diff --git a/.github/actions/setup-ci-deps/action.yml b/.github/actions/setup-ci-deps/action.yml
index f658dac0dee2..eea622cc3d98 100644
--- a/.github/actions/setup-ci-deps/action.yml
+++ b/.github/actions/setup-ci-deps/action.yml
@@ -39,7 +39,7 @@ runs:
     # package across filesystems instead of hard-linking it: install took 28-49s
     # against 9s plus an 11s restore.
     - name: Cache full pnpm store
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm_store.outputs.path }}
         key: pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2ddddaf4178..b356eb0ab6ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -252,6 +252,7 @@ jobs:
 
   # The web suite is the largest outside the server. In the shared Test job it
   # started last and ran alone for about 40s after everything else finished.
+  # release.yml mirrors this test, test_web, and test_server split.
   test_web:
     name: Test Web
     needs: changes
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index 08552d1cd53a..cbd61e0604ef 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -64,6 +64,13 @@ on:
         required: false
         default: false
         type: boolean
+      # A runner of the target's own platform and architecture, for a `runner`
+      # that cannot execute the target. The build job skips everything that
+      # runs the packaged binaries, and a second job runs it there.
+      verify_runner:
+        required: false
+        default: ""
+        type: string
       version:
         required: true
         type: string
@@ -129,39 +136,6 @@ jobs:
           git sparse-checkout set --no-cone '/*' '!/.repos/'
           git -c checkout.workers=0 checkout --detach FETCH_HEAD
 
-      # The runner's PowerShell 7.6/.NET 10 intermittently crashes during signing:
-      # https://github.com/dotnet/runtime/issues/131636
-      # Put the .NET 8 release first for both workflow shells and electron-builder.
-      - name: Use PowerShell 7.4 for Windows ARM builds
-        if: inputs.platform == 'win' && inputs.arch == 'arm64'
-        shell: powershell
-        run: |
-          $ErrorActionPreference = "Stop"
-          $ProgressPreference = "SilentlyContinue"
-          $version = "7.4.20"
-          $archive = Join-Path $env:RUNNER_TEMP "PowerShell-$version-win-arm64.zip"
-          $installDir = Join-Path $env:RUNNER_TEMP "powershell-$version-arm64"
-          Invoke-WebRequest -UseBasicParsing `
-            -Uri "https://github.com/PowerShell/PowerShell/releases/download/v$version/PowerShell-$version-win-arm64.zip" `
-            -OutFile $archive
-          $expectedHash = "67eff749d5dae357501c95a3eec1dcd93f669824e3ca2b1d2adcdecdebf04f35"
-          if ((Get-FileHash $archive -Algorithm SHA256).Hash -ne $expectedHash) {
-            throw "PowerShell archive checksum mismatch"
-          }
-          Expand-Archive -Path $archive -DestinationPath $installDir
-          $installDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-          & "$installDir\pwsh.exe" -NoProfile -NonInteractive -Command '$PSVersionTable; [System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture'
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-      - name: Verify Windows ARM PowerShell selection
-        if: inputs.platform == 'win' && inputs.arch == 'arm64'
-        shell: pwsh
-        run: |
-          $expectedPath = Join-Path $env:RUNNER_TEMP "powershell-7.4.20-arm64\pwsh.exe"
-          if ((Get-Command pwsh.exe).Source -ne $expectedPath -or $PSVersionTable.PSVersion -ne [version]"7.4.20") {
-            throw "Windows ARM builds must use the pinned PowerShell runtime"
-          }
-
       # Windows installs straight from the registry. There, linking the packages
       # takes the time, not downloading them, so a ~700 MB package cache did not
       # pay for its own restore. Across recent nightlies, restore plus install
@@ -172,7 +146,7 @@ jobs:
         uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
         with:
           node-version-file: package.json
-          cache: ${{ inputs.platform != 'win' }}
+          cache: ${{ runner.os != 'Windows' }}
           run-install: false
 
       # pnpm checks the lockfile and policy before reusing this result. A missing
@@ -245,7 +219,7 @@ jobs:
       # monitor, the desktop build's preflight skips its MSVC check, and node-pty
       # ships prebuilt Windows binaries, so the 30-60s install is skipped too.
       - name: Install Spectre-mitigated MSVC libs
-        if: inputs.platform == 'win' && steps.resource_monitor_cache.outputs.cache-hit != 'true'
+        if: runner.os == 'Windows' && steps.resource_monitor_cache.outputs.cache-hit != 'true'
         shell: pwsh
         run: |
           $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
@@ -261,27 +235,21 @@ jobs:
             exit $code
           }
 
-      - uses: ./.github/actions/setup-apt-mirrors
-        if: inputs.platform == 'linux'
+      - name: Install cargo-xwin
+        if: runner.os != 'Windows' && inputs.platform == 'win' && steps.resource_monitor_cache.outputs.cache-hit != 'true'
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2
+        with:
+          tool: cargo-xwin@0.23.1
 
-      - name: Install Linux desktop build libraries
-        if: inputs.platform == 'linux'
+      # Built here rather than inside the desktop build so the CLI archive,
+      # which bundles the same binary, can be built and uploaded first.
+      - name: Build resource monitor
+        if: steps.resource_monitor_cache.outputs.cache-hit != 'true'
         shell: bash
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libsecret-1-dev pkg-config
-          if ! command -v magick >/dev/null 2>&1 && ! command -v convert >/dev/null 2>&1; then
-              sudo apt-get install -y imagemagick
-          fi
-
-          if command -v magick >/dev/null 2>&1; then
-              magick -version
-          else
-              convert -version
-          fi
+        run: cargo ${{ runner.os != 'Windows' && inputs.platform == 'win' && 'xwin build' || 'build' }} --locked --release --manifest-path native/resource-monitor/Cargo.toml --target "${{ inputs.rust_target }}"
 
       - name: Prepare Azure Trusted Signing
-        if: inputs.platform == 'win'
+        if: inputs.platform == 'win' && runner.os == 'Windows'
         shell: pwsh
         env:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
@@ -342,6 +310,153 @@ jobs:
             Select-Object -Unique
           "PSModulePath=$($modulePathEntries -join ';')" >> $env:GITHUB_ENV
 
+      # Off Windows, scripts/lib/windows-jsign.ts signs through jsign instead of
+      # the TrustedSigning PowerShell module.
+      - name: Install jsign
+        if: inputs.platform == 'win' && runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          dir="$RUNNER_TEMP/jsign"
+          mkdir -p "$dir"
+          curl -fsSL --retry 3 -o "$dir/jsign.jar" https://github.com/ebourg/jsign/releases/download/7.6/jsign-7.6.jar
+          echo "6cf58aa080e7ff82656f320cff8d4a3bff30408df8766806dcba3740dd839fa5  $dir/jsign.jar" | sha256sum -c -
+          printf '#!/bin/sh\nexec java -jar "%s" "$@"\n' "$dir/jsign.jar" > "$dir/jsign"
+          chmod +x "$dir/jsign"
+          echo "T3CODE_JSIGN=$dir/jsign" >> "$GITHUB_ENV"
+
+      # The desktop build applies the same branding to apps/server/dist/client
+      # (resolveDesktopWebAssetBrand in scripts/build-desktop-artifact.ts); the
+      # CLI archive below ships that client and is now built first.
+      - name: Apply web client branding
+        if: inputs.cli_archive
+        shell: bash
+        run: |
+          brand=production
+          if [[ "${{ inputs.version }}" =~ -nightly\.[0-9]{8}\.[0-9]+$ ]]; then brand=nightly; fi
+          node scripts/apply-web-brand-assets.ts "$brand" apps/server/dist/client
+
+      # The single-executable is built with a Node that supports --build-sea
+      # (25.7+); the repo itself stays on the engines.node version. A native
+      # build injects into the runner's own Node: tsdown's cross-target download
+      # path runs `tar` on a drive-letter path on Windows, which GNU tar reads as
+      # a remote host. Off Windows, a Windows target downloads its node.exe.
+      - name: Build CLI single-executable
+        if: inputs.cli_archive
+        shell: bash
+        env:
+          # The exact version, not a major: vp downloads it from nodejs.org/dist on
+          # the runner, and only exact versions have a dist directory. Keep in
+          # step with SEA_NODE_VERSION in apps/server/vite.config.ts.
+          VP_NODE_VERSION: "26.8.2"
+          # The executable bundles the server again, so it needs the same stamp
+          # as release.yml's JS bundle.
+          T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && inputs.release_channel || 'dev' }}
+        run: node apps/server/scripts/cli.ts build-exe --verbose ${{ runner.os != 'Windows' && inputs.platform == 'win' && format('--target win-{0}', inputs.arch) || '' }}
+
+      - name: Import macOS signing certificate for the CLI archive
+        if: inputs.cli_archive && inputs.platform == 'mac'
+        shell: bash
+        env:
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$CSC_LINK" || -z "$CSC_KEY_PASSWORD" ]]; then
+            echo "macOS CLI signing disabled (missing CSC_LINK); the archive is signed ad hoc."
+            exit 0
+          fi
+          keychain="$RUNNER_TEMP/t3-cli-signing.keychain-db"
+          keychain_password="$(openssl rand -hex 16)"
+          cert_path="$RUNNER_TEMP/t3-cli-signing.p12"
+          printf '%s' "$CSC_LINK" | base64 --decode > "$cert_path"
+          security create-keychain -p "$keychain_password" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_password" "$keychain"
+          security import "$cert_path" -k "$keychain" -P "$CSC_KEY_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain" >/dev/null
+          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
+          identity="$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application: [^"]*\)".*/\1/p' | head -n 1)"
+          if [[ -z "$identity" ]]; then
+            echo "No Developer ID Application identity found in CSC_LINK." >&2
+            exit 1
+          fi
+          echo "::add-mask::$keychain_password"
+          echo "T3CODE_CLI_MAC_SIGN_IDENTITY=$identity" >> "$GITHUB_ENV"
+          echo "macOS CLI signing enabled."
+
+      - name: Stage resource monitor for the CLI archive
+        if: inputs.cli_archive
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary_name="t3-resource-monitor"
+          if [[ "${{ inputs.platform }}" == "win" ]]; then
+            binary_name="${binary_name}.exe"
+          fi
+          target_dir="$RUNNER_TEMP/cli-resource-monitor/${{ inputs.resource_key }}"
+          mkdir -p "$target_dir"
+          cp "native/resource-monitor/target/${{ inputs.rust_target }}/release/${binary_name}" "$target_dir/$binary_name"
+
+      - name: Build CLI archive
+        if: inputs.cli_archive
+        shell: bash
+        env:
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
+          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ inputs.platform }}" == "mac" && -n "${APPLE_API_KEY:-}" ]]; then
+            key_path="$RUNNER_TEMP/AuthKey_cli_${APPLE_API_KEY_ID}.p8"
+            printf '%s' "$APPLE_API_KEY" > "$key_path"
+            export APPLE_API_KEY="$key_path"
+          fi
+          node scripts/build-cli-archive.ts \
+            --platform "${{ inputs.platform }}" \
+            --arch "${{ inputs.arch }}" \
+            --version "${{ inputs.version }}" \
+            --resource-monitor-dir "$RUNNER_TEMP/cli-resource-monitor" \
+            --output-dir release-cli
+
+      - name: Smoke-test CLI archive
+        if: inputs.cli_archive && inputs.verify_runner == ''
+        shell: bash
+        run: node scripts/smoke-cli-archive.ts --archive release-cli/* --expect-version "${{ inputs.version }}"
+
+      - name: Upload CLI archive
+        if: inputs.cli_archive
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cli-${{ inputs.platform }}-${{ inputs.arch }}
+          path: release-cli/*
+          if-no-files-found: error
+
+      - uses: ./.github/actions/setup-apt-mirrors
+        if: inputs.platform == 'linux'
+
+      - name: Install Linux desktop build libraries
+        if: inputs.platform == 'linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libsecret-1-dev pkg-config
+          if ! command -v magick >/dev/null 2>&1 && ! command -v convert >/dev/null 2>&1; then
+              sudo apt-get install -y imagemagick
+          fi
+
+          if command -v magick >/dev/null 2>&1; then
+              magick -version
+          else
+              convert -version
+          fi
+
       # The WSL backend runs the Linux CLI archive inside the distro, so the
       # Windows desktop embeds the same-arch archive the release attaches.
       # This job starts alongside that Linux job instead of after it, and the
@@ -407,7 +522,7 @@ jobs:
         shell: bash
         env:
           pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
-          T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}
+          T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: true
           T3CODE_DESKTOP_REUSE_LINUX_CAPTURE_HELPERS: ${{ steps.capture_helper_cache.outputs.cache-hit == 'true' }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
@@ -433,6 +548,9 @@ jobs:
             --skip-build
             --verbose
           )
+          if [[ -n "${{ inputs.verify_runner }}" ]]; then
+            args+=(--keep-stage)
+          fi
 
           has_all() {
             for value in "$@"; do
@@ -488,107 +606,35 @@ jobs:
 
           vp run dist:desktop:artifact "${args[@]}"
 
-      # The single-executable is built with a Node that supports --build-sea
-      # (25.7+); the repo itself stays on the engines.node version. It always
-      # injects into the runner's own Node: tsdown's cross-target download path
-      # runs `tar` on a drive-letter path on Windows, which GNU tar reads as a
-      # remote host, and a cross-built macOS binary cannot be smoke-tested.
-      - name: Build CLI single-executable
-        if: inputs.cli_archive
-        shell: bash
-        env:
-          # The exact version, not a major: vp downloads it from nodejs.org/dist on
-          # the runner, and only exact versions have a dist directory. Keep in
-          # step with SEA_NODE_VERSION in apps/server/vite.config.ts.
-          VP_NODE_VERSION: "26.8.2"
-          # The executable bundles the server again, so it needs the same stamp
-          # as release.yml's JS bundle.
-          T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && inputs.release_channel || 'dev' }}
-        run: node apps/server/scripts/cli.ts build-exe --verbose
-
-      - name: Import macOS signing certificate for the CLI archive
-        if: inputs.cli_archive && inputs.platform == 'mac'
-        shell: bash
-        env:
-          CSC_LINK: ${{ secrets.CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          if [[ -z "$CSC_LINK" || -z "$CSC_KEY_PASSWORD" ]]; then
-            echo "macOS CLI signing disabled (missing CSC_LINK); the archive is signed ad hoc."
-            exit 0
-          fi
-          keychain="$RUNNER_TEMP/t3-cli-signing.keychain-db"
-          keychain_password="$(openssl rand -hex 16)"
-          cert_path="$RUNNER_TEMP/t3-cli-signing.p12"
-          printf '%s' "$CSC_LINK" | base64 --decode > "$cert_path"
-          security create-keychain -p "$keychain_password" "$keychain"
-          security set-keychain-settings -lut 21600 "$keychain"
-          security unlock-keychain -p "$keychain_password" "$keychain"
-          security import "$cert_path" -k "$keychain" -P "$CSC_KEY_PASSWORD" -T /usr/bin/codesign
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain" >/dev/null
-          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
-          identity="$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application: [^"]*\)".*/\1/p' | head -n 1)"
-          if [[ -z "$identity" ]]; then
-            echo "No Developer ID Application identity found in CSC_LINK." >&2
-            exit 1
-          fi
-          echo "::add-mask::$keychain_password"
-          echo "T3CODE_CLI_MAC_SIGN_IDENTITY=$identity" >> "$GITHUB_ENV"
-          echo "macOS CLI signing enabled."
-
-      - name: Stage resource monitor for the CLI archive
-        if: inputs.cli_archive
-        shell: bash
-        run: |
-          set -euo pipefail
-          binary_name="t3-resource-monitor"
-          if [[ "${{ inputs.platform }}" == "win" ]]; then
-            binary_name="${binary_name}.exe"
-          fi
-          target_dir="$RUNNER_TEMP/cli-resource-monitor/${{ inputs.resource_key }}"
-          mkdir -p "$target_dir"
-          cp "native/resource-monitor/target/${{ inputs.rust_target }}/release/${binary_name}" "$target_dir/$binary_name"
-
-      - name: Build CLI archive
-        if: inputs.cli_archive
+      # The verify job runs what this host could not: the packaged natives and
+      # the CLI. Its scripts are bundled so that job needs no install.
+      - name: Stage verification inputs
+        if: inputs.verify_runner != ''
         shell: bash
-        env:
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
-          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
-          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
         run: |
           set -euo pipefail
-          if [[ "${{ inputs.platform }}" == "mac" && -n "${APPLE_API_KEY:-}" ]]; then
-            key_path="$RUNNER_TEMP/AuthKey_cli_${APPLE_API_KEY_ID}.p8"
-            printf '%s' "$APPLE_API_KEY" > "$key_path"
-            export APPLE_API_KEY="$key_path"
-          fi
-          node scripts/build-cli-archive.ts \
-            --platform "${{ inputs.platform }}" \
-            --arch "${{ inputs.arch }}" \
-            --version "${{ inputs.version }}" \
-            --resource-monitor-dir "$RUNNER_TEMP/cli-resource-monitor" \
-            --output-dir release-cli
-
-      - name: Smoke-test CLI archive
-        if: inputs.cli_archive
-        shell: bash
-        run: node scripts/smoke-cli-archive.ts --archive release-cli/* --expect-version "${{ inputs.version }}"
-
-      - name: Upload CLI archive
-        if: inputs.cli_archive
+          mkdir -p verify
+          unpacked=$(ls -d "${TMPDIR:-/tmp}"/t3code-desktop-${{ inputs.platform }}-stage-*/app/dist/${{ inputs.platform }}-${{ inputs.arch }}-unpacked)
+          tar -C "$(dirname "$unpacked")" -cf verify/unpacked.tar "$(basename "$unpacked")"
+          esbuild=scripts/node_modules/.bin/esbuild
+          banner="import{createRequire as __cr}from'node:module';const require=__cr(import.meta.url);"
+          # build-desktop-artifact.ts's own import.meta.main guard must not run
+          # its CLI inside the verify bundle.
+          "$esbuild" scripts/verify-windows-desktop-artifact.ts --bundle --platform=node --format=esm \
+            --target=node24 --define:import.meta.main=false --banner:js="$banner" \
+            --outfile=verify/verify-windows-desktop-artifact.mjs
+          "$esbuild" scripts/smoke-cli-archive.ts --bundle --platform=node --format=esm \
+            --target=node24 --banner:js="$banner" --outfile=verify/smoke-cli-archive.mjs
+
+      - name: Upload verification inputs
+        if: inputs.verify_runner != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: cli-${{ inputs.platform }}-${{ inputs.arch }}
-          path: release-cli/*
+          name: verify-${{ inputs.platform }}-${{ inputs.arch }}
+          path: verify/*
           if-no-files-found: error
+          retention-days: 1
+          compression-level: 1
 
       - name: Collect release assets
         shell: bash
@@ -661,3 +707,81 @@ jobs:
           name: resource-monitor-${{ inputs.resource_key }}
           path: resource-monitor-publish/${{ inputs.resource_key }}/*
           if-no-files-found: error
+
+  verify:
+    name: Verify
+    needs: [build]
+    if: inputs.verify_runner != ''
+    runs-on: ${{ inputs.verify_runner }}
+    timeout-minutes: 15
+    steps:
+      - name: Download verification inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: verify-${{ inputs.platform }}-${{ inputs.arch }}
+          path: verify
+
+      - name: Download CLI archive
+        if: inputs.cli_archive
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: cli-${{ inputs.platform }}-${{ inputs.arch }}
+          path: release-cli
+
+      - name: Verify packaged natives
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar -C verify -xf verify/unpacked.tar
+          node verify/verify-windows-desktop-artifact.mjs \
+            --app-dir "$(cygpath -w "$PWD/verify/${{ inputs.platform }}-${{ inputs.arch }}-unpacked")" \
+            --arch "${{ inputs.arch }}" --build-version "${{ inputs.version }}" --verbose
+
+      - name: Smoke-test CLI archive
+        if: inputs.cli_archive
+        shell: bash
+        run: node verify/smoke-cli-archive.mjs --archive release-cli/* --expect-version "${{ inputs.version }}"
+
+      # cargo-xwin links this binary on Linux, and nothing else runs it before users do.
+      # Node rather than pwsh: PowerShell on Windows ARM crashes intermittently
+      # (https://github.com/dotnet/runtime/issues/131636), which is why this
+      # target stopped building on Windows.
+      - name: Smoke-test resource monitor
+        shell: bash
+        env:
+          MONITOR: verify/${{ inputs.platform }}-${{ inputs.arch }}-unpacked/resources/resource-monitor/t3-resource-monitor.exe
+          EXPECTED_ARCH: ${{ inputs.arch == 'arm64' && 'aarch64' || 'x86_64' }}
+        run: |
+          node --input-type=module <<'EOF'
+          import { spawn } from "node:child_process";
+          const monitor = spawn(process.env.MONITOR, { stdio: ["pipe", "pipe", "inherit"] });
+          monitor.stdout.setEncoding("utf8");
+          let output = "";
+          const exited = new Promise((resolve) => monitor.on("close", resolve));
+          const hello = await new Promise((resolve, reject) => {
+            monitor.on("error", reject);
+            monitor.on("close", () => reject(new Error(`Resource monitor exited before hello: ${output}`)));
+            monitor.stdout.on("data", (chunk) => {
+              output += chunk;
+              const end = output.indexOf("\n");
+              if (end !== -1) resolve(JSON.parse(output.slice(0, end)));
+            });
+          });
+          if (hello.type !== "hello" || hello.arch !== process.env.EXPECTED_ARCH) {
+            throw new Error(`Unexpected hello: ${JSON.stringify(hello)}`);
+          }
+          const send = (message) => monitor.stdin.write(`${JSON.stringify({ version: hello.version, ...message })}\n`);
+          send({ type: "configure", rootPid: process.pid, sampleIntervalMs: 1000 });
+          send({ type: "sampleNow", requestId: "verify" });
+          monitor.stdin.end();
+          const exitCode = await exited;
+          const sample = output
+            .split("\n")
+            .filter((line) => line.trim())
+            .map((line) => JSON.parse(line))
+            .find((message) => message.requestId === "verify");
+          if (exitCode !== 0 || sample?.type !== "snapshot" || !sample.processes.some((p) => p.pid === process.pid)) {
+            throw new Error(`Resource monitor exited ${exitCode} with: ${output}`);
+          }
+          console.log(`Resource monitor sampled ${sample.scannedProcessCount} processes.`);
+          EOF
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ac181064714d..2cbecee94cdd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -256,7 +256,7 @@ jobs:
         run: vp run typecheck
 
   # Keep tests on their own runners, using the same package split and server
-  # shards as CI, so the release check job does not spend its budget on tests.
+  # shards as CI (test, test_web, test_server in ci.yml). Keep the two in sync.
   test:
     name: Release tests
     needs: [preflight]
@@ -286,13 +286,57 @@ jobs:
           sudo sed -i 's|http://|https://|g' /etc/apt/ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
           sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential
 
-      # The web package's browser project runs React tests in headless Chromium.
+      - name: Test
+        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' --filter '!@t3tools/web' test
+
+  # Web browser tests time out when they share a runner with the other package
+  # suites: Chromium gets too little CPU and diff workers miss their 10s start budget.
+  test_web:
+    name: Release web tests
+    needs: [preflight]
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup dependencies
+        uses: ./.github/actions/setup-ci-deps
+
+      - name: Resolve Playwright version
+        id: playwright_version
+        run: echo "version=$(node -p "require('./apps/web/node_modules/playwright/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Chromium
+        id: chromium_cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-chromium-shell-${{ runner.os }}-${{ runner.arch }}-${{ steps.playwright_version.outputs.version }}
+
       - name: Install Chromium for web browser tests
-        run: node apps/web/node_modules/playwright/cli.js install --with-deps --only-shell chromium
+        if: steps.chromium_cache.outputs.cache-hit != 'true'
+        run: node apps/web/node_modules/playwright/cli.js install --only-shell chromium
+
+      - name: Install missing Chromium system dependencies
+        run: |
+          browser=$(find "$HOME/.cache/ms-playwright" -name chrome-headless-shell -type f -print -quit)
+          test -n "$browser"
+          if ldd "$browser" | grep '=> not found'; then
+            node apps/web/node_modules/playwright/cli.js install-deps chromium
+          fi
 
       - name: Test
-        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test
+        run: vp run --filter @t3tools/web test
 
+  # Server test files run one at a time, so more small runners beat fewer big ones.
   test_server:
     name: Release server tests ${{ matrix.shard }}
     needs: [preflight]
@@ -302,7 +346,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8]
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -675,6 +719,8 @@ jobs:
       resource_key: win32-x64
       cli_archive: true
 
+  # Windows arm64 runners have 4 vCPUs, and the packaging is mostly CPU-bound,
+  # so the build runs on Linux and only the native checks run on arm64.
   desktop_win_arm64:
     name: Desktop Windows arm64
     needs: [preflight, relay_public_config, build_bundle]
@@ -690,7 +736,8 @@ jobs:
       clerk_cli_oauth_client_id: ${{ needs.relay_public_config.outputs.clerk_cli_oauth_client_id }}
       relay_url: ${{ needs.relay_public_config.outputs.relay_url }}
       label: Windows arm64
-      runner: windows-11-arm
+      runner: ubuntu-24.04
+      verify_runner: windows-11-arm
       platform: win
       target: nsis
       arch: arm64
@@ -706,6 +753,7 @@ jobs:
         relay_public_config,
         quality,
         test,
+        test_web,
         test_server,
         desktop_mac_arm64,
         desktop_mac_x64,
@@ -714,7 +762,7 @@ jobs:
         desktop_win_x64,
         desktop_win_arm64,
       ]
-    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.outputs.relay_url != '' && needs.quality.result == 'success' && needs.test.result == 'success' && needs.test_server.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_mac_x64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.outputs.relay_url != '' && needs.quality.result == 'success' && needs.test.result == 'success' && needs.test_web.result == 'success' && needs.test_server.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_mac_x64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
diff --git a/.github/workflows/windows-tests.yml b/.github/workflows/windows-tests.yml
index 21a61e91cc8e..cf0f7c030c23 100644
--- a/.github/workflows/windows-tests.yml
+++ b/.github/workflows/windows-tests.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           sparse-checkout: |
             /*
@@ -40,7 +40,7 @@ jobs:
       # setup-vp's own cache restores a Linux-shaped store on Windows, which is
       # slower than no cache (see #7975). Cache pnpm's Windows store directly.
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@v1
+        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
         with:
           node-version-file: package.json
           cache: false
@@ -52,7 +52,7 @@ jobs:
         run: '"path=$(vp pm cache dir)" >> $env:GITHUB_OUTPUT'
 
       - name: Cache packages
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.package_cache_path.outputs.path }}
           key: windows-tests-packages-v1-${{ hashFiles('pnpm-lock.yaml') }}
diff --git a/AGENTS.md b/AGENTS.md
index efc48931a298..5c91465889c4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -100,7 +100,12 @@ An empty database is a bad test. Seed your worktree's `.t3` with a copy of real
 - **Do not run repo-wide checks.** No `vp check`, no `vp run -r test`, no `vp run -r typecheck` unless I ask. CI owns the full suite.
 - Backend behavior changes ship with focused tests for that behavior.
 - The server is event-sourced, and side effects run after the command commits. In tests, drain the effect worker (`OrchestrationEffectWorkerV2.drain`) or await the specific persisted event or `Deferred` that marks the milestone. Never wait on sleeps or polling. A test that needs a timeout to pass is wrong.
-- Web component tests are `*.browser.test.tsx` and render through `apps/web/test/render.tsx`. Acquire everything a test changes with `using`/`await using` so disposal undoes it even when the test fails; no `beforeEach`/`afterEach`, no module-level screens. Shared mock state that `vi.mock` factories read gets reset by a `setup()` call at the top of the test. `t3code/require-disposable-render` flags the old patterns.
+- Web browser tests are `*.browser.test.tsx` or `*.browser.test.ts` and render with `await using screen = await render(...)` from `apps/web/test/render.tsx`. `t3code/require-disposable-render` errors on the old patterns.
+  - Acquire what the test drives after mounting (fake timers it advances, spies it sets up after mounting) after the render, so it disposes before the unmount. Anything the first render reads comes before it.
+  - A helper that renders and then waits or clicks puts the screen in an `AsyncDisposableStack` and `move()`s it out only on success, so a failed wait still unmounts.
+  - `rerender` needs a fresh element on every call.
+  - No lifecycle hooks and no module-level mutable state. Shared mock state that `vi.mock` factories read is reset by a `setup()` call at the top of the test.
+  - `router` is on by default. Pass `router: false` only with a one-line comment saying why.
 
   ```tsx
   it("saves on Enter", async () => {
diff --git a/apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz b/apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz
deleted file mode 100644
index 33a1dcca0721..000000000000
Binary files a/apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz and /dev/null differ
diff --git a/apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz b/apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz
new file mode 100644
index 000000000000..581307cf91be
Binary files /dev/null and b/apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz differ
diff --git a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
index 1d57632eee5f..32d48da78b31 100644
--- a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
+++ b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
@@ -57,6 +57,7 @@ class T3ComposerEditorView(context: Context, appContext: AppContext) : ExpoView(
   private var applyingNativeValue = false
   private var desiredLineHeightPx = 0
   private var lastContentHeight = 0
+  private var lastContentWidth = 0
   private var contentInsetVertical = 0
   private var tokensJson = "[]"
   private var tokens: List<ComposerToken> = emptyList()
@@ -424,12 +425,19 @@ class T3ComposerEditorView(context: Context, appContext: AppContext) : ExpoView(
   }
 
   private fun emitContentSizeIfNeeded() {
-    val height = editor.layout?.height ?: editor.measuredHeight
-    val contentHeight = height + contentInsetVertical * 2
-    if (contentHeight == lastContentHeight) return
+    // The laid-out text without insets. A one-line draft reports its natural width, so
+    // JS can tell whether it fits a narrower row than the one it is laid out in; past
+    // one line only the height matters. Trailing whitespace hangs past a line without
+    // wrapping it, so getLineMax leaves it out.
+    val layout = editor.layout
+    val contentHeight = layout?.height ?: editor.measuredHeight
+    val contentWidth = if (layout?.lineCount == 1) layout.getLineMax(0).toInt() else 0
+    if (contentHeight == lastContentHeight && contentWidth == lastContentWidth) return
     lastContentHeight = contentHeight
+    lastContentWidth = contentWidth
+    val density = resources.displayMetrics.density
     onComposerContentSizeChange(
-      mapOf("height" to contentHeight / resources.displayMetrics.density),
+      mapOf("width" to contentWidth / density, "height" to contentHeight / density),
     )
   }
 
diff --git a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
index 7a659cc510ae..b816bafde14a 100644
--- a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
+++ b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
@@ -1230,7 +1230,28 @@ public final class T3ComposerEditorView: ExpoView, UITextViewDelegate, UITextDro
   }
 
   private func emitContentSizeIfNeeded() {
-    let nextSize = textView.contentSize
+    // The laid-out text without insets. A one-line draft reports its natural width, so
+    // JS can tell whether it fits a narrower row than the one it is laid out in; past
+    // one line only the height matters, so layout stops at the second line. The width
+    // comes from the line fragment because usedRect spans the container once the view
+    // scrolls. A trailing newline's empty line only exists as the extra fragment.
+    let layout = textView.layoutManager
+    let container = textView.textContainer
+    var lines = 0
+    var width: CGFloat = 0
+    var height: CGFloat = 0
+    let glyphs = NSRange(location: 0, length: layout.numberOfGlyphs)
+    layout.enumerateLineFragments(forGlyphRange: glyphs) { _, used, _, _, stop in
+      lines += 1
+      width = used.width
+      height = used.maxY
+      if lines > 1 { stop.pointee = true }
+    }
+    if lines < 2, layout.extraLineFragmentTextContainer === container {
+      lines += 1
+      height = max(height, layout.extraLineFragmentUsedRect.maxY)
+    }
+    let nextSize = CGSize(width: lines == 1 ? ceil(width) : 0, height: ceil(height))
     guard abs(nextSize.width - lastContentSize.width) > 0.5 ||
       abs(nextSize.height - lastContentSize.height) > 0.5 else {
       return
diff --git a/apps/mobile/package.json b/apps/mobile/package.json
index c7e8406bc174..441ee7beb6d3 100644
--- a/apps/mobile/package.json
+++ b/apps/mobile/package.json
@@ -134,7 +134,7 @@
     "react-native-pdf-jsi": "5.0.0",
     "react-native-reanimated": "4.7.1",
     "react-native-safe-area-context": "~5.10.1",
-    "react-native-screens": "file:deps/react-native-screens-5.0.0-t3.29.tgz",
+    "react-native-screens": "file:deps/react-native-screens-5.0.0-t3.30.tgz",
     "react-native-shiki-engine": "^0.3.12",
     "react-native-svg": "15.16.0",
     "react-native-webview": "14.0.1",
diff --git a/apps/mobile/src/components/ComposerToolbar.tsx b/apps/mobile/src/components/ComposerToolbar.tsx
index d6bbf9d99294..5c84720bedf9 100644
--- a/apps/mobile/src/components/ComposerToolbar.tsx
+++ b/apps/mobile/src/components/ComposerToolbar.tsx
@@ -13,6 +13,8 @@ import {
   type ViewStyle,
 } from "react-native";
 
+import Animated, { FadeIn, LinearTransition } from "react-native-reanimated";
+
 import { cn } from "../lib/cn";
 import { AppText as Text } from "./ui/AppText";
 import { SymbolView } from "./ui/AppSymbol";
@@ -21,6 +23,10 @@ import { useAndroidControlSizing } from "./ui/useAndroidControlSizing";
 const COMPOSER_TOOLBAR_GAP = 8;
 const COMPOSER_TOOLBAR_FADE_WIDTH = 18;
 const COMPOSER_TOOLBAR_SCROLL_EPSILON = 4;
+const INLINE_CONTROL_LABEL_ENTERING = FadeIn.duration(160);
+// Android runs no composer layout transitions, so the toolbar never trails the dock.
+const INLINE_CONTROL_WIDTH_TRANSITION =
+  Platform.OS === "android" ? undefined : LinearTransition.duration(180);
 
 export function ComposerInlineControl(props: {
   readonly accessibilityHint?: string;
@@ -30,6 +36,8 @@ export function ComposerInlineControl(props: {
   readonly icon?: ComponentProps<typeof SymbolView>["name"];
   readonly renderIcon?: (size: number) => ReactNode;
   readonly label: string;
+  /** Show only the icon and chevron; the label still names the control for accessibility. */
+  readonly iconOnly?: boolean;
   readonly maxWidth?: ViewStyle["maxWidth"];
   readonly onPress?: () => void;
   readonly selected?: boolean;
@@ -38,56 +46,77 @@ export function ComposerInlineControl(props: {
   readonly showChevron?: boolean;
 }) {
   const { scale, smallIconSize } = useAndroidControlSizing();
+  // The label fades in as the control widens, and leaves at once: an exiting view keeps
+  // drawing at its old place while the chevron moves into it. The clip keeps content laid out
+  // at the final width inside the frame while it eases there.
+  const animatesLabel = props.iconOnly !== undefined;
   return (
-    <Pressable
-      accessibilityLabel={props.accessibilityLabel ?? props.label}
-      accessibilityHint={props.accessibilityHint}
-      accessibilityRole={props.static ? undefined : "button"}
-      accessibilityState={
-        props.static ? undefined : { disabled: props.disabled, selected: props.selected }
-      }
-      className="h-11 flex-row items-center gap-2 rounded-xl px-2 active:bg-subtle"
-      disabled={props.disabled || props.static}
-      onPress={props.onPress}
-      style={{ maxWidth: props.maxWidth ?? 190, opacity: props.disabled ? 0.45 : 1 }}
+    <Animated.View
+      layout={animatesLabel ? INLINE_CONTROL_WIDTH_TRANSITION : undefined}
+      style={{
+        maxWidth: props.maxWidth ?? 190,
+        overflow: animatesLabel ? "hidden" : undefined,
+      }}
     >
-      {props.renderIcon ? (
-        <View
-          className="size-4 shrink-0 items-center justify-center"
-          style={Platform.OS === "android" ? { width: 14 * scale, height: 14 * scale } : undefined}
-        >
-          {props.renderIcon(smallIconSize)}
-        </View>
-      ) : props.icon ? (
-        <SymbolView
-          name={props.icon}
-          size={smallIconSize}
-          tintColorClassName={
-            props.emphasized || props.selected ? "accent-icon" : "accent-icon-muted"
-          }
-          type="monochrome"
-        />
-      ) : null}
-      <Text
-        className={cn(
-          "shrink text-sm font-t3-medium",
-          props.emphasized || props.selected ? "text-foreground" : "text-foreground-muted",
-        )}
-        numberOfLines={1}
+      <Pressable
+        accessibilityLabel={props.accessibilityLabel ?? props.label}
+        accessibilityHint={props.accessibilityHint}
+        accessibilityRole={props.static ? undefined : "button"}
+        accessibilityState={
+          props.static ? undefined : { disabled: props.disabled, selected: props.selected }
+        }
+        className="h-11 flex-row items-center gap-2 rounded-xl px-2 active:bg-subtle"
+        disabled={props.disabled || props.static}
+        onPress={props.onPress}
+        style={{ opacity: props.disabled ? 0.45 : 1 }}
       >
-        {props.label}
-      </Text>
-      {props.showChevron === false ? null : (
-        <SymbolView
-          name={props.chevronDirection === "right" ? "chevron.right" : "chevron.down"}
-          size={Math.round(10 * scale)}
-          tintColorClassName={
-            props.emphasized || props.selected ? "accent-icon" : "accent-icon-muted"
-          }
-          type="monochrome"
-        />
-      )}
-    </Pressable>
+        {props.renderIcon ? (
+          <View
+            className="size-4 shrink-0 items-center justify-center"
+            style={
+              Platform.OS === "android" ? { width: 14 * scale, height: 14 * scale } : undefined
+            }
+          >
+            {props.renderIcon(smallIconSize)}
+          </View>
+        ) : props.icon ? (
+          <SymbolView
+            name={props.icon}
+            size={smallIconSize}
+            tintColorClassName={
+              props.emphasized || props.selected ? "accent-icon" : "accent-icon-muted"
+            }
+            type="monochrome"
+          />
+        ) : null}
+        {props.iconOnly ? null : (
+          <Animated.View
+            className="shrink"
+            entering={animatesLabel ? INLINE_CONTROL_LABEL_ENTERING : undefined}
+          >
+            <Text
+              className={cn(
+                "text-sm font-t3-medium",
+                props.emphasized || props.selected ? "text-foreground" : "text-foreground-muted",
+              )}
+              numberOfLines={1}
+            >
+              {props.label}
+            </Text>
+          </Animated.View>
+        )}
+        {props.showChevron === false ? null : (
+          <SymbolView
+            name={props.chevronDirection === "right" ? "chevron.right" : "chevron.down"}
+            size={Math.round(10 * scale)}
+            tintColorClassName={
+              props.emphasized || props.selected ? "accent-icon" : "accent-icon-muted"
+            }
+            type="monochrome"
+          />
+        )}
+      </Pressable>
+    </Animated.View>
   );
 }
 
diff --git a/apps/mobile/src/components/ui/AndroidScreenHeader.tsx b/apps/mobile/src/components/ui/AndroidScreenHeader.tsx
index b35c7cc58f8f..1b259f1ecbfa 100644
--- a/apps/mobile/src/components/ui/AndroidScreenHeader.tsx
+++ b/apps/mobile/src/components/ui/AndroidScreenHeader.tsx
@@ -1,5 +1,6 @@
 import { AppActivityIndicator } from "./AppActivityIndicator";
-import { Column, Text as NativeText, RNHostView } from "@expo/ui/jetpack-compose";
+import { Column, Row, Text as NativeText, RNHostView } from "@expo/ui/jetpack-compose";
+import { weight } from "@expo/ui/jetpack-compose/modifiers";
 import { useState, type ReactNode } from "react";
 import { View } from "react-native";
 
@@ -43,6 +44,8 @@ export function AndroidScreenHeader(props: {
   readonly onBack?: () => void;
   readonly embedded?: boolean;
   readonly hideBottomBorder?: boolean;
+  /** One row with the subtitle after the title, for screens short on height. */
+  readonly compact?: boolean;
 }) {
   const { colors } = useControlTheme();
   const titleTypography = useScaledTextRole("title");
@@ -65,6 +68,7 @@ export function AndroidScreenHeader(props: {
       }}
     >
       <NativeAppBar
+        singleLine={props.compact}
         navigationIcon={
           props.onBack || props.leading ? (
             <View collapsable={false} className="flex-row items-center">
@@ -95,6 +99,26 @@ export function AndroidScreenHeader(props: {
             >
               {props.title}
             </NativeText>
+          ) : props.compact ? (
+            <Row verticalAlignment="center" horizontalArrangement={{ spacedBy: 8 }}>
+              <NativeText
+                color={colors["--color-header-foreground"]}
+                maxLines={1}
+                overflow="ellipsis"
+                style={titleTypography}
+              >
+                {props.title}
+              </NativeText>
+              <NativeText
+                color={colors["--color-foreground-muted"]}
+                maxLines={1}
+                overflow="ellipsis"
+                style={subtitleTypography}
+                modifiers={[weight(1)]}
+              >
+                {props.subtitle}
+              </NativeText>
+            </Row>
           ) : (
             <Column>
               <NativeText
diff --git a/apps/mobile/src/components/ui/AppBar.android.tsx b/apps/mobile/src/components/ui/AppBar.android.tsx
index 49d22b560aad..4132c2256777 100644
--- a/apps/mobile/src/components/ui/AppBar.android.tsx
+++ b/apps/mobile/src/components/ui/AppBar.android.tsx
@@ -158,6 +158,7 @@ export function AppBar(props: AppBarProps) {
       onBack={props.onBack}
       leading={props.sidebar !== false ? <AndroidWorkspaceSidebarButton /> : undefined}
       hideBottomBorder={props.hideBottomBorder}
+      compact={props.compact}
       actions={
         search
           ? [
diff --git a/apps/mobile/src/components/ui/AppBar.types.ts b/apps/mobile/src/components/ui/AppBar.types.ts
index 621006d949c0..e3db494219d7 100644
--- a/apps/mobile/src/components/ui/AppBar.types.ts
+++ b/apps/mobile/src/components/ui/AppBar.types.ts
@@ -68,6 +68,8 @@ export interface AppBarProps {
     readonly onPress?: () => void;
   };
   readonly hideBottomBorder?: boolean;
+  /** Android: one title row with the subtitle inline. iOS ignores it. */
+  readonly compact?: boolean;
   readonly trailing?: ReactNode;
   readonly matchSearchSurface?: boolean;
   readonly options?: AppNativeStackNavigationOptions;
diff --git a/apps/mobile/src/components/ui/NativeAppBar.android.tsx b/apps/mobile/src/components/ui/NativeAppBar.android.tsx
index 2c028fded803..22f8ca65cc42 100644
--- a/apps/mobile/src/components/ui/NativeAppBar.android.tsx
+++ b/apps/mobile/src/components/ui/NativeAppBar.android.tsx
@@ -10,9 +10,11 @@ export function NativeAppBar(props: {
   readonly title: ReactElement;
   readonly navigationIcon?: ReactElement;
   readonly actions?: ReactElement;
+  /** Shorter bar for a one-row title. */
+  readonly singleLine?: boolean;
 }) {
   const { colors } = useControlTheme();
-  const layout = useToolbarLayout();
+  const layout = useToolbarLayout(false, props.singleLine);
   return (
     // The bar's height is fixed, so React Native lays out the screen below it from the first frame
     // instead of at zero height until Compose has measured and reported the bar.
diff --git a/apps/mobile/src/components/ui/useToolbarLayout.ts b/apps/mobile/src/components/ui/useToolbarLayout.ts
index faa02c198289..736ac27ed4eb 100644
--- a/apps/mobile/src/components/ui/useToolbarLayout.ts
+++ b/apps/mobile/src/components/ui/useToolbarLayout.ts
@@ -4,8 +4,11 @@ import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { useScaledTextRole } from "../../features/settings/appearance/useScaledTextRole";
 import { useAndroidControlSizing } from "./useAndroidControlSizing";
 
-/** Shared Android header geometry; class-based spacing uses the app's 14dp rem. */
-export function useToolbarLayout(embedded = false) {
+/**
+ * Shared Android header geometry; class-based spacing uses the app's 14dp rem.
+ * `singleLine` sizes the toolbar for a title row with the subtitle inline.
+ */
+export function useToolbarLayout(embedded = false, singleLine = false) {
   const insets = useSafeAreaInsets();
   const title = useScaledTextRole("title");
   const subtitle = useScaledTextRole("label");
@@ -13,7 +16,9 @@ export function useToolbarLayout(embedded = false) {
   const { fontScale } = useWindowDimensions();
   return {
     height: Math.ceil(
-      Math.max(48, 56 * scale, (title.lineHeight + subtitle.lineHeight) * fontScale + 1),
+      singleLine
+        ? Math.max(48, 48 * scale, title.lineHeight * fontScale + 1)
+        : Math.max(48, 56 * scale, (title.lineHeight + subtitle.lineHeight) * fontScale + 1),
     ),
     paddingTop: embedded ? 8 * scale : Math.max(insets.top, 12 * scale),
     paddingBottom: 7 * scale,
diff --git a/apps/mobile/src/features/layout/AdaptiveWorkspaceLayout.tsx b/apps/mobile/src/features/layout/AdaptiveWorkspaceLayout.tsx
index 480ca463dac8..07e70f448a72 100644
--- a/apps/mobile/src/features/layout/AdaptiveWorkspaceLayout.tsx
+++ b/apps/mobile/src/features/layout/AdaptiveWorkspaceLayout.tsx
@@ -15,6 +15,7 @@ import {
 import {
   createContext,
   use,
+  useDeferredValue,
   useEffect,
   useEffectEvent,
   useMemo,
@@ -23,6 +24,7 @@ import {
   type ReactNode,
 } from "react";
 import { Platform, useWindowDimensions, View } from "react-native";
+import { KeyboardController, useKeyboardState } from "react-native-keyboard-controller";
 import Animated, {
   runOnJS,
   useAnimatedStyle,
@@ -73,7 +75,10 @@ import { useOpenThreadPullRequests } from "../threads/use-open-thread-pull-reque
 import { RenderErrorBoundary, RenderFailureView } from "../../components/RenderErrorBoundary";
 import { WORKSPACE_PANE_TIMING } from "./workspace-pane-animation";
 import { WorkspaceInspectorPane } from "./workspace-inspector-pane";
-import { WorkspaceContentWidthContext } from "./workspace-content-width";
+import {
+  WorkspaceContentWidthContext,
+  WorkspaceSettledContentWidthContext,
+} from "./workspace-content-width";
 import {
   NativeWorkspaceModeContext,
   NativeWorkspaceInspectorContext,
@@ -96,6 +101,13 @@ interface AdaptiveWorkspaceContextValue {
   readonly toggleAuxiliaryPane: () => void;
   readonly togglePrimarySidebar: () => void;
   readonly setAuxiliaryPaneWidth: (width: number) => void;
+  /**
+   * Android split view while the thread composer has the soft keyboard: the
+   * sidebar and rail step aside and the thread header drops to one line.
+   */
+  readonly composerKeyboardActive: boolean;
+  /** The thread composer reports its focus so the layout can make room for typing. */
+  readonly setComposerEditing: (editing: boolean) => void;
 }
 
 const compactLayout = deriveLayout({ width: 0, height: 0 });
@@ -122,6 +134,8 @@ const AdaptiveWorkspaceContext = createContext<AdaptiveWorkspaceContextValue>({
   toggleAuxiliaryPane: () => undefined,
   togglePrimarySidebar: () => undefined,
   setAuxiliaryPaneWidth: () => undefined,
+  composerKeyboardActive: false,
+  setComposerEditing: () => undefined,
 });
 
 export function useAdaptiveWorkspaceLayout(): AdaptiveWorkspaceContextValue {
@@ -270,8 +284,19 @@ function AdaptiveWorkspaceLayoutContent(
     nativeWorkspace,
     usesSplitView: baseLayout.usesSplitView,
   });
+  const [composerEditing, setComposerEditing] = useState(false);
+  const softKeyboardVisible = useKeyboardState((state) => state.isVisible);
+  // Keyed on the soft keyboard, not focus alone: a hardware keyboard leaves room
+  // for the sidebar, and Back closes the keyboard while the editor keeps focus.
+  // Deferred because the thread composer follows the keyboard only once its own render of this
+  // keyboard event commits; re-laying out the workspace in that commit held it behind the
+  // keyboard until the feed had reflowed.
+  const composerKeyboardActive = useDeferredValue(
+    Platform.OS === "android" && baseLayout.usesSplitView && composerEditing && softKeyboardVisible,
+  );
   const showPrimarySidebar =
-    !workspacePage && (primarySidebarPinned || primarySidebarPreferredVisible);
+    !workspacePage &&
+    (primarySidebarPinned || (primarySidebarPreferredVisible && !composerKeyboardActive));
   const shouldRenderNavigationRail = Platform.OS === "android" && baseLayout.usesSplitView;
   const navigationRailWidth =
     shouldRenderNavigationRail && (showPrimarySidebar || workspacePage)
@@ -391,6 +416,12 @@ function AdaptiveWorkspaceLayoutContent(
     if (primarySidebarPinned) {
       return;
     }
+    // A sidebar the keyboard set aside returns with the keyboard; the user's preference stays
+    // intact. One the user had hidden still opens.
+    if (composerKeyboardActive) {
+      void KeyboardController.dismiss();
+      if (primarySidebarPreferredVisible) return;
+    }
     if (!panes.primarySidebarVisible && panes.primarySidebarSuppressedByAuxiliary) {
       setFileInspectorPreferredVisible(false);
       setPrimarySidebarPreferredVisible(true);
@@ -399,6 +430,7 @@ function AdaptiveWorkspaceLayoutContent(
     setPrimarySidebarPreferredVisible((current) => !current);
   };
   const revealPrimarySidebar = () => {
+    if (composerKeyboardActive) void KeyboardController.dismiss();
     if (panes.primarySidebarSuppressedByAuxiliary) {
       setFileInspectorPreferredVisible(false);
     }
@@ -499,12 +531,10 @@ function AdaptiveWorkspaceLayoutContent(
   const contentTargetWidth = layout.usesSplitView
     ? Math.max(0, panes.contentPaneWidth - inspectorColumnTargetWidth)
     : null;
-  const [contentSizing, setContentSizing] = useState({
+  const [listPaneSizing, setListPaneSizing] = useState({
     viewportWidth,
     workspacePage,
-    target: contentTargetWidth,
     sidebarVisible: panes.primarySidebarVisible,
-    width: contentTargetWidth,
     listPaneTarget: layout.listPaneWidth,
     listPaneFloor: layout.listPaneWidth,
     listPaneCeiling: layout.listPaneWidth,
@@ -512,69 +542,80 @@ function AdaptiveWorkspaceLayoutContent(
   });
   if (
     Platform.OS === "android" &&
-    (contentSizing.viewportWidth !== viewportWidth ||
-      contentSizing.workspacePage !== workspacePage ||
-      contentSizing.target !== contentTargetWidth ||
-      contentSizing.sidebarVisible !== panes.primarySidebarVisible ||
-      contentSizing.listPaneTarget !== layout.listPaneWidth)
+    (listPaneSizing.viewportWidth !== viewportWidth ||
+      listPaneSizing.workspacePage !== workspacePage ||
+      listPaneSizing.sidebarVisible !== panes.primarySidebarVisible ||
+      listPaneSizing.listPaneTarget !== layout.listPaneWidth)
   ) {
-    // A workspace page swaps the sidebar in the same frame, so nothing animates to wait for.
-    const sameViewport =
-      contentSizing.viewportWidth === viewportWidth &&
-      contentSizing.workspacePage === workspacePage;
-    const openingSidebar =
-      sameViewport && !contentSizing.sidebarVisible && panes.primarySidebarVisible;
     // A book-posture hinge resizes the visible list pane instead of revealing it.
     const resizingSidebar =
-      sameViewport &&
-      contentSizing.sidebarVisible &&
+      listPaneSizing.viewportWidth === viewportWidth &&
+      listPaneSizing.workspacePage === workspacePage &&
+      listPaneSizing.sidebarVisible &&
       panes.primarySidebarVisible &&
-      contentSizing.listPaneTarget !== layout.listPaneWidth;
-    const keepWide =
-      (openingSidebar || resizingSidebar) &&
-      contentSizing.width !== null &&
-      contentTargetWidth !== null;
-    setContentSizing({
+      listPaneSizing.listPaneTarget !== layout.listPaneWidth;
+    setListPaneSizing({
       viewportWidth,
       workspacePage,
-      target: contentTargetWidth,
       sidebarVisible: panes.primarySidebarVisible,
-      // Clip the wide navigator while the sidebar opens or widens, then reflow once at the
-      // end. Narrowing it first exposes an empty strip before the sidebar arrives.
-      width: keepWide
-        ? Math.max(contentSizing.width ?? 0, contentTargetWidth ?? 0)
-        : contentTargetWidth,
       listPaneTarget: layout.listPaneWidth,
       // While a hinge resizes the list, its width follows the pane edge within this span. A
       // retarget mid-animation widens the span, since the edge is still somewhere inside it.
       listPaneFloor: resizingSidebar
-        ? Math.min(contentSizing.listPaneFloor ?? 0, layout.listPaneWidth ?? 0)
+        ? Math.min(listPaneSizing.listPaneFloor ?? 0, layout.listPaneWidth ?? 0)
         : layout.listPaneWidth,
       listPaneCeiling: resizingSidebar
-        ? Math.max(contentSizing.listPaneCeiling ?? 0, layout.listPaneWidth ?? 0)
+        ? Math.max(listPaneSizing.listPaneCeiling ?? 0, layout.listPaneWidth ?? 0)
         : layout.listPaneWidth,
-      revision: contentSizing.revision + 1,
+      revision: listPaneSizing.revision + 1,
     });
   }
-  const settleContentWidth = (revision: number) => {
-    setContentSizing((current) =>
+  const settleListPane = (revision: number) => {
+    setListPaneSizing((current) =>
       current.revision !== revision ||
-      (current.width === current.target &&
-        current.listPaneFloor === current.listPaneTarget &&
+      (current.listPaneFloor === current.listPaneTarget &&
         current.listPaneCeiling === current.listPaneTarget)
         ? current
         : {
             ...current,
-            width: current.target,
             listPaneFloor: current.listPaneTarget,
             listPaneCeiling: current.listPaneTarget,
           },
     );
   };
-  const listPaneFloor = contentSizing.listPaneFloor ?? 0;
-  const listPaneCeiling = contentSizing.listPaneCeiling ?? 0;
-  const contentSettledWidth = Platform.OS === "android" ? contentSizing.width : contentTargetWidth;
-  const contentRevision = contentSizing.revision;
+  const listPaneFloor = listPaneSizing.listPaneFloor ?? 0;
+  const listPaneCeiling = listPaneSizing.listPaneCeiling ?? 0;
+  const listPaneRevision = listPaneSizing.revision;
+  // Android lays the content out at its new width as soon as a pane toggles, then holds it
+  // against the edge that stays put while the other one slides, so nothing reflows after the
+  // panes land. A sliding sidebar uncovers the strip it is about to fill, or covers the content
+  // until it is gone.
+  const contentLeftTarget =
+    navigationRailWidth +
+    (shouldRenderPrimarySidebar && !workspacePage && panes.primarySidebarVisible
+      ? (layout.listPaneWidth ?? 0) + (layout.listPaneGap ?? 0)
+      : 0);
+  const [contentAnchor, setContentAnchor] = useState({
+    viewportWidth,
+    left: contentLeftTarget,
+    inspector: inspectorColumnTargetWidth,
+    end: false,
+  });
+  if (
+    Platform.OS === "android" &&
+    (contentAnchor.viewportWidth !== viewportWidth ||
+      contentAnchor.left !== contentLeftTarget ||
+      contentAnchor.inspector !== inspectorColumnTargetWidth)
+  ) {
+    setContentAnchor({
+      viewportWidth,
+      left: contentLeftTarget,
+      inspector: inspectorColumnTargetWidth,
+      end:
+        contentAnchor.viewportWidth === viewportWidth &&
+        contentAnchor.inspector === inspectorColumnTargetWidth,
+    });
+  }
 
   const renderedSidebarWidth = useSharedValue(
     panes.primarySidebarVisible ? (layout.listPaneWidth ?? 0) + (layout.listPaneGap ?? 0) : 0,
@@ -598,7 +639,7 @@ function AdaptiveWorkspaceLayoutContent(
     // The content beside it already took its final width when the page closed.
     renderedSidebarWidth.set(
       withTiming(targetWidth, snap ? { duration: 0 } : WORKSPACE_PANE_TIMING, (finished) => {
-        if (finished && Platform.OS === "android") runOnJS(settleContentWidth)(contentRevision);
+        if (finished && Platform.OS === "android") runOnJS(settleListPane)(listPaneRevision);
       }),
     );
   }, [
@@ -609,8 +650,8 @@ function AdaptiveWorkspaceLayoutContent(
     panes.primarySidebarVisible,
     renderedSidebarWidth,
     renderedRailWidth,
-    settleContentWidth,
-    contentRevision,
+    settleListPane,
+    listPaneRevision,
     workspacePage,
   ]);
   const railAnimatedStyle = useAnimatedStyle(() => ({ width: renderedRailWidth.value }));
@@ -699,6 +740,8 @@ function AdaptiveWorkspaceLayoutContent(
     toggleAuxiliaryPane,
     togglePrimarySidebar,
     setAuxiliaryPaneWidth,
+    composerKeyboardActive,
+    setComposerEditing,
   };
 
   if (nativeWorkspace) {
@@ -796,18 +839,28 @@ function AdaptiveWorkspaceLayoutContent(
               <View
                 collapsable={false}
                 style={
-                  contentSettledWidth !== null
+                  contentTargetWidth !== null
                     ? {
                         flex: 1,
-                        width: contentSettledWidth,
+                        width: contentTargetWidth,
+                        alignSelf: contentAnchor.end ? "flex-end" : "flex-start",
                       }
                     : { flex: 1 }
                 }
               >
+                {/* Android holds the content still, so its floating controls keep its width. */}
                 <WorkspaceContentWidthContext
-                  value={layout.usesSplitView ? renderedContentWidth : null}
+                  value={
+                    layout.usesSplitView && Platform.OS !== "android" ? renderedContentWidth : null
+                  }
                 >
-                  {props.children}
+                  <WorkspaceSettledContentWidthContext
+                    value={
+                      Platform.OS === "android" && layout.usesSplitView ? contentTargetWidth : null
+                    }
+                  >
+                    {props.children}
+                  </WorkspaceSettledContentWidthContext>
                 </WorkspaceContentWidthContext>
               </View>
             </View>
diff --git a/apps/mobile/src/features/layout/createWorkspaceStackNavigator.ios.tsx b/apps/mobile/src/features/layout/createWorkspaceStackNavigator.ios.tsx
index 2b23ad865f04..c4c0946fffd0 100644
--- a/apps/mobile/src/features/layout/createWorkspaceStackNavigator.ios.tsx
+++ b/apps/mobile/src/features/layout/createWorkspaceStackNavigator.ios.tsx
@@ -44,9 +44,11 @@ import {
 import { V5StackHeader } from "../../native/V5StackHeader.ios";
 import type { AppNativeStackNavigationOptions } from "../../native/StackHeader";
 import {
+  collapsedSplitTransition,
   nativeWorkspacePopAction,
   projectWorkspaceStack,
   partitionStackPresentations,
+  type CollapsedSplitColumn,
 } from "../../native/workspace-stack-projection";
 import {
   NativePrimaryColumnContext,
@@ -65,6 +67,7 @@ function ColumnScreen(props: {
   readonly selectedPullRequestKey?: string | null;
   readonly sidebarFilter?: NativeStackHeaderItemMenu;
   readonly onDismiss: (routeKey: string) => void;
+  readonly onAppearance: (type: "willAppear" | "didAppear" | "willDisappear", key: string) => void;
   readonly navigation: ViewProps["navigation"];
 }) {
   const { descriptor } = props;
@@ -85,15 +88,18 @@ function ColumnScreen(props: {
       onDismiss={(event) => {
         if (event.nativeEvent.isNativeDismiss) props.onDismiss(key);
       }}
-      onWillAppear={() =>
-        props.navigation.emit({ type: "transitionStart", target: key, data: { closing: false } })
-      }
-      onDidAppear={() =>
-        props.navigation.emit({ type: "transitionEnd", target: key, data: { closing: false } })
-      }
-      onWillDisappear={() =>
-        props.navigation.emit({ type: "transitionStart", target: key, data: { closing: true } })
-      }
+      onWillAppear={() => {
+        props.onAppearance("willAppear", key);
+        props.navigation.emit({ type: "transitionStart", target: key, data: { closing: false } });
+      }}
+      onDidAppear={() => {
+        props.onAppearance("didAppear", key);
+        props.navigation.emit({ type: "transitionEnd", target: key, data: { closing: false } });
+      }}
+      onWillDisappear={() => {
+        props.onAppearance("willDisappear", key);
+        props.navigation.emit({ type: "transitionStart", target: key, data: { closing: true } });
+      }}
       onDidDisappear={() =>
         props.navigation.emit({ type: "transitionEnd", target: key, data: { closing: true } })
       }
@@ -130,7 +136,8 @@ function WorkspaceColumns(
   const hostRef = useRef<SplitHostCommands>(null);
   const activeDetailKey = props.detail.at(-1)?.key;
   const compactColumn = activeDetailKey ? "secondary" : "primary";
-  const shownCompactColumn = useRef(compactColumn);
+  const collapsed = useRef(!layout.usesSplitView);
+  const collapsedColumn = useRef<CollapsedSplitColumn>({ visible: compactColumn, leaving: null });
   const threadParams = props.detail.findLast((route) => route.name === "Thread")?.params;
   const pullRequestParams = props.detail.findLast(
     (route) =>
@@ -169,10 +176,24 @@ function WorkspaceColumns(
     },
     [props.navigation],
   );
+  const followCollapsedSplit = (
+    type: "willAppear" | "didAppear" | "willDisappear",
+    key: string,
+  ) => {
+    if (!collapsed.current || layout.usesSplitView) return;
+    const transition = collapsedSplitTransition(
+      collapsedColumn.current,
+      { type, key },
+      props.navigation.getState(),
+      props.primary.key,
+    );
+    collapsedColumn.current = transition.column;
+    if (transition.pop) props.navigation.dispatch(transition.pop);
+  };
 
   useEffect(() => {
-    if (layout.usesSplitView || shownCompactColumn.current === compactColumn) return;
-    shownCompactColumn.current = compactColumn;
+    if (layout.usesSplitView || collapsedColumn.current.visible === compactColumn) return;
+    collapsedColumn.current = { ...collapsedColumn.current, visible: compactColumn };
     hostRef.current?.show(compactColumn);
   }, [compactColumn, layout.usesSplitView]);
 
@@ -185,6 +206,13 @@ function WorkspaceColumns(
       testID="adaptive-workspace-layout"
       preferredSplitBehavior="tile"
       topColumnForCollapsing={compactColumn}
+      onCollapse={() => {
+        collapsed.current = true;
+        collapsedColumn.current = { visible: compactColumn, leaving: null };
+      }}
+      onExpand={() => {
+        collapsed.current = false;
+      }}
       preferredDisplayMode={
         panes.primarySidebarVisible || (!layout.usesSplitView && !activeDetailKey)
           ? "oneBesideSecondary"
@@ -211,6 +239,7 @@ function WorkspaceColumns(
             selectedThreadKey={selectedThreadKey}
             selectedPullRequestKey={selectedPullRequestKey}
             onDismiss={handleNativeDismiss}
+            onAppearance={followCollapsedSplit}
             navigation={props.navigation}
           />
         </Split.Stack>
@@ -252,6 +281,7 @@ function WorkspaceColumns(
                 key={route.key}
                 descriptor={descriptor}
                 onDismiss={handleNativeDismiss}
+                onAppearance={followCollapsedSplit}
                 navigation={props.navigation}
                 sidebarFilter={sidebarFilter}
               />
diff --git a/apps/mobile/src/features/layout/workspace-content-width.ts b/apps/mobile/src/features/layout/workspace-content-width.ts
index cf24b1be68b4..e4811586c0af 100644
--- a/apps/mobile/src/features/layout/workspace-content-width.ts
+++ b/apps/mobile/src/features/layout/workspace-content-width.ts
@@ -8,3 +8,12 @@ export const WorkspaceContentWidthContext = createContext<SharedValue<number> |
 export function useWorkspaceContentWidth() {
   return use(WorkspaceContentWidthContext);
 }
+
+// The settled width itself. The feed lays its rows out at this width in the same commit that
+// resizes the pane; waiting for its own onLayout re-measured every row twice, once against the
+// old text widths, and the list jumped while it repositioned them.
+export const WorkspaceSettledContentWidthContext = createContext<number | null>(null);
+
+export function useWorkspaceSettledContentWidth() {
+  return use(WorkspaceSettledContentWidthContext);
+}
diff --git a/apps/mobile/src/features/settings/SettingsScheduledTasksRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsScheduledTasksRouteScreen.tsx
index 8913502da919..36c58dc893d0 100644
--- a/apps/mobile/src/features/settings/SettingsScheduledTasksRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsScheduledTasksRouteScreen.tsx
@@ -13,6 +13,7 @@ import type {
 } from "@t3tools/contracts";
 import {
   MAX_WEBHOOK_DELIVERY_AGE_MINUTES,
+  MAX_WEBHOOK_FILTERS,
   resolveEnvironmentMachineKind,
 } from "@t3tools/contracts";
 import type { MenuAction } from "@react-native-menu/menu";
@@ -24,7 +25,12 @@ import {
 } from "@t3tools/client-runtime/state/runtime";
 import {
   DEFAULT_WEBHOOK_PROMPT,
+  emptyWebhookFilterDraft,
   parseMaxDeliveryAge,
+  parseWebhookFilterDrafts,
+  removeWebhookFilterDraft,
+  WEBHOOK_FILTER_OPS,
+  type WebhookFilterDraft,
 } from "@t3tools/client-runtime/scheduled-task-webhook";
 import { useEffect, useLayoutEffect, useRef, useState, type ReactNode } from "react";
 import { useFocusEffect, useNavigation, usePreventRemove } from "@react-navigation/native";
@@ -222,6 +228,84 @@ function SelectRow(props: {
   );
 }
 
+function WebhookFilterRows(props: {
+  readonly filters: ReadonlyArray<WebhookFilterDraft>;
+  readonly disabled: boolean;
+  readonly onChange: (filters: ReadonlyArray<WebhookFilterDraft>) => void;
+}) {
+  const update = (index: number, patch: Partial<WebhookFilterDraft>) =>
+    props.onChange(
+      props.filters.map((filter, at) => (at === index ? { ...filter, ...patch } : filter)),
+    );
+  return (
+    <>
+      {props.filters.map((filter, index) => (
+        <View key={filter.id}>
+          <View className="flex-row items-center gap-3 border-t border-border-subtle px-4 pt-3">
+            <Text className="min-w-0 flex-1 text-sm text-foreground-muted">Filter {index + 1}</Text>
+            <Pressable
+              accessibilityRole="button"
+              accessibilityLabel={`Remove filter ${index + 1}`}
+              disabled={props.disabled}
+              hitSlop={8}
+              onPress={() => props.onChange(removeWebhookFilterDraft(props.filters, filter.id))}
+              className="active:opacity-70"
+            >
+              <SymbolView name="trash" size={16} tintColorClassName="accent-danger-foreground" />
+            </Pressable>
+          </View>
+          <FormField
+            label="Path"
+            value={filter.path}
+            placeholder="body.action"
+            disabled={props.disabled}
+            onChange={(path) => update(index, { path })}
+          />
+          <SelectRow
+            label="Test"
+            value={WEBHOOK_FILTER_OPS.find((option) => option.op === filter.op)?.label ?? ""}
+            actions={WEBHOOK_FILTER_OPS.map((option) => ({
+              id: option.op,
+              title: option.label,
+              state: option.op === filter.op ? ("on" as const) : undefined,
+            }))}
+            onSelect={(id) => {
+              const known = WEBHOOK_FILTER_OPS.find((option) => option.op === id);
+              if (known) update(index, { op: known.op });
+            }}
+          />
+          {filter.op === "exists" ? null : (
+            <FormField
+              label={filter.op === "in" ? "Values, comma-separated" : "Value"}
+              value={filter.value}
+              placeholder={filter.op === "in" ? "opened, reopened" : "opened"}
+              disabled={props.disabled}
+              onChange={(value) => update(index, { value })}
+            />
+          )}
+        </View>
+      ))}
+      {props.filters.length < MAX_WEBHOOK_FILTERS ? (
+        <Pressable
+          accessibilityRole="button"
+          disabled={props.disabled}
+          onPress={() => props.onChange([...props.filters, emptyWebhookFilterDraft()])}
+          className="min-h-14 flex-row items-center gap-3 border-t border-border-subtle px-4 py-3 active:opacity-70"
+        >
+          <Text className="min-w-0 flex-1 text-lg text-foreground">Add filter</Text>
+          <SymbolView name="plus" size={16} tintColorClassName="accent-icon" />
+        </Pressable>
+      ) : null}
+      {props.filters.length > 0 ? (
+        <Text className="px-4 pb-3 text-sm text-foreground-muted">
+          Runs only when every filter matches. Other requests are logged as filtered. Separate “is
+          one of” values with commas; a value can't contain a comma.
+        </Text>
+      ) : null}
+    </>
+  );
+}
+
 function PickerRow(props: {
   readonly label: string;
   readonly value: string;
@@ -627,6 +711,18 @@ function TaskForm({
       );
       return;
     }
+    const parsedFilters = parseWebhookFilterDrafts(draft.schedule.filters);
+    if (draft.schedule.mode === "webhook" && "error" in parsedFilters) {
+      Dialog.alert("Invalid filter", parsedFilters.error);
+      return;
+    }
+    if (draft.schedule.mode === "webhook" && schedule === null) {
+      Dialog.alert(
+        "Invalid webhook settings",
+        "Each dedupe key must contain a valid request placeholder. The coalesce window must be whole seconds from 10 to 3600, or blank.",
+      );
+      return;
+    }
     if (
       !draft.title.trim() ||
       !draft.prompt.trim() ||
@@ -964,6 +1060,48 @@ function TaskForm({
                   setDraft({ ...draft, schedule: { ...draft.schedule, maxDeliveryAgeMinutes } })
                 }
               />
+              <WebhookFilterRows
+                filters={draft.schedule.filters}
+                disabled={saving}
+                onChange={(filters) =>
+                  setDraft({ ...draft, schedule: { ...draft.schedule, filters } })
+                }
+              />
+              <FormField
+                label="Replay key template"
+                value={draft.schedule.replayKey}
+                placeholder="{{headers.delivery-id}}"
+                disabled={saving}
+                borderTop
+                onChange={(replayKey) =>
+                  setDraft({ ...draft, schedule: { ...draft.schedule, replayKey } })
+                }
+              />
+              <FormField
+                label="Coalesce key template"
+                value={draft.schedule.coalesceKey}
+                placeholder="{{body.id}}"
+                disabled={saving}
+                borderTop
+                onChange={(coalesceKey) =>
+                  setDraft({ ...draft, schedule: { ...draft.schedule, coalesceKey } })
+                }
+              />
+              <FormField
+                label="Coalesce window (seconds, 10–3600)"
+                value={draft.schedule.coalesceWindowSeconds}
+                placeholder="120"
+                keyboardType="number-pad"
+                disabled={saving}
+                borderTop
+                onChange={(coalesceWindowSeconds) =>
+                  setDraft({ ...draft, schedule: { ...draft.schedule, coalesceWindowSeconds } })
+                }
+              />
+              <Text className="px-4 pb-3 text-sm text-foreground-muted">
+                Replay keys suppress repeats for 7 days. Coalescing runs the latest payload when the
+                window from the first delivery closes. Empty keys run normally.
+              </Text>
             </>
           ) : (
             <>
diff --git a/apps/mobile/src/features/settings/scheduledTaskDraft.test.ts b/apps/mobile/src/features/settings/scheduledTaskDraft.test.ts
index 69532b3fd264..aa7d36156e50 100644
--- a/apps/mobile/src/features/settings/scheduledTaskDraft.test.ts
+++ b/apps/mobile/src/features/settings/scheduledTaskDraft.test.ts
@@ -30,6 +30,37 @@ describe("scheduleDraftForTask", () => {
     expect(scheduleFromDraft(scheduleDraftForTask({ schedule }))).toEqual(schedule);
   });
 
+  it("round-trips dedupe settings and rejects invalid windows", () => {
+    const dedupe = {
+      replayKey: "{{headers.delivery-id}}",
+      coalesceKey: "{{body.id}}",
+      coalesceWindowSeconds: 3600,
+    };
+    const draft = scheduleDraftForTask({ schedule: { type: "webhook", signature: null, dedupe } });
+    expect(scheduleFromDraft(draft)).toMatchObject({ dedupe });
+    expect(
+      scheduleFromDraft({
+        ...draft,
+        replayKey: " \n ",
+        coalesceKey: " \t ",
+        coalesceWindowSeconds: "",
+      }),
+    ).toMatchObject({ dedupe: {} });
+    expect(
+      scheduleFromDraft({
+        ...draft,
+        replayKey: `  ${dedupe.replayKey}  `,
+        coalesceKey: `\t${dedupe.coalesceKey}\n`,
+      }),
+    ).toMatchObject({ dedupe });
+    expect(
+      scheduleFromDraft({ ...draft, replayKey: "", coalesceKey: "", coalesceWindowSeconds: "" }),
+    ).toMatchObject({ dedupe: {} });
+    for (const coalesceWindowSeconds of ["9", "3601", "1.5", "abc"]) {
+      expect(scheduleFromDraft({ ...draft, coalesceWindowSeconds })).toBeNull();
+    }
+  });
+
   it("round-trips a webhook schedule without a signature", () => {
     const draft = scheduleDraftForTask({ schedule: { type: "webhook", signature: null } });
     expect(draft.mode).toBe("webhook");
@@ -37,6 +68,7 @@ describe("scheduleDraftForTask", () => {
       type: "webhook",
       signature: null,
       maxDeliveryAgeMinutes: null,
+      dedupe: {},
     });
   });
 
@@ -50,6 +82,7 @@ describe("scheduleDraftForTask", () => {
     expect(scheduleFromDraft({ ...draft, maxDeliveryAgeMinutes: "0" })).toBeNull();
     expect(scheduleFromDraft({ ...draft, maxDeliveryAgeMinutes: "" })).toMatchObject({
       maxDeliveryAgeMinutes: null,
+      dedupe: {},
     });
   });
 
@@ -62,9 +95,26 @@ describe("scheduleDraftForTask", () => {
     const saved = scheduleFromDraft(
       scheduleDraftForTask({ schedule: { type: "webhook", signature } }),
     );
-    expect(saved).toEqual({ type: "webhook", signature, maxDeliveryAgeMinutes: null });
+    expect(saved).toEqual({ type: "webhook", signature, maxDeliveryAgeMinutes: null, dedupe: {} });
     expect(saved?.type === "webhook" && saved.signature && "secret" in saved.signature).toBe(false);
   });
+
+  it("round-trips webhook filters and refuses an invalid one", () => {
+    const filters = [
+      { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+      { path: "body.label.name", op: "in", value: ["needs review", "agent:fix"] },
+    ] as const;
+    const draft = scheduleDraftForTask({ schedule: { type: "webhook", signature: null, filters } });
+    // Untouched rows are left out, so the server keeps whatever is stored now.
+    expect(scheduleFromDraft(draft)).not.toHaveProperty("filters");
+    expect(scheduleFromDraft({ ...draft, filters: [] })).toMatchObject({ filters: [] });
+    expect(scheduleFromDraft({ ...draft, filters: draft.filters.slice(1) })).toMatchObject({
+      filters: filters.slice(1),
+    });
+    expect(
+      scheduleFromDraft({ ...draft, filters: [{ id: "f1", path: "", op: "exists", value: "" }] }),
+    ).toBeNull();
+  });
 });
 
 describe("hasScheduledTaskDraftChanges", () => {
@@ -352,3 +402,12 @@ describe("scheduled task model defaults", () => {
     ).toBeNull();
   });
 });
+
+it("rejects dedupe keys without valid request placeholders", () => {
+  expect(
+    scheduleFromDraft({ ...DEFAULT_SCHEDULE, mode: "webhook", replayKey: "literal" }),
+  ).toBeNull();
+  expect(
+    scheduleFromDraft({ ...DEFAULT_SCHEDULE, mode: "webhook", coalesceKey: "{{body.bad" }),
+  ).toBeNull();
+});
diff --git a/apps/mobile/src/features/settings/scheduledTaskDraft.ts b/apps/mobile/src/features/settings/scheduledTaskDraft.ts
index eff6674aacc9..3ef1a2f3faf6 100644
--- a/apps/mobile/src/features/settings/scheduledTaskDraft.ts
+++ b/apps/mobile/src/features/settings/scheduledTaskDraft.ts
@@ -1,3 +1,4 @@
+import { isWebhookDedupeTemplate } from "@t3tools/contracts";
 import type {
   ModelSelection,
   ServerConfig,
@@ -9,7 +10,13 @@ import type {
 } from "@t3tools/contracts";
 
 import { DEFAULT_SERVER_SETTINGS } from "@t3tools/contracts";
-import { parseMaxDeliveryAge } from "@t3tools/client-runtime/scheduled-task-webhook";
+import {
+  parseMaxDeliveryAge,
+  parseWebhookFilterDrafts,
+  webhookFilterDrafts,
+  webhookFilterDraftsChanged,
+  type WebhookFilterDraft,
+} from "@t3tools/client-runtime/scheduled-task-webhook";
 import {
   resolveProjectSettings,
   type LegacyProjectSettingsFields,
@@ -50,6 +57,12 @@ export type ScheduleDraft = {
   readonly intervalMinutes: string;
   readonly signature: ScheduledTaskWebhookSignature | null;
   readonly maxDeliveryAgeMinutes: string;
+  readonly replayKey: string;
+  readonly coalesceKey: string;
+  readonly coalesceWindowSeconds: string;
+  readonly filters: ReadonlyArray<WebhookFilterDraft>;
+  /** The filter rows the form opened with. */
+  readonly savedFilters: ReadonlyArray<WebhookFilterDraft>;
 };
 
 export const DEFAULT_SCHEDULE: ScheduleDraft = {
@@ -59,6 +72,11 @@ export const DEFAULT_SCHEDULE: ScheduleDraft = {
   intervalMinutes: "15",
   signature: null,
   maxDeliveryAgeMinutes: "",
+  replayKey: "",
+  coalesceKey: "",
+  coalesceWindowSeconds: "",
+  filters: [],
+  savedFilters: [],
 };
 
 export function scheduleDraftForTask(task: Pick<ScheduledTask, "schedule">): ScheduleDraft {
@@ -82,10 +100,18 @@ export function scheduleDraftForTask(task: Pick<ScheduledTask, "schedule">): Sch
         ...DEFAULT_SCHEDULE,
         mode: "webhook",
         signature: task.schedule.signature,
+        replayKey: task.schedule.dedupe?.replayKey ?? "",
+        coalesceKey: task.schedule.dedupe?.coalesceKey ?? "",
+        coalesceWindowSeconds:
+          task.schedule.dedupe?.coalesceWindowSeconds === undefined
+            ? ""
+            : String(task.schedule.dedupe.coalesceWindowSeconds),
         maxDeliveryAgeMinutes:
           task.schedule.maxDeliveryAgeMinutes == null
             ? ""
             : String(task.schedule.maxDeliveryAgeMinutes),
+        filters: webhookFilterDrafts(task.schedule.filters),
+        savedFilters: webhookFilterDrafts(task.schedule.filters),
       };
   }
 }
@@ -94,6 +120,21 @@ export function scheduleFromDraft(draft: ScheduleDraft): ScheduledTaskUpsertSche
   if (draft.mode === "webhook") {
     const maxDeliveryAgeMinutes = parseMaxDeliveryAge(draft.maxDeliveryAgeMinutes);
     if (maxDeliveryAgeMinutes === undefined) return null;
+    const replayKey = draft.replayKey.trim();
+    const coalesceKey = draft.coalesceKey.trim();
+    if ([replayKey, coalesceKey].some((key) => key && !isWebhookDedupeTemplate(key))) return null;
+    const coalesceWindowSeconds = draft.coalesceWindowSeconds?.trim()
+      ? Number(draft.coalesceWindowSeconds)
+      : undefined;
+    if (
+      coalesceWindowSeconds !== undefined &&
+      (!Number.isInteger(coalesceWindowSeconds) ||
+        coalesceWindowSeconds < 10 ||
+        coalesceWindowSeconds > 3600)
+    )
+      return null;
+    const parsedFilters = parseWebhookFilterDrafts(draft.filters);
+    if (!("filters" in parsedFilters)) return null;
     // No secret is sent, so the server keeps the stored one.
     return {
       type: "webhook",
@@ -106,6 +147,19 @@ export function scheduleFromDraft(draft: ScheduleDraft): ScheduledTaskUpsertSche
               prefix: draft.signature.prefix,
             },
       maxDeliveryAgeMinutes,
+      ...(replayKey || coalesceKey || coalesceWindowSeconds !== undefined
+        ? {
+            dedupe: {
+              ...(replayKey ? { replayKey } : {}),
+              ...(coalesceKey ? { coalesceKey } : {}),
+              ...(coalesceWindowSeconds === undefined ? {} : { coalesceWindowSeconds }),
+            },
+          }
+        : { dedupe: {} }),
+      // Only edited filters are sent; the server keeps the stored ones otherwise.
+      ...(webhookFilterDraftsChanged(draft.savedFilters, draft.filters)
+        ? { filters: parsedFilters.filters }
+        : {}),
     };
   }
   if (draft.mode === "interval") {
@@ -160,6 +214,10 @@ function draftSignature(draft: ScheduledTaskDraft): string {
     [...draft.schedule.weekdays].sort((a, b) => a - b),
     draft.schedule.intervalMinutes,
     draft.schedule.maxDeliveryAgeMinutes,
+    draft.schedule.replayKey,
+    draft.schedule.coalesceKey,
+    draft.schedule.coalesceWindowSeconds,
+    draft.schedule.filters.map(({ path, op, value }) => [path, op, value]),
     draft.workspace,
     draft.baseRef,
     draft.checkoutPath,
diff --git a/apps/mobile/src/features/threads/ThreadComposer.tsx b/apps/mobile/src/features/threads/ThreadComposer.tsx
index 1619612a5aef..8140517f4ab4 100644
--- a/apps/mobile/src/features/threads/ThreadComposer.tsx
+++ b/apps/mobile/src/features/threads/ThreadComposer.tsx
@@ -1,6 +1,7 @@
 import { Button } from "../../components/ui/Button";
 import * as Dialog from "../../components/ui/Dialog";
 import type { ComposerTextPaste } from "../../native/T3ComposerEditor.types";
+import { useAdaptiveWorkspaceLayout } from "../layout/AdaptiveWorkspaceLayout";
 import { useAppearancePreferences } from "../settings/appearance/AppearancePreferencesProvider";
 import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";
 import { settlePromise, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
@@ -187,6 +188,7 @@ export interface ThreadComposerProps {
   readonly onUpdateModelSelection: (modelSelection: ModelSelection) => void;
   readonly onUpdateRuntimeMode: (runtimeMode: RuntimeMode) => void;
   readonly onUpdateInteractionMode: (interactionMode: ProviderInteractionMode) => void;
+  /** True while the draft is stacked above the controls rather than in the one-row capsule. */
   readonly onExpandedChange?: (expanded: boolean) => void;
   readonly onEditorFocusChange?: (focused: boolean) => void;
 }
@@ -220,6 +222,11 @@ const composerHeightTransition: LayoutAnimationFunction = (values) => {
 };
 export const COMPOSER_LAYOUT_TRANSITION =
   Platform.OS === "android" ? undefined : composerHeightTransition;
+// Share of the one-row composer the draft keeps; a long model name truncates first.
+const INLINE_EDITOR_MIN_WIDTH = "40%";
+// The one-row editor's horizontal padding plus room for the caret.
+const INLINE_EDITOR_TEXT_SLACK = 10;
+const INLINE_EDITOR_HEIGHT = 36;
 
 const COMPOSER_ATTACHMENT_ENTERING =
   Platform.OS === "android"
@@ -495,8 +502,39 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
   );
   const isVoiceInputPresented = voicePresentation.statusLabel !== null;
   const isExpanded = isFocused || settingsSheetPresentation.keepsComposerExpanded;
-  const showsCompactDictation = isVoiceInputPresented && !isExpanded;
-  const isToolbarVisible = isExpanded || isVoiceInputPresented;
+  const { setComposerEditing } = useAdaptiveWorkspaceLayout();
+  // The composer stays one row, with the model picker in it, until the draft would
+  // wrap. Then the draft stacks above the controls and returns to the row once it
+  // fits again. The native editor reports its laid-out text size: more than one
+  // line means the draft wrapped where it is, and the widest line is a one-line
+  // draft's natural width, which is compared with the row's text area so a draft
+  // laid out in the wider card still returns to the row when it fits, including
+  // when the pane widens. The measurements live in refs and only the verdict is
+  // state, so a keystroke that keeps the verdict costs no extra render.
+  const draftSizeRef = useRef({ width: 0, height: 0 });
+  const rowGeometryRef = useRef({ surfaceWidth: 0, leadingWidth: 0, trailingWidth: 0 });
+  const [draftOverflowsRow, setDraftOverflowsRow] = useState(false);
+  const lineHeight = bodyText.lineHeight;
+  const updateDraftOverflow = () => {
+    const { width, height } = draftSizeRef.current;
+    const row = rowGeometryRef.current;
+    const rowTextWidth =
+      row.surfaceWidth - row.leadingWidth - row.trailingWidth - INLINE_EDITOR_TEXT_SLACK;
+    setDraftOverflowsRow(
+      height > lineHeight * 1.5 || (row.surfaceWidth > 0 && width > rowTextWidth),
+    );
+  };
+  const measureRow = (key: keyof typeof rowGeometryRef.current, value: number) => {
+    if (rowGeometryRef.current[key] === value) return;
+    rowGeometryRef.current = { ...rowGeometryRef.current, [key]: value };
+    updateDraftOverflow();
+  };
+  const usesCard = isExpanded && draftMessage.length > 0 && draftOverflowsRow;
+  const showsCompactDictation = isVoiceInputPresented && !usesCard;
+  const isToolbarVisible = usesCard || isVoiceInputPresented;
+  const hasEditingAttachments =
+    (queuedEdit !== null && queuedEdit.existingAttachments.length > 0) ||
+    stripAttachments.length > 0;
   const attachmentBlockReason = composerAttachmentUploadBlockReason({
     environmentId: props.environmentId,
     attachments: draftAttachments,
@@ -519,8 +557,9 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
     !modelUnavailable;
 
   useEffect(() => {
-    onExpandedChange?.(isExpanded);
-  }, [isExpanded, onExpandedChange]);
+    onExpandedChange?.(usesCard);
+  }, [usesCard, onExpandedChange]);
+  useEffect(() => () => setComposerEditing(false), [setComposerEditing]);
 
   const onPressPreview = (source: FilePreviewSource) => {
     wasExpandedBeforePreviewRef.current = isFocused;
@@ -553,16 +592,14 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
   const onEditorFocusChange = props.onEditorFocusChange;
   const handleFocus = () => {
     setIsFocused(true);
-    onExpandedChange?.(true);
     onEditorFocusChange?.(true);
+    setComposerEditing(true);
   };
 
   const handleBlur = () => {
     setIsFocused(false);
-    if (!settingsSheetPresentation.keepsComposerExpanded) {
-      onExpandedChange?.(false);
-    }
     onEditorFocusChange?.(false);
+    setComposerEditing(false);
   };
   const handleSend = async (followUp?: ActiveTurnComposerAction) => {
     if (voiceInput.blocksSubmission || pendingPastedTextAttachmentCountRef.current > 0) return;
@@ -676,12 +713,80 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
     [navigation, settingsSheetPresentation.onStackTransitionsFinished],
   );
 
+  // Removable attachments: inside the card, or above the focused one-row composer.
+  const editingAttachments = hasEditingAttachments ? (
+    <>
+      {queuedEdit !== null && queuedEdit.existingAttachments.length > 0 ? (
+        <Animated.View
+          className="px-[14px] pb-2.5"
+          entering={COMPOSER_ATTACHMENT_ENTERING}
+          exiting={FadeOut.duration(120)}
+        >
+          <ComposerQueuedEditAttachments
+            environmentId={props.environmentId}
+            attachments={queuedEdit.existingAttachments}
+            disabled={queuedEdit.saving || voiceInput.isBusy}
+            onRemove={queuedEdit.onRemoveExistingAttachment}
+          />
+        </Animated.View>
+      ) : null}
+      {stripAttachments.length > 0 ? (
+        <Animated.View
+          className="px-[14px] pb-2.5"
+          entering={COMPOSER_ATTACHMENT_ENTERING}
+          exiting={FadeOut.duration(120)}
+        >
+          <ComposerAttachmentStrip
+            environmentId={props.environmentId}
+            attachments={stripAttachments}
+            onRemove={voiceInput.isBusy ? () => undefined : props.onRemoveDraftImage}
+            onPressPreview={voiceInput.isBusy ? undefined : onPressPreview}
+            onPressVideo={voiceInput.isBusy ? undefined : onPressVideo}
+            onPressDocument={
+              voiceInput.isBusy
+                ? undefined
+                : (attachment) =>
+                    openDraftDocument({
+                      attachmentId: attachment.id,
+                      name: attachment.name,
+                      mimeType: attachment.mimeType,
+                      sizeBytes: attachment.sizeBytes,
+                    })
+            }
+          />
+        </Animated.View>
+      ) : null}
+    </>
+  ) : null;
+
+  // The row and the card's toolbar share this picker. It shrinks to the provider
+  // icon once the draft has text, so the draft keeps the width.
+  const modelControl = (
+    <View className="min-w-0 shrink">
+      <ComposerInlineControl
+        accessibilityLabel="Model and reasoning settings"
+        emphasized
+        renderIcon={(size) => (
+          <ProviderIcon
+            iconUrl={currentModelOption?.providerIconUrl}
+            provider={currentModelOption?.providerDriver}
+            size={size}
+          />
+        )}
+        label={currentModelOption?.label ?? currentModelSelection.model}
+        iconOnly={draftMessage.length > 0}
+        maxWidth="100%"
+        onPress={openSettings}
+      />
+    </View>
+  );
+
   return (
     <Animated.View
       className="px-[12px]"
       style={{
-        paddingTop: isExpanded ? 8 : 6,
-        paddingBottom: (props.bottomInset ?? 0) + (isExpanded ? 8 : 6),
+        paddingTop: usesCard ? 8 : 6,
+        paddingBottom: (props.bottomInset ?? 0) + (usesCard ? 8 : 6),
         backgroundColor:
           Platform.OS === "android" ? themeColorWithAlpha(composerPanel, 1) : undefined,
       }}
@@ -700,6 +805,7 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
       <Animated.View
         className="relative w-full self-center"
         style={{ maxWidth: props.contentMaxWidth }}
+        onLayout={(event) => measureRow("surfaceWidth", event.nativeEvent.layout.width)}
       >
         {!voiceInput.isBusy &&
         composerMenu.trigger &&
@@ -746,10 +852,9 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
 
         <ComposerSurface
           style={
-            isExpanded
+            usesCard
               ? {
                   borderRadius: 26,
-                  minHeight: 140,
                   overflow: "hidden" as const,
                   paddingBottom: 6,
                   paddingTop: 14,
@@ -761,12 +866,13 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                 }
           }
         >
+          {isExpanded && !usesCard ? editingAttachments : null}
           <ComposerDictationDraftContent
-            className={isExpanded ? undefined : "flex-row items-center"}
-            compact={!isExpanded}
+            className={usesCard ? undefined : "flex-row items-center"}
+            compact={!usesCard}
             hidden={showsCompactDictation}
           >
-            {!isExpanded ? (
+            {!usesCard ? (
               <ComposerAttachmentButton
                 supportsFiles={Boolean(
                   props.serverConfig?.environment.capabilities.fileAttachments,
@@ -775,49 +881,16 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                 onPickFiles={props.onPickDraftFiles}
               />
             ) : null}
-            {isExpanded && queuedEdit !== null && queuedEdit.existingAttachments.length > 0 ? (
-              <Animated.View
-                className="px-[14px] pb-2.5"
-                entering={COMPOSER_ATTACHMENT_ENTERING}
-                exiting={FadeOut.duration(120)}
-              >
-                <ComposerQueuedEditAttachments
-                  environmentId={props.environmentId}
-                  attachments={queuedEdit.existingAttachments}
-                  disabled={queuedEdit.saving || voiceInput.isBusy}
-                  onRemove={queuedEdit.onRemoveExistingAttachment}
-                />
-              </Animated.View>
-            ) : null}
-            {isExpanded && stripAttachments.length > 0 ? (
-              <Animated.View
-                className="px-[14px] pb-2.5"
-                entering={COMPOSER_ATTACHMENT_ENTERING}
-                exiting={FadeOut.duration(120)}
-              >
-                <ComposerAttachmentStrip
-                  environmentId={props.environmentId}
-                  attachments={stripAttachments}
-                  onRemove={voiceInput.isBusy ? () => undefined : props.onRemoveDraftImage}
-                  onPressPreview={voiceInput.isBusy ? undefined : onPressPreview}
-                  onPressVideo={voiceInput.isBusy ? undefined : onPressVideo}
-                  onPressDocument={
-                    voiceInput.isBusy
-                      ? undefined
-                      : (attachment) =>
-                          openDraftDocument({
-                            attachmentId: attachment.id,
-                            name: attachment.name,
-                            mimeType: attachment.mimeType,
-                            sizeBytes: attachment.sizeBytes,
-                          })
-                  }
-                />
-              </Animated.View>
-            ) : null}
+            {usesCard ? editingAttachments : null}
             <Animated.View
-              className={isExpanded ? "px-[14px]" : "min-w-0 flex-1 px-[4px]"}
+              className={usesCard ? "px-[14px]" : "min-w-0 flex-1 px-[4px]"}
+              style={usesCard ? undefined : { minWidth: INLINE_EDITOR_MIN_WIDTH }}
               layout={COMPOSER_LAYOUT_TRANSITION}
+              onLayout={
+                usesCard
+                  ? undefined
+                  : (event) => measureRow("leadingWidth", event.nativeEvent.layout.x)
+              }
             >
               <ComposerEditor
                 hidden={props.hidden}
@@ -931,19 +1004,29 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                     : FOLLOW_UP_ACTION_LABEL[sendPresentation.alternate]
                 }
                 scrollEnabled={isExpanded}
-                singleLineCentered={!isExpanded}
+                singleLineCentered={!usesCard}
                 contentInsetVertical={
-                  isExpanded || Platform.OS === "android" ? 0 : collapsedEditorInset(bodyText)
+                  usesCard || Platform.OS === "android" ? 0 : collapsedEditorInset(bodyText)
                 }
+                onContentSizeChange={(size) => {
+                  draftSizeRef.current = size;
+                  updateDraftOverflow();
+                }}
                 style={
-                  isExpanded
+                  usesCard
                     ? {
-                        minHeight: 72,
-                        maxHeight: 160,
+                        // A stacked draft shows two to four lines, then scrolls.
+                        minHeight: lineHeight * 2 + 8,
+                        maxHeight: lineHeight * 4 + 8,
                         paddingVertical: 4,
                       }
                     : {
-                        height: 36,
+                        // Large text sizes need room for one full line plus the iOS inset.
+                        height: Math.max(
+                          INLINE_EDITOR_HEIGHT,
+                          Math.ceil(lineHeight) +
+                            (Platform.OS === "android" ? 0 : 2 * collapsedEditorInset(bodyText)),
+                        ),
                       }
                 }
                 textStyle={{
@@ -975,8 +1058,12 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                 ) : null}
               </View>
             ) : null}
-            {!isExpanded ? (
-              <View className="flex-row items-center">
+            {!usesCard ? (
+              <View
+                className="min-w-0 shrink flex-row items-center"
+                onLayout={(event) => measureRow("trailingWidth", event.nativeEvent.layout.width)}
+              >
+                {modelControl}
                 <ComposerDictationStartAction
                   state={voiceInput.state}
                   isAvailable={voiceInput.isAvailable}
@@ -1008,7 +1095,7 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                 )}
               </View>
             ) : null}
-            {isExpanded ? <View className="h-1" /> : null}
+            {usesCard ? <View className="h-1" /> : null}
           </ComposerDictationDraftContent>
           <Animated.View
             accessibilityElementsHidden={!isToolbarVisible}
@@ -1017,7 +1104,7 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
             layout={COMPOSER_LAYOUT_TRANSITION}
             pointerEvents={isToolbarVisible ? "auto" : "none"}
             style={
-              isExpanded
+              usesCard
                 ? undefined
                 : {
                     position: "absolute",
@@ -1058,22 +1145,7 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                       onPickMedia={props.onPickDraftMedia}
                       onPickFiles={props.onPickDraftFiles}
                     />
-                    <View className="min-w-0 shrink">
-                      <ComposerInlineControl
-                        accessibilityLabel="Model and reasoning settings"
-                        emphasized
-                        renderIcon={(size) => (
-                          <ProviderIcon
-                            iconUrl={currentModelOption?.providerIconUrl}
-                            provider={currentModelOption?.providerDriver}
-                            size={size}
-                          />
-                        )}
-                        label={currentModelOption?.label ?? currentModelSelection.model}
-                        maxWidth="100%"
-                        onPress={openSettings}
-                      />
-                    </View>
+                    {modelControl}
                   </View>
                 )}
                 <View className="shrink-0 flex-row items-center">
diff --git a/apps/mobile/src/features/threads/ThreadFeed.tsx b/apps/mobile/src/features/threads/ThreadFeed.tsx
index d733b751ace6..727cf5782444 100644
--- a/apps/mobile/src/features/threads/ThreadFeed.tsx
+++ b/apps/mobile/src/features/threads/ThreadFeed.tsx
@@ -1,6 +1,7 @@
 import { Button } from "../../components/ui/Button";
 import * as Dialog from "../../components/ui/Dialog";
 import { useOpenPullRequest } from "../../native/useOpenPullRequest";
+import { useWorkspaceSettledContentWidth } from "../layout/workspace-content-width";
 import { ThreadMarkdownVideo, ThreadMediaVisibleContext } from "./ThreadMarkdownVideo";
 import { useMarkdownImageSource } from "../../native/useMarkdownImageSource";
 import { enrichedContextLinkCustomization } from "../../native/useEnrichedLinkVariants";
@@ -1696,9 +1697,12 @@ export const ThreadFeed = memo(function ThreadFeed(props: ThreadFeedProps) {
     previousTextSize.current = workRowSizing.textSizeKey;
     listRef.current?.clearCaches({ mode: "sizes" });
   }, [workRowSizing.textSizeKey, listRef]);
-  const [viewportWidth, setViewportWidth] = useState(() =>
+  const settledPaneWidth = useWorkspaceSettledContentWidth();
+  const [measuredViewportWidth, setViewportWidth] = useState(() =>
     props.layoutVariant === "split" ? 0 : windowWidth,
   );
+  const viewportWidth =
+    settledPaneWidth !== null ? Math.round(settledPaneWidth) : measuredViewportWidth;
   const [viewportHeight, setViewportHeight] = useState(0);
   const [disclosureToggleSettling, setDisclosureToggleSettling] = useState(false);
   // LegendList's maintainScrollAtEnd alone re-pins the feed whenever the
@@ -2402,6 +2406,14 @@ export const ThreadFeed = memo(function ThreadFeed(props: ThreadFeedProps) {
     if (previousContentWidth.current === contentWidth) return;
     previousContentWidth.current = contentWidth;
     if (hasHtmlRenders) listRef.current?.clearCaches({ mode: "sizes" });
+    // A reflow can grow the visible rows past LegendList's near-end threshold in one batch, and
+    // maintainScrollAtEnd then stops following. Pin the end the feed was following once the new
+    // sizes are in.
+    if (!endFollowEnabledRef.current || !listRef.current?.getState().isAtEnd) return;
+    const frame = requestAnimationFrame(() => {
+      if (endFollowEnabledRef.current) void listRef.current?.scrollToEnd({ animated: false });
+    });
+    return () => cancelAnimationFrame(frame);
   }, [contentWidth, hasHtmlRenders, listRef]);
 
   const renderItem = (info: { item: PendingThreadFeedEntry; index: number }) => (
diff --git a/apps/mobile/src/features/threads/ThreadHeader.tsx b/apps/mobile/src/features/threads/ThreadHeader.tsx
index 62e98edc0076..acdbaea83efa 100644
--- a/apps/mobile/src/features/threads/ThreadHeader.tsx
+++ b/apps/mobile/src/features/threads/ThreadHeader.tsx
@@ -20,7 +20,8 @@ export function ThreadHeader(
   },
 ) {
   const goBack = useWorkspaceBackNavigation("threads");
-  const { layout, panes, toggleAuxiliaryPane } = useAdaptiveWorkspaceLayout();
+  const { layout, panes, toggleAuxiliaryPane, composerKeyboardActive } =
+    useAdaptiveWorkspaceLayout();
   const { onOpenTerminal, onMergeBack } = props.gitControls;
   const native = useThreadHeaderOptions(props);
   const androidHeaderActions = useMemo<ReadonlyArray<AppBarAction>>(() => {
@@ -100,6 +101,7 @@ export function ThreadHeader(
         onBack={layout.usesSplitView ? undefined : goBack}
         actions={androidHeaderActions}
         hideBottomBorder
+        compact={composerKeyboardActive}
       />
       {native.fallback}
     </>
diff --git a/apps/mobile/src/features/updates/app-updates.test.ts b/apps/mobile/src/features/updates/app-updates.test.ts
index e35f173a4729..d980164b32d3 100644
--- a/apps/mobile/src/features/updates/app-updates.test.ts
+++ b/apps/mobile/src/features/updates/app-updates.test.ts
@@ -1,7 +1,9 @@
+import { AppState } from "react-native";
 import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
   createAppUpdateDeferral,
+  createAppUpdateForegroundRecheck,
   createAppUpdateLaunchCheck,
   FOREGROUND_APP_UPDATE_RECHECK_AFTER_MS,
   registerHiddenUpdateTap,
@@ -19,6 +21,13 @@ vi.mock("expo-updates", () => ({
   reloadAsync: vi.fn(),
 }));
 
+vi.mock("react-native", () => ({
+  AppState: {
+    currentState: "active",
+    addEventListener: vi.fn(() => ({ remove: vi.fn() })),
+  },
+}));
+
 function makeUpdateClient(overrides: Partial<AppUpdateClient> = {}): AppUpdateClient {
   return {
     isEnabled: true,
@@ -640,3 +649,31 @@ describe("registerHiddenUpdateTap", () => {
     expect(count).toBe(0);
   });
 });
+
+describe("createAppUpdateForegroundRecheck", () => {
+  it("registers once and checks after returning from a long background stay", () => {
+    vi.stubGlobal("__DEV__", false);
+    const now = vi.spyOn(Date, "now");
+    const listener = vi.mocked(AppState.addEventListener);
+    listener.mockClear();
+    const client = makeUpdateClient();
+    const start = createAppUpdateForegroundRecheck(client, createAppUpdateDeferral());
+
+    try {
+      start();
+      start();
+      expect(listener).toHaveBeenCalledOnce();
+      const onChange = listener.mock.calls[0]![1];
+      now.mockReturnValue(1000);
+      onChange("background");
+      now.mockReturnValue(1000 + FOREGROUND_APP_UPDATE_RECHECK_AFTER_MS);
+      onChange("active");
+      expect(client.checkForUpdateAsync).toHaveBeenCalledOnce();
+      onChange("active");
+      expect(client.checkForUpdateAsync).toHaveBeenCalledOnce();
+    } finally {
+      now.mockRestore();
+      vi.unstubAllGlobals();
+    }
+  });
+});
diff --git a/apps/mobile/src/features/updates/app-updates.ts b/apps/mobile/src/features/updates/app-updates.ts
index 2cfe3aa7aebf..6390256108ec 100644
--- a/apps/mobile/src/features/updates/app-updates.ts
+++ b/apps/mobile/src/features/updates/app-updates.ts
@@ -1,4 +1,6 @@
 import * as Updates from "expo-updates";
+// Metro namespace imports evaluate unrelated React Native getters, including unavailable native modules.
+import { AppState } from "react-native";
 
 import {
   type AtomCommandResult,
@@ -418,22 +420,19 @@ async function defaultFlushPendingWrites(): Promise<void> {
 async function defaultIsSafeToRestartInBackground(): Promise<boolean> {
   const { isForegroundHandoffActive } = await import("../../lib/foreground-handoff");
   if (isForegroundHandoffActive()) return false;
-  const { AppState } = await import("react-native");
   return AppState.currentState === "background";
 }
 
 function defaultOnNextBackground(apply: () => void, includeCurrent: boolean): void {
-  void import("react-native").then(({ AppState }) => {
-    const subscription = AppState.addEventListener("change", (state) => {
-      if (state !== "background") return;
-      subscription.remove();
-      apply();
-    });
-    if (includeCurrent && AppState.currentState === "background") {
-      subscription.remove();
-      apply();
-    }
+  const subscription = AppState.addEventListener("change", (state) => {
+    if (state !== "background") return;
+    subscription.remove();
+    apply();
   });
+  if (includeCurrent && AppState.currentState === "background") {
+    subscription.remove();
+    apply();
+  }
 }
 
 export const DEFERRED_INSTALL_PROMPT_AFTER_MS = 30 * 60 * 1000;
@@ -443,25 +442,23 @@ export const DEFERRED_INSTALL_PROMPT_AFTER_MS = 30 * 60 * 1000;
  * the timer running.
  */
 function defaultOnForegroundStay(apply: () => void): void {
-  void import("react-native").then(({ AppState }) => {
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    const arm = () => {
-      timer ??= setTimeout(() => {
-        subscription.remove();
-        apply();
-      }, DEFERRED_INSTALL_PROMPT_AFTER_MS);
-    };
-    const disarm = () => {
-      if (timer === undefined) return;
-      clearTimeout(timer);
-      timer = undefined;
-    };
-    const subscription = AppState.addEventListener("change", (state) => {
-      if (state === "active") arm();
-      else if (state === "background") disarm();
-    });
-    if (AppState.currentState === "active") arm();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const arm = () => {
+    timer ??= setTimeout(() => {
+      subscription.remove();
+      apply();
+    }, DEFERRED_INSTALL_PROMPT_AFTER_MS);
+  };
+  const disarm = () => {
+    if (timer === undefined) return;
+    clearTimeout(timer);
+    timer = undefined;
+  };
+  const subscription = AppState.addEventListener("change", (state) => {
+    if (state === "active") arm();
+    else if (state === "background") disarm();
   });
+  if (AppState.currentState === "active") arm();
 }
 
 const defaultAppUpdateEnvironment: AppUpdateEnvironment = {
@@ -528,22 +525,20 @@ export function createAppUpdateForegroundRecheck(
   return () => {
     if (started || !isAppUpdateCheckAvailable(client)) return;
     started = true;
-    void import("react-native").then(({ AppState }) => {
-      let backgroundedAtMs: number | null = null;
-      AppState.addEventListener("change", (state) => {
-        if (state === "background") {
-          backgroundedAtMs = Date.now();
-          return;
-        }
-        if (state !== "active") return;
-        const shouldCheck = shouldRecheckAppUpdateOnForeground(
-          backgroundedAtMs,
-          Date.now(),
-          deferral.pendingInstall,
-        );
-        backgroundedAtMs = null;
-        if (shouldCheck) void runAppUpdateCheck({ client, deferral });
-      });
+    let backgroundedAtMs: number | null = null;
+    AppState.addEventListener("change", (state) => {
+      if (state === "background") {
+        backgroundedAtMs = Date.now();
+        return;
+      }
+      if (state !== "active") return;
+      const shouldCheck = shouldRecheckAppUpdateOnForeground(
+        backgroundedAtMs,
+        Date.now(),
+        deferral.pendingInstall,
+      );
+      backgroundedAtMs = null;
+      if (shouldCheck) void runAppUpdateCheck({ client, deferral });
     });
   };
 }
diff --git a/apps/mobile/src/features/usage/UsageLimitsPooled.tsx b/apps/mobile/src/features/usage/UsageLimitsPooled.tsx
index 9013a3dfcc9f..010c902364c4 100644
--- a/apps/mobile/src/features/usage/UsageLimitsPooled.tsx
+++ b/apps/mobile/src/features/usage/UsageLimitsPooled.tsx
@@ -41,6 +41,53 @@ function accountName(account: LimitAccount) {
   return `${local[0] ?? ""}${domain[0] ?? ""}`.toUpperCase() || "Account";
 }
 
+// Same gap-and-tick as the Limits rows: two clipped copies of the segment leave a see-through gap.
+function PaceGap({
+  timeLeft,
+  children,
+}: {
+  readonly timeLeft: number | null;
+  readonly children: ReactNode;
+}) {
+  const [width, setWidth] = useState(0);
+  const tickX =
+    timeLeft === null || width < 6
+      ? null
+      : Math.min(Math.max((width * timeLeft) / 100, 3), width - 3);
+  return (
+    <View
+      pointerEvents="none"
+      className="absolute inset-0"
+      onLayout={(event) => setWidth(event.nativeEvent.layout.width)}
+    >
+      {tickX === null
+        ? children
+        : (
+            [
+              [0, tickX - 3],
+              [tickX + 3, width],
+            ] as const
+          ).map(([start, end]) => (
+            <View
+              key={start}
+              className="absolute top-0 bottom-0 overflow-hidden"
+              style={{ left: start, width: end - start }}
+            >
+              <View className="absolute top-0 bottom-0" style={{ left: -start, width }}>
+                {children}
+              </View>
+            </View>
+          ))}
+      {tickX !== null ? (
+        <View
+          className="absolute top-0.5 bottom-0.5 w-0.5 rounded-full bg-foreground"
+          style={{ left: tickX - 1 }}
+        />
+      ) : null}
+    </View>
+  );
+}
+
 function AccountSegment({
   remaining,
   color,
@@ -155,22 +202,18 @@ function PoolWindowCard({
               accessibilityLabel={`Segment ${index + 1}, ${accountName(account)}, ${remainingPercent(window)}% left${timeLeft === null ? "" : `, ${timeLeft}% of the window left`}`}
               accessibilityHint="Show account details"
               onPress={() => openAccount(account)}
-              className="h-7 min-w-0 flex-1 rounded-md bg-subtle"
+              className="h-7 min-w-0 flex-1 rounded-md"
             >
-              <View className="absolute inset-0 overflow-hidden rounded-md">
-                <AccountSegment
-                  remaining={remainingPercent(window)}
-                  color={color}
-                  refillPercent={window.resetsAt ? member.refillPercent : 0}
-                />
-              </View>
-              {timeLeft !== null ? (
-                <View
-                  pointerEvents="none"
-                  className="absolute -top-1 -bottom-1 w-0.5 -translate-x-px rounded-full bg-foreground-muted"
-                  style={{ left: `${timeLeft}%` }}
-                />
-              ) : null}
+              <PaceGap timeLeft={timeLeft}>
+                <View className="absolute inset-0 rounded-md bg-subtle" />
+                <View className="absolute inset-0 overflow-hidden rounded-md">
+                  <AccountSegment
+                    remaining={remainingPercent(window)}
+                    color={color}
+                    refillPercent={window.resetsAt ? member.refillPercent : 0}
+                  />
+                </View>
+              </PaceGap>
               <View
                 pointerEvents="none"
                 className="absolute inset-0 items-center justify-center overflow-hidden rounded-md"
diff --git a/apps/mobile/src/features/usage/UsageLimitsSection.tsx b/apps/mobile/src/features/usage/UsageLimitsSection.tsx
index e5a16a8b75ff..c22496741d98 100644
--- a/apps/mobile/src/features/usage/UsageLimitsSection.tsx
+++ b/apps/mobile/src/features/usage/UsageLimitsSection.tsx
@@ -49,6 +49,32 @@ function WindowRow(props: {
   const timeLeft = paceRemainingPercent(window, now);
   const pace = paceOf(window, now);
   const resetsIn = formatResetsIn(window, now);
+  const [barWidth, setBarWidth] = useState(0);
+  const tickX =
+    timeLeft === null || barWidth < 6
+      ? null
+      : Math.min(Math.max((barWidth * timeLeft) / 100, 3), barWidth - 3);
+  const bar = (
+    <View
+      className="h-1.5 flex-row overflow-hidden rounded-full bg-subtle"
+      style={barWidth > 0 ? { width: barWidth } : undefined}
+    >
+      <View
+        className={
+          remaining <= 10
+            ? "h-full rounded-full bg-red-500"
+            : remaining <= 30
+              ? "h-full rounded-full bg-amber-500"
+              : "h-full rounded-full bg-foreground"
+        }
+        style={[
+          { flex: remaining },
+          remaining > 30 && props.color ? { backgroundColor: props.color } : null,
+        ]}
+      />
+      <View style={{ flex: 100 - remaining }} />
+    </View>
+  );
   return (
     <View className="gap-1">
       <View className="flex-row items-baseline justify-between gap-3">
@@ -57,27 +83,35 @@ function WindowRow(props: {
           {remaining}% left
         </Text>
       </View>
-      <View className="h-3 justify-center">
-        <View className="h-1.5 flex-row overflow-hidden rounded-full bg-subtle">
-          <View
-            className={
-              remaining <= 10
-                ? "h-full rounded-full bg-red-500"
-                : remaining <= 30
-                  ? "h-full rounded-full bg-amber-500"
-                  : "h-full rounded-full bg-foreground"
-            }
-            style={[
-              { flex: remaining },
-              remaining > 30 && props.color ? { backgroundColor: props.color } : null,
-            ]}
-          />
-          <View style={{ flex: 100 - remaining }} />
-        </View>
-        {timeLeft !== null ? (
+      <View
+        className="h-3 justify-center"
+        onLayout={(event) => setBarWidth(event.nativeEvent.layout.width)}
+      >
+        {tickX === null ? (
+          bar
+        ) : (
+          <View className="h-1.5">
+            {/* Clip the same full-width bar so neither fill proportions nor corner radii change. */}
+            {(
+              [
+                [0, tickX - 3],
+                [tickX + 3, barWidth],
+              ] as const
+            ).map(([start, end]) => (
+              <View
+                key={start}
+                className="absolute top-0 bottom-0 overflow-hidden"
+                style={{ left: start, width: end - start }}
+              >
+                <View style={{ marginLeft: -start }}>{bar}</View>
+              </View>
+            ))}
+          </View>
+        )}
+        {tickX !== null ? (
           <View
-            className="absolute top-0 bottom-0 w-px bg-foreground"
-            style={{ left: `${timeLeft}%`, opacity: 0.6 }}
+            className="absolute top-px bottom-px w-0.5 rounded-full bg-foreground"
+            style={{ left: tickX - 1 }}
           />
         ) : null}
       </View>
diff --git a/apps/mobile/src/native/NativeHeaderToolbar.test.tsx b/apps/mobile/src/native/NativeHeaderToolbar.test.tsx
index 41d8777f6dfb..9dba4f4a4f88 100644
--- a/apps/mobile/src/native/NativeHeaderToolbar.test.tsx
+++ b/apps/mobile/src/native/NativeHeaderToolbar.test.tsx
@@ -1,5 +1,5 @@
 import type { NativeStackHeaderItem } from "@react-navigation/native-stack";
-import { act } from "react";
+import { act, createContext, type ReactElement } from "react";
 import { createRoot, type Root } from "react-dom/client";
 import { afterEach, expect, it, vi } from "vite-plus/test";
 
@@ -56,6 +56,43 @@ function renderDocument(path: string, placement: Placement) {
   act(() => root!.render(<DocumentToolbar path={path} placement={placement} />));
 }
 
+// Like React Navigation's NavigationStateContext, whose default value throws when
+// read. React restores a context's default outside render, so layout effects see it.
+const ContainerStateContext = createContext<object>({
+  get getIsInitial(): never {
+    throw new Error("Couldn't find a navigation context.");
+  },
+});
+const containerState = {};
+
+function ConnectingToolbar(props: { readonly label: string }) {
+  return (
+    <NativeHeaderToolbar placement="right">
+      <NativeHeaderToolbar.Custom>
+        <span aria-label={props.label} />
+      </NativeHeaderToolbar.Custom>
+    </NativeHeaderToolbar>
+  );
+}
+
+function renderConnecting(label: string) {
+  vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
+  root ??= createRoot(document.createElement("div"));
+  act(() =>
+    root!.render(
+      <ContainerStateContext value={containerState}>
+        <ConnectingToolbar label={label} />
+      </ContainerStateContext>,
+    ),
+  );
+}
+
+function renderedCustomLabel() {
+  const item = harness.renderedItems[0];
+  if (item?.type !== "custom") throw new Error("Expected the custom header element");
+  return (item.element as ReactElement<{ "aria-label": string }>).props["aria-label"];
+}
+
 function openRenderedDocument() {
   const menu = harness.renderedItems[0];
   if (menu?.type !== "menu") throw new Error("Expected the native file menu");
@@ -98,3 +135,15 @@ it.each(["left", "right", "bottom"] as const)(
     expect(harness.openedDocuments).toEqual(["first/guide.pdf"]);
   },
 );
+
+it("applies a custom header element rendered inside a navigation container", () => {
+  renderConnecting("Connecting");
+  expect(renderedCustomLabel()).toBe("Connecting");
+
+  const applied = harness.setOptionsCalls;
+  renderConnecting("Connecting");
+  expect(harness.setOptionsCalls).toBe(applied);
+
+  renderConnecting("Reconnecting");
+  expect(renderedCustomLabel()).toBe("Reconnecting");
+});
diff --git a/apps/mobile/src/native/StackHeader.tsx b/apps/mobile/src/native/StackHeader.tsx
index 8240fbc74df4..698a345035cc 100644
--- a/apps/mobile/src/native/StackHeader.tsx
+++ b/apps/mobile/src/native/StackHeader.tsx
@@ -4,7 +4,7 @@ import type {
   NativeStackNavigationOptions,
   NativeStackNavigationProp,
 } from "@react-navigation/native-stack";
-import { use, useEffect, useLayoutEffect, useMemo, useRef } from "react";
+import { isValidElement, use, useEffect, useLayoutEffect, useMemo, useRef } from "react";
 import { NativeWorkspaceTabActivityContext } from "./v5-workspace-context";
 import type { ColorValue } from "react-native";
 
@@ -55,6 +55,29 @@ function normalizeScreenOptions(
   return normalized as NativeStackNavigationOptions;
 }
 
+// React tags elements, component types and contexts with `$$typeof`; their other
+// fields are React internals. In development an element's `_owner` is a fiber that
+// reaches the whole tree, including contexts that hold their default value outside
+// render, and React Navigation's NavigationStateContext default throws when read.
+function isReactObject(value: object): boolean {
+  return "$$typeof" in value;
+}
+
+const identityIds = new WeakMap<object, number>();
+let nextIdentityId = 0;
+
+function identitySignature(value: unknown): string {
+  if (value === null || (typeof value !== "object" && typeof value !== "function")) {
+    return String(value);
+  }
+  let id = identityIds.get(value);
+  if (id === undefined) {
+    id = nextIdentityId++;
+    identityIds.set(value, id);
+  }
+  return `identity:${id}`;
+}
+
 function optionsSignature(value: unknown, seen = new WeakSet<object>()): string {
   if (value === null) return "null";
   switch (typeof value) {
@@ -75,6 +98,11 @@ function optionsSignature(value: unknown, seen = new WeakSet<object>()): string
       return `bigint:${String(value)}`;
     case "object": {
       const object = value as object;
+      if (isValidElement(object)) {
+        // Elements are recreated on every render, so compare what they render.
+        return `element:${identitySignature(object.type)}:${String(object.key)}:${optionsSignature(object.props, seen)}`;
+      }
+      if (isReactObject(object)) return identitySignature(object);
       if (seen.has(object)) return "[circular]";
       seen.add(object);
       if (Array.isArray(value)) {
@@ -121,7 +149,7 @@ function stabilizeOptionFunctions(
     );
   }
   if (value !== null && typeof value === "object") {
-    if (seen.has(value) || "current" in value) return value;
+    if (seen.has(value) || "current" in value || isReactObject(value)) return value;
     seen.add(value);
     return Object.fromEntries(
       Object.entries(value as Record<string, unknown>).map(([key, entry]) => [
diff --git a/apps/mobile/src/native/T3ComposerEditor.ios.tsx b/apps/mobile/src/native/T3ComposerEditor.ios.tsx
index f2d2699f7a89..dfbfff192171 100644
--- a/apps/mobile/src/native/T3ComposerEditor.ios.tsx
+++ b/apps/mobile/src/native/T3ComposerEditor.ios.tsx
@@ -99,6 +99,9 @@ interface NativeComposerEditorProps extends ViewProps {
   readonly onComposerFocus?: () => void;
   readonly onComposerBlur?: () => void;
   readonly onComposerSubmit?: (event: NativeSyntheticEvent<{ alternate: boolean }>) => void;
+  readonly onComposerContentSizeChange?: (
+    event: NativeSyntheticEvent<{ readonly width: number; readonly height: number }>,
+  ) => void;
 }
 
 const NativeView = requireNativeView<NativeComposerEditorProps>(NATIVE_MODULE_NAME);
@@ -125,6 +128,7 @@ export function ComposerEditor({
   onFocus,
   onBlur,
   onSubmit,
+  onContentSizeChange,
   contentInsetVertical = 0,
   ...props
 }: ComposerEditorProps) {
@@ -349,6 +353,11 @@ export function ComposerEditor({
       }}
       onComposerFocus={onFocus}
       onComposerBlur={onBlur}
+      onComposerContentSizeChange={
+        onContentSizeChange === undefined
+          ? undefined
+          : (event) => onContentSizeChange(event.nativeEvent)
+      }
       onComposerSubmit={
         onSubmit === undefined
           ? undefined
diff --git a/apps/mobile/src/native/T3ComposerEditor.native.tsx b/apps/mobile/src/native/T3ComposerEditor.native.tsx
index dce1589439ad..732df5f8f2e3 100644
--- a/apps/mobile/src/native/T3ComposerEditor.native.tsx
+++ b/apps/mobile/src/native/T3ComposerEditor.native.tsx
@@ -98,6 +98,9 @@ interface NativeComposerEditorProps extends ViewProps {
   readonly onComposerPasteText?: (event: NativePasteTextEvent) => void;
   readonly onComposerFocus?: () => void;
   readonly onComposerBlur?: () => void;
+  readonly onComposerContentSizeChange?: (
+    event: NativeSyntheticEvent<{ readonly width: number; readonly height: number }>,
+  ) => void;
 }
 
 const NativeView = requireNativeView<NativeComposerEditorProps>(NATIVE_MODULE_NAME);
@@ -123,6 +126,7 @@ export function ComposerEditor({
   onPasteText,
   onFocus,
   onBlur,
+  onContentSizeChange,
   contentInsetVertical = 0,
   ...props
 }: ComposerEditorProps) {
@@ -354,6 +358,11 @@ export function ComposerEditor({
         }}
         onComposerFocus={onFocus}
         onComposerBlur={onBlur}
+        onComposerContentSizeChange={
+          onContentSizeChange === undefined
+            ? undefined
+            : (event) => onContentSizeChange(event.nativeEvent)
+        }
       />
     </TextInputWrapper>
   );
diff --git a/apps/mobile/src/native/T3ComposerEditor.tsx b/apps/mobile/src/native/T3ComposerEditor.tsx
index 20554b4f1eb0..d621deb3c6ac 100644
--- a/apps/mobile/src/native/T3ComposerEditor.tsx
+++ b/apps/mobile/src/native/T3ComposerEditor.tsx
@@ -19,6 +19,7 @@ export function ComposerEditor({
   singleLineCentered: _singleLineCentered,
   enterBehavior: _enterBehavior,
   readOnly = false,
+  onContentSizeChange,
   ...props
 }: ComposerEditorProps) {
   const inputRef = useRef<TextInputInstance>(null);
@@ -45,6 +46,7 @@ export function ComposerEditor({
         editable={(props.editable ?? true) && !readOnly}
         selection={selection}
         onSelectionChange={(event) => props.onSelectionChange?.(event.nativeEvent.selection)}
+        onContentSizeChange={(event) => onContentSizeChange?.(event.nativeEvent.contentSize)}
         multiline={props.multiline ?? true}
         placeholderTextColorClassName={"accent-placeholder"}
         className="text-foreground"
diff --git a/apps/mobile/src/native/T3ComposerEditor.types.ts b/apps/mobile/src/native/T3ComposerEditor.types.ts
index 4e2ddd178b06..95726c9f8ba9 100644
--- a/apps/mobile/src/native/T3ComposerEditor.types.ts
+++ b/apps/mobile/src/native/T3ComposerEditor.types.ts
@@ -68,6 +68,14 @@ export interface ComposerEditorProps {
   readonly onPasteText?: (paste: ComposerTextPaste) => void;
   readonly onFocus?: () => void;
   readonly onBlur?: () => void;
+  /**
+   * Size of the laid-out text in dp, without insets. Width is the widest line, so a
+   * one-line draft reports its natural width; only fires when the size changes.
+   */
+  readonly onContentSizeChange?: (size: {
+    readonly width: number;
+    readonly height: number;
+  }) => void;
   /**
    * Hardware-keyboard Return behavior on iOS. No-op on Android, which has no
    * hardware Return handling.
diff --git a/apps/mobile/src/native/workspace-stack-projection.test.ts b/apps/mobile/src/native/workspace-stack-projection.test.ts
index e813c48faa6b..99901652473d 100644
--- a/apps/mobile/src/native/workspace-stack-projection.test.ts
+++ b/apps/mobile/src/native/workspace-stack-projection.test.ts
@@ -3,12 +3,14 @@ import type { ParamListBase, StackNavigationState } from "@react-navigation/nati
 import { describe, expect, it } from "vite-plus/test";
 
 import {
+  collapsedSplitTransition,
   nativeStackPopAction,
   nativeWorkspacePopAction,
   nativeWorkspacePopCount,
   projectWorkspaceStack,
   partitionStackPresentations,
   reconcileStackScreens,
+  type CollapsedSplitColumn,
 } from "./workspace-stack-projection";
 
 const requireNavigation = NodeModule.createRequire(
@@ -185,6 +187,111 @@ describe("native card pop handoff", () => {
   });
 });
 
+describe("collapsed split Back", () => {
+  const routerOptions = {
+    routeNames: history([home]).routeNames,
+    routeParamList: {},
+    routeGetIdList: {},
+  };
+  type Appearance = "willAppear" | "didAppear" | "willDisappear";
+  // UIKit's appearance callbacks for one collapsed transition, against the router at each step.
+  function replay(
+    steps: ReadonlyArray<readonly [Appearance, string, StackNavigationState<ParamListBase>]>,
+  ) {
+    let column: CollapsedSplitColumn = { visible: "secondary", leaving: null };
+    let pop: ReturnType<typeof nativeStackPopAction> = null;
+    for (const [type, key, state] of steps) {
+      const transition = collapsedSplitTransition(column, { type, key }, state, home.key);
+      column = transition.column;
+      pop ??= transition.pop;
+    }
+    return { visible: column.visible, pop };
+  }
+
+  it("returns the router to the list so the next selection opens a new detail", () => {
+    const state = history([home, thread]);
+    const back = replay([
+      ["willDisappear", thread.key, state],
+      ["willAppear", home.key, state],
+      ["didAppear", home.key, state],
+    ]);
+    expect(back.visible).toBe("primary");
+    const router = StackRouter({});
+    const listed = router.getStateForAction(state, back.pop!, routerOptions);
+    expect(listed?.routes).toEqual([home]);
+    if (!listed || listed.stale !== false) throw new Error("Expected a rehydrated router history");
+    const select = {
+      type: "NAVIGATE",
+      payload: { name: "Thread", params: { threadId: "next" } },
+    } as const;
+    expect(router.getStateForAction(listed, select, routerOptions)?.routes[1]?.key).not.toBe(
+      thread.key,
+    );
+    // Left on the hidden detail, the selection would only rename it and never show the column.
+    expect(router.getStateForAction(state, select, routerOptions)?.routes[1]?.key).toBe(thread.key);
+  });
+
+  it("clears every detail while keeping a presentation opened during the Back animation", () => {
+    const leaving = history([home, thread, files]);
+    const presented = history([home, thread, files, settings]);
+    const { pop } = replay([
+      ["willDisappear", files.key, leaving],
+      ["didAppear", home.key, presented],
+    ]);
+    expect(StackRouter({}).getStateForAction(presented, pop!, routerOptions)?.routes).toEqual([
+      home,
+      settings,
+    ]);
+  });
+
+  it("keeps the detail when it appears again before the list finishes appearing", () => {
+    const state = history([home, thread]);
+    const cancelledSwipe = replay([
+      ["willDisappear", thread.key, state],
+      ["willAppear", home.key, state],
+      ["willAppear", thread.key, state],
+      ["didAppear", thread.key, state],
+    ]);
+    expect(cancelledSwipe).toEqual({ visible: "secondary", pop: null });
+    expect(
+      replay([
+        ["willDisappear", thread.key, state],
+        ["willAppear", thread.key, state],
+        ["didAppear", home.key, state],
+      ]).pop,
+    ).toBeNull();
+  });
+
+  it("does not mistake JS navigation or a cold link for native Back", () => {
+    const pushed = history([home, thread, files]);
+    expect(
+      replay([
+        ["willDisappear", thread.key, pushed],
+        ["didAppear", files.key, pushed],
+      ]),
+    ).toEqual({ visible: "secondary", pop: null });
+    const presented = history([home, thread, settings]);
+    expect(
+      replay([
+        ["willDisappear", thread.key, presented],
+        ["didAppear", home.key, presented],
+      ]).pop,
+    ).toBeNull();
+    const popped = history([home]);
+    expect(
+      replay([
+        ["willDisappear", thread.key, popped],
+        ["didAppear", home.key, popped],
+      ]).pop,
+    ).toBeNull();
+    // A linked thread whose list appears first still needs its detail column shown.
+    expect(replay([["didAppear", home.key, history([home, thread])]])).toEqual({
+      visible: "primary",
+      pop: null,
+    });
+  });
+});
+
 describe("v5 stack handoff", () => {
   it("releases a completed native pop when the router acknowledges it", () => {
     const completed = new Set([files.key]);
diff --git a/apps/mobile/src/native/workspace-stack-projection.ts b/apps/mobile/src/native/workspace-stack-projection.ts
index 2d6afae419ee..71ebec0ed9c2 100644
--- a/apps/mobile/src/native/workspace-stack-projection.ts
+++ b/apps/mobile/src/native/workspace-stack-projection.ts
@@ -70,6 +70,53 @@ export function nativeStackPopAction(
   };
 }
 
+/** The column UIKit shows while a split is collapsed, and the active detail it began removing. */
+export interface CollapsedSplitColumn {
+  readonly visible: "primary" | "secondary";
+  readonly leaving: string | null;
+}
+
+/**
+ * A collapsed split nests the detail column's navigation controller in the list column's. Back
+ * from the detail root pops that controller whole, so no screen leaves its own stack or reports a
+ * dismissal: the list appearing after the active detail began leaving is the only sign of it.
+ */
+export function collapsedSplitTransition(
+  column: CollapsedSplitColumn,
+  event: { readonly type: "willAppear" | "didAppear" | "willDisappear"; readonly key: string },
+  state: Pick<NavigationState, "key" | "index" | "routes">,
+  primaryKey: string,
+): {
+  readonly column: CollapsedSplitColumn;
+  readonly pop: ReturnType<typeof nativeStackPopAction>;
+} {
+  switch (event.type) {
+    case "willDisappear":
+      // JS pushes, pops, and presentations have already moved the router past this screen.
+      return {
+        column:
+          state.index > 0 && state.routes[state.index]?.key === event.key
+            ? { ...column, leaving: event.key }
+            : column,
+        pop: null,
+      };
+    case "willAppear":
+      // A cancelled swipe, or an expansion that keeps the detail on screen.
+      return {
+        column: column.leaving === event.key ? { ...column, leaving: null } : column,
+        pop: null,
+      };
+    case "didAppear":
+      return {
+        column: { visible: event.key === primaryKey ? "primary" : "secondary", leaving: null },
+        pop:
+          event.key === primaryKey && column.leaving
+            ? nativeStackPopAction(state, column.leaving, primaryKey)
+            : null,
+      };
+  }
+}
+
 export function partitionStackPresentations<T>(
   routes: readonly T[],
   isModal: (route: T) => boolean,
diff --git a/apps/server/integration/transferBudgetV2.integration.test.ts b/apps/server/integration/transferBudgetV2.integration.test.ts
index 0ec8b1c37b29..b4dd358c17b1 100644
--- a/apps/server/integration/transferBudgetV2.integration.test.ts
+++ b/apps/server/integration/transferBudgetV2.integration.test.ts
@@ -1,5 +1,6 @@
 // @effect-diagnostics nodeBuiltinImport:off - Measures real local HTTP/WebSocket sockets.
 import * as NodeHttp from "node:http";
+import * as NodeUtil from "node:util";
 import { assert, it } from "@effect/vitest";
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";
@@ -299,9 +300,16 @@ it.live(
             const events = turnEvents(provider, TRANSFER_HISTORY_TURN_COUNT, true);
             const stored = yield* sink.write({ events });
             const last = stored.at(-1)!;
-            const terminal = (item: StreamItem) =>
+            const threadTerminal = (item: StreamItem) =>
               "sequence" in item && item.sequence >= last.sequence;
-            for (const queue of [tq, sq, ttq, ssq]) yield* collectUntil(queue, terminal);
+            // Shell items carry the shell read when their batch is projected, and unchanged
+            // shells are skipped, so a turn split across batches may never yield an item at
+            // the last sequence. Wait for the final shell instead.
+            const finalShell = yield* projection.getThreadShell(THREAD_ID);
+            const shellTerminal = (item: StreamItem) =>
+              item.kind === "thread.updated" && NodeUtil.isDeepStrictEqual(item.thread, finalShell);
+            for (const queue of [tq, ttq]) yield* collectUntil(queue, threadTerminal);
+            for (const queue of [sq, ssq]) yield* collectUntil(queue, shellTerminal);
             const measuredTurnWebSocket = difference(thread.recorder.totals(), threadBefore);
             const measuredTurnShellWebSocket = difference(shell.recorder.totals(), shellBefore);
             const measuredTurnSecondClientWebSocket = difference(
diff --git a/apps/server/scripts/acp-mock-agent.ts b/apps/server/scripts/acp-mock-agent.ts
index c2d29e98047e..ae06aba0355d 100644
--- a/apps/server/scripts/acp-mock-agent.ts
+++ b/apps/server/scripts/acp-mock-agent.ts
@@ -1383,6 +1383,7 @@ const program = Effect.gen(function* () {
         (emitRunningCommandThenHangOnFirstPrompt && promptCount === 1)
       ) {
         const toolCallId = "tool-call-running-1";
+        let runningCommandPublished: Promise<void> = Promise.resolve();
         if (runningCommandPidPath !== undefined) {
           const command = runningCommandIgnoresTerm
             ? 'trap "" TERM; bash -c \'trap "" TERM; while :; do sleep 1; done\' & child=$!; printf "%s %s\n" "$$" "$child" > "$1"; wait "$child"'
@@ -1390,19 +1391,24 @@ const program = Effect.gen(function* () {
           if (runningCommandSeparateSession) {
             const launcher = [
               'const { spawn } = require("node:child_process");',
-              "const child = spawn(process.argv[1], process.argv.slice(2), { stdio: 'ignore' });",
+              "const child = spawn(process.argv[1], process.argv.slice(2), { stdio: ['ignore', 'inherit', 'ignore'] });",
               "child.once('exit', (code, signal) => process.exitCode = code ?? (signal ? 1 : 0));",
             ].join(" ");
             const detachedCommand = runningCommandIgnoresTerm
-              ? 'trap "" TERM; bash -c \'trap "" TERM; while :; do sleep 1; done\' & child=$!; printf "%s %s %s\n" "$PPID" "$$" "$child" > "$1"; wait "$child"'
-              : 'sleep 120 & child=$!; printf "%s %s %s\n" "$PPID" "$$" "$child" > "$1"; wait "$child"';
+              ? 'trap "" TERM; bash -c \'trap "" TERM; while :; do sleep 1; done\' & child=$!; printf "%s %s %s\n" "$PPID" "$$" "$child" > "$1"; echo published; wait "$child"'
+              : 'sleep 120 & child=$!; printf "%s %s %s\n" "$PPID" "$$" "$child" > "$1"; echo published; wait "$child"';
             // Nested bash publishes "$PPID $$ $child" once it starts. Do not
             // write the launcher PID alone here: that races with bash and can
-            // clobber the triple that interrupt tests wait for.
+            // clobber the triple that interrupt tests wait for. It then prints a
+            // line, so an agent that exits after launch only exits once the
+            // triple exists instead of racing a slow launcher start.
             const detachedLauncher = NodeChildProcess.spawn(
               process.execPath,
               ["-e", launcher, "bash", "-c", detachedCommand, "bash", runningCommandPidPath],
-              { detached: true, stdio: "ignore" },
+              { detached: true, stdio: ["ignore", "pipe", "ignore"] },
+            );
+            runningCommandPublished = new Promise((resolve) =>
+              detachedLauncher.stdout.once("data", () => resolve()),
             );
             detachedLauncher.unref();
           } else {
@@ -1460,6 +1466,7 @@ const program = Effect.gen(function* () {
           },
         });
         if (exitAfterRunningCommandLaunch) {
+          yield* Effect.promise(() => runningCommandPublished);
           yield* Effect.sleep("100 millis");
           return yield* Effect.sync(() => process.exit(0));
         }
diff --git a/apps/server/src/mcp/toolkits/orchestrator/tools.ts b/apps/server/src/mcp/toolkits/orchestrator/tools.ts
index db291aac7b74..91187bc2a131 100644
--- a/apps/server/src/mcp/toolkits/orchestrator/tools.ts
+++ b/apps/server/src/mcp/toolkits/orchestrator/tools.ts
@@ -116,7 +116,7 @@ const WorkflowStopTool = Tool.make("t3_workflow_stop", {
 
 export const ScheduleTaskTool = Tool.make("schedule_task", {
   description:
-    "Create persistent work in the app scheduler that runs even when no turn is active. Pass schedule as a STRUCTURED OBJECT, never JSON text. Timers: {type:'interval', everyMs:3600000} is hourly; {type:'fixed_time', timeOfDay:'09:00', weekdays:[1,2,3,4,5]} is weekday mornings; report the returned nextRunAt. Webhooks: {type:'webhook'} runs once per request to a generated URL. The run sees the request ONLY through prompt placeholders: {{body.path}} (e.g. {{body.action}}, {{body.release.tag_name}}), {{headers.name}}, {{query.name}}, {{body}}, or {{request}} (method, headers with credentials redacted, and body). Each value arrives framed as untrusted request data, and $skill, @file or /command mentions inside it do not act; without a signature, anyone with the URL can trigger a run. For a sender that signs requests, first call request_secret so the user enters the secret privately (never ask for it in chat or invent one), then set signature with the returned secretRef, e.g. GitHub: {type:'webhook', signature:{header:'x-hub-signature-256', encoding:'hex', prefix:'sha256=', secretRef}}. The result's webhookUrl is the public URL to give the user; if it is absent, this environment has no T3 Connect managed tunnel, so tell the user to enable T3 Connect remote access rather than sharing a path. Omit projectId for this thread's project. In this thread's project, runs post into THIS thread by default (bindToCurrentThread=true), which suits an orchestrator that sees every trigger, delegates work, and can dedupe against what is in flight; use false only when the user wants a fresh top-level thread per run. Elsewhere each run launches a fresh thread. Provider, model, and runtime settings inherit from this thread, or from the project default when there is no calling thread.",
+    "Create persistent work in the app scheduler that runs even when no turn is active. Pass schedule as a STRUCTURED OBJECT, never JSON text. Timers: {type:'interval', everyMs:3600000} is hourly; {type:'fixed_time', timeOfDay:'09:00', weekdays:[1,2,3,4,5]} is weekday mornings; report the returned nextRunAt. Webhook dedupe accepts replayKey and coalesceKey templates with coalesceWindowSeconds (10–3600, default 120); replay keys expire after 7 days and coalescing keeps the latest payload in a window measured from its first delivery. Webhooks: {type:'webhook'} runs once per request to a generated URL. The run sees the request ONLY through prompt placeholders: {{body.path}} (e.g. {{body.action}}, {{body.release.tag_name}}), {{headers.name}}, {{query.name}}, {{body}}, or {{request}} (method, headers with credentials redacted, and body). Each value arrives framed as untrusted request data, and $skill, @file or /command mentions inside it do not act; without a signature, anyone with the URL can trigger a run. For a sender that signs requests, first call request_secret so the user enters the secret privately (never ask for it in chat or invent one), then set signature with the returned secretRef, e.g. GitHub: {type:'webhook', signature:{header:'x-hub-signature-256', encoding:'hex', prefix:'sha256=', secretRef}}. To run only for some requests, add filters, all of which must match, e.g. filters:[{path:'headers.x-github-event', op:'equals', value:'pull_request'}, {path:'body.action', op:'in', value:['opened','reopened']}]; ops are equals, notEquals, in, startsWith and exists. The result's webhookUrl is the public URL to give the user; if it is absent, this environment has no T3 Connect managed tunnel, so tell the user to enable T3 Connect remote access rather than sharing a path. Omit projectId for this thread's project. In this thread's project, runs post into THIS thread by default (bindToCurrentThread=true), which suits an orchestrator that sees every trigger, delegates work, and can dedupe against what is in flight; use false only when the user wants a fresh top-level thread per run. Elsewhere each run launches a fresh thread. Provider, model, and runtime settings inherit from this thread, or from the project default when there is no calling thread.",
   parameters: OrchestratorMcpScheduleTaskInput,
   success: OrchestratorMcpScheduleTaskResult,
   failure: OrchestratorMcpFailure,
@@ -143,7 +143,7 @@ const ListScheduledTasksTool = Tool.make("list_scheduled_tasks", {
 
 const UpdateScheduledTaskTool = Tool.make("update_scheduled_task", {
   description:
-    "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Only the provided fields change; omit a field to leave it as-is. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run.",
+    "Update an existing scheduled task by scheduledTaskId (from list_scheduled_tasks). Webhook schedule dedupe accepts replayKey, coalesceKey, and coalesceWindowSeconds (10–3600, default 120) to suppress replays for 7 days and retain the latest payload in each fixed window. Only the provided fields change; omit a field to leave it as-is. Use enabled=false to pause a task without deleting it. Set bindToCurrentThread to move the task between posting into this thread and launching a fresh thread per run. A webhook schedule without filters keeps the stored filters; pass filters to replace them, or filters:[] to clear them.",
   parameters: OrchestratorMcpUpdateScheduledTaskInput,
   success: OrchestratorMcpScheduleTaskResult,
   failure: OrchestratorMcpFailure,
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index cc6fc02e113d..1e4c0689d67d 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -17528,10 +17528,13 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           const NESTED_TOOL_USE_ID = "toolu-steer-nested";
           const FINISHED_TOOL_USE_ID = "toolu-steer-finished";
           const calls: Array<string> = [];
+          const backgroundRequested = yield* Deferred.make<void>();
           let beforeAnswer: Effect.Effect<void> = Effect.void;
+          const lateAnswer = yield* Deferred.make<void>();
           const harness = yield* makeWakeHarnessWithOptions({
             backgroundTasks: (toolUseId) =>
               Effect.sync(() => calls.push(toolUseId)).pipe(
+                Effect.andThen(Deferred.succeed(backgroundRequested, undefined)),
                 Effect.andThen(
                   backgrounding === "answers after the turn ended" ||
                     backgrounding === "answers after the subagent ran again"
@@ -17546,7 +17549,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
                       : backgrounding === "never answers"
                         ? Effect.never
                         : backgrounding === "answers after the steer went out"
-                          ? Effect.sleep("6 seconds").pipe(Effect.as(true))
+                          ? Deferred.await(lateAnswer).pipe(Effect.as(true))
                           : Effect.succeed(true),
                 ),
               ),
@@ -17699,12 +17702,15 @@ describe("ClaudeAdapterV2 background wake turns", () => {
                 ),
               );
           }
-          const steering = yield* Effect.forkScoped(steer);
+          // Started at once so the steer reads its backgrounding deadline before
+          // this test moves the clock. Its message is built with real file I/O,
+          // so a scheduled start could read the clock after the moves below.
+          const steering = yield* Effect.forkScoped(steer, { startImmediately: true });
           if (
             backgrounding === "never answers" ||
             backgrounding === "answers after the steer went out"
           ) {
-            yield* awaitUntil(() => calls.length === 1, "background request");
+            yield* Deferred.await(backgroundRequested);
             assert.equal(harness.offeredMessages.length, offered);
             yield* TestClock.adjust("5 seconds");
           }
@@ -17721,18 +17727,15 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           assert.equal(harness.offeredMessages.at(-1)?.priority, "now");
           if (backgrounding === "never answers") {
             for (let repeat = 1; repeat <= 2; repeat++) {
-              const again = yield* Effect.forkScoped(steer);
-              for (let tick = 0; tick < 100 && again.pollUnsafe() === undefined; tick++) {
-                yield* TestClock.adjust("1 second");
-                yield* Effect.yieldNow;
-              }
+              const again = yield* Effect.forkScoped(steer, { startImmediately: true });
+              yield* TestClock.adjust("5 seconds");
               assert.isTrue(Exit.isSuccess(yield* Fiber.await(again)));
               assert.equal(harness.offeredMessages.length, offered + 1 + repeat);
             }
             assert.deepEqual(calls, [FOREGROUND_TOOL_USE_ID]);
           }
           if (backgrounding === "answers after the steer went out") {
-            yield* TestClock.adjust("1 second");
+            yield* Deferred.succeed(lateAnswer, undefined);
           } else if (
             backgrounding !== "succeeds" &&
             backgrounding !== "answers after the subagent ran again"
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index a8e58816619a..2396e61e2232 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -97,6 +97,7 @@ import {
 } from "@t3tools/contracts";
 
 import * as Cause from "effect/Cause";
+import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
@@ -305,6 +306,9 @@ const CLAUDE_WAKE_TURN_START_DEADLINE = "2 minutes";
 // reply can land after the progress frame that settles it. Its transcript
 // stays the source of its answer this long after it settles.
 const WORKFLOW_MEMBER_TRANSCRIPT_FLUSH_MS = 500;
+// A steer waits at most this long, from its request, for its foreground
+// subagents to move to the background before it is sent.
+const BACKGROUND_MOVE_TIMEOUT_MS = 5_000;
 
 /**
  * When the CLI exits it stops the MCP servers it started, but not their children: a plugin's
@@ -9798,6 +9802,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
         // its result arrives as a task notification like any background agent.
         const backgroundForegroundSubagents = Effect.fnUntraced(function* (
           live: ClaudeLiveQueryContext,
+          deadline: number,
         ) {
           const foreground: Array<{
             readonly taskId: string;
@@ -9853,11 +9858,17 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
             backgroundMovesByToolUseId.set(toolUseId, move);
             moves.push(move);
           }
-          yield* Fiber.joinAll(moves).pipe(Effect.timeoutOption("5 seconds"));
+          const remaining = deadline - (yield* Clock.currentTimeMillis);
+          yield* Fiber.joinAll(moves).pipe(Effect.timeoutOption(Math.max(0, remaining)));
         });
 
         const steerTurn = Effect.fn("ClaudeAdapterV2.steerTurn")(
           function* (turnInput: ProviderAdapter.ProviderAdapterV2SteerInput) {
+            // Measured from the request, not from when the moves are forked:
+            // building the message and the moves can take clock time a timer
+            // started later would not count, and the steer would wait past it.
+            const backgroundDeadline =
+              (yield* Clock.currentTimeMillis) + BACKGROUND_MOVE_TIMEOUT_MS;
             const existing = yield* Ref.get(queryContext);
             if (existing === null) {
               return yield* new ProviderAdapter.ProviderAdapterProtocolError({
@@ -9883,7 +9894,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
               fileSystem,
               skills: yield* userInvocableSkills(currentTurn.input.runtimePolicy.cwd),
             });
-            yield* backgroundForegroundSubagents(existing);
+            yield* backgroundForegroundSubagents(existing, backgroundDeadline);
             // The turn can end while the moves are answered. A steer offered
             // then would start a new turn the orchestrator never asked for, so
             // the steer fails and the orchestrator starts the follow-up turn.
diff --git a/apps/server/src/persistence/Migrations.ts b/apps/server/src/persistence/Migrations.ts
index 9a0dff477368..8dfbfe712a7d 100644
--- a/apps/server/src/persistence/Migrations.ts
+++ b/apps/server/src/persistence/Migrations.ts
@@ -69,6 +69,7 @@ import Migration0063 from "./Migrations/063_DropUnusedV1Projections.ts";
 import Migration0064 from "./Migrations/064_CanonicalizeThreadPullRequestLinks.ts";
 import Migration0065 from "./Migrations/065_CodexUsageNativeTurnIndex.ts";
 import Migration0066 from "./Migrations/066_RepairClientSettlementTimestamps.ts";
+import Migration0067 from "./Migrations/067_WebhookDedupe.ts";
 
 export const migrationEntries = [
   [1, "OrchestrationEvents", Migration0001],
@@ -138,6 +139,7 @@ export const migrationEntries = [
   [64, "CanonicalizeThreadPullRequestLinks", Migration0064],
   [65, "CodexUsageNativeTurnIndex", Migration0065],
   [66, "RepairClientSettlementTimestamps", Migration0066],
+  [67, "WebhookDedupe", Migration0067],
 ] as const;
 
 export const migrationManifest = migrationEntries.map(([id, name]) => [id, name] as const);
diff --git a/apps/server/src/persistence/Migrations/055_OrchestrationV2.test.ts b/apps/server/src/persistence/Migrations/055_OrchestrationV2.test.ts
index cd926c899d97..5bbf3cd9a7e6 100644
--- a/apps/server/src/persistence/Migrations/055_OrchestrationV2.test.ts
+++ b/apps/server/src/persistence/Migrations/055_OrchestrationV2.test.ts
@@ -15,7 +15,7 @@ layer("055_OrchestrationV2", (it) => {
     Effect.sync(() => {
       assert.deepStrictEqual(
         migrationEntries.map(([id]) => id),
-        Array.from({ length: 66 }, (_, index) => index + 1),
+        Array.from({ length: 67 }, (_, index) => index + 1),
       );
     }),
   );
@@ -40,6 +40,7 @@ layer("055_OrchestrationV2", (it) => {
         [64, "CanonicalizeThreadPullRequestLinks"],
         [65, "CodexUsageNativeTurnIndex"],
         [66, "RepairClientSettlementTimestamps"],
+        [67, "WebhookDedupe"],
       ]);
       assert.deepStrictEqual(yield* runMigrations(), []);
 
@@ -72,6 +73,7 @@ layer("055_OrchestrationV2", (it) => {
         { migration_id: 64, name: "CanonicalizeThreadPullRequestLinks" },
         { migration_id: 65, name: "CodexUsageNativeTurnIndex" },
         { migration_id: 66, name: "RepairClientSettlementTimestamps" },
+        { migration_id: 67, name: "WebhookDedupe" },
       ]);
 
       const tables = yield* sql<{ readonly name: string }>`
diff --git a/apps/server/src/persistence/Migrations/067_WebhookDedupe.ts b/apps/server/src/persistence/Migrations/067_WebhookDedupe.ts
new file mode 100644
index 000000000000..b132e7c6dd14
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/067_WebhookDedupe.ts
@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/sql/SqlClient";
+
+export default Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`ALTER TABLE scheduled_tasks ADD COLUMN last_run_webhook_delivery_id TEXT`;
+  yield* sql`CREATE TABLE scheduled_task_webhook_replay_keys (
+    task_id TEXT NOT NULL REFERENCES scheduled_tasks(task_id) ON DELETE CASCADE,
+    replay_key TEXT NOT NULL,
+    delivery_id TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    PRIMARY KEY (task_id, replay_key)
+  )`;
+  yield* sql`CREATE INDEX idx_webhook_replay_expiry ON scheduled_task_webhook_replay_keys(expires_at)`;
+  yield* sql`CREATE INDEX idx_webhook_replay_delivery ON scheduled_task_webhook_replay_keys(delivery_id)`;
+  yield* sql`CREATE TABLE scheduled_task_webhook_pending (
+    delivery_id TEXT PRIMARY KEY,
+    task_id TEXT NOT NULL REFERENCES scheduled_tasks(task_id) ON DELETE CASCADE,
+    coalesce_key TEXT NOT NULL,
+    due_at INTEGER NOT NULL,
+    state TEXT NOT NULL DEFAULT 'pending',
+    task_json TEXT NOT NULL,
+    request_json TEXT NOT NULL,
+    delivery_ids_json TEXT NOT NULL
+  )`;
+  yield* sql`CREATE INDEX idx_webhook_pending_due ON scheduled_task_webhook_pending(state, due_at)`;
+  yield* sql`CREATE UNIQUE INDEX idx_webhook_pending_key
+    ON scheduled_task_webhook_pending(task_id, coalesce_key) WHERE state = 'pending'`;
+});
diff --git a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
index f1495d1e62a4..990d450cde6b 100644
--- a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
+++ b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
@@ -46,6 +46,7 @@ describe("V2 preview upgrade", () => {
         [64, "CanonicalizeThreadPullRequestLinks"],
         [65, "CodexUsageNativeTurnIndex"],
         [66, "RepairClientSettlementTimestamps"],
+        [67, "WebhookDedupe"],
       ]);
       assert.deepStrictEqual(yield* runMigrations(), []);
       assert.deepStrictEqual(yield* sql`SELECT * FROM orchestration_v2_legacy_imports`, imports);
@@ -135,6 +136,7 @@ describe("V2 preview upgrade", () => {
         [64, "CanonicalizeThreadPullRequestLinks"],
         [65, "CodexUsageNativeTurnIndex"],
         [66, "RepairClientSettlementTimestamps"],
+        [67, "WebhookDedupe"],
       ]);
     }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: ":memory:" }))),
   );
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
index d9a962994040..ea681a30afe0 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
@@ -15,6 +15,7 @@ import {
   type ScheduledTaskListWebhookDeliveriesResult,
   type ScheduledTaskRotateWebhookTokenInput,
   type ScheduledTaskWebhookDeliveryOutcome,
+  type ScheduledTaskWebhookFilter,
   type ScheduledTaskListResult,
   type ScheduledTaskMutationResult,
   type ScheduledTaskRunNowInput,
@@ -28,6 +29,7 @@ import * as Crypto from "effect/Crypto";
 import * as Data from "effect/Data";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as Duration from "effect/Duration";
 import * as Metric from "effect/Metric";
 import * as Layer from "effect/Layer";
@@ -53,15 +55,38 @@ import {
   renderWebhookPrompt,
   type WebhookRequest,
 } from "./webhookTemplate.ts";
+import {
+  acceptWebhookDedupe,
+  acceptImmediateWebhookDedupe,
+  releaseWebhookReplay,
+  decodePendingTask,
+  decodePendingRequest,
+  dedupeError,
+} from "./webhookDedupe.ts";
+import { describeFailedWebhookFilter, findFailedWebhookFilter } from "./webhookFilter.ts";
 import { constantTimeEquals, verifyWebhookSignature } from "./webhookVerification.ts";
 
 export const WEBHOOK_ROUTE_PREFIX = "/api/hooks";
+const isScheduledTaskError = Schema.is(ScheduledTaskError);
+const PROMPT_TOO_LONG = "The filled-in prompt is too long.";
 const WEBHOOK_DELIVERY_RETENTION = 50;
+const WEBHOOK_DEDUPE_DELIVERY_RETENTION = 20;
+const WEBHOOK_FILTERED_DELIVERY_RETENTION = 20;
+const WEBHOOK_DEDUPE_LOG_PER_MINUTE = 10;
+const WEBHOOK_FILTERED_LOG_PER_MINUTE = 10;
 const WEBHOOK_DELIVERY_LOG_BODY_LIMIT = 64 * 1024;
 const WEBHOOK_DELIVERY_LOG_PROMPT_LIMIT = 64 * 1024;
 const WEBHOOK_MAX_QUEUED_PER_TASK = 20;
 /** Accepted deliveries per task per minute, enforced here as well as on the relay because the tunnel hostname is public too. */
 const WEBHOOK_RATE_LIMIT_PER_MINUTE = 60;
+const LEGACY_DELIVERY_OUTCOMES: ReadonlySet<string> = new Set([
+  "accepted",
+  "dispatch_failed",
+  "rejected_signature",
+  "disabled",
+  "rate_limited",
+  "expired",
+]);
 
 interface WebhookOrigin {
   readonly relayHookBaseUrl: string | null;
@@ -93,7 +118,7 @@ class WebhookDeliverySkipped extends Data.TaggedError("WebhookDeliverySkipped")<
 }> {}
 
 interface RateWindow {
-  readonly accepted: ReadonlyArray<number>;
+  readonly accepted: ReadonlyArray<{ readonly at: number }>;
   readonly rejectedLogged: boolean;
 }
 
@@ -108,12 +133,14 @@ export interface WebhookTriggerRequest extends WebhookRequest {
 export type WebhookDeliveryOutcome =
   | "accepted"
   | "duplicate"
+  | "coalesced"
   | "prompt_too_long"
   | "queue_full"
   | "rate_limited"
   | "disabled"
   | "rejected_signature"
   | "expired"
+  | "filtered"
   | "not_found"
   | "error";
 
@@ -121,7 +148,7 @@ export type WebhookTriggerResult =
   | {
       readonly _tag: "accepted";
       readonly deliveryId: ScheduledTaskWebhookDeliveryId;
-      readonly outcome: "accepted" | "duplicate" | "prompt_too_long";
+      readonly outcome: "accepted" | "duplicate" | "coalesced" | "prompt_too_long" | "filtered";
     }
   | { readonly _tag: "not_found" }
   | { readonly _tag: "rejected_signature" }
@@ -132,6 +159,9 @@ export type WebhookTriggerResult =
     }
   | { readonly _tag: "expired" };
 
+const webhookFilters = (filters: ReadonlyArray<ScheduledTaskWebhookFilter> | undefined) =>
+  filters?.length ? { filters } : {};
+
 const decodeTask = Schema.decodeUnknownEffect(ScheduledTask);
 const decodeTaskId = Schema.decodeUnknownOption(ScheduledTaskId);
 const decodeScheduleJson = Schema.decodeUnknownEffect(
@@ -189,6 +219,7 @@ interface WebhookDeliveryRow {
   readonly signature_verified: number;
   readonly missing_fields_json: string;
   readonly rendered_prompt: string | null;
+  readonly pending_window: number;
   readonly error: string | null;
 }
 
@@ -383,6 +414,16 @@ export const layer = Layer.effect(
     // finish late release their own count, never a recreated task's.
     const webhookQueued = yield* Ref.make<ReadonlyMap<string, number>>(new Map());
     const webhookRateWindows = yield* Ref.make<ReadonlyMap<ScheduledTaskId, RateWindow>>(new Map());
+    const webhookRejectedRateWindows = yield* Ref.make<ReadonlyMap<ScheduledTaskId, RateWindow>>(
+      new Map(),
+    );
+    const webhookDedupeLogWindows = yield* Ref.make<
+      ReadonlyMap<ScheduledTaskId, ReadonlyArray<number>>
+    >(new Map());
+    const pendingInFlight = yield* Ref.make<ReadonlySet<string>>(new Set());
+    const webhookFilteredLogWindows = yield* Ref.make<
+      ReadonlyMap<ScheduledTaskId, ReadonlyArray<number>>
+    >(new Map());
     const activeRuns = yield* Ref.make<ReadonlySet<ScheduledTaskId>>(new Set());
     // Sliding(1) coalesces the dirty-signal: every notification triggers a
     // full list() re-emit anyway, so a slow subscriber only ever needs the
@@ -602,11 +643,12 @@ export const layer = Layer.effect(
           ),
         );
 
-    const markRunning = (id: ScheduledTaskId, startedAtIso: string) =>
+    const markRunning = (id: ScheduledTaskId, startedAtIso: string, webhookDeliveryId?: string) =>
       sql<{ task_id: string }>`
         UPDATE scheduled_tasks
         SET updated_at = ${startedAtIso},
             last_run_at = ${startedAtIso},
+            last_run_webhook_delivery_id = ${webhookDeliveryId ?? null},
             last_run_status = 'running',
             last_run_error = NULL
         WHERE task_id = ${id}
@@ -648,9 +690,10 @@ export const layer = Layer.effect(
     // markCompleted, write a full terminal record so runDueTasks neither skips
     // the task forever (it filters out 'running' rows) nor re-fires it
     // immediately: the dispatch may already have gone out, so next_run_at must
-    // advance and run_count must count the attempt.
+    // advance. Pending webhook attempts count only with their completion state;
+    // other attempts count here.
     const releaseStuckRun = Effect.fn("ScheduledTaskService.releaseStuckRun")(
-      function* (task: ScheduledTask, message: string) {
+      function* (task: ScheduledTask, message: string, pendingDeliveryId?: string) {
         const now = yield* localNow;
         const reread = yield* Effect.result(findTask(task.id));
         if (Result.isSuccess(reread) && reread.success === null) return;
@@ -661,12 +704,15 @@ export const layer = Layer.effect(
               last_run_error = ${message},
               next_run_at = ${nextRunAt(source, now)},
               updated_at = ${iso(now)},
-              run_count = run_count + 1
+              run_count = run_count + CASE WHEN EXISTS (
+                SELECT 1 FROM scheduled_task_webhook_pending
+                WHERE delivery_id = ${pendingDeliveryId ?? null} AND state = 'running'
+              ) THEN 0 ELSE 1 END
           WHERE task_id = ${task.id} AND last_run_status = 'running'
         `;
         yield* notifyChanged;
       },
-      (effect, task, _message) =>
+      (effect, task, _message, _pendingDeliveryId) =>
         effect.pipe(
           Effect.catch((cause) =>
             Effect.logWarning("Could not release stuck schedule task run", {
@@ -680,7 +726,11 @@ export const layer = Layer.effect(
     const runTask = Effect.fn("ScheduledTaskService.runTask")(function* (
       task: ScheduledTask,
       trigger: "scheduled" | "manual" | "webhook",
-      webhook?: { readonly deliveryId: string; readonly prompt: string },
+      webhook?: {
+        readonly deliveryId: string;
+        readonly prompt: string;
+        readonly dispatched: Ref.Ref<boolean>;
+      },
     ) {
       const reserved = yield* Ref.modify(activeRuns, (active) => {
         if (active.has(task.id)) return [false, active] as const;
@@ -714,6 +764,12 @@ export const layer = Layer.effect(
           }
           return { task, threadId: null };
         }
+        if (
+          webhook !== undefined &&
+          (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE delivery_id = ${webhook.deliveryId} AND state = 'completed'`)
+            .length > 0
+        )
+          return { task: { ...active, lastRunStatus: "succeeded" as const }, threadId: null };
         const parsedNextRunAt =
           active.nextRunAt === null ? Option.none() : DateTime.make(active.nextRunAt);
         if (
@@ -739,7 +795,22 @@ export const layer = Layer.effect(
           if (reason !== null) return yield* new WebhookDeliverySkipped({ reason });
         }
 
-        yield* markRunning(active.id, startedAtIso);
+        if (webhook === undefined) yield* markRunning(active.id, startedAtIso);
+        else
+          yield* sql
+            .withTransaction(
+              Effect.gen(function* () {
+                yield* markRunning(active.id, startedAtIso, webhook.deliveryId);
+                // Recovery must distinguish this delivery from other windows waiting on the same task.
+                yield* sql`UPDATE scheduled_task_webhook_pending SET state = 'running' WHERE delivery_id = ${webhook.deliveryId}`;
+              }),
+            )
+            .pipe(
+              Effect.mapError((cause) =>
+                taskError("Could not start webhook run.", { taskId: task.id, cause }),
+              ),
+            );
+
         yield* notifyChanged;
 
         const fireKey =
@@ -796,8 +867,9 @@ export const layer = Layer.effect(
                   .pipe(Effect.as(ThreadId.make(active.threadId))),
               );
 
-        const completedAt = yield* localNow;
         const runSucceeded = result._tag === "Success";
+        if (webhook !== undefined && runSucceeded) yield* Ref.set(webhook.dispatched, true);
+        const completedAt = yield* localNow;
         const lastRunStatus = runSucceeded ? ("succeeded" as const) : ("failed" as const);
         const lastRunError = runSucceeded ? null : errorMessage(result.cause);
         const threadId = runSucceeded ? result.value : null;
@@ -816,7 +888,7 @@ export const layer = Layer.effect(
           // startedAtIso in the guard ensures this writes only to the row this
           // run marked as running — a task deleted mid-run and recreated with
           // the same id (idempotent commandId replay) must not be stamped.
-          yield* markCompleted({
+          const completion = markCompleted({
             id: task.id,
             completedAtIso: completed.updatedAt,
             nextRunAtIso: completed.nextRunAt,
@@ -824,11 +896,32 @@ export const layer = Layer.effect(
             error: lastRunError,
             startedAtIso,
           });
+          if (webhook === undefined) yield* completion;
+          else
+            yield* sql
+              .withTransaction(
+                Effect.gen(function* () {
+                  const pending =
+                    yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE delivery_id = ${webhook.deliveryId}`;
+                  if (pending.length === 0) yield* completion;
+                  else {
+                    const counted =
+                      yield* sql`UPDATE scheduled_task_webhook_pending SET state = ${runSucceeded ? "completed" : "failed"}
+                      WHERE delivery_id = ${webhook.deliveryId} AND state NOT IN ('completed', 'failed') RETURNING delivery_id`;
+                    if (counted.length > 0) yield* completion;
+                  }
+                }),
+              )
+              .pipe(
+                Effect.mapError((cause) =>
+                  taskError("Could not record webhook completion.", { taskId: task.id, cause }),
+                ),
+              );
           yield* notifyChanged;
         }
         return { task: completed, threadId };
       }).pipe(
-        Effect.onError((cause) => releaseStuckRun(task, errorMessage(cause))),
+        Effect.onError((cause) => releaseStuckRun(task, errorMessage(cause), webhook?.deliveryId)),
         Effect.ensuring(
           Ref.update(activeRuns, (active) => {
             const next = new Set(active);
@@ -905,7 +998,11 @@ export const layer = Layer.effect(
                     last_run_error = 'Run was interrupted by a server restart.',
                     next_run_at = ${nextRunAt(decoded.success, now)},
                     updated_at = ${iso(now)},
-                    run_count = run_count + 1
+                    run_count = run_count + CASE WHEN EXISTS (
+                      SELECT 1 FROM scheduled_task_webhook_pending
+                      WHERE task_id IS ${row.task_id} AND state = 'running'
+                        AND delivery_id = scheduled_tasks.last_run_webhook_delivery_id
+                    ) THEN 0 ELSE 1 END
                 WHERE task_id IS ${row.task_id} AND last_run_status = 'running'
               `;
               return;
@@ -919,7 +1016,11 @@ export const layer = Layer.effect(
               SET last_run_status = 'failed',
                   last_run_error = 'Run was interrupted by a server restart.',
                   updated_at = ${iso(now)},
-                  run_count = run_count + 1
+                  run_count = run_count + CASE WHEN EXISTS (
+                    SELECT 1 FROM scheduled_task_webhook_pending
+                    WHERE task_id IS ${row.task_id} AND state = 'running'
+                        AND delivery_id = scheduled_tasks.last_run_webhook_delivery_id
+                  ) THEN 0 ELSE 1 END
               WHERE task_id IS ${row.task_id} AND last_run_status = 'running'
             `;
           }),
@@ -992,6 +1093,20 @@ export const layer = Layer.effect(
                       prefix: input.schedule.signature.prefix,
                     },
               maxDeliveryAgeMinutes: input.schedule.maxDeliveryAgeMinutes ?? null,
+              ...(input.schedule.dedupe === undefined
+                ? existingTask?.schedule.type === "webhook" &&
+                  existingTask.schedule.dedupe !== undefined
+                  ? { dedupe: existingTask.schedule.dedupe }
+                  : {}
+                : { dedupe: input.schedule.dedupe }),
+              ...webhookFilters(
+                // Omitted keeps the stored filters, so a client that predates
+                // them can re-save a task without clearing them.
+                input.schedule.filters ??
+                  (existingTask?.schedule.type === "webhook"
+                    ? existingTask.schedule.filters
+                    : undefined),
+              ),
             }
           : input.schedule;
       const webhook =
@@ -1106,6 +1221,21 @@ export const layer = Layer.effect(
             next.delete(id);
             return next;
           }),
+          Ref.update(webhookRejectedRateWindows, (windows) => {
+            const next = new Map(windows);
+            next.delete(id);
+            return next;
+          }),
+          Ref.update(webhookDedupeLogWindows, (windows) => {
+            const next = new Map(windows);
+            next.delete(id);
+            return next;
+          }),
+          Ref.update(webhookFilteredLogWindows, (windows) => {
+            const next = new Map(windows);
+            next.delete(id);
+            return next;
+          }),
           Ref.update(webhookPermits, (permits) => {
             const next = new Map(permits);
             next.delete(id);
@@ -1205,6 +1335,7 @@ export const layer = Layer.effect(
       bodyBytes: row.body_bytes,
       outcome: row.outcome as ScheduledTaskWebhookDeliveryOutcome,
       signatureVerified: row.signature_verified === 1,
+      pendingWindow: row.outcome === "accepted" && row.pending_window === 1,
       missingFields: Option.getOrElse(decodeMissingFieldsJson(row.missing_fields_json), () => []),
       error: row.error,
     });
@@ -1213,11 +1344,18 @@ export const layer = Layer.effect(
       input,
     ) =>
       sql<WebhookDeliveryRow>`
-        SELECT * FROM scheduled_task_webhook_deliveries
-        WHERE task_id = ${input.id}
+        SELECT d.*, EXISTS (SELECT 1 FROM scheduled_task_webhook_pending p
+          WHERE p.delivery_id = d.delivery_id AND p.state IN ('pending', 'dispatching')) AS pending_window
+        FROM scheduled_task_webhook_deliveries d WHERE task_id = ${input.id}
         ORDER BY received_at DESC, rowid DESC
       `.pipe(
-        Effect.map((rows) => ({ deliveries: rows.map(decodeDeliverySummary) })),
+        Effect.map((rows) => ({
+          deliveries: rows
+            .filter(
+              (row) => input.acceptAnyOutcome === true || LEGACY_DELIVERY_OUTCOMES.has(row.outcome),
+            )
+            .map(decodeDeliverySummary),
+        })),
         Effect.mapError((cause) =>
           taskError("Could not list webhook deliveries.", { taskId: input.id, cause }),
         ),
@@ -1227,15 +1365,19 @@ export const layer = Layer.effect(
       "ScheduledTaskService.getWebhookDelivery",
     )(function* (input) {
       const rows = yield* sql<WebhookDeliveryRow>`
-          SELECT * FROM scheduled_task_webhook_deliveries
-          WHERE task_id = ${input.id} AND delivery_id = ${input.deliveryId}
+          SELECT d.*, EXISTS (SELECT 1 FROM scheduled_task_webhook_pending p
+            WHERE p.delivery_id = d.delivery_id AND p.state IN ('pending', 'dispatching')) AS pending_window
+          FROM scheduled_task_webhook_deliveries d WHERE task_id = ${input.id} AND delivery_id = ${input.deliveryId}
         `.pipe(
         Effect.mapError((cause) =>
           taskError("Could not load webhook delivery.", { taskId: input.id, cause }),
         ),
       );
       const row = rows[0];
-      if (row === undefined) {
+      if (
+        row === undefined ||
+        (input.acceptAnyOutcome !== true && !LEGACY_DELIVERY_OUTCOMES.has(row.outcome))
+      ) {
         return yield* taskError("Webhook delivery not found.", { taskId: input.id });
       }
       return {
@@ -1250,6 +1392,24 @@ export const layer = Layer.effect(
       };
     });
 
+    const deliveryRequestBody = (request: WebhookTriggerRequest) => {
+      const truncated = request.body.byteLength > WEBHOOK_DELIVERY_LOG_BODY_LIMIT;
+      return {
+        truncated,
+        body: truncated
+          ? new TextDecoder().decode(request.body.subarray(0, WEBHOOK_DELIVERY_LOG_BODY_LIMIT))
+          : request.bodyText,
+      };
+    };
+    const replaceDeliveryRequest = (deliveryId: string, request: WebhookTriggerRequest) => {
+      const logged = deliveryRequestBody(request);
+      return sql`UPDATE scheduled_task_webhook_deliveries SET
+        method = ${request.method}, query = ${redactQuery(request.query)},
+        headers_json = ${encodeHeadersJson(redactHeaders(request.headers))}, body = ${logged.body},
+        body_bytes = ${request.body.byteLength}, body_truncated = ${logged.truncated ? 1 : 0}
+        WHERE delivery_id = ${deliveryId}`.pipe(Effect.asVoid, Effect.mapError(dedupeError));
+    };
+
     const recordDelivery = (input: {
       readonly id: string;
       readonly taskId: ScheduledTaskId;
@@ -1261,10 +1421,7 @@ export const layer = Layer.effect(
       readonly renderedPrompt: string | null;
       readonly error?: string;
     }) => {
-      const truncated = input.request.body.byteLength > WEBHOOK_DELIVERY_LOG_BODY_LIMIT;
-      const loggedBody = truncated
-        ? new TextDecoder().decode(input.request.body.subarray(0, WEBHOOK_DELIVERY_LOG_BODY_LIMIT))
-        : input.request.bodyText;
+      const { truncated, body: loggedBody } = deliveryRequestBody(input.request);
       return sql
         .withTransaction(
           Effect.gen(function* () {
@@ -1295,15 +1452,28 @@ export const layer = Layer.effect(
                 rendered_prompt = excluded.rendered_prompt,
                 error = excluded.error
             `;
+            // Each suppression bucket retains its own rows, never real run history.
+            const bucket = (outcome: string, error: string | undefined) =>
+              outcome === "filtered"
+                ? "filtered"
+                : outcome === "duplicate" ||
+                    outcome === "coalesced" ||
+                    outcome === "rate_limited" ||
+                    error === PROMPT_TOO_LONG
+                  ? "dedupe"
+                  : "main";
+            const retentionBucket = bucket(input.outcome, input.error);
+            const rowBucket = sql.literal(`CASE WHEN outcome = 'filtered' THEN 'filtered'
+              WHEN outcome IN ('duplicate', 'coalesced', 'rate_limited') OR error = 'The filled-in prompt is too long.' THEN 'dedupe'
+              ELSE 'main' END`);
             yield* sql`
             DELETE FROM scheduled_task_webhook_deliveries
-            WHERE task_id = ${input.taskId}
+            WHERE task_id = ${input.taskId} AND ${rowBucket} = ${retentionBucket}
               AND delivery_id NOT IN (
                 SELECT delivery_id FROM scheduled_task_webhook_deliveries
-                WHERE task_id = ${input.taskId}
-                -- rowid breaks timestamp ties in arrival order; delivery ids are random.
+                WHERE task_id = ${input.taskId} AND ${rowBucket} = ${retentionBucket}
                 ORDER BY received_at DESC, rowid DESC
-                LIMIT ${WEBHOOK_DELIVERY_RETENTION}
+                LIMIT ${retentionBucket === "main" ? WEBHOOK_DELIVERY_RETENTION : retentionBucket === "filtered" ? WEBHOOK_FILTERED_DELIVERY_RETENTION : WEBHOOK_DEDUPE_DELIVERY_RETENTION}
               )
           `;
           }),
@@ -1322,13 +1492,15 @@ export const layer = Layer.effect(
         WHERE delivery_id = ${deliveryId}
       `.pipe(Effect.ignore);
 
-    /**
-     * Sliding one-minute window counting every request with a valid token,
-     * including ones the signature check later rejects.
-     */
-    const takeRateSlot = (id: ScheduledTaskId, nowMs: number) =>
+    /** Sliding one-minute window for deliveries that can start work. */
+    const takeRateSlot = (
+      id: ScheduledTaskId,
+      nowMs: number,
+      rateWindows = webhookRateWindows,
+      reservation = { at: nowMs },
+    ) =>
       Ref.modify(
-        webhookRateWindows,
+        rateWindows,
         (
           windows,
         ): readonly [
@@ -1336,7 +1508,7 @@ export const layer = Layer.effect(
           ReadonlyMap<ScheduledTaskId, RateWindow>,
         ] => {
           const current = windows.get(id);
-          const recent = (current?.accepted ?? []).filter((at) => nowMs - at < 60_000);
+          const recent = (current?.accepted ?? []).filter((entry) => nowMs - entry.at < 60_000);
           if (recent.length >= WEBHOOK_RATE_LIMIT_PER_MINUTE) {
             const first = current?.rejectedLogged !== true;
             return [
@@ -1346,11 +1518,35 @@ export const layer = Layer.effect(
           }
           return [
             "allowed",
-            new Map(windows).set(id, { accepted: [...recent, nowMs], rejectedLogged: false }),
+            new Map(windows).set(id, { accepted: [...recent, reservation], rejectedLogged: false }),
           ];
         },
       );
 
+    const takeDedupeLogSlot = (id: ScheduledTaskId, nowMs: number) =>
+      Ref.modify(webhookDedupeLogWindows, (windows) => {
+        const recent = (windows.get(id) ?? []).filter((at) => nowMs - at < 60_000);
+        return recent.length >= WEBHOOK_DEDUPE_LOG_PER_MINUTE
+          ? ([false, windows] as const)
+          : ([true, new Map(windows).set(id, [...recent, nowMs])] as const);
+      });
+    const releaseReplay = (deliveryId: string) =>
+      releaseWebhookReplay(deliveryId).pipe(
+        Effect.provideService(SqlClient.SqlClient, sql),
+        Effect.mapError(dedupeError),
+      );
+    /** Sliding one-minute window of filtered requests written to the delivery log. */
+    const takeFilteredLogSlot = (id: ScheduledTaskId, nowMs: number) =>
+      Ref.modify(
+        webhookFilteredLogWindows,
+        (windows): readonly [boolean, ReadonlyMap<ScheduledTaskId, ReadonlyArray<number>>] => {
+          const recent = (windows.get(id) ?? []).filter((at) => nowMs - at < 60_000);
+          return recent.length >= WEBHOOK_FILTERED_LOG_PER_MINUTE
+            ? [false, windows]
+            : [true, new Map(windows).set(id, [...recent, nowMs])];
+        },
+      );
+
     const webhookPermit = Effect.fn("ScheduledTaskService.webhookPermit")(function* (
       id: ScheduledTaskId,
     ) {
@@ -1367,6 +1563,83 @@ export const layer = Layer.effect(
 
     const serviceScope = yield* Effect.scope;
 
+    const releaseFailedDelivery = Effect.fn("ScheduledTaskService.releaseFailedDelivery")(
+      function* (deliveryId: string) {
+        yield* releaseReplay(deliveryId);
+        yield* sql`DELETE FROM scheduled_task_webhook_relay_deliveries WHERE relay_delivery_id IN (
+          SELECT substr(value, ${"delivery:relay:".length + 1}) FROM scheduled_task_webhook_pending, json_each(delivery_ids_json)
+          WHERE delivery_id = ${deliveryId} AND value LIKE 'delivery:relay:%'
+        )`.pipe(Effect.mapError(dedupeError));
+        if (deliveryId.startsWith("delivery:relay:"))
+          yield* sql`DELETE FROM scheduled_task_webhook_relay_deliveries WHERE relay_delivery_id = ${deliveryId.slice("delivery:relay:".length)}`.pipe(
+            Effect.mapError(dedupeError),
+          );
+      },
+      (effect) => sql.withTransaction(effect).pipe(Effect.mapError(dedupeError)),
+    );
+
+    const runWebhookDelivery = Effect.fn("ScheduledTaskService.runWebhookDelivery")(function* (
+      task: ScheduledTask,
+      deliveryId: string,
+      prompt: string,
+    ) {
+      const runOutcome = (outcome: "started" | "skipped" | "failed") =>
+        Effect.all([
+          Effect.annotateCurrentSpan({ "scheduled_task.webhook.run_outcome": outcome }),
+          Metrics.increment(Metrics.webhookRunsTotal, { outcome }),
+        ]);
+      const dispatched = yield* Ref.make(false);
+      return yield* runTask(task, "webhook", { deliveryId, prompt, dispatched }).pipe(
+        Effect.flatMap(({ task: completed }) =>
+          completed.lastRunStatus === "failed"
+            ? runOutcome("failed").pipe(
+                Effect.andThen(markDeliveryFailed(deliveryId, "The run failed to start.")),
+                Effect.andThen(releaseFailedDelivery(deliveryId)),
+              )
+            : runOutcome("started"),
+        ),
+        Effect.catchTags({
+          WebhookDeliverySkipped: (skipped) =>
+            runOutcome("skipped").pipe(
+              Effect.andThen(markDeliveryFailed(deliveryId, skipped.reason)),
+              Effect.andThen(releaseFailedDelivery(deliveryId)),
+            ),
+        }),
+        Effect.as(true),
+        // Dispatch success owns the replay key even if later bookkeeping fails.
+        Effect.catchCause((cause) =>
+          Effect.gen(function* () {
+            const started = yield* Ref.get(dispatched);
+            yield* Effect.logWarning("Webhook dispatch failed", { taskId: task.id, cause });
+            yield* runOutcome(started ? "started" : "failed");
+            yield* markDeliveryFailed(
+              deliveryId,
+              started
+                ? "The run started, but completion could not be recorded."
+                : "The run failed to start.",
+            );
+            if (!started) {
+              yield* sql
+                .withTransaction(
+                  Effect.gen(function* () {
+                    const counted =
+                      yield* sql`UPDATE scheduled_task_webhook_pending SET state = 'failed'
+                WHERE delivery_id = ${deliveryId} AND state = 'running' RETURNING delivery_id`;
+                    if (counted.length > 0)
+                      yield* sql`UPDATE scheduled_tasks SET run_count = run_count + 1
+                WHERE task_id = ${task.id} AND created_at = ${task.createdAt}`;
+                  }),
+                )
+                .pipe(Effect.mapError(dedupeError));
+              yield* releaseFailedDelivery(deliveryId);
+            }
+            // Pending windows retry the same command id to finish bookkeeping.
+            return !started;
+          }),
+        ),
+      );
+    });
+
     // Delivery attributes belong to the enclosing triggerWebhook span.
     const observeDelivery = Effect.fnUntraced(function* (
       request: WebhookTriggerRequest,
@@ -1514,16 +1787,19 @@ export const layer = Layer.effect(
               ...(details.error === undefined ? {} : { error: details.error }),
             });
 
-          // Only the first rejected request in a window is logged, so a flood
-          // cannot write rows or push the real deliveries out of the log.
-          const slot = yield* takeRateSlot(task.id, DateTime.toEpochMillis(now));
-          if (slot !== "allowed") {
-            if (slot === "first_rejected") yield* log("rate_limited");
+          // Reject floods before signature work or rejection-log writes; valid
+          // deliveries give this reservation back once validation succeeds.
+          const rejectionReservation = { at: DateTime.toEpochMillis(now) };
+          const rejectionSlot = yield* takeRateSlot(
+            task.id,
+            DateTime.toEpochMillis(now),
+            webhookRejectedRateWindows,
+            rejectionReservation,
+          );
+          if (rejectionSlot !== "allowed") {
+            if (rejectionSlot === "first_rejected") yield* log("rate_limited");
             yield* observe("rate_limited");
-            return yield* releaseClaim({
-              _tag: "rate_limited" as const,
-              outcome: "rate_limited" as const,
-            });
+            return yield* releaseClaim({ _tag: "rate_limited", outcome: "rate_limited" } as const);
           }
           if (!task.enabled) {
             yield* log("disabled");
@@ -1557,6 +1833,122 @@ export const layer = Layer.effect(
             return { _tag: "expired" as const };
           }
 
+          const refundRejectionSlot = Ref.update(webhookRejectedRateWindows, (windows) => {
+            const current = windows.get(task.id);
+            if (current === undefined) return windows;
+            return new Map(windows).set(task.id, {
+              ...current,
+              accepted: current.accepted.filter((entry) => entry !== rejectionReservation),
+            });
+          });
+
+          const failedFilter = findFailedWebhookFilter(schedule.filters ?? [], request);
+          if (failedFilter !== null) {
+            if (yield* takeFilteredLogSlot(task.id, DateTime.toEpochMillis(now))) {
+              yield* log("filtered", {
+                signatureVerified: signature !== null,
+                error: describeFailedWebhookFilter(failedFilter),
+              });
+            }
+            yield* refundRejectionSlot;
+            yield* observe("filtered");
+            return yield* releaseClaim({
+              _tag: "accepted" as const,
+              deliveryId,
+              outcome: "filtered" as const,
+            });
+          }
+
+          const runWindow = (yield* Ref.get(webhookRateWindows)).get(task.id);
+          if (
+            schedule.dedupe === undefined &&
+            (runWindow?.accepted.filter((entry) => DateTime.toEpochMillis(now) - entry.at < 60_000)
+              .length ?? 0) >= WEBHOOK_RATE_LIMIT_PER_MINUTE
+          ) {
+            if ((yield* takeRateSlot(task.id, DateTime.toEpochMillis(now))) === "first_rejected")
+              yield* log("rate_limited");
+            yield* observe("rate_limited");
+            return yield* releaseClaim({ _tag: "rate_limited", outcome: "rate_limited" } as const);
+          }
+          const reserve = takeRateSlot(task.id, DateTime.toEpochMillis(now)).pipe(
+            Effect.flatMap((slot) => (slot === "allowed" ? Effect.void : Effect.fail(slot))),
+          );
+          const queueKey = `${task.id}\u0000${task.createdAt}`;
+          const checkCapacity = Effect.gen(function* () {
+            const [row] = yield* sql<{
+              count: number;
+            }>`SELECT COUNT(*) AS count FROM scheduled_task_webhook_pending
+              WHERE task_id = ${task.id} AND state IN ('pending', 'dispatching', 'running')`;
+            if (
+              (row?.count ?? 0) + ((yield* Ref.get(webhookQueued)).get(queueKey) ?? 0) >=
+              WEBHOOK_MAX_QUEUED_PER_TASK
+            )
+              return yield* Effect.fail("queue_full" as const);
+          }).pipe(
+            Effect.mapError((cause) => (cause === "queue_full" ? cause : dedupeError(cause))),
+          );
+          const admit = <A, E>(effect: Effect.Effect<A, E>) =>
+            sql.withTransaction(effect).pipe(
+              Effect.catch((cause) =>
+                cause === "first_rejected" || cause === "rejected" || cause === "queue_full"
+                  ? Effect.succeed({
+                      outcome:
+                        cause === "queue_full"
+                          ? ("queue_full" as const)
+                          : ("rate_limited" as const),
+                      log: cause === "first_rejected",
+                    })
+                  : Effect.fail(isScheduledTaskError(cause) ? cause : dedupeError(cause)),
+              ),
+            );
+          const deduped =
+            schedule.dedupe === undefined
+              ? "run"
+              : yield* admit(
+                  Effect.gen(function* () {
+                    const outcome = yield* acceptWebhookDedupe(
+                      task,
+                      request,
+                      deliveryId,
+                      DateTime.toEpochMillis(now),
+                      reserve,
+                      takeDedupeLogSlot(task.id, DateTime.toEpochMillis(now)),
+                      checkCapacity,
+                      (ownerId) => replaceDeliveryRequest(ownerId, request),
+                    ).pipe(Effect.provideService(SqlClient.SqlClient, sql));
+                    if (
+                      outcome === "pending" ||
+                      outcome === "coalesced" ||
+                      (outcome === "duplicate" &&
+                        (yield* takeDedupeLogSlot(task.id, DateTime.toEpochMillis(now))))
+                    )
+                      yield* log(outcome === "pending" ? "accepted" : outcome, {
+                        signatureVerified: signature !== null,
+                      });
+                    return outcome;
+                  }),
+                );
+          if (typeof deduped !== "string") {
+            yield* refundRejectionSlot;
+            if (deduped.log) yield* log("rate_limited");
+            yield* observe(deduped.outcome);
+            return yield* releaseClaim({ _tag: "rate_limited", outcome: deduped.outcome } as const);
+          }
+          if (deduped !== "run") {
+            if (deduped !== "coalesced" && deduped !== "coalesced_unlogged")
+              yield* refundRejectionSlot;
+            const outcome =
+              deduped === "pending"
+                ? "accepted"
+                : deduped === "coalesced_unlogged"
+                  ? "coalesced"
+                  : deduped;
+            yield* observe(outcome);
+            if (deduped === "duplicate")
+              return yield* releaseClaim({ _tag: "accepted", deliveryId, outcome } as const);
+            claimAcquired = false;
+            return { _tag: "accepted", deliveryId, outcome } as const;
+          }
           const frameId = yield* crypto.randomBytes(6).pipe(
             Effect.map((bytes) => Buffer.from(bytes).toString("hex")),
             Effect.mapError((cause) => taskError("Could not generate frame id.", { cause })),
@@ -1569,85 +1961,192 @@ export const layer = Layer.effect(
               signatureVerified: signature !== null,
               missing: rendered.missing,
               renderedPrompt: rendered.prompt,
-              error: "The filled-in prompt is too long.",
+              error: PROMPT_TOO_LONG,
             });
+            yield* releaseReplay(deliveryId);
             yield* observe("prompt_too_long");
-            return { _tag: "accepted" as const, deliveryId, outcome: "prompt_too_long" as const };
+            return yield* releaseClaim({
+              _tag: "accepted" as const,
+              deliveryId,
+              outcome: "prompt_too_long" as const,
+            });
           }
           // Bound the deliveries one task holds, so steady traffic to a stuck
           // task cannot pile up parked fibers.
-          const queueKey = `${task.id}\u0000${task.createdAt}`;
-          const queued = yield* Ref.modify(webhookQueued, (counts) => {
-            const count = counts.get(queueKey) ?? 0;
-            return count >= WEBHOOK_MAX_QUEUED_PER_TASK
-              ? ([false, counts] as const)
-              : ([true, new Map(counts).set(queueKey, count + 1)] as const);
+          yield* refundRejectionSlot;
+          let queueReserved = false;
+          const release = Effect.suspend(() => {
+            if (!queueReserved) return Effect.void;
+            queueReserved = false;
+            return Ref.update(webhookQueued, (counts) => {
+              const next = new Map(counts);
+              const count = (next.get(queueKey) ?? 1) - 1;
+              if (count <= 0) next.delete(queueKey);
+              else next.set(queueKey, count);
+              return next;
+            });
+          });
+          // Serialize immediate reservations with persisted window admission.
+          const reserveImmediate = Effect.gen(function* () {
+            yield* checkCapacity;
+            yield* reserve;
+            yield* Ref.update(webhookQueued, (counts) =>
+              new Map(counts).set(queueKey, (counts.get(queueKey) ?? 0) + 1),
+            );
+            queueReserved = true;
           });
-          if (!queued) {
-            yield* observe("queue_full");
+          const admitted = yield* admit(
+            Effect.gen(function* () {
+              const outcome = yield* acceptImmediateWebhookDedupe(
+                task,
+                request,
+                deliveryId,
+                DateTime.toEpochMillis(now),
+                reserveImmediate,
+              ).pipe(Effect.provideService(SqlClient.SqlClient, sql));
+              if (outcome === "duplicate") {
+                if (yield* takeDedupeLogSlot(task.id, DateTime.toEpochMillis(now)))
+                  yield* log("duplicate", { signatureVerified: signature !== null });
+              } else
+                yield* log("accepted", {
+                  signatureVerified: signature !== null,
+                  missing: rendered.missing,
+                  renderedPrompt: rendered.prompt,
+                });
+              return outcome;
+            }),
+          ).pipe(Effect.onError(() => release));
+          if (typeof admitted !== "string") {
+            yield* release;
+            if (admitted.log) yield* log("rate_limited");
+            yield* observe(admitted.outcome);
             return yield* releaseClaim({
-              _tag: "rate_limited" as const,
-              outcome: "queue_full" as const,
-            });
+              _tag: "rate_limited",
+              outcome: admitted.outcome,
+            } as const);
+          }
+          if (admitted === "duplicate") {
+            yield* release;
+            yield* observe("duplicate");
+            return yield* releaseClaim({
+              _tag: "accepted",
+              deliveryId,
+              outcome: "duplicate",
+            } as const);
           }
-          const release = Ref.update(webhookQueued, (counts) => {
-            const next = new Map(counts);
-            const count = (next.get(queueKey) ?? 1) - 1;
-            if (count <= 0) next.delete(queueKey);
-            else next.set(queueKey, count);
-            return next;
-          });
-          yield* log("accepted", {
-            signatureVerified: signature !== null,
-            missing: rendered.missing,
-            renderedPrompt: rendered.prompt,
-          }).pipe(Effect.onError(() => release));
           yield* observe("accepted");
           const permit = yield* webhookPermit(task.id);
-          const runOutcome = (outcome: "started" | "skipped" | "failed") =>
-            Effect.all([
-              Effect.annotateCurrentSpan({ "scheduled_task.webhook.run_outcome": outcome }),
-              Metrics.increment(Metrics.webhookRunsTotal, { outcome }),
-            ]);
-          yield* runTask(task, "webhook", { deliveryId, prompt: rendered.prompt }).pipe(
-            Effect.flatMap(({ task: completed }) =>
-              completed.lastRunStatus === "failed"
-                ? runOutcome("failed").pipe(
-                    Effect.andThen(markDeliveryFailed(deliveryId, "The run failed to start.")),
-                  )
-                : runOutcome("started"),
-            ),
-            Effect.catchTags({
-              WebhookDeliverySkipped: (skipped) =>
-                runOutcome("skipped").pipe(
-                  Effect.andThen(markDeliveryFailed(deliveryId, skipped.reason)),
-                ),
-            }),
-            // The log is readable over RPC, so it gets a fixed reason; the
-            // cause, which can carry request data, stays in the server log.
-            Effect.catchCause((cause) =>
-              Effect.logWarning("Webhook dispatch failed", { taskId: task.id, cause }).pipe(
-                Effect.andThen(runOutcome("failed")),
-                Effect.andThen(markDeliveryFailed(deliveryId, "The run failed to start.")),
-              ),
-            ),
+          yield* runWebhookDelivery(task, deliveryId, rendered.prompt).pipe(
             permit.withPermits(1),
-            Effect.withSpan("ScheduledTaskService.runWebhookDelivery", {
-              root: true,
-              attributes: {
-                "scheduled_task.id": task.id,
-                "scheduled_task.webhook.delivery_id": deliveryId,
-              },
-            }),
             Effect.ensuring(release),
             Effect.forkIn(serviceScope),
           );
           // Dispatch owns the accepted delivery now; retries must keep its claim.
           claimAcquired = false;
           return { _tag: "accepted" as const, deliveryId, outcome: "accepted" as const };
-        }).pipe(Effect.onError(() => releaseClaim(undefined))),
+        }).pipe(
+          Effect.onError(() =>
+            Effect.all([
+              releaseClaim(undefined),
+              (request.relayDeliveryId === undefined || claimAcquired
+                ? releaseReplay(deliveryId)
+                : Effect.void
+              ).pipe(Effect.ignore),
+            ]),
+          ),
+        ),
+      );
+    });
+
+    const dispatchPending = Effect.fn("ScheduledTaskService.dispatchPendingWebhooks")(function* () {
+      const now = DateTime.toEpochMillis(yield* localNow);
+      yield* sql`UPDATE scheduled_task_webhook_pending SET state = 'dispatching' WHERE state = 'pending' AND due_at <= ${now}`;
+      const tasks = yield* sql<{ task_id: ScheduledTaskId }>`
+        SELECT DISTINCT task_id FROM scheduled_task_webhook_pending WHERE state IN ('dispatching', 'running', 'completed', 'failed')
+      `;
+      yield* Effect.forEach(
+        tasks,
+        ({ task_id: taskId }) =>
+          Effect.gen(function* () {
+            const reserved = yield* Ref.modify(pendingInFlight, (active) =>
+              active.has(taskId)
+                ? ([false, active] as const)
+                : ([true, new Set(active).add(taskId)] as const),
+            );
+            if (!reserved) return;
+            const permit = yield* webhookPermit(taskId);
+            // One worker per task waits on its permit, then drains persisted rows in order.
+            // Other tasks remain independent and ticks never reload an active task's payloads.
+            const dispatch = Effect.gen(function* () {
+              while (true) {
+                const [entry] = yield* sql<{
+                  delivery_id: string;
+                  task_json: string;
+                  request_json: string;
+                  state: string;
+                }>`
+              SELECT delivery_id, task_json, request_json, state FROM scheduled_task_webhook_pending
+              WHERE task_id = ${taskId} AND state IN ('dispatching', 'running', 'completed', 'failed') ORDER BY due_at, rowid LIMIT 1
+            `;
+                if (entry === undefined) return;
+                const remove = sql`DELETE FROM scheduled_task_webhook_pending WHERE delivery_id = ${entry.delivery_id}`;
+                if (entry.state === "completed" || entry.state === "failed") {
+                  if (entry.state === "failed") {
+                    yield* markDeliveryFailed(entry.delivery_id, "The run failed to start.");
+                    yield* releaseFailedDelivery(entry.delivery_id);
+                  }
+                  yield* remove;
+                  continue;
+                }
+                const prepared = yield* Effect.gen(function* () {
+                  const task = yield* decodePendingTask(entry.task_json);
+                  const request = yield* decodePendingRequest(entry.request_json);
+                  const frameId = Buffer.from(yield* crypto.randomBytes(6)).toString("hex");
+                  return { task, rendered: renderWebhookPrompt(task.prompt, request, frameId) };
+                }).pipe(Effect.exit);
+                if (Exit.isFailure(prepared)) {
+                  if (Cause.hasInterruptsOnly(prepared.cause))
+                    return yield* Effect.failCause(prepared.cause);
+                  yield* markDeliveryFailed(
+                    entry.delivery_id,
+                    "The pending webhook payload could not be prepared.",
+                  );
+                  yield* releaseFailedDelivery(entry.delivery_id);
+                  yield* remove;
+                  continue;
+                }
+                const { task, rendered } = prepared.value;
+                if (rendered.prompt.trim().length > PROVIDER_SEND_TURN_MAX_INPUT_CHARS) {
+                  yield* markDeliveryFailed(entry.delivery_id, PROMPT_TOO_LONG);
+                  yield* releaseFailedDelivery(entry.delivery_id);
+                } else {
+                  yield* sql`UPDATE scheduled_task_webhook_deliveries SET outcome = 'accepted', error = NULL, rendered_prompt = ${rendered.prompt.slice(0, WEBHOOK_DELIVERY_LOG_PROMPT_LIMIT)}, missing_fields_json = ${encodeMissingFieldsJson(rendered.missing)} WHERE delivery_id = ${entry.delivery_id}`;
+                  if (!(yield* runWebhookDelivery(task, entry.delivery_id, rendered.prompt)))
+                    return;
+                }
+                yield* remove;
+              }
+            });
+            yield* dispatch.pipe(
+              permit.withPermits(1),
+              Effect.catch((cause) =>
+                Effect.logWarning("Pending webhook dispatch failed", { cause }),
+              ),
+              Effect.ensuring(
+                Ref.update(pendingInFlight, (active) => {
+                  const next = new Set(active);
+                  next.delete(taskId);
+                  return next;
+                }),
+              ),
+              Effect.withSpan("ScheduledTaskService.dispatchPendingWebhook", { root: true }),
+              Effect.forkIn(serviceScope),
+            );
+          }),
+        { discard: true },
       );
     });
+    yield* scheduler.register("webhook-coalescing", dispatchPending());
 
     return ScheduledTaskService.of({
       list,
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
index ae8594a03f0a..e8a4957e84c0 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
@@ -3,8 +3,13 @@ import * as NodeCrypto from "node:crypto";
 
 import * as NodePlatformCrypto from "@effect/platform-node/NodeCrypto";
 import { assert, it } from "@effect/vitest";
-import { ScheduledTaskUpsertInput, SecretRequestError } from "@t3tools/contracts";
+import {
+  ScheduledTaskUpsertInput,
+  ScheduledTaskWebhookDeliveryId,
+  SecretRequestError,
+} from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
+import * as Crypto from "effect/Crypto";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
@@ -24,9 +29,94 @@ import * as ManagedProjectFolders from "../project/ManagedProjectFolders.ts";
 import * as SqlitePersistence from "../persistence/Sqlite.ts";
 import * as Scheduler from "../scheduling/Scheduler.ts";
 import * as ScheduledTaskService from "./ScheduledTaskService.ts";
+import { renderWebhookPrompt } from "./webhookTemplate.ts";
 
 const decodeUpsertInput = Schema.decodeUnknownEffect(ScheduledTaskUpsertInput);
 
+it.effect(
+  "preserves omitted dedupe settings, releases duplicate claims, and retains coalesced claims",
+  () =>
+    withService(({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const dedupe = {
+          replayKey: "{{headers.delivery-id}}",
+          coalesceKey: "{{body.group}}",
+          coalesceWindowSeconds: 10,
+        };
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({ schedule: { type: "webhook", dedupe } }),
+        );
+        const updated = yield* service.upsert(yield* webhookTaskInput());
+        assert.deepEqual(
+          updated.task.schedule.type === "webhook" && updated.task.schedule.dedupe,
+          dedupe,
+        );
+        const request = (id: string, bodyText = "{}", relayDeliveryId?: string) =>
+          requestFor(task, {
+            headers: { "delivery-id": id },
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            ...(relayDeliveryId === undefined ? {} : { relayDeliveryId }),
+          });
+        yield* service.triggerWebhook(request("A"));
+        yield* Queue.take(launches);
+        yield* service.triggerWebhook(request("B1", '{"group":"B"}'));
+        for (let i = 0; i < 5; i++) {
+          const duplicate = yield* service.triggerWebhook(request("A", "{}", `duplicate-${i}`));
+          assert.equal(duplicate._tag === "accepted" && duplicate.outcome, "duplicate");
+          const coalesced = yield* service.triggerWebhook(
+            request(`B${i + 2}`, '{"group":"B"}', `coalesced-${i}`),
+          );
+          assert.equal(coalesced._tag === "accepted" && coalesced.outcome, "coalesced");
+        }
+        const claims = yield* sql<{
+          relay_delivery_id: string;
+        }>`SELECT relay_delivery_id FROM scheduled_task_webhook_relay_deliveries ORDER BY relay_delivery_id`;
+        assert.deepEqual(
+          claims.map((claim) => claim.relay_delivery_id),
+          Array.from({ length: 5 }, (_, i) => `coalesced-${i}`),
+        );
+        assert.isTrue(
+          (yield* service.listWebhookDeliveries({ id: task.id })).deliveries.every(
+            (delivery) => delivery.outcome !== "duplicate" && delivery.outcome !== "coalesced",
+          ),
+        );
+        const fresh = yield* service.triggerWebhook(request("C", "{}", "duplicate-0"));
+        assert.equal(fresh._tag === "accepted" && fresh.outcome, "accepted");
+        yield* Queue.take(launches);
+        const cleared = yield* service.upsert(
+          yield* webhookTaskInput({ schedule: { type: "webhook", dedupe: {} } }),
+        );
+        assert.deepEqual(
+          cleared.task.schedule.type === "webhook" && cleared.task.schedule.dedupe,
+          {},
+        );
+      }),
+    ),
+);
+
+const waitForSpan = <A, E, R>(work: Effect.Effect<A, E, R>, name: string) =>
+  Effect.gen(function* () {
+    const done = yield* Deferred.make<void>();
+    const tracer = Tracer.make({
+      span: (options) => {
+        const span = new Tracer.NativeSpan(options);
+        const end = span.end.bind(span);
+        span.end = (...args) => {
+          end(...args);
+          if (span.name === name) Deferred.doneUnsafe(done, Effect.void);
+        };
+        return span;
+      },
+    });
+    const result = yield* work.pipe(Effect.withTracer(tracer));
+    yield* Deferred.await(done);
+    return result;
+  });
+
+const drainPendingDispatch = (workers: Map<string, Effect.Effect<void>>) =>
+  waitForSpan(workers.get("webhook-coalescing")!, "ScheduledTaskService.dispatchPendingWebhook");
+
 type LaunchInput = ThreadLaunchService.ThreadLaunchInput;
 
 const webhookTaskInput = (overrides: Record<string, unknown> = {}) =>
@@ -70,20 +160,76 @@ const withService = <A, E>(
     readonly sql: SqlClient.SqlClient;
     readonly secretsByRef: Map<string, string>;
   }) => Effect.Effect<A, E, never>,
-  options: { readonly gate?: Deferred.Deferred<void>; readonly relayHookBaseUrl?: string } = {},
+  options: {
+    readonly onFrame?: () => void;
+    readonly frameGate?: {
+      readonly started: Deferred.Deferred<void>;
+      readonly release: Deferred.Deferred<void>;
+    };
+    readonly completedLaunches?: Set<string>;
+    readonly failLaunches?: { remaining: number };
+    readonly gate?: Deferred.Deferred<void>;
+    readonly gateForTask?: (input: LaunchInput) => Deferred.Deferred<void> | undefined;
+    readonly relayHookBaseUrl?: string;
+    readonly sql?: SqlClient.SqlClient;
+    readonly workers?: Map<string, Effect.Effect<void>>;
+  } = {},
 ) =>
   Effect.gen(function* () {
     const launches = yield* Queue.unbounded<LaunchInput>();
     const secretsByRef = new Map<string, string>();
     const layerDependencies = Layer.mergeAll(
-      NodePlatformCrypto.layer,
-      Scheduler.layer,
+      options.frameGate === undefined && options.onFrame === undefined
+        ? NodePlatformCrypto.layer
+        : Layer.effect(
+            Crypto.Crypto,
+            Effect.gen(function* () {
+              const crypto = yield* Crypto.Crypto;
+              return {
+                ...crypto,
+                randomBytes: (size: number) =>
+                  Effect.suspend(() => {
+                    if (size === 6) options.onFrame?.();
+                    return size === 6 && options.frameGate !== undefined
+                      ? Deferred.succeed(options.frameGate.started, undefined).pipe(
+                          Effect.andThen(Deferred.await(options.frameGate.release)),
+                          Effect.andThen(crypto.randomBytes(size)),
+                        )
+                      : crypto.randomBytes(size);
+                  }),
+              };
+            }),
+          ).pipe(Layer.provide(NodePlatformCrypto.layer)),
+      options.workers === undefined
+        ? Scheduler.layer
+        : Layer.succeed(Scheduler.Scheduler, {
+            register: <E, R>(name: string, work: Effect.Effect<void, E, R>) =>
+              Effect.gen(function* () {
+                const context = yield* Effect.context<R>();
+                options.workers!.set(name, work.pipe(Effect.provideContext(context), Effect.orDie));
+              }),
+          }),
       Layer.mock(ThreadLaunchService.ThreadLaunchService)({
         launch: (input) =>
-          Queue.offer(launches, input).pipe(
-            Effect.andThen(options.gate ? Deferred.await(options.gate) : Effect.void),
-            Effect.as({ threadId: "thread-1", resumed: false } as never),
-          ),
+          Effect.suspend(() => {
+            if (options.completedLaunches?.has(input.commandId))
+              return Effect.succeed({ threadId: "thread-1", resumed: false } as never);
+            options.completedLaunches?.add(input.commandId);
+            return Queue.offer(launches, input).pipe(
+              Effect.andThen(
+                (options.gateForTask?.(input) ?? options.gate)
+                  ? Deferred.await((options.gateForTask?.(input) ?? options.gate)!)
+                  : Effect.void,
+              ),
+              Effect.andThen(
+                Effect.sync(() => {
+                  if (options.failLaunches && options.failLaunches.remaining-- > 0)
+                    throw new Error("injected start failure");
+                }),
+              ),
+              Effect.as({ threadId: "thread-1", resumed: false } as never),
+            );
+          }),
       }),
       Layer.mock(ManagedProjectFolders.ManagedProjectFolders)({
         namedProjectsRoot: "/projects",
@@ -108,8 +254,18 @@ const withService = <A, E>(
       const service = yield* ScheduledTaskService.ScheduledTaskService;
       const sql = yield* SqlClient.SqlClient;
       return yield* body({ service, launches, sql, secretsByRef });
-    }).pipe(Effect.provide(ScheduledTaskService.layer.pipe(Layer.provide(layerDependencies))));
-  }).pipe(Effect.provide(SqlitePersistence.layerMemory));
+    }).pipe(
+      Effect.provide(
+        Layer.fresh(ScheduledTaskService.layer.pipe(Layer.provide(layerDependencies))),
+      ),
+    );
+  }).pipe(
+    Effect.provide(
+      options.sql === undefined
+        ? SqlitePersistence.layerMemory
+        : Layer.succeed(SqlClient.SqlClient, options.sql),
+    ),
+  );
 
 it.effect("dispatches exactly the rendered prompt and logs the delivery", () =>
   withService(({ service, launches }) =>
@@ -132,7 +288,10 @@ it.effect("dispatches exactly the rendered prompt and logs the delivery", () =>
         `scheduled-task:${task.id}:webhook:${result._tag === "accepted" ? result.deliveryId : ""}`,
       );
 
-      const { deliveries } = yield* service.listWebhookDeliveries({ id: task.id });
+      const { deliveries } = yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      });
       assert.equal(deliveries.length, 1);
       assert.equal(deliveries[0]?.outcome, "accepted");
       const { delivery } = yield* service.getWebhookDelivery({
@@ -188,7 +347,11 @@ it.effect("answers not found for a wrong token or unknown hook without logging",
       assert.equal(wrongToken._tag, "not_found");
       const unknown = yield* service.triggerWebhook(requestFor(task, { hookId: "missing" }));
       assert.equal(unknown._tag, "not_found");
-      assert.equal((yield* service.listWebhookDeliveries({ id: task.id })).deliveries.length, 0);
+      assert.equal(
+        (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true })).deliveries
+          .length,
+        0,
+      );
     }),
   ),
 );
@@ -253,9 +416,10 @@ it.effect("checks the configured signature and keeps the secret write-only", ()
       );
       assert.isTrue(resaved.task.webhook?.hasSecret);
 
-      const outcomes = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries.map(
-        (delivery) => [delivery.outcome, delivery.signatureVerified],
-      );
+      const outcomes = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries.map((delivery) => [delivery.outcome, delivery.signatureVerified]);
       assert.deepEqual(outcomes.toSorted(), [
         ["accepted", true],
         ["rejected_signature", false],
@@ -300,23 +464,38 @@ it.effect("queues a burst of deliveries instead of dropping them", () =>
   }),
 );
 
-it.effect("rate limits a hook past 60 deliveries a minute", () =>
-  withService(({ service }) =>
-    Effect.gen(function* () {
-      const { task } = yield* service.upsert(yield* webhookTaskInput({ enabled: false }));
-      const results = yield* Effect.forEach(Array.from({ length: 61 }), () =>
-        service.triggerWebhook(requestFor(task)),
-      );
-      assert.equal(results.at(-2)?._tag, "disabled");
-      assert.equal(results.at(-1)?._tag, "rate_limited");
-      yield* Effect.forEach([1, 2, 3], () => service.triggerWebhook(requestFor(task)));
-      const outcomes = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries.map(
-        (delivery) => delivery.outcome,
-      );
-      assert.equal(outcomes.filter((outcome) => outcome === "rate_limited").length, 1);
-    }),
-  ),
-);
+it.effect("rate limits a hook past 60 deliveries a minute", () => {
+  let frames = 0;
+  return withService(
+    ({ service, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(yield* webhookTaskInput());
+        const results = yield* Effect.forEach(Array.from({ length: 61 }), () =>
+          service
+            .triggerWebhook(requestFor(task))
+            .pipe(
+              Effect.tap((result) =>
+                result._tag === "accepted" ? Queue.take(launches) : Effect.void,
+              ),
+            ),
+        );
+        assert.equal(results.at(-2)?._tag, "accepted");
+        assert.equal(results.at(-1)?._tag, "rate_limited");
+        yield* Effect.forEach([1, 2, 3], () => service.triggerWebhook(requestFor(task)));
+        const outcomes = (yield* service.listWebhookDeliveries({
+          id: task.id,
+          acceptAnyOutcome: true,
+        })).deliveries.map((delivery) => delivery.outcome);
+        assert.equal(outcomes.filter((outcome) => outcome === "rate_limited").length, 1);
+        assert.equal(frames, 60);
+      }),
+    {
+      onFrame: () => {
+        frames++;
+      },
+    },
+  );
+});
 
 it.effect("a save carrying a stale token cannot undo a rotation", () =>
   withService(({ service }) =>
@@ -337,7 +516,10 @@ it.effect("keeps the newest 50 deliveries when they share a timestamp", () =>
       const ids = yield* Effect.forEach(Array.from({ length: 55 }), (_, index) =>
         service.triggerWebhook(requestFor(task, { query: `n=${index}` })).pipe(Effect.as(index)),
       );
-      const { deliveries } = yield* service.listWebhookDeliveries({ id: task.id });
+      const { deliveries } = yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      });
       assert.equal(deliveries.length, 50);
       const first = yield* service.getWebhookDelivery({
         id: task.id,
@@ -368,7 +550,10 @@ it.effect("keeps credential headers and query values out of the delivery log", (
           },
         }),
       );
-      const [summary] = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      const [summary] = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
       const { delivery } = yield* service.getWebhookDelivery({
         id: task.id,
         deliveryId: summary!.id,
@@ -479,7 +664,10 @@ it.effect("caps deliveries waiting behind a stuck run", () =>
           );
           assert.equal(waiting.filter((result) => result._tag === "accepted").length, 19);
           assert.equal(waiting.at(-1)?._tag, "rate_limited");
-          const logged = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+          const logged = (yield* service.listWebhookDeliveries({
+            id: task.id,
+            acceptAnyOutcome: true,
+          })).deliveries;
           assert.equal(logged.length, 20);
           yield* Deferred.succeed(gate, undefined);
         }),
@@ -495,7 +683,10 @@ it.effect("logs a body's first 64 KiB by bytes, not characters", () =>
       const text = "界".repeat(30_000);
       const body = new TextEncoder().encode(text);
       yield* service.triggerWebhook(requestFor(task, { body, bodyText: text }));
-      const [summary] = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      const [summary] = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
       const { delivery } = yield* service.getWebhookDelivery({
         id: task.id,
         deliveryId: summary!.id,
@@ -559,7 +750,8 @@ it.effect("a held request already delivered directly runs only once", () =>
       assert.equal(direct._tag, "accepted");
       assert.deepEqual(replayed, { ...direct, outcome: "duplicate" } as typeof replayed);
       yield* Queue.take(launches);
-      const logged = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      const logged = (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true }))
+        .deliveries;
       assert.equal(logged.length, 1);
     }),
   ),
@@ -580,7 +772,9 @@ it.effect("relay retries recover failed acceptance without releasing another req
       const error = yield* service.triggerWebhook(request).pipe(Effect.flip);
       assert.equal(error.message, "Could not record webhook delivery.");
       assert.equal(yield* Queue.size(launches), 0);
-      assert.isEmpty((yield* service.listWebhookDeliveries({ id: task.id })).deliveries);
+      assert.isEmpty(
+        (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true })).deliveries,
+      );
       yield* sql`DROP TRIGGER fail_webhook_delivery_log`;
 
       const retried = yield* Effect.all(
@@ -606,7 +800,11 @@ it.effect("relay retries recover failed acceptance without releasing another req
       const replayed = yield* service.triggerWebhook(request);
       assert.equal(replayed._tag === "accepted" ? replayed.outcome : replayed._tag, "duplicate");
       assert.equal(yield* Queue.size(launches), 0);
-      assert.equal((yield* service.listWebhookDeliveries({ id: task.id })).deliveries.length, 1);
+      assert.equal(
+        (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true })).deliveries
+          .length,
+        1,
+      );
     }),
   ),
 );
@@ -657,9 +855,9 @@ it.effect("a held request runs once even after the log has trimmed it", () =>
 it.effect("a rate-limited held request can run on a later pass", () =>
   withService(({ service, launches }) =>
     Effect.gen(function* () {
-      const { task } = yield* service.upsert(yield* webhookTaskInput({ enabled: false }));
+      const { task } = yield* service.upsert(yield* webhookTaskInput());
       yield* Effect.forEach(Array.from({ length: 60 }), () =>
-        service.triggerWebhook(requestFor(task)),
+        service.triggerWebhook(requestFor(task)).pipe(Effect.tap(() => Queue.take(launches))),
       );
       const limited = yield* service.triggerWebhook(requestFor(task, { relayDeliveryId: "later" }));
       assert.equal(limited._tag, "rate_limited");
@@ -678,7 +876,10 @@ it.effect("logs a held request at the time the relay received it", () =>
       const { task } = yield* service.upsert(yield* webhookTaskInput({ enabled: false }));
       const receivedAt = DateTime.formatIso(DateTime.subtract(yield* DateTime.now, { minutes: 5 }));
       yield* service.triggerWebhook(requestFor(task, { relayDeliveryId: "relay-2", receivedAt }));
-      const [delivery] = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      const [delivery] = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
       assert.equal(delivery?.receivedAt, receivedAt);
     }),
   ),
@@ -699,7 +900,10 @@ it.effect("a receive time in the future counts as now", () =>
       );
       assert.equal(result._tag, "accepted");
       yield* Queue.take(launches);
-      const [delivery] = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      const [delivery] = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
       assert.equal(delivery?.receivedAt, DateTime.formatIso(now));
     }),
   ),
@@ -723,9 +927,10 @@ it.effect("skips a held request older than the task's max age", () =>
         requestFor(task, { relayDeliveryId: "fresh", receivedAt: fresh }),
       );
       assert.equal(ok._tag, "accepted");
-      const outcomes = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries.map(
-        (delivery) => delivery.outcome,
-      );
+      const outcomes = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries.map((delivery) => delivery.outcome);
       assert.includeMembers(outcomes, ["expired", "accepted"]);
     }),
   ),
@@ -753,7 +958,11 @@ it.effect("deleting a task removes its delivery log", () =>
       const { task } = yield* service.upsert(yield* webhookTaskInput({ enabled: false }));
       yield* service.triggerWebhook(requestFor(task));
       yield* service.delete({ id: task.id });
-      assert.equal((yield* service.listWebhookDeliveries({ id: task.id })).deliveries.length, 0);
+      assert.equal(
+        (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true })).deliveries
+          .length,
+        0,
+      );
     }),
   ),
 );
@@ -953,3 +1162,1776 @@ it.effect("counts each handled request by what happened to it", () =>
     }),
   ),
 );
+
+it.effect("dedupes replay keys per task, persists them, and expires them after seven days", () =>
+  withService(
+    ({ service, launches, sql }) =>
+      Effect.gen(function* () {
+        const schedule = { type: "webhook", dedupe: { replayKey: "{{headers.delivery-id}}" } };
+        const { task } = yield* service.upsert(yield* webhookTaskInput({ schedule }));
+        const request = requestFor(task, { headers: { "delivery-id": "A" } });
+        const first = yield* service.triggerWebhook(request);
+        assert.equal(first._tag === "accepted" && first.outcome, "accepted");
+        yield* Queue.take(launches);
+        const replay = yield* service.triggerWebhook(request);
+        assert.equal(replay._tag === "accepted" && replay.outcome, "duplicate");
+        assert.equal(yield* Queue.size(launches), 0);
+        const other = yield* service.upsert(
+          yield* webhookTaskInput({ id: "scheduled-task:other", schedule }),
+        );
+        yield* service.triggerWebhook(requestFor(other.task, { headers: request.headers }));
+        yield* Queue.take(launches);
+        yield* withService(
+          ({ service: restarted }) =>
+            Effect.gen(function* () {
+              const replay = yield* restarted.triggerWebhook(request);
+              assert.equal(replay._tag === "accepted" && replay.outcome, "duplicate");
+            }),
+          { sql, workers: new Map() },
+        );
+        yield* TestClock.adjust("7 days");
+        const expired = yield* service.triggerWebhook(request);
+        assert.equal(expired._tag === "accepted" && expired.outcome, "accepted");
+        yield* Queue.take(launches);
+        assert.include(
+          (yield* service.listWebhookDeliveries({
+            id: task.id,
+            acceptAnyOutcome: true,
+          })).deliveries.map((d) => d.outcome),
+          "duplicate",
+        );
+      }),
+    { workers: new Map() },
+  ),
+);
+
+it.effect.each([1, 3])(
+  "coalesces %i deliveries into one run with the latest body, headers and query",
+  (count) => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              prompt: "{{body.value}} {{headers.version}} {{query.version}}",
+              schedule: {
+                type: "webhook",
+                dedupe: { coalesceKey: "{{body.key}}", coalesceWindowSeconds: 10 },
+              },
+            }),
+          );
+          for (let value = 1; value <= count; value++) {
+            const bodyText = JSON.stringify({ key: "B", value });
+            yield* service.triggerWebhook(
+              requestFor(task, {
+                bodyText,
+                body: new TextEncoder().encode(bodyText),
+                headers: { version: String(value) },
+                query: `version=${value}`,
+              }),
+            );
+            if (value < count) yield* TestClock.adjust("2 seconds");
+          }
+          const owner = (yield* service.listWebhookDeliveries({
+            id: task.id,
+            acceptAnyOutcome: true,
+          })).deliveries.find((delivery) => delivery.outcome === "accepted")!;
+          assert.isTrue(owner.pendingWindow);
+          const beforeDispatch = (yield* service.getWebhookDelivery({
+            id: task.id,
+            deliveryId: owner.id,
+            acceptAnyOutcome: true,
+          })).delivery;
+          assert.isTrue(beforeDispatch.pendingWindow);
+          assert.equal(beforeDispatch.body, JSON.stringify({ key: "B", value: count }));
+          assert.equal(beforeDispatch.headers.version, String(count));
+          assert.equal(beforeDispatch.query, `version=${count}`);
+          assert.equal(
+            beforeDispatch.bodyBytes,
+            new TextEncoder().encode(beforeDispatch.body).byteLength,
+          );
+          assert.equal(yield* Queue.size(launches), 0);
+          yield* workers.get("webhook-coalescing")!;
+          assert.equal(yield* Queue.size(launches), 0);
+          yield* TestClock.adjust(count === 1 ? "10 seconds" : "6 seconds");
+          yield* workers.get("webhook-coalescing")!;
+          const launched = yield* Queue.take(launches);
+          assert.equal(
+            (launched.initialMessage!.text.match(new RegExp(`>${count}<`, "g")) ?? []).length,
+            3,
+          );
+          yield* workers.get("webhook-coalescing")!;
+          assert.equal(yield* Queue.size(launches), 0);
+          const outcomes = (yield* service.listWebhookDeliveries({
+            id: task.id,
+            acceptAnyOutcome: true,
+          })).deliveries.map((d) => d.outcome);
+          const afterDispatch = (yield* service.getWebhookDelivery({
+            id: task.id,
+            deliveryId: owner.id,
+            acceptAnyOutcome: true,
+          })).delivery;
+          assert.isFalse(afterDispatch.pendingWindow);
+          assert.equal(afterDispatch.body, beforeDispatch.body);
+          assert.include(afterDispatch.renderedPrompt!, `>${count}<`);
+          assert.equal(outcomes.filter((o) => o === "accepted").length, 1);
+          assert.equal(outcomes.filter((o) => o === "coalesced").length, count - 1);
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect("recovers a persisted coalescing window after restarting the service", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: {
+              type: "webhook",
+              dedupe: { coalesceKey: "{{headers.content-type}}", coalesceWindowSeconds: 10 },
+            },
+          }),
+        );
+        yield* service.triggerWebhook(requestFor(task));
+        yield* TestClock.adjust("4 seconds");
+        const restartedWorkers = new Map<string, Effect.Effect<void>>();
+        yield* withService(
+          ({ launches }) =>
+            Effect.gen(function* () {
+              yield* restartedWorkers.get("webhook-coalescing")!;
+              assert.equal(yield* Queue.size(launches), 0);
+              yield* TestClock.adjust("6 seconds");
+              yield* restartedWorkers.get("webhook-coalescing")!;
+              yield* Queue.take(launches);
+              yield* restartedWorkers.get("webhook-coalescing")!;
+              assert.equal(yield* Queue.size(launches), 0);
+              assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_pending`).length, 0);
+            }),
+          { sql, workers: restartedWorkers },
+        );
+      }),
+    { workers },
+  );
+});
+
+it.effect("empty dedupe key renders run normally and malformed templates fail at save time", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            dedupe: { replayKey: "{{headers.absent}}", coalesceKey: "{{body.absent}}" },
+          },
+        }),
+      );
+      for (let i = 0; i < 2; i++) {
+        const result = yield* service.triggerWebhook(requestFor(task, { headers: { absent: "" } }));
+        assert.equal(result._tag === "accepted" && result.outcome, "accepted");
+        yield* Queue.take(launches);
+      }
+      for (const replayKey of ["literal", "{{body.bad"]) {
+        const invalid = yield* webhookTaskInput({
+          schedule: { type: "webhook", dedupe: { replayKey } },
+        }).pipe(Effect.result);
+        assert.equal(invalid._tag, "Failure");
+      }
+      for (const coalesceWindowSeconds of [9, 3601, 10.5]) {
+        const result = yield* webhookTaskInput({
+          schedule: { type: "webhook", dedupe: { coalesceWindowSeconds } },
+        }).pipe(Effect.result);
+        assert.equal(result._tag, "Failure");
+      }
+    }),
+  ),
+);
+
+it.effect("applies replay before coalescing and defaults the fixed window to 120 seconds", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.value}}",
+            schedule: {
+              type: "webhook",
+              dedupe: { replayKey: "{{headers.delivery-id}}", coalesceKey: "{{body.group}}" },
+            },
+          }),
+        );
+        const request = (id: string, value: string) => {
+          const bodyText = JSON.stringify({ group: "B", value });
+          return requestFor(task, {
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            headers: { "delivery-id": id },
+          });
+        };
+        yield* service.triggerWebhook(request("B1", "first"));
+        yield* service.triggerWebhook(request("B2", "latest"));
+        const replay = yield* service.triggerWebhook(
+          request("B2", "replay must not replace latest"),
+        );
+        assert.equal(replay._tag === "accepted" && replay.outcome, "duplicate");
+        yield* TestClock.adjust("119 seconds");
+        yield* workers.get("webhook-coalescing")!;
+        assert.equal(yield* Queue.size(launches), 0);
+        yield* TestClock.adjust("1 second");
+        yield* workers.get("webhook-coalescing")!;
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, ">latest<");
+      }),
+    { workers },
+  );
+});
+
+it.effect("rolls back replay and pending state when recording a delivery fails", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: {
+              type: "webhook",
+              dedupe: {
+                replayKey: "{{headers.content-type}}",
+                coalesceKey: "{{headers.content-type}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        yield* sql`CREATE TRIGGER fail_dedupe_log BEFORE INSERT ON scheduled_task_webhook_deliveries BEGIN SELECT RAISE(FAIL, 'injected'); END`;
+        yield* service.triggerWebhook(requestFor(task)).pipe(Effect.flip);
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_pending`).length, 0);
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 0);
+        yield* sql`DROP TRIGGER fail_dedupe_log`;
+        const retry = yield* service.triggerWebhook(requestFor(task));
+        assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+        yield* TestClock.adjust("10 seconds");
+        yield* workers.get("webhook-coalescing")!;
+        yield* Queue.take(launches);
+      }),
+    { workers },
+  );
+});
+
+it.effect("starts a new fixed window at the deadline without replacing the expired payload", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body}}",
+            schedule: {
+              type: "webhook",
+              dedupe: { coalesceKey: "{{headers.content-type}}", coalesceWindowSeconds: 10 },
+            },
+          }),
+        );
+        const request = (bodyText: string) =>
+          requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) });
+        yield* service.triggerWebhook(request("first"));
+        yield* TestClock.adjust("10 seconds");
+        yield* service.triggerWebhook(request("second"));
+        yield* workers.get("webhook-coalescing")!;
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, ">first<");
+        assert.equal(yield* Queue.size(launches), 0);
+        yield* TestClock.adjust("10 seconds");
+        yield* workers.get("webhook-coalescing")!;
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, ">second<");
+      }),
+    { workers },
+  );
+});
+
+it.effect("pausing a pending task prevents dispatch and deletion clears its dedupe state", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, launches, sql }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: {
+              type: "webhook",
+              dedupe: {
+                replayKey: "{{headers.content-type}}",
+                coalesceKey: "{{headers.content-type}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        yield* service.triggerWebhook(requestFor(task));
+        yield* service.setEnabled({ id: task.id, enabled: false });
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.equal(yield* Queue.size(launches), 0);
+        assert.equal(
+          (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true }))
+            .deliveries[0]?.outcome,
+          "dispatch_failed",
+        );
+        yield* service.delete({ id: task.id });
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 0);
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_pending`).length, 0);
+      }),
+    { workers },
+  );
+});
+
+it.effect(
+  "caps duplicate writes at ten per minute without evicting runs or consuming their rate slots",
+  () =>
+    withService(({ service, launches, sql }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: { type: "webhook", dedupe: { replayKey: "{{body}}" } },
+          }),
+        );
+        yield* service.triggerWebhook(requestFor(task));
+        yield* Queue.take(launches);
+        const before = yield* deliveriesCounted("duplicate", "direct");
+        for (let i = 0; i < 75; i++) {
+          const result = yield* service.triggerWebhook(requestFor(task));
+          assert.equal(result._tag === "accepted" && result.outcome, "duplicate");
+        }
+        assert.equal((yield* deliveriesCounted("duplicate", "direct")) - before, 75);
+        const rows = (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true }))
+          .deliveries;
+        assert.equal(rows.filter((row) => row.outcome === "duplicate").length, 10);
+        assert.equal(rows.filter((row) => row.outcome === "accepted").length, 1);
+        const keys = yield* sql<{
+          replay_key: string;
+        }>`SELECT replay_key FROM scheduled_task_webhook_replay_keys`;
+        assert.match(keys[0]!.replay_key, /^[a-f0-9]{64}$/);
+        for (let i = 0; i < 59; i++) {
+          const bodyText = JSON.stringify({ i });
+          const result = yield* service.triggerWebhook(
+            requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) }),
+          );
+          assert.equal(result._tag, "accepted");
+          yield* Queue.take(launches);
+        }
+      }),
+    ),
+);
+
+it.effect("caps coalesced history while persisting the latest overflow payload", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.value}}",
+            schedule: {
+              type: "webhook",
+              dedupe: { replayKey: "{{headers.delivery-id}}", coalesceKey: "{{body.group}}" },
+            },
+          }),
+        );
+        const request = (i: number) => {
+          const bodyText = JSON.stringify({ group: "B", value: i });
+          return requestFor(task, {
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            headers: { "delivery-id": String(i) },
+          });
+        };
+        for (let i = 0; i < 40; i++)
+          assert.equal((yield* service.triggerWebhook(request(i)))._tag, "accepted");
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 40);
+        const rows = (yield* service.listWebhookDeliveries({
+          id: task.id,
+          acceptAnyOutcome: true,
+        })).deliveries;
+        assert.equal(rows.filter((row) => row.outcome === "coalesced").length, 10);
+        assert.equal(rows.filter((row) => row.outcome === "accepted").length, 1);
+        const pending = yield* sql<{
+          coalesce_key: string;
+        }>`SELECT coalesce_key FROM scheduled_task_webhook_pending`;
+        assert.match(pending[0]!.coalesce_key, /^[a-f0-9]{64}$/);
+        yield* TestClock.adjust("120 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, ">39<");
+        assert.equal(yield* Queue.size(launches), 0);
+      }),
+    { workers },
+  );
+});
+
+it.effect("a partially missing key is empty even with a literal prefix", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            dedupe: { replayKey: "gh:{{headers.absent}}", coalesceKey: "pr:{{body.absent}}" },
+          },
+        }),
+      );
+      for (let i = 0; i < 2; i++) {
+        const result = yield* service.triggerWebhook(requestFor(task, { headers: { absent: "" } }));
+        assert.equal(result._tag === "accepted" && result.outcome, "accepted");
+        yield* Queue.take(launches);
+      }
+    }),
+  ),
+);
+
+it.effect("queue-full deliveries release replay keys so a later retry runs", () =>
+  Effect.gen(function* () {
+    const gate = yield* Deferred.make<void>();
+    yield* withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: { type: "webhook", dedupe: { replayKey: "{{headers.delivery-id}}" } },
+            }),
+          );
+          const request = (i: number) =>
+            requestFor(task, { headers: { "delivery-id": String(i) } });
+          for (let i = 0; i < 20; i++) yield* service.triggerWebhook(request(i));
+          yield* Queue.take(launches);
+          const full = yield* service.triggerWebhook(request(20));
+          assert.equal(full._tag === "rate_limited" && full.outcome, "queue_full");
+          yield* Deferred.succeed(gate, undefined);
+          for (let i = 1; i < 20; i++) yield* Queue.take(launches);
+          const retry = yield* service.triggerWebhook(request(20));
+          assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+          yield* Queue.take(launches);
+        }),
+      { gate },
+    );
+  }),
+);
+
+it.effect.each(["task_json", "request_json"] as const)(
+  "removes corrupt pending %s instead of retrying forever",
+  (column) => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, sql }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: {
+                type: "webhook",
+                dedupe: {
+                  replayKey: "{{body}}",
+                  coalesceKey: "{{body}}",
+                  coalesceWindowSeconds: 10,
+                },
+              },
+            }),
+          );
+          yield* service.triggerWebhook(requestFor(task));
+          yield* sql`UPDATE scheduled_task_webhook_pending SET ${sql(column)} = 'broken'`;
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_pending`).length, 0);
+          assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 0);
+          assert.equal(
+            (yield* service.listWebhookDeliveries({ id: task.id })).deliveries[0]!.outcome,
+            "dispatch_failed",
+          );
+          yield* workers.get("webhook-coalescing")!;
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect(
+  "restarting after a coalesced launch before pending deletion does not launch or count it twice",
+  () => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, sql, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: {
+                type: "webhook",
+                dedupe: { coalesceKey: "{{body}}", coalesceWindowSeconds: 10 },
+              },
+            }),
+          );
+          const accepted = yield* service.triggerWebhook(requestFor(task));
+          yield* sql`CREATE TRIGGER fail_pending_delete BEFORE DELETE ON scheduled_task_webhook_pending BEGIN SELECT RAISE(FAIL,'crash after launch'); END`;
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          const launch = yield* Queue.take(launches);
+          assert.equal(
+            launch.commandId,
+            `scheduled-task:${task.id}:webhook:${accepted._tag === "accepted" && accepted.deliveryId}`,
+          );
+          assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+          assert.equal(
+            (yield* sql`SELECT * FROM scheduled_task_webhook_pending WHERE state = 'completed'`)
+              .length,
+            1,
+          );
+          yield* sql`DROP TRIGGER fail_pending_delete`;
+          const restartedWorkers = new Map<string, Effect.Effect<void>>();
+          yield* withService(
+            ({ service: restarted, launches: secondLaunches }) =>
+              Effect.gen(function* () {
+                yield* drainPendingDispatch(restartedWorkers);
+                assert.equal(yield* Queue.size(secondLaunches), 0);
+                assert.equal((yield* restarted.list()).tasks[0]!.runCount, 1);
+                assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_pending`).length, 0);
+              }),
+            { sql, workers: restartedWorkers },
+          );
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect("many windows on a busy task share one worker without delaying another task", () =>
+  Effect.gen(function* () {
+    const gate = yield* Deferred.make<void>();
+    const workers = new Map<string, Effect.Effect<void>>();
+    yield* withService(
+      ({ service, launches, sql }) =>
+        Effect.gen(function* () {
+          const schedule = {
+            type: "webhook",
+            dedupe: { coalesceKey: "{{body.group}}", coalesceWindowSeconds: 10 },
+          };
+          const { task: a } = yield* service.upsert(
+            yield* webhookTaskInput({ id: "scheduled-task:a", title: "A", schedule }),
+          );
+          const { task: b } = yield* service.upsert(
+            yield* webhookTaskInput({ id: "scheduled-task:b", title: "B", schedule }),
+          );
+          yield* service.triggerWebhook(requestFor(a));
+          assert.equal((yield* Queue.take(launches)).title, "A");
+          const pendingRequest = (task: typeof a, group: string) => {
+            const bodyText = JSON.stringify({ group });
+            return requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) });
+          };
+          for (let i = 0; i < 19; i++) {
+            const result = yield* service.triggerWebhook(pendingRequest(a, String(i)));
+            assert.equal(result._tag === "accepted" && result.outcome, "accepted");
+          }
+          const overflow = pendingRequest(a, "overflow");
+          const full = yield* service.triggerWebhook({ ...overflow, relayDeliveryId: "overflow" });
+          assert.equal(full._tag === "rate_limited" && full.outcome, "queue_full");
+          assert.equal((yield* service.triggerWebhook(requestFor(a)))._tag, "rate_limited");
+          yield* service.triggerWebhook(pendingRequest(b, "B"));
+          let dispatchWorkers = 0;
+          const drained = yield* Deferred.make<void>();
+          let finishedWorkers = 0;
+          const tracer = Tracer.make({
+            span: (options) => {
+              if (options.name === "ScheduledTaskService.dispatchPendingWebhook") dispatchWorkers++;
+              const span = new Tracer.NativeSpan(options);
+              const end = span.end.bind(span);
+              span.end = (...args) => {
+                end(...args);
+                if (
+                  options.name === "ScheduledTaskService.dispatchPendingWebhook" &&
+                  ++finishedWorkers === 2
+                )
+                  Deferred.doneUnsafe(drained, Effect.void);
+              };
+              return span;
+            },
+          });
+          yield* TestClock.adjust("10 seconds");
+          yield* workers.get("webhook-coalescing")!.pipe(Effect.withTracer(tracer));
+          assert.equal((yield* Queue.take(launches)).title, "B");
+          for (let i = 0; i < 10; i++)
+            yield* workers.get("webhook-coalescing")!.pipe(Effect.withTracer(tracer));
+          assert.equal(dispatchWorkers, 2);
+          assert.equal(
+            (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE task_id = ${a.id}`)
+              .length,
+            19,
+          );
+          yield* Deferred.succeed(gate, undefined);
+          yield* Deferred.await(drained);
+          for (let i = 0; i < 19; i++) assert.equal((yield* Queue.take(launches)).title, "A");
+          const retried = yield* service.triggerWebhook({
+            ...overflow,
+            relayDeliveryId: "overflow",
+          });
+          assert.equal(retried._tag === "accepted" && retried.outcome, "accepted");
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          assert.equal((yield* Queue.take(launches)).title, "A");
+        }),
+      { workers, gateForTask: (input) => (input.title === "A" ? gate : undefined) },
+    );
+  }),
+);
+
+it.effect("guards bad-signature floods separately from valid run admission", () =>
+  withService(({ service, sql }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            signature: { header: "signature", encoding: "hex", prefix: "", secret: "secret" },
+          },
+        }),
+      );
+      const results = yield* Effect.forEach(Array.from({ length: 75 }), () =>
+        service.triggerWebhook(requestFor(task)),
+      );
+      assert.equal(results.filter((result) => result._tag === "rejected_signature").length, 60);
+      assert.equal(results.filter((result) => result._tag === "rate_limited").length, 15);
+      assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_deliveries`).length, 51);
+    }),
+  ),
+);
+
+it.effect("start failures release both replay keys and relay claims for redelivery", () =>
+  withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: { type: "webhook", dedupe: { replayKey: "{{body}}" } },
+          }),
+        );
+        const request = requestFor(task, { relayDeliveryId: "failed-start" });
+        yield* waitForSpan(
+          service.triggerWebhook(request),
+          "ScheduledTaskService.runWebhookDelivery",
+        );
+        yield* Queue.take(launches);
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 0);
+        assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_relay_deliveries`).length, 0);
+        const retry = yield* waitForSpan(
+          service.triggerWebhook(request),
+          "ScheduledTaskService.runWebhookDelivery",
+        );
+        assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+        yield* Queue.take(launches);
+        assert.equal((yield* service.list()).tasks[0]!.lastRunStatus, "succeeded");
+      }),
+    { failLaunches: { remaining: 1 } },
+  ),
+);
+
+it.effect("bounds oversized prompt floods without evicting run or filtered history", () =>
+  withService(({ service, sql, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* webhookTaskInput({ prompt: "{{body}}" }));
+      const accepted = yield* service.triggerWebhook(requestFor(task));
+      yield* Queue.take(launches);
+      assert.equal(accepted._tag, "accepted");
+      // A sibling filter step owns these rows; suppression must preserve its bucket too.
+      yield* sql`INSERT INTO scheduled_task_webhook_deliveries
+      SELECT 'filtered-fixture', task_id, received_at, method, query, headers_json, body,
+        body_bytes, body_truncated, 'filtered', signature_verified, missing_fields_json, rendered_prompt, error
+      FROM scheduled_task_webhook_deliveries LIMIT 1`;
+      const bodyText = "x".repeat(200_000);
+      const request = requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) });
+      const outcomes = yield* Effect.forEach(Array.from({ length: 75 }), () =>
+        service.triggerWebhook(request),
+      );
+      assert.equal(outcomes.filter((result) => result._tag === "accepted").length, 60);
+      assert.equal(outcomes.filter((result) => result._tag === "rate_limited").length, 15);
+      const rows = yield* sql<{
+        outcome: string;
+      }>`SELECT outcome FROM scheduled_task_webhook_deliveries`;
+      assert.equal(rows.filter((row) => row.outcome === "accepted").length, 1);
+      assert.equal(rows.filter((row) => row.outcome === "filtered").length, 1);
+      assert.equal(rows.length, 22);
+      assert.equal(yield* Queue.size(launches), 0);
+      yield* TestClock.adjust("61 seconds");
+      assert.equal((yield* service.triggerWebhook(requestFor(task)))._tag, "accepted");
+      yield* Queue.take(launches);
+    }),
+  ),
+);
+
+it.effect("single delivery lookup hides new outcomes unless the client opts in", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            dedupe: { replayKey: "{{body}}", coalesceKey: "{{body.group}}" },
+          },
+        }),
+      );
+      yield* service.triggerWebhook(requestFor(task));
+      yield* Queue.take(launches);
+      yield* service.triggerWebhook(requestFor(task));
+      for (const value of [1, 2]) {
+        const bodyText = JSON.stringify({ group: "B", value });
+        yield* service.triggerWebhook(
+          requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) }),
+        );
+      }
+      const rows = (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true }))
+        .deliveries;
+      for (const row of rows.filter(
+        (row) => row.outcome === "duplicate" || row.outcome === "coalesced",
+      )) {
+        const input = { id: task.id, deliveryId: row.id };
+        const hidden = yield* service.getWebhookDelivery(input).pipe(Effect.result);
+        assert.equal(hidden._tag, "Failure");
+        assert.equal(
+          (yield* service.getWebhookDelivery({ ...input, acceptAnyOutcome: true })).delivery
+            .outcome,
+          row.outcome,
+        );
+      }
+      assert.equal(
+        rows.filter((row) => row.outcome === "duplicate" || row.outcome === "coalesced").length,
+        2,
+      );
+    }),
+  ),
+);
+
+it.effect("main retention keeps fifty runs and preserves filtered and dedupe buckets", () =>
+  withService(({ service, sql, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* webhookTaskInput());
+      yield* service.triggerWebhook(requestFor(task));
+      yield* Queue.take(launches);
+      for (const outcome of ["filtered", "duplicate"]) {
+        yield* sql`WITH RECURSIVE n(value) AS (SELECT 1 UNION ALL SELECT value + 1 FROM n WHERE value < 20)
+        INSERT INTO scheduled_task_webhook_deliveries
+        SELECT ${outcome} || n.value, d.task_id, d.received_at, d.method, d.query, d.headers_json, d.body,
+          d.body_bytes, d.body_truncated, ${outcome}, d.signature_verified, d.missing_fields_json, d.rendered_prompt, d.error
+        FROM n CROSS JOIN (SELECT * FROM scheduled_task_webhook_deliveries WHERE outcome = 'accepted' LIMIT 1) d`;
+      }
+      for (let i = 0; i < 59; i++) {
+        assert.equal((yield* service.triggerWebhook(requestFor(task)))._tag, "accepted");
+        yield* Queue.take(launches);
+      }
+      const counts = yield* sql<{
+        outcome: string;
+        count: number;
+      }>`SELECT outcome, COUNT(*) AS count FROM scheduled_task_webhook_deliveries GROUP BY outcome ORDER BY outcome`;
+      assert.deepEqual(counts, [
+        { outcome: "accepted", count: 50 },
+        { outcome: "duplicate", count: 20 },
+        { outcome: "filtered", count: 20 },
+      ]);
+    }),
+  ),
+);
+
+it.effect(
+  "a valid request refunds its own reservation without expiring an interleaved rejection",
+  () =>
+    Effect.gen(function* () {
+      const started = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      yield* withService(
+        ({ service, launches }) =>
+          Effect.gen(function* () {
+            const { task } = yield* service.upsert(
+              yield* webhookTaskInput({
+                schedule: {
+                  type: "webhook",
+                  signature: { header: "signature", encoding: "hex", prefix: "", secret: "secret" },
+                },
+              }),
+            );
+            const signature = NodeCrypto.createHmac("sha256", "secret")
+              .update(pullRequestBody)
+              .digest("hex");
+            const valid = yield* service
+              .triggerWebhook(requestFor(task, { headers: { signature } }))
+              .pipe(Effect.forkChild);
+            yield* Deferred.await(started);
+            yield* TestClock.adjust("30 seconds");
+            assert.equal(
+              (yield* service.triggerWebhook(requestFor(task)))._tag,
+              "rejected_signature",
+            );
+            yield* Deferred.succeed(release, undefined);
+            assert.equal((yield* Fiber.join(valid))._tag, "accepted");
+            yield* Queue.take(launches);
+            // Only the valid reservation would have expired now; the rejection must still count.
+            yield* TestClock.adjust("31 seconds");
+            for (let i = 0; i < 59; i++)
+              assert.equal(
+                (yield* service.triggerWebhook(requestFor(task)))._tag,
+                "rejected_signature",
+              );
+            assert.equal((yield* service.triggerWebhook(requestFor(task)))._tag, "rate_limited");
+          }),
+        { frameGate: { started, release } },
+      );
+    }),
+);
+
+it.effect("keeps replay keys when dispatch succeeds but completion bookkeeping fails", () =>
+  withService(({ service, sql, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            dedupe: { replayKey: "{{body}}" },
+          },
+        }),
+      );
+      yield* sql`CREATE TRIGGER fail_completion BEFORE UPDATE ON scheduled_tasks
+      WHEN NEW.last_run_status = 'succeeded' BEGIN SELECT RAISE(FAIL, 'completion unavailable'); END`;
+      yield* waitForSpan(
+        service.triggerWebhook(requestFor(task)),
+        "ScheduledTaskService.runWebhookDelivery",
+      );
+      yield* Queue.take(launches);
+      assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 1);
+      yield* sql`DROP TRIGGER fail_completion`;
+      const retry = yield* service.triggerWebhook(requestFor(task));
+      assert.equal(retry._tag === "accepted" && retry.outcome, "duplicate");
+      assert.equal(yield* Queue.size(launches), 0);
+      assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+    }),
+  ),
+);
+
+it.effect("restart before a coalesced completion commits counts the delivery once", () =>
+  Effect.gen(function* () {
+    const gate = yield* Deferred.make<void>();
+    const completedLaunches = new Set<string>();
+    const workers = new Map<string, Effect.Effect<void>>();
+    yield* withService(
+      ({ service, sql, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: {
+                type: "webhook",
+                dedupe: {
+                  replayKey: "{{body}}",
+                  coalesceKey: "{{body}}",
+                  coalesceWindowSeconds: 10,
+                },
+              },
+            }),
+          );
+          yield* service.triggerWebhook(requestFor(task));
+          yield* TestClock.adjust("10 seconds");
+          yield* workers.get("webhook-coalescing")!;
+          const launch = yield* Queue.take(launches);
+          assert.isTrue(completedLaunches.has(launch.commandId));
+          assert.equal(
+            (yield* sql<{ state: string }>`SELECT state FROM scheduled_task_webhook_pending`)[0]!
+              .state,
+            "running",
+          );
+          assert.equal(
+            (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE state = 'completed'`)
+              .length,
+            0,
+          );
+          assert.equal((yield* service.list()).tasks[0]!.lastRunStatus, "running");
+          const restartedWorkers = new Map<string, Effect.Effect<void>>();
+          yield* withService(
+            ({ service: restarted, launches: recoveredLaunches }) =>
+              Effect.gen(function* () {
+                assert.equal((yield* restarted.list()).tasks[0]!.runCount, 0);
+                yield* drainPendingDispatch(restartedWorkers);
+                assert.equal(yield* Queue.size(recoveredLaunches), 0);
+                assert.equal((yield* restarted.list()).tasks[0]!.runCount, 1);
+                assert.equal((yield* restarted.list()).tasks[0]!.lastRunStatus, "succeeded");
+                assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+                const retry = yield* restarted.triggerWebhook(requestFor(task));
+                assert.equal(retry._tag === "accepted" && retry.outcome, "duplicate");
+              }),
+            { sql, workers: restartedWorkers, completedLaunches },
+          );
+        }),
+      { workers, gate, completedLaunches },
+    );
+  }),
+);
+
+it.effect.each([119_000, 120_000])(
+  "bounds coalesced prompt logs and checks trimmed length for %i body characters",
+  (length) => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              prompt: `{{body.absent}}${" ".repeat(10_000)}{{body.text}}`,
+              schedule: {
+                type: "webhook",
+                dedupe: { coalesceKey: "{{body.group}}", coalesceWindowSeconds: 10 },
+              },
+            }),
+          );
+          const bodyText = JSON.stringify({ group: "B", text: "x".repeat(length) });
+          const accepted = yield* service.triggerWebhook(
+            requestFor(task, { bodyText, body: new TextEncoder().encode(bodyText) }),
+          );
+          assert.equal(accepted._tag, "accepted");
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          const delivery = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries[0]!;
+          if (length === 119_000) {
+            const launch = yield* Queue.take(launches);
+            assert.isAbove(launch.initialMessage!.text.length, 120_000);
+            assert.equal(delivery.outcome, "accepted");
+            const detail = yield* service.getWebhookDelivery({
+              id: task.id,
+              deliveryId: delivery.id,
+            });
+            assert.equal(detail.delivery.renderedPrompt!.length, 64 * 1024);
+          } else {
+            assert.equal(yield* Queue.size(launches), 0);
+            assert.equal(delivery.outcome, "dispatch_failed");
+            assert.equal(delivery.error, "The filled-in prompt is too long.");
+          }
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect("retries coalesced completion bookkeeping without launching or counting twice", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: {
+              type: "webhook",
+              dedupe: { replayKey: "{{body}}", coalesceKey: "{{body}}", coalesceWindowSeconds: 10 },
+            },
+          }),
+        );
+        yield* service.triggerWebhook(requestFor(task));
+        yield* sql`CREATE TRIGGER fail_coalesced_completion BEFORE UPDATE ON scheduled_tasks
+      WHEN NEW.last_run_status = 'succeeded' BEGIN SELECT RAISE(FAIL, 'completion unavailable'); END`;
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        yield* Queue.take(launches);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 1);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 1);
+        assert.equal(
+          (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE state = 'completed'`)
+            .length,
+          0,
+        );
+        assert.equal((yield* service.list()).tasks[0]!.runCount, 0);
+        yield* sql`DROP TRIGGER fail_coalesced_completion`;
+        yield* drainPendingDispatch(workers);
+        assert.equal(yield* Queue.size(launches), 0);
+        assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+        const delivery = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries[0]!;
+        assert.equal(delivery.outcome, "accepted");
+        assert.equal(delivery.error, null);
+      }),
+    { workers, completedLaunches: new Set() },
+  );
+});
+
+it.effect("propagates coalescing log failures with their task id and rolls back acceptance", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            schedule: {
+              type: "webhook",
+              dedupe: { replayKey: "{{body}}", coalesceKey: "{{body}}", coalesceWindowSeconds: 10 },
+            },
+          }),
+        );
+        const request = requestFor(task, { relayDeliveryId: "coalescing-log-failure" });
+        yield* sql`CREATE TRIGGER fail_coalescing_log BEFORE INSERT ON scheduled_task_webhook_deliveries
+      BEGIN SELECT RAISE(FAIL, 'injected coalescing log failure'); END`;
+        const error = yield* service.triggerWebhook(request).pipe(Effect.flip);
+        assert.equal(error.message, "Could not record webhook delivery.");
+        assert.equal(error.taskId, task.id);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length, 0);
+        yield* sql`DROP TRIGGER fail_coalescing_log`;
+        assert.equal((yield* service.triggerWebhook(request))._tag, "accepted");
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        yield* Queue.take(launches);
+      }),
+    { workers },
+  );
+});
+
+it.effect.each([1, 11])(
+  "keeps relay claims for %i coalesced updates after their window closes",
+  (count) => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, sql, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              prompt: "{{body.value}}",
+              schedule: {
+                type: "webhook",
+                dedupe: { coalesceKey: "{{body.group}}", coalesceWindowSeconds: 10 },
+              },
+            }),
+          );
+          const request = (value: number) => {
+            const bodyText = JSON.stringify({ group: "B", value });
+            return requestFor(task, {
+              relayDeliveryId: `coalesced-relay-${value}`,
+              bodyText,
+              body: new TextEncoder().encode(bodyText),
+            });
+          };
+          yield* service.triggerWebhook(request(0));
+          for (let i = 1; i <= count; i++) {
+            const result = yield* service.triggerWebhook(request(i));
+            assert.equal(result._tag === "accepted" && result.outcome, "coalesced");
+          }
+          assert.equal(
+            (yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length,
+            count + 1,
+          );
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          assert.include((yield* Queue.take(launches)).initialMessage!.text, `>${count}<`);
+          const retry = yield* service.triggerWebhook(request(count));
+          assert.equal(retry._tag === "accepted" && retry.outcome, "duplicate");
+          assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+          assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+          assert.equal(yield* Queue.size(launches), 0);
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect("failed windows release every member's replay key and relay claim", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.value}}",
+            schedule: {
+              type: "webhook",
+              dedupe: {
+                replayKey: "{{headers.delivery-id}}",
+                coalesceKey: "{{body.group}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        const request = (id: string) => {
+          const bodyText = JSON.stringify({ group: "same", value: id });
+          return requestFor(task, {
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            headers: { "delivery-id": id },
+            relayDeliveryId: id,
+          });
+        };
+        yield* service.triggerWebhook(request("A"));
+        for (let i = 0; i < 12; i++) yield* service.triggerWebhook(request(`B${i}`));
+        assert.equal(
+          (yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length,
+          13,
+        );
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        yield* Queue.take(launches);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length, 0);
+        const retry = yield* service.triggerWebhook(request("B11"));
+        assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, "B11");
+        assert.equal((yield* service.list()).tasks[0]!.runCount, 2);
+      }),
+    { workers, failLaunches: { remaining: 1 } },
+  );
+});
+
+it.effect(
+  "rejects a twenty-first persisted window and accepts its relay retry after draining",
+  () => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, sql, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              prompt: "{{body.group}}",
+              schedule: {
+                type: "webhook",
+                dedupe: {
+                  replayKey: "{{body.group}}",
+                  coalesceKey: "{{body.group}}",
+                  coalesceWindowSeconds: 10,
+                },
+              },
+            }),
+          );
+          const request = (group: number) => {
+            const bodyText = JSON.stringify({ group });
+            return requestFor(task, {
+              bodyText,
+              body: new TextEncoder().encode(bodyText),
+              relayDeliveryId: `window-${group}`,
+            });
+          };
+          for (let i = 0; i < 20; i++)
+            assert.equal((yield* service.triggerWebhook(request(i)))._tag, "accepted");
+          const overflow = yield* service.triggerWebhook(request(20));
+          assert.equal(overflow._tag === "rate_limited" && overflow.outcome, "queue_full");
+          assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 20);
+          assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 20);
+          assert.equal(
+            (yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length,
+            20,
+          );
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          for (let i = 0; i < 20; i++) yield* Queue.take(launches);
+          assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+          const retry = yield* service.triggerWebhook(request(20));
+          assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          assert.include((yield* Queue.take(launches)).initialMessage!.text, "20");
+          assert.equal((yield* service.list()).tasks[0]!.runCount, 21);
+        }),
+      { workers },
+    );
+  },
+);
+
+it.effect(
+  "recovery finishes failed-window claim cleanup without counting the attempt twice",
+  () => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    return withService(
+      ({ service, sql, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: {
+                type: "webhook",
+                dedupe: {
+                  replayKey: "{{headers.delivery-id}}",
+                  coalesceKey: "{{body}}",
+                  coalesceWindowSeconds: 10,
+                },
+              },
+            }),
+          );
+          const request = (id: string) =>
+            requestFor(task, { headers: { "delivery-id": id }, relayDeliveryId: id });
+          yield* service.triggerWebhook(request("A"));
+          yield* service.triggerWebhook(request("B"));
+          yield* sql`CREATE TRIGGER fail_claim_cleanup BEFORE DELETE ON scheduled_task_webhook_relay_deliveries
+      BEGIN SELECT RAISE(FAIL, 'cleanup unavailable'); END`;
+          yield* TestClock.adjust("10 seconds");
+          yield* drainPendingDispatch(workers);
+          yield* Queue.take(launches);
+          assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+          assert.equal(
+            (yield* sql<{ state: string }>`SELECT state FROM scheduled_task_webhook_pending`)[0]!
+              .state,
+            "failed",
+          );
+          yield* sql`DROP TRIGGER fail_claim_cleanup`;
+          const restartedWorkers = new Map<string, Effect.Effect<void>>();
+          yield* withService(
+            ({ service: restarted, launches: restartedLaunches }) =>
+              Effect.gen(function* () {
+                yield* drainPendingDispatch(restartedWorkers);
+                assert.equal(yield* Queue.size(restartedLaunches), 0);
+                assert.equal((yield* restarted.list()).tasks[0]!.runCount, 1);
+                assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+                assert.equal(
+                  (yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length,
+                  0,
+                );
+                assert.equal(
+                  (yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length,
+                  0,
+                );
+                const retry = yield* restarted.triggerWebhook(request("B"));
+                assert.equal(retry._tag === "accepted" && retry.outcome, "accepted");
+                yield* TestClock.adjust("10 seconds");
+                yield* drainPendingDispatch(restartedWorkers);
+                yield* Queue.take(restartedLaunches);
+                assert.equal((yield* restarted.list()).tasks[0]!.runCount, 2);
+              }),
+            { sql, workers: restartedWorkers },
+          );
+        }),
+      { workers, failLaunches: { remaining: 1 } },
+    );
+  },
+);
+
+it.effect("a full run budget still accepts replay hits and the latest open-window payload", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, launches, sql }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.value}}",
+            schedule: {
+              type: "webhook",
+              dedupe: {
+                replayKey: "{{headers.delivery-id}}",
+                coalesceKey: "{{body.group}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        const request = (id: string, value: string, group?: string) => {
+          const bodyText = JSON.stringify({ value, ...(group === undefined ? {} : { group }) });
+          return requestFor(task, {
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            headers: { "delivery-id": id },
+          });
+        };
+        for (let i = 0; i < 59; i++) {
+          const result = yield* waitForSpan(
+            service.triggerWebhook(request(String(i), String(i))),
+            "ScheduledTaskService.runWebhookDelivery",
+          );
+          assert.equal(result._tag === "accepted" && result.outcome, "accepted");
+          yield* Queue.take(launches);
+        }
+        const opened = yield* service.triggerWebhook(request("B1", "old", "B"));
+        assert.equal(opened._tag === "accepted" && opened.outcome, "accepted");
+        const duplicate = yield* service.triggerWebhook(request("0", "duplicate"));
+        assert.equal(duplicate._tag === "accepted" && duplicate.outcome, "duplicate");
+        const update = yield* service.triggerWebhook(request("B2", "latest", "B"));
+        assert.equal(update._tag === "accepted" && update.outcome, "coalesced");
+        assert.equal(
+          (yield* service.triggerWebhook(request("C", "new window", "C")))._tag,
+          "rate_limited",
+        );
+        assert.equal(
+          (yield* service.triggerWebhook(request("D", "new immediate")))._tag,
+          "rate_limited",
+        );
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 1);
+        assert.equal(yield* Queue.size(launches), 0);
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, "latest");
+        assert.equal(yield* Queue.size(launches), 0);
+        assert.equal((yield* service.list()).tasks[0]!.runCount, 60);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+      }),
+    { workers },
+  );
+});
+
+it.effect("dispatches an overdue window exactly once after its deadline passed while stopped", () =>
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const task = yield* withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          const { task } = yield* service.upsert(
+            yield* webhookTaskInput({
+              schedule: {
+                type: "webhook",
+                dedupe: { coalesceKey: "{{body}}", coalesceWindowSeconds: 10 },
+              },
+            }),
+          );
+          yield* service.triggerWebhook(requestFor(task));
+          assert.equal(yield* Queue.size(launches), 0);
+          return task;
+        }),
+      { sql, workers: new Map() },
+    );
+    // The first service scope is closed before the deadline advances.
+    yield* TestClock.adjust("30 seconds");
+    const restartedWorkers = new Map<string, Effect.Effect<void>>();
+    yield* withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          yield* drainPendingDispatch(restartedWorkers);
+          yield* Queue.take(launches);
+          for (let i = 0; i < 3; i++) yield* restartedWorkers.get("webhook-coalescing")!;
+          assert.equal(yield* Queue.size(launches), 0);
+          assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+          assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+        }),
+      { sql, workers: restartedWorkers },
+    );
+    const secondRestartWorkers = new Map<string, Effect.Effect<void>>();
+    yield* withService(
+      ({ service, launches }) =>
+        Effect.gen(function* () {
+          yield* secondRestartWorkers.get("webhook-coalescing")!;
+          assert.equal(yield* Queue.size(launches), 0);
+          assert.equal(
+            (yield* service.list()).tasks.find((entry) => entry.id === task.id)!.runCount,
+            1,
+          );
+        }),
+      { sql, workers: secondRestartWorkers },
+    );
+  }).pipe(Effect.provide(SqlitePersistence.layerMemory)),
+);
+
+it.effect("removes a window with a render defect and dispatches the task's next window", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, sql, launches }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.deep}}",
+            schedule: {
+              type: "webhook",
+              dedupe: {
+                replayKey: "{{headers.delivery-id}}",
+                coalesceKey: "{{headers.group}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        const request = (id: string, bodyText: string) =>
+          requestFor(task, {
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            headers: { "delivery-id": id, group: id },
+            relayDeliveryId: id,
+          });
+        const bad = request(
+          "bad-render",
+          '{"deep":' + "[".repeat(20000) + "0" + "]".repeat(20000) + "}",
+        );
+        assert.throws(() => renderWebhookPrompt(task.prompt, bad, "frame"), RangeError);
+        const accepted = yield* service.triggerWebhook(bad);
+        assert.equal(accepted._tag, "accepted");
+        yield* service.triggerWebhook(request("good-render", '{"deep":"next window"}'));
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, "next window");
+        assert.equal(yield* Queue.size(launches), 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+        assert.equal(
+          (yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys WHERE delivery_id = 'delivery:relay:bad-render'`)
+            .length,
+          0,
+        );
+        assert.equal(
+          (yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries WHERE relay_delivery_id = 'bad-render'`)
+            .length,
+          0,
+        );
+        const failed = (yield* service.getWebhookDelivery({
+          id: task.id,
+          deliveryId: ScheduledTaskWebhookDeliveryId.make("delivery:relay:bad-render"),
+          acceptAnyOutcome: true,
+        })).delivery;
+        assert.equal(failed.outcome, "dispatch_failed");
+        assert.equal(failed.error, "The pending webhook payload could not be prepared.");
+        yield* workers.get("webhook-coalescing")!;
+        assert.equal((yield* service.list()).tasks[0]!.runCount, 1);
+      }),
+    { workers },
+  );
+});
+
+it.effect.each([false, true])(
+  "counts an interrupted immediate run beside an unrelated running window (corrupt task: %s)",
+  (corrupt) => {
+    const workers = new Map<string, Effect.Effect<void>>();
+    const completedLaunches = new Set<string>();
+    return Effect.gen(function* () {
+      const gate = yield* Deferred.make<void>();
+      yield* withService(
+        ({ service, sql, launches }) =>
+          Effect.gen(function* () {
+            const { task } = yield* service.upsert(
+              yield* webhookTaskInput({
+                prompt: "{{body.value}}",
+                schedule: {
+                  type: "webhook",
+                  dedupe: { coalesceKey: "{{headers.group}}", coalesceWindowSeconds: 10 },
+                },
+              }),
+            );
+            const window = yield* service.triggerWebhook(
+              requestFor(task, { headers: { group: "old" }, bodyText: '{"value":"old"}' }),
+            );
+            yield* sql`CREATE TRIGGER fail_old_completion BEFORE UPDATE ON scheduled_tasks
+        WHEN NEW.last_run_status = 'succeeded' BEGIN SELECT RAISE(FAIL, 'completion unavailable'); END`;
+            yield* TestClock.adjust("10 seconds");
+            yield* drainPendingDispatch(workers);
+            yield* Queue.take(launches);
+            yield* sql`DROP TRIGGER fail_old_completion`;
+            assert.equal(
+              (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending WHERE state = 'running'`)
+                .length,
+              1,
+            );
+            const immediate = yield* service.triggerWebhook(
+              requestFor(task, { bodyText: '{"value":"immediate"}' }),
+            );
+            yield* Queue.take(launches);
+            const [before] = yield* sql<{
+              last_run_webhook_delivery_id: string;
+              model_selection_json: string;
+              run_count: number;
+            }>`SELECT last_run_webhook_delivery_id, model_selection_json, run_count FROM scheduled_tasks WHERE task_id = ${task.id}`;
+            assert.equal(
+              before!.last_run_webhook_delivery_id,
+              immediate._tag === "accepted" ? immediate.deliveryId : "",
+            );
+            assert.notEqual(
+              before!.last_run_webhook_delivery_id,
+              window._tag === "accepted" ? window.deliveryId : "",
+            );
+            assert.equal(before!.run_count, 0);
+            if (corrupt)
+              yield* sql`UPDATE scheduled_tasks SET model_selection_json = 'broken' WHERE task_id = ${task.id}`;
+            const restartedWorkers = new Map<string, Effect.Effect<void>>();
+            yield* withService(
+              ({ service: restarted, launches: recoveredLaunches }) =>
+                Effect.gen(function* () {
+                  const [recovered] = yield* sql<{
+                    run_count: number;
+                    last_run_status: string;
+                  }>`SELECT run_count, last_run_status FROM scheduled_tasks WHERE task_id = ${task.id}`;
+                  assert.equal(recovered!.run_count, 1);
+                  assert.equal(recovered!.last_run_status, "failed");
+                  if (corrupt)
+                    yield* sql`UPDATE scheduled_tasks SET model_selection_json = ${before!.model_selection_json} WHERE task_id = ${task.id}`;
+                  yield* drainPendingDispatch(restartedWorkers);
+                  assert.equal(yield* Queue.size(recoveredLaunches), 0);
+                  assert.equal((yield* restarted.list()).tasks[0]!.runCount, 2);
+                  assert.equal(
+                    (yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length,
+                    0,
+                  );
+                  yield* restartedWorkers.get("webhook-coalescing")!;
+                  assert.equal((yield* restarted.list()).tasks[0]!.runCount, 2);
+                }),
+              { sql, workers: restartedWorkers, completedLaunches },
+            );
+          }),
+        {
+          workers,
+          completedLaunches,
+          gateForTask: (input) =>
+            input.initialMessage?.text.includes(">immediate<") ? gate : undefined,
+        },
+      );
+    });
+  },
+);
+
+it.effect("checks filters after the signature and max age, and runs only matching deliveries", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(
+        yield* webhookTaskInput({
+          schedule: {
+            type: "webhook",
+            signature: {
+              header: "x-hub-signature-256",
+              encoding: "hex",
+              prefix: "sha256=",
+              secret: "s3cret",
+            },
+            maxDeliveryAgeMinutes: 30,
+            filters: [
+              { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+              { path: "body.action", op: "in", value: ["opened", "reopened"] },
+            ],
+          },
+        }),
+      );
+      const delivery = (
+        event: string,
+        action: string,
+        options: { readonly signed?: boolean; readonly receivedAt?: string } = {},
+      ) => {
+        const body = new TextEncoder().encode(
+          JSON.stringify({ action, pull_request: { url: "https://github.com/org/repo/pull/45" } }),
+        );
+        const signature = `sha256=${NodeCrypto.createHmac("sha256", "s3cret").update(body).digest("hex")}`;
+        return requestFor(task, {
+          headers: {
+            "content-type": "application/json",
+            "x-github-event": event,
+            ...(options.signed === false ? {} : { "x-hub-signature-256": signature }),
+          },
+          body,
+          bodyText: new TextDecoder().decode(body),
+          ...(options.receivedAt === undefined
+            ? {}
+            : { relayDeliveryId: "old", receivedAt: options.receivedAt }),
+        });
+      };
+      const now = yield* DateTime.now;
+      const old = DateTime.formatIso(DateTime.subtract(now, { minutes: 31 }));
+
+      // A request failing a filter is still refused first for its signature or age.
+      const unsigned = yield* service.triggerWebhook(delivery("push", "opened", { signed: false }));
+      assert.equal(unsigned._tag, "rejected_signature");
+      const tooOld = yield* service.triggerWebhook(delivery("push", "opened", { receivedAt: old }));
+      assert.equal(tooOld._tag, "expired");
+
+      const wrongEvent = yield* service.triggerWebhook(delivery("push", "opened"));
+      const wrongAction = yield* service.triggerWebhook(delivery("pull_request", "closed"));
+      assert.deepInclude(wrongEvent, { _tag: "accepted", outcome: "filtered" });
+      assert.deepInclude(wrongAction, { _tag: "accepted", outcome: "filtered" });
+      assert.equal(yield* Queue.size(launches), 0);
+      const [listed] = (yield* service.list()).tasks;
+      assert.equal(listed?.runCount, 0);
+      assert.equal(listed?.lastRunStatus, "never");
+
+      const matched = yield* service.triggerWebhook(delivery("pull_request", "opened"));
+      assert.deepInclude(matched, { _tag: "accepted", outcome: "accepted" });
+      assert.include((yield* Queue.take(launches)).initialMessage?.text ?? "", "pull/45");
+
+      const deliveries = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
+      const filtered = deliveries
+        .filter((entry) => entry.outcome === "filtered")
+        .map((entry) => [entry.signatureVerified, entry.error]);
+      assert.sameDeepMembers(filtered, [
+        [true, "Filter 1 (headers.x-github-event) did not match."],
+        [true, "Filter 2 (body.action) did not match."],
+      ]);
+    }),
+  ),
+);
+
+const pullRequestFilterInput = () =>
+  webhookTaskInput({
+    schedule: {
+      type: "webhook",
+      filters: [{ path: "headers.x-github-event", op: "equals", value: "pull_request" }],
+    },
+  });
+const githubEvent = (event: string) => ({
+  headers: { "content-type": "application/json", "x-github-event": event },
+});
+
+it.effect("filtered deliveries take no run slot and log at most 10 rows a minute", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* pullRequestFilterInput());
+      const ignored = yield* Effect.forEach(Array.from({ length: 70 }), () =>
+        service.triggerWebhook(requestFor(task, githubEvent("push"))),
+      );
+      assert.isTrue(
+        ignored.every((result) => result._tag === "accepted" && result.outcome === "filtered"),
+      );
+      const matched = yield* service.triggerWebhook(requestFor(task, githubEvent("pull_request")));
+      assert.deepInclude(matched, { _tag: "accepted", outcome: "accepted" });
+      yield* Queue.take(launches);
+      yield* Effect.forEach(Array.from({ length: 5 }), () =>
+        service.triggerWebhook(requestFor(task, githubEvent("push"))),
+      );
+
+      const outcomes = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries.map((delivery) => delivery.outcome);
+      // 75 filtered requests in one window: only the first 10 are written.
+      assert.equal(outcomes.filter((outcome) => outcome === "filtered").length, 10);
+      assert.equal(outcomes.filter((outcome) => outcome === "accepted").length, 1);
+
+      // Later windows log again, and retention keeps the filtered rows at 20.
+      for (const _ of [1, 2]) {
+        yield* TestClock.adjust("61 seconds");
+        yield* Effect.forEach(Array.from({ length: 15 }), () =>
+          service.triggerWebhook(requestFor(task, githubEvent("push"))),
+        );
+      }
+      const later = (yield* service.listWebhookDeliveries({ id: task.id, acceptAnyOutcome: true }))
+        .deliveries;
+      assert.equal(later.filter((delivery) => delivery.outcome === "filtered").length, 20);
+      assert.equal(later.filter((delivery) => delivery.outcome === "accepted").length, 1);
+    }),
+  ),
+);
+
+it.effect("a filtered relay delivery releases its claim, so a redelivery is evaluated again", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* pullRequestFilterInput());
+      const held = { relayDeliveryId: "relay-filtered" };
+      const first = yield* service.triggerWebhook(
+        requestFor(task, { ...held, ...githubEvent("push") }),
+      );
+      const again = yield* service.triggerWebhook(
+        requestFor(task, { ...held, ...githubEvent("push") }),
+      );
+      assert.deepInclude(first, { _tag: "accepted", outcome: "filtered" });
+      assert.deepInclude(again, { _tag: "accepted", outcome: "filtered" });
+      const ran = yield* service.triggerWebhook(
+        requestFor(task, { ...held, ...githubEvent("pull_request") }),
+      );
+      assert.deepInclude(ran, { _tag: "accepted", outcome: "accepted" });
+      yield* Queue.take(launches);
+      const replayed = yield* service.triggerWebhook(
+        requestFor(task, { ...held, ...githubEvent("pull_request") }),
+      );
+      assert.deepInclude(replayed, { _tag: "accepted", outcome: "duplicate" });
+    }),
+  ),
+);
+
+it.effect("a save without filters keeps the stored ones and an empty list clears them", () =>
+  withService(({ service }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* pullRequestFilterInput());
+      const filters = task.schedule.type === "webhook" ? task.schedule.filters : undefined;
+      assert.lengthOf(filters ?? [], 1);
+
+      const kept = yield* service.upsert(
+        yield* webhookTaskInput({ title: "Renamed", schedule: { type: "webhook" } }),
+      );
+      assert.deepEqual(
+        kept.task.schedule.type === "webhook" && kept.task.schedule.filters,
+        filters,
+      );
+
+      const cleared = yield* service.upsert(
+        yield* webhookTaskInput({ schedule: { type: "webhook", filters: [] } }),
+      );
+      assert.notProperty(cleared.task.schedule, "filters");
+    }),
+  ),
+);
+
+it.effect("leaves filtered rows out of the list for clients that only decode older outcomes", () =>
+  withService(({ service, launches }) =>
+    Effect.gen(function* () {
+      const { task } = yield* service.upsert(yield* pullRequestFilterInput());
+      yield* service.triggerWebhook(requestFor(task, githubEvent("push")));
+      yield* service.triggerWebhook(requestFor(task, githubEvent("pull_request")));
+      yield* Queue.take(launches);
+      const legacy = (yield* service.listWebhookDeliveries({ id: task.id })).deliveries;
+      assert.deepEqual(
+        legacy.map((delivery) => delivery.outcome),
+        ["accepted"],
+      );
+      const current = (yield* service.listWebhookDeliveries({
+        id: task.id,
+        acceptAnyOutcome: true,
+      })).deliveries;
+      assert.sameMembers(
+        current.map((delivery) => delivery.outcome),
+        ["accepted", "filtered"],
+      );
+    }),
+  ),
+);
+
+it.effect("filters run before replay and coalescing without claiming ignored deliveries", () => {
+  const workers = new Map<string, Effect.Effect<void>>();
+  return withService(
+    ({ service, launches, sql }) =>
+      Effect.gen(function* () {
+        const { task } = yield* service.upsert(
+          yield* webhookTaskInput({
+            prompt: "{{body.value}}",
+            schedule: {
+              type: "webhook",
+              filters: [{ path: "body.run", op: "equals", value: "true" }],
+              dedupe: {
+                replayKey: "{{headers.delivery-id}}",
+                coalesceKey: "{{body.group}}",
+                coalesceWindowSeconds: 10,
+              },
+            },
+          }),
+        );
+        const request = (id: string, run: boolean, value: string) => {
+          const bodyText = JSON.stringify({ run, group: "B", value });
+          return requestFor(task, {
+            headers: { "delivery-id": id },
+            bodyText,
+            body: new TextEncoder().encode(bodyText),
+            relayDeliveryId: id,
+          });
+        };
+        const ignored = yield* service.triggerWebhook(request("A", false, "ignored"));
+        assert.deepInclude(ignored, { _tag: "accepted", outcome: "filtered" });
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys`).length, 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_pending`).length, 0);
+        assert.equal((yield* sql`SELECT 1 FROM scheduled_task_webhook_relay_deliveries`).length, 0);
+        const filteredId = ignored._tag === "accepted" ? ignored.deliveryId : assert.fail();
+        const oldClient = yield* service
+          .getWebhookDelivery({ id: task.id, deliveryId: filteredId })
+          .pipe(Effect.result);
+        assert.equal(oldClient._tag, "Failure");
+        const currentClient = yield* service.getWebhookDelivery({
+          id: task.id,
+          deliveryId: filteredId,
+          acceptAnyOutcome: true,
+        });
+        assert.equal(currentClient.delivery.outcome, "filtered");
+        assert.deepInclude(yield* service.triggerWebhook(request("A", true, "first")), {
+          _tag: "accepted",
+          outcome: "accepted",
+        });
+        assert.deepInclude(
+          yield* service.triggerWebhook({
+            ...request("A", false, "ignored replay"),
+            relayDeliveryId: "ignored-replay",
+          }),
+          { _tag: "accepted", outcome: "filtered" },
+        );
+        assert.deepInclude(yield* service.triggerWebhook(request("B", false, "ignored update")), {
+          _tag: "accepted",
+          outcome: "filtered",
+        });
+        assert.deepInclude(yield* service.triggerWebhook(request("B", true, "latest")), {
+          _tag: "accepted",
+          outcome: "coalesced",
+        });
+        yield* TestClock.adjust("10 seconds");
+        yield* drainPendingDispatch(workers);
+        assert.include((yield* Queue.take(launches)).initialMessage!.text, "latest");
+        assert.equal(yield* Queue.size(launches), 0);
+      }),
+    { workers },
+  );
+});
diff --git a/apps/server/src/scheduledTasks/webhookDedupe.ts b/apps/server/src/scheduledTasks/webhookDedupe.ts
new file mode 100644
index 000000000000..21d40b25ac5e
--- /dev/null
+++ b/apps/server/src/scheduledTasks/webhookDedupe.ts
@@ -0,0 +1,128 @@
+// @effect-diagnostics-next-line nodeBuiltinImport:off -- Keys need a deterministic digest, not random bytes.
+import * as NodeCrypto from "node:crypto";
+import { ScheduledTask, ScheduledTaskError } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as SqlClient from "effect/sql/SqlClient";
+import { renderWebhookPrompt, type WebhookRequest } from "./webhookTemplate.ts";
+
+function key(template: string | undefined, request: WebhookRequest): string {
+  if (template === undefined) return "";
+  const rendered = renderWebhookPrompt(template, request, "", true);
+  return rendered.missing.length > 0 || rendered.prompt === ""
+    ? ""
+    : NodeCrypto.createHash("sha256").update(rendered.prompt).digest("hex");
+}
+
+export const releaseWebhookReplay = Effect.fn("ScheduledTaskService.releaseWebhookReplay")(
+  function* (deliveryId: string) {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql`DELETE FROM scheduled_task_webhook_replay_keys WHERE delivery_id = ${deliveryId}`;
+  },
+);
+
+const hasReplayKey = Effect.fn(function* (taskId: string, replayKey: string, now: number) {
+  const sql = yield* SqlClient.SqlClient;
+  return (
+    replayKey !== "" &&
+    (yield* sql`SELECT 1 FROM scheduled_task_webhook_replay_keys
+    WHERE task_id = ${taskId} AND replay_key = ${replayKey} AND expires_at > ${now}`).length > 0
+  );
+});
+const claimReplayKey = Effect.fn(function* (
+  taskId: string,
+  replayKey: string,
+  deliveryId: string,
+  now: number,
+) {
+  if (replayKey === "") return;
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`DELETE FROM scheduled_task_webhook_replay_keys WHERE expires_at <= ${now}`;
+  yield* sql`INSERT INTO scheduled_task_webhook_replay_keys (task_id, replay_key, delivery_id, expires_at)
+    VALUES (${taskId}, ${replayKey}, ${deliveryId}, ${now + 7 * 24 * 60 * 60 * 1000})`;
+});
+
+export const acceptWebhookDedupe = Effect.fn("ScheduledTaskService.acceptWebhookDedupe")(function* (
+  task: ScheduledTask,
+  request: WebhookRequest,
+  deliveryId: string,
+  now: number,
+  reserve: Effect.Effect<void, "first_rejected" | "rejected">,
+  reserveCoalescedLog: Effect.Effect<boolean>,
+  checkCapacity: Effect.Effect<void, "queue_full" | ScheduledTaskError>,
+  replaceDeliveryRequest: (ownerId: string) => Effect.Effect<void, ScheduledTaskError>,
+) {
+  const sql = yield* SqlClient.SqlClient;
+  const dedupe = task.schedule.type === "webhook" ? task.schedule.dedupe : undefined;
+  if (dedupe === undefined) return "run" as const;
+  const replayKey = key(dedupe.replayKey, request);
+  if (yield* hasReplayKey(task.id, replayKey, now)) return "duplicate" as const;
+  const coalesceKey = key(dedupe.coalesceKey, request);
+  if (coalesceKey === "") return "run" as const;
+  const pending = yield* sql<{
+    delivery_id: string;
+  }>`SELECT delivery_id FROM scheduled_task_webhook_pending
+    WHERE task_id = ${task.id} AND coalesce_key = ${coalesceKey} AND state = 'pending' AND due_at > ${now}`;
+  const logCoalesced = pending.length > 0 ? yield* reserveCoalescedLog : true;
+  if (pending.length === 0) {
+    yield* checkCapacity;
+    yield* reserve;
+  }
+  // Coalesced requests retain their validation slot, bounding writes without dropping accepted payloads.
+  yield* claimReplayKey(task.id, replayKey, pending[0]?.delivery_id ?? deliveryId, now);
+  const requestJson = yield* encodePendingRequest({
+    method: request.method,
+    path: request.path,
+    query: request.query,
+    headers: request.headers,
+    bodyText: request.bodyText,
+  });
+  if (pending.length > 0) {
+    yield* sql`UPDATE scheduled_task_webhook_pending SET request_json = ${requestJson},
+      delivery_ids_json = json_insert(delivery_ids_json, '$[#]', ${deliveryId}) WHERE delivery_id = ${pending[0]!.delivery_id}`;
+    yield* replaceDeliveryRequest(pending[0]!.delivery_id);
+    return logCoalesced ? ("coalesced" as const) : ("coalesced_unlogged" as const);
+  }
+  // Expired windows are immutable, even if the scheduler has not dispatched them yet.
+  yield* sql`UPDATE scheduled_task_webhook_pending SET state = 'dispatching'
+    WHERE task_id = ${task.id} AND coalesce_key = ${coalesceKey} AND state = 'pending' AND due_at <= ${now}`;
+  yield* sql`INSERT INTO scheduled_task_webhook_pending (delivery_id, task_id, coalesce_key, due_at, task_json, request_json, delivery_ids_json)
+    VALUES (${deliveryId}, ${task.id}, ${coalesceKey}, ${now + (dedupe.coalesceWindowSeconds ?? 120) * 1000}, ${yield* encodePendingTask(task)}, ${requestJson}, json_array(${deliveryId}))`;
+  return "pending" as const;
+});
+
+export const acceptImmediateWebhookDedupe = Effect.fn(
+  "ScheduledTaskService.acceptImmediateWebhookDedupe",
+)(function* (
+  task: ScheduledTask,
+  request: WebhookRequest,
+  deliveryId: string,
+  now: number,
+  reserve: Effect.Effect<void, "first_rejected" | "rejected" | "queue_full" | ScheduledTaskError>,
+) {
+  const replayKey = key(
+    task.schedule.type === "webhook" ? task.schedule.dedupe?.replayKey : undefined,
+    request,
+  );
+  if (yield* hasReplayKey(task.id, replayKey, now)) return "duplicate" as const;
+  yield* reserve;
+  yield* claimReplayKey(task.id, replayKey, deliveryId, now);
+  return "run" as const;
+});
+
+const PendingTaskJson = Schema.fromJsonString(ScheduledTask);
+const encodePendingTask = Schema.encodeEffect(PendingTaskJson);
+export const decodePendingTask = Schema.decodeUnknownEffect(PendingTaskJson);
+const PendingRequestJson = Schema.fromJsonString(
+  Schema.Struct({
+    method: Schema.String,
+    path: Schema.String,
+    query: Schema.String,
+    headers: Schema.Record(Schema.String, Schema.String),
+    bodyText: Schema.String,
+  }),
+);
+const encodePendingRequest = Schema.encodeEffect(PendingRequestJson);
+export const decodePendingRequest = Schema.decodeUnknownEffect(PendingRequestJson);
+export const dedupeError = (cause: unknown) =>
+  new ScheduledTaskError({ message: "Could not persist webhook dedupe state.", cause });
diff --git a/apps/server/src/scheduledTasks/webhookFilter.test.ts b/apps/server/src/scheduledTasks/webhookFilter.test.ts
new file mode 100644
index 000000000000..b8d9d2070832
--- /dev/null
+++ b/apps/server/src/scheduledTasks/webhookFilter.test.ts
@@ -0,0 +1,91 @@
+import { assert, describe, it } from "@effect/vitest";
+import type { ScheduledTaskWebhookFilter } from "@t3tools/contracts";
+
+import { findFailedWebhookFilter, matchesWebhookFilter } from "./webhookFilter.ts";
+import type { WebhookRequest } from "./webhookTemplate.ts";
+
+const request: WebhookRequest = {
+  method: "POST",
+  path: "/api/hooks/task-1",
+  query: "source=github",
+  headers: { "content-type": "application/json", "x-github-event": "pull_request" },
+  bodyText: JSON.stringify({
+    action: "labeled",
+    number: 45,
+    draft: false,
+    closed_at: null,
+    label: { name: "agent:review" },
+    labels: ["bug"],
+  }),
+};
+
+const matches = (filter: ScheduledTaskWebhookFilter) =>
+  findFailedWebhookFilter([filter], request) === null;
+
+describe("matchesWebhookFilter", () => {
+  it("compares scalars as strings", () => {
+    assert.isTrue(matches({ path: "body.action", op: "equals", value: "labeled" }));
+    assert.isTrue(matches({ path: "body.number", op: "equals", value: "45" }));
+    assert.isTrue(matches({ path: "body.draft", op: "equals", value: "false" }));
+    assert.isFalse(matches({ path: "body.action", op: "equals", value: "Labeled" }));
+    assert.isTrue(matches({ path: "body.action", op: "notEquals", value: "closed" }));
+    assert.isFalse(matches({ path: "body.action", op: "notEquals", value: "labeled" }));
+    assert.isTrue(matches({ path: "body.action", op: "in", value: ["opened", "labeled"] }));
+    assert.isTrue(matches({ path: "body.label.name", op: "startsWith", value: "agent:" }));
+    assert.isFalse(matches({ path: "body.label.name", op: "startsWith", value: "review" }));
+  });
+
+  it("reads headers case-insensitively and query values by name", () => {
+    assert.isTrue(matches({ path: "headers.X-GitHub-Event", op: "equals", value: "pull_request" }));
+    assert.isTrue(matches({ path: "query.source", op: "equals", value: "github" }));
+  });
+
+  it("lets objects and arrays satisfy only exists", () => {
+    for (const path of ["body.label", "body.labels"]) {
+      assert.isTrue(matches({ path, op: "exists" }));
+      assert.isFalse(matches({ path, op: "equals", value: "[object Object]" }));
+      assert.isFalse(matches({ path, op: "notEquals", value: "anything" }));
+      assert.isFalse(matches({ path, op: "in", value: ["bug"] }));
+      assert.isFalse(matches({ path, op: "startsWith", value: "" }));
+    }
+  });
+
+  it("fails every op on a missing or null path, including notEquals", () => {
+    for (const path of [
+      "body.missing",
+      "body.label.name.deeper",
+      "headers.x-none",
+      "body.closed_at",
+    ]) {
+      assert.isFalse(matches({ path, op: "exists" }));
+      assert.isFalse(matches({ path, op: "notEquals", value: "x" }));
+      assert.isFalse(matchesWebhookFilter({ path, op: "startsWith", value: "" }, undefined));
+    }
+  });
+});
+
+describe("findFailedWebhookFilter", () => {
+  it("passes with no filters and reports the first failing filter", () => {
+    assert.isNull(findFailedWebhookFilter([], request));
+    assert.deepEqual(
+      findFailedWebhookFilter(
+        [
+          { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+          { path: "body.action", op: "equals", value: "opened" },
+          { path: "body.missing", op: "exists" },
+        ],
+        request,
+      ),
+      { index: 1, path: "body.action" },
+    );
+  });
+
+  it("does not need a JSON body for header filters", () => {
+    assert.isNull(
+      findFailedWebhookFilter([{ path: "headers.x-github-event", op: "exists" }], {
+        ...request,
+        bodyText: "not json",
+      }),
+    );
+  });
+});
diff --git a/apps/server/src/scheduledTasks/webhookFilter.ts b/apps/server/src/scheduledTasks/webhookFilter.ts
new file mode 100644
index 000000000000..7f46a15cc4fa
--- /dev/null
+++ b/apps/server/src/scheduledTasks/webhookFilter.ts
@@ -0,0 +1,49 @@
+import type { ScheduledTaskWebhookFilter } from "@t3tools/contracts";
+
+import { webhookExpressionResolver, type WebhookRequest } from "./webhookTemplate.ts";
+
+export interface FailedWebhookFilter {
+  readonly index: number;
+  readonly path: string;
+}
+
+function scalarText(value: unknown): string | undefined {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return undefined;
+}
+
+/** Placeholders render null as missing, so filters treat it the same way. */
+export function matchesWebhookFilter(filter: ScheduledTaskWebhookFilter, value: unknown): boolean {
+  if (filter.op === "exists") return value !== undefined && value !== null;
+  const text = scalarText(value);
+  if (text === undefined) return false;
+  switch (filter.op) {
+    case "equals":
+      return text === filter.value;
+    case "notEquals":
+      return text !== filter.value;
+    case "in":
+      return filter.value.includes(text);
+    case "startsWith":
+      return text.startsWith(filter.value);
+  }
+}
+
+/** The first filter the request fails, or null when every filter matches. */
+export function findFailedWebhookFilter(
+  filters: ReadonlyArray<ScheduledTaskWebhookFilter>,
+  request: WebhookRequest,
+): FailedWebhookFilter | null {
+  if (filters.length === 0) return null;
+  const resolve = webhookExpressionResolver(request);
+  for (const [index, filter] of filters.entries()) {
+    if (!matchesWebhookFilter(filter, resolve(filter.path))) return { index, path: filter.path };
+  }
+  return null;
+}
+
+/** Filters are numbered from 1, in the order the settings form lists them. */
+export function describeFailedWebhookFilter(failed: FailedWebhookFilter): string {
+  return `Filter ${failed.index + 1} (${failed.path}) did not match.`;
+}
diff --git a/apps/server/src/scheduledTasks/webhookRoute.test.ts b/apps/server/src/scheduledTasks/webhookRoute.test.ts
index 31261660c623..332e6778ba1b 100644
--- a/apps/server/src/scheduledTasks/webhookRoute.test.ts
+++ b/apps/server/src/scheduledTasks/webhookRoute.test.ts
@@ -222,6 +222,7 @@ describe("webhook route", () => {
       [{ _tag: "accepted", deliveryId, outcome: "accepted" }, 202, "accepted"],
       [{ _tag: "accepted", deliveryId, outcome: "duplicate" }, 202, "duplicate"],
       [{ _tag: "accepted", deliveryId, outcome: "prompt_too_long" }, 202, "prompt_too_long"],
+      [{ _tag: "accepted", deliveryId, outcome: "filtered" }, 202, "filtered"],
       [{ _tag: "not_found" }, 404, "not_found"],
       [{ _tag: "rejected_signature" }, 401, "rejected_signature"],
       [{ _tag: "disabled" }, 409, "disabled"],
@@ -235,6 +236,7 @@ describe("webhook route", () => {
         const response = await handler(post("/api/hooks/id/tok", "{}"));
         expect(response.status).toBe(status);
         expect(response.headers.get("x-t3-hook-outcome")).toBe(outcome);
+        if (status === 429) expect(await response.json()).toEqual({ error: outcome });
       } finally {
         await dispose();
       }
diff --git a/apps/server/src/scheduledTasks/webhookRoute.ts b/apps/server/src/scheduledTasks/webhookRoute.ts
index ce67fa157d33..2566349d273b 100644
--- a/apps/server/src/scheduledTasks/webhookRoute.ts
+++ b/apps/server/src/scheduledTasks/webhookRoute.ts
@@ -118,7 +118,7 @@ export const layer = HttpApiBuilder.group(
         case "disabled":
           return json(409, { error: "hook_disabled" }, "disabled");
         case "rate_limited":
-          return json(429, { error: "rate_limited" }, result.outcome);
+          return json(429, { error: result.outcome }, result.outcome);
         case "expired":
           return json(410, { error: "delivery_too_old" }, "expired");
         case "error":
diff --git a/apps/server/src/scheduledTasks/webhookTemplate.ts b/apps/server/src/scheduledTasks/webhookTemplate.ts
index b129704f0abe..063d41a7ec46 100644
--- a/apps/server/src/scheduledTasks/webhookTemplate.ts
+++ b/apps/server/src/scheduledTasks/webhookTemplate.ts
@@ -112,16 +112,17 @@ function formatWebhookRequest(request: WebhookRequest): string {
   ].join("\n");
 }
 
-export function renderWebhookPrompt(
-  template: string,
+/**
+ * Resolves a placeholder expression (`body.action`, `headers.x-github-event`)
+ * against the request. Webhook filters share it, so both read the same value.
+ */
+export function webhookExpressionResolver(
   request: WebhookRequest,
-  frameId: string,
-): RenderedWebhookPrompt {
-  const missing: string[] = [];
+): (expression: string) => unknown {
   let body: { parsed: unknown } | undefined;
   const parsedBody = () => (body ??= { parsed: parseBody(request) }).parsed;
 
-  const resolve = (expression: string): unknown => {
+  return (expression) => {
     const [root, ...segments] = expression.split(".");
     switch (root) {
       case "request":
@@ -143,6 +144,16 @@ export function renderWebhookPrompt(
         return undefined;
     }
   };
+}
+
+export function renderWebhookPrompt(
+  template: string,
+  request: WebhookRequest,
+  frameId: string,
+  raw = false,
+): RenderedWebhookPrompt {
+  const missing: string[] = [];
+  const resolve = webhookExpressionResolver(request);
 
   const tag = `webhook-data-${frameId}`;
   let framed = false;
@@ -150,12 +161,13 @@ export function renderWebhookPrompt(
     const expression = rawExpression.trim();
     const value = resolve(expression);
     const text = value === undefined || value === null ? undefined : stringify(value);
-    if (text === undefined) {
+    if (text === undefined || (raw && text === "")) {
       if (!missing.includes(expression)) missing.push(expression);
       return "";
     }
     // An empty value carries no request data, so it needs no frame or note.
     if (text === "") return "";
+    if (raw) return text;
     framed = true;
     return `<${tag}>${text.replace(MENTION, "$&\u2060")}</${tag}>`;
   });
diff --git a/apps/web/package.json b/apps/web/package.json
index dbb889a1bb8e..17f40f695472 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -65,8 +65,8 @@
     "katex": "^0.16.47",
     "lucide": "^0.564.0",
     "lucide-react": "^0.564.0",
-    "mermaid": "^11.17.2",
     "morphicons": "^1.7.1",
+    "pele": "^1.8.0",
     "react": "catalog:",
     "react-dom": "catalog:",
     "react-markdown": "^10.1.0",
diff --git a/apps/web/src/components/ChatMarkdown.browser.test.tsx b/apps/web/src/components/ChatMarkdown.browser.test.tsx
index 75ccf03b8a69..01a343282cf0 100644
--- a/apps/web/src/components/ChatMarkdown.browser.test.tsx
+++ b/apps/web/src/components/ChatMarkdown.browser.test.tsx
@@ -1420,7 +1420,7 @@ describe("ChatMarkdown math", () => {
       });
       const [preview, after] = container.querySelectorAll("button");
       preview!.focus();
-      await act(() => userEvent.tab());
+      await userEvent.tab();
       expect(document.activeElement).toBe(after);
       if (formula.includes("notACommand")) {
         expect(page.getByRole("button", { name: /notACommand/ }).element()).toBe(preview);
@@ -1439,7 +1439,7 @@ describe("ChatMarkdown math", () => {
     );
     const { container } = screen;
     container.querySelector("button")!.focus();
-    await act(() => userEvent.tab());
+    await userEvent.tab();
     expect(document.activeElement).toBe(
       container.querySelector('[aria-label="Scroll inline equation"]'),
     );
diff --git a/apps/web/src/components/ChatMarkdown.tsx b/apps/web/src/components/ChatMarkdown.tsx
index baf23d2b4cec..78468b0c8580 100644
--- a/apps/web/src/components/ChatMarkdown.tsx
+++ b/apps/web/src/components/ChatMarkdown.tsx
@@ -1107,7 +1107,7 @@ function MarkdownMermaidCodeBlock({
               </pre>
             }
           >
-            <MermaidDiagram source={code} theme={theme} onExpand={onExpand} />
+            <MermaidDiagram source={code} onExpand={onExpand} />
           </Suspense>
           {searching ? (
             <pre ref={sourceRevealRef} hidden aria-hidden>
diff --git a/apps/web/src/components/ComposerPromptEditorTiptap.input.browser.test.tsx b/apps/web/src/components/ComposerPromptEditorTiptap.input.browser.test.tsx
index 6b4884efdc9f..a5c1a1e87a15 100644
--- a/apps/web/src/components/ComposerPromptEditorTiptap.input.browser.test.tsx
+++ b/apps/web/src/components/ComposerPromptEditorTiptap.input.browser.test.tsx
@@ -484,7 +484,7 @@ describe("composer context undo lifetime", () => {
     const nextEditor = composer.editor();
     expect(nextEditor).not.toBe(previousEditor);
     expect(document.activeElement).toBe(nextEditor.view.dom);
-    await act(async () => userEvent.keyboard("x"));
+    await userEvent.keyboard("x");
     expect(composer.draft().value).toBe("xDraft B");
 
     const button = document.createElement("button");
diff --git a/apps/web/src/components/ThreadStatusIndicators.subscriptions.browser.test.tsx b/apps/web/src/components/ThreadStatusIndicators.subscriptions.browser.test.tsx
index 9e2aa3f0cc35..7b426d756b4b 100644
--- a/apps/web/src/components/ThreadStatusIndicators.subscriptions.browser.test.tsx
+++ b/apps/web/src/components/ThreadStatusIndicators.subscriptions.browser.test.tsx
@@ -200,7 +200,7 @@ it("keeps a long PR hover list in the viewport and lets the last row be selected
       />
     </div>,
   );
-  await act(() => userEvent.hover(screen.container.querySelector("button")!));
+  await userEvent.hover(screen.container.querySelector("button")!);
   const popup = () => document.querySelector<HTMLElement>('[data-slot="tooltip-popup"]')!;
   await expect.poll(() => popup()?.querySelectorAll("a").length).toBe(40);
   await expect.poll(() => popup().getBoundingClientRect().top).toBeGreaterThanOrEqual(0);
@@ -212,13 +212,13 @@ it("keeps a long PR hover list in the viewport and lets the last row be selected
   expect(lastRow.getBoundingClientRect().top).toBeGreaterThan(
     popup().getBoundingClientRect().bottom,
   );
-  await act(() => userEvent.wheel(popup(), { delta: { y: 10_000 } }));
+  await userEvent.wheel(popup(), { delta: { y: 10_000 } });
   await expect
     .poll(() => lastRow.getBoundingClientRect().bottom)
     .toBeLessThanOrEqual(popup().getBoundingClientRect().bottom);
   expect(lastRow.getBoundingClientRect().top).toBeGreaterThanOrEqual(
     popup().getBoundingClientRect().top,
   );
-  await act(() => userEvent.click(lastRow));
+  await userEvent.click(lastRow);
   expect(onOpenPullRequest).toHaveBeenCalledExactlyOnceWith(expect.anything(), lastRow.href);
 });
diff --git a/apps/web/src/components/chat/ComposerBannerStack.browser.test.tsx b/apps/web/src/components/chat/ComposerBannerStack.browser.test.tsx
index 51bb2d4e6422..c6551d4fcb7d 100644
--- a/apps/web/src/components/chat/ComposerBannerStack.browser.test.tsx
+++ b/apps/web/src/components/chat/ComposerBannerStack.browser.test.tsx
@@ -84,15 +84,23 @@ it("keeps only the usage limit attached while an active goal waits in the collap
     "Usage limit reached",
   );
 
-  await act(async () => page.getByRole("button", { name: "Show other notices" }).click());
+  const peek = page.getByRole("button", { name: "Show other notices" });
+  // Hover opens the stack and hides the peek before a pointer click can finish.
+  await act(() => peek.element().focus());
+  await userEvent.keyboard("{Enter}");
   await expect.element(goal).toBeVisible();
   await expect.element(limit).toBeVisible();
   await expect.poll(visibleBanners).toHaveLength(2);
 
-  await act(async () => userEvent.keyboard("{Escape}"));
+  await userEvent.keyboard("{Escape}");
   await expect.element(goal).not.toBeVisible();
   await expect.element(limit).toBeVisible();
   expect(visibleBanners()).toHaveLength(1);
+
+  await userEvent.hover(peek);
+  await expect.element(goal).toBeVisible();
+  await expect.element(limit).toBeVisible();
+  await expect.poll(visibleBanners).toHaveLength(2);
 });
 
 it("reveals the full running command only while its title is clipped", async () => {
diff --git a/apps/web/src/components/chat/ComposerStashMenu.browser.test.tsx b/apps/web/src/components/chat/ComposerStashMenu.browser.test.tsx
index 752ec8af46f0..01dae940a8e7 100644
--- a/apps/web/src/components/chat/ComposerStashMenu.browser.test.tsx
+++ b/apps/web/src/components/chat/ComposerStashMenu.browser.test.tsx
@@ -66,7 +66,7 @@ const editor = () => page.getByRole("textbox", { name: "Message" });
 const stash = () => page.getByRole("list", { name: "Stashed prompts" });
 const restore = (prompt: string) =>
   page.getByRole("button", { name: `Restore stashed prompt: ${prompt}` });
-const press = (keys: string) => act(async () => userEvent.keyboard(keys));
+const press = (keys: string) => userEvent.keyboard(keys);
 const focus = (element: Element) => act(async () => (element as HTMLElement).focus());
 
 it("leaves dialog, unrelated input and question button shortcuts alone while the stash is open", async () => {
@@ -128,7 +128,7 @@ it("navigates, deletes and restores stashed prompts from the composer and drawer
   await press("{Escape}");
   await expect.element(stash()).not.toBeInTheDocument();
 
-  await act(async () => userEvent.click(page.getByRole("button", { name: "Open stash" })));
+  await userEvent.click(page.getByRole("button", { name: "Open stash" }));
   await expect.element(restore("first prompt")).not.toBeInTheDocument();
   expect(stash().element().textContent).toContain("second prompt");
   await focus(editor().element());
diff --git a/apps/web/src/components/chat/MermaidDiagram.browser.test.tsx b/apps/web/src/components/chat/MermaidDiagram.browser.test.tsx
deleted file mode 100644
index 7d65c480da5b..000000000000
--- a/apps/web/src/components/chat/MermaidDiagram.browser.test.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-import { describe, expect, it } from "vite-plus/test";
-
-import { sanitizeMermaidSvg } from "./MermaidDiagram";
-
-// The label markup Mermaid's sequence diagrams emit for $$...$$ text.
-function noteSvg(label: string) {
-  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><foreignObject height="34" width="35" x="57" y="85"><div style="width: fit-content;" xmlns="http://www.w3.org/1999/xhtml"><div style="display: flex; align-items: center; justify-content: center; white-space: nowrap;"><span class="katex">${label}</span></div></div></foreignObject></svg>`;
-}
-
-function sanitize(svg: string) {
-  const host = document.createElement("div");
-  host.innerHTML = sanitizeMermaidSvg(svg);
-  return host;
-}
-
-describe("sanitizeMermaidSvg", () => {
-  it("keeps the MathML Mermaid renders for math labels", () => {
-    const host = sanitize(
-      noteSvg(
-        '<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><mrow><mfrac><mi>d</mi><mrow><mi>d</mi><mi>x</mi></mrow></mfrac><mrow><mo fence="true">(</mo><mi mathvariant="bold">v</mi><mo fence="true">)</mo></mrow><msqrt><mn>2</mn></msqrt></mrow></math>',
-      ),
-    );
-
-    const math = host.querySelector(".katex > math");
-    expect(math?.namespaceURI).toBe("http://www.w3.org/1998/Math/MathML");
-    expect(math?.getAttribute("display")).toBe("block");
-    expect(math?.querySelector("mfrac")?.textContent).toBe("ddx");
-    expect(math?.querySelector("msqrt")?.textContent).toBe("2");
-    expect(math?.querySelector("mi[mathvariant='bold']")?.textContent).toBe("v");
-    expect(math?.querySelectorAll("mo[fence='true']")).toHaveLength(2);
-  });
-
-  it("keeps spaced math labels parseable as an SVG image", () => {
-    // KaTeX renders \text{total cost} with a no-break space.
-    const svg = sanitizeMermaidSvg(noteSvg("<math><mrow><mtext>total cost</mtext></mrow></math>"));
-
-    const image = new DOMParser().parseFromString(svg, "image/svg+xml");
-    expect(image.documentElement.localName).toBe("svg");
-    expect(image.querySelector("mtext")?.textContent).toBe("total cost");
-  });
-
-  it("strips links, scripts, and MathML outside what KaTeX emits", () => {
-    const host = sanitize(
-      noteSvg(
-        '<math href="javascript:alert(1)"><mi href="javascript:alert(1)" onclick="alert(1)">x</mi><maction actiontype="toggle"><mi>a</mi></maction><mglyph src="https://example.com/a.png"></mglyph><annotation-xml encoding="text/html"><img src="x" onerror="alert(1)"></annotation-xml><semantics><mi>y</mi><annotation encoding="application/x-tex">y</annotation></semantics></math>',
-      ),
-    );
-
-    const math = host.querySelector("math");
-    expect(math).not.toBeNull();
-    expect(math?.querySelector("mi")?.textContent).toBe("x");
-    expect(host.querySelector("[href], [onclick], [src], [onerror]")).toBeNull();
-    expect(host.querySelector("maction, mglyph, annotation-xml, annotation, semantics, img")).toBe(
-      null,
-    );
-  });
-
-  it("only accepts math as an HTML label and keeps its attributes on MathML", () => {
-    const host = sanitize(
-      '<svg xmlns="http://www.w3.org/2000/svg"><math><mi>x</mi></math><text mathvariant="bold" fence="true">label</text></svg>',
-    );
-
-    expect(host.querySelector("math, mi")).toBeNull();
-    expect(host.querySelector("text")?.getAttributeNames()).toEqual([]);
-  });
-});
diff --git a/apps/web/src/components/chat/MermaidDiagram.tsx b/apps/web/src/components/chat/MermaidDiagram.tsx
index 2599c00d04da..11f98ec57a73 100644
--- a/apps/web/src/components/chat/MermaidDiagram.tsx
+++ b/apps/web/src/components/chat/MermaidDiagram.tsx
@@ -1,39 +1,99 @@
 import DOMPurify from "dompurify";
-import type { Mermaid } from "mermaid";
-import { use, useState } from "react";
+import type { DiagramType, MathResolver } from "pele/lazy";
+import { use, useLayoutEffect, useRef, useState } from "react";
 
 import { serializeCodeBlockToMarkdown } from "../../markdown-clipboard";
 import { Button } from "../ui/button";
 
-type MermaidRenderResult =
-  | { readonly status: "rendered"; readonly svg: string }
-  | { readonly status: "error"; readonly message: string; readonly retryable: boolean };
+type Pele = typeof import("pele/lazy");
+type PeleLoad = { readonly status: "loaded"; readonly pele: Pele } | { readonly status: "failed" };
 
-let mermaidModulePromise: Promise<Mermaid> | null = null;
-let renderQueue: Promise<unknown> = Promise.resolve();
-let nextDiagramId = 0;
-const MAX_CACHED_RENDERS = 64;
-// Pending renders are never evicted, because use() must get the same promise on
-// retry.
-const renderCache = new Map<string, Promise<MermaidRenderResult>>();
-const settledRenders = new WeakSet<Promise<MermaidRenderResult>>();
+let coreLoad: Promise<PeleLoad> | null = null;
+// Each diagram type is its own chunk, so a chat with one flowchart loads only
+// the flowchart parser and layout.
+const diagramLoads = new Map<DiagramType, Promise<PeleLoad>>();
 
-function loadMermaid(): Promise<Mermaid> {
-  mermaidModulePromise ??= import("mermaid")
-    .then((module) => module.default)
-    .catch((error: unknown) => {
-      mermaidModulePromise = null;
-      throw error;
-    });
-  return mermaidModulePromise;
+function loadCore(): Promise<PeleLoad> {
+  coreLoad ??= import("pele/lazy").then(
+    (pele): PeleLoad => ({ status: "loaded", pele }),
+    (): PeleLoad => ({ status: "failed" }),
+  );
+  return coreLoad;
 }
 
-const REMOTE_CSS_URL = /url\(\s*(?!['"]?#)[^)]*\)/gi;
-let purifier: ReturnType<typeof DOMPurify> | null = null;
+function loadDiagramType(pele: Pele, type: DiagramType): Promise<PeleLoad> {
+  let load = diagramLoads.get(type);
+  if (!load) {
+    load = pele.load(type).then(
+      (): PeleLoad => ({ status: "loaded", pele }),
+      (): PeleLoad => ({ status: "failed" }),
+    );
+    diagramLoads.set(type, load);
+  }
+  return load;
+}
+
+function detectDiagramType(pele: Pele, source: string): DiagramType | null {
+  try {
+    return pele.detectType(source);
+  } catch {
+    return null;
+  }
+}
+
+let mathLoad: Promise<MathResolver | null> | null = null;
+
+// Pele has no typesetter, so $$...$$ labels go through the KaTeX the chat
+// already uses for math. It only loads for diagrams that contain math.
+function loadMath(): Promise<MathResolver | null> {
+  mathLoad ??= import("katex").then(
+    ({ default: katex }) => {
+      const typeset = new Map<string, ReturnType<MathResolver>>();
+      let probe: HTMLDivElement | null = null;
+      // Pele calls this on every layout, including resizes.
+      return (tex, size) => {
+        const key = `${size}:${tex}`;
+        if (typeset.has(key)) return typeset.get(key);
+        let markup: ReturnType<MathResolver> = null;
+        try {
+          if (!probe) {
+            probe = document.createElement("div");
+            probe.style.cssText =
+              "position:absolute;left:-9999px;visibility:hidden;display:inline-block;white-space:nowrap";
+            document.body.append(probe);
+          }
+          probe.style.fontSize = `${size}px`;
+          probe.innerHTML = katex.renderToString(tex, {
+            displayMode: true,
+            output: "mathml",
+            throwOnError: true,
+            // No \href, \url, \htmlClass, or other commands that emit active HTML.
+            trust: false,
+            strict: "ignore",
+            maxSize: 20,
+            maxExpand: 1000,
+          });
+          const expression = probe.querySelector("math");
+          // The annotation repeats the TeX source; the sanitizer would keep its text.
+          expression?.querySelector("annotation")?.remove();
+          if (expression) {
+            const { width, height } = expression.getBoundingClientRect();
+            markup = { html: expression.outerHTML, width, height };
+          }
+        } catch {
+          // Unsupported TeX stays readable as its source.
+        }
+        typeset.set(key, markup);
+        return markup;
+      };
+    },
+    () => null,
+  );
+  return mathLoad;
+}
 
-// Mermaid renders $$...$$ labels with KaTeX's MathML output. These are KaTeX's
-// MathML element types, without annotation (Mermaid strips it), semantics (only
-// a wrapper, so its content is kept), and mglyph (a trusted-input image).
+// MathML element types KaTeX emits, without annotation (the resolver removes it),
+// semantics (only a wrapper, so its content is kept), and mglyph (an image).
 const KATEX_MATHML_TAGS = new Set([
   "math",
   "menclose",
@@ -60,8 +120,8 @@ const KATEX_MATHML_TAGS = new Set([
   "munder",
   "munderover",
 ]);
-// Presentation attributes KaTeX sets on those elements. The existing profiles
-// already cover class, style, width, height, display, and xmlns.
+// Presentation attributes KaTeX sets on those elements. The profiles already
+// cover class, style, width, height, display, and xmlns.
 const KATEX_MATHML_ATTRIBUTES = new Set([
   "accent",
   "accentunder",
@@ -91,115 +151,51 @@ const KATEX_MATHML_ATTRIBUTES = new Set([
   "voffset",
 ]);
 
-// Diagrams can come from untrusted PR descriptions, so strip anything that can
-// navigate, run script, or fetch remote content on top of Mermaid's own strict
-// sanitization.
-export function sanitizeMermaidSvg(svg: string): string {
-  if (!purifier) {
-    purifier = DOMPurify(window);
-    purifier.addHook("uponSanitizeElement", (node, data) => {
-      if (data.tagName === "style" && node.textContent) {
-        node.textContent = node.textContent.replace(REMOTE_CSS_URL, "none");
-      }
-    });
-    purifier.addHook("uponSanitizeAttribute", (_node, data) => {
-      if (data.attrName === "style")
-        data.attrValue = data.attrValue.replace(REMOTE_CSS_URL, "none");
-    });
-  }
-  const sanitized = purifier.sanitize(svg, {
-    // DOMPurify still only accepts <math> under an HTML parent, here the label
-    // <div> inside <foreignObject>, and checks every MathML child's namespace.
+let purifier: ReturnType<typeof DOMPurify> | null = null;
+
+// Diagrams can come from untrusted PR descriptions. Pele escapes labels and
+// links and images are off, so this is defense in depth against anything that
+// could navigate, run script, or fetch remote content.
+function sanitizeDiagramSvg(svg: string): Node {
+  purifier ??= DOMPurify(window);
+  return purifier.sanitize(svg, {
+    FORBID_ATTR: ["href", "xlink:href", "src", "srcset"],
+    FORBID_TAGS: ["a", "image", "foreignObject", "style"],
+    USE_PROFILES: { svg: true, svgFilters: true },
+    RETURN_DOM_FRAGMENT: true,
+  });
+}
+
+// Pele puts MathML labels in a <foreignObject> with an HTML <div> around them.
+function sanitizeMathDiagramSvg(svg: string): Node {
+  purifier ??= DOMPurify(window);
+  return purifier.sanitize(svg, {
+    // DOMPurify still only accepts <math> under an HTML parent and checks every
+    // MathML child's namespace.
     ADD_TAGS: ["foreignObject", ...KATEX_MATHML_TAGS],
     ADD_ATTR: (attribute, tagName) =>
       KATEX_MATHML_TAGS.has(tagName) && KATEX_MATHML_ATTRIBUTES.has(attribute),
     HTML_INTEGRATION_POINTS: { foreignobject: true },
     FORBID_ATTR: ["href", "xlink:href", "src", "srcset"],
-    FORBID_TAGS: ["a", "img", "image", "script"],
+    FORBID_TAGS: ["a", "img", "image", "script", "style"],
     USE_PROFILES: { svg: true, svgFilters: true, html: true },
+    RETURN_DOM_FRAGMENT: true,
   });
-  // The expanded image parses this as XML, which has no &nbsp; entity. KaTeX
-  // writes spaces in math as U+00A0, which HTML serialization turns into &nbsp;.
-  return sanitized.replaceAll("&nbsp;", "&#160;");
-}
-
-// Mermaid also lazy-loads diagram chunks inside render(); losing the network
-// there is worth a retry, unlike a syntax error.
-const CHUNK_LOAD_ERROR = /dynamically imported module|importing a module script|failed to fetch/i;
-
-async function renderMermaid(
-  source: string,
-  theme: "light" | "dark",
-): Promise<MermaidRenderResult> {
-  const id = `mermaid-diagram-${nextDiagramId++}`;
-  let mermaid: Mermaid;
-  try {
-    mermaid = await loadMermaid();
-  } catch {
-    return { status: "error", message: "Mermaid failed to load.", retryable: true };
-  }
-  try {
-    // initialize() mutates global config, so renders run one at a time.
-    mermaid.initialize({
-      startOnLoad: false,
-      securityLevel: "strict",
-      suppressErrorRendering: true,
-      // HTML labels and theme CSS are mounted while Mermaid lays the diagram
-      // out, before sanitizing, so diagram directives must not set them.
-      secure: [
-        "secure",
-        "securityLevel",
-        "startOnLoad",
-        "maxTextSize",
-        "suppressErrorRendering",
-        "maxEdges",
-        "htmlLabels",
-        "themeCSS",
-      ],
-      htmlLabels: false,
-      flowchart: { htmlLabels: false },
-      theme: theme === "dark" ? "dark" : "default",
-      fontFamily: getComputedStyle(document.body).fontFamily,
-    });
-    const { svg } = await mermaid.render(id, source);
-    return { status: "rendered", svg: sanitizeMermaidSvg(svg) };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "The diagram could not be rendered.";
-    return { status: "error", message, retryable: CHUNK_LOAD_ERROR.test(message) };
-  } finally {
-    document.getElementById(`d${id}`)?.remove();
-  }
-}
-
-function evictSettledRenders() {
-  for (const [key, result] of renderCache) {
-    if (renderCache.size <= MAX_CACHED_RENDERS) return;
-    if (settledRenders.has(result)) renderCache.delete(key);
-  }
 }
 
-function mermaidRenderKey(source: string, theme: "light" | "dark") {
-  return `${theme}\n${source}`;
-}
-
-function mermaidRenderPromise(source: string, theme: "light" | "dark") {
-  const key = mermaidRenderKey(source, theme);
-  const cached = renderCache.get(key);
-  if (cached) {
-    renderCache.delete(key);
-    renderCache.set(key, cached);
-    return cached;
-  }
-  const result = renderQueue.then(() => renderMermaid(source, theme));
-  renderQueue = result;
-  void result.then(() => {
-    settledRenders.add(result);
-    evictSettledRenders();
-  });
-  renderCache.set(key, result);
-  evictSettledRenders();
-  return result;
-}
+// Pele colors diagrams through these, which a standalone image cannot inherit.
+const PELE_COLOR_VARIABLES = [
+  "--pele-bg",
+  "--pele-fg",
+  "--pele-muted",
+  "--pele-line",
+  "--pele-surface",
+  "--pele-surface-alt",
+  "--pele-border",
+  "--pele-accent",
+  "--pele-critical",
+  ...Array.from({ length: 8 }, (_, index) => `--pele-series-${index + 1}`),
+];
 
 let expandedImageUrl: string | null = null;
 
@@ -207,21 +203,15 @@ let expandedImageUrl: string | null = null;
  * A blob URL, unlike a data URL, passes the desktop connect-src policy that media
  * save and copy actions fetch through.
  */
-function mermaidImageUrl(svg: string): string {
-  const svgDocument = new DOMParser().parseFromString(svg, "image/svg+xml");
-  const element = svgDocument.documentElement;
-  const viewBox = element.getAttribute("viewBox")?.trim().split(/\s+/).map(Number);
-  if (viewBox?.length === 4 && viewBox.every(Number.isFinite)) {
-    element.setAttribute("width", String(viewBox[2]));
-    element.setAttribute("height", String(viewBox[3]));
+function diagramImageUrl(svg: SVGSVGElement): string {
+  const element = svg.cloneNode(true) as SVGSVGElement;
+  const computed = getComputedStyle(svg);
+  for (const name of PELE_COLOR_VARIABLES) {
+    const value = computed.getPropertyValue(name).trim();
+    if (value) element.style.setProperty(name, value);
   }
-  element.setAttribute("xmlns", "http://www.w3.org/2000/svg");
   element.style.maxWidth = "none";
-  // A standalone image inherits nothing from the page, including the text color
-  // that HTML labels such as math use.
-  const { backgroundColor, color } = getComputedStyle(document.body);
-  element.style.backgroundColor = backgroundColor;
-  element.style.color = color;
+  element.style.backgroundColor = getComputedStyle(document.body).backgroundColor;
   if (expandedImageUrl) URL.revokeObjectURL(expandedImageUrl);
   expandedImageUrl = URL.createObjectURL(
     new Blob([new XMLSerializer().serializeToString(element)], { type: "image/svg+xml" }),
@@ -231,42 +221,50 @@ function mermaidImageUrl(svg: string): string {
 
 export function MermaidDiagram({
   source,
-  theme,
   onExpand,
 }: {
   source: string;
-  theme: "light" | "dark";
   onExpand: (imageUrl: string) => void;
 }) {
   const [, setAttempt] = useState(0);
-  const result = use(mermaidRenderPromise(source.trim(), theme));
+  const [renderError, setRenderError] = useState<string | null>(null);
+  const containerRef = useRef<HTMLSpanElement>(null);
+  const trimmedSource = source.trim();
+  const core = use(loadCore());
+  const type = core.status === "loaded" ? detectDiagramType(core.pele, trimmedSource) : null;
+  const load = core.status === "loaded" && type ? use(loadDiagramType(core.pele, type)) : core;
+  const math = trimmedSource.includes("$$") ? use(loadMath()) : null;
+
+  useLayoutEffect(() => {
+    const container = containerRef.current;
+    if (load.status !== "loaded" || !container) return;
+    const mounted = load.pele.mount(container, trimmedSource, {
+      links: false,
+      images: false,
+      zoom: false,
+      // Keep the author's direction; a wide diagram scales down to fit instead of turning vertical.
+      autoDirection: false,
+      ...(math ? { math, sanitize: sanitizeMathDiagramSvg } : { sanitize: sanitizeDiagramSvg }),
+      onRender: () => setRenderError(null),
+      onError: (error) =>
+        setRenderError(
+          error instanceof Error ? error.message : "The diagram could not be rendered.",
+        ),
+    });
+    return () => mounted.destroy();
+  }, [load, math, trimmedSource]);
 
-  if (result.status === "error") {
+  if (load.status === "failed") {
     return (
-      <div>
-        <div className="flex items-center justify-between gap-2">
-          <p className="m-0 text-xs text-destructive">Unable to render diagram: {result.message}</p>
-          {result.retryable ? (
-            <Button
-              type="button"
-              variant="ghost"
-              size="xs"
-              onClick={() => {
-                renderCache.delete(mermaidRenderKey(source.trim(), theme));
-                setAttempt((attempt) => attempt + 1);
-              }}
-            >
-              Retry
-            </Button>
-          ) : null}
-        </div>
-        <pre
-          data-thread-find-ignore
-          className="mt-2 mb-0 overflow-auto font-mono text-xs whitespace-pre-wrap"
-        >
-          {source}
-        </pre>
-      </div>
+      <DiagramError
+        message="The diagram renderer failed to load."
+        source={source}
+        onRetry={() => {
+          if (core.status === "failed") coreLoad = null;
+          if (type) diagramLoads.delete(type);
+          setAttempt((attempt) => attempt + 1);
+        }}
+      />
     );
   }
 
@@ -276,13 +274,48 @@ export function MermaidDiagram({
       data-markdown-mermaid=""
       data-markdown-copy={serializeCodeBlockToMarkdown(source, "mermaid")}
     >
+      {renderError ? <DiagramError message={renderError} source={source} /> : null}
       <button
         type="button"
         aria-label="Expand diagram"
-        className="flex w-full cursor-zoom-in justify-center rounded-md focus-visible:outline-2 focus-visible:outline-ring [&_svg]:h-auto [&_svg]:max-w-full"
-        onClick={() => onExpand(mermaidImageUrl(result.svg))}
-        dangerouslySetInnerHTML={{ __html: result.svg }}
-      />
+        hidden={renderError !== null}
+        className="block w-full cursor-zoom-in rounded-md focus-visible:outline-2 focus-visible:outline-ring"
+        onClick={() => {
+          const svg = containerRef.current?.querySelector("svg");
+          if (svg) onExpand(diagramImageUrl(svg));
+        }}
+      >
+        <span ref={containerRef} className="flex w-full justify-center" />
+      </button>
+    </div>
+  );
+}
+
+function DiagramError({
+  message,
+  source,
+  onRetry,
+}: {
+  message: string;
+  source: string;
+  onRetry?: () => void;
+}) {
+  return (
+    <div>
+      <div className="flex items-center justify-between gap-2">
+        <p className="m-0 text-xs text-destructive">Unable to render diagram: {message}</p>
+        {onRetry ? (
+          <Button type="button" variant="ghost" size="xs" onClick={onRetry}>
+            Retry
+          </Button>
+        ) : null}
+      </div>
+      <pre
+        data-thread-find-ignore
+        className="mt-2 mb-0 overflow-auto font-mono text-xs whitespace-pre-wrap"
+      >
+        {source}
+      </pre>
     </div>
   );
 }
diff --git a/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx b/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
index 7b99f41dad7c..74680934ab95 100644
--- a/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
+++ b/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
@@ -43,6 +43,13 @@ vi.mock(import("~/state/query"), async (original) => ({
   })) as never,
 }));
 
+// The first Mermaid render loads the library and its flowchart chunk, which took over
+// 10 seconds on a busy release runner. Pay that while the file loads, not inside a test.
+{
+  const pele = await import("pele/lazy");
+  await pele.load("flowchart");
+}
+
 const ENVIRONMENT_ID = EnvironmentId.make("environment-local");
 const CREATED_AT = "2026-03-17T19:12:28.000Z";
 
@@ -215,10 +222,8 @@ describe("MessagesTimeline work rows", () => {
     );
     const row = screen.container.querySelector<HTMLElement>('[data-v2-item-type="file_change"]')!;
     const press = async (target: HTMLElement) => {
-      await act(async () => {
-        target.focus();
-        await userEvent.keyboard(key);
-      });
+      target.focus();
+      await userEvent.keyboard(key);
     };
     expect(row.getAttribute("aria-expanded")).toBe("false");
     await press(row);
diff --git a/apps/web/src/components/chat/ProviderModelPicker.browser.test.tsx b/apps/web/src/components/chat/ProviderModelPicker.browser.test.tsx
index 21a39de1f767..95b2d99e4ce5 100644
--- a/apps/web/src/components/chat/ProviderModelPicker.browser.test.tsx
+++ b/apps/web/src/components/chat/ProviderModelPicker.browser.test.tsx
@@ -12,7 +12,7 @@ import { page, userEvent } from "vite-plus/test/browser";
 
 import "~/index.css";
 
-import { act, render as renderUi } from "../../../test/render";
+import { render as renderUi } from "../../../test/render";
 import { deriveProviderInstanceEntries } from "../../providerInstances";
 import { ProviderModelPicker } from "./ProviderModelPicker";
 import type { ModelEsque } from "./providerIconUtils";
@@ -85,7 +85,7 @@ function renderPicker(input: {
 }
 
 async function click(target: Parameters<typeof userEvent.click>[0]) {
-  await act(async () => userEvent.click(target));
+  await userEvent.click(target);
 }
 
 async function openLegacyPicker(activeModel: string) {
diff --git a/apps/web/src/components/chat/QueuedRunsControl.browser.test.tsx b/apps/web/src/components/chat/QueuedRunsControl.browser.test.tsx
index 14a68afcb434..58da8b82f2a8 100644
--- a/apps/web/src/components/chat/QueuedRunsControl.browser.test.tsx
+++ b/apps/web/src/components/chat/QueuedRunsControl.browser.test.tsx
@@ -30,7 +30,7 @@ vi.mock(import("../../assets/assetUrls"), async (importOriginal) => ({
     resources.map((resource) => `https://assets.test/${resource.attachmentId}`)) as never,
 }));
 
-import { act, render as renderUi } from "../../../test/render";
+import { render as renderUi } from "../../../test/render";
 import { QueuedRunsControl } from "./QueuedRunsControl";
 
 function setup() {
@@ -204,9 +204,7 @@ it("previews assistant quotes as readable text and preserves the citation when e
     .element(page.getByText(`${quotedText} Why per worktree?`, { exact: true }))
     .toBeVisible();
 
-  await act(async () => {
-    await page.getByRole("button", { name: "Edit queued message", exact: true }).nth(1).click();
-  });
+  await page.getByRole("button", { name: "Edit queued message", exact: true }).nth(1).click();
   expect(onEditQueuedRun).toHaveBeenCalledExactlyOnceWith(
     expect.objectContaining({ text: quoteAndText }),
   );
diff --git a/apps/web/src/components/chat/ThreadErrorBanner.browser.test.tsx b/apps/web/src/components/chat/ThreadErrorBanner.browser.test.tsx
index a25bb6eb6e62..0097c191d827 100644
--- a/apps/web/src/components/chat/ThreadErrorBanner.browser.test.tsx
+++ b/apps/web/src/components/chat/ThreadErrorBanner.browser.test.tsx
@@ -1,4 +1,4 @@
-import { act, render as renderUi } from "../../../test/render";
+import { render as renderUi } from "../../../test/render";
 import "../../index.css";
 
 import { expect, it } from "vite-plus/test";
@@ -15,13 +15,13 @@ it("expands even a short JSON error to its exact diagnostics and collapses back
   await expect.element(page.getByText("Turn failed", { exact: true })).toBeVisible();
   expect(container.textContent).not.toContain("unsupported_value");
 
-  await act(async () => page.getByRole("button", { name: "Show full error" }).click());
+  await page.getByRole("button", { name: "Show full error" }).click();
 
   const diagnostics = page.getByText(error, { exact: true });
   await expect.element(diagnostics).toBeVisible();
   expect(diagnostics.element().textContent).toBe(error);
 
-  await act(async () => page.getByRole("button", { name: "Show less" }).click());
+  await page.getByRole("button", { name: "Show less" }).click();
 
   await expect.element(page.getByText("Turn failed", { exact: true })).toBeVisible();
   expect(container.textContent).not.toContain("unsupported_value");
diff --git a/apps/web/src/components/chat/composerFocusRedirect.browser.test.ts b/apps/web/src/components/chat/composerFocusRedirect.browser.test.ts
index d0e0f78dce52..8f5f195ae847 100644
--- a/apps/web/src/components/chat/composerFocusRedirect.browser.test.ts
+++ b/apps/web/src/components/chat/composerFocusRedirect.browser.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from "vite-plus/test";
+import { describe, expect, it } from "vite-plus/test";
 
 import { shouldTypeToFocusComposer } from "./composerFocusRedirect";
 
@@ -15,14 +15,15 @@ function typeOn(target: Element, key: string): boolean {
   return redirected;
 }
 
-afterEach(() => {
-  document.body.replaceChildren();
-});
+function attach(element: Element): Disposable {
+  document.body.append(element);
+  return { [Symbol.dispose]: () => element.remove() };
+}
 
 describe("shouldTypeToFocusComposer", () => {
   it("sends letters typed on the chat to the composer", () => {
     const chat = document.createElement("div");
-    document.body.append(chat);
+    using _chat = attach(chat);
 
     expect(typeOn(chat, "a")).toBe(true);
   });
@@ -31,7 +32,7 @@ describe("shouldTypeToFocusComposer", () => {
     const deviceScreen = document.createElement("div");
     deviceScreen.setAttribute("role", "application");
     deviceScreen.tabIndex = 0;
-    document.body.append(deviceScreen);
+    using _deviceScreen = attach(deviceScreen);
 
     expect(typeOn(deviceScreen, "a")).toBe(false);
   });
diff --git a/apps/web/src/components/chat/threadFindPosition.browser.test.ts b/apps/web/src/components/chat/threadFindPosition.browser.test.ts
index 792cdba1fcb6..60ef3068557d 100644
--- a/apps/web/src/components/chat/threadFindPosition.browser.test.ts
+++ b/apps/web/src/components/chat/threadFindPosition.browser.test.ts
@@ -1,15 +1,7 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { describe, expect, it, vi } from "vite-plus/test";
 import { readThreadFindPosition } from "./threadFindPosition";
 
-afterEach(() => vi.restoreAllMocks());
-beforeEach(() => {
-  Object.defineProperty(Range.prototype, "getBoundingClientRect", {
-    configurable: true,
-    writable: true,
-    value: () => new DOMRect(),
-  });
-});
-
+// The container stays detached, so unmocked ranges measure as an empty rect.
 function viewport(text = "COD4 COD4") {
   const container = document.createElement("div");
   container.innerHTML = `<div data-timeline-row-id="above"><div data-thread-find-text>COD4</div></div>
@@ -27,7 +19,9 @@ function viewport(text = "COD4 COD4") {
 describe("reading position for find", () => {
   it("skips earlier rows and occurrences above the viewport within the current message", () => {
     const container = viewport();
-    vi.spyOn(Range.prototype, "getBoundingClientRect").mockImplementation(function (this: Range) {
+    using _ranges = vi.spyOn(Range.prototype, "getBoundingClientRect").mockImplementation(function (
+      this: Range,
+    ) {
       return new DOMRect(0, this.startOffset === 0 ? 60 : 160, 40, 20);
     });
     expect(readThreadFindPosition(container, "COD4", (id) => id, 100)).toEqual({
@@ -38,7 +32,9 @@ describe("reading position for find", () => {
 
   it("starts after the current message when all its occurrences are above the viewport", () => {
     const container = viewport();
-    vi.spyOn(Range.prototype, "getBoundingClientRect").mockReturnValue(new DOMRect(0, 60, 40, 20));
+    using _ranges = vi
+      .spyOn(Range.prototype, "getBoundingClientRect")
+      .mockReturnValue(new DOMRect(0, 60, 40, 20));
     expect(readThreadFindPosition(container, "COD4", (id) => id, 100)).toEqual({
       entryId: "reading",
       occurrence: 2,
diff --git a/apps/web/src/components/desktop/SnapShotCoordinator.browser.test.ts b/apps/web/src/components/desktop/SnapShotCoordinator.browser.test.ts
index b38e2f7018df..2c5901116091 100644
--- a/apps/web/src/components/desktop/SnapShotCoordinator.browser.test.ts
+++ b/apps/web/src/components/desktop/SnapShotCoordinator.browser.test.ts
@@ -9,9 +9,10 @@ import {
   ProjectId,
   ThreadId,
 } from "@t3tools/contracts";
-import { act, createElement } from "react";
-import { createRoot, type Root } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { createElement } from "react";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { act, fakeTimers, render, type Screen } from "../../../test/render";
 
 import { DraftId, useComposerDraftStore } from "../../composerDraftStore";
 import type { DesktopSnapShotBridge } from "../../lib/desktopSnapShot";
@@ -66,7 +67,8 @@ const storage = vi.hoisted(() => {
 const environmentId = EnvironmentId.make("snap-shot-environment");
 const projectRef = scopeProjectRef(environmentId, ProjectId.make("snap-shot-project"));
 
-beforeEach(() => {
+// Tests stub globals and spy on module exports freely; disposing restores all of them.
+function setup(): Disposable {
   storage.clear();
   vi.stubGlobal("localStorage", storage);
   useComposerDraftStore.setState({
@@ -76,17 +78,18 @@ beforeEach(() => {
     stickyModelSelectionByProvider: {},
     stickyActiveProvider: null,
   });
-});
-
-afterEach(() => {
-  dismissAllSnapShotAnimations();
-  vi.useRealTimers();
-  vi.unstubAllGlobals();
-  vi.restoreAllMocks();
-});
+  return {
+    [Symbol.dispose]() {
+      dismissAllSnapShotAnimations();
+      vi.unstubAllGlobals();
+      vi.restoreAllMocks();
+    },
+  };
+}
 
 describe("window capture failures", () => {
   it("dismisses an older failed capture without disturbing a newer capture", async () => {
+    using _env = setup();
     const target = DraftId.make("snap-shot-draft");
     const pendingStarts = new Set<string>();
     const soundedIds = new Set(["older", "newer"]);
@@ -113,6 +116,7 @@ describe("window capture failures", () => {
   });
 
   it("does not resurrect a failed capture when its draft becomes ready later", async () => {
+    using _env = setup();
     const target = DraftId.make("snap-shot-draft");
     let resolveTarget: ((target: DraftId) => void) | undefined;
     const targetReady = new Promise<DraftId>((resolve) => {
@@ -133,6 +137,7 @@ describe("window capture failures", () => {
   });
 
   it("keeps global failures dismissing all active and pending captures", async () => {
+    using _env = setup();
     const target = DraftId.make("snap-shot-draft");
     let resolveTarget: ((target: DraftId) => void) | undefined;
     const targetReady = new Promise<DraftId>((resolve) => {
@@ -168,10 +173,7 @@ describe("pending snapshot processing", () => {
     },
   };
   const target = scopeThreadRef(environmentId, ThreadId.make("enabled-thread"));
-  let root: Root;
-  let container: HTMLDivElement;
-
-  function setup(routeThreadRef: typeof target | null = target) {
+  function coordinatorFixture(routeThreadRef: typeof target | null = target) {
     let currentSettings = {
       ...DEFAULT_CLIENT_SETTINGS,
       snapShotEnabled: true,
@@ -212,43 +214,44 @@ describe("pending snapshot processing", () => {
     const sound = vi.spyOn(snapShotSound, "playSnapShotSound").mockImplementation(() => undefined);
     const toast = vi.spyOn(toastManager, "add").mockReturnValue("toast-id");
     vi.stubGlobal("desktopBridge", bridge);
-    vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
-    container = document.createElement("div");
-    document.body.append(container);
-    root = createRoot(container);
-    const render = () => act(async () => root.render(createElement(SnapShotCoordinator)));
+    let screen: Screen | undefined;
+    // Settings and route changes rerender the same coordinator instead of remounting it.
+    const renderCoordinator = async () => {
+      if (screen) await screen.rerender(createElement(SnapShotCoordinator));
+      // useHandleNewThread is mocked above, so nothing in the coordinator touches the router.
+      else screen = await render(createElement(SnapShotCoordinator), { router: false });
+    };
     return {
       bridge,
       route,
       sound,
       toast,
-      render,
+      render: renderCoordinator,
       setPending: (items: typeof pending) => {
         pending = items;
       },
       setEnabled: async (snapShotEnabled: boolean) => {
         currentSettings = { ...currentSettings, snapShotEnabled };
-        await render();
+        await renderCoordinator();
       },
       emit: (event: DesktopSnapShotEvent) =>
         act(async () => {
           for (const listener of listeners) listener(event);
         }),
+      [Symbol.asyncDispose]: async () => {
+        await screen?.[Symbol.asyncDispose]();
+      },
     };
   }
 
-  afterEach(async () => {
-    await act(async () => root?.unmount());
-    container?.remove();
-  });
-
   const focus = () =>
     act(async () => {
       window.dispatchEvent(new Event("focus"));
     });
 
   it("leaves captures untouched while disabled and resumes them when enabled again", async () => {
-    const fixture = setup();
+    using _env = setup();
+    await using fixture = coordinatorFixture();
     const { bridge, sound, toast } = fixture;
     await fixture.setEnabled(false);
     await focus();
@@ -287,7 +290,8 @@ describe("pending snapshot processing", () => {
   });
 
   it("reports each pending capture failure once, allows a new failure kind, and resets after success", async () => {
-    const fixture = setup(null);
+    using _env = setup();
+    await using fixture = coordinatorFixture(null);
     const { bridge, sound, toast, route } = fixture;
     await fixture.render();
     await focus();
@@ -337,7 +341,8 @@ describe("pending snapshot processing", () => {
   });
 
   it("suppresses deferred failures while disabled and reports fresh failures after re-enable", async () => {
-    const fixture = setup();
+    using _env = setup();
+    await using fixture = coordinatorFixture();
     const { bridge, sound, toast } = fixture;
     let rejectRead: ((error: Error) => void) | undefined;
     bridge.readSnapShot.mockReturnValueOnce(
@@ -404,7 +409,8 @@ describe("pending snapshot processing", () => {
   });
 
   it("keeps a capture pending when disabled during target resolution, then retries on re-enable", async () => {
-    const fixture = setup(null);
+    using _env = setup();
+    await using fixture = coordinatorFixture(null);
     const { bridge, route } = fixture;
     route.defaultProjectRef = projectRef;
     const draftId = DraftId.make("resolving-snapshot");
@@ -432,7 +438,8 @@ describe("pending snapshot processing", () => {
   });
 
   it("finishes and acknowledges delivery already reading when disabled", async () => {
-    const fixture = setup();
+    using _env = setup();
+    await using fixture = coordinatorFixture();
     let finishReading: ((value: typeof capture) => void) | undefined;
     const reading = new Promise<typeof capture>((resolve) => {
       finishReading = resolve;
@@ -467,7 +474,8 @@ describe("window capture delivery", () => {
   ])(
     "preserves capture contents for $target before a stalled animation finishes ($accessibleText)",
     async ({ target, accessibleText }) => {
-      vi.useFakeTimers();
+      using _env = setup();
+      using _timers = fakeTimers();
       const never = new Promise<void>(() => undefined);
       const animationFrames: Array<FrameRequestCallback> = [];
       const acknowledgeSnapShot = vi.fn(async () => undefined);
@@ -574,6 +582,7 @@ describe("window capture delivery", () => {
 
 describe("window capture target resolution", () => {
   it("shares bare-route draft creation between animation start and capture drain", async () => {
+    using _env = setup();
     const draftId = DraftId.make("snap-shot-draft");
     let finishResolution: ((target: DraftId) => void) | undefined;
     const resolveTarget = vi.fn(
@@ -595,6 +604,7 @@ describe("window capture target resolution", () => {
   });
 
   it("follows a draft to its promoted server thread", () => {
+    using _env = setup();
     const draftId = DraftId.make("snap-shot-draft");
     const promotedRef = scopeThreadRef(environmentId, ThreadId.make("snap-shot-promoted-thread"));
     const store = useComposerDraftStore.getState();
@@ -607,6 +617,7 @@ describe("window capture target resolution", () => {
   });
 
   it("keeps the routed server thread before its shell loads", () => {
+    using _env = setup();
     const routeThreadRef = scopeThreadRef(environmentId, ThreadId.make("snap-shot-routed-thread"));
 
     expect(resolveExistingSnapShotTarget(routeThreadRef, routeThreadRef)).toEqual(routeThreadRef);
@@ -638,6 +649,7 @@ describe("open question delivery", () => {
   };
 
   it("attaches a capture to the open question draft and leaves the thread draft alone", async () => {
+    using _env = setup();
     const pins = new Map();
     const untrack = trackOpenQuestionAttachmentDraft(threadRef, request);
     try {
@@ -655,6 +667,7 @@ describe("open question delivery", () => {
   });
 
   it("falls back to the thread when a newer question replaces the pinned one during compression", async () => {
+    using _env = setup();
     const pins = new Map();
     const untrackFirst = trackOpenQuestionAttachmentDraft(threadRef, request);
     let untrackSecond = () => {};
@@ -686,6 +699,7 @@ describe("open question delivery", () => {
   });
 
   it("keeps a capture pinned before any question off a question that opens during the read", async () => {
+    using _env = setup();
     const pins = new Map();
     const resolveTarget = () => resolveSnapShotAttachmentTarget(pins, capture.id, threadRef);
     // The drain pins a capture it never saw requested before reading it.
@@ -707,6 +721,7 @@ describe("open question delivery", () => {
   });
 
   it("refuses a capture once the request's other questions hold the shared limit", async () => {
+    using _env = setup();
     useComposerDraftStore.getState().addImages(
       first,
       Array.from({ length: PROVIDER_SEND_TURN_MAX_ATTACHMENTS }, (_, index) => ({
@@ -739,6 +754,7 @@ describe("durable snapshot delivery", () => {
   it.each([false, true])(
     "retains a capture on quota failure and retries without duplicates (staged: %s)",
     async (staged) => {
+      using _env = setup();
       const target = scopeThreadRef(environmentId, ThreadId.make("quota-thread"));
       const capture = {
         id: "12345678-1234-1234-1234-123456789abc",
@@ -798,6 +814,7 @@ describe("snapshot destination ownership", () => {
   it.each(["unmount", "blur", "disabled animations"])(
     "keeps the original environment and thread after %s",
     async (reason) => {
+      using _env = setup();
       const original = scopeThreadRef(environmentId, ThreadId.make("original"));
       const next = scopeThreadRef(EnvironmentId.make("another-environment"), ThreadId.make("next"));
       const targets = new Map<string, Promise<typeof original | null>>();
diff --git a/apps/web/src/components/diffs/StyledDiffCodeView.browser.test.tsx b/apps/web/src/components/diffs/StyledDiffCodeView.browser.test.tsx
index 8fbd98a35860..62fd79f6706c 100644
--- a/apps/web/src/components/diffs/StyledDiffCodeView.browser.test.tsx
+++ b/apps/web/src/components/diffs/StyledDiffCodeView.browser.test.tsx
@@ -1,4 +1,4 @@
-import { act, render, fakeTimers } from "../../../test/render";
+import { act, render, fakeTimers, type Screen } from "../../../test/render";
 import {
   CodeView,
   FileDiff,
@@ -146,9 +146,16 @@ function renderViews(count: number) {
   );
 }
 
-const codeFile = (name: string) =>
-  document.querySelector(`[data-code-file="${name}"]`)?.textContent ?? "";
-const loadingViews = () => document.querySelectorAll('[role="status"]').length;
+// Pierre rejects a pool whose workers take 10s to start. Real workers share the runner with the
+// rest of the suite, so outside the test of that limit the test's own timeout is the only deadline.
+const UNLIMITED_WORKER_STARTUP_MS = 120_000;
+
+// Queries stay inside the test's own container: a timed-out test keeps running and leaves its
+// views mounted while the next test starts.
+const codeFile = (container: HTMLElement, name: string) =>
+  container.querySelector(`[data-code-file="${name}"]`)?.textContent ?? "";
+const loadingViews = (container: HTMLElement) =>
+  container.querySelectorAll('[role="status"]').length;
 
 describe("code-view worker lifecycle", () => {
   function setup() {
@@ -165,7 +172,7 @@ describe("code-view worker lifecycle", () => {
   // Worker startup runs on real time, so only the idle expiry checks use this clock.
   // Faking startup too would let advancing the idle clock time out a worker startup.
   const idleClock = () => fakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
-  async function workerEnvironment() {
+  async function workerEnvironment({ startupLimit = UNLIMITED_WORKER_STARTUP_MS } = {}) {
     await using stack = new AsyncDisposableStack();
     // Pins the pool at two workers whatever machine runs the suite.
     stack.use(vi.spyOn(navigator, "hardwareConcurrency", "get").mockReturnValue(2));
@@ -175,6 +182,9 @@ describe("code-view worker lifecycle", () => {
         this: WorkerPoolManager,
         ...args
       ) {
+        // The provider builds the pool without this option, so it is set before startup reads it.
+        const options: { workerInitializationTimeout?: number } = Reflect.get(this, "options");
+        options.workerInitializationTimeout = startupLimit;
         const pending = initialize.apply(this, args);
         testState.pools.set(this, pending);
         return pending;
@@ -200,11 +210,13 @@ describe("code-view worker lifecycle", () => {
     };
   }
 
-  it("starts on demand, keeps quick reopens warm, and expires the last closed pool", async () => {
+  // Two cold starts of real workers can outlast the default timeout on a loaded runner.
+  it("starts workers on demand and expires idle pools", { timeout: 30_000 }, async () => {
     setup();
     await using workers = await workerEnvironment();
     const view = await workers.render(renderViews(0));
-    const button = document.querySelector("button")!;
+    const { container } = view;
+    const button = container.querySelector("button")!;
     expect(testState.workers).toHaveLength(0);
     expect(testState.pools.size).toBe(0);
     await act(async () => button.click());
@@ -213,7 +225,9 @@ describe("code-view worker lifecycle", () => {
     await act(async () => testState.pools.get(pool));
     expect(pool.isInitialized()).toBe(true);
     expect(testState.workers).toHaveLength(2);
-    await vi.waitFor(() => expect(codeFile("notes.txt")).toContain("Plain text is ready."));
+    await vi.waitFor(() =>
+      expect(codeFile(container, "notes.txt")).toContain("Plain text is ready."),
+    );
     expect(testState.requests.filter((request) => request.type === "file")).toHaveLength(0);
 
     await view.rerender(renderViews(2));
@@ -222,7 +236,7 @@ describe("code-view worker lifecycle", () => {
     expect(testState.workers).toHaveLength(2);
     expect(new Set(testState.renderPools)).toEqual(new Set([pool]));
     expect(pool.getFileResultCache(files[1]!)).toBeDefined();
-    await vi.waitFor(() => expect(codeFile("answer.ts")).toContain("answer"));
+    await vi.waitFor(() => expect(codeFile(container, "answer.ts")).toContain("answer"));
 
     {
       using _idleClock = idleClock();
@@ -237,7 +251,7 @@ describe("code-view worker lifecycle", () => {
       await view.rerender(renderViews(1));
       expect(testState.pools.size).toBe(1);
       expect(testState.workers).toHaveLength(2);
-      expect(loadingViews()).toBe(0);
+      expect(loadingViews(container)).toBe(0);
       expect(pool.getFileResultCache(files[1]!)).toBeDefined();
       await vi.advanceTimersByTimeAsync(30_000);
       expect(pool.getStats().totalWorkers).toBe(2);
@@ -253,16 +267,18 @@ describe("code-view worker lifecycle", () => {
     await act(async () => testState.pools.get(reopenedPool));
     expect(reopenedPool.isInitialized()).toBe(true);
     expect(testState.workers).toHaveLength(4);
-    expect(document.querySelector("button")).toBe(button);
+    expect(container.querySelector("button")).toBe(button);
     expect(button.textContent).toBe("Edited draft");
-    await vi.waitFor(() => expect(codeFile("notes.txt")).toContain("Plain text is ready."));
+    await vi.waitFor(() =>
+      expect(codeFile(container, "notes.txt")).toContain("Plain text is ready."),
+    );
   });
 
   it("renders through Pierre's main-thread fallback when worker creation fails", async () => {
     setup();
     await using workers = await workerEnvironment();
     testState.failWorkers = true;
-    await workers.render(renderViews(1));
+    const { container } = await workers.render(renderViews(1));
     const pool = [...testState.pools.keys()][0]!;
     await act(async () => {
       await expect(testState.pools.get(pool)).rejects.toMatchObject({ _tag: "DiffWorkerError" });
@@ -274,13 +290,16 @@ describe("code-view worker lifecycle", () => {
     });
     expect(pool.isWorkingPool()).toBe(false);
     expect(testState.workers).toHaveLength(0);
-    await vi.waitFor(() => expect(codeFile("notes.txt")).toContain("Plain text is ready."));
+    await vi.waitFor(() =>
+      expect(codeFile(container, "notes.txt")).toContain("Plain text is ready."),
+    );
   });
 
   it("keeps an initializing pool until its last view closes and ignores late responses", async () => {
     setup();
     using _idleClock = idleClock();
-    await using workers = await workerEnvironment();
+    // Runs Pierre's own startup limit on the fake clock.
+    await using workers = await workerEnvironment({ startupLimit: 10_000 });
     testState.holdInitialization = true;
     const held = new Promise<void>((resolve) => {
       testState.onInitializationHeld = resolve;
@@ -291,14 +310,14 @@ describe("code-view worker lifecycle", () => {
     await held;
     expect(pool.isInitialized()).toBe(false);
     expect(testState.pools.size).toBe(1);
-    expect(loadingViews()).toBe(2);
+    expect(loadingViews(view.container)).toBe(2);
     expect(testState.renderPools).toHaveLength(0);
 
     await view.rerender(renderViews(1));
     expect(pool.getStats().totalWorkers).toBe(2);
     expect(testState.terminations).toBe(0);
     await view.rerender(renderViews(0));
-    // Pierre gives up on a held startup after 10 seconds; the idle timer then tears the pool down.
+    // Pierre gives up on the held startup after 10 seconds; the idle timer then tears the pool down.
     const timedOut = expect(pending).rejects.toThrow("worker initialization timed out");
     await vi.advanceTimersByTimeAsync(30_000);
     await timedOut;
@@ -309,7 +328,7 @@ describe("code-view worker lifecycle", () => {
     expect(testState.workers).toHaveLength(2);
     expect(testState.terminations).toBe(2);
     expect(testState.renderPools).toHaveLength(0);
-    expect(document.querySelectorAll("pre")).toHaveLength(0);
+    expect(view.container.querySelectorAll("pre")).toHaveLength(0);
   });
 });
 
@@ -345,7 +364,11 @@ describe("collapsed diff content", () => {
     testState.failWorkers = false;
     testState.holdInitialization = false;
     const pool = new WorkerPoolManager(
-      { workerFactory: () => new DiffsWorker(), poolSize: 1 },
+      {
+        workerFactory: () => new DiffsWorker(),
+        poolSize: 1,
+        workerInitializationTimeout: UNLIMITED_WORKER_STARTUP_MS,
+      },
       { theme: "pierre-dark", langs: ["typescript"], preferredHighlighter: "shiki-wasm" },
     );
     stack.defer(() => pool.terminate());
@@ -568,7 +591,7 @@ function RevealViews({
 }
 
 describe("code-view file reveals", () => {
-  const reveal = () => act(async () => document.querySelector("button")!.click());
+  const reveal = (view: Screen) => act(async () => view.container.querySelector("button")!.click());
 
   function setup() {
     revealCalls.length = 0;
@@ -579,7 +602,7 @@ describe("code-view file reveals", () => {
     await using view = await render(
       <RevealViews scope="first" visible selectedFile="external-a" />,
     );
-    await reveal();
+    await reveal(view);
     expect(revealCalls.at(-1)?.fileKey).toBe("tree-file");
     revealCalls.length = 0;
 
@@ -596,7 +619,7 @@ describe("code-view file reveals", () => {
     await using view = await render(
       <RevealViews scope="diff" visible={false} selectedFile="external" />,
     );
-    await reveal();
+    await reveal(view);
     expect(revealCalls).toEqual([]);
 
     await view.rerender(<RevealViews scope="diff" visible selectedFile="external" />);
@@ -611,7 +634,7 @@ describe("code-view file reveals", () => {
     revealCalls.length = 0;
     // A click that lands in the same update that hides the viewer waits for it to return.
     await act(async () => {
-      document.querySelector("button")!.click();
+      view.container.querySelector("button")!.click();
       await view.rerender(<RevealViews scope="diff" visible={false} selectedFile="external" />);
     });
     expect(revealCalls).toEqual([]);
@@ -627,7 +650,7 @@ describe("code-view file reveals", () => {
     await using view = await render(
       <RevealViews scope="first" visible={false} selectedFile="external-a" />,
     );
-    await reveal();
+    await reveal(view);
     await view.rerender(
       <RevealViews scope="first" visible selectedFile="external-b" requestId={1} />,
     );
@@ -635,7 +658,7 @@ describe("code-view file reveals", () => {
     revealCalls.length = 0;
 
     await view.rerender(<RevealViews scope="first" visible={false} />);
-    await reveal();
+    await reveal(view);
     await view.rerender(<RevealViews scope="second" visible={false} />);
     await view.rerender(<RevealViews scope="first" visible />);
     expect(revealCalls).toEqual([]);
@@ -643,9 +666,9 @@ describe("code-view file reveals", () => {
 
   it("reveals after a collapsed file expands and honors another click on the same file", async () => {
     setup();
-    await using _view = await render(<RevealViews scope="diff" visible />);
-    await reveal();
-    await reveal();
+    await using view = await render(<RevealViews scope="diff" visible />);
+    await reveal(view);
+    await reveal(view);
     expect(revealCalls).toEqual([
       { scope: "diff", fileKey: "tree-file", mounted: true, collapsed: false },
       { scope: "diff", fileKey: "tree-file", mounted: true, collapsed: false },
diff --git a/apps/web/src/components/preview/PreviewPanelShell.a11y.browser.test.tsx b/apps/web/src/components/preview/PreviewPanelShell.a11y.browser.test.tsx
index 09613f4d578a..23ff1bb4d5b2 100644
--- a/apps/web/src/components/preview/PreviewPanelShell.a11y.browser.test.tsx
+++ b/apps/web/src/components/preview/PreviewPanelShell.a11y.browser.test.tsx
@@ -59,7 +59,7 @@ function nextFrame() {
 async function enterFocusScope() {
   const toggle = document.querySelector<HTMLElement>('[aria-label="Toggle right panel"]')!;
   await act(async () => toggle.focus());
-  await act(() => userEvent.tab());
+  await userEvent.tab();
   await act(nextFrame);
 }
 
diff --git a/apps/web/src/components/preview/previewSessionSync.browser.test.ts b/apps/web/src/components/preview/previewSessionSync.browser.test.ts
index ba6a60cdbb44..ac19c95f4fd7 100644
--- a/apps/web/src/components/preview/previewSessionSync.browser.test.ts
+++ b/apps/web/src/components/preview/previewSessionSync.browser.test.ts
@@ -7,9 +7,10 @@ import {
 } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import { AsyncResult, Atom } from "effect/reactivity";
-import { act, createElement } from "react";
-import { createRoot, type Root } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { createElement } from "react";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { act, render } from "../../../test/render";
 
 // Only the transport is substituted. The hook, atom registry and preview
 // store run unchanged, including lazy evaluation and refresh notifications.
@@ -78,71 +79,70 @@ import { AppAtomRegistryProvider, appAtomRegistry } from "~/rpc/atomRegistry";
 import { previewEnvironment } from "~/state/preview";
 import { useDesktopHostedPreviewSessions, usePreviewSession } from "./usePreviewSession";
 
-let root: Root | null = null;
-let container: HTMLDivElement | null = null;
-let sequence = 0;
-let ref: ScopedThreadRef;
-
-function SessionSync() {
-  usePreviewSession(ref);
-  return null;
-}
-
-const listAtom = () => {
-  previewEnvironment.list({ environmentId: ref.environmentId, input: { threadId: ref.threadId } });
-  return harness.lists.get(ref.threadId)!.atom;
-};
-const result = (
-  revision: number,
-  tabIds: string[],
-  serverEpoch = "epoch-1",
-): PreviewListResult => ({
-  serverEpoch,
-  revision,
-  sessions: tabIds.map((tabId) => ({
-    threadId: ref.threadId,
-    tabId,
-    navStatus: { _tag: "Idle" },
-    canGoBack: false,
-    canGoForward: false,
-    updatedAt: "2026-10-02T00:00:00.000Z",
-  })),
-});
-
-function DesktopSessionSync() {
-  useDesktopHostedPreviewSessions(ref.environmentId);
-  return null;
-}
+function setup() {
+  harness.lists.clear();
+  harness.events.clear();
+  resetPreviewStateForTests();
+  // The app atom registry outlives each test, so every test gets its own environment and thread.
+  const testName = expect.getState().currentTestName!;
+  const ref: ScopedThreadRef = {
+    environmentId: EnvironmentId.make(`preview-sync ${testName}`),
+    threadId: ThreadId.make(`thread-sync ${testName}`),
+  };
 
-async function mount(Component = SessionSync) {
-  container = document.body.appendChild(document.createElement("div"));
-  root = createRoot(container);
-  await act(async () => {
-    root!.render(createElement(AppAtomRegistryProvider, null, createElement(Component)));
+  const listAtom = () => {
+    previewEnvironment.list({
+      environmentId: ref.environmentId,
+      input: { threadId: ref.threadId },
+    });
+    return harness.lists.get(ref.threadId)!.atom;
+  };
+  const result = (
+    revision: number,
+    tabIds: string[],
+    serverEpoch = "epoch-1",
+  ): PreviewListResult => ({
+    serverEpoch,
+    revision,
+    sessions: tabIds.map((tabId) => ({
+      threadId: ref.threadId,
+      tabId,
+      navStatus: { _tag: "Idle" },
+      canGoBack: false,
+      canGoForward: false,
+      updatedAt: "2026-10-02T00:00:00.000Z",
+    })),
   });
-}
 
-beforeEach(() => {
-  vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
-  sequence += 1;
-  ref = {
-    environmentId: EnvironmentId.make(`preview-sync-${sequence}`),
-    threadId: ThreadId.make(`thread-sync-${sequence}`),
-  };
-});
+  function SessionSync() {
+    usePreviewSession(ref);
+    return null;
+  }
+  function DesktopSessionSync() {
+    useDesktopHostedPreviewSessions(ref.environmentId);
+    return null;
+  }
+  // The session hooks render nothing and never read or change the route.
+  const mount = (Component: () => null = SessionSync) =>
+    render(createElement(AppAtomRegistryProvider, null, createElement(Component)), {
+      router: false,
+    });
 
-afterEach(async () => {
-  await act(async () => root?.unmount());
-  root = null;
-  container?.remove();
-  container = null;
-  resetPreviewStateForTests();
-  vi.unstubAllGlobals();
-});
+  return {
+    ref,
+    listAtom,
+    result,
+    mount,
+    DesktopSessionSync,
+    [Symbol.dispose]: () => resetPreviewStateForTests(),
+  };
+}
 
 describe("native preview session synchronization", () => {
   it("discovers and closes a server tab in a background thread without mounting its chat", async () => {
-    await mount(DesktopSessionSync);
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
+    await using _screen = await sync.mount(sync.DesktopSessionSync);
     expect(readThreadPreviewState(ref).sessions).toEqual({});
     previewEnvironment.events({ environmentId: ref.environmentId, input: {} });
     const events = harness.events.get(ref.environmentId)!;
@@ -183,18 +183,22 @@ describe("native preview session synchronization", () => {
   });
 
   it("evaluates the lazy list once and restores sessions that predate mounting", async () => {
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
     const atom = listAtom();
-    await mount();
+    await using _screen = await sync.mount();
     expect(harness.lists.get(ref.threadId)?.box.requests).toBe(1);
     appAtomRegistry.set(atom, AsyncResult.success(result(1, ["restored"])));
     expect(readThreadPreviewState(ref).activeTabId).toBe("restored");
   });
 
   it("preserves a local tab while cached absence is waiting for a fresh response", async () => {
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
     const atom = listAtom();
     appAtomRegistry.set(atom, AsyncResult.waiting(AsyncResult.success(result(1, []))));
     applyPreviewServerSnapshot(ref, result(1, ["local"]).sessions[0]!);
-    await mount();
+    await using _screen = await sync.mount();
     expect(readThreadPreviewState(ref).activeTabId).toBe("local");
     expect(harness.lists.get(ref.threadId)?.box.requests).toBe(0);
     appAtomRegistry.set(atom, AsyncResult.success(result(2, ["local"])));
@@ -204,6 +208,8 @@ describe("native preview session synchronization", () => {
   });
 
   it("refreshes a completed cache without treating its old absence as authoritative", async () => {
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
     const atom = listAtom();
     appAtomRegistry.set(atom, AsyncResult.success(result(1, [])));
     reconcilePreviewServerSessions(ref, result(1, []));
@@ -221,7 +227,7 @@ describe("native preview session synchronization", () => {
       controller: "human",
       favicon: null,
     });
-    await mount();
+    await using _screen = await sync.mount();
     expect(harness.lists.get(ref.threadId)?.box.requests).toBe(1);
     expect(readThreadPreviewState(ref).activeTabId).toBe("local");
     expect(readThreadPreviewState(ref).desktopOverlay?.zoomFactor).toBe(1.5);
@@ -231,8 +237,10 @@ describe("native preview session synchronization", () => {
   });
 
   it("retains newer event state when an older list response completes, then retries the list", async () => {
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
     const atom = listAtom();
-    await mount();
+    await using _screen = await sync.mount();
     const snapshot = result(2, ["opened"]).sessions[0]!;
     previewEnvironment.events({ environmentId: ref.environmentId, input: {} });
     appAtomRegistry.set(
@@ -261,9 +269,11 @@ describe("native preview session synchronization", () => {
   });
 
   it("keeps the local snapshot on a completed failure and reconciles a later success", async () => {
+    using sync = setup();
+    const { ref, listAtom, result } = sync;
     const atom = listAtom();
     applyPreviewServerSnapshot(ref, result(1, ["local"]).sessions[0]!);
-    await mount();
+    await using _screen = await sync.mount();
     appAtomRegistry.set(atom, AsyncResult.failure(Cause.die("offline")));
     expect(readThreadPreviewState(ref).activeTabId).toBe("local");
     appAtomRegistry.set(atom, AsyncResult.success(result(2, [])));
diff --git a/apps/web/src/components/pullRequest/PullRequestCandidatePicker.browser.test.tsx b/apps/web/src/components/pullRequest/PullRequestCandidatePicker.browser.test.tsx
index b6b6cb6248ba..7952157a9485 100644
--- a/apps/web/src/components/pullRequest/PullRequestCandidatePicker.browser.test.tsx
+++ b/apps/web/src/components/pullRequest/PullRequestCandidatePicker.browser.test.tsx
@@ -1,4 +1,4 @@
-import { act, render } from "../../../test/render";
+import { render } from "../../../test/render";
 import { describe, expect, it, vi } from "vite-plus/test";
 import { userEvent } from "vite-plus/test/browser";
 
@@ -40,21 +40,19 @@ describe("disabled candidate picker", () => {
         'button[aria-label="Request reviewers"]',
       )!;
       if (input === "keyboard") {
-        await act(() => userEvent.tab());
+        await userEvent.tab();
         expect(document.activeElement).toBe(trigger);
       } else {
-        await act(() => userEvent.hover(trigger));
+        await userEvent.hover(trigger);
       }
       await expect
         .poll(() => document.querySelector('[data-slot="tooltip-popup"][data-open]')?.textContent)
         .toContain("Only collaborators can request reviewers.");
-      await act(async () => {
-        trigger.focus();
-        await userEvent.keyboard("{Enter}");
-        await userEvent.keyboard(" ");
-        // Playwright skips aria-disabled targets; the click must still land to prove it is inert.
-        await userEvent.click(trigger, { force: true });
-      });
+      trigger.focus();
+      await userEvent.keyboard("{Enter}");
+      await userEvent.keyboard(" ");
+      // Playwright skips aria-disabled targets; the click must still land to prove it is inert.
+      await userEvent.click(trigger, { force: true });
       expect(onOpenChange).not.toHaveBeenCalled();
       expect(onSelect).not.toHaveBeenCalled();
     },
diff --git a/apps/web/src/components/pullRequest/PullRequestDetailPanel.browser.test.tsx b/apps/web/src/components/pullRequest/PullRequestDetailPanel.browser.test.tsx
index 323297b7309c..27eae0e29766 100644
--- a/apps/web/src/components/pullRequest/PullRequestDetailPanel.browser.test.tsx
+++ b/apps/web/src/components/pullRequest/PullRequestDetailPanel.browser.test.tsx
@@ -153,6 +153,14 @@ vi.mock(import("./PullRequestSummaryTab"), async (original) => {
     }) as never,
   };
 });
+// The Code tab waits for the diff worker pool, and a cold pool starts real Shiki workers that
+// a loaded runner can keep past Pierre's 10s startup limit. These tests are about the panel,
+// so the pool falls back to main-thread highlighting at once.
+vi.mock("@pierre/diffs/worker/worker.js?worker", () => ({
+  default: function UnavailableDiffsWorker() {
+    throw new Error("Diff workers are disabled in panel tests");
+  },
+}));
 vi.mock(import("../ui/toast"), async (original) => {
   const actual = await original();
   return {
diff --git a/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx b/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
index 5598bb0c194a..da51fa00e5a5 100644
--- a/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
+++ b/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
@@ -129,7 +129,7 @@ const input = (selector: string) => {
   return found!;
 };
 async function type(selector: string, value: string) {
-  await act(async () => userEvent.fill(input(selector), value));
+  await userEvent.fill(input(selector), value);
   await act(async () => input(selector).blur());
 }
 const signInStep = () => document.querySelector('[aria-label="Sign-in step"]');
diff --git a/apps/web/src/components/settings/CaptureShortcutConfig.browser.test.tsx b/apps/web/src/components/settings/CaptureShortcutConfig.browser.test.tsx
index 3fc121d19e2e..0dc5432dee73 100644
--- a/apps/web/src/components/settings/CaptureShortcutConfig.browser.test.tsx
+++ b/apps/web/src/components/settings/CaptureShortcutConfig.browser.test.tsx
@@ -85,8 +85,8 @@ async function renderConfig(desktop: "niri" | "hyprland" = "niri") {
       await act(async () => target!.click());
     },
     async recordKeys(keys: string) {
-      await act(async () => userEvent.click(recorder()));
-      await act(async () => userEvent.keyboard(keys));
+      await userEvent.click(recorder());
+      await userEvent.keyboard(keys);
     },
   });
 }
@@ -184,9 +184,9 @@ it.each(["Escape", "blur"])(
     using _env = setup();
     await using screen = await renderConfig();
     await screen.click("Review changes");
-    await act(async () => userEvent.click(screen.recorder()));
+    await userEvent.click(screen.recorder());
     expect(screen.button("Save shortcut")?.disabled).toBe(true);
-    if (cancel === "Escape") await act(async () => userEvent.keyboard("{Escape}"));
+    if (cancel === "Escape") await userEvent.keyboard("{Escape}");
     else await act(async () => screen.recorder().blur());
     expect(screen.button("Save shortcut")?.disabled).toBe(false);
     expect(bridge.previewSnapShotConfig).toHaveBeenCalledOnce();
diff --git a/apps/web/src/components/settings/FontFamilyPicker.browser.test.tsx b/apps/web/src/components/settings/FontFamilyPicker.browser.test.tsx
index 1a2495f0c371..fa4327da432b 100644
--- a/apps/web/src/components/settings/FontFamilyPicker.browser.test.tsx
+++ b/apps/web/src/components/settings/FontFamilyPicker.browser.test.tsx
@@ -48,10 +48,10 @@ describe("FontFamilyPicker", () => {
 
     const input = document.querySelector<HTMLInputElement>('input[placeholder="Search fonts…"]');
     expect(input).not.toBeNull();
-    const press = (key: string) => act(() => userEvent.keyboard(`{${key}}`));
+    const press = (key: string) => userEvent.keyboard(`{${key}}`);
 
     // Both matches were already rendered further down the unfiltered list.
-    await act(() => userEvent.type(input!, "co"));
+    await userEvent.type(input!, "co");
     await expect.poll(highlightedOptions).toEqual(["Courier New"]);
 
     await press("ArrowDown");
diff --git a/apps/web/src/components/settings/ProjectFaviconPickerDialog.browser.test.tsx b/apps/web/src/components/settings/ProjectFaviconPickerDialog.browser.test.tsx
index 6d0de80caa48..39aa4a19cc17 100644
--- a/apps/web/src/components/settings/ProjectFaviconPickerDialog.browser.test.tsx
+++ b/apps/web/src/components/settings/ProjectFaviconPickerDialog.browser.test.tsx
@@ -129,9 +129,14 @@ const imageUrl = `data:image/svg+xml,${encodeURIComponent(
   '<svg xmlns="http://www.w3.org/2000/svg" width="8" height="8"><rect width="8" height="8" fill="red"/></svg>',
 )}`;
 
+// The registry drops an unsubscribed atom on its next task. A row calls createUrl while it
+// renders but subscribes only after React commits, so on a busy runner a URL published
+// in between would be dropped. A server keeps its answer; keepAlive models that.
 function addFiles(paths: string[]) {
   state.entries = paths.map((path) => ({ path, kind: "file" }));
-  for (const path of paths) state.assets.set(path, Atom.make<AssetResult>(AsyncResult.initial()));
+  for (const path of paths) {
+    state.assets.set(path, Atom.make<AssetResult>(AsyncResult.initial()).pipe(Atom.keepAlive));
+  }
 }
 
 function fileRow(path: string) {
diff --git a/apps/web/src/components/settings/ProjectSettingsPanel.browser.test.tsx b/apps/web/src/components/settings/ProjectSettingsPanel.browser.test.tsx
index 4a47a353dbeb..8d39c065f579 100644
--- a/apps/web/src/components/settings/ProjectSettingsPanel.browser.test.tsx
+++ b/apps/web/src/components/settings/ProjectSettingsPanel.browser.test.tsx
@@ -429,39 +429,40 @@ describe("project settings permissions", () => {
 });
 
 describe("project settings scope", () => {
-  it("offers project checkout environments while keeping unselected and unknown projects recoverable", async () => {
+  const environmentMenu = () => page.getByRole("button", { name: /^Environment scope:/ });
+  const primaryOption = () => page.getByRole("menuitemradio", { name: /^primary/ });
+  const remoteOption = () => page.getByRole("menuitemradio", { name: /^remote/ });
+
+  it("offers every environment while no project is selected", async () => {
     setup();
     state.projects = state.projects.filter((project) => project.environmentId === primaryId);
-    const key = projectKey();
-    await using screen = await mountSettings({});
-    const environmentMenu = () => page.getByRole("button", { name: /^Environment scope:/ });
-    const primaryOption = () => page.getByRole("menuitemradio", { name: /^primary/ });
-    const remoteOption = () => page.getByRole("menuitemradio", { name: /^remote/ });
+    await using _screen = await mountSettings({});
 
-    await act(async () => userEvent.click(environmentMenu()));
+    await userEvent.click(environmentMenu());
     await expect.element(primaryOption()).toBeVisible();
     await expect.element(remoteOption()).toBeVisible();
-    await act(async () => userEvent.keyboard("{Escape}"));
+  });
+
+  it("offers only the selected project's checkout environments", async () => {
+    setup();
+    state.projects = state.projects.filter((project) => project.environmentId === primaryId);
+    await using _screen = await mountSettings({ project: projectKey() });
 
-    await act(async () =>
-      screen.router.navigate({ to: "/settings/projects", search: () => ({ project: key }) }),
-    );
     await expect.element(page.getByRole("textbox", { name: "Project name" })).toBeVisible();
-    await act(async () => userEvent.click(environmentMenu()));
+    await userEvent.click(environmentMenu());
     await expect.element(primaryOption()).toBeVisible();
     await expect.element(remoteOption()).not.toBeInTheDocument();
-    await act(async () => userEvent.keyboard("{Escape}"));
+  });
 
-    await act(async () =>
-      screen.router.navigate({
-        to: "/settings/projects",
-        search: () => ({ project: "removed-project" }),
-      }),
-    );
-    await act(async () => userEvent.click(environmentMenu()));
+  it("keeps an unknown project recoverable from any environment", async () => {
+    setup();
+    state.projects = state.projects.filter((project) => project.environmentId === primaryId);
+    await using screen = await mountSettings({ project: "removed-project" });
+
+    await userEvent.click(environmentMenu());
     await expect.element(primaryOption()).toBeVisible();
     await expect.element(remoteOption()).toBeVisible();
-    await act(async () => userEvent.click(remoteOption()));
+    await userEvent.click(remoteOption());
     await vi.waitFor(() =>
       expect(screen.router.state.location.search).toEqual({
         project: "removed-project",
@@ -491,9 +492,7 @@ describe("project settings scope", () => {
     await expect
       .element(page.getByRole("button", { name: "Environment scope: remote" }))
       .toBeVisible();
-    await act(async () =>
-      userEvent.click(page.getByRole("button", { name: "Show all environments" })),
-    );
+    await userEvent.click(page.getByRole("button", { name: "Show all environments" }));
 
     await expect
       .element(page.getByRole("textbox", { name: "Project name" }))
@@ -517,7 +516,7 @@ it("returns to the project overview after removal, clearing the selection but ke
     (button) => button.textContent === "Remove project",
   )!;
 
-  await act(async () => userEvent.click(removeProject));
+  await userEvent.click(removeProject);
 
   await vi.waitFor(() => {
     expect(screen.router.state.location.pathname).toBe("/settings/projects");
diff --git a/apps/web/src/components/settings/ProviderSetupSection.browser.test.tsx b/apps/web/src/components/settings/ProviderSetupSection.browser.test.tsx
index a02de7ed5b78..d3e25b90159c 100644
--- a/apps/web/src/components/settings/ProviderSetupSection.browser.test.tsx
+++ b/apps/web/src/components/settings/ProviderSetupSection.browser.test.tsx
@@ -195,7 +195,7 @@ describe("Antigravity setup", () => {
     resetSetup();
     const callbackUrl = "http://127.0.0.1:5555/?state=test-only&code=test-only";
     await using screen = await renderSetup();
-    await act(async () => userEvent.fill(screen.callbackInput(), callbackUrl));
+    await userEvent.fill(screen.callbackInput(), callbackUrl);
     await screen.click("Continue");
 
     expect(setup.completeAuth).toHaveBeenCalledWith({
@@ -244,11 +244,9 @@ describe("Antigravity setup", () => {
     };
     setup.auth = authState({ interaction });
     await using screen = await renderSetup();
-    await act(async () =>
-      userEvent.fill(
-        screen.callbackInput(),
-        "http://127.0.0.1:5555/?state=old-flow&code=test-only",
-      ),
+    await userEvent.fill(
+      screen.callbackInput(),
+      "http://127.0.0.1:5555/?state=old-flow&code=test-only",
     );
     setup.auth = authState({ flowId: "flow-2", interaction });
     await publish();
diff --git a/apps/web/src/components/settings/ScheduledTasksSettings.tsx b/apps/web/src/components/settings/ScheduledTasksSettings.tsx
index c22bdc188dbd..82d2092f61fb 100644
--- a/apps/web/src/components/settings/ScheduledTasksSettings.tsx
+++ b/apps/web/src/components/settings/ScheduledTasksSettings.tsx
@@ -22,13 +22,20 @@ import type {
   ScheduledTaskId,
   ScheduledTaskSchedule,
   ScheduledTaskUpsertInput,
-  ScheduledTaskWebhookDeliveryOutcome,
   ScheduledTaskWebhookDeliverySummary,
   ThreadId,
 } from "@t3tools/contracts";
-import { DEFAULT_WEBHOOK_PROMPT } from "@t3tools/client-runtime/scheduled-task-webhook";
+import {
+  DEFAULT_WEBHOOK_PROMPT,
+  emptyWebhookFilterDraft,
+  parseWebhookFilterDrafts,
+  removeWebhookFilterDraft,
+  WEBHOOK_FILTER_OPS,
+  type WebhookFilterDraft,
+} from "@t3tools/client-runtime/scheduled-task-webhook";
 import {
   MAX_WEBHOOK_DELIVERY_AGE_MINUTES,
+  MAX_WEBHOOK_FILTERS,
   MIN_SCHEDULED_TASK_INTERVAL_MS,
   ProviderInstanceId,
   resolveEnvironmentMachineKind,
@@ -73,6 +80,8 @@ import { SettingsGroup } from "./SettingsGroup";
 import { settingsScopeEnvironmentLabel, settingsScopeEnvironmentLabels } from "./settingsScopeAxis";
 import {
   WEBHOOK_SIGNATURE_DEFAULTS,
+  webhookDraftErrors,
+  webhookDeliveryLabel,
   matchesScheduledTaskScope,
   scheduleFromDraft,
   scheduledTaskDefaultModel,
@@ -144,8 +153,106 @@ const EMPTY_DRAFT: DraftState = {
   ...WEBHOOK_SIGNATURE_DEFAULTS,
   signatureSecret: "",
   maxDeliveryAgeMinutes: "",
+  replayKey: "",
+  coalesceKey: "",
+  coalesceWindowSeconds: "",
+  filters: [],
+  savedFilters: [],
 };
 
+function WebhookFiltersField({
+  filters,
+  onChange,
+}: {
+  filters: ReadonlyArray<WebhookFilterDraft>;
+  onChange: (filters: ReadonlyArray<WebhookFilterDraft>) => void;
+}) {
+  const update = (index: number, patch: Partial<WebhookFilterDraft>) =>
+    onChange(filters.map((filter, at) => (at === index ? { ...filter, ...patch } : filter)));
+  return (
+    <div className="space-y-2">
+      <div className="flex items-center justify-between gap-2">
+        <div className="min-w-0 space-y-1">
+          <Label>Filters</Label>
+          <p className="text-sm text-muted-foreground">
+            Run only when every filter matches. Other requests are logged as filtered. Separate “is
+            one of” values with commas; a value can't contain a comma.
+          </p>
+        </div>
+        <Button
+          className="shrink-0"
+          variant="outline"
+          size="sm"
+          disabled={filters.length >= MAX_WEBHOOK_FILTERS}
+          onClick={() => onChange([...filters, emptyWebhookFilterDraft()])}
+        >
+          <PlusIcon />
+          Add filter
+        </Button>
+      </div>
+      {filters.map((filter, index) => (
+        // Always stacked: the dialog stays narrow on wide windows, so a single line
+        // would cut off typical paths and values. The grid wrappers size each control
+        // without restyling it; a grid item stretches to its minmax(0, 1fr) track.
+        <div key={filter.id} className="space-y-2 pt-1">
+          <div className="flex items-center gap-2">
+            <div className="grid min-w-0 flex-1 grid-cols-1">
+              <Input
+                aria-label={`Filter ${index + 1} path`}
+                placeholder="body.action"
+                value={filter.path}
+                onChange={(event) => update(index, { path: event.target.value })}
+              />
+            </div>
+            <Button
+              variant="ghost"
+              size="icon-sm"
+              aria-label={`Remove filter ${index + 1}`}
+              onClick={() => onChange(removeWebhookFilterDraft(filters, filter.id))}
+            >
+              <Trash2Icon />
+            </Button>
+          </div>
+          <div className="flex items-center gap-2">
+            <Select
+              value={filter.op}
+              onValueChange={(op) => {
+                const known = WEBHOOK_FILTER_OPS.find((option) => option.op === op);
+                if (known) update(index, { op: known.op });
+              }}
+            >
+              <div className="grid w-44 shrink-0 grid-cols-1">
+                <SelectTrigger size="sm" aria-label={`Filter ${index + 1} test`}>
+                  <SelectValue>
+                    {WEBHOOK_FILTER_OPS.find((option) => option.op === filter.op)?.label}
+                  </SelectValue>
+                </SelectTrigger>
+              </div>
+              <SelectPopup>
+                {WEBHOOK_FILTER_OPS.map((option) => (
+                  <SelectItem key={option.op} value={option.op}>
+                    {option.label}
+                  </SelectItem>
+                ))}
+              </SelectPopup>
+            </Select>
+            {filter.op === "exists" ? null : (
+              <div className="grid min-w-0 flex-1 grid-cols-1">
+                <Input
+                  aria-label={`Filter ${index + 1} value`}
+                  placeholder={filter.op === "in" ? "opened, reopened" : "opened"}
+                  value={filter.value}
+                  onChange={(event) => update(index, { value: event.target.value })}
+                />
+              </div>
+            )}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
 function Field({
   label,
   hint,
@@ -225,21 +332,19 @@ export function ScheduledRelativeLabel(props: { value: string | null }) {
   return relativeLabel(props.value, Date.parse(`${nowMinute}:00.000Z`));
 }
 
-const DELIVERY_OUTCOME_LABELS: Record<ScheduledTaskWebhookDeliveryOutcome, string> = {
-  accepted: "Ran",
-  dispatch_failed: "Run failed",
-  rejected_signature: "Bad signature",
-  disabled: "Task paused",
-  rate_limited: "Rate limited",
-  expired: "Too old",
-};
-
-function deliveryOutcomeVariant(outcome: ScheduledTaskWebhookDeliveryOutcome) {
+function deliveryOutcomeVariant(outcome: string) {
   if (outcome === "accepted") return "success";
-  if (outcome === "disabled" || outcome === "rate_limited" || outcome === "expired") {
+  if (
+    outcome === "duplicate" ||
+    outcome === "coalesced" ||
+    outcome === "disabled" ||
+    outcome === "rate_limited" ||
+    outcome === "expired"
+  ) {
     return "warning";
   }
-  return "error";
+  if (outcome === "dispatch_failed" || outcome === "rejected_signature") return "error";
+  return "outline";
 }
 
 function statusVariant(status: ScheduledTask["lastRunStatus"]) {
@@ -697,7 +802,10 @@ function WebhookDeliveriesDialog({
   readonly onClose: () => void;
 }) {
   const deliveriesQuery = useEnvironmentQuery(
-    serverEnvironment.scheduledTaskWebhookDeliveries({ environmentId, input: { id: task.id } }),
+    serverEnvironment.scheduledTaskWebhookDeliveries({
+      environmentId,
+      input: { id: task.id, acceptAnyOutcome: true },
+    }),
   );
   const [selectedId, setSelectedId] = useState<ScheduledTaskWebhookDeliverySummary["id"] | null>(
     null,
@@ -707,7 +815,7 @@ function WebhookDeliveriesDialog({
       ? null
       : serverEnvironment.scheduledTaskWebhookDelivery({
           environmentId,
-          input: { id: task.id, deliveryId: selectedId },
+          input: { id: task.id, deliveryId: selectedId, acceptAnyOutcome: true },
         }),
   );
   const deliveries = deliveriesQuery.data?.deliveries ?? null;
@@ -735,8 +843,12 @@ function WebhookDeliveriesDialog({
           ) : selected ? (
             <div className="space-y-4">
               <div className="flex flex-wrap items-center gap-2 text-sm">
-                <Badge variant={deliveryOutcomeVariant(selected.outcome)}>
-                  {DELIVERY_OUTCOME_LABELS[selected.outcome]}
+                <Badge
+                  variant={deliveryOutcomeVariant(
+                    selected.pendingWindow ? "coalesced" : selected.outcome,
+                  )}
+                >
+                  {webhookDeliveryLabel(selected)}
                 </Badge>
                 <span>
                   {selected.method} · <ScheduledRelativeLabel value={selected.receivedAt} />
@@ -745,9 +857,24 @@ function WebhookDeliveriesDialog({
                   <span className="text-muted-foreground">Signature verified</span>
                 ) : null}
               </div>
-              {selected.error ? <p className="text-sm text-destructive">{selected.error}</p> : null}
-              <DeliveryBlock title="Prompt sent to the agent">
-                {selected.renderedPrompt ?? "No run was started for this request."}
+              {selected.error ? (
+                <p
+                  className={
+                    selected.outcome === "filtered"
+                      ? "text-sm text-muted-foreground"
+                      : "text-sm text-destructive"
+                  }
+                >
+                  {selected.error}
+                </p>
+              ) : null}
+              <DeliveryBlock
+                title={selected.pendingWindow ? "Scheduled run" : "Prompt sent to the agent"}
+              >
+                {selected.renderedPrompt ??
+                  (selected.pendingWindow
+                    ? "Run scheduled when the window closes; no run started yet."
+                    : "No run was started for this request.")}
               </DeliveryBlock>
               {selected.missingFields.length > 0 ? (
                 <p className="text-sm text-muted-foreground">
@@ -781,13 +908,20 @@ function WebhookDeliveriesDialog({
                     className="flex w-full flex-wrap items-center gap-2 py-2 text-left text-sm hover:bg-accent/40"
                     onClick={() => setSelectedId(delivery.id)}
                   >
-                    <Badge variant={deliveryOutcomeVariant(delivery.outcome)}>
-                      {DELIVERY_OUTCOME_LABELS[delivery.outcome]}
+                    <Badge
+                      variant={deliveryOutcomeVariant(
+                        delivery.pendingWindow ? "coalesced" : delivery.outcome,
+                      )}
+                    >
+                      {webhookDeliveryLabel(delivery)}
                     </Badge>
                     <span>{delivery.method}</span>
                     <span className="text-muted-foreground">
                       <ScheduledRelativeLabel value={delivery.receivedAt} />
                     </span>
+                    {delivery.outcome === "filtered" && delivery.error ? (
+                      <span className="text-muted-foreground">{delivery.error}</span>
+                    ) : null}
                     {delivery.missingFields.length > 0 ? (
                       <span className="text-muted-foreground">
                         {delivery.missingFields.length} empty placeholder
@@ -1058,12 +1192,14 @@ function ScheduledTaskEditorForm({
       reportFailure("Scheduled task is incomplete", "Add a title, prompt, project, and model.");
       return;
     }
+    const parsedFilters = parseWebhookFilterDrafts(draft.filters);
+    if (draft.scheduleMode === "webhook" && "error" in parsedFilters) {
+      reportFailure("Invalid filter", parsedFilters.error);
+      return;
+    }
     const schedule = scheduleFromDraft(draft);
     if (schedule === null) {
-      reportFailure(
-        "Invalid age limit",
-        `Enter whole minutes from 1 to ${MAX_WEBHOOK_DELIVERY_AGE_MINUTES}, or leave it blank.`,
-      );
+      for (const error of webhookDraftErrors(draft)) reportFailure(error.title, error.description);
       return;
     }
     if (
@@ -1142,7 +1278,8 @@ function ScheduledTaskEditorForm({
       </DialogHeader>
 
       <DialogPanel>
-        <fieldset disabled={saving} className="space-y-5">
+        {/* Fieldsets default to min-width: min-content, which lets one wide control widen the form past the dialog. */}
+        <fieldset disabled={saving} className="min-w-0 space-y-5">
           {!connected ? (
             <p className="text-sm text-destructive">Reconnect this environment before saving.</p>
           ) : null}
@@ -1351,7 +1488,8 @@ function ScheduledTaskEditorForm({
                 minute.
               </p>
             ) : null}
-            <div className="flex items-center justify-between gap-2">
+            {/* Wraps the toggle below the label when both don't fit, as on phones. */}
+            <div className="flex flex-wrap items-center justify-between gap-2">
               <Label>Schedule</Label>
               <ToggleGroup
                 aria-label="Schedule type"
@@ -1404,6 +1542,64 @@ function ScheduledTaskEditorForm({
                     }
                   />
                 </Field>
+                <WebhookFiltersField
+                  filters={draft.filters}
+                  onChange={(filters) => setDraft((current) => ({ ...current, filters }))}
+                />
+                <Field
+                  label="Replay key"
+                  hint="template, optional"
+                  htmlFor="scheduled-task-replay-key"
+                >
+                  <Input
+                    id="scheduled-task-replay-key"
+                    placeholder="{{headers.delivery-id}}"
+                    value={draft.replayKey}
+                    onChange={(event) =>
+                      setDraft((current) => ({ ...current, replayKey: event.target.value }))
+                    }
+                  />
+                </Field>
+                <Field
+                  label="Coalesce key"
+                  hint="template, optional"
+                  htmlFor="scheduled-task-coalesce-key"
+                >
+                  <Input
+                    id="scheduled-task-coalesce-key"
+                    placeholder="{{body.id}}"
+                    value={draft.coalesceKey}
+                    onChange={(event) =>
+                      setDraft((current) => ({ ...current, coalesceKey: event.target.value }))
+                    }
+                  />
+                </Field>
+                <Field
+                  label="Coalesce window"
+                  hint="seconds, 10–3600"
+                  htmlFor="scheduled-task-coalesce-window"
+                >
+                  <Input
+                    id="scheduled-task-coalesce-window"
+                    type="number"
+                    nativeInput
+                    min={10}
+                    max={3600}
+                    placeholder="120"
+                    value={draft.coalesceWindowSeconds}
+                    onChange={(event) =>
+                      setDraft((current) => ({
+                        ...current,
+                        coalesceWindowSeconds: event.target.value,
+                      }))
+                    }
+                  />
+                </Field>
+                <p className="text-xs text-muted-foreground">
+                  Replay keys suppress repeat deliveries for 7 days. Coalescing runs the latest
+                  payload once when the window from the first delivery closes. Empty keys run
+                  normally.
+                </p>
                 <div className="flex items-center justify-between gap-4">
                   <div className="min-w-0 space-y-1">
                     <Label htmlFor="scheduled-task-signature">Require signature</Label>
diff --git a/apps/web/src/components/settings/SnapShotSettings.browser.test.tsx b/apps/web/src/components/settings/SnapShotSettings.browser.test.tsx
index 67b144d0112a..f2ae1fefe8bd 100644
--- a/apps/web/src/components/settings/SnapShotSettings.browser.test.tsx
+++ b/apps/web/src/components/settings/SnapShotSettings.browser.test.tsx
@@ -186,13 +186,14 @@ it.each(["direct", "gnome-extension", "kde"] as const)(
         "Record snapshot shortcut, currently Ctrl+Shift+2",
       );
     }
-    await act(async () => userEvent.click(recorder()));
-    await act(async () => userEvent.keyboard("{Control>}{Alt>}y{/Alt}{/Control}"));
+    await userEvent.click(recorder());
+    await userEvent.keyboard("{Control>}{Alt>}y{/Alt}{/Control}");
     expect(bridge.checkSnapShotShortcut).toHaveBeenCalledOnce();
-    expect(container.textContent).toContain("Ready to save.");
-    expect(recorder().getAttribute("aria-label")).toBe(
-      "Record snapshot shortcut, currently Ctrl+Alt+Y",
-    );
+    // The status and label update only after the awaited shortcut check resolves.
+    await expect.poll(() => container.textContent).toContain("Ready to save.");
+    await expect
+      .poll(() => recorder().getAttribute("aria-label"))
+      .toBe("Record snapshot shortcut, currently Ctrl+Alt+Y");
     await click("Save");
     expect(settingsStore.update).toHaveBeenCalledWith({
       snapShotShortcut: expect.objectContaining({ key: "y", modKey: true, altKey: true }),
@@ -233,9 +234,9 @@ it("keeps the approved desktop shortcut when recording is cancelled in setup", a
   expect(recorder().getAttribute("aria-label")).toBe(
     "Record snapshot shortcut, currently Ctrl+Alt+8",
   );
-  await act(async () => userEvent.click(recorder()));
+  await userEvent.click(recorder());
   expect(recorder().textContent).toBe("Press shortcut…");
-  await act(async () => userEvent.keyboard("{Escape}"));
+  await userEvent.keyboard("{Escape}");
   expect(dialog()).not.toBeNull();
   expect(recorder().getAttribute("aria-label")).toBe(
     "Record snapshot shortcut, currently Ctrl+Alt+8",
@@ -273,7 +274,7 @@ it("keeps older portal shortcuts editable without offering unsupported permissio
   const { button, recorder } = screen;
   expect(button("Shortcut permissions")).toBeNull();
   expect(bridge.setupSnapShot).not.toHaveBeenCalled();
-  await act(async () => userEvent.click(recorder()));
+  await userEvent.click(recorder());
   expect(recorder().textContent).toBe("Press shortcut…");
 });
 
diff --git a/apps/web/src/components/settings/scheduledTasksSettings.logic.test.ts b/apps/web/src/components/settings/scheduledTasksSettings.logic.test.ts
index 9c67ec46e8e0..4be149ac9d71 100644
--- a/apps/web/src/components/settings/scheduledTasksSettings.logic.test.ts
+++ b/apps/web/src/components/settings/scheduledTasksSettings.logic.test.ts
@@ -20,6 +20,8 @@ import {
   scheduledTaskDefaultModel,
   matchesScheduledTaskScope,
   scheduleFromDraft,
+  webhookDraftErrors,
+  webhookDeliveryLabel,
   taskToDraft,
 } from "./scheduledTasksSettings.logic";
 
@@ -175,6 +177,43 @@ describe("webhook scheduled tasks", () => {
     webhook: { path: "/api/hooks/legacy-task/token", url: null, hasSecret: true },
   };
 
+  it("round-trips dedupe settings, clears them, and rejects invalid windows", () => {
+    const dedupe = {
+      replayKey: "{{headers.delivery-id}}",
+      coalesceKey: "{{body.id}}",
+      coalesceWindowSeconds: 10,
+    };
+    const draft = taskToDraft({
+      ...webhookTask,
+      schedule: { type: "webhook", signature: null, dedupe },
+    });
+    expect(scheduleFromDraft(draft)).toMatchObject({ dedupe });
+    expect(
+      scheduleFromDraft({
+        ...draft,
+        replayKey: " \n ",
+        coalesceKey: " \t ",
+        coalesceWindowSeconds: "",
+      }),
+    ).toMatchObject({ dedupe: {} });
+    expect(
+      scheduleFromDraft({
+        ...draft,
+        replayKey: `  ${dedupe.replayKey}  `,
+        coalesceKey: `\t${dedupe.coalesceKey}\n`,
+      }),
+    ).toMatchObject({ dedupe });
+    expect(
+      scheduleFromDraft({ ...draft, replayKey: "", coalesceKey: "", coalesceWindowSeconds: "" }),
+    ).toMatchObject({ dedupe: {} });
+    expect(scheduleFromDraft({ ...draft, coalesceWindowSeconds: "" })).toMatchObject({
+      dedupe: { replayKey: dedupe.replayKey, coalesceKey: dedupe.coalesceKey },
+    });
+    for (const coalesceWindowSeconds of ["9", "3601", "1.5", "abc"]) {
+      expect(scheduleFromDraft({ ...draft, coalesceWindowSeconds })).toBeNull();
+    }
+  });
+
   it("keeps a stored secret when the secret field is left blank", () => {
     const draft = taskToDraft(webhookTask);
     expect(draft.scheduleMode).toBe("webhook");
@@ -183,11 +222,13 @@ describe("webhook scheduled tasks", () => {
       type: "webhook",
       signature,
       maxDeliveryAgeMinutes: null,
+      dedupe: {},
     });
     expect(scheduleFromDraft({ ...draft, signatureSecret: " new " })).toEqual({
       type: "webhook",
       signature: { ...signature, secret: "new" },
       maxDeliveryAgeMinutes: null,
+      dedupe: {},
     });
   });
 
@@ -199,6 +240,7 @@ describe("webhook scheduled tasks", () => {
       type: "webhook",
       signature: null,
       maxDeliveryAgeMinutes: null,
+      dedupe: {},
     });
   });
 
@@ -212,12 +254,38 @@ describe("webhook scheduled tasks", () => {
     for (const blank of ["", "  "]) {
       expect(scheduleFromDraft({ ...draft, maxDeliveryAgeMinutes: blank })).toMatchObject({
         maxDeliveryAgeMinutes: null,
+        dedupe: {},
       });
     }
     for (const invalid of ["0", "-5", "1.5", "abc", "1441"]) {
       expect(scheduleFromDraft({ ...draft, maxDeliveryAgeMinutes: invalid })).toBeNull();
     }
   });
+
+  it("sends filters only when the form changed them", () => {
+    const filters = [
+      { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+      { path: "body.action", op: "in", value: ["opened", "reopened"] },
+    ] as const;
+    const draft = taskToDraft({
+      ...webhookTask,
+      schedule: { type: "webhook", signature, filters },
+    });
+    expect(draft.filters.map((filter) => filter.op)).toEqual(["equals", "in"]);
+    // A title-only save leaves the key out, so the server keeps whatever is stored now.
+    expect(scheduleFromDraft({ ...draft, title: "Renamed" })).not.toHaveProperty("filters");
+    expect(scheduleFromDraft({ ...draft, filters: draft.filters.slice(0, 1) })).toMatchObject({
+      filters: filters.slice(0, 1),
+    });
+    // Removing every row is a change, so it clears the stored filters.
+    expect(scheduleFromDraft({ ...draft, filters: [] })).toMatchObject({ filters: [] });
+    expect(
+      scheduleFromDraft({
+        ...draft,
+        filters: [{ id: "f1", path: "body.action", op: "in", value: " , " }],
+      }),
+    ).toBeNull();
+  });
 });
 
 describe("scheduled task model defaults", () => {
@@ -314,3 +382,58 @@ describe("scheduled task model defaults", () => {
     ).toBeNull();
   });
 });
+
+it("rejects dedupe templates without a request placeholder", () => {
+  const draft = taskToDraft({ ...legacyTask, schedule: { type: "webhook", signature: null } });
+  expect(scheduleFromDraft({ ...draft, replayKey: "literal" })).toBeNull();
+  expect(scheduleFromDraft({ ...draft, coalesceKey: "{{body.bad" })).toBeNull();
+});
+
+describe("webhook delivery labels and validation messages", () => {
+  it("preserves Ran for legacy and dispatched deliveries and distinguishes pending windows", () => {
+    expect(webhookDeliveryLabel({ outcome: "accepted" })).toBe("Ran");
+    expect(webhookDeliveryLabel({ outcome: "accepted", pendingWindow: false })).toBe("Ran");
+    expect(webhookDeliveryLabel({ outcome: "accepted", pendingWindow: true })).toBe(
+      "Opened window",
+    );
+  });
+
+  it("keeps the existing age-limit title and body", () => {
+    const draft = taskToDraft({ ...legacyTask, schedule: { type: "webhook", signature: null } });
+    expect(
+      webhookDraftErrors({ ...draft, maxDeliveryAgeMinutes: "0", replayKey: "literal" }),
+    ).toEqual([
+      {
+        title: "Invalid age limit",
+        description: "Enter whole minutes from 1 to 1440, or leave it blank.",
+      },
+    ]);
+  });
+
+  it.each([
+    [{ replayKey: "literal" }, "Replay key must contain a valid request placeholder."],
+    [{ coalesceKey: "{{body.bad" }, "Coalesce key must contain a valid request placeholder."],
+    [{ coalesceWindowSeconds: "9" }, "Coalesce window must be whole seconds from 10 to 3600."],
+  ])("names only the invalid webhook field for %o", (invalid, description) => {
+    const draft = taskToDraft({ ...legacyTask, schedule: { type: "webhook", signature: null } });
+    expect(webhookDraftErrors({ ...draft, ...invalid })).toEqual([
+      { title: "Invalid webhook settings", description },
+    ]);
+  });
+
+  it("reports separate short errors when several dedupe fields fail", () => {
+    const draft = taskToDraft({ ...legacyTask, schedule: { type: "webhook", signature: null } });
+    expect(
+      webhookDraftErrors({
+        ...draft,
+        replayKey: "bad",
+        coalesceKey: "bad",
+        coalesceWindowSeconds: "0",
+      }).map((error) => error.description),
+    ).toEqual([
+      "Replay key must contain a valid request placeholder.",
+      "Coalesce key must contain a valid request placeholder.",
+      "Coalesce window must be whole seconds from 10 to 3600.",
+    ]);
+  });
+});
diff --git a/apps/web/src/components/settings/scheduledTasksSettings.logic.ts b/apps/web/src/components/settings/scheduledTasksSettings.logic.ts
index 0767f99190c9..43030010c5ae 100644
--- a/apps/web/src/components/settings/scheduledTasksSettings.logic.ts
+++ b/apps/web/src/components/settings/scheduledTasksSettings.logic.ts
@@ -1,5 +1,7 @@
+import { isWebhookDedupeTemplate } from "@t3tools/contracts";
 import {
   EnvironmentId,
+  MAX_WEBHOOK_DELIVERY_AGE_MINUTES,
   type ProjectId,
   ScheduledTaskId,
   type ScheduledTask,
@@ -9,7 +11,13 @@ import {
   type ProviderInteractionMode,
   type ServerSettings,
 } from "@t3tools/contracts";
-import { parseMaxDeliveryAge } from "@t3tools/client-runtime/scheduled-task-webhook";
+import {
+  parseMaxDeliveryAge,
+  parseWebhookFilterDrafts,
+  webhookFilterDrafts,
+  webhookFilterDraftsChanged,
+  type WebhookFilterDraft,
+} from "@t3tools/client-runtime/scheduled-task-webhook";
 
 import {
   resolveProjectSettings,
@@ -77,6 +85,12 @@ export interface DraftState {
   /** Write-only: empty keeps the secret already stored on the server. */
   readonly signatureSecret: string;
   readonly maxDeliveryAgeMinutes: string;
+  readonly replayKey: string;
+  readonly coalesceKey: string;
+  readonly coalesceWindowSeconds: string;
+  readonly filters: ReadonlyArray<WebhookFilterDraft>;
+  /** The filter rows the form opened with. */
+  readonly savedFilters: ReadonlyArray<WebhookFilterDraft>;
 }
 
 export const WEBHOOK_SIGNATURE_DEFAULTS = {
@@ -85,10 +99,65 @@ export const WEBHOOK_SIGNATURE_DEFAULTS = {
   signaturePrefix: "sha256=",
 } as const;
 
+export function webhookDraftErrors(draft: DraftState) {
+  if (draft.scheduleMode !== "webhook") return [];
+  if (parseMaxDeliveryAge(draft.maxDeliveryAgeMinutes) === undefined)
+    return [
+      {
+        title: "Invalid age limit",
+        description: `Enter whole minutes from 1 to ${MAX_WEBHOOK_DELIVERY_AGE_MINUTES}, or leave it blank.`,
+      },
+    ];
+  const errors: Array<{ title: string; description: string }> = [];
+  for (const [label, value] of [
+    ["Replay key", draft.replayKey],
+    ["Coalesce key", draft.coalesceKey],
+  ] as const) {
+    if (value.trim() && !isWebhookDedupeTemplate(value.trim()))
+      errors.push({
+        title: "Invalid webhook settings",
+        description: `${label} must contain a valid request placeholder.`,
+      });
+  }
+  const window = draft.coalesceWindowSeconds.trim();
+  if (window && (!Number.isInteger(Number(window)) || Number(window) < 10 || Number(window) > 3600))
+    errors.push({
+      title: "Invalid webhook settings",
+      description: "Coalesce window must be whole seconds from 10 to 3600.",
+    });
+  return errors;
+}
+
+export function webhookDeliveryLabel(delivery: {
+  readonly outcome: string;
+  readonly pendingWindow?: boolean | undefined;
+}) {
+  if (delivery.outcome === "accepted") return delivery.pendingWindow ? "Opened window" : "Ran";
+  const labels: Record<string, string> = {
+    dispatch_failed: "Run failed",
+    duplicate: "Duplicate",
+    coalesced: "Coalesced",
+    filtered: "Filtered",
+    rejected_signature: "Bad signature",
+    disabled: "Task paused",
+    rate_limited: "Rate limited",
+    expired: "Too old",
+  };
+  return labels[delivery.outcome] ?? delivery.outcome.replaceAll("_", " ");
+}
+
 export function scheduleFromDraft(draft: DraftState): ScheduledTaskUpsertSchedule | null {
   if (draft.scheduleMode === "webhook") {
+    if (webhookDraftErrors(draft).length > 0) return null;
     const maxDeliveryAgeMinutes = parseMaxDeliveryAge(draft.maxDeliveryAgeMinutes);
+    const replayKey = draft.replayKey.trim();
+    const coalesceKey = draft.coalesceKey.trim();
+    const coalesceWindowSeconds = draft.coalesceWindowSeconds.trim()
+      ? Number(draft.coalesceWindowSeconds)
+      : undefined;
     if (maxDeliveryAgeMinutes === undefined) return null;
+    const parsedFilters = parseWebhookFilterDrafts(draft.filters);
+    if (!("filters" in parsedFilters)) return null;
     const secret = draft.signatureSecret.trim();
     return {
       type: "webhook",
@@ -101,6 +170,19 @@ export function scheduleFromDraft(draft: DraftState): ScheduledTaskUpsertSchedul
           }
         : null,
       maxDeliveryAgeMinutes,
+      ...(replayKey || coalesceKey || coalesceWindowSeconds !== undefined
+        ? {
+            dedupe: {
+              ...(replayKey ? { replayKey } : {}),
+              ...(coalesceKey ? { coalesceKey } : {}),
+              ...(coalesceWindowSeconds === undefined ? {} : { coalesceWindowSeconds }),
+            },
+          }
+        : { dedupe: {} }),
+      // Only edited filters are sent; the server keeps the stored ones otherwise.
+      ...(webhookFilterDraftsChanged(draft.savedFilters, draft.filters)
+        ? { filters: parsedFilters.filters }
+        : {}),
     };
   }
   if (draft.scheduleMode === "interval") {
@@ -117,6 +199,7 @@ export function scheduleFromDraft(draft: DraftState): ScheduledTaskUpsertSchedul
 
 export function taskToDraft(task: ScheduledTask): DraftState {
   const schedule = task.schedule;
+  const filters = webhookFilterDrafts(schedule.type === "webhook" ? schedule.filters : undefined);
   const weekdays =
     schedule.type === "fixed_time" && schedule.weekdays && schedule.weekdays.length > 0
       ? new Set(schedule.weekdays)
@@ -157,10 +240,18 @@ export function taskToDraft(task: ScheduledTask): DraftState {
         }
       : { signatureEnabled: false, ...WEBHOOK_SIGNATURE_DEFAULTS }),
     signatureSecret: "",
+    replayKey: schedule.type === "webhook" ? (schedule.dedupe?.replayKey ?? "") : "",
+    coalesceKey: schedule.type === "webhook" ? (schedule.dedupe?.coalesceKey ?? "") : "",
+    coalesceWindowSeconds:
+      schedule.type === "webhook" && schedule.dedupe?.coalesceWindowSeconds !== undefined
+        ? String(schedule.dedupe.coalesceWindowSeconds)
+        : "",
     maxDeliveryAgeMinutes:
       schedule.type === "webhook" && schedule.maxDeliveryAgeMinutes != null
         ? String(schedule.maxDeliveryAgeMinutes)
         : "",
+    filters,
+    savedFilters: filters,
   };
 }
 
diff --git a/apps/web/src/components/settings/useSnapShotShortcutRecorder.browser.test.tsx b/apps/web/src/components/settings/useSnapShotShortcutRecorder.browser.test.tsx
index b463ed296d6b..bd2a3a54337c 100644
--- a/apps/web/src/components/settings/useSnapShotShortcutRecorder.browser.test.tsx
+++ b/apps/web/src/components/settings/useSnapShotShortcutRecorder.browser.test.tsx
@@ -1,6 +1,5 @@
 import { act, render } from "../../../test/render";
 import { DEFAULT_CLIENT_SETTINGS } from "@t3tools/contracts";
-import { useEffect } from "react";
 import { userEvent } from "vite-plus/test/browser";
 import { expect, it, vi } from "vite-plus/test";
 
@@ -22,7 +21,6 @@ function deferred<T>() {
 
 const recorded = vi.fn();
 const error = vi.fn();
-let recording = false;
 
 function Recorder(props: { allowModifierPairs?: boolean; shortcutLabel?: string }) {
   const recorder = useSnapShotShortcutRecorder({
@@ -32,9 +30,6 @@ function Recorder(props: { allowModifierPairs?: boolean; shortcutLabel?: string
     onRecord: recorded,
     onError: error,
   });
-  useEffect(() => {
-    recording = recorder.recording;
-  });
   return recorder.input;
 }
 
@@ -42,22 +37,25 @@ function setup() {
   suppress.mockReset().mockResolvedValue(undefined);
   recorded.mockReset();
   error.mockReset();
-  recording = false;
 }
 async function renderRecorder(props: Parameters<typeof Recorder>[0] = {}) {
   const screen = await render(<Recorder {...props} />);
   const button = () =>
     screen.container.querySelector<HTMLButtonElement>("[data-keybinding-capture]")!;
+  // aria-pressed mirrors the hook's recording state, which flips once suppression resolves.
+  const expectRecording = (recording: boolean) =>
+    expect.element(screen.getByRole("button")).toHaveAttribute("aria-pressed", String(recording));
   return {
     ...screen,
     button,
+    expectRecording,
     async start() {
-      await act(() => userEvent.click(button()));
-      expect(recording).toBe(true);
+      await userEvent.click(button());
+      await expectRecording(true);
     },
   };
 }
-const press = (keys: string) => act(async () => userEvent.keyboard(keys));
+const press = (keys: string) => userEvent.keyboard(keys);
 
 it("suppresses capture while recording and uses the physical key for shifted digits", async () => {
   setup();
@@ -77,7 +75,7 @@ it("suppresses capture while recording and uses the physical key for shifted dig
     shiftKey: true,
   });
   expect(suppress).toHaveBeenLastCalledWith(false);
-  expect(recording).toBe(false);
+  await screen.expectRecording(false);
 });
 
 it("lets users replace an unrecognized desktop label without displaying guessed keys", async () => {
@@ -88,7 +86,7 @@ it("lets users replace an unrecognized desktop label without displaying guessed
   const { button } = screen;
   expect(button().textContent).toBe("Change shortcut");
   expect(button().getAttribute("aria-label")).toBe("Change snapshot shortcut");
-  await act(async () => userEvent.click(button()));
+  await userEvent.click(button());
   expect(button().textContent).toBe("Press shortcut…");
   await press("{Control>}{Shift>}2{/Shift}{/Control}");
   expect(recorded).toHaveBeenCalledWith(
@@ -124,7 +122,7 @@ it.each(["Escape", "blur", "unmount"])("cancels on %s without selecting keys", a
   else await screen.unmount();
   expect(suppress).toHaveBeenLastCalledWith(false);
   expect(recorded).not.toHaveBeenCalled();
-  if (cancel !== "unmount") expect(recording).toBe(false);
+  if (cancel !== "unmount") await screen.expectRecording(false);
 });
 
 it("ignores late suppression acknowledgements after cancellation", async () => {
@@ -134,10 +132,10 @@ it("ignores late suppression acknowledgements after cancellation", async () => {
   suppress.mockImplementation((enabled) => (enabled ? pending.promise : Promise.resolve()));
   await using screen = await renderRecorder();
   const { button } = screen;
-  await act(async () => userEvent.click(button()));
+  await userEvent.click(button());
   await act(async () => button().blur());
   await act(async () => pending.resolve());
-  expect(recording).toBe(false);
+  await screen.expectRecording(false);
   expect(suppress).toHaveBeenLastCalledWith(false);
   expect(recorded).not.toHaveBeenCalled();
 });
@@ -148,8 +146,8 @@ it("reports suppression failures instead of arming the recorder", async () => {
   suppress.mockRejectedValue(new Error("Couldn't pause capture"));
   await using screen = await renderRecorder();
   const { button } = screen;
-  await act(async () => userEvent.click(button()));
-  expect(recording).toBe(false);
+  await userEvent.click(button());
+  await screen.expectRecording(false);
   expect(error).toHaveBeenCalledWith("Couldn't pause capture");
 });
 
@@ -162,7 +160,7 @@ it("does not record Tab, unmodified keys, or modifier keys on their own", async
   await press("y");
   await press("{Control>}{/Control}");
   expect(recorded).not.toHaveBeenCalled();
-  expect(recording).toBe(true);
+  await screen.expectRecording(true);
   await press("{Tab}");
   expect(document.activeElement).not.toBe(button());
 });
@@ -176,7 +174,7 @@ it("rejects modifier pairs on Wayland but accepts the next key chord", async ()
   await press("{ShiftLeft>}{ShiftRight>}{/ShiftRight}{/ShiftLeft}");
   expect(recorded).not.toHaveBeenCalled();
   expect(error).toHaveBeenCalledWith(expect.stringContaining("Add a letter, number"));
-  expect(recording).toBe(true);
+  await screen.expectRecording(true);
   await press("{Control>}{Alt>}y{/Alt}{/Control}");
   expect(recorded).toHaveBeenCalledOnce();
 });
diff --git a/apps/web/src/components/usage/UsageLimits.browser.test.tsx b/apps/web/src/components/usage/UsageLimits.browser.test.tsx
new file mode 100644
index 000000000000..c0786c675f24
--- /dev/null
+++ b/apps/web/src/components/usage/UsageLimits.browser.test.tsx
@@ -0,0 +1,89 @@
+import { render } from "../../../test/render";
+import { ProviderDriverKind, type ServerProviderUsageWindow } from "@t3tools/contracts";
+import { expect, it, vi } from "vite-plus/test";
+import { page } from "vite-plus/test/browser";
+
+import "~/index.css";
+
+vi.mock("../../state/session", () => ({
+  useEnvironmentScope: () => true,
+  readEnvironmentScope: () => true,
+}));
+vi.mock("../../state/server", () => ({ serverEnvironment: { consumeResetCredit: null } }));
+vi.mock("../../state/use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));
+vi.mock("../../hooks/useSettings", () => ({ usePrimarySettings: () => "24h" }));
+
+import { LimitWindows } from "./UsageLimits";
+
+const codex = ProviderDriverKind.make("codex");
+const now = Date.parse("2026-09-03T12:00:00Z");
+
+const sessionWindow = (minutesUntilReset: number | null): ServerProviderUsageWindow => ({
+  id: "five_hour",
+  kind: "session",
+  label: "Session",
+  usedPercent: 40,
+  ...(minutesUntilReset === null
+    ? {}
+    : {
+        windowDurationMins: 300,
+        resetsAt: new Date(now + minutesUntilReset * 60_000).toISOString(),
+      }),
+});
+
+const sized = (width: string) => {
+  const container = document.createElement("div");
+  container.style.width = width;
+  return container;
+};
+
+const bar = () => {
+  const element = page.getByRole("img", { name: /^Session:/ }).element();
+  const mark = element.querySelector(":scope > span[aria-hidden]");
+  return {
+    rect: element.getBoundingClientRect(),
+    mark: mark?.getBoundingClientRect(),
+    clip: getComputedStyle(element.querySelector(":scope > div")!).clipPath,
+  };
+};
+
+it("places the even-pace tick in a gap at the share of the window left", async () => {
+  await using _screen = await render(
+    <LimitWindows driver={codex} windows={[sessionWindow(90)]} now={now} />,
+    { container: sized("640px") },
+  );
+  const { rect, mark, clip } = bar();
+  expect(mark!.left + mark!.width / 2 - rect.left).toBeCloseTo(rect.width * 0.3, 0);
+  expect(clip).toMatch(/^polygon/);
+});
+
+it("keeps the tick inside the bar at both ends of the window", async () => {
+  for (const minutesUntilReset of [0, 300]) {
+    await using _screen = await render(
+      <LimitWindows driver={codex} windows={[sessionWindow(minutesUntilReset)]} now={now} />,
+      { container: sized("640px") },
+    );
+    const { rect, mark } = bar();
+    expect(mark!.left).toBeGreaterThanOrEqual(rect.left);
+    expect(mark!.right).toBeLessThanOrEqual(rect.right);
+  }
+});
+
+it("draws a continuous bar when the window timing is unknown", async () => {
+  await using _screen = await render(
+    <LimitWindows driver={codex} windows={[sessionWindow(null)]} now={now} />,
+    { container: sized("640px") },
+  );
+  expect(bar()).toMatchObject({ mark: undefined, clip: "none" });
+});
+
+it("draws neither gap nor tick on a bar narrower than 6px", async () => {
+  // 11rem + 1rem + 3.5px + 1rem + 7rem: the bar column gets 3.5px.
+  await using _screen = await render(
+    <LimitWindows driver={codex} windows={[sessionWindow(300)]} now={now} />,
+    { container: sized("323.5px") },
+  );
+  const { rect, mark, clip } = bar();
+  expect(rect.width).toBeCloseTo(3.5, 1);
+  expect({ mark, clip }).toEqual({ mark: undefined, clip: "none" });
+});
diff --git a/apps/web/src/components/usage/UsageLimits.tsx b/apps/web/src/components/usage/UsageLimits.tsx
index 0ac9cf236292..bac2682a0245 100644
--- a/apps/web/src/components/usage/UsageLimits.tsx
+++ b/apps/web/src/components/usage/UsageLimits.tsx
@@ -18,9 +18,10 @@ import {
   remainingPercent,
 } from "@t3tools/shared/usageLimits";
 import { GaugeIcon, TrendingDownIcon, TrendingUpIcon } from "lucide-react";
-import { Fragment, type ReactNode, useState } from "react";
+import { Fragment, type ReactNode, useLayoutEffect, useState } from "react";
 
 import { usePrimarySettings } from "../../hooks/useSettings";
+import { observeResize } from "../../lib/observeResize";
 import { environmentPresentations } from "../../state/presentation";
 import { useEnvironmentScope, readEnvironmentScope } from "../../state/session";
 import { serverEnvironment } from "../../state/server";
@@ -73,6 +74,43 @@ export function PaceIcon({ pace }: { readonly pace: LimitPace }) {
   );
 }
 
+// The tick sits in a transparent gap cut from the bar, clamped so it stays inside at 0% and 100%.
+// The gap is a clip-path slot rather than a mask: a mask composites its layer and re-antialiases
+// the bar's rounded ends, and the polygon reaches 1px past the box so only the slot edges clip.
+function paceMarkStyles(timeLeft: number | null) {
+  if (timeLeft === null) return null;
+  const at = `clamp(3px, ${timeLeft}%, calc(100% - 3px))`;
+  const [left, right] = [`calc(${at} - 3px)`, `calc(${at} + 3px)`];
+  const [near, far] = ["-1px", "calc(100% + 1px)"];
+  return {
+    tick: { left: at },
+    gap: {
+      clipPath: `polygon(${near} ${near}, ${left} ${near}, ${left} ${far}, ${right} ${far}, ${right} ${near}, ${far} ${near}, ${far} ${far}, ${near} ${far})`,
+    },
+    // For a track painted on an element that also draws focus rings, which a clip would cut.
+    gappedTrack: {
+      backgroundColor: "transparent",
+      backgroundImage: `linear-gradient(to right, var(--color-muted) ${left}, transparent ${left}, transparent ${right}, var(--color-muted) ${right})`,
+    },
+  };
+}
+
+/**
+ * Pace mark styles for the bar given the returned ref. Below 6px there is no room for the gap
+ * and tick, so the bar draws neither, as the mobile bars do.
+ */
+export function usePaceMark(timeLeft: number | null) {
+  const [bar, setBar] = useState<HTMLElement | null>(null);
+  const [roomy, setRoomy] = useState(false);
+  useLayoutEffect(() => {
+    if (!bar) return;
+    const measure = () => setRoomy(bar.getBoundingClientRect().width >= 6);
+    measure();
+    return observeResize(bar, measure);
+  }, [bar]);
+  return [setBar, roomy ? paceMarkStyles(timeLeft) : null] as const;
+}
+
 function WindowBar({
   color,
   window,
@@ -85,6 +123,7 @@ function WindowBar({
   const timestampFormat = usePrimarySettings((settings) => settings.timestampFormat);
   const remaining = remainingPercent(window);
   const timeLeft = paceRemainingPercent(window, now);
+  const [barRef, paceMark] = usePaceMark(timeLeft);
   const resetsIn = formatResetsIn(window, now);
   const resetsAt = window.resetsAt
     ? formatUpcomingTimestamp(window.resetsAt, timestampFormat, now)
@@ -98,6 +137,7 @@ function WindowBar({
       <TooltipTrigger
         render={
           <div
+            ref={barRef}
             role="img"
             aria-label={summary}
             tabIndex={0}
@@ -105,18 +145,21 @@ function WindowBar({
           />
         }
       >
-        <div className="absolute inset-x-0 inset-y-1.5 rounded-full bg-muted" />
-        {remaining > 0 ? (
-          <div
-            className="absolute inset-y-1.5 left-0 rounded-full"
-            style={{ width: `${remaining}%`, backgroundColor: color }}
-          />
-        ) : null}
-        {timeLeft !== null ? (
+        {/* Clip both layers so the gap exposes even a translucent composer surface. */}
+        <div className="absolute inset-0" style={paceMark?.gap}>
+          <div className="absolute inset-x-0 inset-y-1.5 rounded-full bg-muted" />
+          {remaining > 0 ? (
+            <div
+              className="absolute inset-y-1.5 left-0 rounded-full"
+              style={{ width: `${remaining}%`, backgroundColor: color }}
+            />
+          ) : null}
+        </div>
+        {paceMark ? (
           <span
             aria-hidden
-            className="absolute inset-y-0.5 w-px -translate-x-1/2 bg-foreground/60"
-            style={{ left: `${timeLeft}%` }}
+            className="absolute inset-y-1 w-0.5 -translate-x-1/2 rounded-full bg-foreground"
+            style={paceMark.tick}
           />
         ) : null}
       </TooltipTrigger>
diff --git a/apps/web/src/components/usage/UsageLimitsPooled.browser.test.tsx b/apps/web/src/components/usage/UsageLimitsPooled.browser.test.tsx
index a70900c189d4..01cae793ae01 100644
--- a/apps/web/src/components/usage/UsageLimitsPooled.browser.test.tsx
+++ b/apps/web/src/components/usage/UsageLimitsPooled.browser.test.tsx
@@ -81,7 +81,7 @@ async function click(label: string) {
     (node) => node.textContent === label || node.getAttribute("aria-label")?.startsWith(label),
   );
   expect(button).toBeDefined();
-  await act(() => userEvent.click(button!));
+  await userEvent.click(button!);
 }
 
 /**
@@ -177,6 +177,43 @@ it("omits an empty reset plate but keeps countdowns and banked credits visible",
   expect(plate()?.textContent).toBe("1");
 });
 
+it("cuts the pace gap through the segment track and keeps the tick inside it", async () => {
+  setup();
+  // Five hours before the reset is the start of the window, the right-hand end of the bar.
+  await using _screen = await render(
+    <UsageLimitsPooled
+      presentations={presentations("2026-09-03T14:00:00Z", 0)}
+      now={Date.parse("2026-09-03T09:00:00Z")}
+    />,
+  );
+  const segment = page.getByRole("button", { name: /^Alpha:/ }).element();
+  const tick = segment.querySelector(':scope > span[style*="left"]')!.getBoundingClientRect();
+  const rect = segment.getBoundingClientRect();
+  expect(getComputedStyle(segment).backgroundImage).toMatch(/^linear-gradient/);
+  expect(tick.left).toBeGreaterThanOrEqual(rect.left);
+  expect(tick.right).toBeLessThanOrEqual(rect.right);
+});
+
+it("drops the pace gap and tick when a segment is narrower than 6px", async () => {
+  setup();
+  await using _screen = await render(
+    <UsageLimitsPooled
+      presentations={presentations("2026-09-03T14:00:00Z", 0)}
+      now={Date.parse("2026-09-03T11:30:00Z")}
+    />,
+  );
+  const segment = page.getByRole("button", { name: /^Alpha:/ }).element();
+  const tick = () => segment.querySelector(':scope > span[style*="left"]');
+  expect(tick()).not.toBeNull();
+  // Pooled grid columns have no minimum width; squeeze the segment the way a crowded pool does.
+  await act(() => {
+    segment.style.width = "4.5px";
+  });
+  await expect.poll(tick).toBeNull();
+  expect(getComputedStyle(segment).backgroundImage).toBe("none");
+  expect(getComputedStyle(segment.querySelector(":scope > div > div")!).clipPath).toBe("none");
+});
+
 it("moves the one limit popover between windows on hover", async () => {
   setup();
   await using screen = await render(initial());
@@ -225,24 +262,24 @@ it("moves the one limit popover between windows on hover", async () => {
   const session = segment("Alpha: 60%");
   const weekly = segment("Alpha: 68%");
 
-  await act(() => userEvent.click(session));
+  await userEvent.click(session);
   await expect.poll(popups).toEqual([expect.stringContaining("Left60%")]);
 
-  await act(() => userEvent.hover(weekly));
+  await userEvent.hover(weekly);
   await expect.poll(popups).toEqual([expect.stringContaining("Left68%")]);
 
   // Weekly's popover now sits over the middle of the Session bar; come back in at its edge.
-  await act(() => userEvent.hover(session, { position: { x: 4, y: 4 } }));
+  await userEvent.hover(session, { position: { x: 4, y: 4 } });
   await expect.poll(popups).toEqual([expect.stringContaining("Left60%")]);
 
   await expectDismissedInPlace(() =>
     act(() => screen.rerender(<UsageLimitsPooled presentations={new Map()} now={0} />)),
   );
-  await act(() => userEvent.hover(container, { position: { x: 4, y: 4 } }));
+  await userEvent.hover(container, { position: { x: 4, y: 4 } });
 
   await act(() => screen.rerender(<UsageLimitsPooled presentations={twoWindows} now={0} />));
   await expect.poll(popups).toEqual([]);
-  await act(() => userEvent.click(segment("Alpha: 60%")));
+  await userEvent.click(segment("Alpha: 60%"));
   await expect.poll(popups).toEqual([expect.stringContaining("Left60%")]);
 });
 
diff --git a/apps/web/src/components/usage/UsageLimitsPooled.tsx b/apps/web/src/components/usage/UsageLimitsPooled.tsx
index 8fc4b775b850..76be2555ff8c 100644
--- a/apps/web/src/components/usage/UsageLimitsPooled.tsx
+++ b/apps/web/src/components/usage/UsageLimitsPooled.tsx
@@ -42,6 +42,7 @@ import {
   PaceIcon,
   ResetCreditDialog,
   barColor,
+  usePaceMark,
   resetCreditsSummary,
   useResetCredit,
 } from "./UsageLimits";
@@ -342,6 +343,7 @@ function SegmentTriggers({
   const payload: SegmentPayload = { account, window, reset, redeem };
   const remaining = remainingPercent(window);
   const timeLeft = paceRemainingPercent(window, now);
+  const [segmentRef, paceMark] = usePaceMark(timeLeft);
   const resetsIn = formatResetsIn(window, now);
   const credits = account.limits.resetCredits?.availableCount ?? 0;
   return (
@@ -352,35 +354,39 @@ function SegmentTriggers({
         openOnHover
         render={
           <button
+            ref={segmentRef}
             type="button"
-            style={{ gridColumn: index, gridRow: 1 }}
+            style={{ gridColumn: index, gridRow: 1, ...paceMark?.gappedTrack }}
             aria-label={`${account.displayName ?? (account.email ? accountInitials(account.email) : account.driver)}: ${remaining}% left${resetsIn ? `, ${resetsIn}` : ""}${timeLeft === null ? "" : `, ${timeLeft}% of the window left`}${credits ? `, ${credits} reset ${credits === 1 ? "credit" : "credits"} banked` : ""}`}
             className="relative h-5 min-w-0 cursor-pointer rounded-md bg-muted text-start outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background data-[popup-open]:ring-1 data-[popup-open]:ring-inset data-[popup-open]:ring-border @2xl/pool:h-8"
           />
         }
       >
         <div aria-hidden className="absolute inset-0 overflow-hidden rounded-md">
-          <div
-            aria-hidden
-            className="absolute inset-y-0 left-0 rounded-md opacity-35"
-            style={{ width: `${remaining}%`, backgroundColor: color }}
-          />
-          {remaining < 100 && reset && refillPercent > 0 ? (
+          {/* Clipped inside the rounded clip so the bar's own corners keep their antialiasing. */}
+          <div className="absolute inset-0" style={paceMark?.gap}>
             <div
               aria-hidden
-              className="absolute inset-y-0 right-0 opacity-20"
-              style={{
-                width: `${Math.min(100 - remaining, refillPercent)}%`,
-                backgroundImage: `repeating-linear-gradient(135deg, ${color} 0 1px, transparent 1px 5px)`,
-              }}
+              className="absolute inset-y-0 left-0 rounded-md opacity-35"
+              style={{ width: `${remaining}%`, backgroundColor: color }}
             />
-          ) : null}
+            {remaining < 100 && reset && refillPercent > 0 ? (
+              <div
+                aria-hidden
+                className="absolute inset-y-0 right-0 opacity-20"
+                style={{
+                  width: `${Math.min(100 - remaining, refillPercent)}%`,
+                  backgroundImage: `repeating-linear-gradient(135deg, ${color} 0 1px, transparent 1px 5px)`,
+                }}
+              />
+            ) : null}
+          </div>
         </div>
-        {timeLeft !== null ? (
+        {paceMark ? (
           <span
             aria-hidden
-            className="absolute -inset-y-1 w-0.5 -translate-x-1/2 rounded-full bg-muted-foreground"
-            style={{ left: `${timeLeft}%` }}
+            className="absolute inset-y-0.5 w-0.5 -translate-x-1/2 rounded-full bg-foreground"
+            style={paceMark.tick}
           />
         ) : null}
         <span
diff --git a/apps/web/src/composer-list-split.browser.test.ts b/apps/web/src/composer-list-split.browser.test.ts
index ed672464c7c1..5201c11203cf 100644
--- a/apps/web/src/composer-list-split.browser.test.ts
+++ b/apps/web/src/composer-list-split.browser.test.ts
@@ -2,7 +2,7 @@ import { Editor } from "@tiptap/core";
 import { TaskList } from "@tiptap/extension-task-list";
 import { TextSelection } from "@tiptap/pm/state";
 import StarterKit from "@tiptap/starter-kit";
-import { afterEach, describe, expect, it } from "vite-plus/test";
+import { describe, expect, it } from "vite-plus/test";
 
 import {
   backspaceAcrossList,
@@ -19,13 +19,8 @@ import {
 } from "./composer-rich-text-doc";
 
 // ProseMirror's DOM observer can flush on a timer after a test ends, which
-// throws once its DOM is gone, so every editor is destroyed after its test.
-const editors: Editor[] = [];
-afterEach(() => {
-  for (const editor of editors.splice(0)) editor.destroy();
-});
-
-function makeEditor(value: string) {
+// throws once its DOM is gone, so every editor is acquired with `using`.
+function makeEditor(value: string): Editor & Disposable {
   const editor = new Editor({
     extensions: [
       StarterKit.configure({
@@ -47,12 +42,11 @@ function makeEditor(value: string) {
     ],
     content: buildDocJson(value, (name) => ({ label: name, description: null })),
   });
-  editors.push(editor);
-  return editor;
+  return Object.assign(editor, { [Symbol.dispose]: () => editor.destroy() });
 }
 
 function splitLastItem(value: string, type: "listItem" | "taskItem", overrides: object) {
-  const editor = makeEditor(value);
+  using editor = makeEditor(value);
   editor.view.dispatch(editor.state.tr.setSelection(TextSelection.atEnd(editor.state.doc)));
   editor.commands.splitListItem(type, overrides);
   editor.view.dispatch(editor.state.tr.insertText("b"));
@@ -88,7 +82,8 @@ function placeCaret(editor: Editor, text: string, offset = 0) {
 
 function storedDraft(editor: Editor) {
   const stored = serializeEditorDoc(editor.state.doc).value;
-  expect(makeEditor(stored).state.doc.toString()).toBe(editor.state.doc.toString());
+  using reloaded = makeEditor(stored);
+  expect(reloaded.state.doc.toString()).toBe(editor.state.doc.toString());
   return stored;
 }
 
@@ -102,7 +97,7 @@ describe("Shift+Enter twice on an item", () => {
     ["- [ ] a\n  - [ ] x", "- [ ] a\n  - [ ] x\n- [ ] b"],
     ["- [x] a\n  - [ ] x\n- [ ] c", "- [x] a\n  - [ ] x\n- [ ] b\n- [ ] c"],
   ])("after x in %j writes %j", (value, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     let caret = -1;
     editor.state.doc.descendants((node, pos) => {
       if (node.isText && node.text === "x") caret = pos + 1;
@@ -115,7 +110,8 @@ describe("Shift+Enter twice on an item", () => {
     editor.view.dispatch(editor.state.tr.insertText("b"));
     const stored = serializeEditorDoc(editor.state.doc).value;
     expect(stored).toBe(expected);
-    expect(makeEditor(stored).state.doc.toString()).toBe(editor.state.doc.toString());
+    using reloaded = makeEditor(stored);
+    expect(reloaded.state.doc.toString()).toBe(editor.state.doc.toString());
   });
 });
 
@@ -125,7 +121,7 @@ describe("Shift+Enter in the middle of an ordered list", () => {
     ["1) a\n2) x\n3) c", "1) a\n2) x\n3) b\n4) c"],
     ["1. a\n   1. x\n   2. c\n2. d", "1. a\n   1. x\n   2. b\n   3. c\n2. d"],
   ])("after x in %j writes %j", (value, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "x", 1);
     expect(splitOrLiftListItem(editor)).toBe(true);
     editor.view.dispatch(editor.state.tr.insertText("b"));
@@ -135,7 +131,7 @@ describe("Shift+Enter in the middle of an ordered list", () => {
 
 describe("Shift+Enter on an empty task under a bullet", () => {
   it.each(["- a\n  - [ ] x", "- [ ] a\n  - x"])("in %j keeps the draft honest", (value) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "x", 1);
     splitOrLiftListItem(editor);
     splitOrLiftListItem(editor);
@@ -153,7 +149,7 @@ describe("Backspace at the start of a line", () => {
     ["- a\n  - x\nb", "b", "- a\n  - xb"],
     ["1. a\nb", "b", "1. ab"],
   ])("in %j at %s writes %j", (value, at, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, at);
     expect(backspaceAcrossList(editor)).toBe(true);
     expect(storedDraft(editor)).toBe(expected);
@@ -163,7 +159,7 @@ describe("Backspace at the start of a line", () => {
     ["- a\n```\nl1\nl2\n```", "- a\nl1\nl2"],
     ["p\n```ts\nl1\n```", "p\nl1"],
   ])("removes the fence of %j rather than joining its code up", (value, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "l1");
     editor.commands.keyboardShortcut("Backspace");
     expect(storedDraft(editor)).toBe(expected);
@@ -176,14 +172,14 @@ describe("Delete at the end of a line", () => {
     ["- a\n  - x\n- c", "- ax\n- c"],
     ["- a\n\nb", "- a\nb"],
   ])("in %j writes %j", (value, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "a", 1);
     expect(deleteAcrossList(editor)).toBe(true);
     expect(storedDraft(editor)).toBe(expected);
   });
 
   it.each(["- a\n```\nl1\n```", "a\n```\nl1\n```"])("leaves the fence in %j alone", (value) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "a", 1);
     editor.commands.keyboardShortcut("Delete");
     expect(storedDraft(editor)).toBe(value);
@@ -192,7 +188,7 @@ describe("Delete at the end of a line", () => {
 
 describe("blocks that a list item or quote cannot hold", () => {
   it("puts lines pasted at the end of an item after the list", () => {
-    const editor = makeEditor("- a");
+    using editor = makeEditor("- a");
     editor.view.dispatch(editor.state.tr.setSelection(TextSelection.atEnd(editor.state.doc)));
     const lines = buildTiptapContent("one\ntwo", (name) => ({ label: name, description: null }));
     editor.commands.insertContent(lines);
@@ -200,7 +196,7 @@ describe("blocks that a list item or quote cannot hold", () => {
   });
 
   it("will not make a task list inside a quote", () => {
-    const editor = makeEditor("> q");
+    using editor = makeEditor("> q");
     placeCaret(editor, "q");
     expect(editor.commands.wrapInList("taskList")).toBe(false);
     expect(storedDraft(editor)).toBe("> q");
@@ -216,7 +212,7 @@ describe("[ ] typed at the start of a bullet item", () => {
     ["- [ ]x\n  - y", "- [ ] x\n  - y"],
     ["-   [ ]x", "-   [ ] x"],
   ])("makes the item in %j a task where it stands", (value, expected) => {
-    const editor = makeEditor(value);
+    using editor = makeEditor(value);
     placeCaret(editor, "[ ]x");
     const from = editor.state.selection.from;
     editor.view.dispatch(
@@ -233,7 +229,7 @@ describe("[ ] typed at the start of a bullet item", () => {
 
 describe("a rule at the end of the draft", () => {
   it("keeps an empty line after it to type on", () => {
-    const editor = makeEditor("a\n---");
+    using editor = makeEditor("a\n---");
     editor.view.dispatch(
       editor.state.tr.delete(editor.state.doc.content.size - 2, editor.state.doc.content.size),
     );
diff --git a/apps/web/src/index.css b/apps/web/src/index.css
index 1a4727e40a17..346d4d85cde9 100644
--- a/apps/web/src/index.css
+++ b/apps/web/src/index.css
@@ -1729,6 +1729,20 @@ code {
   --diffs-header-font-family: var(--font-sans);
 }
 
+/* Pele diagrams read their colors through these, so a theme change recolors
+   them without re-rendering. */
+.pele {
+  --pele-bg: var(--background);
+  --pele-fg: var(--foreground);
+  --pele-muted: var(--muted-foreground);
+  --pele-line: var(--muted-foreground);
+  --pele-surface: var(--secondary);
+  --pele-surface-alt: var(--accent);
+  --pele-border: color-mix(in srgb, var(--foreground) 28%, transparent);
+  --pele-accent: var(--primary);
+  --pele-critical: var(--destructive);
+}
+
 /* Window drag region (frameless titlebar) */
 .drag-region {
   -webkit-app-region: drag;
@@ -2108,7 +2122,7 @@ code {
 .chat-markdown th,
 .chat-markdown td {
   padding: 0.45rem 0.75rem;
-  text-align: center;
+  text-align: left;
 }
 
 .chat-markdown thead th {
diff --git a/apps/web/src/lib/editableFocus.browser.test.ts b/apps/web/src/lib/editableFocus.browser.test.ts
index ea09ef792aac..9491ffeeacc4 100644
--- a/apps/web/src/lib/editableFocus.browser.test.ts
+++ b/apps/web/src/lib/editableFocus.browser.test.ts
@@ -1,11 +1,7 @@
-import { afterEach, describe, expect, it } from "vite-plus/test";
+import { describe, expect, it } from "vite-plus/test";
 
 import { isEditableFocused } from "./editableFocus";
 
-afterEach(() => {
-  document.body.replaceChildren();
-});
-
 describe("isEditableFocused", () => {
   it("sees a text field focused inside an open shadow root", () => {
     // A key event from a shadow input is retargeted to its host, so the host is
@@ -14,6 +10,7 @@ describe("isEditableFocused", () => {
     const input = document.createElement("input");
     host.attachShadow({ mode: "open" }).append(input);
     document.body.append(host);
+    using _host = { [Symbol.dispose]: () => host.remove() };
 
     expect(isEditableFocused(host)).toBe(false);
     input.focus();
diff --git a/apps/web/src/shortcutModifierState.browser.test.ts b/apps/web/src/shortcutModifierState.browser.test.ts
index e017369ff4a9..575f590747cb 100644
--- a/apps/web/src/shortcutModifierState.browser.test.ts
+++ b/apps/web/src/shortcutModifierState.browser.test.ts
@@ -1,6 +1,7 @@
-import { act, createElement } from "react";
-import { createRoot, type Root } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+import { createElement } from "react";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { act, render } from "../test/render";
 
 import {
   areShortcutModifierStatesEqual,
@@ -17,33 +18,16 @@ const emptyState = (): ShortcutModifierState => ({
 });
 
 describe("useShortcutModifierState", () => {
-  let root: Root;
-  let container: HTMLDivElement;
-
-  beforeEach(() => {
-    vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
-    container = document.createElement("div");
-    document.body.append(container);
-    root = createRoot(container);
-  });
-
-  afterEach(async () => {
-    await act(async () => root.unmount());
-    container.remove();
-    vi.unstubAllGlobals();
-  });
-
   it.each(["keyup", "paste", "blur"] as const)(
     "does not render for unchanged modifiers after %s resets the state",
     async (reset) => {
-      const render = vi.fn();
+      const onRender = vi.fn();
       function Consumer() {
-        render(useShortcutModifierState());
+        onRender(useShortcutModifierState());
         return null;
       }
-      await act(async () => {
-        root.render(createElement(Consumer));
-      });
+      // The test counts the hook's renders, and the hook never reads a route.
+      await using _screen = await render(createElement(Consumer), { router: false });
       const press = async (type: "keydown" | "keyup", key: string, shiftKey = false) => {
         await act(async () => {
           window.dispatchEvent(new KeyboardEvent(type, { key, shiftKey }));
@@ -51,7 +35,7 @@ describe("useShortcutModifierState", () => {
       };
 
       await press("keydown", "Shift", true);
-      expect(render).toHaveBeenLastCalledWith({ ...emptyState(), shiftKey: true });
+      expect(onRender).toHaveBeenLastCalledWith({ ...emptyState(), shiftKey: true });
       if (reset === "keyup") {
         await press("keyup", "Shift");
       } else {
@@ -59,8 +43,8 @@ describe("useShortcutModifierState", () => {
           window.dispatchEvent(new Event(reset));
         });
       }
-      expect(render).toHaveBeenLastCalledWith(emptyState());
-      render.mockClear();
+      expect(onRender).toHaveBeenLastCalledWith(emptyState());
+      onRender.mockClear();
 
       for (const key of "typing") {
         await press("keydown", key);
@@ -70,9 +54,9 @@ describe("useShortcutModifierState", () => {
         window.dispatchEvent(new Event("paste"));
         window.dispatchEvent(new Event("blur"));
       });
-      expect(render).not.toHaveBeenCalled();
+      expect(onRender).not.toHaveBeenCalled();
       await press("keydown", "Shift", true);
-      expect(render).toHaveBeenCalledExactlyOnceWith({ ...emptyState(), shiftKey: true });
+      expect(onRender).toHaveBeenCalledExactlyOnceWith({ ...emptyState(), shiftKey: true });
     },
   );
 });
diff --git a/apps/web/test/fixtures/usage-limits-hub/README.md b/apps/web/test/fixtures/usage-limits-hub/README.md
new file mode 100644
index 000000000000..102f8a31e573
--- /dev/null
+++ b/apps/web/test/fixtures/usage-limits-hub/README.md
@@ -0,0 +1,65 @@
+# Usage limits hub fixture
+
+A fake CLIProxyAPI hub that serves the Limits evidence scenarios in `scenarios.json`:
+
+| Scenario | Accounts                                                       |
+| -------- | -------------------------------------------------------------- |
+| A        | mixed Codex and Claude accounts                                |
+| B        | one account per provider                                       |
+| C        | six long-email Codex accounts                                  |
+| L        | named accounts (no email, so segments show the auth-file name) |
+| T        | forty accounts, so pooled segments are 4px wide at 390px       |
+
+Reset times are minute offsets from `n0`.
+
+## Rebuild a capture
+
+1. Start a dev server with empty provider homes, so local logins add no accounts:
+
+   ```sh
+   CODEX_HOME=$(mktemp -d) CLAUDE_CONFIG_DIR=$(mktemp -d) vp run dev
+   ```
+
+2. Write `state.json` as `{"scenario": "A", "n0": 1792515540000}`. That `n0` is 2026-10-20T16:59:00Z, the instant every published capture uses. Then start the hub:
+
+   ```sh
+   node hub.mjs state.json 18517
+   ```
+
+3. Under Settings → Providers → Usage limit sources, add a hub with URL `http://127.0.0.1:18517`, any management key, and label `Team hub`. The composer panel prints that label on every account row.
+
+4. Freeze the browser clock at `n0` from the devtools console:
+
+   ```js
+   const T = 1792515540000;
+   const R = Date;
+   window.Date = class extends R {
+     constructor(...a) {
+       super(...(a.length ? a : [T]));
+     }
+     static now() {
+       return T;
+     }
+   };
+   ```
+
+   Then re-read the time:
+   - On the Usage page, select Cost and then Limits again.
+   - Open the composer panel with `/usage-limits` after freezing.
+   - The sidebar's relative timestamp picks up the frozen clock on its next minute tick.
+
+5. Viewports and themes: emulate `prefers-color-scheme` light and dark, and wait a few seconds after switching theme or size so transitions and overlay scrollbars settle.
+
+   | Surface                                         | Viewport                              |
+   | ----------------------------------------------- | ------------------------------------- |
+   | Usage page                                      | 1440×900 and 390×1500                 |
+   | Scenario T                                      | 390×3100, so the page does not scroll |
+   | Composer panel, Codex thread (`gpt-6-astra`)    | 1440×900                              |
+   | Composer panel, Claude thread (Claude Opus 5.5) | 390×1300                              |
+
+6. Edit `state.json` and press Refresh limits to switch scenarios.
+
+## Not from the fixture
+
+- **"Codex: Could not read limits."** That banner comes from the local Codex install, which is unauthenticated with an empty `CODEX_HOME`.
+- **"Claude API Key" rows** in the Claude composer panel come from the local Claude install, not the fixture.
diff --git a/apps/web/test/fixtures/usage-limits-hub/hub.mjs b/apps/web/test/fixtures/usage-limits-hub/hub.mjs
new file mode 100644
index 000000000000..a2ba8d7c2ef0
--- /dev/null
+++ b/apps/web/test/fixtures/usage-limits-hub/hub.mjs
@@ -0,0 +1,91 @@
+// Fake CLIProxyAPI management API serving the Limits scenarios in scenarios.json.
+// Usage: node hub.mjs <state.json> [port]. state.json is {"scenario": "A", "n0": <epoch ms>};
+// it is re-read on every request, so edit it and press Refresh limits to switch scenarios.
+import * as NodeFS from "node:fs";
+import * as NodeHttp from "node:http";
+
+const [statePath, port = "18517"] = process.argv.slice(2);
+if (!statePath) throw new Error("usage: node hub.mjs <state.json> [port]");
+const scenarios = JSON.parse(
+  NodeFS.readFileSync(new URL("./scenarios.json", import.meta.url), "utf8"),
+);
+const MINUTE = 60_000;
+
+// A window is [usedPercent, minutesFromN0 | null]; null is unknown reset timing.
+const at = (n0, minutes) => (minutes === null ? null : n0 + minutes * MINUTE);
+const usage = (account, n0) => {
+  const [session, weekly, fable] = account.windows;
+  if (account.provider === "codex") {
+    const window = ([used, minutes], seconds) => ({
+      used_percent: used,
+      reset_at: at(n0, minutes) === null ? null : Math.floor(at(n0, minutes) / 1000),
+      limit_window_seconds: seconds,
+    });
+    return {
+      plan_type: "pro",
+      rate_limit: {
+        primary_window: window(session, 18_000),
+        secondary_window: window(weekly, 604_800),
+      },
+    };
+  }
+  const window = ([used, minutes]) => ({
+    utilization: used,
+    resets_at: at(n0, minutes) === null ? null : new Date(at(n0, minutes)).toISOString(),
+  });
+  return {
+    five_hour: window(session),
+    seven_day: window(weekly),
+    limits: fable
+      ? [
+          {
+            kind: "weekly_scoped",
+            percent: fable[0],
+            resets_at: window(fable).resets_at,
+            scope: { model: { display_name: "Fable" } },
+          },
+        ]
+      : [],
+  };
+};
+
+const json = (response, body) => {
+  response.writeHead(200, { "content-type": "application/json" });
+  response.end(JSON.stringify(body));
+};
+
+NodeHttp.createServer((request, response) => {
+  let raw = "";
+  request.on("data", (chunk) => (raw += chunk));
+  request.on("end", () => {
+    const { scenario, n0 } = JSON.parse(NodeFS.readFileSync(statePath, "utf8"));
+    const accounts = scenarios[scenario];
+    if (!accounts) return json(response, { files: [] });
+    if (request.url.endsWith("/v0/management/auth-files")) {
+      return json(response, {
+        files: Object.entries(accounts).map(([id, account]) => ({
+          id,
+          auth_index: id,
+          provider: account.provider,
+          ...(account.email ? { email: account.email } : {}),
+        })),
+      });
+    }
+    if (request.url.endsWith("/v0/management/api-call")) {
+      const call = JSON.parse(raw);
+      const account = accounts[call.auth_index];
+      if (!account) return json(response, { status_code: 404, body: "{}" });
+      if (call.url.endsWith("/rate-limit-reset-credits")) {
+        const credits = Array.from({ length: account.credits ?? 0 }, (_, index) => ({
+          id: `${call.auth_index}-credit-${index}`,
+          status: "available",
+          reset_type: "codex_rate_limits",
+          expires_at: new Date(n0 + 3 * 24 * 60 * MINUTE).toISOString(),
+        }));
+        return json(response, { status_code: 200, body: JSON.stringify({ credits }) });
+      }
+      return json(response, { status_code: 200, body: JSON.stringify(usage(account, n0)) });
+    }
+    response.writeHead(404).end();
+  });
+}).listen(Number(port), "127.0.0.1", () => console.log(`usage limits hub on ${port}`));
diff --git a/apps/web/test/fixtures/usage-limits-hub/scenarios.json b/apps/web/test/fixtures/usage-limits-hub/scenarios.json
new file mode 100644
index 000000000000..70e9be83f9a1
--- /dev/null
+++ b/apps/web/test/fixtures/usage-limits-hub/scenarios.json
@@ -0,0 +1,516 @@
+{
+  "A": {
+    "c1": {
+      "provider": "codex",
+      "email": "c1.codex.owner@example.com",
+      "windows": [
+        [30, 120],
+        [60, 7560.0]
+      ]
+    },
+    "c2": {
+      "provider": "codex",
+      "email": "c2.codex.owner@example.com",
+      "windows": [
+        [0, 310],
+        [40, null]
+      ]
+    },
+    "c3": {
+      "provider": "codex",
+      "email": "c3.codex.owner@example.com",
+      "windows": [
+        [20, -1],
+        [50, 5040.0]
+      ],
+      "credits": 2
+    },
+    "a1": {
+      "provider": "claude",
+      "email": "a1.claude.owner@example.com",
+      "windows": [
+        [50, 150.0],
+        [10, 9273.6],
+        [0, 10140]
+      ]
+    },
+    "a2": {
+      "provider": "claude",
+      "email": "a2.claude.owner@example.com",
+      "windows": [
+        [100, 60],
+        [92, 5040.0],
+        [75, 7200]
+      ]
+    },
+    "a3": {
+      "provider": "claude",
+      "email": "a3.claude.owner@example.com",
+      "windows": [
+        [30, 180],
+        [100, 120]
+      ]
+    }
+  },
+  "B": {
+    "c1": {
+      "provider": "codex",
+      "email": "c1.codex.owner@example.com",
+      "windows": [
+        [30, 120],
+        [60, 7560.0]
+      ]
+    },
+    "a1": {
+      "provider": "claude",
+      "email": "a1.claude.owner@example.com",
+      "windows": [
+        [50, 150.0],
+        [10, 9273.6],
+        [0, 10140]
+      ]
+    }
+  },
+  "C": {
+    "m1": {
+      "provider": "codex",
+      "email": "firstname1.lastname.contractor@example-company.com",
+      "windows": [
+        [0, 310],
+        [0, 10140]
+      ]
+    },
+    "m2": {
+      "provider": "codex",
+      "email": "firstname2.lastname.contractor@example-company.com",
+      "windows": [
+        [100, -1],
+        [100, 60]
+      ]
+    },
+    "m3": {
+      "provider": "codex",
+      "email": "firstname3.lastname.contractor@example-company.com",
+      "windows": [
+        [45, 165.0],
+        [30, 7200]
+      ]
+    },
+    "m4": {
+      "provider": "codex",
+      "email": "firstname4.lastname.contractor@example-company.com",
+      "windows": [
+        [10, 30.0],
+        [80, 8640]
+      ]
+    },
+    "m5": {
+      "provider": "codex",
+      "email": "firstname5.lastname.contractor@example-company.com",
+      "windows": [
+        [40, null],
+        [40, null]
+      ]
+    },
+    "m6": {
+      "provider": "codex",
+      "email": "firstname6.lastname.contractor@example-company.com",
+      "windows": [
+        [60, 240],
+        [5, 1440]
+      ]
+    }
+  },
+  "L": {
+    "platform-team-primary": {
+      "provider": "codex",
+      "windows": [
+        [30, 120],
+        [60, 7560.0]
+      ]
+    },
+    "platform-team-backup": {
+      "provider": "codex",
+      "windows": [
+        [0, 310],
+        [40, null]
+      ]
+    },
+    "contractor-shared-pool": {
+      "provider": "codex",
+      "windows": [
+        [20, -1],
+        [50, 9072.0]
+      ],
+      "credits": 2
+    },
+    "research-lab-claude-seat-1": {
+      "provider": "claude",
+      "windows": [
+        [50, 150.0],
+        [10, 9273.6],
+        [0, 10140]
+      ]
+    },
+    "research-lab-claude-seat-2": {
+      "provider": "claude",
+      "windows": [
+        [100, 60],
+        [92, 5040.0],
+        [75, 7200]
+      ]
+    },
+    "research-lab-claude-seat-3": {
+      "provider": "claude",
+      "windows": [
+        [30, 180],
+        [100, 120]
+      ]
+    },
+    "research-lab-claude-seat-4": {
+      "provider": "claude",
+      "windows": [
+        [50, 150.0],
+        [10, 9273.6],
+        [0, 10140]
+      ]
+    },
+    "research-lab-claude-seat-5": {
+      "provider": "claude",
+      "windows": [
+        [100, 60],
+        [92, 5040.0],
+        [75, 7200]
+      ]
+    },
+    "research-lab-claude-seat-6": {
+      "provider": "claude",
+      "windows": [
+        [30, 180],
+        [100, 120]
+      ]
+    }
+  },
+  "T": {
+    "t01": {
+      "provider": "codex",
+      "email": "t01@example.com",
+      "windows": [
+        [7, 37],
+        [13, 697]
+      ]
+    },
+    "t02": {
+      "provider": "codex",
+      "email": "t02@example.com",
+      "windows": [
+        [14, 44],
+        [26, 794]
+      ]
+    },
+    "t03": {
+      "provider": "codex",
+      "email": "t03@example.com",
+      "windows": [
+        [21, 51],
+        [39, 891]
+      ]
+    },
+    "t04": {
+      "provider": "codex",
+      "email": "t04@example.com",
+      "windows": [
+        [28, 58],
+        [52, 988]
+      ]
+    },
+    "t05": {
+      "provider": "codex",
+      "email": "t05@example.com",
+      "windows": [
+        [35, 65],
+        [65, 1085]
+      ]
+    },
+    "t06": {
+      "provider": "codex",
+      "email": "t06@example.com",
+      "windows": [
+        [42, 72],
+        [78, 1182]
+      ]
+    },
+    "t07": {
+      "provider": "codex",
+      "email": "t07@example.com",
+      "windows": [
+        [49, 79],
+        [91, 1279]
+      ]
+    },
+    "t08": {
+      "provider": "codex",
+      "email": "t08@example.com",
+      "windows": [
+        [56, 86],
+        [4, 1376]
+      ]
+    },
+    "t09": {
+      "provider": "codex",
+      "email": "t09@example.com",
+      "windows": [
+        [63, 93],
+        [17, 1473]
+      ]
+    },
+    "t10": {
+      "provider": "codex",
+      "email": "t10@example.com",
+      "windows": [
+        [70, 100],
+        [30, 1570]
+      ]
+    },
+    "t11": {
+      "provider": "codex",
+      "email": "t11@example.com",
+      "windows": [
+        [77, 107],
+        [43, 1667]
+      ]
+    },
+    "t12": {
+      "provider": "codex",
+      "email": "t12@example.com",
+      "windows": [
+        [84, 114],
+        [56, 1764]
+      ]
+    },
+    "t13": {
+      "provider": "codex",
+      "email": "t13@example.com",
+      "windows": [
+        [91, 121],
+        [69, 1861]
+      ]
+    },
+    "t14": {
+      "provider": "codex",
+      "email": "t14@example.com",
+      "windows": [
+        [98, 128],
+        [82, 1958]
+      ]
+    },
+    "t15": {
+      "provider": "codex",
+      "email": "t15@example.com",
+      "windows": [
+        [5, 135],
+        [95, 2055]
+      ]
+    },
+    "t16": {
+      "provider": "codex",
+      "email": "t16@example.com",
+      "windows": [
+        [12, 142],
+        [8, 2152]
+      ]
+    },
+    "t17": {
+      "provider": "codex",
+      "email": "t17@example.com",
+      "windows": [
+        [19, 149],
+        [21, 2249]
+      ]
+    },
+    "t18": {
+      "provider": "codex",
+      "email": "t18@example.com",
+      "windows": [
+        [26, 156],
+        [34, 2346]
+      ]
+    },
+    "t19": {
+      "provider": "codex",
+      "email": "t19@example.com",
+      "windows": [
+        [33, 163],
+        [47, 2443]
+      ]
+    },
+    "t20": {
+      "provider": "codex",
+      "email": "t20@example.com",
+      "windows": [
+        [40, 170],
+        [60, 2540]
+      ]
+    },
+    "t21": {
+      "provider": "codex",
+      "email": "t21@example.com",
+      "windows": [
+        [47, 177],
+        [73, 2637]
+      ]
+    },
+    "t22": {
+      "provider": "codex",
+      "email": "t22@example.com",
+      "windows": [
+        [54, 184],
+        [86, 2734]
+      ]
+    },
+    "t23": {
+      "provider": "codex",
+      "email": "t23@example.com",
+      "windows": [
+        [61, 191],
+        [99, 2831]
+      ]
+    },
+    "t24": {
+      "provider": "codex",
+      "email": "t24@example.com",
+      "windows": [
+        [68, 198],
+        [12, 2928]
+      ]
+    },
+    "t25": {
+      "provider": "codex",
+      "email": "t25@example.com",
+      "windows": [
+        [75, 205],
+        [25, 3025]
+      ]
+    },
+    "t26": {
+      "provider": "codex",
+      "email": "t26@example.com",
+      "windows": [
+        [82, 212],
+        [38, 3122]
+      ]
+    },
+    "t27": {
+      "provider": "codex",
+      "email": "t27@example.com",
+      "windows": [
+        [89, 219],
+        [51, 3219]
+      ]
+    },
+    "t28": {
+      "provider": "codex",
+      "email": "t28@example.com",
+      "windows": [
+        [96, 226],
+        [64, 3316]
+      ]
+    },
+    "t29": {
+      "provider": "codex",
+      "email": "t29@example.com",
+      "windows": [
+        [3, 233],
+        [77, 3413]
+      ]
+    },
+    "t30": {
+      "provider": "codex",
+      "email": "t30@example.com",
+      "windows": [
+        [10, 240],
+        [90, 3510]
+      ]
+    },
+    "t31": {
+      "provider": "codex",
+      "email": "t31@example.com",
+      "windows": [
+        [17, 247],
+        [3, 3607]
+      ]
+    },
+    "t32": {
+      "provider": "codex",
+      "email": "t32@example.com",
+      "windows": [
+        [24, 254],
+        [16, 3704]
+      ]
+    },
+    "t33": {
+      "provider": "codex",
+      "email": "t33@example.com",
+      "windows": [
+        [31, 261],
+        [29, 3801]
+      ]
+    },
+    "t34": {
+      "provider": "codex",
+      "email": "t34@example.com",
+      "windows": [
+        [38, 268],
+        [42, 3898]
+      ]
+    },
+    "t35": {
+      "provider": "codex",
+      "email": "t35@example.com",
+      "windows": [
+        [45, 275],
+        [55, 3995]
+      ]
+    },
+    "t36": {
+      "provider": "codex",
+      "email": "t36@example.com",
+      "windows": [
+        [52, 282],
+        [68, 4092]
+      ]
+    },
+    "t37": {
+      "provider": "codex",
+      "email": "t37@example.com",
+      "windows": [
+        [59, 289],
+        [81, 4189]
+      ]
+    },
+    "t38": {
+      "provider": "codex",
+      "email": "t38@example.com",
+      "windows": [
+        [66, 296],
+        [94, 4286]
+      ]
+    },
+    "t39": {
+      "provider": "codex",
+      "email": "t39@example.com",
+      "windows": [
+        [73, 33],
+        [7, 4383]
+      ]
+    },
+    "t40": {
+      "provider": "codex",
+      "email": "t40@example.com",
+      "windows": [
+        [80, 40],
+        [20, 4480]
+      ]
+    }
+  }
+}
diff --git a/apps/web/test/render.tsx b/apps/web/test/render.tsx
index 0ad52c0ec228..05ce93e024b3 100644
--- a/apps/web/test/render.tsx
+++ b/apps/web/test/render.tsx
@@ -8,12 +8,19 @@ import {
 import { act as reactAct, createContext, use, type ReactNode } from "react";
 import { createRoot } from "react-dom/client";
 import { vi } from "vite-plus/test";
-import { page, utils, type Locator, type LocatorSelectors } from "vite-plus/test/browser";
+import { commands, page, utils, type Locator, type LocatorSelectors } from "vite-plus/test/browser";
 
 declare global {
   var IS_REACT_ACT_ENVIRONMENT: boolean | undefined;
 }
 
+declare module "vite-plus/test/browser" {
+  interface BrowserCommands {
+    /** Defined in vite.config.ts. Moves Playwright's mouse off the page. */
+    resetPointer: () => Promise<void>;
+  }
+}
+
 // React warns about every update outside act() while this flag is on, and a real
 // browser drives updates from userEvent, timers and network that act() cannot wrap.
 // So it is on only while act() runs, and nested calls restore the outer value.
@@ -97,6 +104,10 @@ export async function render(
         await unmount();
       } finally {
         container.remove();
+        // The real mouse outlives the test, and whatever the next test mounts under it
+        // starts hovered. Parking it here keeps render() itself free of awaits before
+        // the first mount, which tests rely on.
+        await commands.resetPointer();
       }
     },
   };
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 6e550f681467..e58708100d6b 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -108,6 +108,13 @@ const browserTestProject = {
       provider: playwright(),
       instances: [{ browser: "chromium" }],
       screenshotFailures: false,
+      commands: {
+        // Playwright's mouse outlives each test, so whatever mounts under its last
+        // position starts hovered. test/render.tsx parks it off the page after each test.
+        resetPointer: async ({ page }) => {
+          await page.mouse.move(-1, -1);
+        },
+      },
     },
   },
 } satisfies TestProjectInlineConfiguration;
diff --git a/docs/operations/mobile-screens-fork.md b/docs/operations/mobile-screens-fork.md
index db92950963c6..cd21aa551370 100644
--- a/docs/operations/mobile-screens-fork.md
+++ b/docs/operations/mobile-screens-fork.md
@@ -1,7 +1,7 @@
 # Building the mobile Screens dependency
 
 The mobile v5 stack uses a committed tarball from the
-[T3 Screens fork](https://github.com/pingdotgg/react-native-screens/tree/t3-v5.0.0-t3.29).
+[T3 Screens fork](https://github.com/pingdotgg/react-native-screens/tree/t3-v5.0.0-t3.30).
 The fork owns the integration changes; the app does not patch this package.
 Each archive includes compiled JavaScript, declarations, native source and
 `t3-fork.json` recording its version, source commit and upstream base.
diff --git a/docs/operations/release.md b/docs/operations/release.md
index c96551bc00c0..c6e151434ca3 100644
--- a/docs/operations/release.md
+++ b/docs/operations/release.md
@@ -31,7 +31,7 @@ the version.
 - Runs lint, typecheck, and tests alongside artifact builds. Publishing waits for every check.
 - Reads the shared production T3 Connect relay URL and Clerk client configuration before packaging clients.
 - Builds the platform-independent JS (server bundle, web client, Electron main) once in the `build_bundle` job and hands it to every platform job as the `js-bundle` artifact; the platform jobs only package it, so no runner rebuilds it.
-- Builds six desktop artifacts in parallel for both channels, each as its own job (`desktop_<platform>_<arch>`, one call of `release-desktop.yml`) on hardware of its own architecture, gated only on the bundle. The Windows jobs embed the same-arch Linux CLI archive as the WSL runtime and wait for that artifact partway through, not for the whole Linux job:
+- Builds six desktop artifacts in parallel for both channels, each as its own job (`desktop_<platform>_<arch>`, one call of `release-desktop.yml`), gated only on the bundle. Every target builds on hardware of its own architecture except Windows arm64: its runners have 4 vCPUs, so it builds and signs (with jsign) on a Linux runner, and a `windows-11-arm` job runs the packaged natives and the CLI archive (`verify_runner`). The Windows jobs embed the same-arch Linux CLI archive as the WSL runtime and wait for that artifact partway through, not for the whole Linux job:
   - macOS `arm64` DMG
   - macOS `x64` DMG
   - Linux `x64` and `arm64` AppImage and `.deb`, from one electron-builder run. The `.deb` updates in the app through electron-updater, which installs it with `dpkg`.
@@ -42,11 +42,11 @@ the version.
   - Nightly runs are always GitHub prereleases and never marked latest.
   - Automatically generated release notes are pinned to the previous tag in the same channel, so stable compares to the previous stable tag and nightly compares to the previous nightly tag.
 - Includes Electron auto-update metadata (for example `latest*.yml`, `nightly*.yml`, and `*.blockmap`) in release assets.
-- Builds a self-contained CLI archive per platform (`t3-<version>-<platform>-<arch>.tar.gz`, `.zip` on Windows) in the same job as that target's desktop artifact and attaches them to the GitHub Release with a `SHA256SUMS` file, on every channel, for five targets: macOS arm64, Linux x64 and arm64, Windows x64 and arm64. Every archive is built, signed, and smoke-tested on hardware of its own architecture. There is no macOS x64 archive: Node single-executables are unsupported on x64 macOS (the SEA docs list macOS as arm64 only) and the binary segfaults on start; the x64 desktop app is Electron and unaffected.
+- Builds a self-contained CLI archive per platform (`t3-<version>-<platform>-<arch>.tar.gz`, `.zip` on Windows) in the same job as that target's desktop artifact and attaches them to the GitHub Release with a `SHA256SUMS` file, on every channel, for five targets: macOS arm64, Linux x64 and arm64, Windows x64 and arm64. Every archive is smoke-tested on hardware of its own architecture, and every one but Windows arm64 is also built and signed there. There is no macOS x64 archive: Node single-executables are unsupported on x64 macOS (the SEA docs list macOS as arm64 only) and the binary segfaults on start; the x64 desktop app is Electron and unaffected.
   - The archive holds the server as a Node single-executable (`scripts/build-cli-archive.ts`), so unpacking it needs neither Node, npm, nor a compiler. It is the only form in which T3 Code manages a runtime: the desktop's SSH environments, the boot service, `t3 update`, and the install scripts all download and verify this archive against `SHA256SUMS`. The `t3` npm package exists for people who run `npx t3` or `npm install -g t3` themselves, and it downloads this same archive too; nothing in the product installs from npm. The `curl | sh` installers are `scripts/install.sh` and `scripts/install.ps1`; the marketing site copies them into its `public/` at build time (`apps/marketing/scripts/stage-install-scripts.mjs`) and serves them at `t3.codes/install.sh` and `/install.ps1`.
   - The executable is built with a Node that supports `--build-sea` (`VP_NODE_VERSION=26.8.2`, kept in step with `SEA_NODE_VERSION` in `apps/server/vite.config.ts`), while the repo stays on `engines.node`.
   - macOS archives are signed with the Developer ID certificate and notarized when the Apple secrets are present (ad hoc otherwise, which still runs from `curl`/`tar` installs). Windows executables use the same Azure Trusted Signing setup as the installer. Every native addon in the macOS archive is signed too, since the hardened runtime refuses unsigned libraries.
-  - Each archive is extracted and executed on its build runner (`scripts/smoke-cli-archive.ts`) before it is uploaded.
+  - Each archive is extracted and executed (`scripts/smoke-cli-archive.ts`) on its build runner, or on the `verify_runner` for Windows arm64.
 - After the GitHub Release is published, publishes the `t3` npm package with OIDC trusted publishing from the same workflow file. It is only a launcher (`scripts/npm-launcher/t3.mjs`): on first run it downloads its exact version's CLI archive from the GitHub Release, verifies it against `SHA256SUMS`, and unpacks it into `<T3 home>/runtime/versions/<version>`, the layout the install scripts and `t3 update` share. The executables are not on npm. They used to be, as `@t3code/t3-<platform>-<arch>` optional dependencies, but npm's publish-time scanning held those 80-250 MB packages back for up to an hour after the launcher was live, and every install in that window got a launcher with no executable. Those packages stay on npm at their old versions and get no new ones. Because the launcher reads from the release, `publish_cli` runs after `release`, never before.
   - stable releases publish npm dist-tag `latest`
   - nightly releases publish npm dist-tag `nightly`
diff --git a/docs/user/project-settings.md b/docs/user/project-settings.md
index bb89de6717e8..db994a7fe8de 100644
--- a/docs/user/project-settings.md
+++ b/docs/user/project-settings.md
@@ -109,6 +109,29 @@ same secret in the repository's webhook settings with content type
 up on desktop or web; mobile keeps an existing signature check but can't turn
 one on.
 
+To run only for some requests, add **Filters**. Each one tests a value named
+like a placeholder, without the braces, such as `headers.x-github-event` equals
+`pull_request` or `body.action` is one of `opened, reopened`. A task runs only
+when every filter matches; other requests are answered normally, logged as
+**Filtered** with the first filter that failed, and start nothing. Values
+compare as text, and a value that is an object or a list only passes
+**exists**. Separate **is one of** values with commas; a value can't contain
+a comma or start or end with a space.
+
+To suppress repeated deliveries, set a **Replay key** template, such as
+`{{headers.delivery-id}}`. The same key is ignored for seven days per task.
+To combine a burst, set a **Coalesce key**, such as `{{body.id}}`, and a window
+of 10–3600 seconds (120 by default). One run uses the latest body, headers,
+and query when the window from the first delivery closes; later requests
+do not extend it. Pending windows survive a server restart. Keys must contain
+request placeholders; if any placeholder is missing, or the render is empty,
+that key's rule is skipped. Clear the templates to turn dedupe off.
+
+Duplicate and coalesced log entries share a limit of 10 per task per minute.
+Additional deliveries are accepted without a log entry, and coalesced deliveries
+always replace the persisted payload. Coalesced updates count toward a separate
+60-per-minute validation limit; exceeding it receives HTTP 429.
+
 On desktop and web, pick **Deliveries** from a task's menu to see recent
 requests and the prompt each one produced.
 
diff --git a/knip.jsonc b/knip.jsonc
index aaf5f6e7ffea..0815e45e4626 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -18,8 +18,15 @@
     },
     "scripts": {
       // Knip loads its preprocessor through a CLI option; native verification and
-      // worktree setup (from t3.json) run directly.
-      "entry": ["knip-schemas.ts", "mobile-native-client.ts", "setup-worktree.ts"],
+      // worktree setup (from t3.json) run directly. release-desktop.yml bundles the
+      // Windows verify script with esbuild through a path knip does not trace.
+      "entry": [
+        "knip-schemas.ts",
+        "mobile-native-client.ts",
+        "setup-worktree.ts",
+        "verify-windows-desktop-artifact.ts",
+      ],
+      "ignoreDependencies": ["esbuild"],
       // The `t3` npm package's files: copied into the package, never imported.
       "ignore": ["npm-launcher/**"],
     },
@@ -69,8 +76,9 @@
       "ignoreDependencies": ["playwright-core", "electron-builder"],
     },
     "apps/web": {
-      // Worktree setup (scripts/setup-worktree.ts) runs this directly.
-      "entry": ["scripts/warm-dep-cache.ts"],
+      // Worktree setup (scripts/setup-worktree.ts) runs this directly, and evidence
+      // fixtures run under node.
+      "entry": ["scripts/warm-dep-cache.ts", "test/fixtures/**/*.mjs"],
       // UI component modules are copied and adapted as cohesive sets. Keep their
       // named subcomponents even before they have callers; the file audit still
       // reports an entire component module when nothing imports it.
diff --git a/oxlint-plugin-t3code/rules/require-disposable-render.test.ts b/oxlint-plugin-t3code/rules/require-disposable-render.test.ts
index 866c83bbc5fa..92dbb5c21bf9 100644
--- a/oxlint-plugin-t3code/rules/require-disposable-render.test.ts
+++ b/oxlint-plugin-t3code/rules/require-disposable-render.test.ts
@@ -1,4 +1,4 @@
-import { describe } from "@effect/vitest";
+import { assert, describe } from "@effect/vitest";
 
 import { createOxlintRuleHarness } from "../test/utils.ts";
 
@@ -9,6 +9,9 @@ const unitTest = createOxlintRuleHarness("t3code/require-disposable-render", {
   filename: "widget.test.tsx",
 });
 
+const reportsInputInAct = (output: string) =>
+  assert.match(output, /Do not wrap real input \(userEvent or a locator's click\/fill\) in act/);
+
 describe("t3code/require-disposable-render", () => {
   browserTest.valid(
     "allows the disposable helper",
@@ -18,6 +21,8 @@ describe("t3code/require-disposable-render", () => {
       'it("renders", async () => {',
       "  await using screen = await render(null);",
       "  await act(() => screen.rerender(null));",
+      '  await userEvent.click(screen.getByRole("button"));',
+      "  await act(() => store.setState({ open: true }));",
       "});",
     ].join("\n"),
   );
@@ -39,8 +44,114 @@ describe("t3code/require-disposable-render", () => {
     "rejects stubbing the act environment",
     'vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);',
   );
+  browserTest.invalid(
+    "rejects userEvent wrapped in act from react",
+    [
+      'import { act } from "react";',
+      'import { userEvent } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      "  await act(async () => {",
+      "    await userEvent.click(document.body);",
+      "  });",
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.invalid(
+    "rejects userEvent wrapped in the render helper's act",
+    [
+      'import { act } from "../../test/render";',
+      'import { userEvent } from "vite-plus/test/browser";',
+      'it("types", async () => {',
+      '  await act(() => userEvent.type(document.body, "a"));',
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.invalid(
+    "rejects userEvent wrapped in a renamed render helper act",
+    [
+      'import { act as flush } from "../test/render.tsx";',
+      'import { userEvent } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      "  await flush(async () => {",
+      "    await userEvent.click(document.body);",
+      "  });",
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.invalid(
+    "rejects a renamed userEvent wrapped in act",
+    [
+      'import { act } from "../test/render";',
+      'import { userEvent as ue } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      "  await act(() => ue.click(document.body));",
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.invalid(
+    "rejects a locator click wrapped in act",
+    [
+      'import { act } from "../test/render";',
+      'import { page } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      '  await act(async () => page.getByRole("button", { name: "Save" }).nth(0).click());',
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.invalid(
+    "rejects React.act from a namespace import",
+    [
+      'import * as React from "react";',
+      'it("renders", async () => {',
+      "  await React.act(async () => {});",
+      "});",
+    ].join("\n"),
+    (output) => assert.match(output, /import `act` from there/),
+  );
+  browserTest.invalid(
+    "rejects userEvent wrapped in React.act",
+    [
+      'import * as React from "react";',
+      'import { userEvent } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      "  await React.act(() => userEvent.click(document.body));",
+      "});",
+    ].join("\n"),
+    reportsInputInAct,
+  );
+  browserTest.valid(
+    "allows act around a DOM click and userEvent in a function act only defines",
+    [
+      'import { act } from "../test/render";',
+      'import { page, userEvent } from "vite-plus/test/browser";',
+      'it("clicks", async () => {',
+      '  await act(async () => page.getByRole("button").element().click());',
+      "  await act(async () => {",
+      "    const later = () => userEvent.click(document.body);",
+      "    store.setState({ later });",
+      "  });",
+      "});",
+    ].join("\n"),
+  );
+  browserTest.invalid(
+    "rejects lifecycle hooks through a test runner namespace",
+    ['import * as vt from "vitest";', "vt.beforeEach(() => {});"].join("\n"),
+  );
+  browserTest.invalid(
+    "rejects importing lifecycle hooks from the test runner",
+    'import { beforeEach, it } from "vite-plus/test";',
+  );
   browserTest.invalid("rejects afterEach", "afterEach(async () => {});");
   browserTest.invalid("rejects beforeAll", "beforeAll(() => {});");
   unitTest.valid("allows lifecycle hooks outside browser tests", "beforeEach(() => {});");
+  unitTest.valid(
+    "allows importing lifecycle hooks outside browser tests",
+    'import { afterEach } from "vite-plus/test";',
+  );
   unitTest.invalid("still rejects react-dom/client in unit tests", 'import "react-dom/client";');
 });
diff --git a/oxlint-plugin-t3code/rules/require-disposable-render.ts b/oxlint-plugin-t3code/rules/require-disposable-render.ts
index da13e0e89246..f27420276f8a 100644
--- a/oxlint-plugin-t3code/rules/require-disposable-render.ts
+++ b/oxlint-plugin-t3code/rules/require-disposable-render.ts
@@ -5,14 +5,34 @@ import { getPropertyName, unwrapExpression } from "../utils.ts";
 
 const BROWSER_TEST_FILE = /\.browser\.test\.[cm]?[jt]sx?$/u;
 const LIFECYCLE_HOOKS = new Set(["afterAll", "afterEach", "beforeAll", "beforeEach"]);
+const TEST_RUNNERS = new Set(["@effect/vitest", "vite-plus/test", "vitest"]);
 const REACT_ACT_EXPORTS = new Set(["act", "unstable_act"]);
 const ACT_ENVIRONMENT = "IS_REACT_ACT_ENVIRONMENT";
+const RENDER_HELPER = /(?:^|\/)test\/render(?:\.tsx)?$/u;
+const LOCATOR_QUERY = /^getBy/u;
+// Locator methods that dispatch real input through the browser provider.
+const LOCATOR_INPUT = new Set([
+  "clear",
+  "click",
+  "dblClick",
+  "dropTo",
+  "fill",
+  "hover",
+  "selectOptions",
+  "tripleClick",
+  "unhover",
+  "upload",
+]);
+// These leave the locator for a DOM element, whose click() is synthetic and fine inside act.
+const LOCATOR_EXITS = new Set(["element", "elements", "query"]);
 const HELPER = "Render with `await using screen = await render(...)` from apps/web/test/render.tsx";
 
 const MESSAGES = {
   reactDomClient: `${HELPER}; it owns the React root and unmounts it on dispose.`,
   reactAct: `${HELPER} and import \`act\` from there; it enables React's act environment only while act runs.`,
   actEnvironment: `${HELPER}; its act() sets ${ACT_ENVIRONMENT} for exactly as long as it runs.`,
+  actAroundInput:
+    "Do not wrap real input (userEvent or a locator's click/fill) in act; the browser runner flushes React updates after real input. Await the input directly.",
   lifecycleHook:
     "Browser tests acquire what they need with `using`/`await using` instead of lifecycle hooks, so nothing outlives the test that created it.",
 };
@@ -20,6 +40,32 @@ const MESSAGES = {
 const stringValue = (node: ESTree.Node | null | undefined) =>
   node?.type === "Literal" && typeof node.value === "string" ? node.value : undefined;
 
+const importedName = (specifier: ESTree.ImportSpecifier) =>
+  specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+
+const isFunction = (node: ESTree.Node) =>
+  node.type === "ArrowFunctionExpression" ||
+  node.type === "FunctionExpression" ||
+  node.type === "FunctionDeclaration";
+
+// Walks a.b().c().d back to its root, reporting whether a getBy* query built a locator on the way
+// without leaving it through element()/query().
+const isLocatorChain = (node: ESTree.Node): boolean => {
+  let sawQuery = false;
+  for (let current: ESTree.Node | undefined = node; current;) {
+    if (current.type === "CallExpression") {
+      current = current.callee;
+      continue;
+    }
+    if (current.type !== "MemberExpression") break;
+    const name = Option.getOrUndefined(getPropertyName(current.property));
+    if (name !== undefined && LOCATOR_EXITS.has(name)) return false;
+    if (name !== undefined && LOCATOR_QUERY.test(name)) sawQuery = true;
+    current = current.object;
+  }
+  return sawQuery;
+};
+
 const namesActEnvironment = (node: unknown) => {
   const target = unwrapExpression(node);
   if (Option.isNone(target)) return false;
@@ -41,21 +87,94 @@ export default defineRule({
   },
   create(context) {
     const isBrowserTest = BROWSER_TEST_FILE.test(context.filename);
+    // Local names bound to React's act or the render helper's act.
+    const actNames = new Set<string>();
+    const reactNamespaces = new Set<string>();
+    const runnerNamespaces = new Set<string>();
+    const userEventNames = new Set<string>();
+
+    const namespaceMember = (node: ESTree.Node, namespaces: ReadonlySet<string>) =>
+      node.type === "MemberExpression" &&
+      node.object.type === "Identifier" &&
+      namespaces.has(node.object.name)
+        ? Option.getOrUndefined(getPropertyName(node.property))
+        : undefined;
+
+    const isReactNamespaceAct = (callee: ESTree.Node) => {
+      const member = namespaceMember(callee, reactNamespaces);
+      return member !== undefined && REACT_ACT_EXPORTS.has(member);
+    };
+
+    const isActCall = (node: ESTree.Node) =>
+      node.type === "CallExpression" &&
+      ((node.callee.type === "Identifier" && actNames.has(node.callee.name)) ||
+        isReactNamespaceAct(node.callee));
+
+    // A function defined inside act but not passed straight to a call may run after act settles.
+    const isInsideAct = (node: ESTree.Node) => {
+      for (let current = node.parent; current; current = current.parent) {
+        if (isActCall(current)) return true;
+        if (
+          isFunction(current) &&
+          !(
+            current.parent?.type === "CallExpression" &&
+            (current.parent.arguments as ReadonlyArray<ESTree.Node>).includes(current)
+          )
+        ) {
+          return false;
+        }
+      }
+      return false;
+    };
+
+    const isRealInput = (callee: ESTree.MemberExpression) => {
+      if (callee.object.type === "Identifier" && userEventNames.has(callee.object.name)) {
+        return true;
+      }
+      const method = Option.getOrUndefined(getPropertyName(callee.property));
+      return method !== undefined && LOCATOR_INPUT.has(method) && isLocatorChain(callee.object);
+    };
 
     return {
       ImportDeclaration(node) {
+        for (const specifier of node.specifiers) {
+          if (specifier.type === "ImportSpecifier" && importedName(specifier) === "userEvent") {
+            userEventNames.add(specifier.local.name);
+          }
+        }
+        if (isBrowserTest && TEST_RUNNERS.has(node.source.value)) {
+          for (const specifier of node.specifiers) {
+            if (specifier.type === "ImportNamespaceSpecifier") {
+              runnerNamespaces.add(specifier.local.name);
+              continue;
+            }
+            if (specifier.type !== "ImportSpecifier") continue;
+            if (LIFECYCLE_HOOKS.has(importedName(specifier))) {
+              context.report({ node: specifier, message: MESSAGES.lifecycleHook });
+            }
+          }
+          return;
+        }
+        if (RENDER_HELPER.test(node.source.value)) {
+          for (const specifier of node.specifiers) {
+            if (specifier.type === "ImportSpecifier" && importedName(specifier) === "act") {
+              actNames.add(specifier.local.name);
+            }
+          }
+          return;
+        }
         if (node.source.value === "react-dom/client") {
           context.report({ node: node.source, message: MESSAGES.reactDomClient });
           return;
         }
         if (node.source.value !== "react") return;
         for (const specifier of node.specifiers) {
-          if (specifier.type !== "ImportSpecifier") continue;
-          const imported =
-            specifier.imported.type === "Identifier"
-              ? specifier.imported.name
-              : specifier.imported.value;
-          if (REACT_ACT_EXPORTS.has(imported)) {
+          if (specifier.type !== "ImportSpecifier") {
+            reactNamespaces.add(specifier.local.name);
+            continue;
+          }
+          if (REACT_ACT_EXPORTS.has(importedName(specifier))) {
+            actNames.add(specifier.local.name);
             context.report({ node: specifier, message: MESSAGES.reactAct });
           }
         }
@@ -71,6 +190,21 @@ export default defineRule({
         if (callee.value.type === "MemberExpression") {
           // vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true) leaves the flag on for the whole test.
           const method = getPropertyName(callee.value.property);
+          if (isReactNamespaceAct(callee.value)) {
+            context.report({ node: node.callee, message: MESSAGES.reactAct });
+            return;
+          }
+          if (isBrowserTest) {
+            const hook = namespaceMember(callee.value, runnerNamespaces);
+            if (hook !== undefined && LIFECYCLE_HOOKS.has(hook)) {
+              context.report({ node: node.callee, message: MESSAGES.lifecycleHook });
+              return;
+            }
+          }
+          if (isRealInput(callee.value) && isInsideAct(node)) {
+            context.report({ node, message: MESSAGES.actAroundInput });
+            return;
+          }
           if (
             Option.getOrUndefined(method) === "stubGlobal" &&
             stringValue(node.arguments[0] as ESTree.Node | undefined) === ACT_ENVIRONMENT
diff --git a/packages/client-runtime/src/scheduledTaskWebhook.test.ts b/packages/client-runtime/src/scheduledTaskWebhook.test.ts
index c2de7d240bc7..6e35d8446964 100644
--- a/packages/client-runtime/src/scheduledTaskWebhook.test.ts
+++ b/packages/client-runtime/src/scheduledTaskWebhook.test.ts
@@ -1,6 +1,13 @@
 import { describe, expect, it } from "vite-plus/test";
 
-import { parseMaxDeliveryAge } from "./scheduledTaskWebhook.ts";
+import {
+  parseMaxDeliveryAge,
+  emptyWebhookFilterDraft,
+  parseWebhookFilterDrafts,
+  removeWebhookFilterDraft,
+  webhookFilterDrafts,
+  webhookFilterDraftsChanged,
+} from "./scheduledTaskWebhook.ts";
 
 describe("parseMaxDeliveryAge", () => {
   it("treats blank as no limit and rejects values the server would not accept", () => {
@@ -11,3 +18,57 @@ describe("parseMaxDeliveryAge", () => {
     }
   });
 });
+
+describe("webhook filter drafts", () => {
+  it("round-trips saved filters through the form rows", () => {
+    const filters = [
+      { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+      { path: "body.action", op: "in", value: ["opened", "reopened"] },
+      { path: "body.label.name", op: "in", value: ["needs review", "a-b"] },
+      { path: "query.source", op: "exists" },
+    ] as const;
+    const drafts = webhookFilterDrafts(filters);
+    expect(drafts[1]).toMatchObject({ path: "body.action", op: "in", value: "opened, reopened" });
+    expect(parseWebhookFilterDrafts(drafts)).toEqual({ filters });
+  });
+
+  it("names the first row the server would refuse", () => {
+    expect(
+      parseWebhookFilterDrafts([
+        { id: "f1", path: "body.action", op: "equals", value: "opened" },
+        { id: "f2", path: "body.action", op: "in", value: " , " },
+        { id: "f3", path: "", op: "exists", value: "" },
+      ]),
+    ).toEqual({
+      error: "Filter 2 needs a path under body, headers or query, and at least one value.",
+    });
+    expect(parseWebhookFilterDrafts([{ id: "f1", path: " ", op: "exists", value: "" }])).toEqual({
+      error: "Filter 1 needs a path under body, headers or query.",
+    });
+    const seventeen = Array.from({ length: 17 }, (_, index) => ({
+      id: `f${index}`,
+      path: "body.action",
+      op: "exists" as const,
+      value: "",
+    }));
+    expect(parseWebhookFilterDrafts(seventeen)).toEqual({ error: "Use at most 16 filters." });
+  });
+
+  it("notices added, removed and edited rows but not an untouched list", () => {
+    const saved = webhookFilterDrafts([{ path: "body.action", op: "equals", value: "opened" }]);
+    expect(webhookFilterDraftsChanged(saved, [...saved])).toBe(false);
+    expect(webhookFilterDraftsChanged(saved, [])).toBe(true);
+    expect(webhookFilterDraftsChanged(saved, [{ ...saved[0]!, value: "closed" }])).toBe(true);
+    expect(webhookFilterDraftsChanged([], [])).toBe(false);
+  });
+
+  it("removing the first row keeps the second row's id", () => {
+    const drafts = [
+      ...webhookFilterDrafts([{ path: "body.action", op: "equals", value: "opened" }]),
+      emptyWebhookFilterDraft(),
+    ];
+    expect(new Set(drafts.map((draft) => draft.id)).size).toBe(2);
+    const remaining = removeWebhookFilterDraft(drafts, drafts[0]!.id);
+    expect(remaining.map((draft) => draft.id)).toEqual([drafts[1]!.id]);
+  });
+});
diff --git a/packages/client-runtime/src/scheduledTaskWebhook.ts b/packages/client-runtime/src/scheduledTaskWebhook.ts
index 028591709659..2b19d282dceb 100644
--- a/packages/client-runtime/src/scheduledTaskWebhook.ts
+++ b/packages/client-runtime/src/scheduledTaskWebhook.ts
@@ -1,4 +1,11 @@
-import { MAX_WEBHOOK_DELIVERY_AGE_MINUTES } from "@t3tools/contracts";
+import {
+  MAX_WEBHOOK_DELIVERY_AGE_MINUTES,
+  MAX_WEBHOOK_FILTERS,
+  ScheduledTaskWebhookFilter,
+  type ScheduledTaskWebhookFilterOp,
+} from "@t3tools/contracts";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
 
 export const DEFAULT_WEBHOOK_PROMPT = "Handle this webhook:\n{{body}}";
 
@@ -10,3 +17,118 @@ export function parseMaxDeliveryAge(value: string): number | null | undefined {
     ? minutes
     : undefined;
 }
+
+/**
+ * One editable filter row. `in` takes a comma-separated list, which is
+ * lossless because list values can't contain commas; `exists` ignores the value.
+ */
+export interface WebhookFilterDraft {
+  /** Stable row identity for the form; never sent to the server. */
+  readonly id: string;
+  readonly path: string;
+  readonly op: ScheduledTaskWebhookFilterOp;
+  readonly value: string;
+}
+
+export const WEBHOOK_FILTER_OPS: ReadonlyArray<{
+  readonly op: ScheduledTaskWebhookFilterOp;
+  readonly label: string;
+}> = [
+  { op: "equals", label: "equals" },
+  { op: "notEquals", label: "does not equal" },
+  { op: "in", label: "is one of" },
+  { op: "startsWith", label: "starts with" },
+  { op: "exists", label: "exists" },
+];
+
+let lastWebhookFilterDraftId = 0;
+const nextWebhookFilterDraftId = () => `filter-${++lastWebhookFilterDraftId}`;
+
+export function emptyWebhookFilterDraft(): WebhookFilterDraft {
+  return { id: nextWebhookFilterDraftId(), path: "", op: "equals", value: "" };
+}
+
+/** By id, so a removed row's identity never passes to the row after it. */
+export function removeWebhookFilterDraft(
+  drafts: ReadonlyArray<WebhookFilterDraft>,
+  id: string,
+): ReadonlyArray<WebhookFilterDraft> {
+  return drafts.filter((draft) => draft.id !== id);
+}
+
+export function webhookFilterDrafts(
+  filters: ReadonlyArray<ScheduledTaskWebhookFilter> | undefined,
+): ReadonlyArray<WebhookFilterDraft> {
+  return (filters ?? []).map((filter) => ({
+    id: nextWebhookFilterDraftId(),
+    path: filter.path,
+    op: filter.op,
+    value:
+      filter.op === "exists" ? "" : filter.op === "in" ? filter.value.join(", ") : filter.value,
+  }));
+}
+
+const decodeFilter = Schema.decodeUnknownOption(ScheduledTaskWebhookFilter);
+
+/**
+ * Checks each row with the server's own schema, so a draft that parses here
+ * also saves. The error names the first row that would not.
+ */
+export function parseWebhookFilterDrafts(
+  drafts: ReadonlyArray<WebhookFilterDraft>,
+): { readonly filters: ReadonlyArray<ScheduledTaskWebhookFilter> } | { readonly error: string } {
+  if (drafts.length > MAX_WEBHOOK_FILTERS) {
+    return { error: `Use at most ${MAX_WEBHOOK_FILTERS} filters.` };
+  }
+  const filters: ScheduledTaskWebhookFilter[] = [];
+  for (const [index, draft] of drafts.entries()) {
+    const path = draft.path.trim();
+    const filter = decodeFilter(
+      draft.op === "exists"
+        ? { path, op: draft.op }
+        : draft.op === "in"
+          ? {
+              path,
+              op: draft.op,
+              value: draft.value
+                .split(",")
+                .map((item) => item.trim())
+                .filter((item) => item !== ""),
+            }
+          : { path, op: draft.op, value: draft.value },
+    );
+    if (Option.isNone(filter)) {
+      return {
+        error: `Filter ${index + 1} needs a path under body, headers or query${
+          draft.op === "exists"
+            ? "."
+            : draft.op === "in"
+              ? ", and at least one value."
+              : ", and a value."
+        }`,
+      };
+    }
+    filters.push(filter.value);
+  }
+  return { filters };
+}
+
+/**
+ * Whether a form's filter rows differ from the ones it opened with. A save
+ * leaves `filters` out unless they did, so editing only the title can't
+ * overwrite filters another device changed in the meantime.
+ */
+export function webhookFilterDraftsChanged(
+  saved: ReadonlyArray<WebhookFilterDraft>,
+  current: ReadonlyArray<WebhookFilterDraft>,
+): boolean {
+  return (
+    saved.length !== current.length ||
+    saved.some(
+      (filter, index) =>
+        filter.path !== current[index]?.path ||
+        filter.op !== current[index]?.op ||
+        (filter.op !== "exists" && filter.value !== current[index]?.value),
+    )
+  );
+}
diff --git a/packages/contracts/src/scheduledTask.test.ts b/packages/contracts/src/scheduledTask.test.ts
index c3373d08abf4..4e781d3c6200 100644
--- a/packages/contracts/src/scheduledTask.test.ts
+++ b/packages/contracts/src/scheduledTask.test.ts
@@ -2,13 +2,49 @@ import { describe, expect, it } from "vite-plus/test";
 import * as Schema from "effect/Schema";
 
 import {
+  isWebhookDedupeTemplate,
   MIN_SCHEDULED_TASK_INTERVAL_MS,
+  ScheduledTaskListWebhookDeliveriesResult,
   ScheduledTaskSchedule,
   ScheduledTaskUpsertSchedule,
+  ScheduledTaskWebhookDeliverySummary,
 } from "./scheduledTask.ts";
 
 const decodeSchedule = Schema.decodeUnknownSync(ScheduledTaskSchedule);
 const decodeUpsertSchedule = Schema.decodeUnknownSync(ScheduledTaskUpsertSchedule);
+const decodeDeliverySummary = Schema.decodeSync(ScheduledTaskWebhookDeliverySummary);
+const decodeDeliveryList = Schema.decodeUnknownSync(ScheduledTaskListWebhookDeliveriesResult);
+
+it("rejects a long unterminated dotted dedupe key without excessive backtracking", () => {
+  const template = "{{body." + "a.".repeat(5000) + "x";
+  const startedAt = performance.now();
+  const valid = isWebhookDedupeTemplate(template);
+  const elapsedMs = performance.now() - startedAt;
+  expect(valid).toBe(false);
+  expect(elapsedMs).toBeLessThan(50);
+  for (const field of ["replayKey", "coalesceKey"]) {
+    expect(() =>
+      decodeUpsertSchedule({ type: "webhook", dedupe: { [field]: template } }),
+    ).toThrow();
+  }
+});
+
+it.each(["duplicate", "coalesced", "future_outcome"])("decodes delivery outcome %s", (outcome) => {
+  expect(
+    decodeDeliverySummary({
+      id: "delivery:test",
+      taskId: "scheduled-task:test",
+      receivedAt: "2026-10-20T00:00:00.000Z",
+      method: "POST",
+      contentType: null,
+      bodyBytes: 0,
+      outcome,
+      signatureVerified: false,
+      missingFields: [],
+      error: null,
+    }).outcome,
+  ).toBe(outcome);
+});
 
 describe("ScheduledTaskSchedule", () => {
   it("keeps legacy sub-minute persisted schedules readable", () => {
@@ -50,3 +86,80 @@ describe("ScheduledTaskUpsertSchedule", () => {
     ).toThrow();
   });
 });
+
+it.each(["literal", " ", "\t\n", "{{body.bad", "{{unknown.field}}"])(
+  "rejects invalid dedupe template %s",
+  (replayKey) => {
+    expect(() => decodeUpsertSchedule({ type: "webhook", dedupe: { replayKey } })).toThrow();
+    expect(() =>
+      decodeUpsertSchedule({ type: "webhook", dedupe: { coalesceKey: replayKey } }),
+    ).toThrow();
+  },
+);
+describe("webhook filters", () => {
+  const accepts = (filters: unknown) => {
+    try {
+      decodeUpsertSchedule({ type: "webhook", filters });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+
+  it("keeps valid filters", () => {
+    const filters = [
+      { path: "headers.x-github-event", op: "equals", value: "pull_request" },
+      { path: "body.action", op: "in", value: ["opened", "labeled"] },
+      { path: "body.label.name", op: "startsWith", value: "agent:" },
+      { path: "query.source", op: "exists" },
+    ];
+    expect(decodeUpsertSchedule({ type: "webhook", filters })).toEqual({
+      type: "webhook",
+      filters,
+    });
+    expect(decodeSchedule({ type: "webhook", signature: null, filters })).toMatchObject({
+      filters,
+    });
+  });
+
+  it("rejects empty or unknown paths, unknown ops, and values that do not fit the op", () => {
+    expect(accepts([{ path: "", op: "exists" }])).toBe(false);
+    expect(accepts([{ path: "  ", op: "exists" }])).toBe(false);
+    expect(accepts([{ path: "request", op: "exists" }])).toBe(false);
+    expect(accepts([{ path: "header.x-github-event", op: "exists" }])).toBe(false);
+    expect(accepts([{ path: "body.action", op: "in", value: "opened" }])).toBe(false);
+    expect(accepts([{ path: "body.action", op: "in", value: [] }])).toBe(false);
+    for (const value of ["", " opened", "opened ", "a,b"]) {
+      expect(accepts([{ path: "body.action", op: "in", value: [value] }])).toBe(false);
+    }
+    expect(accepts([{ path: "body.label.name", op: "in", value: ["needs review"] }])).toBe(true);
+    expect(accepts([{ path: "body.action", op: "equals" }])).toBe(false);
+    expect(accepts([{ path: "body.action", op: "matches", value: "^opened$" }])).toBe(false);
+  });
+
+  it("allows at most 16 filters", () => {
+    const sixteen = Array.from({ length: 16 }, () => ({ path: "body.action", op: "exists" }));
+    expect(accepts(sixteen)).toBe(true);
+    expect(accepts([...sixteen, { path: "body.action", op: "exists" }])).toBe(false);
+  });
+});
+
+describe("ScheduledTaskWebhookDeliverySummary", () => {
+  it("decodes an outcome this client does not know yet", () => {
+    const summary = {
+      id: "delivery:1",
+      taskId: "scheduled-task:1",
+      receivedAt: "2026-10-20T00:00:00.000Z",
+      method: "POST",
+      contentType: null,
+      bodyBytes: 0,
+      outcome: "some_future_outcome",
+      signatureVerified: false,
+      missingFields: [],
+      error: null,
+    };
+    expect(decodeDeliveryList({ deliveries: [summary] }).deliveries[0]?.outcome).toBe(
+      "some_future_outcome",
+    );
+  });
+});
diff --git a/packages/contracts/src/scheduledTask.ts b/packages/contracts/src/scheduledTask.ts
index 9a24e1b8abe3..67e2314a8b01 100644
--- a/packages/contracts/src/scheduledTask.ts
+++ b/packages/contracts/src/scheduledTask.ts
@@ -83,12 +83,77 @@ const WebhookMaxDeliveryAgeMinutes = Schema.Int.check(
     "Skip requests the relay held longer than this many minutes while the environment was offline. Null runs every request.",
 });
 
+export function isWebhookDedupeTemplate(template: string): boolean {
+  const placeholders = /\{\{\s*(?:(?:body|headers|query)(?:\.[^{}.\s]+)*|request)\s*\}\}/g;
+  const matches = [...template.matchAll(placeholders)];
+  const remainder = template.replace(placeholders, "");
+  return matches.length > 0 && !remainder.includes("{{") && !remainder.includes("}}");
+}
+
+const WebhookDedupeTemplate = Schema.String.check(Schema.makeFilter(isWebhookDedupeTemplate));
+
+const ScheduledTaskWebhookDedupe = Schema.Struct({
+  replayKey: Schema.optional(WebhookDedupeTemplate),
+  coalesceKey: Schema.optional(WebhookDedupeTemplate),
+  coalesceWindowSeconds: Schema.optional(
+    Schema.Int.check(Schema.isBetween({ minimum: 10, maximum: 3600 })),
+  ),
+}).annotate({
+  description:
+    "Replay key template (7 days), coalesce key template, and fixed window in seconds (default 120).",
+});
+
+export const MAX_WEBHOOK_FILTERS = 16;
+
+const WebhookFilterPath = TrimmedNonEmptyString.check(
+  Schema.isPattern(/^(body|headers|query)(\.|$)/),
+).annotate({
+  description:
+    "Request value to test, in placeholder syntax without braces: headers.x-github-event, body.action, query.source.",
+});
+
+/**
+ * Forms edit an `in` list as comma-separated text, so a value that has no
+ * comma and no surrounding whitespace survives that round trip unchanged.
+ */
+const WebhookFilterListValue = Schema.String.check(
+  Schema.isPattern(/^[^,\s](?:[^,]*[^,\s])?$/),
+).annotate({ description: "Non-empty, without commas or surrounding whitespace." });
+
+export const ScheduledTaskWebhookFilter = Schema.Union([
+  Schema.Struct({
+    path: WebhookFilterPath,
+    op: Schema.Literals(["equals", "notEquals", "startsWith"]),
+    value: Schema.String,
+  }),
+  Schema.Struct({
+    path: WebhookFilterPath,
+    op: Schema.Literal("in"),
+    value: Schema.Array(WebhookFilterListValue).check(Schema.isMinLength(1)),
+  }),
+  Schema.Struct({ path: WebhookFilterPath, op: Schema.Literal("exists") }),
+]).annotate({
+  description:
+    "Scalars compare as strings; objects and arrays only satisfy 'exists'. Every op but 'exists' fails when the path is missing.",
+});
+export type ScheduledTaskWebhookFilter = typeof ScheduledTaskWebhookFilter.Type;
+export type ScheduledTaskWebhookFilterOp = ScheduledTaskWebhookFilter["op"];
+
+const ScheduledTaskWebhookFilters = Schema.Array(ScheduledTaskWebhookFilter)
+  .check(Schema.isMaxLength(MAX_WEBHOOK_FILTERS))
+  .annotate({
+    description:
+      "Run only when every filter matches the request; other requests are logged as filtered. Up to 16. Omit to keep the stored filters; pass [] to clear them.",
+  });
+
 const ScheduledTaskWebhookSchedule = Schema.Struct({
   type: Schema.Literal("webhook").annotate({
     description: "Run when the task's webhook URL receives a request.",
   }),
   signature: Schema.NullOr(ScheduledTaskWebhookSignature),
   maxDeliveryAgeMinutes: Schema.optional(Schema.NullOr(WebhookMaxDeliveryAgeMinutes)),
+  dedupe: Schema.optional(ScheduledTaskWebhookDedupe),
+  filters: Schema.optional(ScheduledTaskWebhookFilters),
 }).annotate({
   description:
     "Run on each request to the task's webhook URL. The prompt may use {{body.path}}, {{headers.name}}, {{query.name}}, {{body}} and {{request}} placeholders.",
@@ -115,6 +180,8 @@ const ScheduledTaskUpsertWebhookSchedule = Schema.Struct({
     description: "Signature check; omit or null to accept requests by URL token only.",
   }),
   maxDeliveryAgeMinutes: Schema.optional(Schema.NullOr(WebhookMaxDeliveryAgeMinutes)),
+  dedupe: Schema.optional(ScheduledTaskWebhookDedupe),
+  filters: Schema.optional(ScheduledTaskWebhookFilters),
 }).annotate({
   description:
     "Run on each request to the task's webhook URL. The prompt may use {{body.path}}, {{headers.name}}, {{query.name}}, {{body}} and {{request}} placeholders.",
@@ -249,10 +316,13 @@ export type ScheduledTaskWebhookDeliveryId = typeof ScheduledTaskWebhookDelivery
 export const ScheduledTaskWebhookDeliveryOutcome = Schema.Literals([
   "accepted",
   "dispatch_failed",
+  "duplicate",
+  "coalesced",
   "rejected_signature",
   "disabled",
   "rate_limited",
   "expired",
+  "filtered",
 ]);
 export type ScheduledTaskWebhookDeliveryOutcome = typeof ScheduledTaskWebhookDeliveryOutcome.Type;
 
@@ -263,8 +333,10 @@ export const ScheduledTaskWebhookDeliverySummary = Schema.Struct({
   method: TrimmedNonEmptyString,
   contentType: Schema.NullOr(Schema.String),
   bodyBytes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
-  outcome: ScheduledTaskWebhookDeliveryOutcome,
+  // Any string, so an outcome added later doesn't break a client's whole list.
+  outcome: Schema.Union([ScheduledTaskWebhookDeliveryOutcome, Schema.String]),
   signatureVerified: Schema.Boolean,
+  pendingWindow: Schema.optional(Schema.Boolean),
   missingFields: Schema.Array(Schema.String),
   error: Schema.NullOr(Schema.String),
 });
@@ -282,6 +354,12 @@ export type ScheduledTaskWebhookDelivery = typeof ScheduledTaskWebhookDelivery.T
 
 export const ScheduledTaskListWebhookDeliveriesInput = Schema.Struct({
   id: ScheduledTaskId,
+  /**
+   * Sent by clients that decode any outcome. Shipped clients decode a closed
+   * list and fail on the whole response, so without it the server leaves out
+   * rows with outcomes they don't know.
+   */
+  acceptAnyOutcome: Schema.optional(Schema.Boolean),
 });
 export type ScheduledTaskListWebhookDeliveriesInput =
   typeof ScheduledTaskListWebhookDeliveriesInput.Type;
@@ -295,6 +373,7 @@ export type ScheduledTaskListWebhookDeliveriesResult =
 export const ScheduledTaskGetWebhookDeliveryInput = Schema.Struct({
   id: ScheduledTaskId,
   deliveryId: ScheduledTaskWebhookDeliveryId,
+  acceptAnyOutcome: Schema.optional(Schema.Boolean),
 });
 export type ScheduledTaskGetWebhookDeliveryInput = typeof ScheduledTaskGetWebhookDeliveryInput.Type;
 
diff --git a/packages/provider-opencode/src/server/OpenCodeServerLedger.test.ts b/packages/provider-opencode/src/server/OpenCodeServerLedger.test.ts
index 040e4ead2b59..90c72cf49130 100644
--- a/packages/provider-opencode/src/server/OpenCodeServerLedger.test.ts
+++ b/packages/provider-opencode/src/server/OpenCodeServerLedger.test.ts
@@ -28,9 +28,14 @@ const groupExists = (pgid: number) => {
   }
 };
 
+// A group of zombies can be reaped between a check and the kill, so ESRCH just means it is gone.
 const killGroup = (pgid: number) =>
   Effect.sync(() => {
-    if (groupExists(pgid)) process.kill(-pgid, "SIGKILL");
+    try {
+      process.kill(-pgid, "SIGKILL");
+    } catch (cause) {
+      if (!(cause instanceof Error && "code" in cause && cause.code === "ESRCH")) throw cause;
+    }
   });
 
 const spawnGroup = (args: ReadonlyArray<string>, script = "sleep 600 & wait") =>
@@ -38,13 +43,15 @@ const spawnGroup = (args: ReadonlyArray<string>, script = "sleep 600 & wait") =>
     Effect.gen(function* () {
       const child = NodeChildProcess.spawn("/bin/sh", ["-c", script, ...args], {
         detached: true,
-        stdio: "ignore",
+        stdio: ["ignore", "pipe", "ignore"],
       });
       const exited = yield* Deferred.make<NodeJS.Signals | null>();
+      const printed = yield* Deferred.make<void>();
       child.once("exit", (_code, signal) => Deferred.doneUnsafe(exited, Effect.succeed(signal)));
+      child.stdout.once("data", () => Deferred.doneUnsafe(printed, Effect.void));
       const pid = child.pid;
       if (pid === undefined) return yield* Effect.die("spawn failed");
-      return { pid, exited: Deferred.await(exited) };
+      return { pid, exited: Deferred.await(exited), printed: Deferred.await(printed) };
     }),
     ({ pid }) => killGroup(pid),
   );
@@ -96,11 +103,14 @@ describe.each(observedPlatforms)("OpenCodeServerLedger observing as %s", (platfo
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const stateDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-opencode-ledger-" });
+      // The inner shell prints once it has exec'd. Until then it still carries the wrapper's
+      // command line, and recording that would make the reaper skip the group as recycled.
       const wrapper = yield* spawnGroup(
         SERVE_ARGS,
-        '/bin/sh -c "sleep 600 & wait" "$0" "$@" & exit 0',
+        '/bin/sh -c "echo ready; sleep 600 & wait" "$0" "$@" & exit 0',
       );
       yield* wrapper.exited;
+      yield* wrapper.printed;
       expect(groupExists(wrapper.pid)).toBe(true);
 
       yield* recordFromDeadServer(stateDir, wrapper);
diff --git a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.test.ts b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.test.ts
index 20f8ab3941f9..266d63079e5f 100644
--- a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.test.ts
+++ b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.test.ts
@@ -2,6 +2,7 @@ import { SourceControlProviderKind } from "@t3tools/contracts";
 import { assert, describe, it } from "@effect/vitest";
 import { GitCommandError } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
@@ -18,6 +19,7 @@ import * as GitCafeCredentials from "./GitCafeCredentials.ts";
 import * as GitCafeSourceControlProvider from "./GitCafeSourceControlProvider.ts";
 
 const encodeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+const decodeJson = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
 
 const authAnswer = (input: { stdout?: unknown; stderr?: unknown; exitCode?: number }) => ({
   stdout: input.stdout === undefined ? "" : encodeJson(input.stdout),
@@ -29,6 +31,36 @@ const failure = (code: string, status: number | null) => ({
   error: { code, status, message: `Failure ${code}` },
 });
 
+/** Most calls touch no file; one that does fails the test. */
+const NoFiles = FileSystem.layerNoop({});
+
+/** A provider on git.cafe whose checkout has no remote and which may not run `cafe`. */
+const layerFor = (
+  client: HttpClient.HttpClient,
+  options: { readonly files?: Layer.Layer<FileSystem.FileSystem> } = {},
+) =>
+  Layer.merge(GitCafeApi.layer, options.files ?? NoFiles).pipe(
+    Layer.provideMerge(GitCafeCredentials.layer),
+    Layer.provideMerge(
+      TestSourceControlHost.layer({
+        git: {
+          resolvePrimaryRemoteName: () =>
+            Effect.fail(
+              new GitCommandError({
+                operation: "resolvePrimaryRemoteName",
+                command: "git remote",
+                cwd: "/repo",
+                detail: "No git remote is configured.",
+              }),
+            ),
+        },
+      }),
+    ),
+    Layer.provide(Layer.succeed(HostProcess.Environment, { CAFE_TOKEN: "env-token" })),
+    Layer.provide(Layer.succeed(HostProcess.WorkingDirectory, "/server")),
+    Layer.provide(Layer.succeed(HttpClient.HttpClient, client)),
+  );
+
 describe("GitCafeSourceControlProvider", () => {
   it("reads a signed-in account and keeps transient failures apart from sign-out", () => {
     const { parseAuth } = GitCafeSourceControlProvider;
@@ -94,7 +126,7 @@ describe("GitCafeSourceControlProvider", () => {
       ]);
     }).pipe(
       Effect.provide(
-        GitCafeApi.layer.pipe(
+        Layer.merge(GitCafeApi.layer, NoFiles).pipe(
           Layer.provideMerge(GitCafeCredentials.layer),
           Layer.provideMerge(TestSourceControlHost.layer()),
           Layer.provide(
@@ -140,7 +172,7 @@ describe("GitCafeSourceControlProvider", () => {
         assert.deepStrictEqual(urls, ["https://git.cafe/api/repos/team/project"]);
       }).pipe(
         Effect.provide(
-          GitCafeApi.layer.pipe(
+          Layer.merge(GitCafeApi.layer, NoFiles).pipe(
             Layer.provideMerge(GitCafeCredentials.layer),
             Layer.provideMerge(
               TestSourceControlHost.layer({
@@ -222,7 +254,7 @@ describe("GitCafeSourceControlProvider", () => {
       assert.deepStrictEqual(remotes, [expected]);
     }).pipe(
       Effect.provide(
-        GitCafeApi.layer.pipe(
+        Layer.merge(GitCafeApi.layer, NoFiles).pipe(
           Layer.provideMerge(GitCafeCredentials.layer),
           Layer.provideMerge(
             TestSourceControlHost.layer({
@@ -246,22 +278,19 @@ describe("GitCafeSourceControlProvider", () => {
     );
   });
 
-  it.effect("waits for a created repository's admission before handing out its URLs", () => {
-    const urls: Array<string> = [];
-    const states = ["running", "complete"];
+  it.effect("creates a repository over REST and waits for its admission", () => {
+    const sent: Array<{ method: string; url: string; body: unknown }> = [];
     const client = HttpClient.make((request) => {
-      urls.push(request.url);
+      const body =
+        request.body._tag === "Uint8Array"
+          ? decodeJson(new TextDecoder().decode(request.body.body))
+          : undefined;
+      sent.push({ method: request.method, url: request.url, body });
+      const state = request.method === "POST" ? "running" : "complete";
       return Effect.succeed(
         HttpClientResponse.fromWeb(
           request,
-          new Response(
-            encodeJson({
-              repoId: "repo_1",
-              state: states.shift(),
-              owner: "team",
-              name: "project",
-            }),
-          ),
+          new Response(encodeJson({ repoId: "repo_1", state, owner: "team", name: "project" })),
         ),
       );
     });
@@ -276,51 +305,76 @@ describe("GitCafeSourceControlProvider", () => {
         url: "https://git.cafe/team/project",
         sshUrl: "ssh@git.cafe:team/project.git",
       });
-      assert.deepStrictEqual(urls, [
-        "https://git.cafe/api/orgs/team/admissions/repo_1",
-        "https://git.cafe/api/orgs/team/admissions/repo_1",
-      ]);
-    }).pipe(
-      Effect.provide(
-        GitCafeApi.layer.pipe(
-          Layer.provideMerge(GitCafeCredentials.layer),
-          Layer.provideMerge(
-            TestSourceControlHost.layer({
-              process: {
-                run: () =>
-                  Effect.succeed(
-                    TestSourceControlHost.processOutput(
-                      encodeJson({
-                        schemaVersion: 1,
-                        data: {
-                          resource: {
-                            repoId: "repo_1",
-                            state: "running",
-                            owner: "team",
-                            name: "project",
-                          },
-                        },
-                      }),
-                    ),
-                  ),
-              },
-              git: {
-                resolvePrimaryRemoteName: () =>
-                  Effect.fail(
-                    new GitCommandError({
-                      operation: "resolvePrimaryRemoteName",
-                      command: "git remote",
-                      cwd: "/repo",
-                      detail: "No git remote is configured.",
-                    }),
-                  ),
-              },
-            }),
+      assert.deepStrictEqual(
+        sent.map((request) => `${request.method} ${request.url}`),
+        [
+          "POST https://git.cafe/api/orgs/team/repos",
+          "GET https://git.cafe/api/orgs/team/admissions/repo_1",
+        ],
+      );
+      const { requestKey, ...body } = sent[0]?.body as { requestKey: string };
+      assert.match(requestKey, /^[0-9a-f-]{36}$/u);
+      assert.deepStrictEqual(body, {
+        name: "project",
+        visibility: "private",
+        defaultBranch: "main",
+      });
+    }).pipe(Effect.provide(layerFor(client)));
+  });
+
+  it.effect("opens a pull request from a fork over REST with the body file's text", () => {
+    const sent: Array<{ method: string; url: string; body: unknown }> = [];
+    const client = HttpClient.make((request) => {
+      const body =
+        request.body._tag === "Uint8Array"
+          ? decodeJson(new TextDecoder().decode(request.body.body))
+          : undefined;
+      sent.push({ method: request.method, url: request.url, body });
+      return Effect.succeed(
+        HttpClientResponse.fromWeb(
+          request,
+          new Response(
+            encodeJson(
+              request.method === "POST"
+                ? { number: 3 }
+                : { id: "repo_fork", name: "project", defaultBranch: "main" },
+            ),
           ),
-          Layer.provide(Layer.succeed(HostProcess.Environment, { CAFE_TOKEN: "env-token" })),
-          Layer.provide(Layer.succeed(HostProcess.WorkingDirectory, "/server")),
-          Layer.provide(Layer.succeed(HttpClient.HttpClient, client)),
         ),
+      );
+    });
+    return Effect.gen(function* () {
+      const provider = yield* GitCafeSourceControlProvider.make;
+      yield* provider.createChangeRequest({
+        cwd: "/repo",
+        target: { repository: "team/project", refName: "main" },
+        baseRefName: "main",
+        headSelector: "fork:feature",
+        title: "Add a thing",
+        bodyFile: "/tmp/body.md",
+      });
+      assert.deepStrictEqual(
+        sent.map((request) => `${request.method} ${request.url}`),
+        [
+          "GET https://git.cafe/api/repos/fork/project",
+          "POST https://git.cafe/api/repos/team/project/pulls",
+        ],
+      );
+      assert.deepStrictEqual(sent[1]?.body, {
+        repo: "repo_fork",
+        source: "feature",
+        target: "main",
+        title: "Add a thing",
+        description: "Body",
+      });
+    }).pipe(
+      Effect.provide(
+        layerFor(client, {
+          files: FileSystem.layerNoop({
+            readFileString: (path) =>
+              path === "/tmp/body.md" ? Effect.succeed("Body") : Effect.die(path),
+          }),
+        }),
       ),
     );
   });
diff --git a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
index 57304f2d4ad8..fe624532f74b 100644
--- a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
+++ b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
@@ -1,5 +1,6 @@
 import { SourceControlProviderKind } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
@@ -16,6 +17,7 @@ import {
   type SourceControlCliDiscoverySpec,
   type SourceControlManagedCliDiscoverySpec,
 } from "@t3tools/source-control-core/server/discovery";
+import { randomUuidV4 } from "@t3tools/provider-core/server/randomUuid";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
 import * as SourceControlProvider from "@t3tools/source-control-core/server/SourceControlProvider";
 
@@ -146,10 +148,8 @@ const RepositoryAdmission = Schema.Struct({
   owner: TrimmedNonEmptyString,
   name: TrimmedNonEmptyString,
 });
-const CreatedRepository = Schema.Struct({
-  data: Schema.Struct({ resource: RepositoryAdmission }),
-});
-const decodeCreatedRepository = Schema.decodeEffect(Schema.fromJsonString(CreatedRepository));
+const RepositoryId = Schema.Struct({ id: TrimmedNonEmptyString });
+const CreatedPull = Schema.Struct({ number: PositiveInt });
 const encodeBranches = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
 
 interface Target {
@@ -171,7 +171,7 @@ const pullUrlPattern = /^https:\/\/([^/]+)\/([^/]+\/[^/]+)\/pulls\/(\d+)\/?(?:[?
 export const make = Effect.gen(function* () {
   const api = yield* GitCafeApi.GitCafeApi;
   const host = yield* SourceControlHost.SourceControlHost;
-  const credentials = yield* GitCafeCredentials.GitCafeCredentials;
+  const fileSystem = yield* FileSystem.FileSystem;
 
   const error = (operation: string, cwd: string, detail: string, cause?: unknown) =>
     new SourceControlProviderError({
@@ -197,33 +197,6 @@ export const make = Effect.gen(function* () {
         ),
       ),
     );
-  const cafe = (operation: string, cwd: string, target: Target, args: ReadonlyArray<string>) =>
-    credentials
-      .cliEnv(target.host)
-      .pipe(
-        Effect.flatMap((env) =>
-          host.process.run({
-            operation: `GitCafeSourceControlProvider.${operation}`,
-            command: "cafe",
-            cwd,
-            args: [...cliArgs(target.host), ...args],
-            env: { CAFE_OUTPUT: "json", ...env },
-            timeoutMs: 30_000,
-          }),
-        ),
-      )
-      .pipe(
-        Effect.mapError((cause) =>
-          error(
-            operation,
-            cwd,
-            (cause._tag === "VcsProcessExitError" && cliFailure(cause.detail)?.message) ||
-              "GitCafe CLI command failed.",
-            cause,
-          ),
-        ),
-      );
-
   const resolveTarget = Effect.fn("GitCafeSourceControlProvider.resolveTarget")(function* (
     operation: string,
     input: {
@@ -371,21 +344,42 @@ export const make = Effect.gen(function* () {
             ? `${source.owner}/${target.repository.split("/")[1]}`
             : target.repository);
         const branch = SourceControlProvider.sourceBranch(input);
-        yield* cafe("createChangeRequest", input.cwd, target, [
-          "pr",
-          "create",
-          "--json",
-          "--repo",
-          target.repository,
-          "--head",
-          sourceRepository === target.repository ? branch : `${sourceRepository}:${branch}`,
-          "--base",
-          input.target?.refName ?? input.baseRefName,
-          "--title",
-          input.title,
-          "--body-file",
-          input.bodyFile,
-        ]);
+        // GitCafe names the head by its repository's id, so the head repository is looked up first.
+        const head = yield* read(
+          "createChangeRequest",
+          input.cwd,
+          { host: target.host, path: `/repos/${sourceRepository}` },
+          RepositoryId,
+        );
+        const description = yield* fileSystem
+          .readFileString(input.bodyFile)
+          .pipe(
+            Effect.mapError((cause) =>
+              error(
+                "createChangeRequest",
+                input.cwd,
+                "Could not read the pull request description.",
+                cause,
+              ),
+            ),
+          );
+        yield* read(
+          "createChangeRequest",
+          input.cwd,
+          {
+            host: target.host,
+            method: "POST",
+            path: `/repos/${target.repository}/pulls`,
+            body: {
+              repo: head.id,
+              source: branch,
+              target: input.target?.refName ?? input.baseRefName,
+              title: input.title,
+              ...(description.trim().length === 0 ? {} : { description }),
+            },
+          },
+          CreatedPull,
+        );
       },
     ),
     getRepositoryCloneUrls: Effect.fn("GitCafeSourceControlProvider.getRepositoryCloneUrls")(
@@ -403,25 +397,25 @@ export const make = Effect.gen(function* () {
     createRepository: Effect.fn("GitCafeSourceControlProvider.createRepository")(function* (input) {
       const target = yield* resolveTarget("createRepository", input);
       const [owner = "", name = ""] = target.repository.split("/");
-      const output = yield* cafe("createRepository", input.cwd, target, [
-        "repo",
-        "create",
-        name,
-        "--org",
-        owner,
-        "--visibility",
-        input.visibility,
-        "--json",
-      ]);
-      const created = yield* decodeCreatedRepository(output.stdout).pipe(
-        Effect.mapError((cause) =>
-          error("createRepository", input.cwd, "GitCafe returned an unreadable response.", cause),
-        ),
+      const pending = yield* read(
+        "createRepository",
+        input.cwd,
+        {
+          host: target.host,
+          method: "POST",
+          path: `/orgs/${owner}/repos`,
+          body: {
+            name,
+            requestKey: yield* randomUuidV4,
+            visibility: input.visibility,
+            defaultBranch: "main",
+          },
+        },
+        RepositoryAdmission,
       );
-      // GitCafe admits a repository asynchronously: `cafe repo create` answers while admission is
-      // still running, so wait for it to settle the way `cafe repo create --clone` does.
+      // GitCafe admits a repository asynchronously and answers while admission is still running,
+      // so wait for it to settle the way `cafe repo create --clone` does.
       const settled = (state: string) => state === "complete" || state === "blocked";
-      const pending = created.data.resource;
       const resource = settled(pending.state)
         ? pending
         : yield* read(
diff --git a/patches/app-builder-lib@26.16.1.patch b/patches/app-builder-lib@26.16.1.patch
new file mode 100644
index 000000000000..72655d9f0a62
--- /dev/null
+++ b/patches/app-builder-lib@26.16.1.patch
@@ -0,0 +1,15 @@
+diff --git a/out/targets/nsis/NsisTarget.js b/out/targets/nsis/NsisTarget.js
+index 8a3462b185b078a260483635e6d774e2ece6e269..105778c145ab63a26444179215c643a7f22148a0 100644
+--- a/out/targets/nsis/NsisTarget.js
++++ b/out/targets/nsis/NsisTarget.js
+@@ -366,7 +366,9 @@ class NsisTarget extends core_1.Target {
+         await this.executeMakensis(defines, commands, sharedHeader + (await this.computeFinalScript(script, false, archs)));
+         // http://forums.winamp.com/showthread.php?p=3078545
+         // TODO: remove workaround when wine is fully upgraded to 11
+-        if ((0, macosVersion_1.isMacOsCatalina)()) {
++        // T3 Code builds Windows installers on Linux without wine; read the
++        // uninstaller out of the stub the way macOS hosts already do.
++        if ((0, macosVersion_1.isMacOsCatalina)() || process.platform === "linux") {
+             try {
+                 await nsisUtil_1.UninstallerReader.exec(installerPath, uninstallerPath);
+             }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 69d513886503..2f2c90202bc6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -179,6 +179,7 @@ patchedDependencies:
   '@react-native-menu/menu@2.0.0': a4866ecfcd44f318043de839d20110c17e14909004900f002ffe12050376f2ba
   '@react-navigation/native-stack@7.21.0': caae6552051bce91a85f567f3a08f9c8d25ce4c53f65a9391a67f016bb1d798e
   alchemy@2.0.0-beta.80: bea1b6c0c0b23157fd5f439a1d7feff430f28ac1621ba135d8a13eeec60ccacd
+  app-builder-lib@26.16.1: a28c2dfcfc2b90d6c6247e199e6537391db9ecd941854c650910d607442512d3
   dbus-next@0.10.2: cfff57561b0ee59b5addb3b2e6c6f20906e967507a530ab67e8db8108e520ba4
   expo-audio@58.0.9: 2c2f8c73a23d48804c8b537b8cd73c25eb331aa47d82eaa481c6766cb81e5add
   expo-modules-core@58.0.22: f0b0fd100550ed76e5c25b4d13eb7c9ff62825f8f197c53edf7bf447c50c9fb7
@@ -380,7 +381,7 @@ importers:
         version: 7.5.1(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
       '@react-navigation/native-stack':
         specifier: 7.21.0
-        version: 7.21.0(patch_hash=caae6552051bce91a85f567f3a08f9c8d25ce4c53f65a9391a67f016bb1d798e)(6f7595467acac269803072e24b2c2fee)
+        version: 7.21.0(patch_hash=caae6552051bce91a85f567f3a08f9c8d25ce4c53f65a9391a67f016bb1d798e)(16f893500fb9de13b2f16d636ddf6f9b)
       '@shikijs/core':
         specifier: 4.2.0
         version: 4.2.0
@@ -592,8 +593,8 @@ importers:
         specifier: ~5.10.1
         version: 5.10.1(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
       react-native-screens:
-        specifier: file:deps/react-native-screens-5.0.0-t3.29.tgz
-        version: file:apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
+        specifier: file:deps/react-native-screens-5.0.0-t3.30.tgz
+        version: file:apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
       react-native-shiki-engine:
         specifier: ^0.3.12
         version: 0.3.12(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
@@ -974,12 +975,12 @@ importers:
       lucide-react:
         specifier: ^0.564.0
         version: 0.564.0(react@19.3.0)
-      mermaid:
-        specifier: ^11.17.2
-        version: 11.17.2
       morphicons:
         specifier: ^1.7.1
         version: 1.7.1(react-native-svg@15.16.0(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0))(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
+      pele:
+        specifier: ^1.8.0
+        version: 1.8.0
       react:
         specifier: 'catalog:'
         version: 19.3.0
@@ -1962,6 +1963,9 @@ importers:
       '@types/pngjs':
         specifier: 6.0.5
         version: 6.0.5
+      esbuild:
+        specifier: 0.28.2
+        version: 0.28.2
       typescript:
         specifier: 'catalog:'
         version: 7.0.2
@@ -2036,9 +2040,6 @@ packages:
       react-devtools-core:
         optional: true
 
-  '@antfu/install-pkg@2.1.0':
-    resolution: {integrity: sha512-sdg9NxU3zR4Mnawfbc/x6GB5Wf17WYud5qOuEuxXjaKpYpMkISSJEjItGebXJ2bQ4DIcly4NYH23mtkGJjvKUw==}
-
   '@anthropic-ai/claude-agent-sdk@0.3.276':
     resolution: {integrity: sha512-Dic43v4uuGLhibPAArWy3RSfq3zHdn+4Oh2AI2/18a5tlbNKkvChEpazyp8c+grUJvzxkzt0jETCa1wrADbkyw==}
     engines: {node: '>=18.0.0'}
@@ -2681,9 +2682,6 @@ packages:
   '@blazediff/core@1.10.0':
     resolution: {integrity: sha512-AOQff0zgR7cGsZL+4E7hVkmujoPUpm0J9xzWGWZj5wCjd3gmxESXAPfKyuzs93VdpQNFhHlBhfOjrcZ+XTERtQ==}
 
-  '@braintree/sanitize-url@7.1.2':
-    resolution: {integrity: sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==}
-
   '@bramus/specificity@2.4.2':
     resolution: {integrity: sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==}
     hasBin: true
@@ -2744,9 +2742,6 @@ packages:
     resolution: {integrity: sha512-CuNiSqg7+e1cO/GjffyMOm5Tt2jUF9CWHHnvQ/UkqvtkGfHdgwEC0wpmq7fkN3gxwpRnrAN0WzO3vREKmNolMQ==}
     engines: {node: '>=18'}
 
-  '@chevrotain/types@11.1.2':
-    resolution: {integrity: sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==}
-
   '@clack/core@1.5.1':
     resolution: {integrity: sha512-iHTrHA8MtVuLl2TfZySmcKv1qO2PoyC9Z7pfSDozEuV5vtY3/wcOPKJXlqJ5Oq2Cx5DDGQGAMVx6HZfRRoVEbQ==}
     engines: {node: '>= 20.12.0'}
@@ -4027,12 +4022,6 @@ packages:
   '@iarna/toml@2.2.5':
     resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==}
 
-  '@iconify/types@2.0.0':
-    resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
-
-  '@iconify/utils@3.1.7':
-    resolution: {integrity: sha512-JZHlwdID+dy+lTgbYC8NEC4zeugqeYsc6jewvzb4c58kHauJn+X7rNwQjxz5p2qSjqaEeQoLkCIQ9v/H4PK0/w==}
-
   '@img/colour@1.1.0':
     resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
     engines: {node: '>=18'}
@@ -4352,9 +4341,6 @@ packages:
   '@material/material-color-utilities@0.3.0':
     resolution: {integrity: sha512-ztmtTd6xwnuh2/xu+Vb01btgV8SQWYCaK56CkRK8gEkWe5TuDyBcYJ0wgkMRn+2VcE9KUmhvkz+N9GHrqw/C0g==}
 
-  '@mermaid-js/parser@1.2.1':
-    resolution: {integrity: sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==}
-
   '@modelcontextprotocol/sdk@1.31.0':
     resolution: {integrity: sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==}
     engines: {node: '>=18'}
@@ -6594,99 +6580,6 @@ packages:
   '@types/culori@4.0.1':
     resolution: {integrity: sha512-43M51r/22CjhbOXyGT361GZ9vncSVQ39u62x5eJdBQFviI8zWp2X5jzqg7k4M6PVgDQAClpy2bUe2dtwEgEDVQ==}
 
-  '@types/d3-array@3.2.2':
-    resolution: {integrity: sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==}
-
-  '@types/d3-axis@3.0.6':
-    resolution: {integrity: sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw==}
-
-  '@types/d3-brush@3.0.6':
-    resolution: {integrity: sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A==}
-
-  '@types/d3-chord@3.0.6':
-    resolution: {integrity: sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg==}
-
-  '@types/d3-color@3.1.3':
-    resolution: {integrity: sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==}
-
-  '@types/d3-contour@3.0.6':
-    resolution: {integrity: sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg==}
-
-  '@types/d3-delaunay@6.0.4':
-    resolution: {integrity: sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw==}
-
-  '@types/d3-dispatch@3.0.7':
-    resolution: {integrity: sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA==}
-
-  '@types/d3-drag@3.0.7':
-    resolution: {integrity: sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ==}
-
-  '@types/d3-dsv@3.0.7':
-    resolution: {integrity: sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g==}
-
-  '@types/d3-ease@3.0.2':
-    resolution: {integrity: sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==}
-
-  '@types/d3-fetch@3.0.7':
-    resolution: {integrity: sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA==}
-
-  '@types/d3-force@3.0.10':
-    resolution: {integrity: sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw==}
-
-  '@types/d3-format@3.0.4':
-    resolution: {integrity: sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g==}
-
-  '@types/d3-geo@3.1.1':
-    resolution: {integrity: sha512-65Emv9fQiQQqphLlRkuQ5ypPsOmWPhtBGCMv61JDPEPMvsx+gzhGf74yw1a78xFKPj6zw4AgQICJoQv0vK9M2w==}
-
-  '@types/d3-hierarchy@3.1.7':
-    resolution: {integrity: sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg==}
-
-  '@types/d3-interpolate@3.0.4':
-    resolution: {integrity: sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==}
-
-  '@types/d3-path@3.1.1':
-    resolution: {integrity: sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==}
-
-  '@types/d3-polygon@3.0.2':
-    resolution: {integrity: sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA==}
-
-  '@types/d3-quadtree@3.0.6':
-    resolution: {integrity: sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg==}
-
-  '@types/d3-random@3.0.4':
-    resolution: {integrity: sha512-UHYId5WTCx4L4YNel7NU00XUXXgvgpgZOvp10PuvsQENjMDXhh2RyFc0KBjO7B45ne4Ha1yVH7ii0vnzKkuzWA==}
-
-  '@types/d3-scale-chromatic@3.1.0':
-    resolution: {integrity: sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==}
-
-  '@types/d3-scale@4.0.9':
-    resolution: {integrity: sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==}
-
-  '@types/d3-selection@3.0.12':
-    resolution: {integrity: sha512-Qe/KWYhEiIIxGs7HrAAjMfShxKldx19SJtr5zu53f3afPsdZNz7HHtdTLXo/kqeiWNXVycI24kSnfzBYkTzpgw==}
-
-  '@types/d3-shape@3.2.0':
-    resolution: {integrity: sha512-kVd74ta9eof3eJOvbNd1vGKS/XERRyQbT26Og63hIsvDO84cjD5gEOhsXf26w3FSoNlPVz84DOFcKv/oou+fMw==}
-
-  '@types/d3-time-format@4.0.3':
-    resolution: {integrity: sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg==}
-
-  '@types/d3-time@3.0.4':
-    resolution: {integrity: sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==}
-
-  '@types/d3-timer@3.0.2':
-    resolution: {integrity: sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==}
-
-  '@types/d3-transition@3.0.9':
-    resolution: {integrity: sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg==}
-
-  '@types/d3-zoom@3.0.9':
-    resolution: {integrity: sha512-0sE1406XBYJGiqD3AusTl9ZqC//2mIXix51tbom25gDCA8ri4xnSZg28CaSE8Srl6FClqABUKfsn0qghgdepMA==}
-
-  '@types/d3@7.4.3':
-    resolution: {integrity: sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww==}
-
   '@types/debug@4.1.13':
     resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
 
@@ -6711,9 +6604,6 @@ packages:
   '@types/fs-extra@9.0.13':
     resolution: {integrity: sha512-nEnwB++1u5lVDM2UI4c1+5R+FYaKfaAzS4OococimjVm3nQw3TuzH5UNsocrcTBbhnerblyHj4A49qXbIiZdpA==}
 
-  '@types/geojson@7946.0.16':
-    resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
-
   '@types/hast@3.0.5':
     resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
 
@@ -6956,9 +6846,6 @@ packages:
   '@ungap/structured-clone@1.3.1':
     resolution: {integrity: sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==}
 
-  '@upsetjs/venn.js@2.0.0':
-    resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
-
   '@vercel/config@0.3.0':
     resolution: {integrity: sha512-Tf5k5y2F478oTiQcU5R8Ntix1UejE6NdduZnI7aa1XXxjCtifX1XdRS/D2uTjiQAwIL3pLa1LSAN80ABbba+TQ==}
     hasBin: true
@@ -8118,12 +8005,6 @@ packages:
     resolution: {integrity: sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==}
     engines: {node: '>= 0.10'}
 
-  cose-base@1.0.3:
-    resolution: {integrity: sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg==}
-
-  cose-base@2.2.0:
-    resolution: {integrity: sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g==}
-
   cross-dirname@0.1.0:
     resolution: {integrity: sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==}
 
@@ -8180,162 +8061,6 @@ packages:
     resolution: {integrity: sha512-1+BhOB8ahCn4O0cep0Sh2l9KCOfOdY+BXJnKMHFFzDEouSr/el18QwXEMRlOj9UY5nCeA8UN3a/82rUWRBeyBw==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  cytoscape-cose-bilkent@4.1.0:
-    resolution: {integrity: sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ==}
-    peerDependencies:
-      cytoscape: ^3.2.0
-
-  cytoscape-fcose@2.2.0:
-    resolution: {integrity: sha512-ki1/VuRIHFCzxWNrsshHYPs6L7TvLu3DL+TyIGEsRcvVERmxokbf5Gdk7mFxZnTdiGtnA4cfSmjZJMviqSuZrQ==}
-    peerDependencies:
-      cytoscape: ^3.2.0
-
-  cytoscape@3.34.3:
-    resolution: {integrity: sha512-yfYGhRcGAntq6YBD583j4n0Eg3jIxvWmZtz/5uz9UYkeIStSlMxuUja+ec5j3iBD8nv1rwaOAYMW09tBdkSeaQ==}
-    engines: {node: '>=0.10'}
-
-  d3-array@2.12.1:
-    resolution: {integrity: sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ==}
-
-  d3-array@3.2.4:
-    resolution: {integrity: sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==}
-    engines: {node: '>=12'}
-
-  d3-axis@3.0.0:
-    resolution: {integrity: sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw==}
-    engines: {node: '>=12'}
-
-  d3-brush@3.0.0:
-    resolution: {integrity: sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ==}
-    engines: {node: '>=12'}
-
-  d3-chord@3.0.1:
-    resolution: {integrity: sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g==}
-    engines: {node: '>=12'}
-
-  d3-color@3.1.0:
-    resolution: {integrity: sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==}
-    engines: {node: '>=12'}
-
-  d3-contour@4.0.2:
-    resolution: {integrity: sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA==}
-    engines: {node: '>=12'}
-
-  d3-delaunay@6.0.4:
-    resolution: {integrity: sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A==}
-    engines: {node: '>=12'}
-
-  d3-dispatch@3.0.1:
-    resolution: {integrity: sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg==}
-    engines: {node: '>=12'}
-
-  d3-drag@3.0.0:
-    resolution: {integrity: sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg==}
-    engines: {node: '>=12'}
-
-  d3-dsv@3.0.1:
-    resolution: {integrity: sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q==}
-    engines: {node: '>=12'}
-    hasBin: true
-
-  d3-ease@3.0.1:
-    resolution: {integrity: sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==}
-    engines: {node: '>=12'}
-
-  d3-fetch@3.0.1:
-    resolution: {integrity: sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw==}
-    engines: {node: '>=12'}
-
-  d3-force@3.0.0:
-    resolution: {integrity: sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg==}
-    engines: {node: '>=12'}
-
-  d3-format@3.1.2:
-    resolution: {integrity: sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==}
-    engines: {node: '>=12'}
-
-  d3-geo@3.1.1:
-    resolution: {integrity: sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q==}
-    engines: {node: '>=12'}
-
-  d3-hierarchy@3.1.2:
-    resolution: {integrity: sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA==}
-    engines: {node: '>=12'}
-
-  d3-interpolate@3.0.1:
-    resolution: {integrity: sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==}
-    engines: {node: '>=12'}
-
-  d3-path@1.0.9:
-    resolution: {integrity: sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg==}
-
-  d3-path@3.1.0:
-    resolution: {integrity: sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==}
-    engines: {node: '>=12'}
-
-  d3-polygon@3.0.1:
-    resolution: {integrity: sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg==}
-    engines: {node: '>=12'}
-
-  d3-quadtree@3.0.1:
-    resolution: {integrity: sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw==}
-    engines: {node: '>=12'}
-
-  d3-random@3.0.1:
-    resolution: {integrity: sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ==}
-    engines: {node: '>=12'}
-
-  d3-sankey@0.12.3:
-    resolution: {integrity: sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ==}
-
-  d3-scale-chromatic@3.1.0:
-    resolution: {integrity: sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ==}
-    engines: {node: '>=12'}
-
-  d3-scale@4.0.2:
-    resolution: {integrity: sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==}
-    engines: {node: '>=12'}
-
-  d3-selection@3.0.0:
-    resolution: {integrity: sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==}
-    engines: {node: '>=12'}
-
-  d3-shape@1.3.7:
-    resolution: {integrity: sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw==}
-
-  d3-shape@3.2.0:
-    resolution: {integrity: sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==}
-    engines: {node: '>=12'}
-
-  d3-time-format@4.1.0:
-    resolution: {integrity: sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==}
-    engines: {node: '>=12'}
-
-  d3-time@3.1.0:
-    resolution: {integrity: sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==}
-    engines: {node: '>=12'}
-
-  d3-timer@3.0.1:
-    resolution: {integrity: sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==}
-    engines: {node: '>=12'}
-
-  d3-transition@3.0.1:
-    resolution: {integrity: sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w==}
-    engines: {node: '>=12'}
-    peerDependencies:
-      d3-selection: 2 - 3
-
-  d3-zoom@3.0.0:
-    resolution: {integrity: sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw==}
-    engines: {node: '>=12'}
-
-  d3@7.9.0:
-    resolution: {integrity: sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA==}
-    engines: {node: '>=12'}
-
-  dagre-d3-es@7.0.14:
-    resolution: {integrity: sha512-P4rFMVq9ESWqmOgK+dlXvOtLwYg0i7u0HBGJER0LZDJT2VHIPAMZ/riPxqJceWMStH5+E61QxFra9kIS3AqdMg==}
-
   data-urls@7.0.0:
     resolution: {integrity: sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
@@ -8343,9 +8068,6 @@ packages:
   date-fns@4.4.0:
     resolution: {integrity: sha512-+1UMbeh68lH1SegH83CGWwpb6OHHbpSgr3+s5Eww5M4CAgswBpoWS0AjTOfEJ33HiYKz1hdj/KTFprzXHmq/6w==}
 
-  dayjs@1.11.23:
-    resolution: {integrity: sha512-QDTCU0M0MxR3hQfnlDJfwekQiaanm1ubOD231u73WBckQ/fsamwRLiE2GBz6D3a/xF1NgfiDLJjXBa1hYOYTtQ==}
-
   dbus-next@0.10.2:
     resolution: {integrity: sha512-kLNQoadPstLgKKGIXKrnRsMgtAK/o+ix3ZmcfTfvBHzghiO9yHXpoKImGnB50EXwnfSFaSAullW/7UrSkAISSQ==}
 
@@ -8414,9 +8136,6 @@ packages:
   defu@6.1.7:
     resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
 
-  delaunator@5.1.0:
-    resolution: {integrity: sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==}
-
   delayed-stream@1.0.0:
     resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
     engines: {node: '>=0.4.0'}
@@ -8792,9 +8511,6 @@ packages:
     resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
     engines: {node: '>= 0.4'}
 
-  es-toolkit@1.52.0:
-    resolution: {integrity: sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==}
-
   es6-error@4.1.1:
     resolution: {integrity: sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==}
 
@@ -9242,9 +8958,6 @@ packages:
     resolution: {integrity: sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==}
     hasBin: true
 
-  fastdom@1.0.12:
-    resolution: {integrity: sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==}
-
   fastest-levenshtein@1.0.16:
     resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
     engines: {node: '>= 4.9.1'}
@@ -9477,9 +9190,6 @@ packages:
   h3@1.15.11:
     resolution: {integrity: sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg==}
 
-  hachure-fill@0.5.2:
-    resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==}
-
   has-flag@3.0.0:
     resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
     engines: {node: '>=4'}
@@ -9621,9 +9331,6 @@ packages:
   immediate@3.0.6:
     resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==}
 
-  import-meta-resolve@4.2.0:
-    resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==}
-
   inflight@1.0.6:
     resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
     deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
@@ -9634,13 +9341,6 @@ packages:
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
-  internmap@1.0.1:
-    resolution: {integrity: sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw==}
-
-  internmap@2.0.3:
-    resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==}
-    engines: {node: '>=12'}
-
   invariant@2.2.4:
     resolution: {integrity: sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==}
 
@@ -9876,9 +9576,6 @@ packages:
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
-  khroma@2.1.0:
-    resolution: {integrity: sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw==}
-
   kleur@3.0.3:
     resolution: {integrity: sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==}
     engines: {node: '>=6'}
@@ -9896,12 +9593,6 @@ packages:
     resolution: {integrity: sha512-ONPnazC96VKDntab9j9JKwIWhZ4ZUceB4A9Epu4Ssg0hYFmtHZSeQ+n15nIwTFmcBUKtExOer8WTJ4GF9MO64A==}
     hasBin: true
 
-  layout-base@1.0.2:
-    resolution: {integrity: sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg==}
-
-  layout-base@2.0.1:
-    resolution: {integrity: sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg==}
-
   lazy-val@1.0.5:
     resolution: {integrity: sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q==}
 
@@ -10004,9 +9695,6 @@ packages:
     resolution: {integrity: sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==}
     engines: {node: '>=6'}
 
-  lodash-es@4.18.1:
-    resolution: {integrity: sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==}
-
   lodash.debounce@4.0.8:
     resolution: {integrity: sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==}
 
@@ -10092,11 +9780,6 @@ packages:
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
-  marked@16.4.2:
-    resolution: {integrity: sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA==}
-    engines: {node: '>= 20'}
-    hasBin: true
-
   matcher@3.0.0:
     resolution: {integrity: sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==}
     engines: {node: '>=10'}
@@ -10185,9 +9868,6 @@ packages:
   merge-stream@2.0.0:
     resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
 
-  mermaid@11.17.2:
-    resolution: {integrity: sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==}
-
   meshoptimizer@0.22.0:
     resolution: {integrity: sha512-IebiK79sqIy+E4EgOr+CAw+Ke8hAspXKzBd0JdgEmPHiAwmvEj2S4h1rfvo+o/BnfEYd/jAOg5IeeIjzlzSnDg==}
 
@@ -10834,9 +10514,6 @@ packages:
   path-browserify@1.0.1:
     resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==}
 
-  path-data-parser@0.1.0:
-    resolution: {integrity: sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w==}
-
   path-exists@3.0.0:
     resolution: {integrity: sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==}
     engines: {node: '>=4'}
@@ -10879,6 +10556,10 @@ packages:
     resolution: {integrity: sha512-eRWB5LBz7PpDu4PUlwT0PhnQfTQJlDDdPa35urV4Osrm0t0AqQFGn+UIkU3klZvwJ8KPO3VbBFsXquA6p6kqZw==}
     engines: {node: '>=12', npm: '>=6'}
 
+  pele@1.8.0:
+    resolution: {integrity: sha512-AYmHttE70cwNJVXdfPMCANGivFlmc3bGGpMG0GqH5S5vE3RgtEuLlkqbhRfe94Csv/ZEd1TUbv2dMUHpw4p1Bg==}
+    engines: {node: '>=20'}
+
   pend@1.2.0:
     resolution: {integrity: sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==}
 
@@ -10968,12 +10649,6 @@ packages:
     resolution: {integrity: sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==}
     engines: {node: '>=14.19.0'}
 
-  points-on-curve@0.2.0:
-    resolution: {integrity: sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A==}
-
-  points-on-path@0.2.1:
-    resolution: {integrity: sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g==}
-
   postcss@8.5.28:
     resolution: {integrity: sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==}
     engines: {node: ^10 || ^12 || >=14}
@@ -11271,9 +10946,9 @@ packages:
       react: '*'
       react-native: '*'
 
-  react-native-screens@file:apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz:
-    resolution: {integrity: sha512-Y5gaQmd/p1SOeCh7Esyaj1DEycDJ7XFNUdXS1ZDOsuwF5yK1h8yu4H4tCw6mKDrSVV8bNPBYhf4qs5/AaNe3zQ==, tarball: file:apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz}
-    version: 5.0.0-t3.29
+  react-native-screens@file:apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz:
+    resolution: {integrity: sha512-Szxvbp1mt4KwJ6cLoirkLQ2kz7Ebia3fTYPTjTifwqw3djskueHmML1np+wSZEs3Y0NtZf681SG/8xN5iW3T5Q==, tarball: file:apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz}
+    version: 5.0.0-t3.30
     peerDependencies:
       react: '*'
       react-native: '*'
@@ -11481,9 +11156,6 @@ packages:
     resolution: {integrity: sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==}
     engines: {node: '>=8.0'}
 
-  robust-predicates@3.0.3:
-    resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==}
-
   rolldown@1.0.0-rc.17:
     resolution: {integrity: sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -11502,16 +11174,10 @@ packages:
   rope-sequence@1.3.4:
     resolution: {integrity: sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ==}
 
-  roughjs@4.6.6:
-    resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==}
-
   router@2.2.0:
     resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
     engines: {node: '>= 18'}
 
-  rw@1.3.3:
-    resolution: {integrity: sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==}
-
   safe-buffer@5.1.2:
     resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
 
@@ -11806,9 +11472,6 @@ packages:
   strict-event-emitter@0.5.1:
     resolution: {integrity: sha512-vMgjE/GGEPEFnhFub6pa4FmJBRBVOLpIII2hvCZ8Kzb7K0hlHo7mQv6xYrBvCL2LtAIBwFUK8wvuJgTVSQ5MFQ==}
 
-  strictdom@1.0.1:
-    resolution: {integrity: sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==}
-
   string-width@4.2.3:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
     engines: {node: '>=8'}
@@ -11855,9 +11518,6 @@ packages:
   style-to-object@1.0.14:
     resolution: {integrity: sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==}
 
-  stylis@4.4.0:
-    resolution: {integrity: sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA==}
-
   sumchecker@3.0.1:
     resolution: {integrity: sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg==}
     engines: {node: '>= 8.0'}
@@ -12038,10 +11698,6 @@ packages:
   ts-algebra@2.0.0:
     resolution: {integrity: sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==}
 
-  ts-dedent@2.3.0:
-    resolution: {integrity: sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg==}
-    engines: {node: '>=6.10'}
-
   tsc-rs@0.7.0:
     resolution: {integrity: sha512-diVCBljoXLQjvXRkIuamR3QRrmNyqgYDePKA5SFXTSDPSjku2a2JXj/bOxG4DoPUbYkzWl/XFu1689z/46TCaA==}
     engines: {node: '>=16.20.0'}
@@ -12316,10 +11972,6 @@ packages:
     resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
     engines: {node: '>= 0.4.0'}
 
-  uuid@14.0.2:
-    resolution: {integrity: sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==}
-    hasBin: true
-
   uuid@7.0.3:
     resolution: {integrity: sha512-DPSke0pXhTZgoF/d+WSt2QaKMCFSfx7QegxEWT+JOuHF5aWrKEn0G+ztjuJg/gG8/ItK+rbPCD/yNv8yyih6Cg==}
     deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
@@ -12891,11 +12543,6 @@ snapshots:
       '@types/react': 19.3.0
       react-devtools-core: 6.1.5(bufferutil@4.1.0)(utf-8-validate@6.0.6)
 
-  '@antfu/install-pkg@2.1.0':
-    dependencies:
-      package-manager-detector: 1.8.0
-      tinyexec: 1.3.1
-
   '@anthropic-ai/claude-agent-sdk@0.3.276(@anthropic-ai/sdk@0.93.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))(zod@4.6.5)':
     dependencies:
       '@anthropic-ai/sdk': 0.93.0(zod@4.6.5)
@@ -13792,8 +13439,6 @@ snapshots:
 
   '@blazediff/core@1.10.0': {}
 
-  '@braintree/sanitize-url@7.1.2': {}
-
   '@bramus/specificity@2.4.2':
     dependencies:
       css-tree: 3.2.1
@@ -13835,8 +13480,6 @@ snapshots:
     dependencies:
       fontkitten: 1.0.3
 
-  '@chevrotain/types@11.1.2': {}
-
   '@clack/core@1.5.1':
     dependencies:
       fast-wrap-ansi: 0.2.2
@@ -15186,14 +14829,6 @@ snapshots:
 
   '@iarna/toml@2.2.5': {}
 
-  '@iconify/types@2.0.0': {}
-
-  '@iconify/utils@3.1.7':
-    dependencies:
-      '@antfu/install-pkg': 2.1.0
-      '@iconify/types': 2.0.0
-      import-meta-resolve: 4.2.0
-
   '@img/colour@1.1.0': {}
 
   '@img/sharp-darwin-arm64@0.35.5':
@@ -15464,10 +15099,6 @@ snapshots:
 
   '@material/material-color-utilities@0.3.0': {}
 
-  '@mermaid-js/parser@1.2.1':
-    dependencies:
-      '@chevrotain/types': 11.1.2
-
   '@modelcontextprotocol/sdk@1.31.0(zod@4.6.5)':
     dependencies:
       '@hono/node-server': 1.19.17(hono@4.13.7)
@@ -16475,7 +16106,7 @@ snapshots:
     optionalDependencies:
       '@react-native-masked-view/masked-view': 0.3.2(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
 
-  '@react-navigation/native-stack@7.21.0(patch_hash=caae6552051bce91a85f567f3a08f9c8d25ce4c53f65a9391a67f016bb1d798e)(6f7595467acac269803072e24b2c2fee)':
+  '@react-navigation/native-stack@7.21.0(patch_hash=caae6552051bce91a85f567f3a08f9c8d25ce4c53f65a9391a67f016bb1d798e)(16f893500fb9de13b2f16d636ddf6f9b)':
     dependencies:
       '@react-navigation/elements': 2.9.45(da16e244bd876bd7d4e1e8899c8eabfd)
       '@react-navigation/native': 7.5.1(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
@@ -16483,7 +16114,7 @@ snapshots:
       react: 19.3.0
       react-native: 0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6)
       react-native-safe-area-context: 5.10.1(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
-      react-native-screens: file:apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
+      react-native-screens: file:apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0)
       sf-symbols-typescript: 2.2.0
       warn-once: 0.1.1
     transitivePeerDependencies:
@@ -17265,123 +16896,6 @@ snapshots:
 
   '@types/culori@4.0.1': {}
 
-  '@types/d3-array@3.2.2': {}
-
-  '@types/d3-axis@3.0.6':
-    dependencies:
-      '@types/d3-selection': 3.0.12
-
-  '@types/d3-brush@3.0.6':
-    dependencies:
-      '@types/d3-selection': 3.0.12
-
-  '@types/d3-chord@3.0.6': {}
-
-  '@types/d3-color@3.1.3': {}
-
-  '@types/d3-contour@3.0.6':
-    dependencies:
-      '@types/d3-array': 3.2.2
-      '@types/geojson': 7946.0.16
-
-  '@types/d3-delaunay@6.0.4': {}
-
-  '@types/d3-dispatch@3.0.7': {}
-
-  '@types/d3-drag@3.0.7':
-    dependencies:
-      '@types/d3-selection': 3.0.12
-
-  '@types/d3-dsv@3.0.7': {}
-
-  '@types/d3-ease@3.0.2': {}
-
-  '@types/d3-fetch@3.0.7':
-    dependencies:
-      '@types/d3-dsv': 3.0.7
-
-  '@types/d3-force@3.0.10': {}
-
-  '@types/d3-format@3.0.4': {}
-
-  '@types/d3-geo@3.1.1':
-    dependencies:
-      '@types/geojson': 7946.0.16
-
-  '@types/d3-hierarchy@3.1.7': {}
-
-  '@types/d3-interpolate@3.0.4':
-    dependencies:
-      '@types/d3-color': 3.1.3
-
-  '@types/d3-path@3.1.1': {}
-
-  '@types/d3-polygon@3.0.2': {}
-
-  '@types/d3-quadtree@3.0.6': {}
-
-  '@types/d3-random@3.0.4': {}
-
-  '@types/d3-scale-chromatic@3.1.0': {}
-
-  '@types/d3-scale@4.0.9':
-    dependencies:
-      '@types/d3-time': 3.0.4
-
-  '@types/d3-selection@3.0.12': {}
-
-  '@types/d3-shape@3.2.0':
-    dependencies:
-      '@types/d3-path': 3.1.1
-
-  '@types/d3-time-format@4.0.3': {}
-
-  '@types/d3-time@3.0.4': {}
-
-  '@types/d3-timer@3.0.2': {}
-
-  '@types/d3-transition@3.0.9':
-    dependencies:
-      '@types/d3-selection': 3.0.12
-
-  '@types/d3-zoom@3.0.9':
-    dependencies:
-      '@types/d3-interpolate': 3.0.4
-      '@types/d3-selection': 3.0.12
-
-  '@types/d3@7.4.3':
-    dependencies:
-      '@types/d3-array': 3.2.2
-      '@types/d3-axis': 3.0.6
-      '@types/d3-brush': 3.0.6
-      '@types/d3-chord': 3.0.6
-      '@types/d3-color': 3.1.3
-      '@types/d3-contour': 3.0.6
-      '@types/d3-delaunay': 6.0.4
-      '@types/d3-dispatch': 3.0.7
-      '@types/d3-drag': 3.0.7
-      '@types/d3-dsv': 3.0.7
-      '@types/d3-ease': 3.0.2
-      '@types/d3-fetch': 3.0.7
-      '@types/d3-force': 3.0.10
-      '@types/d3-format': 3.0.4
-      '@types/d3-geo': 3.1.1
-      '@types/d3-hierarchy': 3.1.7
-      '@types/d3-interpolate': 3.0.4
-      '@types/d3-path': 3.1.1
-      '@types/d3-polygon': 3.0.2
-      '@types/d3-quadtree': 3.0.6
-      '@types/d3-random': 3.0.4
-      '@types/d3-scale': 4.0.9
-      '@types/d3-scale-chromatic': 3.1.0
-      '@types/d3-selection': 3.0.12
-      '@types/d3-shape': 3.2.0
-      '@types/d3-time': 3.0.4
-      '@types/d3-time-format': 4.0.3
-      '@types/d3-timer': 3.0.2
-      '@types/d3-transition': 3.0.9
-      '@types/d3-zoom': 3.0.9
-
   '@types/debug@4.1.13':
     dependencies:
       '@types/ms': 2.1.0
@@ -17413,8 +16927,6 @@ snapshots:
     dependencies:
       '@types/node': 24.12.4
 
-  '@types/geojson@7946.0.16': {}
-
   '@types/hast@3.0.5':
     dependencies:
       '@types/unist': 3.0.3
@@ -17609,11 +17121,6 @@ snapshots:
 
   '@ungap/structured-clone@1.3.1': {}
 
-  '@upsetjs/venn.js@2.0.0':
-    optionalDependencies:
-      d3-selection: 3.0.0
-      d3-transition: 3.0.1(d3-selection@3.0.0)
-
   '@vercel/config@0.3.0':
     dependencies:
       '@vercel/routing-utils': 6.2.0
@@ -18181,7 +17688,7 @@ snapshots:
   anynum@1.0.1:
     optional: true
 
-  app-builder-lib@26.16.1(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1):
+  app-builder-lib@26.16.1(patch_hash=a28c2dfcfc2b90d6c6247e199e6537391db9ecd941854c650910d607442512d3)(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1):
     dependencies:
       '@electron/asar': 3.4.1
       '@electron/fuses': 1.8.0
@@ -18859,14 +18366,6 @@ snapshots:
       object-assign: 4.1.1
       vary: 1.1.2
 
-  cose-base@1.0.3:
-    dependencies:
-      layout-base: 1.0.2
-
-  cose-base@2.2.0:
-    dependencies:
-      layout-base: 2.0.1
-
   cross-dirname@0.1.0:
     optional: true
 
@@ -18930,190 +18429,6 @@ snapshots:
 
   culori@4.0.2: {}
 
-  cytoscape-cose-bilkent@4.1.0(cytoscape@3.34.3):
-    dependencies:
-      cose-base: 1.0.3
-      cytoscape: 3.34.3
-
-  cytoscape-fcose@2.2.0(cytoscape@3.34.3):
-    dependencies:
-      cose-base: 2.2.0
-      cytoscape: 3.34.3
-
-  cytoscape@3.34.3: {}
-
-  d3-array@2.12.1:
-    dependencies:
-      internmap: 1.0.1
-
-  d3-array@3.2.4:
-    dependencies:
-      internmap: 2.0.3
-
-  d3-axis@3.0.0: {}
-
-  d3-brush@3.0.0:
-    dependencies:
-      d3-dispatch: 3.0.1
-      d3-drag: 3.0.0
-      d3-interpolate: 3.0.1
-      d3-selection: 3.0.0
-      d3-transition: 3.0.1(d3-selection@3.0.0)
-
-  d3-chord@3.0.1:
-    dependencies:
-      d3-path: 3.1.0
-
-  d3-color@3.1.0: {}
-
-  d3-contour@4.0.2:
-    dependencies:
-      d3-array: 3.2.4
-
-  d3-delaunay@6.0.4:
-    dependencies:
-      delaunator: 5.1.0
-
-  d3-dispatch@3.0.1: {}
-
-  d3-drag@3.0.0:
-    dependencies:
-      d3-dispatch: 3.0.1
-      d3-selection: 3.0.0
-
-  d3-dsv@3.0.1:
-    dependencies:
-      commander: 7.2.0
-      iconv-lite: 0.6.3
-      rw: 1.3.3
-
-  d3-ease@3.0.1: {}
-
-  d3-fetch@3.0.1:
-    dependencies:
-      d3-dsv: 3.0.1
-
-  d3-force@3.0.0:
-    dependencies:
-      d3-dispatch: 3.0.1
-      d3-quadtree: 3.0.1
-      d3-timer: 3.0.1
-
-  d3-format@3.1.2: {}
-
-  d3-geo@3.1.1:
-    dependencies:
-      d3-array: 3.2.4
-
-  d3-hierarchy@3.1.2: {}
-
-  d3-interpolate@3.0.1:
-    dependencies:
-      d3-color: 3.1.0
-
-  d3-path@1.0.9: {}
-
-  d3-path@3.1.0: {}
-
-  d3-polygon@3.0.1: {}
-
-  d3-quadtree@3.0.1: {}
-
-  d3-random@3.0.1: {}
-
-  d3-sankey@0.12.3:
-    dependencies:
-      d3-array: 2.12.1
-      d3-shape: 1.3.7
-
-  d3-scale-chromatic@3.1.0:
-    dependencies:
-      d3-color: 3.1.0
-      d3-interpolate: 3.0.1
-
-  d3-scale@4.0.2:
-    dependencies:
-      d3-array: 3.2.4
-      d3-format: 3.1.2
-      d3-interpolate: 3.0.1
-      d3-time: 3.1.0
-      d3-time-format: 4.1.0
-
-  d3-selection@3.0.0: {}
-
-  d3-shape@1.3.7:
-    dependencies:
-      d3-path: 1.0.9
-
-  d3-shape@3.2.0:
-    dependencies:
-      d3-path: 3.1.0
-
-  d3-time-format@4.1.0:
-    dependencies:
-      d3-time: 3.1.0
-
-  d3-time@3.1.0:
-    dependencies:
-      d3-array: 3.2.4
-
-  d3-timer@3.0.1: {}
-
-  d3-transition@3.0.1(d3-selection@3.0.0):
-    dependencies:
-      d3-color: 3.1.0
-      d3-dispatch: 3.0.1
-      d3-ease: 3.0.1
-      d3-interpolate: 3.0.1
-      d3-selection: 3.0.0
-      d3-timer: 3.0.1
-
-  d3-zoom@3.0.0:
-    dependencies:
-      d3-dispatch: 3.0.1
-      d3-drag: 3.0.0
-      d3-interpolate: 3.0.1
-      d3-selection: 3.0.0
-      d3-transition: 3.0.1(d3-selection@3.0.0)
-
-  d3@7.9.0:
-    dependencies:
-      d3-array: 3.2.4
-      d3-axis: 3.0.0
-      d3-brush: 3.0.0
-      d3-chord: 3.0.1
-      d3-color: 3.1.0
-      d3-contour: 4.0.2
-      d3-delaunay: 6.0.4
-      d3-dispatch: 3.0.1
-      d3-drag: 3.0.0
-      d3-dsv: 3.0.1
-      d3-ease: 3.0.1
-      d3-fetch: 3.0.1
-      d3-force: 3.0.0
-      d3-format: 3.1.2
-      d3-geo: 3.1.1
-      d3-hierarchy: 3.1.2
-      d3-interpolate: 3.0.1
-      d3-path: 3.1.0
-      d3-polygon: 3.0.1
-      d3-quadtree: 3.0.1
-      d3-random: 3.0.1
-      d3-scale: 4.0.2
-      d3-scale-chromatic: 3.1.0
-      d3-selection: 3.0.0
-      d3-shape: 3.2.0
-      d3-time: 3.1.0
-      d3-time-format: 4.1.0
-      d3-timer: 3.0.1
-      d3-transition: 3.0.1(d3-selection@3.0.0)
-      d3-zoom: 3.0.0
-
-  dagre-d3-es@7.0.14:
-    dependencies:
-      d3: 7.9.0
-      lodash-es: 4.18.1
-
   data-urls@7.0.0(@noble/hashes@1.8.0):
     dependencies:
       whatwg-mimetype: 5.0.0
@@ -19123,8 +18438,6 @@ snapshots:
 
   date-fns@4.4.0: {}
 
-  dayjs@1.11.23: {}
-
   dbus-next@0.10.2(patch_hash=cfff57561b0ee59b5addb3b2e6c6f20906e967507a530ab67e8db8108e520ba4):
     dependencies:
       '@nornagon/put': 0.0.8
@@ -19187,10 +18500,6 @@ snapshots:
 
   defu@6.1.7: {}
 
-  delaunator@5.1.0:
-    dependencies:
-      robust-predicates: 3.0.3
-
   delayed-stream@1.0.0: {}
 
   denque@2.1.0:
@@ -19234,7 +18543,7 @@ snapshots:
 
   dmg-builder@26.16.1(electron-builder-squirrel-windows@26.16.1):
     dependencies:
-      app-builder-lib: 26.16.1(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
+      app-builder-lib: 26.16.1(patch_hash=a28c2dfcfc2b90d6c6247e199e6537391db9ecd941854c650910d607442512d3)(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
       builder-util: 26.16.0
       fs-extra: 10.1.0
       js-yaml: 4.3.2
@@ -19326,7 +18635,7 @@ snapshots:
 
   electron-builder-squirrel-windows@26.16.1(dmg-builder@26.16.1):
     dependencies:
-      app-builder-lib: 26.16.1(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
+      app-builder-lib: 26.16.1(patch_hash=a28c2dfcfc2b90d6c6247e199e6537391db9ecd941854c650910d607442512d3)(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
       builder-util: 26.16.0
       electron-winstaller: 5.4.0
     transitivePeerDependencies:
@@ -19335,7 +18644,7 @@ snapshots:
 
   electron-builder@26.16.1(electron-builder-squirrel-windows@26.16.1):
     dependencies:
-      app-builder-lib: 26.16.1(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
+      app-builder-lib: 26.16.1(patch_hash=a28c2dfcfc2b90d6c6247e199e6537391db9ecd941854c650910d607442512d3)(dmg-builder@26.16.1)(electron-builder-squirrel-windows@26.16.1)
       builder-util: 26.16.0
       builder-util-runtime: 9.7.0
       chalk: 4.1.2
@@ -19470,8 +18779,6 @@ snapshots:
       has-tostringtag: 1.0.2
       hasown: 2.0.4
 
-  es-toolkit@1.52.0: {}
-
   es6-error@4.1.1:
     optional: true
 
@@ -20054,10 +19361,6 @@ snapshots:
       strnum: 2.4.2
     optional: true
 
-  fastdom@1.0.12:
-    dependencies:
-      strictdom: 1.0.1
-
   fastest-levenshtein@1.0.16: {}
 
   fb-dotslash@0.5.8: {}
@@ -20330,8 +19633,6 @@ snapshots:
       ufo: 1.6.4
       uncrypto: 0.1.3
 
-  hachure-fill@0.5.2: {}
-
   has-flag@3.0.0: {}
 
   has-flag@4.0.0: {}
@@ -20515,6 +19816,7 @@ snapshots:
   iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
+    optional: true
 
   iconv-lite@0.7.2:
     dependencies:
@@ -20531,8 +19833,6 @@ snapshots:
 
   immediate@3.0.6: {}
 
-  import-meta-resolve@4.2.0: {}
-
   inflight@1.0.6:
     dependencies:
       once: 1.4.0
@@ -20542,10 +19842,6 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  internmap@1.0.1: {}
-
-  internmap@2.0.3: {}
-
   invariant@2.2.4:
     dependencies:
       loose-envify: 1.4.0
@@ -20765,8 +20061,6 @@ snapshots:
     dependencies:
       json-buffer: 3.0.1
 
-  khroma@2.1.0: {}
-
   kleur@3.0.3: {}
 
   kleur@4.1.5: {}
@@ -20789,10 +20083,6 @@ snapshots:
 
   lan-network@0.2.1: {}
 
-  layout-base@1.0.2: {}
-
-  layout-base@2.0.1: {}
-
   lazy-val@1.0.5: {}
 
   leven@3.1.0: {}
@@ -20878,8 +20168,6 @@ snapshots:
       p-locate: 3.0.0
       path-exists: 3.0.0
 
-  lodash-es@4.18.1: {}
-
   lodash.debounce@4.0.8: {}
 
   lodash.escaperegexp@4.1.2: {}
@@ -20953,8 +20241,6 @@ snapshots:
 
   markdown-table@3.0.4: {}
 
-  marked@16.4.2: {}
-
   matcher@3.0.0:
     dependencies:
       escape-string-regexp: 4.0.0
@@ -21163,31 +20449,6 @@ snapshots:
 
   merge-stream@2.0.0: {}
 
-  mermaid@11.17.2:
-    dependencies:
-      '@braintree/sanitize-url': 7.1.2
-      '@iconify/utils': 3.1.7
-      '@mermaid-js/parser': 1.2.1
-      '@types/d3': 7.4.3
-      '@upsetjs/venn.js': 2.0.0
-      cytoscape: 3.34.3
-      cytoscape-cose-bilkent: 4.1.0(cytoscape@3.34.3)
-      cytoscape-fcose: 2.2.0(cytoscape@3.34.3)
-      d3: 7.9.0
-      d3-sankey: 0.12.3
-      dagre-d3-es: 7.0.14
-      dayjs: 1.11.23
-      dompurify: 3.4.16
-      es-toolkit: 1.52.0
-      fastdom: 1.0.12
-      katex: 0.16.47
-      khroma: 2.1.0
-      marked: 16.4.2
-      roughjs: 4.6.6
-      stylis: 4.4.0
-      ts-dedent: 2.3.0
-      uuid: 14.0.2
-
   meshoptimizer@0.22.0: {}
 
   metro-babel-transformer@0.87.1:
@@ -22189,8 +21450,6 @@ snapshots:
 
   path-browserify@1.0.1: {}
 
-  path-data-parser@0.1.0: {}
-
   path-exists@3.0.0: {}
 
   path-expression-matcher@1.6.2:
@@ -22221,6 +21480,8 @@ snapshots:
 
   pe-library@0.4.1: {}
 
+  pele@1.8.0: {}
+
   pend@1.2.0: {}
 
   pg-cloudflare@1.4.0:
@@ -22312,13 +21573,6 @@ snapshots:
 
   pngjs@7.0.0: {}
 
-  points-on-curve@0.2.0: {}
-
-  points-on-path@0.2.1:
-    dependencies:
-      path-data-parser: 0.1.0
-      points-on-curve: 0.2.0
-
   postcss@8.5.28:
     dependencies:
       nanoid: 3.3.19
@@ -22649,7 +21903,7 @@ snapshots:
       react: 19.3.0
       react-native: 0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6)
 
-  react-native-screens@file:apps/mobile/deps/react-native-screens-5.0.0-t3.29.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0):
+  react-native-screens@file:apps/mobile/deps/react-native-screens-5.0.0-t3.30.tgz(react-native@0.88.0(@babel/core@7.29.7)(@react-native/metro-config@0.88.0(@babel/core@7.29.7)(bufferutil@4.1.0)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(utf-8-validate@6.0.6))(react@19.3.0):
     dependencies:
       react: 19.3.0
       react-freeze: 1.0.4(react@19.3.0)
@@ -22954,8 +22208,6 @@ snapshots:
       sprintf-js: 1.1.3
     optional: true
 
-  robust-predicates@3.0.3: {}
-
   rolldown@1.0.0-rc.17:
     dependencies:
       '@oxc-project/types': 0.127.0
@@ -23023,13 +22275,6 @@ snapshots:
 
   rope-sequence@1.3.4: {}
 
-  roughjs@4.6.6:
-    dependencies:
-      hachure-fill: 0.5.2
-      path-data-parser: 0.1.0
-      points-on-curve: 0.2.0
-      points-on-path: 0.2.1
-
   router@2.2.0:
     dependencies:
       debug: 4.4.3
@@ -23040,8 +22285,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  rw@1.3.3: {}
-
   safe-buffer@5.1.2: {}
 
   safe-buffer@5.2.1: {}
@@ -23390,8 +22633,6 @@ snapshots:
   strict-event-emitter@0.5.1:
     optional: true
 
-  strictdom@1.0.1: {}
-
   string-width@4.2.3:
     dependencies:
       emoji-regex: 8.0.0
@@ -23447,8 +22688,6 @@ snapshots:
     dependencies:
       inline-style-parser: 0.2.7
 
-  stylis@4.4.0: {}
-
   sumchecker@3.0.1:
     dependencies:
       debug: 4.4.3
@@ -23622,8 +22861,6 @@ snapshots:
 
   ts-algebra@2.0.0: {}
 
-  ts-dedent@2.3.0: {}
-
   tsc-rs@0.7.0:
     optionalDependencies:
       '@tsc-rs/darwin-arm64': 0.7.0
@@ -23855,8 +23092,6 @@ snapshots:
 
   utils-merge@1.0.1: {}
 
-  uuid@14.0.2: {}
-
   uuid@7.0.3: {}
 
   valibot@1.2.0(typescript@7.0.2):
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b7f755edc3b4..e0c5869b39a5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -218,6 +218,7 @@ minimumReleaseAgeExclude:
   - "@react-native/virtualized-lists@0.88.0"
   - react-native-svg@15.16.0
   - "@expo/schema-utils@58.0.2"
+  - pele@1.8.0
 
 overrides:
   # Keep on the patched version. A fresh resolution would take a newer release and
@@ -357,6 +358,7 @@ patchedDependencies:
   # Android: Maven-resolved gradle plugins (expo-widgets) have no sourceDir; without this
   # skip, the fingerprint silently drops every Expo native module and OTAs reach stale binaries.
   "@expo/fingerprint@0.21.5": patches/@expo__fingerprint@0.21.5.patch
+  app-builder-lib@26.16.1: patches/app-builder-lib@26.16.1.patch
 
 peerDependencyRules:
   allowAny:
diff --git a/scripts/build-cli-archive.ts b/scripts/build-cli-archive.ts
index c56106871385..1367c27c180d 100644
--- a/scripts/build-cli-archive.ts
+++ b/scripts/build-cli-archive.ts
@@ -30,6 +30,8 @@ import {
   STAGE_INSTALL_ARGS,
 } from "./build-desktop-artifact.ts";
 import { selectCliRuntimeExternalDependencies } from "./lib/cli-external-packages.ts";
+import { signWithJsign } from "./lib/windows-jsign.ts";
+import { windowsSystemTar } from "./lib/windows-tar.ts";
 import { resolveCatalogDependencies } from "./lib/resolve-catalog.ts";
 
 const BuildPlatform = Schema.Literals(["mac", "linux", "win"]);
@@ -95,11 +97,6 @@ export function cliArchiveFileName(version: string, platform: BuildPlatform, arc
   return `${cliArchiveStem(version, platform, arch)}.${platform === "win" ? "zip" : "tar.gz"}`;
 }
 
-export function windowsSystemTar(): string {
-  const systemRoot = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
-  return `${systemRoot}\\System32\\tar.exe`;
-}
-
 const runCommand = Effect.fn("runCommand")(function* (
   command: ChildProcess.Command,
   label: string,
@@ -411,6 +408,11 @@ const signWindowsExecutable = Effect.fn("signWindowsExecutable")(function* (
     return;
   }
   yield* stripStaleAuthenticodeEntry(executablePath);
+  if ((yield* HostProcess.Platform) !== "win32") {
+    yield* signWithJsign(executablePath);
+    yield* Effect.log("[cli-archive] Signed t3.exe (Azure Trusted Signing via jsign).");
+    return;
+  }
   const quote = (value: string) => `'${value.replaceAll("'", "''")}'`;
   const script = [
     "$ErrorActionPreference = 'Stop';",
@@ -507,7 +509,14 @@ const buildCliArchive = Effect.fn("buildCliArchive")(function* (input: {
     cliArchiveFileName(input.version, input.platform, input.arch),
   );
   yield* fs.remove(archivePath, { force: true });
-  if (input.platform === "win") {
+  if (input.platform === "win" && hostPlatform !== "win32") {
+    yield* runCommand(
+      ChildProcess.make("zip", ["-q", "-r", "-X", path.resolve(archivePath), stem], {
+        cwd: stageRoot,
+      }),
+      "zip",
+    );
+  } else if (input.platform === "win") {
     // Windows ships bsdtar, which writes zip natively. Name it by path: under
     // the Git Bash shell CI uses, a bare `tar` is GNU tar, which neither
     // writes zip nor accepts a drive-letter path.
diff --git a/scripts/build-desktop-artifact.test.ts b/scripts/build-desktop-artifact.test.ts
index 77cf9ba3a26e..7bf7fbe173e0 100644
--- a/scripts/build-desktop-artifact.test.ts
+++ b/scripts/build-desktop-artifact.test.ts
@@ -83,6 +83,7 @@ import {
   LinuxBrowserSecretHostError,
   stageBrowserSecret,
   validateWindowsPackagedPayload,
+  verifyPackagedBundleIsSelfContained,
   WindowsPrimaryNativeProbeError,
   WindowsDesktopBuildPrerequisitesMissingError,
   WindowsPackagedPayloadValidationError,
@@ -2063,21 +2064,44 @@ it.layer(NodeServices.layer)("build-desktop-artifact", (it) => {
   it.effect("rejects a sidecar whose extracted server bundle cannot resolve", () =>
     Effect.scoped(
       Effect.gen(function* () {
+        const path = yield* Path.Path;
         const fixture = yield* makeWindowsPayloadFixture({
           copyUnpackedNatives: true,
           serverEntrySource: 'import "t3code-deliberately-missing-package";\n',
         });
-        const error = yield* validateWindowsPackagedPayload({
-          stageDistDir: fixture.stageDistDir,
-          appExecutableName: fixture.appExecutableName,
-          targetArch: "x64",
-          appVersion: WINDOWS_PAYLOAD_FIXTURE_VERSION,
+        const error = yield* verifyPackagedBundleIsSelfContained({
+          asarPath: path.join(fixture.packagedAppDir, "resources", WINDOWS_SERVER_ASAR_RESOURCE),
+          verbose: false,
         }).pipe(Effect.flip);
 
         assert.instanceOf(error, BundleNotSelfContainedError);
         assert.include(error.output, "t3code-deliberately-missing-package");
       }),
-    ).pipe(Effect.provideService(HostProcess.Platform, "linux")),
+    ),
+  );
+
+  it.effect("leaves the bundle self-check of a cross-built payload to the verify job", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fixture = yield* makeWindowsPayloadFixture({
+          copyUnpackedNatives: true,
+          serverEntrySource: 'import "t3code-deliberately-missing-package";\n',
+        });
+        yield* validateWindowsPackagedPayload({
+          stageDistDir: fixture.stageDistDir,
+          appExecutableName: fixture.appExecutableName,
+          targetArch: "arm64",
+          appVersion: WINDOWS_PAYLOAD_FIXTURE_VERSION,
+        });
+      }),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          Layer.succeed(HostProcess.Platform, "linux"),
+          Layer.succeed(HostProcess.Architecture, "x64"),
+        ),
+      ),
+    ),
   );
 
   it.effect("preserves both Linux icon resize failures with structural context", () => {
@@ -2438,6 +2462,40 @@ it.layer(NodeServices.layer)("build-desktop-artifact", (it) => {
     }).pipe(Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env: {} })))),
   );
 
+  it.effect("signs Windows builds with signtool on Windows and the jsign hook elsewhere", () =>
+    Effect.gen(function* () {
+      const signedWinConfig = (hostPlatform: string) =>
+        createBuildConfig("win", "nsis", "1.2.3", true, false, undefined, undefined).pipe(
+          Effect.map((config) => config.win as Record<string, unknown>),
+          Effect.provideService(HostProcess.Platform, hostPlatform),
+        );
+
+      const onWindows = yield* signedWinConfig("win32");
+      assert.equal((onWindows.azureSignOptions as Record<string, unknown>).publisherName, "T3");
+      assert.notProperty(onWindows, "signtoolOptions");
+
+      const onLinux = yield* signedWinConfig("linux");
+      assert.notProperty(onLinux, "azureSignOptions");
+      const signtoolOptions = onLinux.signtoolOptions as Record<string, unknown>;
+      assert.match(signtoolOptions.sign as string, /scripts[\\/]lib[\\/]windows-jsign\.ts$/);
+      assert.deepStrictEqual(signtoolOptions.signingHashAlgorithms, ["sha256"]);
+      assert.deepStrictEqual(signtoolOptions.publisherName, ["T3"]);
+    }).pipe(
+      Effect.provide(
+        ConfigProvider.layer(
+          ConfigProvider.fromEnv({
+            env: {
+              AZURE_TRUSTED_SIGNING_PUBLISHER_NAME: "T3",
+              AZURE_TRUSTED_SIGNING_ENDPOINT: "https://eus.codesigning.azure.net/",
+              AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME: "profile",
+              AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: "account",
+            },
+          }),
+        ),
+      ),
+    ),
+  );
+
   it("stages the resource monitor as an external executable resource", () => {
     assert.deepStrictEqual(DESKTOP_EXTRA_RESOURCES, [
       {
diff --git a/scripts/build-desktop-artifact.ts b/scripts/build-desktop-artifact.ts
index 66f05377c323..d2cff4726345 100644
--- a/scripts/build-desktop-artifact.ts
+++ b/scripts/build-desktop-artifact.ts
@@ -2247,7 +2247,7 @@ export const copyDirectoryPreservingSymlinks = Effect.fn("copyDirectoryPreservin
   },
 );
 
-const verifyPackagedBundleIsSelfContained = Effect.fn("verifyPackagedBundleIsSelfContained")(
+export const verifyPackagedBundleIsSelfContained = Effect.fn("verifyPackagedBundleIsSelfContained")(
   function* (input: { readonly asarPath: string; readonly verbose: boolean }) {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -3017,8 +3017,16 @@ export const createBuildConfig = Effect.fn("createBuildConfig")(function* (
       // packaged executable with Electron's stock icon.
       signAndEditExecutable: true,
     };
-    if (signed) {
+    if (signed && (yield* HostProcess.Platform) === "win32") {
       winConfig.azureSignOptions = yield* AzureTrustedSigningOptionsConfig;
+    } else if (signed) {
+      const path = yield* Path.Path;
+      const { publisherName } = yield* AzureTrustedSigningOptionsConfig;
+      winConfig.signtoolOptions = {
+        sign: yield* path.fromFileUrl(new URL("./lib/windows-jsign.ts", import.meta.url)),
+        signingHashAlgorithms: ["sha256"],
+        publisherName: [publisherName],
+      };
     }
     buildConfig.win = winConfig;
   }
@@ -3345,6 +3353,32 @@ export const verifyWindowsPrimaryFffNativeLoad = Effect.fn(
   );
 });
 
+/**
+ * The fff probe needs a host of the target's platform and architecture; the
+ * bundle self-check needs a Windows host. A cross build defers both to
+ * scripts/verify-windows-desktop-artifact.ts.
+ */
+export const verifyWindowsPackagedRuntime = Effect.fn(
+  "desktopArtifact.verifyWindowsPackagedRuntime",
+)(function* (input: {
+  readonly packagedAppDir: string;
+  readonly appExecutableName: string;
+  readonly targetArch: typeof BuildArch.Type;
+  readonly verbose: boolean;
+}) {
+  const path = yield* Path.Path;
+  const asarPath = path.join(input.packagedAppDir, "resources", WINDOWS_SERVER_ASAR_RESOURCE);
+  yield* verifyWindowsPrimaryFffNativeLoad({ ...input, asarPath });
+  const hostPlatform = yield* HostProcess.Platform;
+  if (hostPlatform !== "win32") {
+    yield* Effect.log(
+      `[desktop-artifact] Skipped the bundle self-check on a ${hostPlatform} host.`,
+    );
+    return;
+  }
+  yield* verifyPackagedBundleIsSelfContained({ asarPath, verbose: input.verbose });
+});
+
 export const validateWindowsPackagedPayload = Effect.fn(
   "desktopArtifact.validateWindowsPackagedPayload",
 )(function* (input: {
@@ -3558,19 +3592,13 @@ export const validateWindowsPackagedPayload = Effect.fn(
     });
   }
 
-  yield* verifyWindowsPrimaryFffNativeLoad({
+  yield* verifyWindowsPackagedRuntime({
     packagedAppDir,
-    asarPath,
     appExecutableName: input.appExecutableName,
     targetArch: input.targetArch,
     verbose: input.verbose ?? false,
   });
 
-  yield* verifyPackagedBundleIsSelfContained({
-    asarPath,
-    verbose: input.verbose ?? false,
-  });
-
   yield* Effect.log(
     `[desktop-artifact] Validated Windows payload (${String(fileCount)} files, ${String(unpackedFiles.length)} sidecar natives).`,
   );
@@ -3993,6 +4021,13 @@ const buildDesktopArtifactUnlocked = Effect.fn("buildDesktopArtifactUnlocked")(f
     // takes seconds on a many-core runner instead of about two minutes.
     buildEnv.XZ_DEFAULTS = "-T0";
   }
+  if (options.platform === "win") {
+    // Windows signs only through Azure Trusted Signing. Off Windows,
+    // electron-builder's signtool manager would read CSC_LINK (the macOS
+    // certificate) as a Windows certificate.
+    delete buildEnv.CSC_LINK;
+    delete buildEnv.CSC_KEY_PASSWORD;
+  }
   if (!options.signed) {
     buildEnv.CSC_IDENTITY_AUTO_DISCOVERY = "false";
     delete buildEnv.CSC_LINK;
diff --git a/scripts/build-npm-launcher.ts b/scripts/build-npm-launcher.ts
index e12186e90abb..0f226a943f5e 100644
--- a/scripts/build-npm-launcher.ts
+++ b/scripts/build-npm-launcher.ts
@@ -26,7 +26,7 @@ import * as HostProcess from "@t3tools/shared/HostProcess";
 import { fromJsonStringPretty } from "@t3tools/shared/schemaJson";
 import serverPackageJson from "../apps/server/package.json" with { type: "json" };
 
-import { windowsSystemTar } from "./build-cli-archive.ts";
+import { windowsSystemTar } from "./lib/windows-tar.ts";
 
 export const NPM_LAUNCHER_PACKAGE_NAME = "t3";
 
diff --git a/scripts/lib/windows-jsign.ts b/scripts/lib/windows-jsign.ts
new file mode 100644
index 000000000000..9b3d1fcfcfe6
--- /dev/null
+++ b/scripts/lib/windows-jsign.ts
@@ -0,0 +1,65 @@
+// Azure Trusted Signing from a non-Windows host. The Windows-only path is
+// electron-builder's azureSignOptions (PowerShell + signtool.exe); this one is
+// electron-builder's `win.signtoolOptions.sign` hook and the CLI archive's
+// signer. jsign reads AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET
+// itself when no --storepass is given.
+
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+export class JsignFailedError extends Schema.TaggedError<JsignFailedError>()("JsignFailedError", {
+  file: Schema.String,
+  exitCode: Schema.Number,
+}) {
+  override get message() {
+    return `jsign exited with code ${String(this.exitCode)} signing ${this.file}.`;
+  }
+}
+
+export const signWithJsign = Effect.fn("signWithJsign")(function* (file: string) {
+  const { jsign, endpoint, account, profile } = yield* Config.all({
+    jsign: Config.String("T3CODE_JSIGN").pipe(Config.withDefault("jsign")),
+    endpoint: Config.String("AZURE_TRUSTED_SIGNING_ENDPOINT"),
+    account: Config.String("AZURE_TRUSTED_SIGNING_ACCOUNT_NAME"),
+    profile: Config.String("AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME"),
+  });
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const child = yield* spawner.spawn(
+    ChildProcess.make(
+      jsign,
+      [
+        "--storetype",
+        "TRUSTEDSIGNING",
+        "--keystore",
+        new URL(endpoint).host,
+        "--alias",
+        `${account}/${profile}`,
+        "--alg",
+        "SHA-256",
+        "--tsaurl",
+        "http://timestamp.acs.microsoft.com",
+        "--tsmode",
+        "RFC3161",
+        // jsign appends a nested signature by default; signtool replaces.
+        "--replace",
+        file,
+      ],
+      { stdout: "inherit", stderr: "inherit" },
+    ),
+  );
+  const exitCode = Number(yield* child.exitCode);
+  if (exitCode !== 0) {
+    return yield* new JsignFailedError({ file, exitCode });
+  }
+});
+
+export default function sign(configuration: { readonly path: string }): Promise<void> {
+  return signWithJsign(configuration.path).pipe(
+    Effect.scoped,
+    Effect.provide(NodeServices.layer),
+    Effect.runPromise,
+  );
+}
diff --git a/scripts/lib/windows-tar.ts b/scripts/lib/windows-tar.ts
new file mode 100644
index 000000000000..8d2417f90d02
--- /dev/null
+++ b/scripts/lib/windows-tar.ts
@@ -0,0 +1,4 @@
+export function windowsSystemTar(): string {
+  const systemRoot = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+  return `${systemRoot}\\System32\\tar.exe`;
+}
diff --git a/scripts/package.json b/scripts/package.json
index 6e9c79abdb69..d401f8683822 100644
--- a/scripts/package.json
+++ b/scripts/package.json
@@ -21,6 +21,7 @@
     "@effect/vitest": "catalog:",
     "@types/plist": "catalog:",
     "@types/pngjs": "6.0.5",
+    "esbuild": "0.28.2",
     "typescript": "catalog:",
     "typescript-legacy": "npm:typescript@~6.0.3",
     "vite-plus": "catalog:"
diff --git a/scripts/smoke-cli-archive.ts b/scripts/smoke-cli-archive.ts
index dd545b967175..7c994153469b 100644
--- a/scripts/smoke-cli-archive.ts
+++ b/scripts/smoke-cli-archive.ts
@@ -16,7 +16,7 @@ import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
 import * as NetService from "@t3tools/shared/Net";
 import * as HostProcess from "@t3tools/shared/HostProcess";
-import { windowsSystemTar } from "./build-cli-archive.ts";
+import { windowsSystemTar } from "./lib/windows-tar.ts";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
 
 export class CliArchiveSmokeError extends Schema.TaggedError<CliArchiveSmokeError>()(
diff --git a/scripts/verify-windows-desktop-artifact.ts b/scripts/verify-windows-desktop-artifact.ts
new file mode 100644
index 000000000000..2867a9389ed6
--- /dev/null
+++ b/scripts/verify-windows-desktop-artifact.ts
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+// Runs the native-load probes a cross-built Windows desktop artifact skipped,
+// on a host of the target's architecture.
+
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import { Command, Flag } from "effect/cli";
+
+import {
+  resolveDesktopProductName,
+  verifyWindowsPackagedRuntime,
+} from "./build-desktop-artifact.ts";
+
+const verifyWindowsDesktopArtifactCli = Command.make("verify-windows-desktop-artifact", {
+  appDir: Flag.String("app-dir").pipe(
+    Flag.withDescription("The electron-builder `win-<arch>-unpacked` directory."),
+  ),
+  arch: Flag.Literals("arch", ["arm64", "x64"] as const),
+  buildVersion: Flag.String("build-version").pipe(
+    Flag.withDescription("The artifact's build version."),
+  ),
+  verbose: Flag.Boolean("verbose").pipe(Flag.withDefault(false)),
+}).pipe(
+  Command.withDescription("Verify a Windows desktop artifact's packaged natives load."),
+  Command.withHandler(({ appDir, arch, buildVersion, verbose }) =>
+    Effect.gen(function* () {
+      yield* verifyWindowsPackagedRuntime({
+        packagedAppDir: appDir,
+        appExecutableName: `${resolveDesktopProductName(buildVersion)}.exe`,
+        targetArch: arch,
+        verbose,
+      });
+      yield* Effect.log(`[verify-windows-desktop-artifact] ${appDir} passed.`);
+    }),
+  ),
+);
+
+// No import.meta.main guard: CI bundles this file into one module together with
+// build-desktop-artifact.ts, whose own guard is defined false in that bundle.
+Command.run(verifyWindowsDesktopArtifactCli, { version: "0.0.0" }).pipe(
+  Effect.scoped,
+  Effect.provide(Layer.mergeAll(Logger.layer([Logger.consolePretty()]), NodeServices.layer)),
+  NodeRuntime.runMain,
+);
diff --git a/vite.config.ts b/vite.config.ts
index 1d20d404656b..b6d286e307fd 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -188,10 +188,8 @@ export default defineConfig({
         rules: { "t3code/prefer-effect-fn": "off" },
       },
       {
-        // Warns while the remaining web component tests move to apps/web/test/render.tsx.
-        // Raise to "error" once `vp lint` reports no t3code(require-disposable-render) warnings.
-        files: ["apps/web/**/*.test.tsx"],
-        rules: { "t3code/require-disposable-render": "warn" },
+        files: ["apps/web/**/*.test.{ts,tsx}"],
+        rules: { "t3code/require-disposable-render": "error" },
       },
       {
         files: ["apps/**/src/**", "packages/**/src/**"],