs save on blur, so tabbing from the host path to the mount name
+   * fires a save with the name still empty. `update_project` now validates —
+   * a half-filled row is refused — so the unconditional save turned an ordinary
+   * keystroke into an error toast. A blank row is *not* incomplete: the
+   * "+ Add folder" button adds one deliberately, and it is dropped on save.
+   *
+   * A blur that changed nothing saves nothing, which is what keeps the blank
+   * row on screen while it is being filled in: persisting the filtered list
+   * would round-trip through `project` and take the empty row away under the
+   * cursor.
+   */
+  const saveIfComplete = () => {
+    const filled = paths.filter((p) => p.host_path.trim() || p.mount_name.trim());
+    const halfFilled = filled.some((p) => !p.host_path.trim() || !p.mount_name.trim());
+    if (halfFilled) return;
+    if (sameRows(filled, project.paths ?? [])) return;
+    return persist(paths);
+  };
+
   return (
     <ConfigGroup
       title="Workspace"
@@ -70,7 +121,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                   updated[i] = { ...updated[i], host_path: e.target.value };
                   setPaths(updated);
                 }}
-                onBlur={() => save({ paths })}
+                onBlur={() => saveIfComplete()}
                 placeholder="/path/to/folder"
                 disabled={disabled}
                 className={`flex-1 min-w-0 ${inputClass}`}
@@ -90,7 +141,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                         mount_name: updated[i].mount_name || basename,
                       };
                       setPaths(updated);
-                      save({ paths: updated });
+                      persist(updated);
                     }
                   }}
                 >
@@ -107,7 +158,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                     updated[i] = { ...updated[i], mount_name: e.target.value };
                     setPaths(updated);
                   }}
-                  onBlur={() => save({ paths })}
+                  onBlur={() => saveIfComplete()}
                   placeholder="name"
                   disabled={disabled}
                   className={`w-40 ${monoInputClass}`}
@@ -121,7 +172,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                     onClick={() => {
                       const updated = paths.filter((_, j) => j !== i);
                       setPaths(updated);
-                      save({ paths: updated });
+                      persist(updated);
                     }}
                   >
                     Remove
diff --git a/app/src/components/projects/home/filePreview.test.ts b/app/src/components/projects/home/filePreview.test.ts
new file mode 100644
index 0000000..3dbf0c8
--- /dev/null
+++ b/app/src/components/projects/home/filePreview.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect } from "vitest";
+import {
+  IMAGE_PREVIEW_LIMIT,
+  TEXT_PREVIEW_LIMIT,
+  decodeBase64,
+  extensionOf,
+  imageMimeFor,
+  looksBinary,
+  previewKind,
+  previewLimit,
+} from "./filePreview";
+
+describe("extensionOf", () => {
+  it("lowercases, and takes only the last segment", () => {
+    expect(extensionOf("Photo.PNG")).toBe("png");
+    expect(extensionOf("archive.tar.gz")).toBe("gz");
+    expect(extensionOf("/workspace/app/main.rs")).toBe("rs");
+  });
+
+  it("treats a leading dot as hidden, not as an extension", () => {
+    // `.gitignore` is a text file called `.gitignore`, not one of type "gitignore".
+    expect(extensionOf(".gitignore")).toBe("");
+    expect(extensionOf("Makefile")).toBe("");
+  });
+});
+
+describe("previewKind", () => {
+  it("recognises images by extension, with a MIME the Blob can use", () => {
+    expect(previewKind("logo.png")).toBe("image");
+    expect(imageMimeFor("logo.PNG")).toBe("image/png");
+    expect(imageMimeFor("photo.jpeg")).toBe("image/jpeg");
+    expect(imageMimeFor("icon.svg")).toBe("image/svg+xml");
+    expect(imageMimeFor("notes.txt")).toBeNull();
+  });
+
+  it("recognises known text extensions and conventional extensionless names", () => {
+    expect(previewKind("main.rs")).toBe("text");
+    expect(previewKind("config.yaml")).toBe("text");
+    expect(previewKind("Dockerfile")).toBe("text");
+    expect(previewKind("README")).toBe("text");
+    expect(previewKind(".gitignore")).toBe("text");
+  });
+
+  it("leaves anything else undecided rather than refusing it outright", () => {
+    // `unknown` means "read it and sniff the bytes" — a .bak of a config file
+    // should still preview.
+    expect(previewKind("dump.bak")).toBe("unknown");
+    expect(previewKind("app.wasm")).toBe("unknown");
+  });
+});
+
+describe("previewLimit", () => {
+  it("gives images the bigger budget, since they are what blows a text cap", () => {
+    expect(previewLimit("photo.jpg")).toBe(IMAGE_PREVIEW_LIMIT);
+    expect(previewLimit("notes.md")).toBe(TEXT_PREVIEW_LIMIT);
+    expect(previewLimit("mystery.bin")).toBe(TEXT_PREVIEW_LIMIT);
+    expect(IMAGE_PREVIEW_LIMIT).toBeGreaterThan(TEXT_PREVIEW_LIMIT);
+  });
+});
+
+describe("decodeBase64 / looksBinary", () => {
+  it("round-trips bytes that are not valid UTF-8", () => {
+    // The reason the backend returns base64 at all: these bytes must survive.
+    const bytes = decodeBase64(btoa("\xff\xd8\xff\xe0"));
+    expect(Array.from(bytes)).toEqual([0xff, 0xd8, 0xff, 0xe0]);
+  });
+
+  it("calls a NUL-bearing prefix binary and plain text text", () => {
+    expect(looksBinary(new Uint8Array([0x68, 0x69, 0x0a]))).toBe(false);
+    expect(looksBinary(new Uint8Array([0x68, 0x00, 0x69]))).toBe(true);
+  });
+
+  it("only sniffs the first 8 KB, so a NUL deep in a big file is ignored", () => {
+    const bytes = new Uint8Array(20000).fill(0x61);
+    bytes[9000] = 0;
+    expect(looksBinary(bytes)).toBe(false);
+  });
+});
diff --git a/app/src/components/projects/home/filePreview.ts b/app/src/components/projects/home/filePreview.ts
new file mode 100644
index 0000000..831b8e5
--- /dev/null
+++ b/app/src/components/projects/home/filePreview.ts
@@ -0,0 +1,107 @@
+/**
+ * What the Files viewer can show, and how much of it to ask for.
+ *
+ * Pure helpers, deliberately separate from the modal: the type sniffing is
+ * where a preview quietly turns into a screenful of mojibake, and it is worth
+ * testing without a container.
+ */
+
+/**
+ * Extension → MIME, for the raster/vector types an `<img>` actually renders.
+ * The MIME matters because the bytes are handed to the DOM as a `Blob`, and a
+ * blob with the wrong (or empty) type will not decode.
+ */
+const IMAGE_MIME: Record<string, string> = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  avif: "image/avif",
+  // Safe in an `<img>`: that context cannot run the script an SVG may carry.
+  svg: "image/svg+xml",
+};
+
+/** Extensions we are confident are text, so no byte sniffing is needed. */
+const TEXT_EXTENSIONS = new Set([
+  "txt", "md", "markdown", "rst", "log", "csv", "tsv",
+  "json", "jsonc", "yaml", "yml", "toml", "ini", "cfg", "conf", "env", "properties",
+  "js", "jsx", "mjs", "cjs", "ts", "tsx", "rs", "py", "rb", "go", "java", "kt",
+  "c", "h", "cc", "cpp", "hpp", "cs", "php", "swift", "scala", "lua", "pl", "r",
+  "sh", "bash", "zsh", "fish", "ps1", "bat",
+  "html", "htm", "xml", "svelte", "vue", "css", "scss", "sass", "less",
+  "sql", "graphql", "gql", "proto", "diff", "patch", "lock", "gitignore",
+  "dockerfile", "makefile", "cmake", "gradle", "tf", "tfvars",
+]);
+
+/** Extensionless files that are text by convention. */
+const TEXT_BASENAMES = new Set([
+  "dockerfile", "makefile", "readme", "license", "licence", "changelog",
+  "authors", "notice", "copying", "procfile", "rakefile", "gemfile", "vagrantfile",
+  // Dotfiles: the leading dot is stripped before the lookup.
+  "gitignore", "gitattributes", "gitmodules", "dockerignore", "npmrc", "nvmrc",
+  "editorconfig", "bashrc", "zshrc", "profile", "env",
+]);
+
+/** 1 MiB of text is already far more than anyone reads in a modal. */
+export const TEXT_PREVIEW_LIMIT = 1024 * 1024;
+/**
+ * Images get five times the budget: they are the file kind that routinely
+ * blows past a text-sized cap, and a half-read image is not a preview at all —
+ * it either decodes whole or it does not.
+ */
+export const IMAGE_PREVIEW_LIMIT = 5 * 1024 * 1024;
+
+/** Lowercased extension, or "" for an extensionless name. */
+export function extensionOf(name: string): string {
+  const base = name.slice(name.lastIndexOf("/") + 1);
+  const dot = base.lastIndexOf(".");
+  // A leading dot is "hidden file", not "extension" (`.gitignore`).
+  if (dot <= 0) return "";
+  return base.slice(dot + 1).toLowerCase();
+}
+
+/** The MIME to build the Blob with, or null if this is not a previewable image. */
+export function imageMimeFor(name: string): string | null {
+  return IMAGE_MIME[extensionOf(name)] ?? null;
+}
+
+export type PreviewKind = "image" | "text" | "unknown";
+
+/**
+ * A first guess from the name alone. `unknown` is not a refusal — the viewer
+ * reads the bytes and falls back to sniffing them, so a `.bak` of a config
+ * file still previews.
+ */
+export function previewKind(name: string): PreviewKind {
+  if (imageMimeFor(name)) return "image";
+  const ext = extensionOf(name);
+  if (ext) return TEXT_EXTENSIONS.has(ext) ? "text" : "unknown";
+  const base = name.slice(name.lastIndexOf("/") + 1).replace(/^\./, "").toLowerCase();
+  return TEXT_BASENAMES.has(base) ? "text" : "unknown";
+}
+
+/** How many bytes to ask the backend for, given what we expect to render. */
+export function previewLimit(name: string): number {
+  return previewKind(name) === "image" ? IMAGE_PREVIEW_LIMIT : TEXT_PREVIEW_LIMIT;
+}
+
+/** Base64 → bytes. `atob` yields a binary string; widen it one char at a time. */
+export function decodeBase64(base64: string): Uint8Array<ArrayBuffer> {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+/**
+ * The classic heuristic: a NUL byte early on means this is not text. Cheap,
+ * and it is what `git` and `grep` use to decide the same question.
+ */
+export function looksBinary(bytes: Uint8Array): boolean {
+  const limit = Math.min(bytes.length, 8000);
+  for (let i = 0; i < limit; i++) if (bytes[i] === 0) return true;
+  return false;
+}
diff --git a/app/src/components/projects/home/format.ts b/app/src/components/projects/home/format.ts
index 171c8e0..2f85c06 100644
--- a/app/src/components/projects/home/format.ts
+++ b/app/src/components/projects/home/format.ts
@@ -1,10 +1,16 @@
 /** Shared formatting helpers for the Project Home views. */
 
+import { formatBytes as shared } from "../../../lib/formatBytes";
+
+/**
+ * File sizes in Project Home, ÷1024 with `KB`/`MB`/`GB` labels.
+ *
+ * Kept as a named re-export rather than deleted: three modules import it from
+ * here, and the binary/decimal-label pairing is a Project Home convention
+ * rather than the app-wide default. The implementation is `lib/formatBytes`.
+ */
 export function formatBytes(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+  return shared(bytes, { binary: true });
 }
 
 /** "2h ago" / "3d ago". Returns null for unparseable timestamps. */
diff --git a/app/src/components/projects/migrationCopy.ts b/app/src/components/projects/migrationCopy.ts
index 026d541..d5e8169 100644
--- a/app/src/components/projects/migrationCopy.ts
+++ b/app/src/components/projects/migrationCopy.ts
@@ -7,6 +7,7 @@
  */
 
 import type { PackageFailure } from "../../lib/types";
+import { formatBytes } from "../../lib/formatBytes";
 
 /**
  * What re-attaches untouched. These are not copied, rebuilt or re-authenticated
@@ -62,14 +63,7 @@ export const REPLAY_COST =
 
 /** `41.0 MB`. Sizes here are informational, so the friendlier decimal unit. */
 export function formatDataSize(bytes: number): string {
-  const units = ["B", "KB", "MB", "GB", "TB"];
-  let value = bytes;
-  let unit = 0;
-  while (value >= 1000 && unit < units.length - 1) {
-    value /= 1000;
-    unit += 1;
-  }
-  return unit === 0 ? `${bytes} B` : `${value.toFixed(1)} ${units[unit]}`;
+  return formatBytes(bytes);
 }
 
 /** `1 Mar` — short enough to sit inline in the banner sentence. */
diff --git a/app/src/components/settings/SharedAuthSettings.test.tsx b/app/src/components/settings/SharedAuthSettings.test.tsx
index b7a0ff0..d221894 100644
--- a/app/src/components/settings/SharedAuthSettings.test.tsx
+++ b/app/src/components/settings/SharedAuthSettings.test.tsx
@@ -6,14 +6,38 @@ import type { ClearTokenOutcome, Project } from "../../lib/types";
 
 const hasClaudeToken = vi.fn();
 const clearClaudeToken = vi.fn();
+const sweepClaudeTokenSnapshots = vi.fn();
 
 vi.mock("../../lib/tauri-commands", () => ({
   hasClaudeToken: () => hasClaudeToken(),
   clearClaudeToken: () => clearClaudeToken(),
+  sweepClaudeTokenSnapshots: () => sweepClaudeTokenSnapshots(),
   acquireClaudeToken: vi.fn(),
   submitClaudeTokenCode: vi.fn(),
 }));
 
+// Stood in for so a sign-in can be *completed* in a test. The panel's reaction
+// to `onAuthenticated` is the subject of the H1 sequence below, and driving the
+// real acquisition dialog to get there would test the dialog instead.
+vi.mock("./ClaudeAuthModal", () => ({
+  default: ({
+    onAuthenticated,
+    onClose,
+  }: {
+    onAuthenticated: () => void;
+    onClose: () => void;
+  }) => (
+    <button
+      onClick={() => {
+        onAuthenticated();
+        onClose();
+      }}
+    >
+      finish sign-in
+    </button>
+  ),
+}));
+
 vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => vi.fn()) }));
 vi.mock("@tauri-apps/plugin-opener", () => ({ openUrl: vi.fn() }));
 
@@ -59,11 +83,22 @@ const running = (over: Partial<Project> = {}): Project => ({
   ...over,
 });
 
+/** A `ClearTokenOutcome` with nothing left behind, plus any overrides. */
+const outcome = (over: Partial<ClearTokenOutcome> = {}): ClearTokenOutcome => ({
+  snapshots_scrubbed: [],
+  snapshots_failed: [],
+  snapshots_skipped: [],
+  snapshots_superseded: [],
+  docker_unavailable: null,
+  ...over,
+});
+
 describe("SharedAuthSettings", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     projects = [];
     hasClaudeToken.mockResolvedValue(false);
+    sweepClaudeTokenSnapshots.mockResolvedValue(outcome());
     useAppState.setState({ toasts: [] });
   });
 
@@ -189,4 +224,219 @@ describe("SharedAuthSettings", () => {
     expect(toast.kind).toBe("success");
     expect(toast.message).toBe("Shared Claude token removed from the keychain.");
   });
+
+  // ── A skipped scrub is not a success, and must stay retryable ────────────
+  // `scrub_secrets_from_snapshots` refuses a project another operation holds
+  // rather than racing its `:latest` tag. That leaves a live ~1-year token in
+  // the image, so it can be neither folded into the success message nor
+  // described as a permanent failure whose remedy is Reset.
+
+  it("reports a skipped snapshot as an incomplete revocation, not a success", async () => {
+    const toast = await revoke({
+      snapshots_skipped: [
+        "triple-c-snapshot-p1:latest: This project's container is being started or recreated. Wait for it to finish before removing a credential from its snapshot.",
+      ],
+    });
+    expect(toast.kind).toBe("error");
+    expect(toast.message).toMatch(/still in 1 snapshot image/i);
+    expect(toast.detail).toMatch(/run the\s+cleanup again/i);
+    // The wrong advice for a transient refusal.
+    expect(toast.detail).not.toMatch(/Reset/i);
+  });
+
+  it("keeps a retry available after the revoke has cleared the keychain", async () => {
+    projects = [running()];
+    // Stored when the panel mounts, gone after the revoke — which is exactly
+    // the state that used to remove the only button able to finish the job.
+    hasClaudeToken.mockResolvedValueOnce(true).mockResolvedValue(false);
+    clearClaudeToken.mockResolvedValue({
+      snapshots_scrubbed: [],
+      snapshots_failed: [],
+      snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"],
+      snapshots_superseded: [],
+      docker_unavailable: null,
+    });
+    render(<SharedAuthSettings />);
+
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
+
+    const retry = await screen.findByTestId("shared-auth-retry");
+    await waitFor(() =>
+      expect(screen.queryByRole("button", { name: "Revoke" })).not.toBeInTheDocument(),
+    );
+    expect(screen.getByTestId("shared-auth-leftover")).toHaveTextContent(
+      /still readable/i,
+    );
+    expect(retry).toBeEnabled();
+  });
+
+  it("clears the warning when a retry finally finishes the job", async () => {
+    projects = [running()];
+    hasClaudeToken.mockResolvedValueOnce(true).mockResolvedValue(false);
+    clearClaudeToken.mockResolvedValueOnce({
+      snapshots_scrubbed: [],
+      snapshots_failed: [],
+      snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"],
+      snapshots_superseded: [],
+      docker_unavailable: null,
+    });
+    render(<SharedAuthSettings />);
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
+    const retry = await screen.findByTestId("shared-auth-retry");
+
+    sweepClaudeTokenSnapshots.mockResolvedValueOnce(
+      outcome({ snapshots_scrubbed: ["triple-c-snapshot-p1:latest"] }),
+    );
+    fireEvent.click(retry);
+
+    await waitFor(() =>
+      expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument(),
+    );
+    // One revoke, one sweep — the retry must not be a second revoke.
+    expect(clearClaudeToken).toHaveBeenCalledTimes(1);
+    expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1);
+    const toast = useAppState.getState().toasts.at(-1)!;
+    expect(toast.kind).toBe("success");
+    expect(toast.message).toMatch(/cleared from 1 snapshot image/i);
+  });
+
+  it("offers a snapshot sweep even when no token is stored", async () => {
+    // Snapshots committed by an older build carry the token whether or not
+    // anything is in the keychain today, so the sweep cannot be gated on it.
+    projects = [running()];
+    hasClaudeToken.mockResolvedValue(false);
+    render(<SharedAuthSettings />);
+
+    const sweep = await screen.findByTestId("shared-auth-sweep");
+    expect(screen.queryByRole("button", { name: "Revoke" })).not.toBeInTheDocument();
+    fireEvent.click(sweep);
+
+    await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
+    expect(clearClaudeToken).not.toHaveBeenCalled();
+    const toast = useAppState.getState().toasts.at(-1)!;
+    expect(toast.kind).toBe("success");
+    expect(toast.message).toBe("No snapshot image is holding the token.");
+  });
+
+  it("tolerates a backend that does not report skipped snapshots", async () => {
+    // `snapshots_skipped` is newer than the rest of the payload; its absence
+    // must read as "none", never as undefined reaching the UI.
+    const toast = await revoke({ snapshots_scrubbed: ["triple-c-snapshot-p1:latest"] });
+    expect(toast.kind).toBe("success");
+    expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
+  });
+
+  // ── The retry must not be a revoke in disguise ───────────────────────────
+  // The sequence that shipped green: revoke, get a skipped image, re-authenticate
+  // from the button directly above the warning, then press the retry the warning
+  // is still offering. One command was behind both, so that press deleted the
+  // token acquired seconds earlier — no confirmation, and a toast that mentioned
+  // only images. The deliberate Revoke needs a modal; this needed nothing.
+
+  it("does not leave a stale cleanup panel over a freshly acquired token", async () => {
+    projects = [running()];
+    // Stored when the panel mounts, gone after the revoke, stored again once
+    // the sign-in finishes.
+    hasClaudeToken
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false)
+      .mockResolvedValue(true);
+    clearClaudeToken.mockResolvedValue(
+      outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
+    );
+    render(<SharedAuthSettings />);
+
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
+    await screen.findByTestId("shared-auth-leftover");
+
+    // Re-authenticate from the button above the warning.
+    fireEvent.click(await screen.findByRole("button", { name: "Authenticate" }));
+    fireEvent.click(await screen.findByRole("button", { name: "finish sign-in" }));
+
+    await screen.findByRole("button", { name: "Revoke" });
+    expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("shared-auth-retry")).not.toBeInTheDocument();
+
+    // The images can still be cleaned up — and doing so does not spend the new
+    // token.
+    fireEvent.click(screen.getByTestId("shared-auth-sweep"));
+    await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
+    expect(clearClaudeToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("sends the retry to the sweep-only command, never to the revoke", async () => {
+    projects = [running()];
+    hasClaudeToken.mockResolvedValueOnce(true).mockResolvedValue(false);
+    clearClaudeToken.mockResolvedValue(
+      outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
+    );
+    sweepClaudeTokenSnapshots.mockResolvedValue(
+      outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
+    );
+    render(<SharedAuthSettings />);
+
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
+    const retry = await screen.findByTestId("shared-auth-retry");
+
+    fireEvent.click(retry);
+    await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1));
+    fireEvent.click(await screen.findByTestId("shared-auth-retry"));
+    await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(2));
+
+    // However many times it is pressed, the keychain is touched exactly once —
+    // by the revoke the user confirmed.
+    expect(clearClaudeToken).toHaveBeenCalledTimes(1);
+    // …and a retry that still finds a busy project says so without ever
+    // claiming a token was removed.
+    const toast = useAppState.getState().toasts.at(-1)!;
+    expect(toast.message).not.toMatch(/keychain/i);
+  });
+
+  it("will not start a sign-in while a cleanup is still running", async () => {
+    // A sweep is a per-image inspect/create/commit/rmi over the Docker socket
+    // and runs for minutes. Acquiring a token inside that window races the
+    // rewrite that is meant to be removing one.
+    projects = [running()];
+    hasClaudeToken.mockResolvedValue(false);
+    sweepClaudeTokenSnapshots.mockReturnValue(new Promise(() => {}));
+    render(<SharedAuthSettings />);
+
+    const authenticate = await screen.findByRole("button", { name: "Authenticate" });
+    expect(authenticate).toBeEnabled();
+
+    fireEvent.click(await screen.findByTestId("shared-auth-sweep"));
+    await waitFor(() =>
+      expect(screen.getByRole("button", { name: "Authenticate" })).toBeDisabled(),
+    );
+  });
+
+  // ── A keychain that refuses the delete has to leave something to press ───
+
+  it("keeps both remedies on screen when the keychain refuses the delete", async () => {
+    projects = [running()];
+    hasClaudeToken.mockResolvedValue(true);
+    clearClaudeToken.mockRejectedValue("the keychain is locked");
+    render(<SharedAuthSettings />);
+
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
+
+    await waitFor(() =>
+      expect(useAppState.getState().toasts.length).toBeGreaterThan(0),
+    );
+    const toast = useAppState.getState().toasts[0];
+    expect(toast.kind).toBe("error");
+    expect(toast.detail).toMatch(/still stored/i);
+
+    // The token is still there, so Revoke is still the retry for it — and the
+    // images, which the failed delete says nothing about, have their own sweep.
+    await screen.findByRole("button", { name: "Revoke" });
+    const sweep = screen.getByTestId("shared-auth-sweep");
+    fireEvent.click(sweep);
+    await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
+  });
 });
diff --git a/app/src/components/settings/SharedAuthSettings.tsx b/app/src/components/settings/SharedAuthSettings.tsx
index c4ada5b..23a1d1c 100644
--- a/app/src/components/settings/SharedAuthSettings.tsx
+++ b/app/src/components/settings/SharedAuthSettings.tsx
@@ -4,7 +4,11 @@ import Modal from "../ui/Modal";
 import StatusIndicator, { type StatusTone } from "../ui/StatusIndicator";
 import { selectClass } from "../ui/Field";
 import ClaudeAuthModal from "./ClaudeAuthModal";
-import { clearClaudeToken } from "../../lib/tauri-commands";
+import {
+  clearClaudeToken,
+  sweepClaudeTokenSnapshots,
+} from "../../lib/tauri-commands";
+import type { ClearTokenOutcome } from "../../lib/types";
 import { useProjects } from "../../hooks/useProjects";
 import { useAppState } from "../../store/appState";
 import { authErrorMessage, useClaudeTokenStatus } from "../../hooks/useClaudeAuth";
@@ -37,6 +41,32 @@ const STATUS_DISPLAY: Record<
   },
 };
 
+/**
+ * `clear_claude_token` reports three separate things about the snapshot images
+ * that `docker commit` baked the token into, and they need three different
+ * sentences. `snapshots_skipped` in particular is **not** a failure of the
+ * rewrite — the project was busy (starting, compacting, migrating) and its
+ * snapshot was never attempted, so the remedy is to run the sweep again, not
+ * to Reset the project and lose both its volumes.
+ *
+ * `snapshots_skipped` is declared on `ClearTokenOutcome`, but it is still read
+ * through `list()` rather than indexed directly: a backend older than this
+ * change does not send the field at all, and a missing skip list must read as
+ * "nothing was skipped" rather than crashing the panel that reports it.
+ */
+type RevokeOutcome = ClearTokenOutcome;
+
+const list = (values: string[] | undefined): string[] => values ?? [];
+
+/** Whether a copy of the token is known — or suspected — to still be reachable. */
+function needsAnotherPass(outcome: RevokeOutcome): boolean {
+  return (
+    list(outcome.snapshots_failed).length > 0 ||
+    list(outcome.snapshots_skipped).length > 0 ||
+    Boolean(outcome.docker_unavailable)
+  );
+}
+
 /**
  * Host-level control for the one long-lived Claude Code token shared by every
  * project. Acquisition needs a running container to run the CLI in, so the
@@ -50,7 +80,14 @@ export default function SharedAuthSettings() {
   const [pickedId, setPickedId] = useState<string | null>(null);
   const [authOpen, setAuthOpen] = useState(false);
   const [confirmRevoke, setConfirmRevoke] = useState(false);
-  const [revoking, setRevoking] = useState(false);
+  const [sweeping, setSweeping] = useState(false);
+
+  // What the last sweep could not finish. Held in its own state rather than
+  // derived from `status`, because that is exactly the bug this fixes: a
+  // revoke clears the keychain, `status` flips to "absent", and the button
+  // that could have retried the snapshot rewrite disappeared with it —
+  // leaving a live ~1-year token in an image and Reset as the only remedy.
+  const [leftover, setLeftover] = useState<RevokeOutcome | null>(null);
 
   // `claude setup-token` runs inside a container, so only running projects can
   // host the flow.
@@ -61,45 +98,95 @@ export default function SharedAuthSettings() {
 
   const display = STATUS_DISPLAY[status];
 
-  const handleRevoke = async () => {
-    setRevoking(true);
+  /**
+   * Run one of the two cleanups. **They are different commands**, and that is
+   * the point.
+   *
+   * `"revoke"` deletes the keychain entry and then rewrites the images. It is
+   * destructive, and it is only ever reached through the confirmation modal.
+   *
+   * `"sweep"` rewrites the images and never touches the keychain. Both the
+   * standalone check and the retry offered after an incomplete revocation use
+   * it, because neither is a request to delete a credential — the images are
+   * the durable record of what is left to do, so the work is re-derived from
+   * Docker rather than from any token that happens to be stored.
+   *
+   * While there was one command behind both, the retry button was an
+   * unconfirmed revoke: re-authenticate from the button above the panel, press
+   * "Retry snapshot cleanup", and the token acquired seconds earlier was gone,
+   * announced by a toast that mentioned only images.
+   */
+  const runCleanup = async (mode: "revoke" | "sweep") => {
+    setSweeping(true);
     try {
-      const outcome = await clearClaudeToken();
+      const outcome = (await (mode === "revoke"
+        ? clearClaudeToken()
+        : sweepClaudeTokenSnapshots())) as RevokeOutcome;
       setConfirmRevoke(false);
-      await refresh();
 
-      // The keychain entry is gone either way. What matters here is the copy of
-      // the token that `docker commit` baked into each project's snapshot
-      // image: that one outlives every container, and `docker image inspect`
-      // will keep printing it until the image is rewritten. If that could not
-      // be done, the revocation is incomplete and saying "removed" would be a
-      // lie.
+      const failed = list(outcome.snapshots_failed);
+      const skipped = list(outcome.snapshots_skipped);
+      const scrubbed = list(outcome.snapshots_scrubbed);
+      const superseded = list(outcome.snapshots_superseded);
+
+      setLeftover(needsAnotherPass(outcome) ? outcome : null);
+
+      // Whatever the mode, what is being reported here is the copy of the
+      // token that `docker commit` baked into each project's snapshot image:
+      // that one outlives every container, and `docker image inspect` will
+      // keep printing it until the image is rewritten. On a revoke the
+      // keychain entry is already gone by this point — the command deletes it
+      // before it touches an image — so if the rewrite could not be done the
+      // revocation is incomplete and saying "removed" would be a lie. On a
+      // sweep nothing was deleted at all, and the wording must not imply it.
       if (outcome.docker_unavailable) {
         pushToast({
           kind: "error",
-          message: "Token removed from the keychain, but snapshots were not checked.",
+          message:
+            mode === "revoke"
+              ? "Token removed from the keychain, but snapshots were not checked."
+              : "Snapshot images were not checked.",
           detail:
             `Docker could not be reached (${outcome.docker_unavailable}), so any snapshot image ` +
             "built before this version may still contain the token in its environment. " +
-            "Start Docker and revoke again to clear them.",
+            "Start Docker and run the cleanup again to clear them.",
         });
-      } else if (outcome.snapshots_failed.length > 0) {
+      } else if (failed.length > 0) {
         pushToast({
           kind: "error",
-          message: "Token removed from the keychain, but it is still in some images.",
+          message:
+            mode === "revoke"
+              ? "Token removed from the keychain, but it is still in some images."
+              : "A token is still readable in some snapshot images.",
           detail:
-            `${outcome.snapshots_failed.length} snapshot image(s) could not be rewritten and ` +
+            `${failed.length} snapshot image(s) could not be rewritten and ` +
             "still contain the token, readable via `docker image inspect`. Reset those " +
-            `projects to remove the images. Details: ${outcome.snapshots_failed.join("; ")}`,
+            `projects to remove the images. Details: ${failed.join("; ")}` +
+            (skipped.length > 0
+              ? ` A further ${skipped.length} image(s) were skipped because their projects ` +
+                "are busy; those can be cleared by running the cleanup again."
+              : ""),
         });
-      } else if (outcome.snapshots_scrubbed.length > 0) {
+      } else if (skipped.length > 0) {
+        pushToast({
+          kind: "error",
+          message: `Token still in ${skipped.length} snapshot image(s) — those projects were busy.`,
+          detail:
+            "Nothing was rewritten for them, so the token is still readable via " +
+            "`docker image inspect`. Wait for the operation in progress to finish and run the " +
+            `cleanup again. Details: ${skipped.join("; ")}`,
+        });
+      } else if (scrubbed.length > 0) {
         pushToast({
           kind: "success",
-          message: `Shared Claude token removed, and cleared from ${outcome.snapshots_scrubbed.length} snapshot image(s).`,
+          message:
+            mode === "revoke"
+              ? `Shared Claude token removed, and cleared from ${scrubbed.length} snapshot image(s).`
+              : `Token cleared from ${scrubbed.length} snapshot image(s).`,
           detail:
-            outcome.snapshots_superseded.length > 0
+            superseded.length > 0
               ? "The pre-rewrite image layer for " +
-                `${outcome.snapshots_superseded.join(", ")} is still on disk because a ` +
+                `${superseded.join(", ")} is still on disk because a ` +
                 "container is running from it. It goes away once that project is restarted " +
                 "(which recreates the container) and Docker prunes the leftover."
               : undefined,
@@ -107,23 +194,44 @@ export default function SharedAuthSettings() {
       } else {
         pushToast({
           kind: "success",
-          message: "Shared Claude token removed from the keychain.",
+          message:
+            mode === "revoke"
+              ? "Shared Claude token removed from the keychain."
+              : "No snapshot image is holding the token.",
         });
       }
     } catch (e) {
       pushToast({
         kind: "error",
-        message: "Could not remove the shared Claude token.",
-        detail: authErrorMessage(
-          e,
-          "The OS keychain rejected the delete. The token may still be stored.",
-        ),
+        message:
+          mode === "revoke"
+            ? "Could not remove the shared Claude token."
+            : "Could not clear the token from snapshot images.",
+        detail:
+          mode === "revoke"
+            ? // The keychain delete runs first and nothing else runs until it
+              // succeeds, so the consequence is knowable and worth stating
+              // rather than leaving the user with a raw keyring error: the
+              // token is still stored, and no image was touched. Revoke stays
+              // on screen because `status` is still "stored", and the snapshot
+              // sweep beside it does not need this delete to have worked.
+              `${authErrorMessage(e, "The OS keychain rejected the delete.")} ` +
+              "The token is still stored and no snapshot image was changed — try again, " +
+              "or use “Check snapshot images” to clean the images on their own."
+            : authErrorMessage(e, "The snapshot images could not be checked."),
       });
     } finally {
-      setRevoking(false);
+      // In `finally` rather than in the success path: a failed revoke leaves
+      // the token stored, and the panel has to say so rather than keeping
+      // whatever it believed before the attempt.
+      await refresh();
+      setSweeping(false);
     }
   };
 
+  const leftoverFailed = list(leftover?.snapshots_failed);
+  const leftoverSkipped = list(leftover?.snapshots_skipped);
+
   return (
     <div className="space-y-3">
       <div>
@@ -179,7 +287,11 @@ export default function SharedAuthSettings() {
         <Button
           size="md"
           variant="primary"
-          disabled={!host}
+          // Also disabled while a cleanup is running. A sweep is a per-image
+          // inspect/create/commit/rmi over the Docker socket and takes minutes;
+          // acquiring a token in the middle of one races the rewrite, and a
+          // revoke started before it would delete the new token when it lands.
+          disabled={!host || sweeping}
           onClick={() => setAuthOpen(true)}
         >
           {status === "stored" ? "Re-authenticate" : "Authenticate"}
@@ -188,14 +300,81 @@ export default function SharedAuthSettings() {
           <Button
             size="md"
             variant="danger"
-            disabled={revoking}
+            disabled={sweeping}
             onClick={() => setConfirmRevoke(true)}
           >
             Revoke
           </Button>
         )}
+        {status !== "checking" && (
+          // Offered in every state, not just "absent". Three reasons, and the
+          // command behind it deletes nothing, so none of them costs anything:
+          // a snapshot committed by an older build carries a token whether or
+          // not one is stored today; a revoke that could not finish leaves one
+          // in an image while the keychain entry — and the Revoke button — is
+          // already gone; and when the keychain refuses the delete, `status`
+          // stays "stored", which used to leave the images with no affordance
+          // at all.
+          <Button
+            size="md"
+            variant="ghost"
+            disabled={sweeping}
+            data-testid="shared-auth-sweep"
+            onClick={() => void runCleanup("sweep")}
+          >
+            {sweeping ? "Checking…" : "Check snapshot images"}
+          </Button>
+        )}
       </div>
 
+      {leftover && (
+        <div
+          data-testid="shared-auth-leftover"
+          className="rounded-[var(--radius-control)] border border-[var(--error)]/40 bg-[var(--error-muted)] p-2"
+        >
+          <StatusIndicator
+            tone="error"
+            label="Token still readable"
+            className="text-xs"
+          />
+          <p className="mt-1 text-xs text-[var(--text-secondary)] leading-snug">
+            {leftover.docker_unavailable
+              ? `Docker could not be reached (${leftover.docker_unavailable}), so no snapshot image was checked.`
+              : null}
+            {leftoverSkipped.length > 0 ? (
+              <>
+                {leftoverSkipped.length} snapshot image(s) were skipped because their
+                projects were busy. Nothing was rewritten for them, so the token is
+                still readable with{" "}
+                <code className="font-mono">docker image inspect</code>. Running the
+                cleanup again once those projects are idle clears them.
+              </>
+            ) : null}
+            {leftoverFailed.length > 0 ? (
+              <>
+                {" "}
+                {leftoverFailed.length} snapshot image(s) could not be rewritten:{" "}
+                {leftoverFailed.join("; ")}. If retrying does not help, Reset those
+                projects to remove the images.
+              </>
+            ) : null}
+          </p>
+          <div className="mt-2">
+            <Button
+              size="md"
+              variant="secondary"
+              disabled={sweeping}
+              data-testid="shared-auth-retry"
+              // `runCleanup("sweep")` is `sweep_claude_token_snapshots`, which
+              // has no keychain delete on the wire at all — see `runCleanup`.
+              onClick={() => void runCleanup("sweep")}
+            >
+              {sweeping ? "Retrying…" : "Retry snapshot cleanup"}
+            </Button>
+          </div>
+        </div>
+      )}
+
       {!host && (
         <p
           data-testid="shared-auth-no-container"
@@ -221,6 +400,13 @@ export default function SharedAuthSettings() {
           projectName={host.name}
           onClose={() => setAuthOpen(false)}
           onAuthenticated={() => {
+            // The panel is about a *previous* credential and the button that
+            // finishes it is a sweep, so leaving it up after a fresh sign-in
+            // is at best confusing and was at worst fatal: while the retry ran
+            // `clear_claude_token`, the obvious next click deleted the token
+            // just acquired. "Check snapshot images" stays available above, so
+            // nothing is lost by clearing this.
+            setLeftover(null);
             void refresh();
           }}
         />
@@ -237,17 +423,17 @@ export default function SharedAuthSettings() {
                 size="md"
                 variant="ghost"
                 onClick={() => setConfirmRevoke(false)}
-                disabled={revoking}
+                disabled={sweeping}
               >
                 Cancel
               </Button>
               <Button
                 size="md"
                 variant="danger"
-                disabled={revoking}
-                onClick={() => void handleRevoke()}
+                disabled={sweeping}
+                onClick={() => void runCleanup("revoke")}
               >
-                {revoking ? "Revoking…" : "Revoke token"}
+                {sweeping ? "Revoking…" : "Revoke token"}
               </Button>
             </>
           }
@@ -260,11 +446,13 @@ export default function SharedAuthSettings() {
             restarted.
           </p>
           <p className="mt-2 text-[13px] text-[var(--text-secondary)] leading-snug">
-            Each project&rsquo;s snapshot image is also rewritten, because{" "}
-            <code className="font-mono">docker commit</code> copies the token into it
-            and an image outlives every container built from it. If any image
-            cannot be rewritten you will be told which, and the token stays readable
-            in it until that project is Reset.
+            The keychain entry goes first, then each project&rsquo;s snapshot image is
+            rewritten &mdash; <code className="font-mono">docker commit</code> copies
+            the token into it, and an image outlives every container built from it.
+            That second half takes a while, and a project that is busy right now is
+            skipped rather than rewritten unsafely: you will be told which, and
+            &ldquo;Check snapshot images&rdquo; runs the cleanup again afterwards
+            without touching the keychain.
           </p>
         </Modal>
       )}
diff --git a/app/src/components/settings/UpdateDialog.tsx b/app/src/components/settings/UpdateDialog.tsx
index 1f97193..7e905c8 100644
--- a/app/src/components/settings/UpdateDialog.tsx
+++ b/app/src/components/settings/UpdateDialog.tsx
@@ -2,6 +2,7 @@ import { openUrl } from "@tauri-apps/plugin-opener";
 import type { UpdateInfo } from "../../lib/types";
 import Modal from "../ui/Modal";
 import Button from "../ui/Button";
+import { formatBytes } from "../../lib/formatBytes";
 
 interface Props {
   updateInfo: UpdateInfo;
@@ -24,11 +25,6 @@ export default function UpdateDialog({
     }
   };
 
-  const formatSize = (bytes: number) => {
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-  };
-
   return (
     <Modal
       title="Update Available"
@@ -83,7 +79,11 @@ export default function UpdateDialog({
             >
               <span className="truncate font-mono">{asset.name}</span>
               <span className="text-[var(--text-secondary)] ml-2 flex-shrink-0">
-                {formatSize(asset.size)}
+                {/* `binary` because a release asset's size is the ÷1024 figure
+                    every OS file browser shows for the same download. This
+                    used to be a local copy that rendered KB whole and stopped
+                    the ladder at MB; see `formatBytes.ts`. */}
+                {formatBytes(asset.size, { binary: true })}
               </span>
             </button>
           ))}
diff --git a/app/src/components/terminal/TerminalView.test.tsx b/app/src/components/terminal/TerminalView.test.tsx
new file mode 100644
index 0000000..42284d0
--- /dev/null
+++ b/app/src/components/terminal/TerminalView.test.tsx
@@ -0,0 +1,540 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, fireEvent, cleanup, act } from "@testing-library/react";
+import TerminalView, { supersedes } from "./TerminalView";
+import { useAppState } from "../../store/appState";
+import { uploadHostFileToTerminal } from "../../lib/tauri-commands";
+
+/**
+ * The window-wide native drag-drop listener, captured at registration.
+ *
+ * Tauri routes *every* file drop to *every* listener, which is the whole reason
+ * `TerminalView` hit-tests one — so a test that wants to know what the hit test
+ * decides has to be able to fire the event itself.
+ */
+const dragDrop = vi.hoisted(() => ({
+  handler: null as null | ((event: unknown) => unknown),
+}));
+
+/** The `terminal-output-{id}` listeners, so a test can be the PTY. */
+const ptyOutput = vi.hoisted(() => ({
+  listeners: new Map<string, (e: { payload: number[] }) => void>(),
+}));
+
+/**
+ * Shift+Enter has to reach the container as ESC+CR.
+ *
+ * xterm.js does not consult `shiftKey` for Enter, so Shift+Enter is
+ * byte-identical to Enter unless `attachCustomKeyEventHandler` intervenes —
+ * which means the interesting assertion is not just "ESC+CR was sent" but
+ * "and a bare CR was not", i.e. that the handler returned false and xterm
+ * stopped. A test that only checked the first half would pass on a version
+ * that submits the prompt *and* inserts a newline.
+ */
+
+const terminalInput = vi.fn(async () => {});
+
+vi.mock("../../lib/tauri-commands", () => ({
+  terminalInput: (sessionId: string, bytes: number[]) =>
+    terminalInput(sessionId, bytes),
+  terminalResize: vi.fn(async () => {}),
+  pasteImageToTerminal: vi.fn(async () => ""),
+  openTerminalSession: vi.fn(async () => {}),
+  closeTerminalSession: vi.fn(async () => {}),
+  updateProject: vi.fn(async () => ({})),
+  awsSsoRefresh: vi.fn(async () => {}),
+  openPageInContainerBrowser: vi.fn(async () => ({ error: null })),
+  uploadHostFileToTerminal: vi.fn(async () => ""),
+}));
+
+vi.mock("@tauri-apps/api/event", () => ({
+  listen: async (event: string, cb: (e: { payload: number[] }) => void) => {
+    ptyOutput.listeners.set(event, cb);
+    return () => ptyOutput.listeners.delete(event);
+  },
+}));
+
+vi.mock("@tauri-apps/plugin-opener", () => ({
+  openUrl: vi.fn(async () => {}),
+}));
+
+vi.mock("@tauri-apps/api/webview", () => ({
+  getCurrentWebview: () => ({
+    onDragDropEvent: async (cb: (event: unknown) => unknown) => {
+      dragDrop.handler = cb;
+      return () => {
+        dragDrop.handler = null;
+      };
+    },
+  }),
+}));
+
+/** jsdom has no ResizeObserver, and the mount effect installs one. */
+class NoopResizeObserver {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+
+/** What `sendInput` put on the wire, decoded back to a string. */
+function sent(): string[] {
+  return terminalInput.mock.calls.map((call) =>
+    new TextDecoder().decode(new Uint8Array((call as unknown as [string, number[]])[1])),
+  );
+}
+
+function mountSession(sessionType: "claude" | "bash") {
+  useAppState.setState({
+    sessions: [
+      {
+        id: "s1",
+        projectId: "p1",
+        projectName: "api",
+        sessionType,
+        sessionName: null,
+      },
+    ],
+  });
+  return render(<TerminalView sessionId="s1" active />);
+}
+
+/** The hidden textarea xterm binds its keyboard handling to. */
+function helperTextarea(container: HTMLElement): HTMLTextAreaElement {
+  const el = container.querySelector<HTMLTextAreaElement>(
+    "textarea.xterm-helper-textarea",
+  );
+  if (!el) throw new Error("xterm helper textarea not found");
+  return el;
+}
+
+beforeEach(() => {
+  vi.stubGlobal("ResizeObserver", NoopResizeObserver);
+  // xterm's renderer asks the window for its device pixel ratio on open.
+  vi.stubGlobal(
+    "matchMedia",
+    (query: string) => ({
+      matches: false,
+      media: query,
+      addEventListener() {},
+      removeEventListener() {},
+      addListener() {},
+      removeListener() {},
+      onchange: null,
+      dispatchEvent: () => false,
+    }),
+  );
+  terminalInput.mockClear();
+  vi.mocked(uploadHostFileToTerminal).mockClear();
+  vi.mocked(uploadHostFileToTerminal).mockResolvedValue("/workspace/api/dropped.txt");
+  dragDrop.handler = null;
+  ptyOutput.listeners.clear();
+  document.body.innerHTML = "";
+  useAppState.setState({ sessions: [] });
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe("TerminalView — Shift+Enter", () => {
+  it("sends ESC+CR and cancels the keydown, so no bare CR follows", () => {
+    // **The cancel is the load-bearing half, and this test could not see it.**
+    //
+    // Returning `false` from xterm's custom key handler does not cancel the
+    // event: `_keyDown` returns before setting `_keyDownHandled`, so
+    // `_keyPress` still runs and emits a bare CR for Enter's charCode 13. In a
+    // real browser that submitted the prompt straight after inserting the
+    // newline. jsdom never synthesizes the follow-up keypress, so the old
+    // `expect(sent()).not.toContain("\r")` assertion below could not fail no
+    // matter what the code did — it was named for a behaviour it could not
+    // exercise.
+    //
+    // Asserting `defaultPrevented` pins the actual mechanism that stops the
+    // keypress, which is a property jsdom *can* observe.
+    const { container } = mountSession("claude");
+
+    const event = new KeyboardEvent("keydown", {
+      key: "Enter",
+      keyCode: 13,
+      shiftKey: true,
+      bubbles: true,
+      cancelable: true,
+    });
+    helperTextarea(container).dispatchEvent(event);
+
+    // The bytes `/terminal-setup` installs for every other editor.
+    expect(sent()).toEqual(["\x1b\r"]);
+    expect(sent()).not.toContain("\r");
+    // Without this, the browser fires keypress and xterm submits.
+    expect(event.defaultPrevented).toBe(true);
+  });
+
+  it("leaves a plain Enter alone", () => {
+    const { container } = mountSession("claude");
+
+    fireEvent.keyDown(helperTextarea(container), { key: "Enter", keyCode: 13 });
+
+    expect(sent()).toEqual(["\r"]);
+  });
+
+  it("does not bind it in a bash session", () => {
+    // `bash -l` runs readline, which has no binding for `\e\r`: it would answer
+    // with a bell and swallow the Enter the user actually pressed.
+    const { container } = mountSession("bash");
+
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "Enter",
+      keyCode: 13,
+      shiftKey: true,
+    });
+
+    expect(sent()).toEqual(["\r"]);
+  });
+
+  it("leaves a modified Shift+Enter to xterm", () => {
+    // Adding Ctrl is not the chord this binds; whatever xterm does with it is
+    // xterm's business.
+    const { container } = mountSession("claude");
+
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "Enter",
+      keyCode: 13,
+      shiftKey: true,
+      ctrlKey: true,
+    });
+
+    expect(sent()).not.toContain("\x1b\r");
+  });
+
+  it("Alt+Enter already produced ESC+CR without any handler", () => {
+    // Pinned because it is the reason Shift+Enter was the only gap: xterm
+    // ESC-prefixes on `altKey` by itself, so Alt+Enter has always inserted a
+    // newline in Claude Code. It was simply undocumented.
+    const { container } = mountSession("bash"); // no custom branch involved
+
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "Enter",
+      keyCode: 13,
+      altKey: true,
+    });
+
+    expect(sent()).toEqual(["\x1b\r"]);
+  });
+});
+
+describe("supersedes — who owns the prompt slot", () => {
+  const relay = (url: string) => ({ url, source: "relay" as const });
+  const osc8 = (url: string) => ({ url, source: "osc8" as const });
+  const guess = (url: string) => ({ url, source: "heuristic" as const });
+
+  const COMPLETE =
+    "https://claude.ai/oauth/authorize?code=true&client_id=abc123&response_type=code&redirect_uri=https%3A%2F%2Fconsole.anthropic.com%2Foauth%2Fcode%2Fcallback&scope=user%3Ainference";
+  // What the screen-scraper reconstructs from the visible text: parses, points
+  // at the right host, authorises nothing.
+  const TRUNCATED = COMPLETE.slice(0, 80);
+
+  it("fills an empty slot from anywhere", () => {
+    expect(supersedes(guess(TRUNCATED), null)).toBe(true);
+  });
+
+  it("refuses to let a truncated guess replace the exact copy", () => {
+    // The whole bug: the relay lands first with the complete URL, and 300 ms
+    // later the detector's debounce fires with a prefix of it.
+    expect(supersedes(guess(TRUNCATED), relay(COMPLETE))).toBe(false);
+    expect(supersedes(guess(TRUNCATED), osc8(COMPLETE))).toBe(false);
+  });
+
+  it("lets a better source take over from a worse one", () => {
+    expect(supersedes(osc8(COMPLETE), guess(TRUNCATED))).toBe(true);
+    expect(supersedes(relay(COMPLETE), guess(TRUNCATED))).toBe(true);
+  });
+
+  it("refuses to let a truncated guess replace another guess it truncates", () => {
+    // The same rule one rank down. Both are scrapes of the same repainting
+    // frame, so recency says the newer one wins and recency is wrong: a
+    // repaint that lands a *shorter* view of the link already on screen is
+    // showing less of it, not something new.
+    expect(supersedes(guess(TRUNCATED), guess(COMPLETE))).toBe(false);
+  });
+
+  it("lets a scraped candidate grow into the complete link", () => {
+    // A repaint can land the truncated copy first. Extending it is safe: a
+    // longer string with the same prefix has the same origin.
+    expect(supersedes(guess(COMPLETE), guess(TRUNCATED))).toBe(true);
+  });
+
+  it("does not let an unrelated scrape displace what is on screen", () => {
+    // Longest-wins without the prefix test hands the choice to whoever pads
+    // their URL the most.
+    expect(
+      supersedes(guess("https://evil.tld/" + "a".repeat(400)), guess(COMPLETE)),
+    ).toBe(false);
+  });
+
+  it("lets a second explicit relay request through", () => {
+    // Each OSC 7777 is a fresh deliberate ask, not another view of the last
+    // one — a second `gh auth login` must be able to replace the first.
+    expect(
+      supersedes(relay("https://github.com/login/device"), relay(COMPLETE)),
+    ).toBe(true);
+  });
+});
+
+describe("TerminalView — where a dropped file lands", () => {
+  /** Mount, let the async drag-drop registration settle, and give the pane a
+   *  rect — jsdom has no layout, so every element is 0×0 and would be rejected
+   *  as a hidden pane.
+   *
+   *  The rect goes on the *pane wrapper*, which is what the hit test asks
+   *  about: it is what the user sees as the terminal (gutter included), and
+   *  the chrome painted over it — the Following toggle, the URL toast — are
+   *  its children rather than the xterm host's. */
+  async function mountWithLayout() {
+    const view = mountSession("bash");
+    await act(async () => {});
+    const pane = view.container.firstElementChild as HTMLElement | null;
+    if (!pane) throw new Error("terminal pane not found");
+    pane.getBoundingClientRect = () =>
+      ({
+        left: 0,
+        top: 0,
+        right: 800,
+        bottom: 600,
+        width: 800,
+        height: 600,
+        x: 0,
+        y: 0,
+        toJSON: () => ({}),
+      }) as DOMRect;
+    return view;
+  }
+
+  /** jsdom has no `elementFromPoint`, so a z-order branch is unreachable
+   *  unless a test supplies one — which is exactly how a gate that refused
+   *  every drop under the Following toggle shipped through this file green.
+   *  The gate asks no per-point question any more, but the tests below still
+   *  install one and feed it the most misleading answer available, to pin
+   *  that the routing does not change when it is there. */
+  function stubElementFromPoint(top: Element | null) {
+    Object.defineProperty(document, "elementFromPoint", {
+      configurable: true,
+      writable: true,
+      value: () => top,
+    });
+  }
+
+  async function drop(x: number, y: number) {
+    if (!dragDrop.handler) throw new Error("no drag-drop listener registered");
+    await act(async () => {
+      await dragDrop.handler!({
+        payload: { type: "drop", position: { x, y }, paths: ["/host/dropped.txt"] },
+      });
+    });
+  }
+
+  it("uploads a file dropped onto the pane", async () => {
+    await mountWithLayout();
+    await drop(400, 300);
+    expect(vi.mocked(uploadHostFileToTerminal)).toHaveBeenCalledWith(
+      "s1",
+      "/host/dropped.txt",
+    );
+  });
+
+  it("ignores a drop that lands outside the pane", async () => {
+    await mountWithLayout();
+    await drop(4000, 300);
+    expect(vi.mocked(uploadHostFileToTerminal)).not.toHaveBeenCalled();
+  });
+
+  it("ignores a drop released onto an open modal", async () => {
+    // The hit test used to be purely geometric, and a `Modal` is a
+    // `fixed inset-0 z-50` portal painted *over* the whole window — so the pane
+    // underneath still had its rect and happily uploaded the file into the
+    // directory the dialog was covering. Same for the shutdown overlay, which is
+    // up precisely while nothing should be accepting work.
+    await mountWithLayout();
+    const dialog = document.createElement("div");
+    dialog.setAttribute("role", "dialog");
+    dialog.setAttribute("aria-modal", "true");
+    document.body.appendChild(dialog);
+
+    await drop(400, 300);
+
+    expect(vi.mocked(uploadHostFileToTerminal)).not.toHaveBeenCalled();
+
+    // …and it is the modal, not the mount, that is refusing: close it and the
+    // very same drop goes through.
+    dialog.remove();
+    await drop(400, 300);
+    expect(vi.mocked(uploadHostFileToTerminal)).toHaveBeenCalledTimes(1);
+  });
+
+  it("uploads a file dropped onto the always-present Following toggle", async () => {
+    // The regression this file could not see. The toggle is `absolute top-2
+    // right-4 z-50` and is rendered unconditionally, so `elementFromPoint`
+    // returns *it* for the terminal's top-right corner — and a gate asking
+    // "is what is painted here inside the xterm host?" answered no, forever,
+    // with no message and no log line. jsdom never ran that branch.
+    const view = await mountWithLayout();
+    const toggle = view.getByTitle(/Auto-scroll/i);
+    stubElementFromPoint(toggle);
+
+    await drop(780, 10);
+
+    expect(vi.mocked(uploadHostFileToTerminal)).toHaveBeenCalledWith(
+      "s1",
+      "/host/dropped.txt",
+    );
+    delete (document as Partial<Document>).elementFromPoint;
+  });
+
+  it("refuses — and says so — while a dialog is open", async () => {
+    useAppState.setState({ toasts: [] });
+    await mountWithLayout();
+    const backdrop = document.createElement("div");
+    backdrop.setAttribute("data-blocks-drop", "true");
+    const panel = document.createElement("div");
+    panel.setAttribute("aria-modal", "true");
+    backdrop.appendChild(panel);
+    document.body.appendChild(backdrop);
+    stubElementFromPoint(backdrop);
+
+    await drop(400, 300);
+
+    expect(vi.mocked(uploadHostFileToTerminal)).not.toHaveBeenCalled();
+    // A refused drop is otherwise indistinguishable from a broken one.
+    const notice = useAppState
+      .getState()
+      .toasts.find((t) => t.message === "File drop ignored");
+    expect(notice).toBeTruthy();
+    // Not an error: the user has a dialog open, which is a state they chose
+    // and can leave with Escape. An error card would sit there until
+    // dismissed, and `ToastHost` paints at `z-[60]`.
+    expect(notice?.kind).toBe("info");
+
+    backdrop.remove();
+    delete (document as Partial<Document>).elementFromPoint;
+  });
+
+  it("keeps refusing when the refusal's own toast is painted over the dialog", async () => {
+    // C1, end to end. Refusing pushes a toast; `ToastHost` is `fixed
+    // bottom-4 right-4 z-[60]` and the `Modal` backdrop is `z-50` in the same
+    // stacking context — so the toast is the topmost element over the covered
+    // pane, and a gate that asked "is a blocker painted here?" answered no and
+    // uploaded into the directory the dialog was covering. The gate had armed
+    // its own hole: one refused drop was all it took to open it.
+    useAppState.setState({ toasts: [] });
+    await mountWithLayout();
+    const backdrop = document.createElement("div");
+    backdrop.setAttribute("data-blocks-drop", "true");
+    document.body.appendChild(backdrop);
+    stubElementFromPoint(backdrop);
+
+    await drop(400, 300);
+    expect(vi.mocked(uploadHostFileToTerminal)).not.toHaveBeenCalled();
+    expect(useAppState.getState().toasts).toHaveLength(1);
+
+    // The toast is now on screen, above the backdrop, and the user drops again
+    // on the very point it occupies.
+    const toastCard = document.createElement("div");
+    document.body.appendChild(toastCard);
+    stubElementFromPoint(toastCard);
+
+    await drop(700, 550);
+    expect(vi.mocked(uploadHostFileToTerminal)).not.toHaveBeenCalled();
+    // …and a second refusal replaces the first notice rather than stacking.
+    expect(useAppState.getState().toasts).toHaveLength(1);
+
+    toastCard.remove();
+    backdrop.remove();
+    delete (document as Partial<Document>).elementFromPoint;
+  });
+});
+
+describe("TerminalView — reaching the URL prompt without a mouse", () => {
+  // This toast is the only route to completing a sign-in started in a terminal.
+  // It used to be mouse-only: nothing moved focus to it, nothing dismissed it
+  // from the keyboard, and xterm's helper textarea eats Tab, so its buttons
+  // could not be reached at all.
+  const SIGN_IN =
+    "https://claude.ai/oauth/authorize?code=true&client_id=abc&response_type=code";
+
+  /** What `container/triple-c-open` writes to its controlling terminal. */
+  function relaySequence(url: string): number[] {
+    const payload = btoa(url);
+    return Array.from(
+      new TextEncoder().encode(`\x1b]7777;open;${payload}\x07`),
+    );
+  }
+
+  /** Mount, and let the container ask for a URL to be opened. */
+  async function mountWithPrompt() {
+    const view = mountSession("claude");
+    await act(async () => {});
+    const emit = ptyOutput.listeners.get("terminal-output-s1");
+    if (!emit) throw new Error("no terminal-output listener registered");
+    await act(async () => {
+      emit({ payload: relaySequence(SIGN_IN) });
+      // xterm parses on its own write queue.
+      await new Promise((r) => setTimeout(r, 0));
+      await new Promise((r) => setTimeout(r, 0));
+    });
+    return view;
+  }
+
+  function primaryAction(): HTMLElement {
+    const el = document.querySelector<HTMLElement>('[data-url-toast-primary="true"]');
+    if (!el) throw new Error("toast default action not found");
+    return el;
+  }
+
+  it("does not take focus away from the terminal when the prompt appears", async () => {
+    // Deliberate: the terminal is live, and the default action opens a URL the
+    // *container* chose. A focused button is one stray Enter from doing it.
+    const { container } = await mountWithPrompt();
+    expect(document.querySelector('[data-testid="url-toast"]')).not.toBeNull();
+    expect(document.activeElement).toBe(helperTextarea(container));
+  });
+
+  it("jumps to the default action on Ctrl+Shift+O", async () => {
+    const { container } = await mountWithPrompt();
+
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "O",
+      ctrlKey: true,
+      shiftKey: true,
+    });
+
+    expect(document.activeElement).toBe(primaryAction());
+  });
+
+  it("dismisses on Escape and hands focus back to the terminal", async () => {
+    // Not back to `document.body`, where the next keystroke goes nowhere.
+    const { container } = await mountWithPrompt();
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "O",
+      ctrlKey: true,
+      shiftKey: true,
+    });
+
+    fireEvent.keyDown(document.activeElement!, { key: "Escape" });
+
+    expect(document.querySelector('[data-testid="url-toast"]')).toBeNull();
+    expect(document.activeElement).toBe(helperTextarea(container));
+  });
+
+  it("leaves Ctrl+Shift+O to the terminal when there is no prompt", async () => {
+    const { container } = mountSession("claude");
+    await act(async () => {});
+    const before = document.activeElement;
+
+    fireEvent.keyDown(helperTextarea(container), {
+      key: "O",
+      ctrlKey: true,
+      shiftKey: true,
+    });
+
+    expect(document.activeElement).toBe(before);
+  });
+});
diff --git a/app/src/components/terminal/TerminalView.tsx b/app/src/components/terminal/TerminalView.tsx
index a151b76..72d6ae0 100644
--- a/app/src/components/terminal/TerminalView.tsx
+++ b/app/src/components/terminal/TerminalView.tsx
@@ -13,14 +13,20 @@ import {
   uploadHostFileToTerminal,
 } from "../../lib/tauri-commands";
 import { getCurrentWebview } from "@tauri-apps/api/webview";
-import { UrlDetector } from "../../lib/urlDetector";
+import { UrlDetector, type UrlSource } from "../../lib/urlDetector";
 import {
   RelayRateLimiter,
   URL_RELAY_OSC,
+  extendsUrl,
   parseUrlRelayOsc,
   sanitizeRelayUrl,
 } from "../../lib/urlRelay";
-import UrlToast from "./UrlToast";
+import { classifyDrop, DROP_BLOCKED_TOAST } from "../../lib/dropTarget";
+import UrlToast, {
+  URL_TOAST_PRIMARY_SELECTOR,
+  URL_TOAST_SELECTOR,
+  URL_TOAST_SHORTCUT,
+} from "./UrlToast";
 import { trimSelection } from "./trimSelection";
 import TerminalContextMenu from "./TerminalContextMenu";
 
@@ -29,6 +35,58 @@ interface Props {
   active: boolean;
 }
 
+/**
+ * Where a prompted URL came from.
+ *
+ * `relay` is the container asking explicitly, over OSC 7777, with the URL
+ * base64-encoded — exact by construction. `osc8` is lifted verbatim out of a
+ * hyperlink parameter — also exact, but nobody asked for it. `heuristic` was
+ * reassembled from painted text and is the only one that can be a *truncated
+ * guess* at the link it is showing.
+ */
+export type PromptSource = "relay" | UrlSource;
+
+/** Higher wins. Provenance, not recency. */
+const SOURCE_RANK: Record<PromptSource, number> = {
+  heuristic: 0,
+  osc8: 1,
+  relay: 2,
+};
+
+/**
+ * Whether `next` may take over the prompt slot from `current`.
+ *
+ * The bug this exists for: `claude login` relays its OAuth URL over OSC 7777,
+ * base64-encoded and therefore complete; the screen-scraper's 300 ms debounce
+ * then fires, finds the same link cut into terminal-width pieces, and — under
+ * the old last-writer-wins slot — replaced the good URL with a truncated one
+ * that still parses, still points at the right host, and cannot authorise
+ * anything. The user is the one who has to notice.
+ *
+ * Two rules, in order:
+ *
+ *  - Better provenance always wins, worse provenance never does. A scraped
+ *    guess cannot displace an exact copy.
+ *  - Between equals, only an *extension* of what is showing may replace it.
+ *    That is {@link extendsUrl}, the same rule and the same reasoning as
+ *    `pickSignInUrl` in `hooks/useClaudeAuth.ts`: a repaint can land a
+ *    truncated copy before the complete one, and a longer string sharing a
+ *    prefix cannot move the origin. The relay is exempt because each OSC 7777
+ *    is a fresh deliberate request rather than another view of the last one —
+ *    a second `gh auth login` must be able to replace the first.
+ */
+export function supersedes(
+  next: { url: string; source: PromptSource },
+  current: { url: string; source: PromptSource } | null,
+): boolean {
+  if (!current) return true;
+  if (SOURCE_RANK[next.source] !== SOURCE_RANK[current.source]) {
+    return SOURCE_RANK[next.source] > SOURCE_RANK[current.source];
+  }
+  if (next.source === "relay") return true;
+  return extendsUrl(next.url, current.url);
+}
+
 export default function TerminalView({ sessionId, active }: Props) {
   const containerRef = useRef<HTMLDivElement>(null);
   const terminalContainerRef = useRef<HTMLDivElement>(null);
@@ -47,13 +105,24 @@ export default function TerminalView({ sessionId, active }: Props) {
     (s) => s.sessions.find((sess) => sess.id === sessionId)?.projectId
   );
 
-  // One toast slot, two producers: the heuristic long-URL detector and the
-  // container's explicit "open this in the host browser" relay (OSC 7777).
-  // Sharing the slot keeps them from stacking on top of each other.
+  // Which program is on the other end of the PTY. Read through a ref because
+  // the key handler is registered once, in the mount effect keyed on
+  // `sessionId`, and a value captured there would go stale if the session
+  // record arrived after the first render.
+  const sessionType = useAppState(
+    (s) => s.sessions.find((sess) => sess.id === sessionId)?.sessionType
+  );
+  const sessionTypeRef = useRef(sessionType);
+  sessionTypeRef.current = sessionType;
+
+  // One toast slot, three producers: the container's explicit "open this in the
+  // host browser" relay (OSC 7777), OSC 8 hyperlink targets, and the heuristic
+  // long-URL detector. Sharing the slot keeps them from stacking on top of each
+  // other.
   //
-  // Both producers read the container's PTY output, so both are untrusted, and
-  // both must go through `sanitizeRelayUrl` before anything is stored here —
-  // see `promptUrl` below, which is the only writer.
+  // All three read the container's PTY output, so all three are untrusted, and
+  // all three must go through `sanitizeRelayUrl` before anything is stored here
+  // — see `promptUrl` below, which is the only writer.
   //
   // `seq` exists because the slot is shared and long-lived: a second prompt
   // replacing a first would otherwise mutate the toast in place, swapping the
@@ -62,25 +131,89 @@ export default function TerminalView({ sessionId, active }: Props) {
   const [urlPrompt, setUrlPrompt] = useState<{
     url: string;
     label: string;
+    source: PromptSource;
     seq: number;
   } | null>(null);
   const promptSeqRef = useRef(0);
   const relayLimiterRef = useRef(new RelayRateLimiter());
+  // Read by the long-lived keyboard listener below, which is registered once
+  // and would otherwise close over the prompt as it was at mount.
+  const urlPromptRef = useRef<{ url: string } | null>(null);
+
+  /**
+   * Empty the prompt slot, and put focus somewhere real if it was inside the
+   * toast.
+   *
+   * The toast never *takes* focus — see the note in `UrlToast` — but a keyboard
+   * user who jumped into it with {@link URL_TOAST_SHORTCUT} is standing on a
+   * node that is about to unmount, and React does not rehome focus: it lands on
+   * `document.body`, where the terminal receives nothing and the next keystroke
+   * goes nowhere. Every route out of the toast goes through here for that
+   * reason — Open, In container, ✕, Escape and the auto-dismiss alike.
+   */
+  const dismissUrlPrompt = useCallback(() => {
+    const wasInside = !!document.activeElement?.closest(URL_TOAST_SELECTOR);
+    setUrlPrompt(null);
+    if (wasInside) termRef.current?.focus();
+  }, []);
 
   /**
    * The only writer of the prompt slot. Re-validates whatever the caller
    * found: the OSC relay branch has already been through `parseUrlRelayOsc`,
    * but the heuristic detector branch has been through nothing at all, and a
    * raw regex match is exactly the input `sanitizeRelayUrl` exists to refuse.
+   *
+   * Last-writer-wins is what this used to be, and it lost the OAuth URL every
+   * time: the relay delivers the link base64-encoded and therefore exact, and
+   * ~300 ms later the screen-scraper's debounce fired and overwrote it with a
+   * truncated guess at the same link. `supersedes` is the fix — see there.
    */
-  const promptUrl = useCallback((raw: string, label: string) => {
-    const url = sanitizeRelayUrl(raw);
-    if (!url) {
-      console.warn("Refusing to prompt for a URL that failed validation");
-      return;
-    }
-    promptSeqRef.current += 1;
-    setUrlPrompt({ url, label, seq: promptSeqRef.current });
+  const promptUrl = useCallback(
+    (raw: string, label: string, source: PromptSource) => {
+      const url = sanitizeRelayUrl(raw);
+      if (!url) {
+        console.warn("Refusing to prompt for a URL that failed validation");
+        return;
+      }
+      setUrlPrompt((current) => {
+        if (!supersedes({ url, source }, current)) return current;
+        promptSeqRef.current += 1;
+        return { url, label, source, seq: promptSeqRef.current };
+      });
+    },
+    [],
+  );
+  useEffect(() => {
+    urlPromptRef.current = urlPrompt;
+  }, [urlPrompt]);
+
+  /**
+   * The keyboard route into the toast.
+   *
+   * Registered on `document` in the capture phase for the same reason
+   * `useKeyboardShortcuts` does it there: xterm would otherwise forward the
+   * chord to the shell. It is *not* added to that hook because the target is
+   * this pane's own toast — the hook has no way to name it, and only one pane
+   * is on screen at a time, which is what `activeRef` checks.
+   *
+   * Nothing is swallowed unless there is a prompt to jump to, so Ctrl+Shift+O
+   * reaches the terminal untouched the rest of the time.
+   */
+  useEffect(() => {
+    const onKeyDown = (e: KeyboardEvent) => {
+      if (!e.ctrlKey || !e.shiftKey || e.altKey || e.metaKey) return;
+      if (e.key !== "o" && e.key !== "O") return;
+      if (!activeRef.current || !urlPromptRef.current) return;
+      const primary = terminalContainerRef.current?.querySelector<HTMLElement>(
+        `${URL_TOAST_SELECTOR} ${URL_TOAST_PRIMARY_SELECTOR}`,
+      );
+      if (!primary) return;
+      e.preventDefault();
+      e.stopPropagation();
+      primary.focus();
+    };
+    document.addEventListener("keydown", onKeyDown, true);
+    return () => document.removeEventListener("keydown", onKeyDown, true);
   }, []);
   const [imagePasteMsg, setImagePasteMsg] = useState<string | null>(null);
   const [isAtBottom, setIsAtBottom] = useState(true);
@@ -101,24 +234,28 @@ export default function TerminalView({ sessionId, active }: Props) {
   // in-container paths typed into the prompt so Claude Code can read them.
   // Tauri intercepts OS file drops at the webview level, so we use
   // onDragDropEvent (HTML5 ondrop on the element wouldn't expose file paths).
-  // The listener is window-wide, so we route purely by a hit-test against this
-  // terminal's bounds: the pane the drop lands on handles it. Inactive panes are
-  // `display:none` (zero-size rect) so they never match — this works for the
-  // current tabbed layout and would also do the right thing with split panes.
+  //
+  // The listener is window-wide, so every pane decides for itself whether a
+  // drop was meant for it. `classifyDrop` is that decision, shared with the
+  // Files pane, and it asks two things in order: is the payload position
+  // inside this pane's rect (a hidden pane is `display:none`, so its zero-size
+  // rect is what stops two panes both claiming the drop), and — document-wide,
+  // with no geometry — is a modal or blocking overlay on screen at all? An
+  // open `Modal` is a `fixed inset-0` portal painted *over* the window and the
+  // pane underneath still has its rect, so a rect alone uploaded files into
+  // the directory a dialog was covering. See `lib/dropTarget.ts` for why the
+  // blocking half is deliberately not a per-point z-order test.
+  //
+  // The rect asked about is the **pane wrapper**, not the xterm host inside it:
+  // the pane is what the user sees as "the terminal", gutter included, and the
+  // chrome painted over it (the Following toggle, the URL toast) is a sibling
+  // of the host rather than a child. Nothing painted over the pane refuses a
+  // drop on its own account — asking "is this element mine?" once turned every
+  // pixel under that chrome into a permanent dead zone.
   useEffect(() => {
     let unlisten: (() => void) | undefined;
     let cancelled = false;
 
-    const insideThisTerminal = (pos: { x: number; y: number }): boolean => {
-      const rect = containerRef.current?.getBoundingClientRect();
-      // A hidden (display:none) pane has a zero-size rect — never a drop target.
-      if (!rect || rect.width === 0 || rect.height === 0) return false;
-      const dpr = window.devicePixelRatio || 1;
-      const x = pos.x / dpr;
-      const y = pos.y / dpr;
-      return x >= rect.left && x <= rect.right && y >= rect.top && y <= rect.bottom;
-    };
-
     // Always single-quote: a dropped filename can contain shell metacharacters
     // ($(), &&, ', spaces) even with no whitespace, and this path is typed into
     // a live shell. Single-quoting with '\'' escaping neutralizes all of them.
@@ -127,7 +264,24 @@ export default function TerminalView({ sessionId, active }: Props) {
     (async () => {
       const un = await getCurrentWebview().onDragDropEvent(async (event) => {
         if (event.payload.type !== "drop") return;
-        if (!insideThisTerminal(event.payload.position)) return;
+        const verdict = classifyDrop(
+          terminalContainerRef.current,
+          event.payload.position,
+        );
+        // A refused drop is invisible — the file simply does not arrive — so
+        // the one case where the user aimed at us and we said no gets both a
+        // log line and something on screen. The toast, not `imagePasteMsg`:
+        // whatever refused this is painted over the terminal, and `ToastHost`
+        // sits above it.
+        if (verdict === "blocked") {
+          console.warn(
+            "[drop] refused: a dialog or overlay is open",
+            event.payload.position,
+          );
+          useAppState.getState().pushToast(DROP_BLOCKED_TOAST);
+          return;
+        }
+        if (verdict !== "accept") return;
 
         const paths = event.payload.paths ?? [];
         if (paths.length === 0) return;
@@ -234,6 +388,46 @@ export default function TerminalView({ sessionId, active }: Props) {
         useAppState.getState().sttToggle();
         return false;
       }
+      // Shift+Enter inserts a newline in Claude Code's prompt instead of
+      // submitting it. xterm.js does not consult `shiftKey` for Enter
+      // (`Keyboard.ts`, `case 13`), so without this branch Shift+Enter is
+      // byte-identical to Enter and submits.
+      //
+      // `\x1b\r` — ESC then CR — is what Claude Code parses as `return` with
+      // meta, and it is exactly what its own `/terminal-setup` writes into the
+      // VS Code, Cursor, Alacritty and Zed keymaps. These are the in-band
+      // bytes, not a guess, which is why this must NOT be "simplified" to
+      // `\n`: Claude Code accepts `\n` too, but a shell would *run* the line,
+      // so the two session types would quietly diverge.
+      //
+      // Scoped to Claude sessions for the same reason. A bash tab runs
+      // `bash -l`, where readline has no binding for `\e\r` and answers with a
+      // bell — harmless, but there is nothing to gain from sending it.
+      if (
+        event.type === "keydown" &&
+        event.key === "Enter" &&
+        event.shiftKey &&
+        !event.ctrlKey &&
+        !event.altKey &&
+        !event.metaKey &&
+        !event.isComposing &&
+        sessionTypeRef.current === "claude"
+      ) {
+        sendInput(sessionId, "\x1b\r");
+        // **`preventDefault()` is what stops the submit, not the `return false`.**
+        //
+        // xterm's `_keyDown` returns the instant a custom handler says `false`
+        // — *before* it sets `_keyDownHandled` and before it cancels the event.
+        // `_keyPress` then checks that same flag, finds it still false, and
+        // emits a bare CR for Enter's charCode 13. So returning `false` alone
+        // sent ESC+CR *and* a submit: the newline was inserted and the
+        // half-written prompt went to Claude with a stray blank line in it.
+        // Cancelling the keydown is what stops the browser firing keypress at
+        // all. Verified in Chromium; jsdom never synthesizes the follow-up
+        // keypress, which is why the unit test could not see this.
+        event.preventDefault();
+        return false;
+      }
       return true;
     });
 
@@ -287,7 +481,11 @@ export default function TerminalView({ sessionId, active }: Props) {
         console.warn("URL relay: rate-limited", url);
         return true;
       }
-      promptUrl(url, "Container asked to open a URL");
+      // Exact by construction (base64 over OSC 7777), and the detector never
+      // sees it — so tell it, or a truncated scrape of the same link could
+      // still fill the slot once this prompt is dismissed.
+      detectorRef.current?.noteExactUrl(url);
+      promptUrl(url, "Container asked to open a URL", "relay");
       return true;
     });
 
@@ -374,11 +572,17 @@ export default function TerminalView({ sessionId, active }: Props) {
     // Handle backend output -> terminal
     let aborted = false;
 
-    // The width is read per scan, not captured: only a break the terminal
+    // The detector samples this getter on every `feed`, so what it reassembles
+    // with is the width the bytes were *printed* at — only a break the terminal
     // itself inserted may be deleted, and where that is moves with every
     // resize.
     const detector = new UrlDetector(
-      (url) => promptUrl(url, "Long URL detected"),
+      (url, source) =>
+        promptUrl(
+          url,
+          source === "osc8" ? "Link detected" : "Long URL detected",
+          source,
+        ),
       () => termRef.current?.cols ?? 0,
     );
     detectorRef.current = detector;
@@ -509,12 +713,19 @@ export default function TerminalView({ sessionId, active }: Props) {
     }
   }, [active]);
 
-  // Auto-dismiss toast after 30 seconds
+  // Auto-dismiss toast after 30 seconds — unless the user is standing in it.
+  // A keyboard user who has just jumped into the toast is mid-decision, and
+  // pulling it out from under them costs them the only route to finishing a
+  // sign-in. It goes when they act on it, which is the same thing a mouse user
+  // does by clicking.
   useEffect(() => {
     if (!urlPrompt) return;
-    const timer = setTimeout(() => setUrlPrompt(null), 30_000);
+    const timer = setTimeout(() => {
+      if (document.activeElement?.closest(URL_TOAST_SELECTOR)) return;
+      dismissUrlPrompt();
+    }, 30_000);
     return () => clearTimeout(timer);
-  }, [urlPrompt]);
+  }, [urlPrompt, dismissUrlPrompt]);
 
   // Auto-dismiss image paste message after 3 seconds
   useEffect(() => {
@@ -529,13 +740,13 @@ export default function TerminalView({ sessionId, active }: Props) {
     // sanitizes, so this can only fail if that invariant is broken — which is
     // precisely when it matters that the last thing before `openUrl` checks.
     const safe = sanitizeRelayUrl(urlPrompt.url);
-    setUrlPrompt(null);
+    dismissUrlPrompt();
     if (!safe) {
       console.warn("Refusing to open a URL that failed validation");
       return;
     }
     openUrl(safe).catch((e) => console.error("Failed to open URL:", e));
-  }, [urlPrompt]);
+  }, [urlPrompt, dismissUrlPrompt]);
 
   /**
    * Open the prompted URL in the container's own browser instead of the host's.
@@ -548,7 +759,7 @@ export default function TerminalView({ sessionId, active }: Props) {
   const handleOpenUrlInContainer = useCallback(() => {
     if (!urlPrompt) return;
     const safe = sanitizeRelayUrl(urlPrompt.url);
-    setUrlPrompt(null);
+    dismissUrlPrompt();
     if (!safe) {
       console.warn("Refusing to open a URL that failed validation");
       return;
@@ -580,7 +791,7 @@ export default function TerminalView({ sessionId, active }: Props) {
           detail: String(e),
         }),
       );
-  }, [urlPrompt, projectId]);
+  }, [urlPrompt, projectId, dismissUrlPrompt]);
 
   const handleScrollToBottom = useCallback(() => {
     const term = termRef.current;
@@ -660,7 +871,7 @@ export default function TerminalView({ sessionId, active }: Props) {
           label={urlPrompt.label}
           onOpen={handleOpenUrl}
           onOpenInContainer={handleOpenUrlInContainer}
-          onDismiss={() => setUrlPrompt(null)}
+          onDismiss={dismissUrlPrompt}
         />
       )}
       {imagePasteMsg && (
diff --git a/app/src/components/terminal/UrlToast.test.tsx b/app/src/components/terminal/UrlToast.test.tsx
index 0660396..ad705d0 100644
--- a/app/src/components/terminal/UrlToast.test.tsx
+++ b/app/src/components/terminal/UrlToast.test.tsx
@@ -1,6 +1,6 @@
 import { describe, it, expect, vi } from "vitest";
-import { render, screen } from "@testing-library/react";
-import UrlToast from "./UrlToast";
+import { fireEvent, render, screen } from "@testing-library/react";
+import UrlToast, { URL_TOAST_PRIMARY_SELECTOR } from "./UrlToast";
 
 /**
  * The toast is the *only* thing standing between a container-chosen URL and
@@ -58,4 +58,184 @@ describe("UrlToast", () => {
     screen.getByRole("button", { name: "Open" }).click();
     expect(onOpen).toHaveBeenCalledTimes(1);
   });
+
+  describe("keyboard", () => {
+    // This toast is the only route to completing a sign-in started in a
+    // terminal, and xterm's helper textarea swallows Tab — so without these it
+    // is unreachable for a keyboard-only user.
+    const SIGN_IN =
+      "https://claude.ai/oauth/authorize?code=true&client_id=abc&response_type=code";
+
+    it("does not take focus from the live terminal when it appears", () => {
+      // Deliberate. The user may be mid-command, and the default action opens a
+      // URL the *container* chose — a focused button is one stray Enter away
+      // from doing it. The shortcut hint below is what makes that affordable.
+      render(
+        <UrlToast url="https://example.com/" onOpen={noop} onDismiss={noop} />,
+      );
+      expect(document.activeElement).toBe(document.body);
+    });
+
+    it("says how to reach it, since nothing announces a shortcut by itself", () => {
+      render(
+        <UrlToast url="https://example.com/" onOpen={noop} onDismiss={noop} />,
+      );
+      expect(screen.getByTestId("url-toast-shortcut")).toHaveTextContent(
+        "Ctrl+Shift+O",
+      );
+    });
+
+    it("marks the default action so the shortcut has somewhere to land", () => {
+      // Which button that is depends on the URL, so the marker moves with the
+      // decision rather than the owner having to repeat it.
+      const { rerender } = render(
+        <UrlToast
+          url="https://github.com/login/device?code=ABCD"
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(
+        document.querySelector(URL_TOAST_PRIMARY_SELECTOR),
+      ).toHaveTextContent("Open");
+
+      rerender(
+        <UrlToast
+          url={SIGN_IN}
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(
+        document.querySelector(URL_TOAST_PRIMARY_SELECTOR),
+      ).toHaveTextContent("In container");
+    });
+
+    it("dismisses on Escape from anywhere inside it", () => {
+      const onDismiss = vi.fn();
+      render(
+        <UrlToast
+          url="https://example.com/"
+          onOpen={noop}
+          onDismiss={onDismiss}
+        />,
+      );
+      fireEvent.keyDown(screen.getByRole("button", { name: "Open" }), {
+        key: "Escape",
+      });
+      expect(onDismiss).toHaveBeenCalledTimes(1);
+    });
+
+    it("does not answer Escape pressed outside it", () => {
+      // Escape belongs to whatever is running in the terminal — vim, above all.
+      // A document-level binding would break it for everyone who never looked
+      // at this toast.
+      const onDismiss = vi.fn();
+      render(
+        <UrlToast
+          url="https://example.com/"
+          onOpen={noop}
+          onDismiss={onDismiss}
+        />,
+      );
+      fireEvent.keyDown(document.body, { key: "Escape" });
+      expect(onDismiss).not.toHaveBeenCalled();
+    });
+
+    it("gives every action a real button, so Tab reaches all three", () => {
+      render(
+        <UrlToast
+          url={SIGN_IN}
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      const names = screen
+        .getAllByRole("button")
+        .map((b) => b.getAttribute("aria-label") ?? b.textContent);
+      expect(names).toEqual(["In container", "Open", "Dismiss"]);
+      // Nothing is taken out of the tab order.
+      for (const b of screen.getAllByRole("button")) {
+        expect(b).not.toHaveAttribute("tabindex", "-1");
+      }
+    });
+  });
+
+  describe("Anthropic sign-in links", () => {
+    // The callback listener a `claude login` is waiting on is *inside* the
+    // container. Sending the user to their host browser completes the sign-in
+    // and then posts the result where nothing is listening, and the terminal
+    // hangs to its timeout — so for these, and only these, the container-side
+    // browser leads.
+    const SIGN_IN =
+      "https://claude.ai/oauth/authorize?code=true&client_id=abc&response_type=code";
+
+    function actions() {
+      return screen
+        .getAllByRole("button")
+        .map((b) => b.textContent)
+        .filter((t) => t === "Open" || t === "In container");
+    }
+
+    it("puts the container browser first", () => {
+      render(
+        <UrlToast
+          url={SIGN_IN}
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(actions()).toEqual(["In container", "Open"]);
+      expect(screen.getByTestId("url-toast-signin-hint")).toHaveTextContent(
+        /callback listener is inside the container/i,
+      );
+    });
+
+    it("keeps the host browser available as a fallback", () => {
+      const onOpen = vi.fn();
+      render(
+        <UrlToast
+          url={SIGN_IN}
+          onOpen={onOpen}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      screen.getByRole("button", { name: "Open" }).click();
+      expect(onOpen).toHaveBeenCalledTimes(1);
+    });
+
+    it("leaves an ordinary URL alone", () => {
+      // A `gh auth login` device code, a docs page, a preview build — the host
+      // browser is the right answer for all of them and stays the default.
+      render(
+        <UrlToast
+          url="https://github.com/login/device?code=ABCD-EFGH"
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(actions()).toEqual(["Open", "In container"]);
+      expect(screen.queryByTestId("url-toast-signin-hint")).not.toBeInTheDocument();
+    });
+
+    it("is not fooled by a lookalike host", () => {
+      // `isAnthropicSignInUrl` uses the same allowlist the sign-in flow does,
+      // so a URL that merely says "claude.ai" somewhere is not one.
+      render(
+        <UrlToast
+          url="https://claude.ai.evil.tld/oauth/authorize?x=1"
+          onOpen={noop}
+          onOpenInContainer={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(actions()).toEqual(["Open", "In container"]);
+    });
+  });
 });
diff --git a/app/src/components/terminal/UrlToast.tsx b/app/src/components/terminal/UrlToast.tsx
index 6874d31..ddad469 100644
--- a/app/src/components/terminal/UrlToast.tsx
+++ b/app/src/components/terminal/UrlToast.tsx
@@ -1,4 +1,32 @@
-import { urlOrigin } from "../../lib/urlRelay";
+import type { KeyboardEvent } from "react";
+import { isAnthropicSignInUrl, urlOrigin } from "../../lib/urlRelay";
+import Button from "../ui/Button";
+
+/**
+ * Marks the toast's subtree. `TerminalView` uses it to answer "is focus inside
+ * the thing I am about to unmount?", which is what decides whether dismissing
+ * has to hand focus back to the terminal.
+ */
+export const URL_TOAST_SELECTOR = '[data-testid="url-toast"]';
+
+/**
+ * The chord that jumps from the terminal into this toast.
+ *
+ * Bound in `TerminalView` on `document` in the capture phase, the same way
+ * `useKeyboardShortcuts` binds the app's other chords, because xterm would
+ * otherwise forward it to the shell. Shift is what keeps it clear of the
+ * terminal: plain Ctrl+O is readline's `operate-and-get-next`.
+ */
+export const URL_TOAST_SHORTCUT = "Ctrl+Shift+O";
+
+/**
+ * Marks the *default* action inside the toast, so the owner can put focus
+ * there without a ref threaded through `ui/Button` — which is a plain function
+ * component and not this file's to change. Which button it is depends on the
+ * URL (see the sign-in note below), so the attribute moves with the decision
+ * rather than the caller having to repeat it.
+ */
+export const URL_TOAST_PRIMARY_SELECTOR = '[data-url-toast-primary="true"]';
 
 interface Props {
   /** Already validated by `sanitizeRelayUrl` — this component never opens it. */
@@ -28,6 +56,40 @@ interface Props {
  * is shared and long-lived, so without one React mutates the node in place: the
  * text swaps with no animation, and a user reading URL A can click Open on URL
  * B that arrived a second later.
+ *
+ * ## Anthropic sign-in links default to the container's browser
+ *
+ * For an ordinary URL the host browser is the right answer and stays the
+ * default. For a sign-in it is the *wrong* one: the callback listener the CLI
+ * is waiting on is inside the container, so a host browser completes the sign-in
+ * and then posts the result somewhere nothing is listening, and the terminal
+ * hangs until it times out. Making the host button primary there was quietly
+ * steering every user into that. The container-side browser closes the loop
+ * with no host round trip and no auth bridge, so it leads — and the host button
+ * stays, because a user who has the auth bridge on, or who wants their existing
+ * browser session, still needs it.
+ *
+ * ## Reachable without a mouse, and it does not take focus to manage it
+ *
+ * This toast is the only route to completing a sign-in started in a terminal,
+ * and it used to be mouse-only: xterm's helper textarea swallows Tab, so there
+ * was no way to reach these buttons at all from the keyboard.
+ *
+ * The obvious fix — focus the default action when the toast appears — was
+ * rejected on two counts. The terminal underneath is *live*: the user may be
+ * mid-command, and every keystroke after the steal would go to a button instead
+ * of the shell. Worse, the default action opens a URL chosen by the untrusted
+ * side of the sandbox, and a focused button is one stray Space or Enter away
+ * from doing it. This prompt exists precisely to make that a deliberate act.
+ *
+ * So focus stays where the user put it and the toast is reachable on demand:
+ * {@link URL_TOAST_SHORTCUT} jumps to the default action (the hint is on
+ * screen, next to the label, because a shortcut nobody is told about is not a
+ * route), Tab then moves between the actions normally — this subtree is not
+ * inside xterm — and Escape dismisses. Escape is handled *here*, on the
+ * toast's own subtree, rather than globally: Escape belongs to whatever is
+ * running in the terminal, and a document-level binding for it would break vim
+ * for everyone who never looked at this toast.
  */
 export default function UrlToast({
   url,
@@ -38,11 +100,60 @@ export default function UrlToast({
 }: Props) {
   const origin = urlOrigin(url);
   const rest = origin && url.startsWith(origin) ? url.slice(origin.length) : url;
+  // Only when there is somewhere to send it: without `onOpenInContainer` the
+  // host button is the only action there is, so it stays primary.
+  const signIn = !!onOpenInContainer && isAnthropicSignInUrl(url);
+
+  // `Button` already owns the filled/outlined variants — including the rule
+  // that filled uses `--accent-emphasis` and never `--accent`, which is the
+  // foreground/link accent and fails WCAG AA behind white text.
+  const hostButton = (
+    <Button
+      variant={signIn ? "secondary" : "primary"}
+      data-url-toast-primary={signIn ? undefined : "true"}
+      onClick={onOpen}
+      className="flex-shrink-0"
+      title={
+        signIn
+          ? "Open in your own browser instead — the callback then has to reach the container by some other route"
+          : undefined
+      }
+    >
+      Open
+    </Button>
+  );
+
+  const containerButton = onOpenInContainer && (
+    // A sign-in completed in the *container's* browser lands its callback on
+    // the container's own loopback, which is where the tool waiting for it is
+    // listening — no host round trip, no auth bridge.
+    <Button
+      variant={signIn ? "primary" : "secondary"}
+      data-url-toast-primary={signIn ? "true" : undefined}
+      onClick={onOpenInContainer}
+      className="flex-shrink-0"
+      title="Open in a browser inside the container, and watch it in the Browser tab"
+    >
+      In container
+    </Button>
+  );
+
+  const onKeyDown = (e: KeyboardEvent<HTMLDivElement>) => {
+    if (e.key !== "Escape") return;
+    // Scoped to this subtree, so the terminal's own Escape is untouched.
+    e.preventDefault();
+    e.stopPropagation();
+    onDismiss();
+  };
 
   return (
     <div
       className="animate-slide-down"
+      data-testid="url-toast"
       role="status"
+      aria-atomic="true"
+      aria-keyshortcuts="Control+Shift+O"
+      onKeyDown={onKeyDown}
       style={{
         position: "absolute",
         top: 12,
@@ -56,7 +167,7 @@ export default function UrlToast({
         background: "var(--bg-secondary)",
         border: "1px solid var(--border-color)",
         borderRadius: 8,
-        boxShadow: "0 4px 12px rgba(0,0,0,0.4)",
+        boxShadow: "var(--shadow-overlay)",
         maxWidth: "min(90%, 600px)",
       }}
     >
@@ -69,6 +180,11 @@ export default function UrlToast({
           }}
         >
           {label}
+          {" · "}
+          <span data-testid="url-toast-shortcut" style={{ fontFamily: "monospace" }}>
+            {URL_TOAST_SHORTCUT}
+          </span>{" "}
+          to reach the buttons, Esc to dismiss
         </div>
         <div
           data-testid="url-toast-url"
@@ -109,79 +225,44 @@ export default function UrlToast({
             {rest}
           </span>
         </div>
+        {signIn && (
+          <div
+            data-testid="url-toast-signin-hint"
+            style={{
+              marginTop: 3,
+              fontSize: 11,
+              color: "var(--text-secondary)",
+              lineHeight: 1.35,
+            }}
+          >
+            Sign-in link — the callback listener is inside the container.
+            Opening it there closes the loop; the host browser needs the auth
+            bridge.
+          </div>
+        )}
       </div>
 
-      <button
-        onClick={onOpen}
-        style={{
-          padding: "4px 12px",
-          fontSize: 12,
-          fontWeight: 600,
-          color: "#fff",
-          background: "var(--accent)",
-          border: "none",
-          borderRadius: 4,
-          cursor: "pointer",
-          whiteSpace: "nowrap",
-          flexShrink: 0,
-        }}
-        onMouseEnter={(e) =>
-          (e.currentTarget.style.background = "var(--accent-hover)")
-        }
-        onMouseLeave={(e) =>
-          (e.currentTarget.style.background = "var(--accent)")
-        }
-      >
-        Open
-      </button>
-
-      {onOpenInContainer && (
-        // A sign-in completed in the *container's* browser lands its callback
-        // on the container's own loopback, which is where the tool waiting for
-        // it is listening — no host round trip, no auth bridge.
-        <button
-          onClick={onOpenInContainer}
-          title="Open in a browser inside the container, and watch it in the Browser tab"
-          style={{
-            padding: "4px 10px",
-            fontSize: 12,
-            fontWeight: 600,
-            color: "var(--text-primary)",
-            background: "transparent",
-            border: "1px solid var(--border-color)",
-            borderRadius: 4,
-            cursor: "pointer",
-            whiteSpace: "nowrap",
-            flexShrink: 0,
-          }}
-        >
-          In container
-        </button>
+      {signIn ? (
+        <>
+          {containerButton}
+          {hostButton}
+        </>
+      ) : (
+        <>
+          {hostButton}
+          {containerButton}
+        </>
       )}
 
-      <button
+      <Button
+        variant="ghost"
         onClick={onDismiss}
-        style={{
-          padding: "2px 6px",
-          fontSize: 14,
-          lineHeight: 1,
-          color: "var(--text-secondary)",
-          background: "transparent",
-          border: "none",
-          borderRadius: 4,
-          cursor: "pointer",
-          flexShrink: 0,
-        }}
-        onMouseEnter={(e) =>
-          (e.currentTarget.style.color = "var(--text-primary)")
-        }
-        onMouseLeave={(e) =>
-          (e.currentTarget.style.color = "var(--text-secondary)")
-        }
+        className="flex-shrink-0"
         aria-label="Dismiss"
+        title="Dismiss (Esc)"
       >
         ✕
-      </button>
+      </Button>
     </div>
   );
 }
diff --git a/app/src/components/ui/Modal.test.tsx b/app/src/components/ui/Modal.test.tsx
index 0f33602..ecf72c1 100644
--- a/app/src/components/ui/Modal.test.tsx
+++ b/app/src/components/ui/Modal.test.tsx
@@ -1,6 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { render, screen, fireEvent, act } from "@testing-library/react";
 import Modal from "./Modal";
+import { PaneVisibilityProvider } from "./PaneVisibility";
+import { dropIsBlocked } from "../../lib/dropTarget";
 
 /**
  * Modal focuses asynchronously via rAF so the panel is laid out first; jsdom
@@ -102,6 +104,108 @@ describe("Modal", () => {
     expect(container).toBeTruthy();
   });
 
+  // -------------------------------------------------------------------------
+  // Stepping aside with the pane that owns it
+  // -------------------------------------------------------------------------
+
+  it("marks its backdrop as swallowing native file drops", async () => {
+    // `lib/dropTarget` refuses every drop in the window while a dialog is on
+    // screen, and this marker is half of how it knows one is (the panel's
+    // `aria-modal` is the other half).
+    render(
+      <Modal title="Reset" onClose={vi.fn()}>
+        <p>body</p>
+      </Modal>,
+    );
+    const backdrop = document.querySelector(".fixed.inset-0");
+    expect(backdrop).toHaveAttribute("data-blocks-drop", "true");
+    expect(dropIsBlocked()).toBe(true);
+  });
+
+  it("paints nothing, traps nothing and blocks no drop while its pane is hidden", async () => {
+    // A dialog portals to `document.body`, where the `hidden` class its pane
+    // uses to step aside for another tab cannot reach it. Left to itself it
+    // stayed on screen over the tab the user switched to, kept its Escape
+    // binding, and refused every native file drop in the window.
+    const onClose = vi.fn();
+    const { rerender } = render(
+      <PaneVisibilityProvider visible={false}>
+        <Modal title="Reset" onClose={onClose}>
+          <button>Confirm</button>
+        </Modal>
+      </PaneVisibilityProvider>,
+    );
+    await flushFocus();
+
+    const backdrop = document.querySelector(".fixed.inset-0") as HTMLElement;
+    expect(backdrop.hidden).toBe(true);
+    expect(backdrop.style.display).toBe("none");
+    expect(dropIsBlocked()).toBe(false);
+    // Two independent reasons it does not block, because they are maintained
+    // in two files: the marker is gone *and* `[hidden]` disqualifies it.
+    expect(backdrop.hasAttribute("data-blocks-drop")).toBe(false);
+    expect(backdrop.contains(document.activeElement)).toBe(false);
+
+    fireEvent.keyDown(document, { key: "Escape" });
+    expect(onClose).not.toHaveBeenCalled();
+
+    // Back on screen: the same dialog, still mounted, resumes everything.
+    // (Including the marker: it is dropped on hide, not written once at mount.)
+    rerender(
+      <PaneVisibilityProvider visible={true}>
+        <Modal title="Reset" onClose={onClose}>
+          <button>Confirm</button>
+        </Modal>
+      </PaneVisibilityProvider>,
+    );
+    await flushFocus();
+    expect(backdrop.hidden).toBe(false);
+    expect(dropIsBlocked()).toBe(true);
+    expect(screen.getByRole("dialog").contains(document.activeElement)).toBe(true);
+    fireEvent.keyDown(document, { key: "Escape" });
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not leave focus inside itself when its pane steps aside", async () => {
+    // The dialog goes `display:none` with the keyboard focus still inside it,
+    // and nothing else relocates it — so the user arrives on the tab they
+    // switched to with focus held by a dialog they cannot see, Tab resuming
+    // from inside it. jsdom does not blur on `display:none` either, so this
+    // is exactly the state the assertion below describes.
+    const { rerender } = render(
+      <PaneVisibilityProvider visible={true}>
+        <Modal title="Reset" onClose={vi.fn()}>
+          <button>Confirm</button>
+        </Modal>
+      </PaneVisibilityProvider>,
+    );
+    await flushFocus();
+    const panel = screen.getByRole("dialog");
+    expect(panel.contains(document.activeElement)).toBe(true);
+
+    rerender(
+      <PaneVisibilityProvider visible={false}>
+        <Modal title="Reset" onClose={vi.fn()}>
+          <button>Confirm</button>
+        </Modal>
+      </PaneVisibilityProvider>,
+    );
+    await flushFocus();
+    expect(panel.contains(document.activeElement)).toBe(false);
+    expect(document.activeElement).toBe(document.body);
+
+    // …and coming back puts it where it was: inside the dialog.
+    rerender(
+      <PaneVisibilityProvider visible={true}>
+        <Modal title="Reset" onClose={vi.fn()}>
+          <button>Confirm</button>
+        </Modal>
+      </PaneVisibilityProvider>,
+    );
+    await flushFocus();
+    expect(screen.getByRole("dialog").contains(document.activeElement)).toBe(true);
+  });
+
   it("ignores Escape and overlay clicks when not dismissible", async () => {
     const onClose = vi.fn();
     render(
diff --git a/app/src/components/ui/Modal.tsx b/app/src/components/ui/Modal.tsx
index cbe48b3..7755a4b 100644
--- a/app/src/components/ui/Modal.tsx
+++ b/app/src/components/ui/Modal.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useId, useRef, type ReactNode } from "react";
 import { createPortal } from "react-dom";
+import { usePaneVisible } from "./PaneVisibility";
 
 const FOCUSABLE_SELECTOR = [
   "a[href]",
@@ -66,26 +67,51 @@ export default function Modal({
   const restoreFocusRef = useRef<HTMLElement | null>(null);
   const titleId = useId();
   const descId = useId();
+  // A dialog portals to `document.body`, so the `hidden` class its pane uses to
+  // step aside for another tab cannot reach it. `PaneVisibility` is how it
+  // finds out, and while it is false this dialog paints nothing, traps
+  // nothing, holds no focus, and blocks no native file drop.
+  const paneVisible = usePaneVisible();
+  const paneVisibleRef = useRef(paneVisible);
+  paneVisibleRef.current = paneVisible;
 
-  // Remember what had focus, move focus inside, restore on unmount.
+  // Remember what had focus, and restore it on unmount — but not if the pane
+  // is hidden by then: a dialog closed while the user is on another tab would
+  // otherwise yank focus back to a control they cannot see.
   useEffect(() => {
     restoreFocusRef.current = document.activeElement as HTMLElement | null;
-    const panel = panelRef.current;
-    if (panel) {
-      const target =
-        initialFocusRef?.current ?? focusableWithin(panel)[0] ?? panel;
-      // Defer so the panel is laid out (offsetParent) before we query it.
-      requestAnimationFrame(() => target.focus?.());
-    }
     return () => {
-      restoreFocusRef.current?.focus?.();
+      if (paneVisibleRef.current) restoreFocusRef.current?.focus?.();
     };
-    // Mount/unmount only — re-running would steal focus mid-interaction.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
-  // Escape closes; Tab is trapped inside the panel.
+  // Move focus inside — on mount, and again whenever the pane comes back. And
+  // move it *out* when the pane steps aside: the backdrop goes `display:none`
+  // with the keyboard focus still inside it, and nothing else relocates it, so
+  // the user lands on the new tab with focus held by a dialog they cannot see.
+  // Blurring puts it on `<body>`, which is where a fresh Tab starts.
   useEffect(() => {
+    const panel = panelRef.current;
+    if (!panel) return;
+    if (!paneVisible) {
+      const active = panel.ownerDocument.activeElement as HTMLElement | null;
+      if (active && panel.contains(active)) active.blur?.();
+      return;
+    }
+    const target = initialFocusRef?.current ?? focusableWithin(panel)[0] ?? panel;
+    // Defer so the panel is laid out (offsetParent) before we query it.
+    const frame = requestAnimationFrame(() => target.focus?.());
+    return () => cancelAnimationFrame(frame);
+    // `initialFocusRef` is a ref object; re-running on its identity would steal
+    // focus mid-interaction.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [paneVisible]);
+
+  // Escape closes; Tab is trapped inside the panel. Neither applies while the
+  // pane is hidden — those keystrokes belong to whatever the user is looking
+  // at instead.
+  useEffect(() => {
+    if (!paneVisible) return;
     const onKeyDown = (e: KeyboardEvent) => {
       if (e.key === "Escape" && dismissible) {
         e.stopPropagation();
@@ -119,7 +145,7 @@ export default function Modal({
     };
     document.addEventListener("keydown", onKeyDown, true);
     return () => document.removeEventListener("keydown", onKeyDown, true);
-  }, [dismissible, onClose]);
+  }, [dismissible, onClose, paneVisible]);
 
   const handleOverlayClick = useCallback(
     (e: React.MouseEvent<HTMLDivElement>) => {
@@ -133,6 +159,16 @@ export default function Modal({
       ref={overlayRef}
       onClick={handleOverlayClick}
       className="fixed inset-0 bg-black/60 flex items-center justify-center z-50 p-4"
+      /* This dialog swallows native file drops for as long as it is on screen.
+         Dropped while the owning pane is hidden, so a dialog parked on another
+         tab does not keep refusing drops here — `lib/dropTarget.ts` also
+         filters `[hidden]`, and these two must not disagree. */
+      data-blocks-drop={paneVisible ? "true" : undefined}
+      hidden={!paneVisible}
+      aria-hidden={paneVisible ? undefined : true}
+      /* `hidden` is a base-layer rule and `flex` is a utility-layer one, so the
+         attribute alone loses. Inline wins over both. */
+      style={paneVisible ? undefined : { display: "none" }}
     >
       <div
         ref={panelRef}
diff --git a/app/src/components/ui/PaneVisibility.tsx b/app/src/components/ui/PaneVisibility.tsx
new file mode 100644
index 0000000..e9eee44
--- /dev/null
+++ b/app/src/components/ui/PaneVisibility.tsx
@@ -0,0 +1,40 @@
+import { createContext, useContext, type ReactNode } from "react";
+
+/**
+ * "Is the pane I belong to the one on screen?"
+ *
+ * The main area keeps every tab *mounted* and hides the inactive ones with a
+ * `hidden` class, so their state survives a tab switch. A `ui/Modal` opened
+ * inside one of those panes does not go quiet when its pane does: it portals
+ * to `document.body`, where an ancestor's `display:none` cannot reach it. So a
+ * dialog opened in project A stayed painted over project B after a tab switch,
+ * kept its focus trap and its Escape binding, and — because it is a blocking
+ * overlay — refused every native file drop in the window.
+ *
+ * `App` publishes the answer around each pane it mounts — it is what decides
+ * which one is on screen — and `Modal` reads it. Nothing else needs to:
+ * dialogs are the only thing in the app that escapes its pane's subtree.
+ *
+ * Default `true`, so a dialog with no pane above it — host settings, the
+ * Docker install prompt — behaves exactly as it always has.
+ */
+const PaneVisibilityContext = createContext(true);
+
+export function PaneVisibilityProvider({
+  visible,
+  children,
+}: {
+  visible: boolean;
+  children: ReactNode;
+}) {
+  return (
+    <PaneVisibilityContext.Provider value={visible}>
+      {children}
+    </PaneVisibilityContext.Provider>
+  );
+}
+
+/** True unless an ancestor pane says it is currently hidden. */
+export function usePaneVisible(): boolean {
+  return useContext(PaneVisibilityContext);
+}
diff --git a/app/src/components/ui/ToastHost.tsx b/app/src/components/ui/ToastHost.tsx
index 008b0d5..2d383f1 100644
--- a/app/src/components/ui/ToastHost.tsx
+++ b/app/src/components/ui/ToastHost.tsx
@@ -47,7 +47,16 @@ function ToastCard({ toast, onDismiss }: { toast: Toast; onDismiss: () => void }
         {tone.glyph}
       </span>
       <div className="flex-1 min-w-0">
-        <div className="text-[var(--text-primary)] break-words">{toast.message}</div>
+        {/* Clamped. A toast message is normally a sentence, but some of them
+            quote text a *container* wrote — and this card is `z-[60]`, above
+            every modal, with its dismiss button at the top. An unclamped
+            message of a few kilobytes is a card taller than the viewport whose
+            ✕ has been pushed off-screen, i.e. an unclosable overlay. The
+            `detail` block below has always had `max-h-40 overflow-auto`; this
+            half did not. */}
+        <div className="text-[var(--text-primary)] break-words max-h-40 overflow-y-auto">
+          {toast.message}
+        </div>
         {toast.detail && (
           <>
             <button
diff --git a/app/src/hooks/useClaudeAuth.ts b/app/src/hooks/useClaudeAuth.ts
index 8fcb7a2..b6c0188 100644
--- a/app/src/hooks/useClaudeAuth.ts
+++ b/app/src/hooks/useClaudeAuth.ts
@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { listen, type UnlistenFn } from "@tauri-apps/api/event";
 import * as commands from "../lib/tauri-commands";
-import { ANTHROPIC_SIGN_IN_HOSTS, sanitizeRelayUrl } from "../lib/urlRelay";
+import { ANTHROPIC_SIGN_IN_HOSTS, extendsUrl, sanitizeRelayUrl } from "../lib/urlRelay";
 import type {
   ClaudeTokenCodeRejectedEvent,
   ClaudeTokenLinkEvent,
@@ -67,7 +67,8 @@ export function authErrorMessage(e: unknown, fallback: string): string {
  *    starts with it. That is the case longest-wins existed for — a repainting
  *    TUI can land a truncated copy of the same link in the transcript before
  *    the complete one — and it cannot swap the origin, because a longer string
- *    with the same prefix has the same host.
+ *    with the same prefix has the same host. {@link extendsUrl} is that rule;
+ *    the terminal's URL prompt slot shares it.
  */
 export function pickSignInUrl(candidates: readonly string[]): string | null {
   const cleaned = candidates
@@ -79,7 +80,7 @@ export function pickSignInUrl(candidates: readonly string[]): string | null {
 
   let best: string | null = null;
   for (const url of pool) {
-    if (best === null || url.startsWith(best)) best = url;
+    if (best === null || extendsUrl(url, best)) best = url;
   }
   return best;
 }
diff --git a/app/src/hooks/useFileManager.test.ts b/app/src/hooks/useFileManager.test.ts
new file mode 100644
index 0000000..0b606ae
--- /dev/null
+++ b/app/src/hooks/useFileManager.test.ts
@@ -0,0 +1,561 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { useFileManager } from "./useFileManager";
+import type { FileEntry } from "../lib/types";
+
+const listContainerFiles = vi.fn();
+const renameContainerPath = vi.fn();
+const createContainerDirectory = vi.fn();
+const uploadFilesToContainer = vi.fn();
+const downloadContainerFile = vi.fn();
+
+vi.mock("../lib/tauri-commands", () => ({
+  listContainerFiles: (p: string, path: string) => listContainerFiles(p, path),
+  renameContainerPath: (p: string, f: string, t: string) => renameContainerPath(p, f, t),
+  createContainerDirectory: (p: string, parent: string, n: string) =>
+    createContainerDirectory(p, parent, n),
+  uploadFilesToContainer: (p: string, dir: string) => uploadFilesToContainer(p, dir),
+  downloadContainerFile: (p: string, path: string) => downloadContainerFile(p, path),
+  readContainerFile: vi.fn(),
+}));
+
+/**
+ * Transient failures go to `ToastHost` rather than an inline string — see the
+ * comment at the top of `useFileManager`. The store is mocked down to the one
+ * method the hook reaches for.
+ */
+const pushToast = vi.fn();
+vi.mock("../store/appState", () => ({
+  useAppState: { getState: () => ({ pushToast }) },
+}));
+
+/** Everything the hook has said through the toast host, message and detail. */
+const toastText = () =>
+  pushToast.mock.calls
+    .map(([toast]) => `${toast.kind}: ${toast.message} ${toast.detail ?? ""}`)
+    .join("\n");
+
+const file = (name: string, extra: Partial<FileEntry> = {}): FileEntry => ({
+  name,
+  path: `/workspace/${name}`,
+  is_directory: false,
+  is_symlink: false,
+  size: 10,
+  modified: "2024-01-01 00:00:00",
+  permissions: "644",
+  ...extra,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  listContainerFiles.mockResolvedValue([file("a.txt")]);
+  uploadFilesToContainer.mockResolvedValue({ uploaded: [], failures: [] });
+  downloadContainerFile.mockResolvedValue(0);
+});
+
+describe("useFileManager navigation", () => {
+  it("lists a directory and remembers where it is", async () => {
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app");
+    });
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace/app");
+    expect(result.current.currentPath).toBe("/workspace/app");
+    expect(result.current.entries).toHaveLength(1);
+  });
+
+  it("surfaces a listing failure rather than showing a stale directory", async () => {
+    listContainerFiles.mockRejectedValueOnce("Permission denied");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/root");
+    });
+    expect(result.current.error).toContain("Permission denied");
+    expect(result.current.currentPath).toBe("/workspace");
+  });
+
+  it("goes up one level, and stops at the root", async () => {
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app/src");
+    });
+    await act(async () => {
+      result.current.goUp();
+    });
+    await waitFor(() => expect(result.current.currentPath).toBe("/workspace/app"));
+
+    await act(async () => {
+      await result.current.navigate("/");
+    });
+    listContainerFiles.mockClear();
+    await act(async () => {
+      result.current.goUp();
+    });
+    expect(listContainerFiles).not.toHaveBeenCalled();
+  });
+});
+
+describe("useFileManager rename and mkdir", () => {
+  it("sends the bare new name, never a path, and re-lists on success", async () => {
+    renameContainerPath.mockResolvedValue("/workspace/renamed.txt");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace");
+    });
+    listContainerFiles.mockClear();
+
+    let ok: boolean | undefined;
+    await act(async () => {
+      ok = await result.current.renameEntry(file("a.txt"), "  renamed.txt  ");
+    });
+    expect(ok).toBe(true);
+    expect(renameContainerPath).toHaveBeenCalledWith("p1", "/workspace/a.txt", "renamed.txt");
+    expect(listContainerFiles).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps the editor open and shows what the container said when a rename fails", async () => {
+    // Renames outside /workspace legitimately fail; the user needs mv's words.
+    renameContainerPath.mockRejectedValue("mv: cannot move '/etc/hosts': Permission denied");
+    const { result } = renderHook(() => useFileManager("p1"));
+    let ok: boolean | undefined;
+    await act(async () => {
+      ok = await result.current.renameEntry(file("hosts"), "hosts.bak");
+    });
+    expect(ok).toBe(false);
+    expect(toastText()).toContain("Permission denied");
+  });
+
+  it("treats an unchanged name as a no-op rather than a round trip", async () => {
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.renameEntry(file("a.txt"), "a.txt");
+    });
+    expect(renameContainerPath).not.toHaveBeenCalled();
+  });
+
+  it("creates a folder under the current directory", async () => {
+    createContainerDirectory.mockResolvedValue("/workspace/app/new");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app");
+    });
+    await act(async () => {
+      await result.current.createFolder(" new ");
+    });
+    expect(createContainerDirectory).toHaveBeenCalledWith("p1", "/workspace/app", "new");
+  });
+
+  it("surfaces a clash instead of silently doing nothing", async () => {
+    createContainerDirectory.mockRejectedValue("mkdir: cannot create directory 'src': File exists");
+    const { result } = renderHook(() => useFileManager("p1"));
+    let ok: boolean | undefined;
+    await act(async () => {
+      ok = await result.current.createFolder("src");
+    });
+    expect(ok).toBe(false);
+    expect(toastText()).toContain("File exists");
+  });
+});
+
+describe("useFileManager stays where the user is", () => {
+  it("does not drag the pane back when the user navigates away mid-operation", async () => {
+    // The closure captured `/workspace`; the user is in `/workspace/src` by the
+    // time the rename finishes. Re-listing the *captured* path is what used to
+    // yank them out of the directory they had walked into.
+    let failRename: (reason: unknown) => void = () => {};
+    // `Once`, deliberately: `clearAllMocks` clears calls but not
+    // implementations, so a never-settling one would hang every test after it.
+    renameContainerPath.mockImplementationOnce(
+      () => new Promise((_resolve, reject) => { failRename = reject; }),
+    );
+    const { result } = renderHook(() => useFileManager("p1"));
+
+    let rename!: Promise<boolean>;
+    await act(async () => {
+      rename = result.current.renameEntry(file("big.bin"), "bigger.bin");
+      await Promise.resolve();
+    });
+
+    listContainerFiles.mockResolvedValue([file("index.ts", { path: "/workspace/src/index.ts" })]);
+    await act(async () => {
+      await result.current.navigate("/workspace/src");
+    });
+    listContainerFiles.mockClear();
+
+    await act(async () => {
+      failRename("mv: no space left on device");
+      await rename;
+    });
+
+    expect(result.current.currentPath).toBe("/workspace/src");
+    expect(result.current.entries.map((e) => e.name)).toEqual(["index.ts"]);
+    // No re-list of the directory the rename targeted…
+    expect(listContainerFiles).not.toHaveBeenCalled();
+    // …and no failure text painted over the listing that replaced it.
+    expect(result.current.error).toBeNull();
+    expect(toastText()).toContain("no space left");
+  });
+
+  it("re-lists when the user stayed put, which is the ordinary case", async () => {
+    renameContainerPath.mockResolvedValue("/workspace/b.txt");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace");
+    });
+    listContainerFiles.mockClear();
+    await act(async () => {
+      await result.current.renameEntry(file("a.txt"), "b.txt");
+    });
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace");
+  });
+
+  it("lets the newest listing win when a slow one lands last", async () => {
+    // Two listings in flight, and the slower one is not necessarily the older
+    // one. Landing last used to set both the rows and the breadcrumb back.
+    let landSlow: (entries: FileEntry[]) => void = () => {};
+    listContainerFiles.mockImplementationOnce(
+      () => new Promise((resolve) => { landSlow = resolve; }),
+    );
+    listContainerFiles.mockResolvedValueOnce([file("new.txt")]);
+    const { result } = renderHook(() => useFileManager("p1"));
+
+    let slow!: Promise<void>;
+    await act(async () => {
+      slow = result.current.navigate("/workspace/slow");
+      await Promise.resolve();
+    });
+    await act(async () => {
+      await result.current.navigate("/workspace/fast");
+    });
+    expect(result.current.currentPath).toBe("/workspace/fast");
+
+    await act(async () => {
+      landSlow([file("stale.txt")]);
+      await slow;
+    });
+
+    expect(result.current.currentPath).toBe("/workspace/fast");
+    expect(result.current.entries.map((e) => e.name)).toEqual(["new.txt"]);
+  });
+
+  it("keeps a failed navigation from claiming the directory it never reached", async () => {
+    listContainerFiles.mockRejectedValueOnce("Permission denied");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/root");
+    });
+    listContainerFiles.mockClear();
+    // The pane never left /workspace, so a new folder made now lands there.
+    await act(async () => {
+      await result.current.createFolder("new");
+    });
+    expect(createContainerDirectory).toHaveBeenCalledWith("p1", "/workspace", "new");
+  });
+});
+
+/**
+ * Refusals the backend already phrased for a person. `ToastHost` renders a
+ * `detail` as collapsed monospace behind a "Details" button, so a sentence
+ * reported that way is a sentence nobody reads.
+ */
+describe("useFileManager surfaces written refusals as prose", () => {
+  const outsideRoots =
+    "Folder path is outside the folders this panel can change (/workspace, /home/claude, /tmp): /etc";
+
+  /** The toast this operation pushed. */
+  const lastToast = () => pushToast.mock.calls.at(-1)?.[0];
+
+  it("puts the write-root refusal in the headline, not behind Details", async () => {
+    createContainerDirectory.mockRejectedValueOnce(outsideRoots);
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.createFolder("new");
+    });
+
+    expect(lastToast().message).toBe(outsideRoots);
+    expect(lastToast().detail).toBeUndefined();
+    expect(lastToast().message).not.toMatch(/^Error:/);
+  });
+
+  it("unwraps an `Error` rather than stamping \"Error:\" on prose", async () => {
+    renameContainerPath.mockRejectedValueOnce(new Error(outsideRoots));
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.renameEntry(file("a.txt"), "b.txt");
+    });
+
+    expect(lastToast().message).toBe(outsideRoots);
+  });
+
+  it("keeps the hook's own headline when the failure is not a written refusal", async () => {
+    createContainerDirectory.mockRejectedValueOnce("no space left on device");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.createFolder("new");
+    });
+
+    expect(lastToast().message).toBe('Could not create "new"');
+    expect(lastToast().detail).toBe("no space left on device");
+  });
+});
+
+/**
+ * Both of these actions are *dialog-driven from Rust* — the hook passes a
+ * project and a directory and gets back an answer, and there is deliberately no
+ * host path anywhere in this file. What is worth pinning is the vocabulary of
+ * that answer, because two of its values look like failure and are not: `null`
+ * means the user dismissed the picker, and `0` bytes means an empty file was
+ * saved successfully.
+ */
+describe("useFileManager saving to the host", () => {
+  it("treats a zero-byte save as a success", async () => {
+    // The bug this exists for: `if (!bytes) return` reads a genuine
+    // zero-length file — an empty `.gitkeep`, a truncated log — as a
+    // dismissal, so the file lands on the host and the app says nothing at
+    // all. The sentinel is `null`, and only `null`.
+    downloadContainerFile.mockResolvedValueOnce(0);
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.saveToHost(file("empty.txt"));
+    });
+    expect(result.current.completed).toContain("empty.txt");
+    expect(pushToast).not.toHaveBeenCalled();
+  });
+
+  it("says nothing at all when the dialog is dismissed", async () => {
+    downloadContainerFile.mockResolvedValueOnce(null);
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.saveToHost(file("a.txt"));
+    });
+    expect(result.current.completed).toBeNull();
+    expect(pushToast).not.toHaveBeenCalled();
+  });
+
+  it("names the file in a refusal", async () => {
+    downloadContainerFile.mockRejectedValueOnce("/etc/shadow is not readable");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.saveToHost(file("secret.txt"));
+    });
+    expect(toastText()).toContain("secret.txt");
+  });
+});
+
+describe("useFileManager uploading from the host", () => {
+  it("uploads into the directory on screen and shows the result", async () => {
+    uploadFilesToContainer.mockResolvedValueOnce({
+      uploaded: ["/workspace/app/one.txt", "/workspace/app/two.txt"],
+      failures: [],
+    });
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app");
+    });
+    listContainerFiles.mockClear();
+    await act(async () => {
+      await result.current.uploadFiles();
+    });
+    expect(uploadFilesToContainer).toHaveBeenCalledWith("p1", "/workspace/app");
+    expect(result.current.completed).toContain("2 files");
+    // The directory is named. `target` is captured at click time and the
+    // picker is a modal dialog, so "Uploaded 2 files." on its own can be shown
+    // in front of a grid those files are not in.
+    expect(result.current.completed).toContain("/workspace/app");
+    // The new files are only on screen if the listing was asked for again.
+    expect(listContainerFiles).toHaveBeenCalledWith("p1", "/workspace/app");
+  });
+
+  it("reports every file that failed, not just a count", async () => {
+    // "3 of 5 uploaded" without naming the two is not a report — the user
+    // cannot tell which ones to retry, or why.
+    uploadFilesToContainer.mockResolvedValueOnce({
+      uploaded: ["/workspace/ok.txt"],
+      failures: [
+        "/home/j/Pictures is a folder — upload its files individually.",
+        "/home/j/vm.img is too large to upload (900 MB; limit 256 MB).",
+      ],
+    });
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.uploadFiles();
+    });
+    expect(pushToast).toHaveBeenCalledTimes(2);
+    expect(toastText()).toContain("is a folder");
+    expect(toastText()).toContain("too large");
+    // A partial batch still succeeded partially, and the pane must show it.
+    expect(result.current.completed).toContain("1 file");
+  });
+
+  it("does not refresh when the picker was dismissed", async () => {
+    uploadFilesToContainer.mockResolvedValueOnce(null);
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app");
+    });
+    listContainerFiles.mockClear();
+    await act(async () => {
+      await result.current.uploadFiles();
+    });
+    expect(listContainerFiles).not.toHaveBeenCalled();
+    expect(pushToast).not.toHaveBeenCalled();
+    expect(result.current.completed).toBeNull();
+  });
+
+  it("reports a refusal that happened before the picker once, not per file", async () => {
+    // No container, not running, or a directory this pane may not write to.
+    // There is no selection yet, so there is nothing to enumerate.
+    uploadFilesToContainer.mockRejectedValueOnce(
+      "Start the project before uploading files — it runs inside the running container.",
+    );
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.uploadFiles();
+    });
+    expect(pushToast).toHaveBeenCalledTimes(1);
+    expect(toastText()).toContain("Start the project");
+  });
+
+  it("does not drag the pane back when the user navigated during the upload", async () => {
+    // The same rule rename and new-folder follow: a slow operation must not
+    // relist a directory the user has already left.
+    let release: (v: unknown) => void = () => {};
+    uploadFilesToContainer.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve;
+      }),
+    );
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.navigate("/workspace/app");
+    });
+    let uploading: Promise<void>;
+    act(() => {
+      uploading = result.current.uploadFiles();
+    });
+    await act(async () => {
+      await result.current.navigate("/workspace/other");
+    });
+    listContainerFiles.mockClear();
+    await act(async () => {
+      release({ uploaded: ["/workspace/app/one.txt"], failures: [] });
+      await uploading;
+    });
+    expect(listContainerFiles).not.toHaveBeenCalled();
+    expect(result.current.currentPath).toBe("/workspace/other");
+  });
+});
+
+describe("useFileManager transfer state", () => {
+  it("marks an upload in flight for as long as it runs", async () => {
+    // Without this the button stays live: a second click opens a second OS
+    // dialog and runs a second concurrent exec, and a slow transfer looks
+    // exactly like a click that did nothing.
+    let release: (v: unknown) => void = () => {};
+    uploadFilesToContainer.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve;
+      }),
+    );
+    const { result } = renderHook(() => useFileManager("p1"));
+    expect(result.current.uploading).toBe(false);
+    let uploading: Promise<void>;
+    act(() => {
+      uploading = result.current.uploadFiles();
+    });
+    expect(result.current.uploading).toBe(true);
+    await act(async () => {
+      release({ uploaded: [], failures: [] });
+      await uploading;
+    });
+    expect(result.current.uploading).toBe(false);
+  });
+
+  it("stays in flight through the refresh, not just the transfer", async () => {
+    // Clearing the flag the moment the command settled put the button back
+    // while the re-listing was still running, so a second click landed
+    // mid-refresh on a grid that was still showing the old contents.
+    uploadFilesToContainer.mockResolvedValueOnce({
+      uploaded: ["/workspace/a.txt"],
+      failures: [],
+    });
+    let finishListing: (v: unknown) => void = () => {};
+    listContainerFiles.mockReturnValueOnce(
+      new Promise((resolve) => {
+        finishListing = resolve;
+      }),
+    );
+    const { result } = renderHook(() => useFileManager("p1"));
+    let uploading: Promise<void>;
+    act(() => {
+      uploading = result.current.uploadFiles();
+    });
+    await act(async () => {
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    // The transfer is done; the listing it triggered is not.
+    expect(result.current.uploading).toBe(true);
+    await act(async () => {
+      finishListing([file("a.txt")]);
+      await uploading;
+    });
+    expect(result.current.uploading).toBe(false);
+  });
+
+  it("clears the upload flag when the transfer fails", async () => {
+    // The `catch` returns early, so without a `finally` the button is disabled
+    // for the rest of the session — the failure mode is a pane that can never
+    // upload again, with no error left on screen to explain it.
+    uploadFilesToContainer.mockRejectedValueOnce("Start the project first");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.uploadFiles();
+    });
+    expect(result.current.uploading).toBe(false);
+  });
+
+  it("tracks each save separately, so one finishing does not free another", async () => {
+    // The bug this exists for: `savingPath` was a single string. Starting a
+    // second save overwrote it, so the first row went live again mid-transfer,
+    // and whichever save settled first cleared the flag for both — dismissing
+    // the second dialog was enough. A set is what the design needs, because
+    // "only the row being saved is disabled" is exactly what makes a second
+    // save startable.
+    let releaseBig: (v: unknown) => void = () => {};
+    let releaseSmall: (v: unknown) => void = () => {};
+    downloadContainerFile
+      .mockReturnValueOnce(new Promise((r) => { releaseBig = r; }))
+      .mockReturnValueOnce(new Promise((r) => { releaseSmall = r; }));
+
+    const { result } = renderHook(() => useFileManager("p1"));
+    let big: Promise<void>;
+    let small: Promise<void>;
+    act(() => { big = result.current.saveToHost(file("big.bin")); });
+    expect(result.current.savingPaths.has("/workspace/big.bin")).toBe(true);
+
+    act(() => { small = result.current.saveToHost(file("notes.txt")); });
+    // Both, at once — a scalar could only hold the second.
+    expect(result.current.savingPaths.has("/workspace/big.bin")).toBe(true);
+    expect(result.current.savingPaths.has("/workspace/notes.txt")).toBe(true);
+
+    // The second one finishing must not re-enable the first, which is still
+    // streaming. `null` is the dismissal path, which is how this was cheapest
+    // to trigger in practice.
+    await act(async () => { releaseSmall(null); await small; });
+    expect(result.current.savingPaths.has("/workspace/notes.txt")).toBe(false);
+    expect(result.current.savingPaths.has("/workspace/big.bin")).toBe(true);
+
+    await act(async () => { releaseBig(10); await big; });
+    expect(result.current.savingPaths.size).toBe(0);
+  });
+
+  it("clears a row's saving flag when its save fails", async () => {
+    downloadContainerFile.mockRejectedValueOnce("Permission denied");
+    const { result } = renderHook(() => useFileManager("p1"));
+    await act(async () => {
+      await result.current.saveToHost(file("b.txt"));
+    });
+    expect(result.current.savingPaths.size).toBe(0);
+  });
+});
diff --git a/app/src/hooks/useFileManager.ts b/app/src/hooks/useFileManager.ts
index f344d71..3aacbde 100644
--- a/app/src/hooks/useFileManager.ts
+++ b/app/src/hooks/useFileManager.ts
@@ -1,74 +1,280 @@
-import { useState, useCallback } from "react";
-import { save, open as openDialog } from "@tauri-apps/plugin-dialog";
+import { useCallback, useRef, useState } from "react";
 import type { FileEntry } from "../lib/types";
 import * as commands from "../lib/tauri-commands";
+import { useAppState } from "../store/appState";
+import { errorText, readableRefusal } from "../lib/refusalText";
+import { formatBytes } from "../lib/formatBytes";
 
+/**
+ * ## Where failures are reported
+ *
+ * Two audiences, two places, and the split is deliberate.
+ *
+ * The **initial listing** failure stays in `error`, rendered inline above the
+ * (empty) grid. It is on screen, it is in context, it explains why there are
+ * no rows, and it is not transient — it stands until the directory lists.
+ *
+ * Every **transient operation** failure — rename, create folder, upload, save
+ * to host — goes to `ToastHost` instead. Those used to land in the same inline `error` div, which
+ * is the first child of the *scrolling* list: three hundred rows down, a
+ * refused rename produced no visible change at all, just a rename box that
+ * stayed open for no stated reason. The toast host is a persistent `aria-live`
+ * region at `z-[60]`, i.e. the one place in the app that is above a modal and
+ * does not scroll away.
+ *
+ * ## Where the current directory lives
+ *
+ * `currentPath` is state (the UI renders it) *and* a ref (async work reads it
+ * after an await). Every long operation captures the directory it targets at
+ * the start and compares it against the ref at the end: a slow rename in
+ * `/workspace` must not drag the pane back out of `src/` because that is where
+ * the closure happened to be created. The ref moves at the *start* of a
+ * navigation rather than when the listing lands, because the question being
+ * asked is "where is the user going", not "what is on screen right now" — and
+ * it is put back if that navigation fails.
+ */
 export function useFileManager(projectId: string) {
   const [currentPath, setCurrentPath] = useState("/workspace");
   const [entries, setEntries] = useState<FileEntry[]>([]);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  /**
+   * What just finished, for the live region — a rename or a new folder is a
+   * change a sighted user sees in the grid and a screen reader user does not.
+   */
+  const [completed, setCompleted] = useState<string | null>(null);
+  /**
+   * Which host transfers are in flight.
+   *
+   * Both actions open an OS dialog and can then run for a long time on a large
+   * file, with nothing on screen to say so. Without this the buttons stay live:
+   * a second click opens a second dialog and runs a second concurrent exec
+   * against the same file, and a multi-gigabyte save is indistinguishable from
+   * a click that did nothing.
+   *
+   * `savingPaths` is a **set**, not one path. Keeping only the row being
+   * disabled is what makes the pane usable during a big transfer — and that is
+   * precisely what makes a *second* save startable, so the state has to be able
+   * to hold two. As a scalar it could not: starting a save on `notes.txt` while
+   * `big.bin` was still streaming overwrote it, so `big.bin`'s button went live
+   * again mid-transfer; and whichever save finished first cleared the flag for
+   * both. Dismissing the second dialog was enough to do it.
+   *
+   * Paths are unique within a listing, so a path is a usable key — `FilesTab`
+   * relies on the same fact for its row keys.
+   */
+  const [uploading, setUploading] = useState(false);
+  const [savingPaths, setSavingPaths] = useState<ReadonlySet<string>>(new Set());
+
+  const currentPathRef = useRef(currentPath);
+
+  /**
+   * A slow listing can land after a newer one and set both the rows and the
+   * breadcrumb back to a directory the user already left. Same generation
+   * guard `useContainerMigration` uses: every async write
+   * checks it is still the newest before it lands.
+   */
+  const navGeneration = useRef(0);
+
+  /**
+   * Report a failed operation, given the headline this hook would write and the
+   * raw failure behind it.
+   *
+   * The headline is what the *hook* knows ("Could not rename …"); it is a
+   * category, not an explanation. Some backend refusals are already a finished
+   * sentence written for the person reading it — a container path outside the
+   * roots this panel may change, a name it will not create — and those used to
+   * arrive as the toast's `detail`, which `ToastHost` renders as collapsed
+   * monospace behind a "Details" button. So the sentence that said what was
+   * wrong and what to do about it was hidden under a headline that said
+   * neither. When there is such a sentence it becomes the headline, and there
+   * is nothing left to hide.
+   */
+  const report = useCallback((message: string, cause: unknown) => {
+    const promoted = readableRefusal(cause);
+    useAppState.getState().pushToast({
+      kind: "error",
+      message: promoted ?? message,
+      detail: promoted ? undefined : errorText(cause),
+    });
+  }, []);
 
   const navigate = useCallback(
     async (path: string) => {
+      const mine = ++navGeneration.current;
+      const previous = currentPathRef.current;
+      currentPathRef.current = path;
       setLoading(true);
       setError(null);
       try {
         const result = await commands.listContainerFiles(projectId, path);
+        if (navGeneration.current !== mine) return;
         setEntries(result);
         setCurrentPath(path);
       } catch (e) {
+        if (navGeneration.current !== mine) return;
+        // The move did not happen, so the pane is still where it was — the ref
+        // has to agree with the breadcrumb or the next operation will decide
+        // it targeted a directory nobody is looking at.
+        currentPathRef.current = previous;
         setError(String(e));
       } finally {
-        setLoading(false);
+        if (navGeneration.current === mine) setLoading(false);
       }
     },
     [projectId],
   );
 
   const goUp = useCallback(() => {
-    if (currentPath === "/") return;
-    const parent = currentPath.replace(/\/[^/]+$/, "") || "/";
+    const here = currentPathRef.current;
+    if (here === "/") return;
+    const parent = here.replace(/\/[^/]+$/, "") || "/";
     navigate(parent);
-  }, [currentPath, navigate]);
+  }, [navigate]);
 
   const refresh = useCallback(() => {
-    navigate(currentPath);
-  }, [currentPath, navigate]);
+    navigate(currentPathRef.current);
+  }, [navigate]);
 
-  const downloadFile = useCallback(
-    async (entry: FileEntry) => {
+  /**
+   * Rename in place. `newName` is a bare name — Rust rejects anything with a
+   * `/` in it, so this can never turn into a move. Resolves true on success so
+   * the caller knows whether to leave edit mode.
+   */
+  const renameEntry = useCallback(
+    async (entry: FileEntry, newName: string) => {
+      const trimmed = newName.trim();
+      if (!trimmed || trimmed === entry.name) return true;
+      const target = currentPathRef.current;
       try {
-        const hostPath = await save({ defaultPath: entry.name });
-        if (!hostPath) return;
-        await commands.downloadContainerFile(projectId, entry.path, hostPath);
+        await commands.renameContainerPath(projectId, entry.path, trimmed);
+        setCompleted(`Renamed "${entry.name}" to "${trimmed}".`);
+        if (currentPathRef.current === target) await navigate(target);
+        return true;
       } catch (e) {
-        setError(String(e));
+        report(`Could not rename "${entry.name}"`, e);
+        return false;
       }
     },
-    [projectId],
+    [projectId, navigate, report],
   );
 
-  const uploadFile = useCallback(async () => {
+  const createFolder = useCallback(
+    async (name: string) => {
+      const trimmed = name.trim();
+      if (!trimmed) return true;
+      const target = currentPathRef.current;
+      try {
+        await commands.createContainerDirectory(projectId, target, trimmed);
+        setCompleted(`Created "${trimmed}".`);
+        if (currentPathRef.current === target) await navigate(target);
+        return true;
+      } catch (e) {
+        report(`Could not create "${trimmed}"`, e);
+        return false;
+      }
+    },
+    [projectId, navigate, report],
+  );
+
+  /**
+   * Copy host files into the directory on screen.
+   *
+   * The picker is opened by **Rust**, not here — `upload_files_to_container`
+   * shows it, reads what the user chose and never lets a host path near IPC.
+   * So this passes a directory and gets back an outcome; `null` means the user
+   * dismissed the dialog, which is not a failure and says nothing.
+   *
+   * One dialog can select several files and they need not agree, hence two
+   * lists. Every failure is reported, because "3 of 5 uploaded" without saying
+   * which two is not a report. The listing is refreshed once, at the end, and
+   * only if the user is still looking at the directory that was targeted.
+   */
+  const uploadFiles = useCallback(async () => {
+    const target = currentPathRef.current;
+    setUploading(true);
     try {
-      const selected = await openDialog({ multiple: false, directory: false });
-      if (!selected) return;
-      await commands.uploadFileToContainer(projectId, selected as string, currentPath);
-      await navigate(currentPath);
-    } catch (e) {
-      setError(String(e));
+      let outcome;
+      try {
+        outcome = await commands.uploadFilesToContainer(projectId, target);
+      } catch (e) {
+        // A failure *before* the picker: no container, not running, or a
+        // directory this pane may not write to. One toast, not one per file.
+        report("Could not upload", e);
+        return;
+      }
+      if (!outcome) return;
+      for (const failure of outcome.failures) {
+        useAppState.getState().pushToast({ kind: "error", message: failure });
+      }
+      if (outcome.uploaded.length === 0) return;
+      // The directory is named, not implied. `target` is captured at click time
+      // and the picker is a modal OS dialog — the user has all the time in the
+      // world to browse somewhere else while it is open, and the files land
+      // where they started. "Uploaded 2 files." in front of a grid that does
+      // not contain them is a worse answer than no message at all.
+      const count = outcome.uploaded.length;
+      setCompleted(
+        `Uploaded ${count === 1 ? "1 file" : `${count} files`} to ${target}.`,
+      );
+      if (currentPathRef.current === target) await navigate(target);
+    } finally {
+      // Around the *whole* body, refresh included. Clearing it the moment the
+      // command settled put the button back before the re-listing had run, so
+      // a second click landed mid-refresh on a grid that was still the old one.
+      setUploading(false);
     }
-  }, [projectId, currentPath, navigate]);
+  }, [projectId, navigate, report]);
+
+  /**
+   * Save one file out to the host, with Rust opening the save dialog.
+   *
+   * No refresh: nothing in the container changed. The save dialog is also what
+   * asks about overwriting an existing host file, which is why the backend has
+   * no collision handling of its own to get wrong. `null` is a dismissal.
+   */
+  const saveToHost = useCallback(
+    async (entry: FileEntry) => {
+      setSavingPaths((live) => new Set(live).add(entry.path));
+      try {
+        const bytes = await commands.downloadContainerFile(projectId, entry.path);
+        // `0` is a real answer — an empty file saved is a success — so this
+        // tests for the dismissal sentinel, not for falsiness.
+        if (bytes === null) return;
+        setCompleted(`Saved "${entry.name}" (${formatBytes(bytes)}).`);
+      } catch (e) {
+        report(`Could not save "${entry.name}"`, e);
+      } finally {
+        // Remove only this one. A save that finishes while another is still
+        // streaming must not re-enable the other's row.
+        setSavingPaths((live) => {
+          const next = new Set(live);
+          next.delete(entry.path);
+          return next;
+        });
+      }
+    },
+    [projectId, report],
+  );
 
   return {
     currentPath,
     entries,
     loading,
+    /** Inline, in-context: why the listing on screen is empty. */
     error,
+    /** What the last operation finished doing, for the live region. */
+    completed,
+    setError,
     navigate,
     goUp,
     refresh,
-    downloadFile,
-    uploadFile,
+    renameEntry,
+    createFolder,
+    uploadFiles,
+    saveToHost,
+    /** A host transfer is in flight — see the state declarations above. */
+    uploading,
+    savingPaths,
   };
 }
diff --git a/app/src/hooks/useProjectActions.ts b/app/src/hooks/useProjectActions.ts
index 9f5d7f4..07ded95 100644
--- a/app/src/hooks/useProjectActions.ts
+++ b/app/src/hooks/useProjectActions.ts
@@ -2,6 +2,7 @@ import { useCallback, useState } from "react";
 import { save } from "@tauri-apps/plugin-dialog";
 import type { Project } from "../lib/types";
 import * as commands from "../lib/tauri-commands";
+import { formatBytes } from "../lib/formatBytes";
 import { useAppState } from "../store/appState";
 import { useProjects } from "./useProjects";
 import { useTerminal } from "./useTerminal";
@@ -122,10 +123,15 @@ export function useProjectActions(project: Project) {
       if (!hostPath) return;
       setBackingUp(true);
       const bytes = await commands.downloadContainerBackup(project.id, hostPath);
-      const mb = (bytes / (1024 * 1024)).toFixed(1);
+      // `binary` matches what the host's file browser will say about the
+      // tarball this just wrote. The unit is part of the formatted string, so
+      // there is no separate " MB" to append — and unlike the inline
+      // `toFixed(1)` this replaced, a multi-gigabyte backup no longer reports
+      // itself as a five-digit number of megabytes.
+      const size = formatBytes(bytes, { binary: true });
       pushToast({
         kind: "success",
-        message: `Backup saved (${mb} MB).`,
+        message: `Backup saved (${size}).`,
         detail:
           "Includes Claude config — may contain API keys. Keep the archive private.",
       });
diff --git a/app/src/hooks/useProjects.test.ts b/app/src/hooks/useProjects.test.ts
new file mode 100644
index 0000000..1130479
--- /dev/null
+++ b/app/src/hooks/useProjects.test.ts
@@ -0,0 +1,142 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { act, renderHook } from "@testing-library/react";
+import { useProjects } from "./useProjects";
+import { useAppState } from "../store/appState";
+import type { Project, ProjectStatus } from "../lib/types";
+
+const startProjectContainer = vi.fn();
+const stopProjectContainer = vi.fn();
+const rebuildProjectContainer = vi.fn();
+const listProjects = vi.fn();
+
+vi.mock("../lib/tauri-commands", () => ({
+  startProjectContainer: (id: string) => startProjectContainer(id),
+  stopProjectContainer: (id: string) => stopProjectContainer(id),
+  rebuildProjectContainer: (id: string) => rebuildProjectContainer(id),
+  listProjects: () => listProjects(),
+  addProject: vi.fn(),
+  removeProject: vi.fn(),
+  updateProject: vi.fn(),
+}));
+
+const project = (status: ProjectStatus): Project =>
+  ({ id: "p1", name: "whp", status }) as unknown as Project;
+
+/** The status the sidebar row and Project Home both read. */
+const statusOf = () => useAppState.getState().projects.find((p) => p.id === "p1")?.status;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  useAppState.setState({ projects: [project("running")] });
+});
+
+/**
+ * The optimistic status is what makes a click move the row immediately. It is
+ * also what strands the row when the command it was betting on never ran.
+ *
+ * Since every lifecycle command started taking the per-project lock and failing
+ * fast, all three can be refused *before* the backend changes anything — and
+ * `stop` could not fail this way at all before, because it took no exclusion.
+ * `isTransitioning` disables both Start and Stop, and the only thing that
+ * clears it is `reconcileProjectStatuses`, which runs once when Docker first
+ * appears. So a stale optimistic status is not a cosmetic problem: it is a row
+ * the user cannot operate again until the app is restarted.
+ */
+describe("useProjects puts the status back when a refused command never ran", () => {
+  const refusal =
+    "This project's snapshot is being compacted. Wait for it to finish before starting or recreating its container.";
+
+  it("does not leave a refused Stop showing 'stopping' forever", async () => {
+    stopProjectContainer.mockRejectedValue(refusal);
+    // The lock is taken before `update_status`, so the backend still holds the
+    // truth — which is why re-reading it is the correction, not a guess.
+    listProjects.mockResolvedValue([project("running")]);
+
+    const { result } = renderHook(() => useProjects());
+    await act(async () => {
+      await expect(result.current.stop("p1")).rejects.toBe(refusal);
+    });
+
+    expect(statusOf()).toBe("running");
+  });
+
+  it("does not leave a refused Start showing 'starting' forever", async () => {
+    useAppState.setState({ projects: [project("stopped")] });
+    startProjectContainer.mockRejectedValue(refusal);
+    listProjects.mockResolvedValue([project("stopped")]);
+
+    const { result } = renderHook(() => useProjects());
+    await act(async () => {
+      await expect(result.current.start("p1")).rejects.toBe(refusal);
+    });
+
+    expect(statusOf()).toBe("stopped");
+  });
+
+  it("does not leave a refused Reset showing 'starting' forever", async () => {
+    rebuildProjectContainer.mockRejectedValue(refusal);
+    listProjects.mockResolvedValue([project("running")]);
+
+    const { result } = renderHook(() => useProjects());
+    await act(async () => {
+      await expect(result.current.rebuild("p1")).rejects.toBe(refusal);
+    });
+
+    expect(statusOf()).toBe("running");
+  });
+
+  it("falls back to what was on screen when even the re-read fails", async () => {
+    // Two failures in a row must not land on the one state there is no way out
+    // of. The backend's answer is preferred, but "unknown" is never a reason to
+    // keep showing a transition that is not happening.
+    stopProjectContainer.mockRejectedValue(refusal);
+    listProjects.mockRejectedValue("Docker is not running");
+
+    const { result } = renderHook(() => useProjects());
+    await act(async () => {
+      await expect(result.current.stop("p1")).rejects.toBe(refusal);
+    });
+
+    expect(statusOf()).toBe("running");
+  });
+
+  it("prefers the backend's answer over the status it captured", async () => {
+    // A start that dies half-way really has changed the world, so the captured
+    // status would be a lie. `listProjects` is the thing that knows.
+    useAppState.setState({ projects: [project("stopped")] });
+    startProjectContainer.mockRejectedValue("container exited during startup");
+    listProjects.mockResolvedValue([project("error")]);
+
+    const { result } = renderHook(() => useProjects());
+    await act(async () => {
+      await expect(result.current.start("p1")).rejects.toBe(
+        "container exited during startup",
+      );
+    });
+
+    expect(statusOf()).toBe("error");
+  });
+
+  it("still paints the optimistic status on the way in", async () => {
+    let release: (() => void) | undefined;
+    stopProjectContainer.mockReturnValue(
+      new Promise<void>((resolve) => {
+        release = resolve;
+      }),
+    );
+    listProjects.mockResolvedValue([project("stopped")]);
+
+    const { result } = renderHook(() => useProjects());
+    let pending: Promise<void> | undefined;
+    act(() => {
+      pending = result.current.stop("p1");
+    });
+    expect(statusOf()).toBe("stopping");
+
+    await act(async () => {
+      release?.();
+      await pending;
+    });
+    expect(statusOf()).toBe("stopped");
+  });
+});
diff --git a/app/src/hooks/useProjects.ts b/app/src/hooks/useProjects.ts
index ba5a442..66868a0 100644
--- a/app/src/hooks/useProjects.ts
+++ b/app/src/hooks/useProjects.ts
@@ -2,7 +2,7 @@ import { useCallback } from "react";
 import { useShallow } from "zustand/react/shallow";
 import { useAppState } from "../store/appState";
 import * as commands from "../lib/tauri-commands";
-import type { ProjectPath } from "../lib/types";
+import type { ProjectPath, ProjectStatus } from "../lib/types";
 
 export function useProjects() {
   const {
@@ -61,34 +61,85 @@ export function useProjects() {
     [updateProjectInList],
   );
 
-  const start = useCallback(
-    async (id: string) => {
-      setOptimisticStatus(id, "starting");
-      const updated = await commands.startProjectContainer(id);
-      updateProjectInList(updated);
-      return updated;
+  /**
+   * Paint the optimistic status, run the command, and **put the status back if
+   * the command never happened.**
+   *
+   * The optimistic write exists so a click moves the row immediately. It used
+   * to be safe to leave in place on failure, because the only way these three
+   * commands could fail was after the backend had already started changing
+   * things — so a stale "starting" was at worst premature.
+   *
+   * That stopped being true when every lifecycle command started taking the
+   * per-project lock and failing fast: a compaction, a reset or another start
+   * holding the project now refuses `start`, `stop` **and** `rebuild` before
+   * one byte of state changes. `stop` in particular could not fail this way at
+   * all before — it took no exclusion. The optimistic paint then has nothing to
+   * become, and `isTransitioning` disables both Start and Stop, so the row is
+   * stuck: the only thing that clears it is `reconcileProjectStatuses`, which
+   * runs once, from `App.tsx`, when Docker first appears. A restart.
+   *
+   * Re-reading the list is preferred over restoring what was on screen, because
+   * a refusal is not the only way these throw — a start that dies half-way
+   * really has changed the world, and `listProjects` is the thing that knows.
+   * The captured status is only the fallback for when that call fails too:
+   * leaving the row transitioning is the one outcome the user cannot get out
+   * of, so it must not be what a second failure lands on.
+   */
+  const withOptimisticStatus = useCallback(
+    async <T,>(
+      id: string,
+      status: "starting" | "stopping",
+      run: () => Promise<T>,
+    ): Promise<T> => {
+      const previous: ProjectStatus | null =
+        useAppState.getState().projects.find((p) => p.id === id)?.status ?? null;
+      setOptimisticStatus(id, status);
+      try {
+        return await run();
+      } catch (e) {
+        try {
+          setProjects(await commands.listProjects());
+        } catch {
+          const project = useAppState.getState().projects.find((p) => p.id === id);
+          if (project && previous) updateProjectInList({ ...project, status: previous });
+        }
+        // Rethrown unchanged: `useProjectActions` is what turns this into a
+        // toast, and it must still see the original failure.
+        throw e;
+      }
     },
-    [updateProjectInList, setOptimisticStatus],
+    [setOptimisticStatus, setProjects, updateProjectInList],
+  );
+
+  const start = useCallback(
+    (id: string) =>
+      withOptimisticStatus(id, "starting", async () => {
+        const updated = await commands.startProjectContainer(id);
+        updateProjectInList(updated);
+        return updated;
+      }),
+    [updateProjectInList, withOptimisticStatus],
   );
 
   const stop = useCallback(
-    async (id: string) => {
-      setOptimisticStatus(id, "stopping");
-      await commands.stopProjectContainer(id);
-      const list = await commands.listProjects();
-      setProjects(list);
-    },
-    [setProjects, setOptimisticStatus],
+    (id: string) =>
+      withOptimisticStatus(id, "stopping", async () => {
+        await commands.stopProjectContainer(id);
+        const list = await commands.listProjects();
+        setProjects(list);
+      }),
+    [setProjects, withOptimisticStatus],
   );
 
   const rebuild = useCallback(
-    async (id: string) => {
-      setOptimisticStatus(id, "starting");
-      const updated = await commands.rebuildProjectContainer(id);
-      updateProjectInList(updated);
-      return updated;
-    },
-    [updateProjectInList, setOptimisticStatus],
+    (id: string) =>
+      withOptimisticStatus(id, "starting", async () => {
+        const updated = await commands.rebuildProjectContainer(id);
+        updateProjectInList(updated);
+        return updated;
+      }),
+    [updateProjectInList, withOptimisticStatus],
   );
 
   const update = useCallback(
diff --git a/app/src/hooks/useSecretField.test.ts b/app/src/hooks/useSecretField.test.ts
new file mode 100644
index 0000000..afe3d76
--- /dev/null
+++ b/app/src/hooks/useSecretField.test.ts
@@ -0,0 +1,77 @@
+import { describe, it, expect } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+import { useSecretField, withoutUntouchedSecrets } from "./useSecretField";
+
+describe("useSecretField", () => {
+  it("says nothing about a secret the user never touched", () => {
+    // The bug this exists for: the input always renders empty (secrets are
+    // never serialized to the frontend), so the obvious `value || null` blur
+    // handler sent `null` — which means *delete* — merely because the user
+    // focused the field and tabbed away. No warning, nothing to undo.
+    const { result } = renderHook(() => useSecretField("p1"));
+    expect(result.current.value).toBe("");
+    expect(result.current.edited).toBe(false);
+    expect(result.current.patch("git_token")).toEqual({});
+    // Absent, not null: `JSON.stringify` drops the key entirely, and Rust
+    // distinguishes an absent key ("leave it") from an explicit null ("clear").
+    expect("git_token" in result.current.patch("git_token")).toBe(false);
+  });
+
+  it("sends the value once the user types", () => {
+    const { result } = renderHook(() => useSecretField("p1"));
+    act(() => result.current.setValue("ghp_secret"));
+    expect(result.current.patch("git_token")).toEqual({ git_token: "ghp_secret" });
+  });
+
+  it("sends null only when the user cleared a field they had typed in", () => {
+    // This is the one case where deleting the stored secret is what was asked
+    // for, and it has to keep working — the previous behaviour skipped `None`
+    // entirely, so a blanked token was never actually revoked.
+    const { result } = renderHook(() => useSecretField("p1"));
+    act(() => result.current.setValue("typed"));
+    act(() => result.current.setValue(""));
+    expect(result.current.edited).toBe(true);
+    expect(result.current.patch("git_token")).toEqual({ git_token: null });
+  });
+
+  it("forgets a half-typed secret when the editor moves to another project", () => {
+    const { result, rerender } = renderHook(({ id }) => useSecretField(id), {
+      initialProps: { id: "p1" },
+    });
+    act(() => result.current.setValue("for-project-one"));
+    rerender({ id: "p2" });
+    expect(result.current.value).toBe("");
+    expect(result.current.edited).toBe(false);
+    expect(result.current.patch("api_key")).toEqual({});
+  });
+});
+
+describe("withoutUntouchedSecrets", () => {
+  it("drops a secret key the caller did not set", () => {
+    // `saveBedrock` spreads `{ ...bedrock, ...patch }`, and when `bedrock`
+    // falls back to DEFAULT_BEDROCK_CONFIG that literal spells every secret out
+    // as `null`. Without this filter, editing the AWS *region* would delete the
+    // stored credentials as a side effect.
+    const merged = {
+      aws_region: "eu-west-1",
+      aws_access_key_id: null,
+      aws_secret_access_key: null,
+    };
+    const out = withoutUntouchedSecrets(merged, { aws_region: "eu-west-1" }, [
+      "aws_access_key_id",
+      "aws_secret_access_key",
+    ]);
+    expect(out).toEqual({ aws_region: "eu-west-1" });
+    expect("aws_access_key_id" in out).toBe(false);
+  });
+
+  it("keeps a secret key the caller set, including an explicit null", () => {
+    const merged = { aws_region: "eu-west-1", aws_access_key_id: null };
+    const out = withoutUntouchedSecrets(
+      merged,
+      { aws_access_key_id: null },
+      ["aws_access_key_id"],
+    );
+    expect(out).toEqual({ aws_region: "eu-west-1", aws_access_key_id: null });
+  });
+});
diff --git a/app/src/hooks/useSecretField.ts b/app/src/hooks/useSecretField.ts
new file mode 100644
index 0000000..c84ea32
--- /dev/null
+++ b/app/src/hooks/useSecretField.ts
@@ -0,0 +1,96 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+
+/**
+ * A password input whose stored value the frontend can never see.
+ *
+ * Secrets live in the OS keychain and are `#[serde(skip_serializing)]`, so a
+ * `Project` arriving from Rust has no key for them at all and the input always
+ * renders empty — whether or not a credential is stored. That is fine on its
+ * own. What is not fine is the obvious blur handler:
+ *
+ * ```tsx
+ * onBlur={() => save({ git_token: gitToken || null })}
+ * ```
+ *
+ * An empty box sends `null`, and `null` now means **delete** (it used to mean
+ * "skip", which was its own bug — a blanked token was never actually revoked).
+ * So merely focusing a secret field and tabbing away destroyed the stored
+ * credential, with nothing shown and nothing to undo it.
+ *
+ * The rule this encodes: **only a field the user actually typed in may speak
+ * about a secret.** `patch()` returns `undefined` until then, and `undefined`
+ * is dropped by `JSON.stringify`, so the key never reaches Rust — which
+ * deliberately distinguishes an absent key ("leave it alone") from an explicit
+ * `null` ("clear it"). See `explicitly_cleared_secrets` in
+ * `commands/project_commands.rs`.
+ */
+export interface SecretField {
+  /** Current input value. Always starts empty for a stored secret. */
+  value: string;
+  /** Whether the user has typed in this field since it was last reset. */
+  edited: boolean;
+  /** `onChange` handler — marks the field edited. */
+  setValue: (next: string) => void;
+  /**
+   * What to put in the save patch, spread into it:
+   * `save({ ...token.patch("git_token") })`.
+   *
+   * Empty when untouched, so the key is absent and the stored secret stands.
+   */
+  patch: <K extends string>(key: K) => Partial<Record<K, string | null>>;
+}
+
+export function useSecretField(projectId: string): SecretField {
+  const [value, setValueRaw] = useState("");
+  const [edited, setEdited] = useState(false);
+  // Reset when the editor moves to a different project, so a value typed for
+  // one project can never be saved onto another.
+  const lastProject = useRef(projectId);
+
+  useEffect(() => {
+    if (lastProject.current !== projectId) {
+      lastProject.current = projectId;
+      setValueRaw("");
+      setEdited(false);
+    }
+  }, [projectId]);
+
+  const setValue = useCallback((next: string) => {
+    setValueRaw(next);
+    setEdited(true);
+  }, []);
+
+  const patch = useCallback(
+    <K extends string>(key: K): Partial<Record<K, string | null>> =>
+      edited ? ({ [key]: value || null } as Partial<Record<K, string | null>>) : {},
+    [edited, value],
+  );
+
+  return { value, edited, setValue, patch };
+}
+
+/**
+ * Drop secret keys the caller did not explicitly set.
+ *
+ * The config editors save by spreading — `save({ bedrock_config: { ...bedrock,
+ * ...patch } })`. That is safe while `bedrock` comes from Rust, because secrets
+ * are never serialized and the keys are simply absent. It stops being safe the
+ * moment the spread falls back to a `DEFAULT_*_CONFIG` literal, because those
+ * spell every secret out as `null` — and `null` means delete. Editing the AWS
+ * region would then wipe the stored credentials as a side effect.
+ *
+ * So the merged object is filtered: a secret key survives only if it is in the
+ * caller's own patch, which is to say only if a `useSecretField` that the user
+ * typed into put it there.
+ */
+export function withoutUntouchedSecrets<T extends object>(
+  merged: T,
+  patch: Partial<T>,
+  secretKeys: readonly (keyof T)[],
+): T {
+  const out = { ...merged };
+  for (const key of secretKeys) {
+    if (!(key in patch)) delete out[key];
+  }
+  return out;
+}
diff --git a/app/src/lib/dropTarget.test.ts b/app/src/lib/dropTarget.test.ts
new file mode 100644
index 0000000..c173592
--- /dev/null
+++ b/app/src/lib/dropTarget.test.ts
@@ -0,0 +1,361 @@
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
+import { classifyDrop, dropIsBlocked, isDropTarget } from "./dropTarget";
+
+function pane(rect: Partial<DOMRect>): HTMLElement {
+  const el = document.createElement("div");
+  document.body.appendChild(el);
+  el.getBoundingClientRect = () =>
+    ({
+      left: 0,
+      top: 0,
+      right: 100,
+      bottom: 100,
+      width: 100,
+      height: 100,
+      x: 0,
+      y: 0,
+      toJSON: () => ({}),
+      ...rect,
+    }) as DOMRect;
+  return el;
+}
+
+/**
+ * **jsdom has no `elementFromPoint`.** That single fact is how a z-order gate
+ * that refused every drop under a button, a toast and a dialog shipped green
+ * through 81 drop tests: the branch was never entered, in any of them.
+ *
+ * The gate no longer asks a per-point question at all, so the gap can no
+ * longer hide anything here — but the tests below still *install* an
+ * `elementFromPoint` and hand it the most misleading answer available, because
+ * "the module ignores it" is now a property worth pinning. `spy.mock.calls`
+ * proves it directly.
+ */
+function stubElementFromPoint(top: Element | null): ReturnType<typeof vi.fn> {
+  const spy = vi.fn(() => top);
+  Object.defineProperty(document, "elementFromPoint", {
+    configurable: true,
+    writable: true,
+    value: spy,
+  });
+  return spy;
+}
+
+function removeElementFromPoint(): void {
+  delete (document as Partial<Document>).elementFromPoint;
+}
+
+/** The DOM `ui/Modal` really renders: a marked backdrop around the dialog. */
+function openModal(): { backdrop: HTMLElement; panel: HTMLElement; button: HTMLElement } {
+  const backdrop = document.createElement("div");
+  backdrop.setAttribute("data-blocks-drop", "true");
+  const panel = document.createElement("div");
+  panel.setAttribute("role", "dialog");
+  panel.setAttribute("aria-modal", "true");
+  const button = document.createElement("button");
+  panel.appendChild(button);
+  backdrop.appendChild(panel);
+  document.body.appendChild(backdrop);
+  return { backdrop, panel, button };
+}
+
+function withUserAgent(ua: string): void {
+  Object.defineProperty(window.navigator, "userAgent", {
+    configurable: true,
+    value: ua,
+  });
+}
+
+const REAL_UA = window.navigator.userAgent;
+const REAL_DPR = window.devicePixelRatio;
+
+function withDevicePixelRatio(value: number): void {
+  Object.defineProperty(window, "devicePixelRatio", { configurable: true, value });
+}
+
+describe("dropTarget", () => {
+  beforeEach(() => {
+    document.body.innerHTML = "";
+  });
+  afterEach(() => {
+    document.body.innerHTML = "";
+    removeElementFromPoint();
+    withUserAgent(REAL_UA);
+    withDevicePixelRatio(REAL_DPR);
+  });
+
+  it("accepts a point inside the pane", () => {
+    expect(isDropTarget(pane({}), { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe(true);
+  });
+
+  it("rejects a point outside the pane", () => {
+    expect(isDropTarget(pane({}), { x: 400, y: 50 }, { devicePixelRatio: 1 })).toBe(false);
+  });
+
+  it("converts physical pixels to CSS pixels", () => {
+    const el = pane({});
+    expect(isDropTarget(el, { x: 150, y: 150 }, { devicePixelRatio: 2 })).toBe(true);
+    expect(isDropTarget(el, { x: 150, y: 150 }, { devicePixelRatio: 1 })).toBe(false);
+  });
+
+  it("rejects a hidden pane, which has a zero-size rect", () => {
+    const el = pane({ right: 0, bottom: 0, width: 0, height: 0 });
+    expect(isDropTarget(el, { x: 0, y: 0 }, { devicePixelRatio: 1 })).toBe(false);
+  });
+
+  it("rejects every drop while a modal is open", () => {
+    const el = pane({});
+    const dialog = document.createElement("div");
+    dialog.setAttribute("role", "dialog");
+    dialog.setAttribute("aria-modal", "true");
+    document.body.appendChild(dialog);
+
+    expect(dropIsBlocked()).toBe(true);
+    expect(isDropTarget(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe(false);
+
+    dialog.remove();
+    expect(dropIsBlocked()).toBe(false);
+    expect(isDropTarget(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe(true);
+  });
+
+  it("rejects every drop while a blocking overlay is up", () => {
+    const el = pane({});
+    const overlay = document.createElement("div");
+    overlay.setAttribute("data-blocks-drop", "true");
+    document.body.appendChild(overlay);
+    expect(isDropTarget(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe(false);
+  });
+
+  it("rejects a null pane", () => {
+    expect(isDropTarget(null, { x: 1, y: 1 }, { devicePixelRatio: 1 })).toBe(false);
+  });
+
+  // ---------------------------------------------------------------------
+  // The gate itself: document-wide, and provably not geometric
+  // ---------------------------------------------------------------------
+
+  describe("the blocking gate is document-wide, with no z-order in it", () => {
+    it("never consults elementFromPoint, however tempting its answer", () => {
+      // Round 2 asked `elementFromPoint` whether a *blocker* was painted at
+      // the drop point, and trusted the answer absolutely. Anything painted
+      // above the `z-50` backdrop in the same stacking context — `ToastHost`
+      // at `z-[60]`, `TerminalContextMenu` at `z-[60]` — answered "no blocker
+      // here" on a point the dialog was covering. The fix is not a better
+      // answer, it is not asking: this pins that the call is gone, so a
+      // future edit that reintroduces it fails here rather than in the wild.
+      const el = pane({});
+      const child = document.createElement("span");
+      el.appendChild(child);
+      const spy = stubElementFromPoint(child);
+
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("accept");
+      expect(spy).not.toHaveBeenCalled();
+    });
+
+    it("refuses a covered drop even when a toast is painted over the dialog", () => {
+      // C1, exactly. A refused drop pushes a toast; `ToastHost` is
+      // `fixed bottom-4 right-4 z-[60]` and an error card stays until
+      // dismissed; the *next* drop released on that card had a topmost
+      // element with no blocker in it, and landed in the directory the dialog
+      // was covering. The gate had armed its own hole.
+      const el = pane({});
+      openModal(); // z-50 backdrop, covering the pane
+      const toastCard = document.createElement("div"); // z-[60], over the backdrop
+      document.body.appendChild(toastCard);
+      const spy = stubElementFromPoint(toastCard);
+
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("blocked");
+      expect(spy).not.toHaveBeenCalled();
+    });
+
+    it("refuses a drop anywhere in the window while a dialog is open", () => {
+      // Deliberately stricter than "the points the dialog covers". A dialog
+      // is a state the user entered on purpose and leaves with Escape, the
+      // refusal is announced, and nothing is written — whereas being precise
+      // about coverage has silently uploaded into a covered directory twice.
+      const el = pane({});
+      const { backdrop } = openModal();
+      stubElementFromPoint(document.createElement("div")); // "nothing here"
+
+      expect(classifyDrop(el, { x: 5, y: 5 }, { devicePixelRatio: 1 })).toBe("blocked");
+      expect(classifyDrop(el, { x: 95, y: 95 }, { devicePixelRatio: 1 })).toBe("blocked");
+
+      backdrop.remove();
+      expect(classifyDrop(el, { x: 5, y: 5 }, { devicePixelRatio: 1 })).toBe("accept");
+    });
+
+    it("refuses under the shutdown overlay, which is not a dialog", () => {
+      const el = pane({});
+      const overlay = document.createElement("div");
+      overlay.setAttribute("data-blocks-drop", "true");
+      document.body.appendChild(overlay);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("blocked");
+    });
+
+    it("still refuses a dialog built without ui/Modal's marked backdrop", () => {
+      // Only `aria-modal` is needed; `ui/Modal` is the supported route, but a
+      // hand-rolled dialog must not be a hole either.
+      const el = pane({});
+      const backdrop = document.createElement("div");
+      const panel = document.createElement("div");
+      panel.setAttribute("aria-modal", "true");
+      backdrop.appendChild(panel);
+      document.body.appendChild(backdrop);
+
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("blocked");
+    });
+
+    it("counts a blocker that is only decoratively hidden from assistive tech", () => {
+      // `aria-hidden="true"` used to disqualify a blocker, and it is not a
+      // visibility statement — `ui/Modal`'s own ✕ glyph carries it while
+      // perfectly visible. A blocker nested inside such a wrapper would have
+      // silently stopped blocking. Only `[hidden]` counts now.
+      const el = pane({});
+      const wrapper = document.createElement("div");
+      wrapper.setAttribute("aria-hidden", "true");
+      const overlay = document.createElement("div");
+      overlay.setAttribute("data-blocks-drop", "true");
+      wrapper.appendChild(overlay);
+      document.body.appendChild(wrapper);
+
+      expect(dropIsBlocked()).toBe(true);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("blocked");
+    });
+
+    it("ignores a blocker whose pane has stepped aside", () => {
+      // `ui/Modal` marks itself `hidden` when the tab that owns it is not the
+      // one on screen. A dialog left open in project A must not keep refusing
+      // drops in project B — this is the one case where over-refusal would be
+      // unbounded, since the user cannot see the dialog to close it.
+      const el = pane({});
+      const { backdrop } = openModal();
+      backdrop.setAttribute("hidden", "");
+
+      expect(dropIsBlocked()).toBe(false);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("accept");
+    });
+  });
+
+  // ---------------------------------------------------------------------
+  // Round 1's shape: chrome painted over a pane must never refuse a drop
+  // ---------------------------------------------------------------------
+
+  describe("chrome over a pane, with no dialog open", () => {
+    /** Everything that is painted over a pane and is not a blocker. */
+    const CHROME: Array<[string, () => HTMLElement]> = [
+      // `TerminalView`'s "▼ Following / ▽ Paused" toggle: `absolute top-2
+      // right-4 z-50`, rendered unconditionally, and a *sibling* of the xterm
+      // host — so "does the pane contain what is painted here?" made the
+      // terminal's top-right corner a dead zone no user action could clear.
+      ["the Following/Paused toggle", () => document.createElement("button")],
+      // `ToastHost`: `fixed bottom-4 right-4 z-[60]`, 24rem wide, over every
+      // pane, and its error cards stay until dismissed.
+      ["a toast card", () => document.createElement("div")],
+      // The drop hint is `pointer-events-none`, so a real `elementFromPoint`
+      // skips it — but nothing may depend on that any more.
+      ["the pane's own drop hint", () => document.createElement("div")],
+      // `Tooltip` portals to `document.body`, so it is nobody's child.
+      ["a portaled tooltip", () => document.createElement("div")],
+    ];
+
+    for (const [name, make] of CHROME) {
+      it(`accepts a drop released onto ${name}`, () => {
+        const el = pane({});
+        const chrome = make();
+        document.body.appendChild(chrome); // a sibling, not a child of the pane
+        stubElementFromPoint(chrome);
+
+        expect(classifyDrop(el, { x: 90, y: 5 }, { devicePixelRatio: 1 })).toBe("accept");
+        expect(classifyDrop(el, { x: 95, y: 95 }, { devicePixelRatio: 1 })).toBe("accept");
+      });
+    }
+
+    it("accepts a drop on the gutter around the terminal, and on its content", () => {
+      const el = pane({});
+      const child = document.createElement("span");
+      el.appendChild(child);
+      stubElementFromPoint(child);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("accept");
+
+      stubElementFromPoint(el); // the gutter: the wrapper itself is topmost
+      expect(classifyDrop(el, { x: 1, y: 99 }, { devicePixelRatio: 1 })).toBe("accept");
+    });
+
+    it("accepts a drop the view could not resolve to any element", () => {
+      // `elementFromPoint` answers `null` outside the viewport and `<body>`
+      // over nothing in particular. With no dialog open neither is a reason
+      // to refuse a drop that is inside the pane's rect.
+      const el = pane({});
+      stubElementFromPoint(null);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("accept");
+      stubElementFromPoint(document.body);
+      expect(classifyDrop(el, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("accept");
+    });
+  });
+
+  // ---------------------------------------------------------------------
+  // Routing: exactly one listener speaks for a given drop
+  // ---------------------------------------------------------------------
+
+  describe("routing", () => {
+    it("lets only the pane the drop landed on report a refusal", () => {
+      // Geometry is asked before the gate for this reason: both listeners are
+      // live for every drop, and if the gate came first they would both push
+      // "File drop ignored" for one drop.
+      const hit = pane({});
+      const missed = pane({ left: 200, right: 300, top: 200, bottom: 300 });
+      openModal();
+
+      expect(classifyDrop(hit, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe("blocked");
+      expect(classifyDrop(missed, { x: 50, y: 50 }, { devicePixelRatio: 1 })).toBe(
+        "elsewhere",
+      );
+    });
+
+    it("says elsewhere, not blocked, for a hidden pane's zero-size rect", () => {
+      const hidden = pane({ right: 0, bottom: 0, width: 0, height: 0 });
+      openModal();
+      expect(classifyDrop(hidden, { x: 0, y: 0 }, { devicePixelRatio: 1 })).toBe(
+        "elsewhere",
+      );
+    });
+  });
+
+  // ---------------------------------------------------------------------
+  // HiDPI
+  // ---------------------------------------------------------------------
+
+  describe("physical vs logical payload coordinates", () => {
+    it("divides by devicePixelRatio on Windows", () => {
+      // wry's WebView2 drag-drop handler passes the OS point through in device
+      // pixels, so a physical (150,150) at dpr 2 is a CSS (75,75).
+      withUserAgent("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36");
+      withDevicePixelRatio(2);
+      expect(isDropTarget(pane({}), { x: 150, y: 150 })).toBe(true);
+    });
+
+    it("does not divide on macOS or Linux, where the payload is already logical", () => {
+      // The macOS and GTK backends deliver logical points and
+      // `tauri-runtime-wry` does not rescale them. Halving one there aimed the
+      // hit test at a point the user never touched — harmless while the test
+      // was a bare rect, and a refused drop once z-order joined in.
+      withDevicePixelRatio(2);
+
+      withUserAgent("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15");
+      expect(isDropTarget(pane({}), { x: 150, y: 150 })).toBe(false);
+      expect(isDropTarget(pane({}), { x: 50, y: 50 })).toBe(true);
+
+      withUserAgent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36");
+      expect(isDropTarget(pane({}), { x: 150, y: 150 })).toBe(false);
+      expect(isDropTarget(pane({}), { x: 50, y: 50 })).toBe(true);
+    });
+
+    it("takes an explicit override over the platform guess", () => {
+      withUserAgent("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15");
+      withDevicePixelRatio(2);
+      expect(
+        isDropTarget(pane({}), { x: 150, y: 150 }, { physicalPixelPayload: true }),
+      ).toBe(true);
+    });
+  });
+});
diff --git a/app/src/lib/dropTarget.ts b/app/src/lib/dropTarget.ts
new file mode 100644
index 0000000..9357139
--- /dev/null
+++ b/app/src/lib/dropTarget.ts
@@ -0,0 +1,204 @@
+/**
+ * Routing for Tauri's *native* drag-drop event.
+ *
+ * The listener is window-wide — every pane that wants dropped file paths gets
+ * the same event — so the module answers two separate questions, and keeping
+ * them separate is the whole design:
+ *
+ * 1. **Which pane is this drop for?** Geometry, and nothing else: is the
+ *    payload position inside my rect? A hidden pane is `display:none` and so
+ *    has a zero-size rect, which is what stops two panes both claiming the
+ *    same drop. `TerminalView` is the only pane that takes dropped files
+ *    today — the Files pane copies files through buttons and a backend-opened
+ *    dialog, not through a drop — but the routing is what keeps it honest when
+ *    a second one appears.
+ * 2. **Should the app accept a drop at all right now?** `dropIsBlocked` —
+ *    document-wide, no geometry, no z-order. While a modal or a blocking
+ *    overlay is on screen anywhere, every drop is refused.
+ *
+ * ## Why there is no z-order test here, and must not be one
+ *
+ * A drop that lands underneath a dialog and silently uploads into the
+ * container behind it is the failure mode that matters: it is
+ * invisible, it writes to the container, and the user did not ask for it.
+ * Every attempt to be *precise* about which points a dialog covers has gone
+ * wrong, twice, in opposite directions:
+ *
+ * - Asking `el.contains(document.elementFromPoint(x, y))` — "is the thing
+ *   painted here mine?" — refused drops onto anything painted *over* a pane
+ *   that is not part of it: `TerminalView`'s always-rendered "▼ Following"
+ *   toggle (a sibling of the xterm host), the URL toast, `ToastHost`'s stack.
+ *   Permanent dead zones no user action could clear.
+ * - Replacing that with "is a *blocking overlay* painted here?" removed the
+ *   dead zones and opened a hole instead. `elementFromPoint` returns the
+ *   topmost painted element, and plenty of things paint above a `z-50` modal
+ *   backdrop in the same stacking context: `ToastHost` is `z-[60]`, so is
+ *   `TerminalContextMenu`. A refused drop pushed a toast; the toast then sat
+ *   over the dialog; the next drop released on that toast was reported as
+ *   "clear" and landed in the covered directory. The gate armed its own hole.
+ *
+ * Both bugs are the same mistake: trusting a per-point answer to decide
+ * whether the app should be accepting work at all. The document-wide question
+ * has no z-index in it, so no future overlay can become a drop hole by being
+ * painted high enough, and no chrome can become a dead zone by being painted
+ * at all.
+ *
+ * What it costs: while any dialog is open, drops are refused *everywhere*,
+ * including on parts of a pane the dialog does not cover. That is a state the
+ * user put the app in deliberately and can leave in one keystroke, the
+ * refusal is announced, and nothing is written. It is strictly the better
+ * failure.
+ *
+ * ## jsdom
+ *
+ * Note for future changes: jsdom implements no layout and has no
+ * `elementFromPoint`, which is how the first of those two bugs shipped green
+ * through 81 drop tests — the branch was never entered in any of them. This
+ * module no longer calls it (`dropTarget.test.ts` asserts that it does not),
+ * so the gap can no longer hide a bug here. Anything that reintroduces a
+ * geometric z-order test reintroduces the gap as well.
+ */
+
+export interface DropPoint {
+  x: number;
+  y: number;
+}
+
+/**
+ * Anything that swallows drops while it is on screen.
+ *
+ * `[aria-modal="true"]` is every dialog in the app for free — `ui/Modal` is
+ * the only way one is built, and it sets that attribute. `data-blocks-drop`
+ * is for full-window overlays that are not dialogs (the shutdown overlay), and
+ * `ui/Modal` puts it on its backdrop as well.
+ */
+const BLOCKING_SELECTOR = '[aria-modal="true"],[data-blocks-drop="true"]';
+
+/**
+ * A blocker inside this is in the DOM but not on screen — `ui/Modal` marks
+ * itself `hidden` when the pane that owns it is not the visible one, so a
+ * dialog left open in project A stops refusing drops in project B the moment
+ * the tab changes.
+ *
+ * `[hidden]` only, deliberately. `aria-hidden="true"` used to count too, and
+ * it is not a visibility statement: it is routinely put on *visible*
+ * decorative content (`ui/Modal`'s own ✕ glyph, every `StatusIndicator`
+ * dot). An overlay that happened to sit inside such a wrapper would have
+ * silently stopped blocking — the exact class of hole this gate exists to
+ * close. `ui/Modal` sets `hidden`, the `hidden` attribute, and inline
+ * `display:none` together, so nothing in the app depended on the aria half.
+ */
+const OFFSCREEN_SELECTOR = "[hidden]";
+
+/** A blocker that is actually painted, rather than merely mounted. */
+function isOnScreen(el: Element): boolean {
+  return el.closest(OFFSCREEN_SELECTOR) === null;
+}
+
+/** True while a modal or a blocking overlay is on screen *anywhere*. */
+export function dropIsBlocked(doc: Document = document): boolean {
+  return Array.from(doc.querySelectorAll(BLOCKING_SELECTOR)).some(isOnScreen);
+}
+
+/**
+ * What both listeners say when they refuse a drop.
+ *
+ * `kind: "info"`, so it times out on its own: a drop refused because the user
+ * has a dialog open is expected behaviour, not an error, and an error card
+ * would sit on screen until dismissed. `dedupeKey` means three refused drops
+ * leave one notice rather than a stack of three.
+ */
+export const DROP_BLOCKED_TOAST = {
+  kind: "info",
+  message: "File drop ignored",
+  detail:
+    "A dialog or full-window overlay is open, so nothing accepts dropped files. Close it and drop again.",
+  dedupeKey: "drop-blocked",
+} as const;
+
+export interface DropTargetOptions {
+  doc?: Document;
+  /** Override the ratio used to convert physical pixels to CSS pixels. */
+  devicePixelRatio?: number;
+  /**
+   * Override the platform question "does this payload arrive in physical
+   * pixels?". Tests use it; nothing in the app passes it.
+   */
+  physicalPixelPayload?: boolean;
+}
+
+/**
+ * Whether the drop payload's coordinates are physical device pixels.
+ *
+ * **Only Windows delivers physical pixels.** `wry`'s WebView2 drag-drop
+ * handler reads the point from the OS in device pixels and passes it through
+ * (`wry/src/webview2/drag_drop.rs`), while the macOS and GTK backends deliver
+ * logical points and `tauri-runtime-wry`'s forwarding does not rescale them.
+ * Dividing by `devicePixelRatio` unconditionally therefore halved every drop
+ * position on a HiDPI Mac or Linux box, aiming the hit test at a point the
+ * user never touched.
+ *
+ * Verified by reading the wry/tauri sources named above. **Not** verified on a
+ * real HiDPI macOS or GTK machine — neither is available here — which is why
+ * the divisor is platform-conditional rather than simply deleted: the Windows
+ * behaviour is the one covered by tests and by the shipped code path.
+ */
+function payloadIsPhysical(
+  view: (Window & typeof globalThis) | null,
+  options: DropTargetOptions,
+): boolean {
+  if (options.physicalPixelPayload !== undefined) return options.physicalPixelPayload;
+  return /windows/i.test(view?.navigator?.userAgent ?? "");
+}
+
+/**
+ * Why a native drop at `pos` did or did not belong to `el`.
+ *
+ * - `accept` — it is ours, and the app is in a state to take it.
+ * - `blocked` — it was aimed at us, but a modal or a blocking overlay is on
+ *   screen. Worth *saying* to the user: the drop visibly did nothing.
+ * - `elsewhere` — not our drop. Silence is the right response; some other
+ *   pane's listener may be about to accept it.
+ *
+ * Geometry is asked **first**, so exactly one pane can ever answer `blocked`
+ * for a given drop and the refusal is announced once rather than once per
+ * listener.
+ */
+export type DropVerdict = "accept" | "blocked" | "elsewhere";
+
+export function classifyDrop(
+  el: HTMLElement | null | undefined,
+  pos: DropPoint,
+  options: DropTargetOptions = {},
+): DropVerdict {
+  const doc = options.doc ?? el?.ownerDocument ?? document;
+
+  const rect = el?.getBoundingClientRect();
+  if (!el || !rect || rect.width === 0 || rect.height === 0) return "elsewhere";
+
+  const view = doc.defaultView;
+  const dpr =
+    options.devicePixelRatio ??
+    (payloadIsPhysical(view, options) ? view?.devicePixelRatio || 1 : 1);
+  const x = pos.x / dpr;
+  const y = pos.y / dpr;
+  if (x < rect.left || x > rect.right || y < rect.top || y > rect.bottom) {
+    return "elsewhere";
+  }
+
+  // Whose drop it is has been settled. Whether the app should be taking drops
+  // at all is a separate, document-wide question — see the header.
+  return dropIsBlocked(doc) ? "blocked" : "accept";
+}
+
+/**
+ * Whether a native drop at `pos` (physical pixels on Windows, logical
+ * elsewhere) belongs to `el`.
+ */
+export function isDropTarget(
+  el: HTMLElement | null | undefined,
+  pos: DropPoint,
+  options: DropTargetOptions = {},
+): boolean {
+  return classifyDrop(el, pos, options) === "accept";
+}
diff --git a/app/src/lib/formatBytes.test.ts b/app/src/lib/formatBytes.test.ts
new file mode 100644
index 0000000..827ff9b
--- /dev/null
+++ b/app/src/lib/formatBytes.test.ts
@@ -0,0 +1,121 @@
+import { describe, it, expect } from "vitest";
+import { formatBytes, formatBytesCeiling, formatBytesDelta } from "./formatBytes";
+
+describe("formatBytes", () => {
+  it("defaults to base 1000, because that is what Docker prints", () => {
+    // Anything explaining `docker system df` has to match it, and Docker
+    // formats with `units.HumanSize` — base 1000. Showing 26.1 GB against a
+    // terminal saying 28.0 GB for the same object reads as a bug in the app.
+    expect(formatBytes(28_000_000_000)).toBe("28.0 GB");
+    expect(formatBytes(1_000)).toBe("1.0 KB");
+    expect(formatBytes(1_500_000)).toBe("1.5 MB");
+    expect(formatBytes(12_273_392_374)).toBe("12.3 GB");
+  });
+
+  it("leaves whole bytes without a decimal point", () => {
+    expect(formatBytes(0)).toBe("0 B");
+    expect(formatBytes(512)).toBe("512 B");
+    expect(formatBytes(999)).toBe("999 B");
+  });
+
+  it("reproduces the Project Home convention exactly under `binary`", () => {
+    // Three modules import `projects/home/format.ts#formatBytes`, which is now
+    // this function. Its output had to be byte-identical or re-pointing it
+    // would have quietly changed every file listing in the app.
+    expect(formatBytes(1023, { binary: true })).toBe("1023 B");
+    expect(formatBytes(1024, { binary: true })).toBe("1.0 KB");
+    expect(formatBytes(1024 * 1024, { binary: true })).toBe("1.0 MB");
+    expect(formatBytes(1024 * 1024 * 1024, { binary: true })).toBe("1.0 GB");
+    expect(formatBytes(1_610_612_736, { binary: true })).toBe("1.5 GB");
+  });
+
+  it("absorbs the last two ad-hoc formatters, behaviour change and all", () => {
+    // `UpdateDialog.formatSize` and the inline `toFixed(1)` in
+    // `useProjectActions` both divided by 1024 and both stopped at MB. Routing
+    // them here is what finally makes this the *only* byte formatter, and it
+    // changes two things on purpose — pinned so neither reads as a regression
+    // to whoever meets them next.
+    //
+    // KB gains a decimal, matching every other size in the app:
+    expect(formatBytes(512 * 1024, { binary: true })).toBe("512.0 KB");
+    // and the ladder no longer bottoms out at a five-digit megabyte count:
+    expect(formatBytes(2 * 1024 ** 3, { binary: true })).toBe("2.0 GB");
+    // Sub-kilobyte sizes stop rendering as "0 KB", which is what the old
+    // `(bytes / 1024).toFixed(0)` said about every release asset under 512 B.
+    expect(formatBytes(400, { binary: true })).toBe("400 B");
+  });
+
+  it("reproduces the migration convention exactly by default", () => {
+    // `migrationCopy.formatDataSize` is now a call to this, and its output is
+    // asserted in MigrateContainerModal.test.tsx.
+    expect(formatBytes(41_000_000)).toBe("41.0 MB");
+    expect(formatBytes(3_800_000_000)).toBe("3.8 GB");
+  });
+
+  it("labels binary units honestly when asked to", () => {
+    expect(formatBytes(1024, { binary: true, iec: true })).toBe("1.0 KiB");
+    expect(formatBytes(1024 ** 3, { binary: true, iec: true })).toBe("1.0 GiB");
+  });
+
+  it("climbs to TB rather than showing five-digit gigabytes", () => {
+    expect(formatBytes(2_500_000_000_000)).toBe("2.5 TB");
+  });
+
+  it("promotes the unit when rounding lands on a whole step", () => {
+    // `toFixed` runs after the divide loop, so a value just under a boundary
+    // rounds up into a unit the loop had already ruled out. This is the app's
+    // only byte formatter and the panel is full of near-boundary sizes.
+    expect(formatBytes(999_999)).toBe("1.0 MB");
+    expect(formatBytes(999_999_999)).toBe("1.0 GB");
+    expect(formatBytes(999_999_999_999)).toBe("1.0 TB");
+    expect(formatBytes(1_048_575, { binary: true })).toBe("1.0 MB");
+
+    // Just below the rounding threshold it must NOT promote.
+    expect(formatBytes(999_949)).toBe("999.9 KB");
+    expect(formatBytes(999_400, { precision: 0 })).toBe("999 KB");
+
+    // The top unit has nowhere to go: it renders a whole step rather than
+    // running off the end of the unit array.
+    expect(formatBytes(999_999_999_999_999_999)).toBe("1000.0 PB");
+  });
+
+  it("renders an em dash for a size the daemon did not compute", () => {
+    // Docker reports -1 for "not calculated" on shared sizes and volume ref
+    // counts. `NaN GB` in the middle of a table is worse than nothing.
+    expect(formatBytes(-1)).toBe("—");
+    expect(formatBytes(NaN)).toBe("—");
+    expect(formatBytes(Infinity)).toBe("—");
+  });
+
+  it("honours a requested precision", () => {
+    expect(formatBytes(1_234_567_890, { precision: 2 })).toBe("1.23 GB");
+    expect(formatBytes(1_234_567_890, { precision: 0 })).toBe("1 GB");
+  });
+});
+
+describe("formatBytesDelta", () => {
+  it("signs a figure that is being added rather than measured", () => {
+    // "Next commit adds +868.0 MB" — the sign is what makes it read as a cost
+    // about to be incurred rather than a size already on disk.
+    expect(formatBytesDelta(868_000_000)).toBe("+868.0 MB");
+    expect(formatBytesDelta(0)).toBe("+0 B");
+  });
+
+  it("does not sign an unknown", () => {
+    expect(formatBytesDelta(-1)).toBe("—");
+  });
+});
+
+describe("formatBytesCeiling", () => {
+  it("says 'up to', because a compaction's yield is a bound not a promise", () => {
+    // A projected yield cannot be known until the work runs, unlike every
+    // measured figure beside it — rendering it through a separate function is
+    // what stops it being read as a guarantee.
+    expect(formatBytesCeiling(5_100_000_000)).toBe("up to 5.1 GB");
+  });
+
+  it("refuses to imply a saving when there is no bound to give", () => {
+    expect(formatBytesCeiling(0)).toBe("an unknown amount");
+    expect(formatBytesCeiling(-1)).toBe("an unknown amount");
+  });
+});
diff --git a/app/src/lib/formatBytes.ts b/app/src/lib/formatBytes.ts
new file mode 100644
index 0000000..392bf06
--- /dev/null
+++ b/app/src/lib/formatBytes.ts
@@ -0,0 +1,117 @@
+/**
+ * The one byte formatter.
+ *
+ * The app had four of them — `projects/home/format.ts`,
+ * `projects/migrationCopy.ts`, `settings/UpdateDialog.tsx` and an inline
+ * `toFixed(1)` in `useProjectActions.ts` — disagreeing about the divisor, the
+ * unit labels and the precision. All four now delegate here, and there are no
+ * remaining copies.
+ *
+ * The last two were held back because re-pointing them changes what they
+ * render, and that turned out to be the argument for doing it rather than
+ * against. `UpdateDialog` rendered KB at `toFixed(0)` (`512 KB` is now
+ * `512.0 KB`, consistent with every other size in the app) and both stopped
+ * the ladder at MB, so a 2 GB asset or backup read as a five-digit number of
+ * megabytes. Both are `{ binary: true }`: they describe files, and a host file
+ * browser shows the ÷1024 figure for the same bytes.
+ *
+ * ## Why the default is base 1000
+ *
+ * Anything explaining what Docker reports has to match it, and Docker formats
+ * every size it prints with `units.HumanSize`, which is **base 1000**. Showing
+ * 26.1 GB where the user's terminal said 28.0 GB for the same object would read
+ * as a bug in the app. So decimal is the default and binary is opt-in, rather
+ * than the other way round.
+ *
+ * Both existing conventions are preserved for every size either call site can
+ * realistically produce — a file size or a payload size, i.e. a non-negative
+ * finite number below a terabyte. Outside that range this deliberately differs
+ * from what it replaced: a negative or `NaN` input now renders `—` rather than
+ * `-1 B` or `NaN GB`, and the unit ladder continues past GB instead of
+ * stopping there.
+ *
+ * - `{ }`                        → `41.0 MB`   (decimal, what migration used)
+ * - `{ binary: true }`           → `1.5 GB`    (÷1024 with decimal-style
+ *                                               labels, what Project Home used
+ *                                               — technically a misnomer, but
+ *                                               it is the app's convention and
+ *                                               changing it is not this
+ *                                               feature's business)
+ * - `{ binary: true, iec: true }` → `1.5 GiB`  (÷1024 labelled honestly)
+ */
+
+const DECIMAL_UNITS = ["B", "KB", "MB", "GB", "TB", "PB"];
+const IEC_UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB"];
+
+export interface FormatBytesOptions {
+  /** Divide by 1024 instead of 1000. */
+  binary?: boolean;
+  /** Label binary units as `KiB`/`MiB`/`GiB` rather than `KB`/`MB`/`GB`. */
+  iec?: boolean;
+  /** Decimal places above `B`. Bytes are always whole. */
+  precision?: number;
+}
+
+export function formatBytes(bytes: number, options: FormatBytesOptions = {}): string {
+  const { binary = false, iec = false, precision = 1 } = options;
+
+  // A negative or non-finite size is a bug upstream, not something to render as
+  // `NaN GB` in the middle of a table. Docker reports -1 for "not computed",
+  // and that is the case this actually catches.
+  if (!Number.isFinite(bytes) || bytes < 0) return "—";
+
+  const step = binary ? 1024 : 1000;
+  const units = binary && iec ? IEC_UNITS : DECIMAL_UNITS;
+
+  let value = bytes;
+  let unit = 0;
+  while (value >= step && unit < units.length - 1) {
+    value /= step;
+    unit += 1;
+  }
+
+  // **Promote again if rounding pushed the value back up to a whole step.**
+  // `toFixed` runs after the loop, so 999,999 B divides to 999.999 KB and then
+  // renders as "1000.0 KB" — a unit the loop had already decided against. The
+  // same happens at every boundary (999,999,999 → "1000.0 MB", and 1,048,575
+  // → "1024.0 KB" in binary).
+  if (unit < units.length - 1 && Number(value.toFixed(precision)) >= step) {
+    value /= step;
+    unit += 1;
+  }
+
+  // Whole bytes never get a decimal point: `512 B`, not `512.0 B`.
+  return unit === 0
+    ? `${Math.round(bytes)} ${units[0]}`
+    : `${value.toFixed(precision)} ${units[unit]}`;
+}
+
+/**
+ * `12.3 GB` → `+12.3 GB`, for a figure that is being *added* rather than
+ * measured. Used for "next commit adds …", which is the number that explains
+ * why a snapshot grows.
+ *
+ * **No caller on this branch**, for the same reason as [`formatBytesCeiling`]:
+ * the Disk panel's per-project table was the last one, and it went to
+ * `hold/disk-and-dragout`.
+ */
+export function formatBytesDelta(bytes: number, options?: FormatBytesOptions): string {
+  const formatted = formatBytes(bytes, options);
+  return formatted === "—" ? formatted : `+${formatted}`;
+}
+
+/**
+ * `up to 12.3 GB` — for a bound rather than a measurement.
+ *
+ * A figure that cannot be known until an operation runs must not render like
+ * one that was measured; going through a different function is what stops it
+ * being read as a promise.
+ *
+ * **No caller on this branch.** Its last one was the Disk panel's projected
+ * compaction yield, which went to `hold/disk-and-dragout`. Kept with its tests
+ * because the distinction it encodes is the reusable part.
+ */
+export function formatBytesCeiling(bytes: number, options?: FormatBytesOptions): string {
+  if (!Number.isFinite(bytes) || bytes <= 0) return "an unknown amount";
+  return `up to ${formatBytes(bytes, options)}`;
+}
diff --git a/app/src/lib/refusalText.test.ts b/app/src/lib/refusalText.test.ts
new file mode 100644
index 0000000..4a91c4d
--- /dev/null
+++ b/app/src/lib/refusalText.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+import { errorText, readableRefusal } from "./refusalText";
+
+/**
+ * Refusals that are a sentence the backend wrote for the person reading it.
+ * They used to arrive as a toast's `detail`, which renders as collapsed
+ * monospace behind a "Details" button — so the only part of the message that
+ * explained anything was the part nobody saw.
+ */
+describe("readableRefusal", () => {
+  const hidden =
+    'the path goes through ".ssh", a hidden folder — Triple-C will not save anything whose folders are not all visible. Choose a visible location.';
+  const outside =
+    "Folder path is outside the folders this panel can change (/workspace, /home/claude, /tmp): /etc";
+
+  it("recognises the hidden-host-folder refusal, in both directions", () => {
+    expect(readableRefusal(hidden)).toBe(hidden);
+    expect(
+      readableRefusal(
+        'the path goes through ".aws", a hidden folder — Triple-C will not read anything whose folders are not all visible. Choose a visible location.',
+      ),
+    ).toContain("hidden folder");
+  });
+
+  it("recognises the container write-root refusal", () => {
+    expect(readableRefusal(outside)).toBe(outside);
+  });
+
+  it("strips a wrapper a JS layer put in front of the sentence", () => {
+    // `invoke` rejects with the bare string today, but an `Error` anywhere in
+    // between would otherwise put "Error: " in front of prose meant to be read.
+    expect(readableRefusal(new Error(hidden))).toBe(hidden);
+    expect(readableRefusal(`Error: ${hidden}`)).toBe(hidden);
+    expect(readableRefusal(`Uncaught (in promise) Error: ${outside}`)).toBe(outside);
+    expect(readableRefusal({ message: `invoke failed: ${outside}` })).toBe(outside);
+  });
+
+  it("says nothing about failures that are not a written refusal", () => {
+    // Promotion is an improvement, not a fallback: anything unrecognised keeps
+    // reporting exactly as it did before.
+    expect(readableRefusal("File too large to upload (900 MB; limit 256 MB)")).toBeNull();
+    expect(readableRefusal("FILE_EXISTS: /workspace/a.txt already exists")).toBeNull();
+    expect(readableRefusal("cp: Permission denied")).toBeNull();
+    expect(readableRefusal(null)).toBeNull();
+  });
+});
+
+describe("errorText", () => {
+  it("keeps an ordinary message intact", () => {
+    expect(errorText("cp: cannot create regular file: Permission denied")).toBe(
+      "cp: cannot create regular file: Permission denied",
+    );
+  });
+
+  it("reads a message out of a shape `String()` would render as [object Object]", () => {
+    expect(errorText({ message: "Container not running" })).toBe("Container not running");
+    expect(errorText({ kind: "NotRunning" })).toBe("NotRunning");
+    expect(errorText(new Error("Failed to upload file to container: no space left"))).toBe(
+      "Failed to upload file to container: no space left",
+    );
+  });
+
+  it("prefers the written refusal when there is one", () => {
+    expect(errorText(new Error("Folder path is outside the folders this panel can change (/workspace): /etc"))).toBe(
+      "Folder path is outside the folders this panel can change (/workspace): /etc",
+    );
+  });
+});
diff --git a/app/src/lib/refusalText.ts b/app/src/lib/refusalText.ts
new file mode 100644
index 0000000..084d42d
--- /dev/null
+++ b/app/src/lib/refusalText.ts
@@ -0,0 +1,124 @@
+/**
+ * Turning a backend refusal into the sentence a person reads.
+ *
+ * Tauri command errors cross the IPC boundary as whatever `serde` made of them:
+ * a bare string from `Err(String)`, an object from a `#[derive(Serialize)]`
+ * error enum, or an `Error` if a JS layer wrapped it on the way through. All
+ * three are the same refusal, and the UI must not read differently depending on
+ * which one a future refactor produces — so everything here is tolerant about
+ * the *shape* of an error and picks the most human string out of it.
+ */
+
+/**
+ * Field names a serialised Rust error realistically uses for its discriminant
+ * and for its human text. `error` is listed as a discriminant field and yet
+ * routinely carries a whole sentence, which is why a kind string is read as
+ * prose too.
+ */
+const KIND_FIELDS = ["kind", "code", "type", "error", "reason"] as const;
+const MESSAGE_FIELDS = ["message", "msg", "detail", "description"] as const;
+
+function asRecord(e: unknown): Record<string, unknown> | null {
+  return typeof e === "object" && e !== null ? (e as Record<string, unknown>) : null;
+}
+
+/**
+ * Every string an error carries, flattened: the error itself if it is one, its
+ * message-ish fields, and its kind-ish fields. Nesting is followed one level
+ * because a wrapped error (`{ error: { message: … } }`) is the same refusal.
+ */
+function stringsIn(e: unknown, depth = 0): string[] {
+  if (typeof e === "string") return [e];
+  if (e instanceof Error) return [e.message, e.name];
+  const record = asRecord(e);
+  if (!record || depth > 1) return [];
+  const out: string[] = [];
+  const walk = (value: unknown) => {
+    if (typeof value === "string") out.push(value);
+    else if (value !== undefined) out.push(...stringsIn(value, depth + 1));
+  };
+  for (const field of KIND_FIELDS) walk(record[field]);
+  for (const field of MESSAGE_FIELDS) walk(record[field]);
+  return out;
+}
+
+/**
+ * Fragments that identify a refusal the backend already wrote **for a person**.
+ *
+ * The file commands guard two policies that a user can trip over by accident,
+ * and both answer with a finished sentence that names the offending path and
+ * says what to do instead:
+ *
+ *     the path goes through ".ssh", a hidden folder — Triple-C will not save …
+ *     Folder path is outside the folders this panel can change (/workspace, /home/claude, /tmp): /etc
+ *
+ * Those sentences were being used as the *detail* of a generic toast, and
+ * `ToastHost` renders a detail as collapsed monospace behind a "Details"
+ * button — so the one part of the message that explained anything was the part
+ * nobody saw. Matching them here lets the caller promote the sentence to the
+ * toast's headline.
+ *
+ * Matched on a stable fragment rather than the whole string, because the path
+ * and the verb ("save"/"read", "file"/"folder") vary per call. Deliberately a
+ * short list: an error that is *not* recognised still reports exactly as it
+ * did before, so a wrong guess here can only fail to promote, never mangle.
+ */
+const REFUSAL_MARKERS = [
+  // `validate_host_path` — hidden host component, and system locations.
+  "Triple-C will not",
+  // `validate_container_write_path` — outside /workspace, /home/claude, /tmp.
+  "outside the folders this panel can change",
+] as const;
+
+/**
+ * `Error: …`, `TypeError: …`, `invoke failed: …` — wrappers a JS layer may have
+ * put in front of the backend's sentence on the way through. Stripped so the
+ * prose starts where the backend started it; applied twice at most, because a
+ * doubly-wrapped error is the realistic worst case and looping on user text is
+ * not.
+ */
+const WRAPPER_PREFIX = /^(?:uncaught\s*(?:\(in promise\)\s*)?)?(?:[a-z]*error|invoke(?:\s+failed)?)\s*:\s*/i;
+
+function stripWrapper(text: string): string {
+  let out = text.trim();
+  for (let i = 0; i < 2; i++) {
+    const next = out.replace(WRAPPER_PREFIX, "").trim();
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/**
+ * The backend's own user-facing sentence, when this failure is one — otherwise
+ * `null`, and the caller reports it however it reported everything else.
+ */
+export function readableRefusal(e: unknown): string | null {
+  for (const s of stringsIn(e)) {
+    const text = stripWrapper(s);
+    if (REFUSAL_MARKERS.some((marker) => text.includes(marker))) return text;
+  }
+  return null;
+}
+
+/**
+ * The most human form of any failure, for the places that show one verbatim.
+ *
+ * `String(e)` is what these used to be, which turns a serialised error object
+ * into `[object Object]` and leaves a JS wrapper prefix on a sentence that
+ * reads perfectly well without it.
+ */
+export function errorText(e: unknown): string {
+  const readable = readableRefusal(e);
+  if (readable) return readable;
+  if (typeof e === "string") return stripWrapper(e);
+  if (e instanceof Error) return stripWrapper(e.message);
+  const record = asRecord(e);
+  if (record) {
+    for (const field of [...MESSAGE_FIELDS, ...KIND_FIELDS]) {
+      const value = record[field];
+      if (typeof value === "string" && value.trim().length > 0) return stripWrapper(value);
+    }
+  }
+  return String(e);
+}
diff --git a/app/src/lib/tauri-commands.ts b/app/src/lib/tauri-commands.ts
index f80607e..f9bb0fe 100644
--- a/app/src/lib/tauri-commands.ts
+++ b/app/src/lib/tauri-commands.ts
@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, BrowserViewPopoutState, BrowserPageState, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo } from "./types";
+import type { Project, ProjectPath, ContainerInfo, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, FileContents, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, BrowserViewPopoutState, BrowserPageState, PlaywrightDetection, BrowserSetupOutcome, BrowserInstallTarget, ContainerStaleness, MigrationOptions, MigrationReport, MigrationState, ClearTokenOutcome, CaCertInfo, UploadOutcome } from "./types";
 
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -7,8 +7,6 @@ export const checkImageExists = () => invoke<boolean>("check_image_exists");
 export const buildImage = () => invoke<void>("build_image");
 export const getContainerInfo = (projectId: string) =>
   invoke<ContainerInfo | null>("get_container_info", { projectId });
-export const listSiblingContainers = () =>
-  invoke<SiblingContainer[]>("list_sibling_containers");
 
 // Projects
 export const listProjects = () => invoke<Project[]>("list_projects");
@@ -71,12 +69,34 @@ export const stopAudioBridge = (sessionId: string) =>
 // Files
 export const listContainerFiles = (projectId: string, path: string) =>
   invoke<FileEntry[]>("list_container_files", { projectId, path });
-export const downloadContainerFile = (projectId: string, containerPath: string, hostPath: string) =>
-  invoke<void>("download_container_file", { projectId, containerPath, hostPath });
+/**
+ * Save one container file to the host.
+ *
+ * The **backend** opens the save dialog, so this call cannot name a place on
+ * the host — that is the point (see `pick_save_path` in `file_commands.rs`).
+ * Paths do come *back* inside error text; what is closed is the inbound
+ * direction.
+ * Resolves to the number of bytes written, or `null` if the user dismissed the
+ * dialog. Zero bytes is a success: an empty file is a file.
+ */
+export const downloadContainerFile = (projectId: string, containerPath: string) =>
+  invoke<number | null>("download_container_file", { projectId, containerPath });
+/**
+ * Upload host files into `containerDir`, with the backend opening the file
+ * picker. Resolves to `null` if the user dismissed it, otherwise to what
+ * happened — one dialog can select several files and they need not all succeed.
+ */
+export const uploadFilesToContainer = (projectId: string, containerDir: string) =>
+  invoke<UploadOutcome | null>("upload_files_to_container", { projectId, containerDir });
 export const downloadContainerBackup = (projectId: string, hostPath: string, containerPath?: string) =>
   invoke<number>("download_container_backup", { projectId, hostPath, containerPath });
-export const uploadFileToContainer = (projectId: string, hostPath: string, containerDir: string) =>
-  invoke<void>("upload_file_to_container", { projectId, hostPath, containerDir });
+export const readContainerFile = (projectId: string, path: string, maxBytes?: number) =>
+  invoke<FileContents>("read_container_file", { projectId, path, maxBytes });
+/** `toPath` is the new *name*, not a destination — renames never move. */
+export const renameContainerPath = (projectId: string, fromPath: string, toPath: string) =>
+  invoke<string>("rename_container_path", { projectId, fromPath, toPath });
+export const createContainerDirectory = (projectId: string, parentPath: string, name: string) =>
+  invoke<string>("create_container_directory", { projectId, parentPath, name });
 
 // Updates
 export const getAppVersion = () => invoke<string>("get_app_version");
@@ -277,8 +297,13 @@ export const setBrowserViewPopoutAlwaysOnTop = (projectId: string, onTop: boolea
 // lives in the OS keychain and is injected as a container env var.
 //
 // `acquireClaudeToken` borrows the given project's running container to run the
-// login (temporarily enabling its auth bridge), and streams progress on the
-// `claude-token-progress` and `claude-token-output` events. It resolves only
+// login and streams progress on the `claude-token-progress` and
+// `claude-token-output` events. It deliberately does *not* touch the project's
+// auth bridge: `setup-token` finishes on an Anthropic-hosted page and pastes a
+// code back, so there is no loopback callback for a bridge to carry — and an
+// earlier version that enabled it "just in case" persisted that flag to
+// projects.json and left it latched on whenever the flow was killed. See the
+// module comment in `commands/auth_token_commands.rs`. It resolves only
 // once the whole flow finishes, so call it without awaiting the UI on it.
 //
 // Partway through, `claude setup-token` prints a sign-in URL and then waits at
@@ -292,10 +317,16 @@ export const submitClaudeTokenCode = (code: string) =>
 /** Abort an in-flight acquisition and release the single-flight guard. No-op if nothing is running. */
 export const cancelClaudeToken = () => invoke<void>("cancel_claude_token");
 export const hasClaudeToken = () => invoke<boolean>("has_claude_token");
-/** Revoke the shared token. Also rewrites any snapshot image that still has it
- *  baked into its env — see `ClearTokenOutcome` for what may be left behind. */
+/** Revoke the shared token: delete the keychain entry **first**, then rewrite
+ *  any snapshot image that still has it baked into its env — see
+ *  `ClearTokenOutcome` for what may be left behind. Destructive; confirm it. */
 export const clearClaudeToken = () =>
   invoke<ClearTokenOutcome>("clear_claude_token");
+/** Rewrite snapshot images that still carry a credential, **without touching
+ *  the keychain**. This is the retry behind an incomplete revocation, and the
+ *  standalone "check my images" sweep; it never deletes a token. */
+export const sweepClaudeTokenSnapshots = () =>
+  invoke<ClearTokenOutcome>("sweep_claude_token_snapshots");
 
 // Container base-image migration — move a project onto the current base image
 // without deleting its volumes. Reset is the destructive alternative: it wipes
diff --git a/app/src/lib/types.ts b/app/src/lib/types.ts
index b4eec82..cc394d6 100644
--- a/app/src/lib/types.ts
+++ b/app/src/lib/types.ts
@@ -52,7 +52,13 @@ export interface Project {
    *  certificate file or a directory of them). null falls back to
    *  `AppSettings.ca_cert_path`. Changing it recreates the container. */
   ca_cert_path: string | null;
-  git_token: string | null;
+  /** **Write-only.** Rust marks this `#[serde(skip_serializing)]`, so it is
+   *  absent from every project the backend hands back — reading it gives
+   *  `undefined`, never `null`. Optional here so that is the type, and so a
+   *  `=== null` test against it is a compile error rather than a branch that
+   *  silently never runs. Still sent on the way *in*: this is how the secret
+   *  is set. */
+  git_token?: string | null;
   git_user_name: string | null;
   git_user_email: string | null;
   custom_env_vars: EnvVar[];
@@ -96,11 +102,23 @@ export type BedrockAuthMethod = "static_credentials" | "profile" | "bearer_token
 export interface BedrockConfig {
   auth_method: BedrockAuthMethod;
   aws_region: string;
-  aws_access_key_id: string | null;
-  aws_secret_access_key: string | null;
-  aws_session_token: string | null;
+  /** **Write-only.** Rust marks this `#[serde(skip_serializing)]`, so it is
+   *  absent from every project the backend hands back — reading it gives
+   *  `undefined`, never `null`. Optional here so that is the type, and so a
+   *  `=== null` test against it is a compile error rather than a branch that
+   *  silently never runs. Still sent on the way *in*: this is how the secret
+   *  is set. */
+  aws_access_key_id?: string | null;
+  aws_secret_access_key?: string | null;
+  aws_session_token?: string | null;
   aws_profile: string | null;
-  aws_bearer_token: string | null;
+  /** **Write-only.** Rust marks this `#[serde(skip_serializing)]`, so it is
+   *  absent from every project the backend hands back — reading it gives
+   *  `undefined`, never `null`. Optional here so that is the type, and so a
+   *  `=== null` test against it is a compile error rather than a branch that
+   *  silently never runs. Still sent on the way *in*: this is how the secret
+   *  is set. */
+  aws_bearer_token?: string | null;
   model_id: string | null;
   disable_prompt_caching: boolean;
   service_tier: string | null;
@@ -127,21 +145,45 @@ export interface LlamaCppConfig {
  *  implement the **Anthropic** Messages API — e.g. LiteLLM. */
 export interface OpenAiCompatibleConfig {
   base_url: string;
-  api_key: string | null;
+  /** **Write-only.** Rust marks this `#[serde(skip_serializing)]`, so it is
+   *  absent from every project the backend hands back — reading it gives
+   *  `undefined`, never `null`. Optional here so that is the type, and so a
+   *  `=== null` test against it is a compile error rather than a branch that
+   *  silently never runs. Still sent on the way *in*: this is how the secret
+   *  is set. */
+  api_key?: string | null;
   model_id: string | null;
   /** See `OllamaConfig.haiku_model_id`. */
   haiku_model_id: string | null;
 }
 
+/**
+ * Every field is three-state. `null` means "not set at this level": on a
+ * project that is "inherit the global value", and on the global settings it is
+ * "leave Claude Code's own default alone". `false` is a deliberate off, which
+ * is what lets a project turn a globally-enabled setting back off.
+ *
+ * Every field is optional as well as nullable: the Rust struct skips
+ * serialising a field it has no value for, so an object with nothing set at
+ * this level arrives as `{}`. Absent and `null` mean the same thing, which is
+ * why every read of one of these has to use `== null` rather than `=== null`.
+ */
 export interface ClaudeCodeSettings {
-  tui_mode: string | null;
-  effort: string | null;
-  auto_scroll_disabled: boolean;
-  focus_mode: boolean;
-  show_thinking_summaries: boolean;
-  enable_session_recap: boolean;
-  env_scrub: boolean;
-  prompt_caching_1h: boolean;
+  /** `null` = let Claude Code choose the renderer; `"default"` = classic, `"fullscreen"` = alt-screen. */
+  tui_mode?: string | null;
+  /** `null` = unset, else `"low" | "medium" | "high" | "xhigh"`. Written as `effortLevel`. */
+  effort?: string | null;
+  auto_scroll_disabled?: boolean | null;
+  /** Written as `viewMode: "focus"`. */
+  focus_mode?: boolean | null;
+  show_thinking_summaries?: boolean | null;
+  /**
+   * Turns the session recap **off**. Held in the disabled sense because Claude
+   * Code's recap is on by default — see the Rust doc on `ClaudeCodeSettings`.
+   */
+  session_recap_disabled?: boolean | null;
+  env_scrub?: boolean | null;
+  prompt_caching_1h?: boolean | null;
 }
 
 export interface ContainerInfo {
@@ -151,13 +193,6 @@ export interface ContainerInfo {
   image: string;
 }
 
-export interface SiblingContainer {
-  id: string;
-  names: string[] | null;
-  image: string;
-  state: string;
-  status: string;
-}
 
 export interface TerminalSession {
   id: string;
@@ -322,12 +357,40 @@ export interface ImageUpdateInfo {
 export interface FileEntry {
   name: string;
   path: string;
+  /** Dereferenced: a symlink pointing at a directory reads as one. */
   is_directory: boolean;
+  is_symlink: boolean;
   size: number;
   modified: string;
   permissions: string;
 }
 
+/**
+ * What one upload dialog's worth of files did — mirrors `UploadOutcome` in
+ * `commands/file_commands.rs`.
+ *
+ * Two lists rather than a count and a flag, because one dialog can select
+ * several files and they do not have to agree: a folder among the selection, or
+ * a file over the size ceiling, must not cost the user the ones either side of
+ * it. Each `failures` entry is already a finished sentence naming its file.
+ */
+export interface UploadOutcome {
+  /** In-container paths, in the order they landed. */
+  uploaded: string[];
+  /** One sentence per file that did not. */
+  failures: string[];
+}
+
+/** A file read out of the container for the in-app viewer. */
+export interface FileContents {
+  /** Base64 — a byte array would cross IPC as JSON numbers. */
+  contents_base64: string;
+  /** The file was larger than the cap; only a prefix came back. */
+  truncated: boolean;
+  /** The file's real size, not the length of what was returned. */
+  size: number;
+}
+
 export interface InstallOptions {
   os: "linux" | "macos" | "windows" | "unknown";
   product_name: string;
@@ -437,6 +500,11 @@ export interface BridgedPort {
   family: AuthBridgePortFamily;
   /** RFC 3339 timestamp of when the host listener was bound. */
   bridged_at: string;
+  /** Set when only the IPv4 half of the host listener could be bound. The port
+   *  is carrying traffic, but a client that resolves `localhost` to `::1` and
+   *  does not fall back will still be refused — which otherwise presents as a
+   *  login that hangs while the bridge reports itself healthy. */
+  ipv6_warning: string | null;
 }
 
 /** A discovered loopback listener that could not be bridged (host port taken). */
@@ -589,6 +657,12 @@ export interface ClearTokenOutcome {
   snapshots_scrubbed: string[];
   /** Images still holding it, each with the reason. Non-empty = incomplete. */
   snapshots_failed: string[];
+  /** Images left alone because the project was busy under the per-project lock
+   *  (a compaction, a migration, a recreate). **Not a failure and not a
+   *  success** — the token is still baked into these, and `clearClaudeToken`
+   *  is itself the retry. Kept separate from `snapshots_failed` so a skipped
+   *  credential removal can never be reported as a completed one. */
+  snapshots_skipped: string[];
   /** Rewritten, but the pre-rewrite image object could not be deleted because a
    *  container still runs off it. Clears itself when that container is
    *  recreated — worth mentioning, not worth alarming about. */
diff --git a/app/src/lib/urlDetector.test.ts b/app/src/lib/urlDetector.test.ts
index bc856d4..875bb9d 100644
--- a/app/src/lib/urlDetector.test.ts
+++ b/app/src/lib/urlDetector.test.ts
@@ -1,5 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { UrlDetector, flatten } from "./urlDetector";
+import { UrlDetector, flatten, osc8Targets, usableLink } from "./urlDetector";
+import type { UrlSource } from "./urlDetector";
 
 const COLS = 80;
 const enc = new TextEncoder();
@@ -17,6 +18,34 @@ function ptyWrap(text: string, cols = COLS): string {
   return lines.join("\r\n");
 }
 
+/**
+ * One OSC 8 hyperlink emission: the whole URL in the parameter, a slice of it
+ * as visible text.
+ *
+ * This is what `claude setup-token` actually prints — measured against 2.1.226,
+ * a 346-character URL arrives as five of these, each carrying the complete URL
+ * and 80 characters of it on screen.
+ */
+function osc8(uri: string, visible: string): string {
+  return `\x1b]8;;${uri}\x07${visible}\x1b]8;;\x07`;
+}
+
+/** Slice `uri` into `width`-character visible pieces, each a full hyperlink. */
+function slicedHyperlink(uri: string, width = COLS): string {
+  const parts: string[] = [];
+  for (let i = 0; i < uri.length; i += width) {
+    parts.push(osc8(uri, uri.slice(i, i + width)));
+  }
+  return parts.join("\r\n");
+}
+
+/** The URL Claude Code prints, at the length it really is. */
+const SIGN_IN_URL =
+  "https://claude.ai/oauth/authorize?code=true&client_id=9d1c250a-e61b-44d9-88ed-5944d1962f5e" +
+  "&response_type=code&redirect_uri=https%3A%2F%2Fconsole.anthropic.com%2Foauth%2Fcode%2Fcallback" +
+  "&scope=org%3Acreate_api_key+user%3Aprofile+user%3Ainference&code_challenge=" +
+  "vJ8Kq2mN4pR7sT9wX1zA3bC5dE6fG8hJ0kL2mN4pQ6r&code_challenge_method=S256&state=aB3dE5gH7jK9";
+
 beforeEach(() => vi.useFakeTimers());
 afterEach(() => vi.useRealTimers());
 
@@ -116,3 +145,215 @@ describe("UrlDetector", () => {
     expect(seen).toEqual([url]);
   });
 });
+
+describe("usableLink", () => {
+  // Ports `usable_sign_in_link` from `commands/auth_token_commands.rs` — a junk
+  // filter, not the security decision. `sanitizeRelayUrl` is still what stands
+  // between any of this and `openUrl`.
+  it("accepts an ordinary authorize URL", () => {
+    expect(usableLink(SIGN_IN_URL)).toBe(true);
+  });
+
+  it("rejects a scheme that is not http(s)", () => {
+    expect(usableLink("file:///etc/passwd")).toBe(false);
+    expect(usableLink("javascript:alert(1)")).toBe(false);
+  });
+
+  it("rejects anything outside printable ASCII", () => {
+    // A control character is how a URL is smuggled past a display, and
+    // `new URL()` strips some of them silently.
+    expect(usableLink("https://example.com/\u0000x")).toBe(false);
+    expect(usableLink("https://exa\u200bmple.com/x")).toBe(false);
+    expect(usableLink("https://example.com/a b")).toBe(false);
+  });
+});
+
+describe("osc8Targets", () => {
+  it("lifts the whole URL out of a sliced emission", () => {
+    const raw = slicedHyperlink(SIGN_IN_URL);
+    // Every piece carries the complete URL, however little of it is on screen.
+    expect(new Set(osc8Targets(raw))).toEqual(new Set([SIGN_IN_URL]));
+  });
+
+  it("ignores the closing half of a hyperlink", () => {
+    expect(osc8Targets("\x1b]8;;\x07")).toEqual([]);
+  });
+
+  it("ignores other OSCs, including the URL relay's own", () => {
+    expect(osc8Targets("\x1b]0;a window title\x07")).toEqual([]);
+    expect(osc8Targets("\x1b]7777;open;aHR0cHM6Ly9leGFtcGxlLmNvbQ==\x07")).toEqual([]);
+  });
+
+  it("reads a hyperlink terminated by ST as well as by BEL", () => {
+    expect(osc8Targets(`\x1b]8;id=1;${SIGN_IN_URL}\x1b\\text`)).toEqual([SIGN_IN_URL]);
+  });
+});
+
+describe("UrlDetector — OSC 8", () => {
+  it("recovers the complete URL from a sliced hyperlink", () => {
+    // The bug this branch exists for. `ANSI_RE` strips OSC sequences wholesale,
+    // so the scraper never saw the parameter and reassembled the *visible*
+    // pieces instead — a URL that parses, points at claude.ai, and cannot
+    // authorise anything.
+    const seen: [string, UrlSource][] = [];
+    const d = new UrlDetector((u, src) => seen.push([u, src]), () => COLS);
+
+    feed(d, "Open this link to sign in:\r\n" + slicedHyperlink(SIGN_IN_URL) + "\r\ndone\r\n");
+
+    expect(seen[0]).toEqual([SIGN_IN_URL, "osc8"]);
+  });
+
+  it("does not emit the same hyperlink again when it is repainted", () => {
+    const seen: [string, UrlSource][] = [];
+    const d = new UrlDetector((u, s) => seen.push([u, s]), () => COLS);
+
+    feed(d, slicedHyperlink(SIGN_IN_URL) + "\r\n");
+    feed(d, slicedHyperlink(SIGN_IN_URL) + "\r\n");
+
+    expect(seen.filter(([u]) => u === SIGN_IN_URL)).toHaveLength(1);
+  });
+
+  it("marks a scraped candidate as a guess, so the slot can refuse it", () => {
+    // Nothing here decides precedence — that is `supersedes` in TerminalView —
+    // but it is what makes the decision possible.
+    const seen: [string, UrlSource][] = [];
+    const d = new UrlDetector((u, s) => seen.push([u, s]), () => COLS);
+    const url = "https://example.com/" + "z".repeat(120);
+
+    feed(d, url + "\r\nnext\r\n");
+
+    expect(seen).toEqual([[url, "heuristic"]]);
+  });
+
+  it("never hands back a truncated guess at a link it has already seen exactly", () => {
+    // The defect: the prompt slot is emptied (dismissed, or auto-dismissed
+    // after 30 s), the OSC 8 target is deduped for the session and cannot come
+    // back, and the next repaint — sliced at a different offset, so a *new*
+    // string — reassembles into a prefix of the real link that fills the empty
+    // slot. It parses, it points at claude.ai, and it authorises nothing.
+    //
+    // Nothing here knows the slot was emptied, and that is the point: the rule
+    // holds however many times it is.
+    const seen: [string, UrlSource][] = [];
+    const d = new UrlDetector((u, s) => seen.push([u, s]), () => COLS);
+
+    feed(d, "Open this link to sign in:\r\n" + slicedHyperlink(SIGN_IN_URL) + "\r\ndone\r\n");
+    expect(seen).toEqual([[SIGN_IN_URL, "osc8"]]);
+
+    // …the user dismisses the toast; the TUI repaints the same link as plain
+    // text, cut short by the frame it was painted into.
+    feed(d, SIGN_IN_URL.slice(0, 150) + "\r\nWaiting for the browser…\r\n");
+
+    expect(seen).toHaveLength(1);
+    expect(seen.map(([u]) => u)).not.toContain(SIGN_IN_URL.slice(0, 150));
+  });
+
+  it("still offers a genuinely different link after an exact one", () => {
+    // The suppression is a prefix rule, not "one prompt per session".
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const other = "https://github.com/login/device?code=" + "x".repeat(90);
+
+    feed(d, slicedHyperlink(SIGN_IN_URL) + "\r\n");
+    feed(d, other + "\r\nnext\r\n");
+
+    expect(seen).toEqual([SIGN_IN_URL, other]);
+  });
+
+  it("suppresses a guess at a URL the consumer reported from the relay", () => {
+    // The OSC 7777 relay hands `TerminalView` a base64-encoded — therefore
+    // exact — URL that this detector never sees. `noteExactUrl` is how it gets
+    // told, so a dismissed relay prompt cannot be replaced by a scrape of the
+    // same link either.
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    d.noteExactUrl(SIGN_IN_URL);
+
+    feed(d, SIGN_IN_URL.slice(0, 150) + "\r\nnext\r\n");
+
+    expect(seen).toEqual([]);
+  });
+
+  it("ignores a short hyperlink", () => {
+    // `ls --hyperlink` decorates every filename; none of that is a prompt.
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+
+    feed(d, osc8("https://example.com/a", "a") + "\r\nnext\r\n");
+
+    expect(seen).toEqual([]);
+  });
+});
+
+describe("UrlDetector — repaints and resizes", () => {
+  it("treats a bare CR as a line break", () => {
+    // A TUI repaints by returning to column 0 without a line feed. Splitting on
+    // `\r?\n` alone leaves a whole frame on one "line", which is then longer
+    // than the width — so the `===` test says "not wrapped" and a break the
+    // terminal really did insert is never rejoined.
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+    const url = "https://example.com/" + "q".repeat(100);
+
+    feed(d, "spinner frame one\rspinner frame two\r" + ptyWrap(url) + "\r\ndone\r\n");
+
+    expect(seen).toEqual([url]);
+  });
+
+  it("does not glue two repainted frames into one token", () => {
+    const seen: string[] = [];
+    const d = new UrlDetector((u) => seen.push(u), () => COLS);
+
+    feed(
+      d,
+      "https://example.com/" + "a".repeat(90) + "\rhttps://evil.tld/" + "b".repeat(90) + "\r\n\r\ndone\r\n",
+    );
+
+    for (const url of seen) expect(new URL(url).host).not.toBe("example.comhttps");
+  });
+
+  it("reassembles with the width the bytes were printed at, not the current one", () => {
+    // The scan runs 300 ms after the print. A resize inside that window used to
+    // change every join decision retroactively: text wrapped at 80 columns,
+    // rejoined against a width of 120, comes back as separate lines glued with
+    // spaces — or, the other way round, as a URL nobody printed.
+    const seen: string[] = [];
+    let cols = COLS;
+    const d = new UrlDetector((u) => seen.push(u), () => cols);
+    const url =
+      "https://accounts.example.com/o/oauth2/auth?client_id=1234567890-abcdefghijklmnop.apps.example.com&redirect_uri=http%3A%2F%2Flocalhost%3A45678";
+
+    d.feed(new TextEncoder().encode(ptyWrap(url) + "\r\nWaiting…\r\n"));
+    cols = 120; // the user drags the window wider before the debounce fires
+    vi.advanceTimersByTime(2000);
+
+    expect(seen).toEqual([url]);
+  });
+
+  it("drops text buffered at a width that no longer applies", () => {
+    // Half printed at 80, half at 120: no single width reassembles both, so the
+    // older half goes rather than being joined by a rule that is wrong for it.
+    const seen: string[] = [];
+    let cols = COLS;
+    const d = new UrlDetector((u) => seen.push(u), () => cols);
+    const url = "https://example.com/" + "m".repeat(120);
+
+    d.feed(new TextEncoder().encode(ptyWrap(url.slice(0, 100))));
+    cols = 120;
+    feed(d, url.slice(100) + "\r\ndone\r\n");
+
+    // Whatever survives, it is never a URL that was not printed.
+    for (const u of seen) expect(url.startsWith(u) || u.startsWith(url)).toBe(true);
+  });
+});
+
+describe("flatten — bare CR", () => {
+  it("splits on a lone CR as well as on LF", () => {
+    expect(flatten("abcde\rfghij", 5)).toBe("abcdefghij");
+    expect(flatten("abc\rdef", 5)).toBe("abc def");
+  });
+
+  it("counts CRLF as one break, not two", () => {
+    expect(flatten("abcde\r\nfghij", 5)).toBe("abcdefghij");
+  });
+});
diff --git a/app/src/lib/urlDetector.ts b/app/src/lib/urlDetector.ts
index e0d48a1..6bab70c 100644
--- a/app/src/lib/urlDetector.ts
+++ b/app/src/lib/urlDetector.ts
@@ -24,17 +24,128 @@
  * When a URL match extends to the end of the flattened buffer, emission is
  * deferred (more chunks may still be arriving). A confirmation timer emits
  * the pending URL if no further data arrives within 500 ms.
+ *
+ * ## OSC 8 comes first, and the scraping is the fallback
+ *
+ * Everything above is guesswork over what a terminal *painted*. When the
+ * program emits an **OSC 8 hyperlink** there is no guesswork to do: the
+ * complete URL is in the sequence's parameter, contiguous and exact, however
+ * the visible text was sliced.
+ *
+ * That distinction is the whole reason this file grew a second branch. Claude
+ * Code prints its sign-in link as an OSC 8 hyperlink whose *visible* text is
+ * cut into terminal-width pieces on separate lines — measured against 2.1.226,
+ * a 346-character URL arrives as five emissions, each carrying the whole URL in
+ * its parameter and 80 characters of it on screen. `ANSI_RE` strips OSC
+ * sequences wholesale, so the scraper never saw the parameter and reassembled
+ * the visible pieces instead: a URL that parses, that points at claude.com, and
+ * that cannot authorise anything. The backend hit this first and solved it the
+ * same way — see `commands/auth_token_commands.rs`, whose `osc8_target` and
+ * `usable_sign_in_link` this mirrors.
+ *
+ * So each emitted candidate is tagged with where it came from, and the consumer
+ * refuses to let a `heuristic` candidate displace an `osc8` one.
+ *
+ * ## …and the exact copy keeps winning after the prompt is gone
+ *
+ * The consumer's precedence rule only compares a new candidate against what is
+ * *currently* in the prompt slot. Empty the slot — the user dismisses the
+ * toast, or its 30 s auto-dismiss fires — and it has nothing to compare
+ * against, so the next truncated guess walks straight in. Meanwhile the OSC 8
+ * target is deduped for the life of the session and cannot come back to
+ * displace it. The user is then holding a URL that parses, points at
+ * claude.ai, and authorises nothing, which is the exact bug the OSC 8 branch
+ * was added to kill.
+ *
+ * That is fixed *here* rather than in the consumer, because this is the side
+ * that knows both halves: {@link UrlDetector} remembers every exact URL it has
+ * seen and refuses to emit a heuristic candidate that is a strict prefix of
+ * one — see `truncatesKnownExact`. The rule then holds however often the slot
+ * is emptied, and needs no cooperation from whoever owns it.
  */
 
+import { extendsUrl } from "./urlRelay";
+
 const ANSI_RE =
   /\x1b(?:\[[0-9;?]*[A-Za-z]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[()#][A-Za-z0-9]|.)/g;
 
+/**
+ * OSC 8 hyperlink: `ESC ] 8 ; <params> ; <uri> (BEL | ESC \\)`.
+ *
+ * The params field is `key=value` pairs separated by `:`, never `;`, so the
+ * first `;` after the `8;` ends it — the same split `osc8_target` makes in
+ * Rust. The closing half of a hyperlink is `8;;` with an empty uri.
+ */
+// eslint-disable-next-line no-control-regex
+const OSC8_RE = /\x1b\]8;([^;\x07\x1b]*);([^\x07\x1b]*)(?:\x07|\x1b\\)/g;
+
 const MAX_BUFFER = 8 * 1024; // 8 KB rolling buffer cap
 const DEBOUNCE_MS = 300;
 const CONFIRM_MS = 500; // extra wait when URL reaches end of buffer
 const MIN_URL_LENGTH = 100;
 
-export type UrlCallback = (url: string) => void;
+/** Mirrors `MAX_LINK_LENGTH` in `commands/auth_token_commands.rs`. */
+const MAX_LINK_LENGTH = 8192;
+
+/** Bound on remembered OSC 8 targets, so a program printing a fresh hyperlink
+ *  every frame cannot grow this without limit. */
+const MAX_REMEMBERED_LINKS = 32;
+
+/**
+ * Where a candidate came from, which is the same thing as how much it can be
+ * trusted to be *complete*.
+ *
+ * `osc8` is lifted verbatim out of a hyperlink parameter; `heuristic` was
+ * reassembled from painted text and may be a truncated guess. The consumer
+ * uses this to decide precedence — see `promptUrl` in `TerminalView.tsx`.
+ */
+export type UrlSource = "osc8" | "heuristic";
+
+export type UrlCallback = (url: string, source: UrlSource) => void;
+
+/**
+ * Whether an OSC 8 target is worth offering as a candidate at all.
+ *
+ * A direct port of `usable_sign_in_link` in
+ * `commands/auth_token_commands.rs`, and deliberately just as shallow: this is
+ * a junk filter, not the security decision. `sanitizeRelayUrl` is still the
+ * only thing standing between any of this and `openUrl`, and duplicating its
+ * rules here would be a second place for them to go stale.
+ *
+ * The one rule from the Rust that is not ported is its `sk-ant-` check: that
+ * exists because the backend's link path bypasses `SecretRedactor`, and there
+ * is no redactor on this side to bypass.
+ */
+export function usableLink(uri: string): boolean {
+  if (!uri.startsWith("https://") && !uri.startsWith("http://")) return false;
+  if (uri.length > MAX_LINK_LENGTH) return false;
+  // Printable ASCII only. Control characters and whitespace are exactly how a
+  // URL is smuggled past a display, and `new URL()` strips some of them
+  // silently; a real authorize URL is percent-encoded anyway.
+  for (let i = 0; i < uri.length; i++) {
+    const code = uri.charCodeAt(i);
+    if (code < 0x21 || code > 0x7e) return false;
+  }
+  return true;
+}
+
+/**
+ * Every usable OSC 8 hyperlink target in `raw`, in the order they were emitted.
+ *
+ * Takes the *unstripped* stream: `ANSI_RE` deletes OSC sequences wholesale, so
+ * by the time the buffer is clean the parameter this reads is already gone.
+ */
+export function osc8Targets(raw: string): string[] {
+  const out: string[] = [];
+  OSC8_RE.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = OSC8_RE.exec(raw)) !== null) {
+    const uri = m[2];
+    // `8;;` closes a hyperlink and carries no target.
+    if (uri && usableLink(uri)) out.push(uri);
+  }
+  return out;
+}
 
 /**
  * How wide the terminal is right now.
@@ -61,7 +172,13 @@ export type ColumnsGetter = () => number;
  * confirmed by the user before anything opens.
  */
 export function flatten(clean: string, columns: number): string {
-  const lines = clean.split(/\r?\n/);
+  // A bare `\r` is a break too. A TUI repaints a frame by returning to column
+  // 0 without a line feed, so splitting on `\r?\n` alone leaves a whole
+  // frame's worth of text on one "line" — which is then far longer than
+  // `columns`, so the `===` test below says "not wrapped" and a URL the
+  // terminal really did cut is never rejoined. Splitting here is also what the
+  // backend does with a lone CR (`strip_ansi_prefix`), for the same reason.
+  const lines = clean.split(/\r\n|\r|\n/);
   let out = "";
   for (let i = 0; i < lines.length; i++) {
     out += lines[i];
@@ -84,6 +201,35 @@ export class UrlDetector {
   private pendingUrl: string | null = null;
   private callback: UrlCallback;
   private columns: ColumnsGetter;
+  /**
+   * The width in effect when the buffered bytes were *printed*, sampled in
+   * `feed`.
+   *
+   * Not read in `scan`, which is where it used to be read: the scan happens
+   * 300 ms after the print, and a resize inside that window would reassemble
+   * text wrapped at 80 columns using a width of 120 — every join decision
+   * wrong, and a fabricated URL out the other end. `-1` means "nothing fed
+   * yet".
+   */
+  private feedColumns = -1;
+  /** OSC 8 targets already offered, so a hyperlink repainted every frame does
+   *  not re-prompt. Bounded by {@link MAX_REMEMBERED_LINKS}. */
+  private emittedLinks = new Set<string>();
+  /**
+   * Every *exact* URL this session has seen — OSC 8 parameters, plus whatever
+   * the consumer reports through {@link noteExactUrl} (the OSC 7777 relay).
+   *
+   * Kept separately from `emittedLinks` because the two answer different
+   * questions: that one is "have I already prompted for this?", this one is "do
+   * I know the full text of a link some guess might be a prefix of?". The
+   * second answer must survive the prompt being dismissed; the whole defect is
+   * that a truncated guess fills the slot the moment it is empty.
+   *
+   * Bounded the same way, and cleared wholesale rather than evicted one by one:
+   * a program printing a fresh hyperlink every frame is not a program whose
+   * older links are still on screen to be mis-scraped.
+   */
+  private exactUrls = new Set<string>();
 
   constructor(callback: UrlCallback, columns: ColumnsGetter) {
     this.callback = callback;
@@ -92,6 +238,18 @@ export class UrlDetector {
 
   /** Feed raw PTY output chunks. */
   feed(data: Uint8Array): void {
+    const columns = this.columns();
+    if (this.feedColumns !== -1 && columns !== this.feedColumns) {
+      // The buffered text was wrapped at a width that no longer applies, and
+      // the new text will be wrapped at this one. There is no single width
+      // that reassembles both, so the older half is dropped rather than
+      // joined by a rule that is now wrong for it. Costs a URL that was
+      // mid-print across a resize; never invents one.
+      this.buffer = "";
+      this.pendingUrl = null;
+    }
+    this.feedColumns = columns;
+
     this.buffer += this.decoder.decode(data, { stream: true });
 
     // Cap buffer to avoid unbounded growth
@@ -114,11 +272,19 @@ export class UrlDetector {
   }
 
   private scan(): void {
+    // 0. The exact copy first. An OSC 8 parameter needs no reassembly, so
+    //    anything found here beats whatever the steps below reconstruct — and
+    //    it has to be read from the raw buffer, because step 1 deletes the
+    //    sequence that carries it.
+    this.scanLinks();
+
     // 1. Strip ANSI escape sequences
     const clean = this.buffer.replace(ANSI_RE, "");
 
     // 2. Flatten the buffer: rejoin hard wraps, terminate on everything else.
-    const flat = flatten(clean, this.columns());
+    //    The width is the one that was in effect when these bytes were
+    //    printed, not the one the terminal happens to have now.
+    const flat = flatten(clean, this.feedColumns);
 
     if (!flat) return;
 
@@ -153,9 +319,9 @@ export class UrlDetector {
 
       // 6. URL is clearly complete (more content follows) — dedup + emit
       this.pendingUrl = null;
-      if (url !== this.lastEmitted) {
+      if (url !== this.lastEmitted && !this.truncatesKnownExact(url)) {
         this.lastEmitted = url;
-        this.callback(url);
+        this.callback(url, "heuristic");
       }
     }
 
@@ -166,14 +332,90 @@ export class UrlDetector {
     }
   }
 
+  /**
+   * Offer every OSC 8 target in the buffer that has not been offered before.
+   *
+   * `lastEmitted` is moved along with them so an identical string arriving on
+   * the heuristic path a moment later is recognised as the same candidate
+   * rather than fired a second time.
+   *
+   * Every target is remembered as exact whether or not it is offered — a
+   * hyperlink repainted a second time is the same known link, and the dedup
+   * that stops it re-prompting must not also stop it counting as something a
+   * later guess can be a truncation of.
+   *
+   * The alternative fix considered here was to make this dedup *releasable*,
+   * so the consumer could hand the exact URL back and have it re-offered once
+   * the prompt slot emptied. Rejected: it re-offers on the very next repaint,
+   * so dismissing the toast would put it straight back on screen — and it
+   * still would not establish the invariant, because a truncated guess and the
+   * released exact URL would simply race for the empty slot.
+   */
+  private scanLinks(): void {
+    for (const uri of osc8Targets(this.buffer)) {
+      if (uri.length < MIN_URL_LENGTH) continue;
+      this.rememberExact(uri);
+      if (this.emittedLinks.has(uri)) continue;
+      if (this.emittedLinks.size >= MAX_REMEMBERED_LINKS) {
+        this.emittedLinks.clear();
+      }
+      this.emittedLinks.add(uri);
+      this.lastEmitted = uri;
+      this.callback(uri, "osc8");
+    }
+  }
+
   private emitPending(): void {
-    if (this.pendingUrl && this.pendingUrl !== this.lastEmitted) {
+    if (
+      this.pendingUrl &&
+      this.pendingUrl !== this.lastEmitted &&
+      !this.truncatesKnownExact(this.pendingUrl)
+    ) {
       this.lastEmitted = this.pendingUrl;
-      this.callback(this.pendingUrl);
+      this.callback(this.pendingUrl, "heuristic");
     }
     this.pendingUrl = null;
   }
 
+  /**
+   * Whether `url` is a strict prefix of an exact URL already seen — i.e. a
+   * truncated guess at a link whose full text is known.
+   *
+   * {@link extendsUrl} is the predicate, used in the direction that asks "does
+   * the link I already have *extend* this guess?". It is the same rule the
+   * prompt slot uses to let a candidate grow into its complete form, which is
+   * the point: the two must agree about what "the same link, only shorter"
+   * means, so there is one implementation of it.
+   *
+   * Deliberately *not* symmetric. A candidate that is longer than a known exact
+   * URL and starts with it is a different problem (text glued onto the end by a
+   * wrap that was not a wrap), and it is still shown in full and confirmed by
+   * the user before anything opens.
+   */
+  private truncatesKnownExact(url: string): boolean {
+    for (const exact of this.exactUrls) {
+      if (extendsUrl(exact, url)) return true;
+    }
+    return false;
+  }
+
+  /**
+   * Record a URL that arrived somewhere exact, outside this detector.
+   *
+   * The OSC 7777 relay hands `TerminalView` a base64-encoded URL — exact by
+   * construction, and never seen here. Without this the suppression rule above
+   * would cover hyperlinks and miss the relay, and a dismissed relay prompt
+   * could still be replaced by a truncated scrape of the same link.
+   */
+  noteExactUrl(url: string): void {
+    this.rememberExact(url);
+  }
+
+  private rememberExact(url: string): void {
+    if (this.exactUrls.size >= MAX_REMEMBERED_LINKS) this.exactUrls.clear();
+    this.exactUrls.add(url);
+  }
+
   dispose(): void {
     if (this.timer !== null) {
       clearTimeout(this.timer);
diff --git a/app/src/lib/urlRelay.ts b/app/src/lib/urlRelay.ts
index 1940fac..2f7b210 100644
--- a/app/src/lib/urlRelay.ts
+++ b/app/src/lib/urlRelay.ts
@@ -158,6 +158,42 @@ export function sanitizeRelayUrl(
   return normalized;
 }
 
+/**
+ * Whether `next` is the same link as `current`, only longer.
+ *
+ * The single rule that lets a later candidate displace an earlier one when both
+ * were scraped from the same untrusted stream. A repainting TUI lands a
+ * truncated copy of a link in the transcript before the complete one, and this
+ * is what joins them back up — safely, because a longer string sharing a prefix
+ * with the current pick necessarily has the same scheme, host and port, so an
+ * attacker cannot use it to move the origin.
+ *
+ * Longest-wins without the prefix test is what this replaced, and it handed the
+ * choice to the attacker: pad a hostile URL and it displaces the real one.
+ *
+ * Used by `pickSignInUrl` (`hooks/useClaudeAuth.ts`) and by the terminal's URL
+ * prompt slot (`components/terminal/TerminalView.tsx`). One implementation, on
+ * purpose.
+ */
+export function extendsUrl(next: string, current: string): boolean {
+  return next.length > current.length && next.startsWith(current);
+}
+
+/**
+ * Whether this is a URL that signs the user in to Anthropic.
+ *
+ * Used to decide *presentation*, not permission — the toast makes the
+ * container-side browser the default action for these, because the OAuth
+ * callback listener is inside the container and the host has nothing to catch
+ * it with. It is deliberately the same host allowlist the sign-in flow itself
+ * uses, so the two cannot disagree about what a sign-in link is.
+ */
+export function isAnthropicSignInUrl(url: string): boolean {
+  const safe = sanitizeRelayUrl(url, { allowHosts: ANTHROPIC_SIGN_IN_HOSTS });
+  if (!safe) return false;
+  return /oauth|authorize|login|sign-?in/i.test(safe);
+}
+
 /**
  * The origin of an already-sanitized URL, for display.
  *
diff --git a/app/src/store/appState.test.ts b/app/src/store/appState.test.ts
index dae5658..ddd9027 100644
--- a/app/src/store/appState.test.ts
+++ b/app/src/store/appState.test.ts
@@ -77,3 +77,38 @@ describe("tab reordering", () => {
     expect(useAppState.getState().activeTabKey).toBe(C);
   });
 });
+
+describe("toasts", () => {
+  beforeEach(() => useAppState.setState({ toasts: [] }));
+
+  const toasts = () => useAppState.getState().toasts;
+
+  it("stacks unkeyed toasts, which are one-off reports", () => {
+    const { pushToast } = useAppState.getState();
+    pushToast({ kind: "error", message: "one" });
+    pushToast({ kind: "error", message: "two" });
+    expect(toasts().map((t) => t.message)).toEqual(["one", "two"]);
+  });
+
+  it("lets a keyed toast supersede the one already on screen", () => {
+    // A recurring notice — "File drop ignored" is the one that exists — must
+    // not build a wall of identical cards when the user tries three times.
+    const { pushToast } = useAppState.getState();
+    const first = pushToast({ kind: "info", message: "ignored", dedupeKey: "drop-blocked" });
+    pushToast({ kind: "error", message: "unrelated" });
+    const second = pushToast({ kind: "info", message: "ignored", dedupeKey: "drop-blocked" });
+
+    expect(toasts().map((t) => t.message)).toEqual(["unrelated", "ignored"]);
+    // A fresh id, so the card re-mounts and its dismissal timer restarts
+    // rather than the replacement inheriting the first one's remaining time.
+    expect(second).not.toBe(first);
+    expect(toasts().some((t) => t.id === first)).toBe(false);
+  });
+
+  it("keeps toasts with different keys apart", () => {
+    const { pushToast } = useAppState.getState();
+    pushToast({ kind: "info", message: "a", dedupeKey: "x" });
+    pushToast({ kind: "info", message: "b", dedupeKey: "y" });
+    expect(toasts()).toHaveLength(2);
+  });
+});
diff --git a/app/src/store/appState.ts b/app/src/store/appState.ts
index 29a1f1c..8dc1b45 100644
--- a/app/src/store/appState.ts
+++ b/app/src/store/appState.ts
@@ -47,6 +47,12 @@ export interface Toast {
   message: string;
   /** Long text (e.g. a bollard error) shown behind a "Details" disclosure. */
   detail?: string;
+  /**
+   * Optional identity for a *recurring* notice. Pushing another toast with the
+   * same key replaces the one already on screen instead of stacking a second
+   * copy of it — three refused file drops leave one card, not three.
+   */
+  dedupeKey?: string;
 }
 
 let toastCounter = 0;
@@ -355,7 +361,14 @@ export const useAppState = create<AppState>((set) => ({
   toasts: [],
   pushToast: (toast) => {
     const id = `toast-${++toastCounter}`;
-    set((state) => ({ toasts: [...state.toasts, { ...toast, id }] }));
+    set((state) => {
+      // A keyed toast supersedes the previous one with that key. The new card
+      // gets a new id, so it re-mounts and its dismissal timer restarts.
+      const kept = toast.dedupeKey
+        ? state.toasts.filter((t) => t.dedupeKey !== toast.dedupeKey)
+        : state.toasts;
+      return { toasts: [...kept, { ...toast, id }] };
+    });
     return id;
   },
   dismissToast: (id) =>
diff --git a/container/Dockerfile b/container/Dockerfile
index 8b4cc41..fc81ee9 100644
--- a/container/Dockerfile
+++ b/container/Dockerfile
@@ -1,5 +1,24 @@
 FROM ubuntu:24.04
 
+# ── Provenance labels ────────────────────────────────────────────────────────
+# Without these the base image carries no labels at all, and
+# `sweep_orphaned_snapshots` (app/src-tauri/src/docker/container.rs) filters on
+# `dangling=true` **and** `triple-c.managed=true` — so a superseded base image,
+# left untagged when a newer build claims `triple-c-sandbox:latest`, could never
+# match and was never collected. ~11.9 GB of stranded base images was measured
+# on one developer's daemon this way.
+#
+# `triple-c.managed=true` is what makes them sweepable. Note that Docker merges
+# an image's labels into the containers created from it and `docker commit`
+# copies a container's labels onto the image, so this value also arrives on
+# every container and every snapshot — which is harmless, because
+# `create_container` writes the same key explicitly anyway.
+#
+# `triple-c.base=true` marks *this* image specifically, so a base image can be
+# told apart from a project snapshot without parsing repository names.
+LABEL triple-c.managed=true
+LABEL triple-c.base=true
+
 # Multi-arch: builds for linux/amd64 and linux/arm64 (Apple Silicon)
 # Avoid interactive prompts during package install
 ENV DEBIAN_FRONTEND=noninteractive
diff --git a/container/entrypoint.sh b/container/entrypoint.sh
index 2e859b2..fb92c06 100644
--- a/container/entrypoint.sh
+++ b/container/entrypoint.sh
@@ -405,26 +405,46 @@ install_feature_skill pia-vpn "${VPN_SUPPORT_ENABLED:-0}"
 unset VPN_SUPPORT_ENABLED
 
 # ── Claude Code settings ────────────────────────────────────────────────────
-# Merge Claude Code settings into ~/.claude/settings.json (preserves existing
-# keys). Creates the file if it doesn't exist. These control TUI mode, effort
-# level, focus mode, thinking summaries, and other CLI behavior.
+# Apply the managed Claude Code settings to ~/.claude/settings.json, keeping
+# every key the user set inside the container.
+#
+# `settings.json` lives on the persisted triple-c-claude-config-{id} volume, so
+# it outlives the container and a plain `.[0] * .[1]` merge could only ever
+# *add*. That is what made every one of these settings one-way: switching one
+# off in Triple-C omitted its key, the merge preserved the old on-value, and the
+# setting stayed on until a destructive Reset. So Rust states the whole managed
+# key set on every start, in two parts: CLAUDE_CODE_SETTINGS_JSON holds the keys
+# that have a value, and CLAUDE_CODE_SETTINGS_CLEAR is a JSON array of the key
+# names whose neutral state is *unset* (`tui`, `effortLevel`, `viewMode`,
+# `awaySummaryEnabled`) and which must therefore be deleted rather than pinned
+# to a stand-in value.
+#
+# The two are kept apart rather than using a null-means-delete payload because
+# a project recreates from its own snapshot image, which carries whatever
+# entrypoint it was built with. An older one merges with a plain `.[0] * .[1]`
+# and would write literal nulls into the user's settings.json; it ignores
+# CLAUDE_CODE_SETTINGS_CLEAR instead, keeping the old sticky behaviour until the
+# project is migrated or Reset.
+# See `build_claude_code_settings_json` in app/src-tauri/src/docker/container.rs.
 if [ -n "$CLAUDE_CODE_SETTINGS_JSON" ]; then
     SETTINGS_FILE="/home/claude/.claude/settings.json"
     mkdir -p /home/claude/.claude
-    if [ -f "$SETTINGS_FILE" ]; then
-        # Merge: existing settings + new settings (new keys override on conflict)
-        MERGED=$(jq -s '.[0] * .[1]' "$SETTINGS_FILE" <(printf '%s' "$CLAUDE_CODE_SETTINGS_JSON") 2>/dev/null)
-        if [ -n "$MERGED" ]; then
-            printf '%s\n' "$MERGED" > "$SETTINGS_FILE"
-        else
-            echo "entrypoint: warning — failed to merge Claude Code settings into $SETTINGS_FILE"
-        fi
+    # One code path for "file exists" and "file doesn't".
+    [ -f "$SETTINGS_FILE" ] || printf '{}\n' > "$SETTINGS_FILE"
+    MERGED=$(jq -s --argjson clear "${CLAUDE_CODE_SETTINGS_CLEAR:-[]}" '
+        .[0] as $current
+        | .[1] as $set
+        | ($current * $set) | delpaths($clear | map([.]))
+    ' "$SETTINGS_FILE" <(printf '%s' "$CLAUDE_CODE_SETTINGS_JSON") 2>/dev/null)
+    if [ -n "$MERGED" ]; then
+        printf '%s\n' "$MERGED" > "$SETTINGS_FILE"
     else
-        printf '%s\n' "$CLAUDE_CODE_SETTINGS_JSON" > "$SETTINGS_FILE"
+        echo "entrypoint: warning — failed to merge Claude Code settings into $SETTINGS_FILE"
     fi
     chown claude:claude "$SETTINGS_FILE"
     chmod 600 "$SETTINGS_FILE"
     unset CLAUDE_CODE_SETTINGS_JSON
+    unset CLAUDE_CODE_SETTINGS_CLEAR
 fi
 
 # ── AWS SSO auth refresh command ──────────────────────────────────────────────
@@ -434,30 +454,76 @@ fi
 # previous Bedrock-profile session — ~/.claude.json lives in the persisted home
 # volume, so without this the container keeps trying to run the SSO refresh even
 # after switching to a non-SSO backend (Anthropic/Ollama) or to static creds.
+# Replace ~/.claude.json atomically: write a sibling temp file, then rename.
+#
+# `> "$CLAUDE_JSON"` truncates before it writes, so a write that fails part-way
+# — a full home volume being the obvious way, and bounding that volume is what
+# half this release is about — leaves the file unparseable. It holds the OAuth
+# account, and the damage does not self-heal: the next start's `jq` fails on the
+# corrupt file, `MERGED` comes back empty, and the `[ -n "$MERGED" ]` guard
+# skips the write that would have repaired it. `triple-c-task-runner` has done
+# it this way all along.
+write_claude_json() {
+    _wcj_tmp="${CLAUDE_JSON}.triple-c-tmp"
+    if printf '%s\n' "$1" > "$_wcj_tmp" 2>/dev/null; then
+        mv -f "$_wcj_tmp" "$CLAUDE_JSON" 2>/dev/null || rm -f "$_wcj_tmp"
+    else
+        rm -f "$_wcj_tmp"
+        echo "entrypoint: warning — could not write $CLAUDE_JSON (leaving it as it was)"
+        return 1
+    fi
+    # By name, after the rename, so these land on the new inode.
+    chown claude:claude "$CLAUDE_JSON"
+    chmod 600 "$CLAUDE_JSON"
+}
+
 CLAUDE_JSON="/home/claude/.claude.json"
 if [ -n "$AWS_SSO_AUTH_REFRESH_CMD" ]; then
     if [ -f "$CLAUDE_JSON" ]; then
         MERGED=$(jq --arg cmd "$AWS_SSO_AUTH_REFRESH_CMD" '.awsAuthRefresh = $cmd' "$CLAUDE_JSON" 2>/dev/null)
         if [ -n "$MERGED" ]; then
-            printf '%s\n' "$MERGED" > "$CLAUDE_JSON"
+            write_claude_json "$MERGED"
         fi
     else
-        printf '{"awsAuthRefresh":"%s"}\n' "$AWS_SSO_AUTH_REFRESH_CMD" > "$CLAUDE_JSON"
+        # No existing file, so there is nothing to destroy — but go through the
+        # same helper so the owner and mode are set in one place.
+        write_claude_json "$(printf '{"awsAuthRefresh":"%s"}' "$AWS_SSO_AUTH_REFRESH_CMD")"
     fi
-    chown claude:claude "$CLAUDE_JSON"
-    chmod 600 "$CLAUDE_JSON"
     unset AWS_SSO_AUTH_REFRESH_CMD
 elif [ -f "$CLAUDE_JSON" ] && grep -q '"awsAuthRefresh"' "$CLAUDE_JSON" 2>/dev/null; then
     # Only rewrite when the key is actually present, to avoid a needless jq
     # reformat of ~/.claude.json on every start of a non-SSO backend.
     MERGED=$(jq 'del(.awsAuthRefresh)' "$CLAUDE_JSON" 2>/dev/null)
     if [ -n "$MERGED" ]; then
-        printf '%s\n' "$MERGED" > "$CLAUDE_JSON"
-        chown claude:claude "$CLAUDE_JSON"
-        chmod 600 "$CLAUDE_JSON"
+        write_claude_json "$MERGED"
     fi
 fi
 
+# ── Shift+Enter key binding ───────────────────────────────────────────────────
+# Triple-C's terminals send ESC+CR (`\e\r`) on Shift+Enter — the same bytes
+# `/terminal-setup` installs for VS Code, Cursor, Alacritty and Zed — and Claude
+# Code decodes those unconditionally. What it cannot see is that the binding is
+# already in place, so it keeps printing its "run /terminal-setup" tip. This
+# flag is what that tip is gated on: purely cosmetic, and it changes nothing
+# about how the sequence is decoded.
+#
+# $CLAUDE_JSON is already set by the awsAuthRefresh block above.
+if [ -f "$CLAUDE_JSON" ]; then
+    # Only rewrite when the value isn't already true, to avoid a needless jq
+    # reformat of ~/.claude.json on every single start.
+    if ! grep -q '"shiftEnterKeyBindingInstalled"[[:space:]]*:[[:space:]]*true' "$CLAUDE_JSON" 2>/dev/null; then
+        # Atomic, via `write_claude_json` — see its comment for why a plain
+        # `>` on this file can permanently destroy the OAuth login.
+        MERGED=$(jq '.shiftEnterKeyBindingInstalled = true' "$CLAUDE_JSON" 2>/dev/null)
+        if [ -n "$MERGED" ]; then
+            write_claude_json "$MERGED"
+        fi
+    fi
+else
+    # Nothing to destroy, but the helper owns the owner/mode too.
+    write_claude_json '{"shiftEnterKeyBindingInstalled":true}'
+fi
+
 # ── Docker socket permissions ────────────────────────────────────────────────
 if [ -S /var/run/docker.sock ]; then
     DOCKER_GID=$(stat -c '%g' /var/run/docker.sock)
diff --git a/container/triple-c-scheduler b/container/triple-c-scheduler
index e75fcae..46d1e38 100644
--- a/container/triple-c-scheduler
+++ b/container/triple-c-scheduler
@@ -20,6 +20,27 @@ generate_id() {
     head -c 4 /dev/urandom | od -An -tx1 | tr -d ' \n'
 }
 
+# Delete a task's log directory, called wherever a task stops existing.
+#
+# The task file is the only index of a task, so a log directory that outlives
+# it is unreachable — `logs --id` needs an id nothing can hand you any more —
+# and it sits on the home volume for the life of the project. The moment of
+# removal is the last point at which we still know what to delete.
+#
+# The `rm -rf` deserves paranoia, so the id is re-validated here rather than
+# trusted from the caller: the pattern rejects an empty id (which would expand
+# to $LOGS_DIR itself), anything containing `/` or `.` (which could climb out
+# of $LOGS_DIR), and a leading `-`. It matches validate_task_id() in
+# app/src-tauri/src/commands/inspect_commands.rs. Always one literal path,
+# never a glob.
+reap_task_logs() {
+    local id="${1:-}"
+    [[ "$id" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]] || return 0
+    local dir="${LOGS_DIR:?}/${id}"
+    [ -d "$dir" ] || return 0
+    rm -rf -- "$dir"
+}
+
 # Live run state for a task: prints "pid<TAB>started_epoch<TAB>log" and returns
 # 0 when the task is genuinely running, returns 1 otherwise.
 #
@@ -292,6 +313,7 @@ cmd_remove() {
     local name
     name=$(jq -r '.name' "$task_file")
     rm -f "$task_file"
+    reap_task_logs "$id"
     rebuild_crontab
     echo "Removed task '$name' ($id)"
 }
diff --git a/container/triple-c-task-runner b/container/triple-c-task-runner
index 79ffa60..7ce583b 100644
--- a/container/triple-c-task-runner
+++ b/container/triple-c-task-runner
@@ -125,6 +125,37 @@ fi
     echo "=== Exit code: $EXIT_CODE ==="
 } >> "$LOG_FILE"
 
+# ── Cap the size of this run's log ──────────────────────────────────────────
+# `claude -p` output is unbounded — a task told to walk a large tree can emit
+# hundreds of megabytes in one run — and the pruning below counts *files*, not
+# bytes, so twenty logs of any size are twenty logs. One chatty task can
+# therefore fill the home volume, which is also where ~/.claude and the OAuth
+# credential live.
+#
+# The tail is the half worth keeping: `claude -p` writes its answer at the end,
+# and the footer just appended carries the exit code that `status` and the app
+# both grep for. So an oversize log is rewritten as a marker line plus its last
+# MAX_LOG_BYTES rather than being deleted or capped from the front. This runs
+# before the notification below so the summary is taken from the capped file.
+#
+# Best effort throughout: the run's real result is already recorded, so a
+# failure here must not change the exit status. Note that `run` may be tailing
+# this file — it has already streamed everything up to here, and nothing is
+# appended after this point, so replacing the inode is invisible to it.
+MAX_LOG_BYTES=$(( 5 * 1024 * 1024 ))
+LOG_BYTES=$(wc -c < "$LOG_FILE" 2>/dev/null || echo 0)
+if [ "${LOG_BYTES:-0}" -gt "$MAX_LOG_BYTES" ]; then
+    TRUNC_FILE="${LOG_FILE}.trunc"
+    if {
+        echo "=== Log truncated: $(( LOG_BYTES - MAX_LOG_BYTES )) bytes dropped from the start (cap ${MAX_LOG_BYTES} bytes) ==="
+        tail -c "$MAX_LOG_BYTES" "$LOG_FILE"
+    } > "$TRUNC_FILE" 2>/dev/null; then
+        mv -f "$TRUNC_FILE" "$LOG_FILE" 2>/dev/null || rm -f "$TRUNC_FILE"
+    else
+        rm -f "$TRUNC_FILE"
+    fi
+fi
+
 # ── Write notification ──────────────────────────────────────────────────────
 mkdir -p "$NOTIFICATIONS_DIR"
 NOTIFY_FILE="${NOTIFICATIONS_DIR}/${TASK_ID}_${TIMESTAMP}.notify"
@@ -176,6 +207,35 @@ if [ "$LOG_COUNT" -gt 20 ]; then
     find "$TASK_LOG_DIR" -name "*.log" -type f | sort | head -n $((LOG_COUNT - 20)) | xargs rm -f
 fi
 
+# ── Reap log dirs of tasks that no longer exist ─────────────────────────────
+# `triple-c-scheduler remove` deletes a task's log dir with the task, but a
+# one-time task deletes its own task file above, so `remove` can never be run
+# for it — nothing knows the id any more — and its directory would sit on the
+# home volume forever. This is the sweep for that case.
+#
+# Deliberately delayed rather than done in the cleanup above: the run that just
+# finished has only just written the sole record of itself, `run` and the app's
+# Automation tab may still be tailing it, and `logs --id` keeps working for a
+# task whose file is gone. So a dir is reaped only once nothing in it has been
+# touched for LOG_RETENTION_DAYS, and never while a run is publishing state for
+# that id. The sweep rides on task runs, so a container whose only task was
+# one-time keeps that one directory until something else runs.
+#
+# Same paranoia as reap_task_logs() in triple-c-scheduler: the id comes from a
+# directory name and is re-validated before it is used to build an `rm -rf`
+# path, so no empty or path-bearing name can reach beyond $LOGS_DIR.
+LOG_RETENTION_DAYS=7
+for ORPHAN_DIR in "$LOGS_DIR"/*/; do
+    [ -d "$ORPHAN_DIR" ] || continue
+    ORPHAN_ID=$(basename "$ORPHAN_DIR")
+    [[ "$ORPHAN_ID" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]] || continue
+    [ -f "${TASKS_DIR}/${ORPHAN_ID}.json" ] && continue
+    [ -f "${RUNNING_DIR}/${ORPHAN_ID}.json" ] && continue
+    # Anything modified inside the window keeps the whole directory.
+    [ -n "$(find "$ORPHAN_DIR" -mmin "-$(( LOG_RETENTION_DAYS * 1440 ))" -print -quit 2>/dev/null)" ] && continue
+    rm -rf -- "${LOGS_DIR:?}/${ORPHAN_ID}"
+done
+
 # ── Prune old notifications (keep 50 total) ─────────────────────────────────
 NOTIFY_COUNT=$(find "$NOTIFICATIONS_DIR" -name "*.notify" -type f 2>/dev/null | wc -l)
 if [ "$NOTIFY_COUNT" -gt 50 ]; then