diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index c8c5dbd..7947e96 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,4 +1,4 @@
-<!-- Thanks for contributing to DevHarbor! Keep PRs focused — one logical change each. -->
+<!-- Thanks for contributing to DevHarbor! Keep PRs focused - one logical change each. -->
 
 ## What & why
 
@@ -8,8 +8,8 @@
 
 - [ ] `pnpm typecheck` passes
 - [ ] `pnpm test` passes
-- [ ] Verified in the running app (`pnpm dev`) — if this touches UI or behaviour
-- [ ] Updated the relevant `specs/` file + `specs/PROGRESS.md` — if behaviour changed
+- [ ] Verified in the running app (`pnpm dev`) - if this touches UI or behaviour
+- [ ] Updated the relevant `specs/` file + `specs/PROGRESS.md` - if behaviour changed
 
 ## Notes
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..cdda6ab
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,54 @@
+name: CI
+
+# Typecheck + tests on every push to main and every PR. Until now the only workflow was the
+# tag-triggered release, so build/test rot (or a contributor's broken PR) was only discovered
+# during a signed release run (IMPROVEMENT-PLAN 12.1). CONTRIBUTING.md promises `pnpm test`
+# must pass before merge - this enforces it.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    # macOS matches the release runner so the better-sqlite3 / node-pty electron-rebuild
+    # postinstall is exercised the same way it will be at release time.
+    runs-on: macos-14
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python 3.11 (node-gyp needs distutils)
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Test
+        run: pnpm test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff4f3d5..a7c4b52 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,21 +24,37 @@ jobs:
     runs-on: macos-14
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      # node-gyp 9 (used by @electron/rebuild when compiling native modules — e.g. node-pty
+      # Guard (tag pushes only): a release must be cut from a v* tag whose number matches
+      # package.json. Manual workflow_dispatch runs skip the guard but build with
+      # --publish never (see the build step) - a safe dry-run for testing the pipeline.
+      - name: Guard - tag matches package.json version
+        if: github.event_name == 'push'
+        run: |
+          if [[ "${GITHUB_REF}" != refs/tags/v* ]]; then
+            echo "::error::Releases must be cut from a v* tag (got ${GITHUB_REF})."; exit 1
+          fi
+          VERSION=$(grep -m1 '"version"' package.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+          TAG="${GITHUB_REF_NAME#v}"
+          if [ "${VERSION}" != "${TAG}" ]; then
+            echo "::error::package.json version (${VERSION}) does not match tag (${TAG})."; exit 1
+          fi
+          echo "Releasing v${VERSION} from tag ${GITHUB_REF_NAME}."
+
+      # node-gyp 9 (used by @electron/rebuild when compiling native modules - e.g. node-pty
       # for the cross-arch x64 build) imports the stdlib `distutils`, which Python 3.12
       # removed (PEP 632). macos-14 runners default to 3.12, so pin 3.11 which still has it.
       - name: Set up Python 3.11 (node-gyp needs distutils)
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: 10
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
@@ -67,11 +83,13 @@ jobs:
         # ~103MB arm64 DMG; Intel users the x64 DMG. electron-builder writes a single
         # latest-mac.yml listing both zips, and electron-updater fetches the slice that
         # matches the running machine. Smaller downloads than a combined universal binary.
-        run: pnpm exec electron-vite build && pnpm exec electron-builder --mac --arm64 --x64 --publish always
+        # Tag pushes publish; manual dispatch runs are dry-runs (build + sign only, artifacts
+        # uploaded by the next step) so the pipeline can be exercised without touching releases.
+        run: pnpm exec electron-vite build && pnpm exec electron-builder --mac --arm64 --x64 --publish ${{ github.event_name == 'push' && 'always' || 'never' }}
 
       - name: Upload artifacts (as backup)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: mac-dmg
           path: |
diff --git a/.prettierignore b/.prettierignore
new file mode 100644
index 0000000..ddbd3e2
--- /dev/null
+++ b/.prettierignore
@@ -0,0 +1,15 @@
+# Generated / machine-managed
+pnpm-lock.yaml
+dist/
+out/
+node_modules/
+*.tsbuildinfo
+
+# Hand-formatted corpora a blanket `pnpm format` must not churn:
+# specs are the project's source-of-truth documents; the workflows are the signed
+# release pipeline; CHANGELOG follows keep-a-changelog conventions.
+specs/
+.github/
+CHANGELOG.md
+README.md
+electron-builder.yml
diff --git a/.prettierrc.json b/.prettierrc.json
new file mode 100644
index 0000000..0ac7c30
--- /dev/null
+++ b/.prettierrc.json
@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "printWidth": 100,
+  "tabWidth": 2
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c084ac..59a0bf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,19 +6,86 @@ All notable changes to DevHarbor are documented here. The format is based on
 
 ## [Unreleased]
 
-## [1.0.1] — 2026-06-07
+## [1.1.0] - 2026-06-14
+
+A hardening + feature release driven by a comprehensive internal audit (see
+`specs/IMPROVEMENT-PLAN.md`).
+
+> **Downgrading:** after running 1.1.0 once, secret env values are encrypted at rest and the
+> database schema is upgraded. Going back to 1.0.x is not supported - export a backup first
+> (Settings → Danger zone → Export) if you want a safety net.
+
+### Added
+- **Menubar (tray) presence** - see aggregate state at a glance; start/stop any app, see its
+  ports, or stop everything without opening the window. Toggle in Settings.
+- **Desktop notifications** when an app crashes (on by default) and, optionally, when an app
+  becomes ready.
+- **Bulk import** - point DevHarbor at a folder of repos and register every detected project
+  in one pass (sidebar `+` menu, ⌘K, or the welcome screen).
+- **Global log search (⌘⇧F)** - search every running task's logs at once; jump to the app.
+- **Monorepo detection** - pnpm/yarn/npm workspaces are detected on add, with a one-click
+  "create a task per workspace package" option.
+- **Launch at login** and per-app **start automatically** toggles.
+- **Start all / Stop all** per folder, and keyboard reordering for folders (Move up / down).
+- **Quit confirmation** that gracefully stops running servers (SIGTERM → grace → kill) before
+  exiting - auto-update installs included.
+- **Port-conflict callout** - a crash caused by a busy port now names the port and, when
+  known, which app holds it.
+- Update banner shows **release notes** before "Quit & install"; **Check for Updates…** and
+  **Open Logs Folder** in the Help menu; update checks repeat every 6 h on long-running Macs.
+- Local **diagnostics log** (`~/Library/Logs/DevHarbor/`) for bug reports - local-only, in
+  keeping with the no-telemetry promise.
+- Window size and position are remembered across launches.
+
+### Changed
+- **Secret env values are encrypted at rest** (macOS Keychain-backed `safeStorage`); existing
+  plaintext secrets are migrated on first launch.
+- Project `.env` files can no longer override env vars you set in DevHarbor, nor
+  process-control variables (`PATH`, `NODE_OPTIONS`, `DYLD_*`) - the UI is the source of
+  truth, and a checked-in `.env` can't hijack the spawned process.
+- `.env` parsing now matches dotenv semantics: multiline quoted values (PEM keys), `export `
+  prefixes, and trailing comments; `.env.development` / `.env.development.local` variants
+  load in the conventional order.
+- Stopping a task now signals the **whole process tree** (graceful SIGTERM first), so dev
+  servers get a clean shutdown instead of skipping straight to a hard kill.
+- Hardened packaged binaries: Electron fuses disable `ELECTRON_RUN_AS_NODE`, `NODE_OPTIONS`,
+  and `--inspect`; app code loads only from the asar archive.
+- Keyboard + screen-reader support across the app: focus-trapped dialogs with Escape,
+  arrow-key menus and comboboxes, focusable sidebar rows, accessible status indicators,
+  screen-reader-readable logs, and a light terminal theme.
+- Faster under load: batched process polling (one `ps`/`lsof` per tick instead of dozens of
+  forks), a global log-memory budget, render-throttled log filtering, and log streaming only
+  for visible tasks.
+
+### Fixed
+- **Restart-on-change** now works (the file watcher had been silently inert after a
+  dependency major bump) - with regression tests.
+- Apps that had ever run can be **removed** again; lifecycle errors (missing Node version,
+  moved folder, no tasks) now surface as messages from every view instead of failing silently.
+- A failed start no longer leaves the app stuck on "Starting"; Stop is instant even while an
+  app is still starting; readiness probes time out instead of hanging forever.
+- One-shot tasks (`exit` readiness) are no longer marked ready before they finish.
+- Deleted task env vars no longer resurrect after a relaunch; task-scoped overrides of an
+  app-level key now save correctly.
+- Database export/reset are WAL-safe (backups no longer miss recent changes); a corrupt
+  database produces a recovery dialog instead of a silent no-window launch.
+- Env editor warns before discarding unsaved changes and confirms saves; long app names
+  truncate instead of breaking layouts; the welcome screen no longer flashes on startup for
+  existing users; many smaller fixes.
+
+## [1.0.1] - 2026-06-07
 
 ### Changed
 - Canonical website domain is now **www.devharbor.app** (About panel, Help menu, repo homepage).
 
-## [1.0.0] — 2026-06-07
+## [1.0.0] - 2026-06-07
 
 First public stable release: code-signed, notarized, and auto-updating.
 
 ### Added
 - **Code-signed + notarized** macOS builds with hardened runtime; **per-architecture** (Apple Silicon + Intel) DMG/zip artifacts and GitHub-based **auto-update** via `electron-updater`.
-- **Folders** in the sidebar — group apps, drag to reorder, rename/delete, collapse; a glowing dot marks collapsed folders that contain a running app.
-- **Tags** — chip input with autocomplete in app settings; group the sidebar by tag, filter on the dashboard, and search tags in ⌘P.
+- **Folders** in the sidebar - group apps, drag to reorder, rename/delete, collapse; a glowing dot marks collapsed folders that contain a running app.
+- **Tags** - chip input with autocomplete in app settings; group the sidebar by tag, filter on the dashboard, and search tags in ⌘P.
 - **Group-by switcher** (Folder ⇄ Tag) and a **shared sort** (Name · Recently used · Running first) across the sidebar and dashboard.
 - **Folder picker** combobox in app settings (select existing or create new).
 - Open-source community files (CONTRIBUTING, Code of Conduct, Security policy, issue/PR templates).
@@ -31,12 +98,12 @@ First public stable release: code-signed, notarized, and auto-updating.
 - Detail-page lifecycle buttons read **Start app / Stop app / Restart app**.
 
 ### Fixed
-- Stopped apps now read **Stopped/Crashed** consistently — including after the teardown window and across app restarts (persisted from run history) — instead of flickering back to Idle.
+- Stopped apps now read **Stopped/Crashed** consistently - including after the teardown window and across app restarts (persisted from run history) - instead of flickering back to Idle.
 - Single-instance relaunch always surfaces a window (no more "running but no window" dead state).
 - Smaller install: renderer libraries are bundled, not double-shipped as `node_modules` (asar ~40 MB → ~4 MB).
 - Numerous correctness fixes from an internal review (atomic app-add, env parsing, stale stats, navigation origin checks, folder-state drift).
 
-## [0.1.0] — 2026-05-30
+## [0.1.0] - 2026-05-30
 
 First public preview. macOS-only (Apple Silicon).
 
@@ -50,7 +117,8 @@ First public preview. macOS-only (Apple Silicon).
 - Dashboard control room, folder organization, and a ⌘K command palette.
 - Local-only storage (SQLite). No accounts, no telemetry.
 
-[Unreleased]: https://github.com/jainath/devharbor/compare/v1.0.1...HEAD
+[Unreleased]: https://github.com/jainath/devharbor/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/jainath/devharbor/compare/v1.0.1...v1.1.0
 [1.0.1]: https://github.com/jainath/devharbor/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/jainath/devharbor/compare/v0.1.0...v1.0.0
 [0.1.0]: https://github.com/jainath/devharbor/releases/tag/v0.1.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2d0feda..73d0479 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,7 +1,7 @@
 # Contributing to DevHarbor
 
 Thanks for your interest in DevHarbor! This is a macOS-first desktop app for managing
-local Node.js dev servers. Contributions of all kinds are welcome — bug reports, fixes,
+local Node.js dev servers. Contributions of all kinds are welcome - bug reports, fixes,
 features, docs, and design feedback.
 
 By participating you agree to abide by our [Code of Conduct](CODE_OF_CONDUCT.md).
@@ -20,11 +20,11 @@ pnpm test          # vitest
 
 ## Prerequisites
 
-- **macOS** (Apple Silicon or Intel). The app is macOS-only today — it relies on
+- **macOS** (Apple Silicon or Intel). The app is macOS-only today - it relies on
   `lsof`/`pgrep`, `open -a`, and Unix Node-manager paths. Windows/Linux are not supported
   yet (see the roadmap).
 - **Node 22+** (an `.nvmrc` pins the version) and **pnpm** (`npm i -g pnpm`).
-- **Xcode Command Line Tools** (`xcode-select --install`) — needed to rebuild the native
+- **Xcode Command Line Tools** (`xcode-select --install`) - needed to rebuild the native
   modules (`better-sqlite3`, `node-pty`).
 
 If `pnpm install` fails rebuilding native modules, see
@@ -37,7 +37,7 @@ src/main/        Electron main process (services, IPC, DB, menu)
 src/preload/     contextBridge API surface
 src/renderer/    React UI (components, store, hooks)
 src/shared/      shared types + the typed IPC contract (ipc.ts)
-specs/           the source of truth — read before non-trivial work
+specs/           the source of truth - read before non-trivial work
 ```
 
 ## The specs are the source of truth
@@ -48,16 +48,16 @@ DevHarbor is **spec-driven**. Before non-trivial work, read the relevant file in
 [`specs/PROGRESS.md`](specs/PROGRESS.md) for the current build status.
 
 Quick map:
-- [`specs/01-architecture.md`](specs/01-architecture.md) — process model, IPC, stack
-- [`specs/02-data-model.md`](specs/02-data-model.md) — SQLite schema + core types
-- [`specs/03-features.md`](specs/03-features.md) — every feature with acceptance criteria
-- [`specs/04-ui.md`](specs/04-ui.md) — screens, layout, interactions
+- [`specs/01-architecture.md`](specs/01-architecture.md) - process model, IPC, stack
+- [`specs/02-data-model.md`](specs/02-data-model.md) - SQLite schema + core types
+- [`specs/03-features.md`](specs/03-features.md) - every feature with acceptance criteria
+- [`specs/04-ui.md`](specs/04-ui.md) - screens, layout, interactions
 
 ## Development workflow
 
 1. **Fork** the repo and create a branch off `main`:
    `git checkout -b fix/short-description`
-2. Make your change. Keep it focused — one logical change per PR.
+2. Make your change. Keep it focused - one logical change per PR.
 3. **Match the surrounding code.** Follow existing naming, comment density, and idioms.
 4. Run the checks locally:
    ```bash
@@ -76,7 +76,7 @@ Quick map:
   `sandbox: true`. Don't loosen these.
 - **Native modules** (`better-sqlite3`, `node-pty`) must be rebuilt for Electron's ABI
   (`pnpm rebuild`), not Node's.
-- **Zustand selectors must return stable references** — `?? []` / `?? {}` inside a
+- **Zustand selectors must return stable references** - `?? []` / `?? {}` inside a
   selector causes infinite re-render loops. Use module-level constants.
 
 ## Tests
@@ -95,7 +95,7 @@ Quick map:
 ## Reporting bugs / requesting features
 
 Use the [issue templates](.github/ISSUE_TEMPLATE/). For security issues, **do not open a
-public issue** — see [SECURITY.md](SECURITY.md).
+public issue** - see [SECURITY.md](SECURITY.md).
 
 ## License
 
@@ -104,4 +104,4 @@ By contributing, you agree that your contributions will be licensed under the pr
 submit the work under that license.
 
 Note the [trademark policy](TRADEMARK.md): the code is AGPL, but the **DevHarbor name and logo
-are not** — forks must ship under a different name.
+are not** - forks must ship under a different name.
diff --git a/README.md b/README.md
index 5d12c8f..d5f92b0 100644
--- a/README.md
+++ b/README.md
@@ -4,47 +4,66 @@
 [![Platform: macOS](https://img.shields.io/badge/platform-macOS%20(Apple%20Silicon%20%2B%20Intel)-black.svg)](#install)
 [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 
-**A harbor for your local dev servers.** macOS-first desktop app for managing local Node.js projects. Register your apps once, then start/stop/restart them, switch Node versions per project, edit env vars, watch logs, organize them into folders, and see what's running — all without leaving one window.
+**A harbor for your local dev servers.** macOS-first desktop app for managing local Node.js projects. Register your apps once, then start/stop/restart them, switch Node versions per project, edit env vars, watch logs, organize them into folders, and see what's running, all without leaving one window.
 
-Think of it like a "Postman for your local dev servers." Everything stays local — no accounts, no cloud, no telemetry.
+Think of it like a "Postman for your local dev servers." Everything stays local: no accounts, no cloud, no telemetry.
 
 Website: [www.devharbor.app](https://www.devharbor.app)
 
+## Highlights
+
+- **Register once, run forever** - point DevHarbor at a project (or **import a whole folder
+  of repos** at once); it detects the package manager, Node version, scripts, and `.env`
+  files. Monorepos get an offer to create a task per workspace package.
+- **Multi-task apps** - services start in dependency order with readiness signals (port,
+  log regex, exit, delay) and stop gracefully in reverse - whole process tree, no orphans.
+- **The right Node, every time** - per-app version resolution across nvm / fnm / Volta /
+  asdf / system, honoring `.nvmrc` / `engines.node`.
+- **Live in the menubar** - see what's running, start/stop apps, and check ports without
+  opening the window; desktop notifications when something crashes.
+- **Logs that work like a terminal** - xterm rendering with search, a regex filter view,
+  and **⌘⇧F to search across every running app at once**. Crash banners pin the last
+  output and call out port conflicts by name.
+- **Layered env vars** - global → app → task, with `.env` watching and secret values
+  **encrypted at rest** (macOS Keychain). Your settings always win over a repo's `.env`.
+- **Keyboard-first** - ⌘K palette, folders/tags, dashboard with live CPU/memory, per-app
+  auto-start + launch at login, signed/notarized builds with auto-update.
+
 ## Install
 
 macOS (Apple Silicon or Intel). From [**Releases**](https://github.com/jainath/devharbor/releases),
-download `devharbor-<version>-arm64.dmg` for Apple Silicon (M-series) or `…-x64.dmg` for Intel,
+download `DevHarbor-<version>-arm64.dmg` for Apple Silicon (M-series) or `…-x64.dmg` for Intel,
 open it, and drag DevHarbor to Applications. (Not sure? Apple menu →  About This Mac → "Chip" says
 "Apple" for arm64.)
 
-> Releases are signed with a Developer ID and notarized by Apple, so they open normally — no right-click bypass needed.
+> Releases are signed with a Developer ID and notarized by Apple, so they open normally - no right-click bypass needed.
 
 ## Contributing
 
-Contributions welcome! Start with [CONTRIBUTING.md](CONTRIBUTING.md) — it covers dev setup
+Contributions welcome! Start with [CONTRIBUTING.md](CONTRIBUTING.md) - it covers dev setup
 (`pnpm install && pnpm dev`), the spec-driven workflow, and the PR checklist. Please also
 read the [Code of Conduct](CODE_OF_CONDUCT.md). For security issues, see [SECURITY.md](SECURITY.md).
 
 ## Status
 
-See [`specs/PROGRESS.md`](specs/PROGRESS.md) for the build-status matrix — that file is authoritative.
+See [`specs/PROGRESS.md`](specs/PROGRESS.md) for the build-status matrix - that file is authoritative.
 
 The `specs/` folder is the source of truth for this project. See [`specs/WORKFLOW.md`](specs/WORKFLOW.md) for the rules of the road (read-before / update-before-code, step-back review after every change, etc.).
 
 ## Where to start
 
-1. [`specs/WORKFLOW.md`](specs/WORKFLOW.md) — how we work
-2. [`specs/PROGRESS.md`](specs/PROGRESS.md) — what's actually built right now
-3. [`specs/00-overview.md`](specs/00-overview.md) — problem, goals, non-goals
-4. [`specs/01-architecture.md`](specs/01-architecture.md) — tech stack, process model, IPC
-5. [`specs/02-data-model.md`](specs/02-data-model.md) — SQLite schema and core types (incl. multi-task model)
-6. [`specs/03-features.md`](specs/03-features.md) — every feature, with acceptance criteria
-7. [`specs/04-ui.md`](specs/04-ui.md) — screens, layout, key interactions
-8. [`specs/05-roadmap.md`](specs/05-roadmap.md) — phased delivery plan
+1. [`specs/WORKFLOW.md`](specs/WORKFLOW.md) - how we work
+2. [`specs/PROGRESS.md`](specs/PROGRESS.md) - what's actually built right now
+3. [`specs/00-overview.md`](specs/00-overview.md) - problem, goals, non-goals
+4. [`specs/01-architecture.md`](specs/01-architecture.md) - tech stack, process model, IPC
+5. [`specs/02-data-model.md`](specs/02-data-model.md) - SQLite schema and core types (incl. multi-task model)
+6. [`specs/03-features.md`](specs/03-features.md) - every feature, with acceptance criteria
+7. [`specs/04-ui.md`](specs/04-ui.md) - screens, layout, key interactions
+8. [`specs/05-roadmap.md`](specs/05-roadmap.md) - phased delivery plan
 
 ## Stack (as built)
 
-Electron 33 + Vite + React 18 + TypeScript · Tailwind 3 (hand-rolled components; theme via semantic CSS variables driven by the **Radix Colors slate scale** — same palette family shadcn/ui, Linear, and Vercel use) · Zustand · better-sqlite3 · `@homebridge/node-pty-prebuilt-multiarch` · `@xterm/xterm` (+ fit, search, webgl) · chokidar · pidusage · `package-manager-detector` · cmdk · react-window + anser · electron-builder + electron-updater · Vitest.
+Electron 33 + Vite + React 18 + TypeScript · Tailwind 3 (hand-rolled components; theme via semantic CSS variables driven by the **Radix Colors slate scale** - same palette family shadcn/ui, Linear, and Vercel use) · Zustand · better-sqlite3 · `@homebridge/node-pty-prebuilt-multiarch` · `@xterm/xterm` (+ fit, search, webgl) · chokidar · pidusage · `package-manager-detector` · cmdk · react-window + anser · electron-builder + electron-updater · Vitest.
 
 See [`specs/01-architecture.md`](specs/01-architecture.md) for the full rationale and [`specs/PROGRESS.md`](specs/PROGRESS.md) for current build status.
 
@@ -52,9 +71,9 @@ See [`specs/01-architecture.md`](specs/01-architecture.md) for the full rational
 
 [GNU AGPL-3.0](LICENSE) © 2026 Jainath Ponnala
 
-DevHarbor is free and open source. You may use, study, modify, and share it — but if you
+DevHarbor is free and open source. You may use, study, modify, and share it - but if you
 distribute a modified version, or run a modified version as a network service, you must release
 your source under the same AGPL-3.0 license. See [`LICENSE`](LICENSE) for the full terms.
 
-The **name "DevHarbor" and its logo are trademarks** and are *not* covered by the AGPL — see
+The **name "DevHarbor" and its logo are trademarks** and are *not* covered by the AGPL - see
 [`TRADEMARK.md`](TRADEMARK.md). Forks are welcome, but please ship them under a different name.
diff --git a/RELEASE.md b/RELEASE.md
index 3c7066f..2ecf17b 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -2,7 +2,7 @@
 
 DevHarbor ships as a **code-signed, notarized** macOS app and auto-updates from
 **GitHub Releases** via `electron-updater`. Releases are triggered by pushing a
-`v*` tag — GitHub Actions builds, signs, notarizes, and publishes the artifacts.
+`v*` tag - GitHub Actions builds, signs, notarizes, and publishes the artifacts.
 
 ## One-time setup
 
@@ -55,19 +55,33 @@ git push origin main --tags
 ```
 
 The `Release` workflow (`.github/workflows/release.yml`) runs on `macos-14`, builds
-**arm64 + x64** (`--mac --arm64 --x64 --publish always`), signs + notarizes, and creates
+**arm64 + x64** (`--mac --arm64 --x64`), signs + notarizes, and creates
 the GitHub Release with `*.dmg`, `*.zip`, `*.blockmap`, and `latest-mac.yml`.
 
-> The git **tag** must match `package.json` `version` (prefixed with `v`) or
-> `electron-builder` will reject the publish.
+> A guard step fails the workflow unless it was triggered by a `v*` **tag whose number
+> matches `package.json` `version`** - so a stale version bump is caught before any
+> signing/publishing happens.
+
+### Dry-run the pipeline (no publish)
+
+Trigger the workflow manually (**Actions → Release → Run workflow**, any branch). Manual
+dispatch runs skip the tag guard and build with `--publish never`: the full
+build + sign + notarize path is exercised and the artifacts are uploaded to the workflow
+run (not to a Release). Use this to validate toolchain changes - runner images, action
+versions, certificate renewals - without burning a version number.
+
+### CI
+
+`.github/workflows/ci.yml` runs typecheck, ESLint, and the test suite on every push/PR to
+`main` (also on `macos-14`, so the native-module rebuild path matches the release runner).
 
 ## Verify after publish
 
 1. Download the `arm64` (Apple Silicon) or `x64` (Intel) `.dmg` from the Release on a
-   clean Mac — it should open **without** the right-click→Open bypass (proves notarization).
+   clean Mac - it should open **without** the right-click→Open bypass (proves notarization).
 2. Auto-update: install the *previous* version, launch it, and confirm the in-app
    updater detects, downloads, and installs the new one. (Auto-update only works on
-   **signed** builds — `squirrel.mac` verifies the Developer ID signature.)
+   **signed** builds - `squirrel.mac` verifies the Developer ID signature.)
 
 ## Artifacts & channels
 
diff --git a/SECURITY.md b/SECURITY.md
index 27ad0de..485debd 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,7 +11,7 @@ DevHarbor is in active development. Only the latest released version receives fi
 
 ## Reporting an issue
 
-Please report security concerns **privately** — do **not** open a public GitHub issue.
+Please report security concerns **privately** - do **not** open a public GitHub issue.
 
 - Preferred: GitHub's **[private vulnerability reporting](https://github.com/jainath/devharbor/security/advisories/new)**
   (repo → **Security** tab → **Report a vulnerability**).
diff --git a/TRADEMARK.md b/TRADEMARK.md
index df08302..6bc235b 100644
--- a/TRADEMARK.md
+++ b/TRADEMARK.md
@@ -13,7 +13,7 @@ licensed under the AGPL-3.0 and are **not** part of the open-source grant.
 
 - Use the Marks to **refer to** the official DevHarbor project (e.g. "compatible with DevHarbor",
   "based on DevHarbor"), as long as it's truthful and doesn't imply endorsement or affiliation.
-- Fork and modify the source code under the AGPL — that's encouraged.
+- Fork and modify the source code under the AGPL - that's encouraged.
 
 ## What you need to do when you fork or redistribute
 
@@ -24,7 +24,7 @@ If you distribute a modified version (a fork, a rebuild, a derivative product),
 - Not use the DevHarbor logo or brand assets in your distribution.
 - Make clear it is your build, not the official project.
 
-(Unmodified builds straight from this repository may keep the DevHarbor name — this restriction
+(Unmodified builds straight from this repository may keep the DevHarbor name - this restriction
 is about *modified* or *competing* distributions.)
 
 ## Why
diff --git a/build/entitlements.mac.plist b/build/entitlements.mac.plist
index f875a5b..0f6c71e 100644
--- a/build/entitlements.mac.plist
+++ b/build/entitlements.mac.plist
@@ -16,19 +16,14 @@
     <key>com.apple.security.cs.allow-dyld-environment-variables</key>
     <true/>
     <!--
-      The two exceptions below are broad — candidates to TRIM, but only after a real notarized
-      build confirms the app still launches and loads the unpacked native .node modules:
-      - disable-library-validation: likely required because better-sqlite3 / node-pty / pidusage
-        ship as upstream prebuilt binaries not signed by this Team ID. Drop only if they get
-        re-signed with the Developer ID during the electron-builder sign step (verify with
-        `codesign -dv` on the .node files in the packaged .app).
-      - disable-executable-page-protection: most permissive; usually unneeded once allow-jit +
-        allow-unsigned-executable-memory are present. Try removing this one first.
+      disable-library-validation is retained because better-sqlite3 / node-pty / pidusage ship
+      as upstream prebuilt binaries not signed by this Team ID. (disable-executable-page-protection
+      was removed — IMPROVEMENT-PLAN 6.3 — as the most permissive of the set and unneeded once
+      allow-jit + allow-unsigned-executable-memory are present; re-add only if a notarized build
+      fails to launch.)
     -->
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
-    <key>com.apple.security.cs.disable-executable-page-protection</key>
-    <true/>
     <key>com.apple.security.files.user-selected.read-write</key>
     <true/>
     <key>com.apple.security.inherit</key>
diff --git a/build/fuses.cjs b/build/fuses.cjs
new file mode 100644
index 0000000..019f9dc
--- /dev/null
+++ b/build/fuses.cjs
@@ -0,0 +1,33 @@
+const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses');
+const path = require('node:path');
+
+/**
+ * electron-builder afterPack hook - runs AFTER packaging but BEFORE code-signing, so the
+ * fuse flips are covered by the signature. Disables the generic-Node-interpreter escape
+ * hatches that would otherwise let any local process execute arbitrary code under DevHarbor's
+ * signed + notarized + entitled identity (IMPROVEMENT-PLAN 6.2):
+ *   - RunAsNode (ELECTRON_RUN_AS_NODE), NODE_OPTIONS, and --inspect → OFF
+ *   - OnlyLoadAppFromAsar → ON (refuse to run loose app code)
+ *   - Cookie encryption → ON
+ *
+ * EnableEmbeddedAsarIntegrityValidation is intentionally NOT flipped here: it requires the
+ * asar integrity header to be embedded and verified, which can fail launch if the toolchain
+ * doesn't embed it - enable only after a notarized build is confirmed to launch with it.
+ */
+exports.default = async function afterPack(context) {
+  const { electronPlatformName, appOutDir } = context;
+  if (electronPlatformName !== 'darwin') return;
+
+  const appName = context.packager.appInfo.productFilename; // "DevHarbor"
+  const electronBinary = path.join(appOutDir, `${appName}.app`, 'Contents', 'MacOS', appName);
+
+  await flipFuses(electronBinary, {
+    version: FuseVersion.V1,
+    resetAdHocDarwinSignature: true, // clear Electron's ad-hoc sig so electron-builder re-signs
+    [FuseV1Options.RunAsNode]: false,
+    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+    [FuseV1Options.EnableNodeCliInspectArguments]: false,
+    [FuseV1Options.OnlyLoadAppFromAsar]: true,
+    [FuseV1Options.EnableCookieEncryption]: true
+  });
+};
diff --git a/build/notarize.cjs b/build/notarize.cjs
index dfc6990..9631e7e 100644
--- a/build/notarize.cjs
+++ b/build/notarize.cjs
@@ -17,7 +17,7 @@ exports.default = async function notarizing(context) {
 
   if (!appleId || !appleIdPassword || !teamId) {
     console.warn(
-      '[notarize] APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID not set — skipping notarization.'
+      '[notarize] APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID not set - skipping notarization.'
     );
     return;
   }
diff --git a/electron-builder.yml b/electron-builder.yml
index 0a4e6f8..07c5459 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -18,12 +18,12 @@ files:
   - "!postcss.config.{js,cjs}"
   - "!tailwind.config.{js,ts}"
   - "!{tsconfig.json,tsconfig.node.json,tsconfig.web.json,tsconfig.web.tsbuildinfo,tsconfig.node.tsbuildinfo}"
-  - "!{.eslintrc.cjs,.prettierignore,.prettierrc.yaml,CHANGELOG.md,README.md,LICENSE}"
+  - "!{eslint.config.mjs,.prettierrc.json,.prettierignore,vitest.config.ts,CHANGELOG.md,README.md,LICENSE}"
   - "!{.env,.env.*,.npmrc,pnpm-lock.yaml,.nvmrc,.gitignore}"
 
 asar: true
 
-# Native modules MUST be unpacked from asar — they can't be loaded from inside a
+# Native modules MUST be unpacked from asar - they can't be loaded from inside a
 # packed archive. electron-builder usually detects these automatically; we list
 # them explicitly for safety and clarity.
 asarUnpack:
@@ -59,14 +59,20 @@ mac:
         CFBundleURLSchemes:
           - devharbor
 
+# Harden Electron fuses on the packaged binary BEFORE signing (afterPack runs pre-sign), so
+# the flips are covered by the code signature. See build/fuses.cjs.
+afterPack: build/fuses.cjs
+
 # Notarization: electron-builder reads APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD /
 # APPLE_TEAM_ID env vars at build time. If they're set, the .app is automatically
 # notarized + stapled after signing. If unset, the build skips notarization with a
-# warning — fine for local unsigned dev builds.
+# warning - fine for local unsigned dev builds.
 afterSign: build/notarize.cjs
 
 dmg:
-  artifactName: ${name}-${version}-${arch}.dmg
+  # ${productName} (DevHarbor) - matches the zip naming so the user-facing dmg isn't the odd
+  # lowercase one out (IMPROVEMENT-PLAN 13.5).
+  artifactName: ${productName}-${version}-${arch}.dmg
   contents:
     - x: 130
       y: 220
diff --git a/eslint.config.mjs b/eslint.config.mjs
new file mode 100644
index 0000000..07f686a
--- /dev/null
+++ b/eslint.config.mjs
@@ -0,0 +1,41 @@
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import reactHooks from 'eslint-plugin-react-hooks';
+
+/**
+ * Flat ESLint config. The repo previously had ZERO linting yet shipped 4 production
+ * `eslint-disable` comments that suppressed nothing (IMPROVEMENT-PLAN 12.2) - those now do
+ * their job. Kept intentionally lenient (most stylistic checks are warnings, not errors) so
+ * CI gates on real problems without forcing a mass refactor of an already-disciplined codebase.
+ */
+export default tseslint.config(
+  {
+    ignores: [
+      'dist/**',
+      'out/**',
+      'node_modules/**',
+      'build/**',
+      'specs/**',
+      '*.config.{js,cjs,mjs,ts}',
+      'postcss.config.cjs',
+      '**/*.tsbuildinfo'
+    ]
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    plugins: { 'react-hooks': reactHooks },
+    rules: {
+      ...reactHooks.configs.recommended.rules,
+      '@typescript-eslint/no-unused-vars': [
+        'warn',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_', caughtErrors: 'none' }
+      ],
+      '@typescript-eslint/no-explicit-any': 'warn',
+      '@typescript-eslint/no-empty-object-type': 'off',
+      'no-empty': ['warn', { allowEmptyCatch: true }],
+      'no-control-regex': 'off',
+      'prefer-const': 'warn'
+    }
+  }
+);
diff --git a/package.json b/package.json
index 3bb1c28..15d9693 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "devharbor",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "private": true,
-  "description": "DevHarbor — a harbor for your local dev servers. Desktop app for managing local Node.js projects on macOS.",
+  "description": "DevHarbor - a harbor for your local dev servers. Desktop app for managing local Node.js projects on macOS.",
   "author": "Jainath Ponnala",
   "license": "AGPL-3.0-only",
   "homepage": "https://www.devharbor.app",
@@ -21,6 +21,10 @@
     "typecheck:node": "tsc --noEmit -p tsconfig.node.json",
     "typecheck:web": "tsc --noEmit -p tsconfig.web.json",
     "typecheck": "pnpm typecheck:node && pnpm typecheck:web",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
     "test": "vitest run",
     "test:watch": "vitest",
     "rebuild": "electron-rebuild -f -w better-sqlite3,@homebridge/node-pty-prebuilt-multiarch",
@@ -30,7 +34,7 @@
     "pack:mac:universal": "electron-vite build && electron-builder --mac --universal"
   },
   "comments": {
-    "dependencies": "ONLY main-process / native modules that electron-vite externalizes belong here — electron-builder ships every production dependency into the asar as raw node_modules. Renderer-only libs (react, lucide-react, xterm, etc.) are bundled into out/renderer by Vite, so they live in devDependencies to avoid being shipped twice (lucide-react alone is 3,500+ files)."
+    "dependencies": "ONLY main-process / native modules that electron-vite externalizes belong here - electron-builder ships every production dependency into the asar as raw node_modules. Renderer-only libs (react, lucide-react, xterm, etc.) are bundled into out/renderer by Vite, so they live in devDependencies to avoid being shipped twice (lucide-react alone is 3,500+ files)."
   },
   "dependencies": {
     "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",
@@ -38,16 +42,20 @@
     "chokidar": "^5.0.0",
     "electron-updater": "^6.8.3",
     "package-manager-detector": "^1.6.0",
+    "picomatch": "^4.0.4",
     "pidusage": "^4.0.1",
     "semver": "^7.8.1",
     "tree-kill": "^1.2.2",
     "ulid": "^2.3.0"
   },
   "devDependencies": {
+    "@electron/fuses": "^1.8.0",
     "@electron/notarize": "^3.1.1",
     "@electron/rebuild": "^3.7.0",
+    "@eslint/js": "^9.39.4",
     "@types/better-sqlite3": "^7.6.11",
     "@types/node": "^22.9.0",
+    "@types/picomatch": "^3.0.2",
     "@types/pidusage": "^2.0.5",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
@@ -66,14 +74,18 @@
     "electron": "^33.2.0",
     "electron-builder": "^25.1.8",
     "electron-vite": "^2.3.0",
+    "eslint": "^9.39.4",
+    "eslint-plugin-react-hooks": "^5.2.0",
     "lucide-react": "^0.460.0",
     "postcss": "^8.4.49",
+    "prettier": "^3.8.4",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-window": "^2.2.7",
     "tailwind-merge": "^2.5.4",
     "tailwindcss": "^3.4.15",
     "typescript": "^5.6.3",
+    "typescript-eslint": "^8.61.0",
     "vite": "^5.4.11",
     "vitest": "^2.1.9",
     "zustand": "^5.0.1"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e33a9e3..4c65f4f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,6 +23,9 @@ importers:
       package-manager-detector:
         specifier: ^1.6.0
         version: 1.6.0
+      picomatch:
+        specifier: ^4.0.4
+        version: 4.0.4
       pidusage:
         specifier: ^4.0.1
         version: 4.0.1
@@ -36,18 +39,27 @@ importers:
         specifier: ^2.3.0
         version: 2.4.0
     devDependencies:
+      '@electron/fuses':
+        specifier: ^1.8.0
+        version: 1.8.0
       '@electron/notarize':
         specifier: ^3.1.1
         version: 3.1.1
       '@electron/rebuild':
         specifier: ^3.7.0
         version: 3.7.2
+      '@eslint/js':
+        specifier: ^9.39.4
+        version: 9.39.4
       '@types/better-sqlite3':
         specifier: ^7.6.11
         version: 7.6.13
       '@types/node':
         specifier: ^22.9.0
         version: 22.19.19
+      '@types/picomatch':
+        specifier: ^3.0.2
+        version: 3.0.2
       '@types/pidusage':
         specifier: ^2.0.5
         version: 2.0.5
@@ -102,12 +114,21 @@ importers:
       electron-vite:
         specifier: ^2.3.0
         version: 2.3.0(vite@5.4.21(@types/node@22.19.19))
+      eslint:
+        specifier: ^9.39.4
+        version: 9.39.4(jiti@1.21.7)
+      eslint-plugin-react-hooks:
+        specifier: ^5.2.0
+        version: 5.2.0(eslint@9.39.4(jiti@1.21.7))
       lucide-react:
         specifier: ^0.460.0
         version: 0.460.0(react@18.3.1)
       postcss:
         specifier: ^8.4.49
         version: 8.5.15
+      prettier:
+        specifier: ^3.8.4
+        version: 3.8.4
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -126,6 +147,9 @@ importers:
       typescript:
         specifier: ^5.6.3
         version: 5.9.3
+      typescript-eslint:
+        specifier: ^8.61.0
+        version: 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
       vite:
         specifier: ^5.4.11
         version: 5.4.21(@types/node@22.19.19)
@@ -243,6 +267,10 @@ packages:
     engines: {node: '>=10.12.0'}
     hasBin: true
 
+  '@electron/fuses@1.8.0':
+    resolution: {integrity: sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==}
+    hasBin: true
+
   '@electron/get@2.0.3':
     resolution: {integrity: sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==}
     engines: {node: '>=12'}
@@ -418,6 +446,44 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.2':
+    resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@9.39.4':
+    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@gar/promisify@1.1.3':
     resolution: {integrity: sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==}
 
@@ -425,6 +491,26 @@ packages:
     resolution: {integrity: sha512-ccQ60nMcbEGrQh0U9E6x0ajW9qJNeazpcM/9CH6J8leyNtJgb+gu24WTBAfBUVeO486ZhscnaxLEITI2HXwhow==}
     engines: {node: '>=18.0.0 <25.0.0'}
 
+  '@humanfs/core@0.19.2':
+    resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.8':
+    resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/types@0.15.0':
+    resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
@@ -854,6 +940,9 @@ packages:
   '@types/http-cache-semantics@4.2.0':
     resolution: {integrity: sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q==}
 
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
   '@types/keyv@3.1.4':
     resolution: {integrity: sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
 
@@ -866,6 +955,9 @@ packages:
   '@types/node@22.19.19':
     resolution: {integrity: sha512-dyh/xO2Fh5bYrfWaaqGrRQQGkNdmYw6AmaAUvYeUMNTWQtvb796ikLdmTchRmOlOiIJ1TDXfWgVx1QkUlQ6Hew==}
 
+  '@types/picomatch@3.0.2':
+    resolution: {integrity: sha512-n0i8TD3UDB7paoMMxA3Y65vUncFJXjcUf7lQY7YyKGl6031FNjfsLs6pdLFCy2GNFxItPJG8GvvpbZc2skH7WA==}
+
   '@types/pidusage@2.0.5':
     resolution: {integrity: sha512-MIiyZI4/MK9UGUXWt0jJcCZhVw7YdhBuTOuqP/BjuLDLZ2PmmViMIQgZiWxtaMicQfAz/kMrZ5T7PKxFSkTeUA==}
 
@@ -899,6 +991,65 @@ packages:
   '@types/yauzl@2.10.3':
     resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==}
 
+  '@typescript-eslint/eslint-plugin@8.61.0':
+    resolution: {integrity: sha512-bFNvl9ZczlVb+wR2Akszf3gHfKVj/8WanXaGJ3UstTA7brNKg0cNdk6X1Psu5V7MZ2oQtzZKOEzIUehaoxbDGw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.61.0
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/parser@8.61.0':
+    resolution: {integrity: sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/project-service@8.61.0':
+    resolution: {integrity: sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/scope-manager@8.61.0':
+    resolution: {integrity: sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.61.0':
+    resolution: {integrity: sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/type-utils@8.61.0':
+    resolution: {integrity: sha512-TuBiQYIkd97yBfInHCTKVYMbX4kvEmpOEuixIuzCU9p8BGT1SfyyO0d0IfDMbPIHcjn/hWnusUX5e8v5Xg+X8A==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/types@8.61.0':
+    resolution: {integrity: sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.61.0':
+    resolution: {integrity: sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.61.0':
+    resolution: {integrity: sha512-3bzFt7ImFMW/jVYwJamDoe/dMOdFLSC6pom6rRjdh4SZJEYupyMzem8e7vKZLclLfpHjlwSAXOUxtKxGXUiLqA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/visitor-keys@8.61.0':
+    resolution: {integrity: sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@vitejs/plugin-react@4.7.0':
     resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
     engines: {node: ^14.18.0 || >=16.0.0}
@@ -953,6 +1104,16 @@ packages:
   abbrev@1.1.1:
     resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==}
 
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn@8.17.0:
+    resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
   agent-base@6.0.2:
     resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
     engines: {node: '>= 6.0.0'}
@@ -1173,6 +1334,10 @@ packages:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
 
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
   camelcase-css@2.0.1:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
@@ -1348,6 +1513,9 @@ packages:
     resolution: {integrity: sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==}
     engines: {node: '>=4.0.0'}
 
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
   defaults@1.0.4:
     resolution: {integrity: sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
 
@@ -1505,9 +1673,61 @@ packages:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
 
+  eslint-plugin-react-hooks@5.2.0:
+    resolution: {integrity: sha512-+f15FfK64YQwZdJNELETdn5ibXEUQmW1DZL6KXhNnc2heoy/sg9VJJeT7n8TlMWouzWqSWavFkIhHyIbIAEapg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@5.0.1:
+    resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+
+  eslint@9.39.4:
+    resolution: {integrity: sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esquery@1.7.0:
+    resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
   estree-walker@3.0.3:
     resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
 
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
   expand-template@2.0.3:
     resolution: {integrity: sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==}
     engines: {node: '>=6'}
@@ -1538,6 +1758,9 @@ packages:
   fast-json-stable-stringify@2.1.0:
     resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
 
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
   fastq@1.20.1:
     resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
 
@@ -1553,6 +1776,10 @@ packages:
       picomatch:
         optional: true
 
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
   file-uri-to-path@1.0.0:
     resolution: {integrity: sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==}
 
@@ -1563,6 +1790,17 @@ packages:
     resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
     engines: {node: '>=8'}
 
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
+
   foreground-child@3.3.1:
     resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
     engines: {node: '>=14'}
@@ -1666,6 +1904,10 @@ packages:
     resolution: {integrity: sha512-PT6XReJ+D07JvGoxQMkT6qji/jVNfX/h364XHZOWeRzy64sSFr+xJ5OX7LI3b4MPQzdL4H8Y8M0xzPpsVMwA8Q==}
     engines: {node: '>=10.0'}
 
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
   globalthis@1.0.4:
     resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
     engines: {node: '>= 0.4'}
@@ -1745,6 +1987,18 @@ packages:
   ieee754@1.2.1:
     resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
 
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
   imurmurhash@0.1.4:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
@@ -1853,6 +2107,9 @@ packages:
   json-schema-traverse@0.4.1:
     resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
 
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
   json-stringify-safe@5.0.1:
     resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
 
@@ -1877,6 +2134,10 @@ packages:
     resolution: {integrity: sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==}
     engines: {node: '>= 0.6.3'}
 
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
   lilconfig@3.1.3:
     resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
     engines: {node: '>=14'}
@@ -1884,6 +2145,10 @@ packages:
   lines-and-columns@1.2.4:
     resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
 
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
   lodash.defaults@4.2.0:
     resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==}
 
@@ -1903,6 +2168,9 @@ packages:
   lodash.isplainobject@4.0.6:
     resolution: {integrity: sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==}
 
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
   lodash.union@4.6.0:
     resolution: {integrity: sha512-c4pB2CdGrGdjMKYLA+XiRDO7Y0PRQbm/Gzg8qMj+QH+pFVAoTp5sBpO0odL3FjoPCGjK96p6qsP+yQoiLoOBcw==}
 
@@ -2067,6 +2335,9 @@ packages:
   napi-build-utils@2.0.0:
     resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
 
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
   negotiator@0.6.4:
     resolution: {integrity: sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==}
     engines: {node: '>= 0.6'}
@@ -2130,6 +2401,10 @@ packages:
     resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
     engines: {node: '>=6'}
 
+  optionator@0.9.4:
+    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
+    engines: {node: '>= 0.8.0'}
+
   ora@5.4.1:
     resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
     engines: {node: '>=10'}
@@ -2142,6 +2417,10 @@ packages:
     resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
     engines: {node: '>=10'}
 
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
   p-map@4.0.0:
     resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
     engines: {node: '>=10'}
@@ -2152,6 +2431,14 @@ packages:
   package-manager-detector@1.6.0:
     resolution: {integrity: sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==}
 
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
   path-is-absolute@1.0.1:
     resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
     engines: {node: '>=0.10.0'}
@@ -2261,6 +2548,15 @@ packages:
     deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
     hasBin: true
 
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prettier@3.8.4:
+    resolution: {integrity: sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==}
+    engines: {node: '>=14'}
+    hasBin: true
+
   proc-log@2.0.1:
     resolution: {integrity: sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
@@ -2387,6 +2683,10 @@ packages:
   resolve-alpn@1.2.1:
     resolution: {integrity: sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
 
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
   resolve@1.22.12:
     resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
     engines: {node: '>= 0.4'}
@@ -2565,6 +2865,10 @@ packages:
     resolution: {integrity: sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==}
     engines: {node: '>=0.10.0'}
 
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
   sucrase@3.35.1:
     resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
     engines: {node: '>=16 || 14 >=14.17'}
@@ -2655,6 +2959,12 @@ packages:
   truncate-utf8-bytes@1.0.2:
     resolution: {integrity: sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==}
 
+  ts-api-utils@2.5.0:
+    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
   ts-interface-checker@0.1.13:
     resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
 
@@ -2664,10 +2974,21 @@ packages:
   tunnel-agent@0.6.0:
     resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
 
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
   type-fest@0.13.1:
     resolution: {integrity: sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==}
     engines: {node: '>=10'}
 
+  typescript-eslint@8.61.0:
+    resolution: {integrity: sha512-8y31Rd0eGTrDKqhy6vT0HtzhN+YLjQizwX3aA3hPXP/ynSfnrBXcQY5IzsP9/DM7+klX4IUncZZjkchP0z+rUw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   typescript@5.9.3:
     resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
     engines: {node: '>=14.17'}
@@ -2812,6 +3133,10 @@ packages:
   wide-align@1.1.5:
     resolution: {integrity: sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==}
 
+  word-wrap@1.2.5:
+    resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
+    engines: {node: '>=0.10.0'}
+
   wrap-ansi@7.0.0:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
@@ -3008,6 +3333,12 @@ snapshots:
       glob: 7.2.3
       minimatch: 3.1.5
 
+  '@electron/fuses@1.8.0':
+    dependencies:
+      chalk: 4.1.2
+      fs-extra: 9.1.0
+      minimist: 1.2.8
+
   '@electron/get@2.0.3':
     dependencies:
       debug: 4.4.3
@@ -3185,6 +3516,52 @@ snapshots:
   '@esbuild/win32-x64@0.21.5':
     optional: true
 
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.4(jiti@1.21.7))':
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.2':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.5':
+    dependencies:
+      ajv: 6.15.0
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.1.1
+      minimatch: 3.1.5
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@9.39.4': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
   '@gar/promisify@1.1.3': {}
 
   '@homebridge/node-pty-prebuilt-multiarch@0.13.1':
@@ -3192,6 +3569,22 @@ snapshots:
       node-addon-api: 7.1.1
       prebuild-install: 7.1.3
 
+  '@humanfs/core@0.19.2':
+    dependencies:
+      '@humanfs/types': 0.15.0
+
+  '@humanfs/node@0.16.8':
+    dependencies:
+      '@humanfs/core': 0.19.2
+      '@humanfs/types': 0.15.0
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanfs/types@0.15.0': {}
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
   '@isaacs/cliui@8.0.2':
     dependencies:
       string-width: 5.1.2
@@ -3546,6 +3939,8 @@ snapshots:
 
   '@types/http-cache-semantics@4.2.0': {}
 
+  '@types/json-schema@7.0.15': {}
+
   '@types/keyv@3.1.4':
     dependencies:
       '@types/node': 22.19.19
@@ -3560,6 +3955,8 @@ snapshots:
     dependencies:
       undici-types: 6.21.0
 
+  '@types/picomatch@3.0.2': {}
+
   '@types/pidusage@2.0.5': {}
 
   '@types/plist@3.0.5':
@@ -3600,6 +3997,97 @@ snapshots:
       '@types/node': 22.19.19
     optional: true
 
+  '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.61.0
+      '@typescript-eslint/type-utils': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.0
+      eslint: 9.39.4(jiti@1.21.7)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.61.0
+      '@typescript-eslint/types': 8.61.0
+      '@typescript-eslint/typescript-estree': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.0
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.61.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.0
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.61.0':
+    dependencies:
+      '@typescript-eslint/types': 8.61.0
+      '@typescript-eslint/visitor-keys': 8.61.0
+
+  '@typescript-eslint/tsconfig-utils@8.61.0(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/type-utils@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.0
+      '@typescript-eslint/typescript-estree': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.61.0': {}
+
+  '@typescript-eslint/typescript-estree@8.61.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.0
+      '@typescript-eslint/visitor-keys': 8.61.0
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.1
+      tinyglobby: 0.2.16
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@typescript-eslint/scope-manager': 8.61.0
+      '@typescript-eslint/types': 8.61.0
+      '@typescript-eslint/typescript-estree': 8.61.0(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.61.0':
+    dependencies:
+      '@typescript-eslint/types': 8.61.0
+      eslint-visitor-keys: 5.0.1
+
   '@vitejs/plugin-react@4.7.0(vite@5.4.21(@types/node@22.19.19))':
     dependencies:
       '@babel/core': 7.29.0
@@ -3664,6 +4152,12 @@ snapshots:
 
   abbrev@1.1.1: {}
 
+  acorn-jsx@5.3.2(acorn@8.17.0):
+    dependencies:
+      acorn: 8.17.0
+
+  acorn@8.17.0: {}
+
   agent-base@6.0.2:
     dependencies:
       debug: 4.4.3
@@ -3974,6 +4468,8 @@ snapshots:
       es-errors: 1.3.0
       function-bind: 1.1.2
 
+  callsites@3.1.0: {}
+
   camelcase-css@2.0.1: {}
 
   caniuse-lite@1.0.30001793: {}
@@ -4136,6 +4632,8 @@ snapshots:
 
   deep-extend@0.6.0: {}
 
+  deep-is@0.1.4: {}
+
   defaults@1.0.4:
     dependencies:
       clone: 1.0.4
@@ -4361,13 +4859,86 @@ snapshots:
 
   escalade@3.2.0: {}
 
-  escape-string-regexp@4.0.0:
-    optional: true
+  escape-string-regexp@4.0.0: {}
+
+  eslint-plugin-react-hooks@5.2.0(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint-visitor-keys@5.0.1: {}
+
+  eslint@9.39.4(jiti@1.21.7):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.2
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.4
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.8
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
+      ajv: 6.15.0
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.7.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.5
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+    optionalDependencies:
+      jiti: 1.21.7
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.17.0
+      acorn-jsx: 5.3.2(acorn@8.17.0)
+      eslint-visitor-keys: 4.2.1
+
+  esquery@1.7.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@5.3.0: {}
 
   estree-walker@3.0.3:
     dependencies:
       '@types/estree': 1.0.8
 
+  esutils@2.0.3: {}
+
   expand-template@2.0.3: {}
 
   expect-type@1.3.0: {}
@@ -4399,6 +4970,8 @@ snapshots:
 
   fast-json-stable-stringify@2.1.0: {}
 
+  fast-levenshtein@2.0.6: {}
+
   fastq@1.20.1:
     dependencies:
       reusify: 1.1.0
@@ -4411,6 +4984,10 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.4
 
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
   file-uri-to-path@1.0.0: {}
 
   filelist@1.0.6:
@@ -4421,6 +4998,18 @@ snapshots:
     dependencies:
       to-regex-range: 5.0.1
 
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.4.2
+      keyv: 4.5.4
+
+  flatted@3.4.2: {}
+
   foreground-child@3.3.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -4559,6 +5148,8 @@ snapshots:
       serialize-error: 7.0.1
     optional: true
 
+  globals@14.0.0: {}
+
   globalthis@1.0.4:
     dependencies:
       define-properties: 1.2.1
@@ -4658,6 +5249,15 @@ snapshots:
 
   ieee754@1.2.1: {}
 
+  ignore@5.3.2: {}
+
+  ignore@7.0.5: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
   imurmurhash@0.1.4: {}
 
   indent-string@4.0.0: {}
@@ -4737,6 +5337,8 @@ snapshots:
 
   json-schema-traverse@0.4.1: {}
 
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
   json-stringify-safe@5.0.1:
     optional: true
 
@@ -4762,10 +5364,19 @@ snapshots:
     dependencies:
       readable-stream: 2.3.8
 
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
   lilconfig@3.1.3: {}
 
   lines-and-columns@1.2.4: {}
 
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
   lodash.defaults@4.2.0: {}
 
   lodash.difference@4.5.0: {}
@@ -4778,6 +5389,8 @@ snapshots:
 
   lodash.isplainobject@4.0.6: {}
 
+  lodash.merge@4.6.2: {}
+
   lodash.union@4.6.0: {}
 
   lodash@4.18.1: {}
@@ -4936,6 +5549,8 @@ snapshots:
 
   napi-build-utils@2.0.0: {}
 
+  natural-compare@1.4.0: {}
+
   negotiator@0.6.4: {}
 
   node-abi@3.92.0:
@@ -5000,6 +5615,15 @@ snapshots:
     dependencies:
       mimic-fn: 2.1.0
 
+  optionator@0.9.4:
+    dependencies:
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+      word-wrap: 1.2.5
+
   ora@5.4.1:
     dependencies:
       bl: 4.1.0
@@ -5018,6 +5642,10 @@ snapshots:
     dependencies:
       yocto-queue: 0.1.0
 
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
   p-map@4.0.0:
     dependencies:
       aggregate-error: 3.1.0
@@ -5026,6 +5654,12 @@ snapshots:
 
   package-manager-detector@1.6.0: {}
 
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  path-exists@4.0.0: {}
+
   path-is-absolute@1.0.1: {}
 
   path-key@3.1.1: {}
@@ -5117,6 +5751,10 @@ snapshots:
       tar-fs: 2.1.4
       tunnel-agent: 0.6.0
 
+  prelude-ls@1.2.1: {}
+
+  prettier@3.8.4: {}
+
   proc-log@2.0.1: {}
 
   process-nextick-args@2.0.1: {}
@@ -5236,6 +5874,8 @@ snapshots:
 
   resolve-alpn@1.2.1: {}
 
+  resolve-from@4.0.0: {}
+
   resolve@1.22.12:
     dependencies:
       es-errors: 1.3.0
@@ -5435,6 +6075,8 @@ snapshots:
 
   strip-json-comments@2.0.1: {}
 
+  strip-json-comments@3.1.1: {}
+
   sucrase@3.35.1:
     dependencies:
       '@jridgewell/gen-mapping': 0.3.13
@@ -5557,6 +6199,10 @@ snapshots:
     dependencies:
       utf8-byte-length: 1.0.5
 
+  ts-api-utils@2.5.0(typescript@5.9.3):
+    dependencies:
+      typescript: 5.9.3
+
   ts-interface-checker@0.1.13: {}
 
   tslib@2.8.1: {}
@@ -5565,9 +6211,24 @@ snapshots:
     dependencies:
       safe-buffer: 5.2.1
 
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
   type-fest@0.13.1:
     optional: true
 
+  typescript-eslint@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.61.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.0(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
   typescript@5.9.3: {}
 
   ulid@2.4.0: {}
@@ -5701,6 +6362,8 @@ snapshots:
     dependencies:
       string-width: 4.2.3
 
+  word-wrap@1.2.5: {}
+
   wrap-ansi@7.0.0:
     dependencies:
       ansi-styles: 4.3.0
diff --git a/specs/00-overview.md b/specs/00-overview.md
index 8d87796..762cde2 100644
--- a/specs/00-overview.md
+++ b/specs/00-overview.md
@@ -1,4 +1,4 @@
-# 00 — Overview
+# 00 - Overview
 
 ## Problem
 
@@ -8,19 +8,19 @@ Developers juggling several local Node.js services hit the same friction every d
 - "Which Node version does this repo want again?" → `nvm use`, hope `.nvmrc` is right.
 - Editing `.env` in a text editor, restarting by hand, forgetting which port a service is on.
 - No single view of "what is currently running on my machine."
-- Switching between npm / yarn / pnpm projects — easy to use the wrong one.
+- Switching between npm / yarn / pnpm projects - easy to use the wrong one.
 
 ## Vision
 
 One desktop app that knows about all your local Node.js projects and gives you a calm, dense, professional interface to run them.
 
-The product the user has in their head: "Postman, but for local dev servers." Not literally Postman — we are not an API client — but the same *feel*: a sidebar of registered things, a main area showing the active one, sensible defaults, keyboard-driven, dev-tool aesthetic.
+The product the user has in their head: "Postman, but for local dev servers." Not literally Postman - we are not an API client - but the same *feel*: a sidebar of registered things, a main area showing the active one, sensible defaults, keyboard-driven, dev-tool aesthetic.
 
 ## Primary user
 
 A working developer on macOS who:
 
-- Maintains 3–20 local Node.js projects
+- Maintains 3-20 local Node.js projects
 - Uses some combination of npm, yarn, and pnpm
 - Has nvm (or fnm, or Volta, or asdf) installed
 - Wants tighter feedback loops and less terminal-tab archaeology
@@ -30,11 +30,11 @@ A working developer on macOS who:
 1. **Register** local app directories by browsing to them.
 2. **Detect** Node version, package manager, and available scripts automatically; allow overrides.
 3. **Run** the chosen script with the correct Node version and package manager.
-4. **Stop** apps cleanly — entire process tree, no orphans.
-5. **Env vars** — global defaults + per-app overrides, layered, with `.env` file integration.
-6. **Logs** — live stdout/stderr per app, real terminal rendering, searchable history.
-7. **Dashboard** — at-a-glance view of running apps, their ports, CPU/RAM.
-8. **Dev-friendly extras** — Cmd-K palette, port detection with clickable links, restart-on-change, `.env` file watching, crash recovery actions.
+4. **Stop** apps cleanly - entire process tree, no orphans.
+5. **Env vars** - global defaults + per-app overrides, layered, with `.env` file integration.
+6. **Logs** - live stdout/stderr per app, real terminal rendering, searchable history.
+7. **Dashboard** - at-a-glance view of running apps, their ports, CPU/RAM.
+8. **Dev-friendly extras** - Cmd-K palette, port detection with clickable links, restart-on-change, `.env` file watching, crash recovery actions.
 
 ## Non-goals (explicitly out of scope for v1)
 
diff --git a/specs/01-architecture.md b/specs/01-architecture.md
index 5b12157..bf2439c 100644
--- a/specs/01-architecture.md
+++ b/specs/01-architecture.md
@@ -1,4 +1,4 @@
-# 01 — Architecture
+# 01 - Architecture
 
 ## Tech stack
 
@@ -9,7 +9,7 @@
 | Packaging | electron-builder | Mature signing/notarization/DMG/auto-update. Pairs cleanly with electron-vite. |
 | UI | React 18 + TypeScript | Default. |
 | Styling | Tailwind CSS | Dense, dev-tool aesthetic; pairs with shadcn. |
-| Components | shadcn/ui (on Radix) | We own the source — easy to make dense + customise. |
+| Components | shadcn/ui (on Radix) | We own the source - easy to make dense + customise. |
 | Renderer state | Zustand | Tiny, no Provider gymnastics, scales for this app size. |
 | IPC types | Shared `types/ipc.ts` + `electron-trpc` (deferred) | Start hand-rolled with strict types; revisit trpc if churn is high. |
 | Process spawn | `@lydell/node-pty` (prebuilt for Electron) | Real TTY → ANSI colors and TUI redraws work. No `electron-rebuild` pain. |
@@ -172,7 +172,7 @@ The preload re-exports an `api` object whose methods are 1:1 with these channel
 
 A single SQLite file at `~/Library/Application Support/devharbor/devharbor.db` (resolved via `app.getPath('userData')`). Schema in [`02-data-model.md`](02-data-model.md). Migrations live in `src/main/db/migrations/` and run in order on startup.
 
-Logs are **not** persisted to SQLite by default — they live in the ring buffer. Optional per-app "save logs to disk" writes a rotating file to `userData/logs/<appId>/<runId>.log`.
+Logs are **not** persisted to SQLite by default - they live in the ring buffer. Optional per-app "save logs to disk" writes a rotating file to `userData/logs/<appId>/<runId>.log`.
 
 ## How we run a child process (the canonical sequence)
 
@@ -181,7 +181,7 @@ Logs are **not** persisted to SQLite by default — they live in the ring buffer
    1. Look up `App` row, including resolved Node version, package manager, working dir, script.
    2. `NodeResolver.resolveBinPath(app.nodeVersion)` → absolute path like `/Users/.../.nvm/versions/node/v20.11.0/bin`.
    3. Build the env:
-      - Start from a clean object (NOT inheriting full `process.env` — too leaky).
+      - Start from a clean object (NOT inheriting full `process.env` - too leaky).
       - Inject a sanitized base: `HOME`, `USER`, `LANG`, `TMPDIR`, `SHELL`, `TERM=xterm-256color`.
       - Prepend the resolved Node bin dir to `PATH`, then the user's standard `PATH` from a one-time login-shell probe.
       - Layer in global env vars from `EnvStore`.
@@ -202,11 +202,11 @@ Logs are **not** persisted to SQLite by default — they live in the ring buffer
 
 ## Failure & recovery
 
-- App quits while children are running → on next boot, scan the DB for "was running" flags; we can't reattach to PTYs but we can show the user "these apps were running last time — restart?"
+- App quits while children are running → on next boot, scan the DB for "was running" flags; we can't reattach to PTYs but we can show the user "these apps were running last time - restart?"
 - PTY native module fails to load → fall back to plain `child_process.spawn` with `FORCE_COLOR=1`. UI shows a warning banner.
 - SQLite corruption → on open failure, back up the file to `*.corrupt.<ts>` and create a fresh DB. Surface a one-time toast.
 - Node version requested but not installed → block start; show "Install v20.11.0 with nvm" with a copy-to-clipboard command. Do not auto-install.
 
 ## Auto-update
 
-`electron-updater` configured against a GitHub releases feed (or S3 later). Code signing + notarization wired from day one — see `04-ui.md` for the in-app update banner.
+`electron-updater` configured against a GitHub releases feed (or S3 later). Code signing + notarization wired from day one - see `04-ui.md` for the in-app update banner.
diff --git a/specs/02-data-model.md b/specs/02-data-model.md
index 2e23d64..53af43e 100644
--- a/specs/02-data-model.md
+++ b/specs/02-data-model.md
@@ -1,4 +1,4 @@
-# 02 — Data Model
+# 02 - Data Model
 
 All persistent state lives in one SQLite file at `userData/devharbor.db`. In-memory state (running processes, ring buffers, pidusage samples) is **not** persisted.
 
@@ -16,12 +16,13 @@ One row per registered project.
 | `color` | TEXT | Hex like `#7aa2f7`, for the sidebar dot; auto-assigned, user-editable |
 | `icon` | TEXT | Optional emoji or short tag |
 | `node_version_pref` | TEXT | One of: `auto` (use `.nvmrc`/`.node-version`/`engines.node`), `system`, or an explicit version like `20.11.0` |
-| `package_manager` | TEXT | `npm` \| `yarn` \| `pnpm` \| `bun` — null means "detect each time" |
-| `default_script` | TEXT | e.g. `dev` — remembered between sessions |
+| `package_manager` | TEXT | `npm` \| `yarn` \| `pnpm` \| `bun` - null means "detect each time" |
+| `default_script` | TEXT | e.g. `dev` - remembered between sessions |
 | `custom_command` | TEXT | If set, used instead of `<pm> run <script>`; raw shell line |
 | `working_dir` | TEXT | Defaults to `path`; can be a subdir for monorepos |
 | `auto_restart_on_change` | INTEGER | 0/1; off by default |
 | `watch_globs` | TEXT | JSON array of globs when `auto_restart_on_change=1` |
+| `auto_start` | INTEGER | 0/1; start this app automatically when DevHarbor launches (migration `0007`, 1.1.0) |
 | `port_hint` | INTEGER | Last detected port; cached for the dashboard |
 | `tags` | TEXT | JSON array of strings |
 | `folder` | TEXT | Phase 8: visual grouping in the sidebar. NULL = "(ungrouped)". Single-level (no nesting). Tags are orthogonal facets; folder is each app's one canonical home. |
@@ -42,33 +43,41 @@ Layered key/value store. **Three scopes** since Phase 7: `global` (`app_id IS NU
 | `app_id` | TEXT FK → apps(id) ON DELETE CASCADE | NULL = global scope |
 | `task_id` | TEXT FK → tasks(id) ON DELETE CASCADE | NULL = not task-scoped. Phase 7 addition. |
 | `key` | TEXT NOT NULL | |
-| `value` | TEXT NOT NULL | Stored as text. Secrets are NOT encrypted in v1 — see Security note below. |
+| `value` | TEXT NOT NULL | Plaintext for non-secrets. Since 1.1.0 (migration `0006` era), rows with `is_secret = 1` are encrypted at rest via Electron `safeStorage` and stored as `enc1:<base64>`; decrypted transparently in `EnvStore`. Falls back to plaintext when OS encryption is unavailable. |
 | `enabled` | INTEGER NOT NULL | 0/1, allows toggling without delete |
-| `is_secret` | INTEGER NOT NULL | 0/1; masks in UI by default |
+| `is_secret` | INTEGER NOT NULL | 0/1; masks in UI, triggers at-rest encryption |
 | `note` | TEXT | Free-form |
 | `created_at` | INTEGER NOT NULL | |
 | `updated_at` | INTEGER NOT NULL | |
 
-Indices: `idx_env_vars_scope (app_id, task_id, key)`.
+Indices: `idx_env_vars_scope (app_id, task_id, key)` plus, since migration `0006`, three
+**partial unique indexes** that enforce per-scope key uniqueness correctly:
+
+- `uq_env_global` - `UNIQUE(key) WHERE app_id IS NULL AND task_id IS NULL`
+- `uq_env_app` - `UNIQUE(app_id, key) WHERE app_id IS NOT NULL AND task_id IS NULL`
+- `uq_env_task` - `UNIQUE(task_id, key) WHERE task_id IS NOT NULL`
+
+(0001's table-level `UNIQUE(app_id, key)` was dropped in `0006`: it made a task-scoped
+override of an app-scoped key - the whole point of layering - impossible to save, while
+being inert for global rows.)
 
 **Scope layering** (later wins) when `EnvBuilder` composes a task's effective env:
-1. Sanitized OS base (HOME, USER, LANG, …)
+1. Sanitized OS base (HOME, USER, LANG, SSH_AUTH_SOCK, …)
 2. User's resolved PATH (Node bin prepended)
-3. Global rows (`app_id IS NULL AND task_id IS NULL`, enabled)
-4. App rows (`app_id = ? AND task_id IS NULL`, enabled)
-5. **Task rows (`task_id = ?`, enabled)** — Phase 7
-6. `.env` / `.env.local` from cwd
+3. Project `.env` files from cwd - `.env`, `.env.development`, `.env.local`,
+   `.env.development.local` (dotenv precedence). Process-control keys (`PATH`,
+   `NODE_OPTIONS`, `NODE_PATH`, `DYLD_*`, `LD_*`) are stripped from file vars.
+4. Global rows (`app_id IS NULL AND task_id IS NULL`, enabled)
+5. App rows (`app_id = ? AND task_id IS NULL`, enabled)
+6. **Task rows (`task_id = ?`, enabled)** - Phase 7
 7. Hard-coded runtime (FORCE_COLOR, TERM)
 
-The `tasks.env_overrides` JSON column (legacy) is migrated into `env_vars` rows once at Phase 7 boot and the column is then left as inert backfill source (kept for safe rollback; no longer read at runtime).
-
-**Layering order at runtime** (later overrides earlier):
+> Changed in 1.1.0: user-configured rows now sit **above** project `.env` files (the UI is
+> the source of truth), and project files can never set process-control variables.
 
-1. Sanitized OS base env (`HOME`, `USER`, `PATH`, etc.)
-2. Global `env_vars` rows (`app_id IS NULL`, `enabled = 1`)
-3. App `env_vars` rows (`app_id = ?`, `enabled = 1`)
-4. Parsed `.env`, `.env.local`, `.env.${NODE_ENV}` from the project directory (in dotenv-cli precedence)
-5. Hard-coded runtime values (`FORCE_COLOR=1`, `TERM=xterm-256color`)
+The `tasks.env_overrides` JSON column (legacy) is migrated into `env_vars` rows on first
+read and then stamped to `'{}'`, so deleted task vars can never resurrect from the frozen
+JSON on a later boot.
 
 The UI surfaces this layering as inheritance indicators.
 
@@ -124,7 +133,7 @@ Indices: `idx_tasks_app` on `(app_id, position)`.
 - App-level Start: topo-sort enabled tasks by `depends_on`; for each task in order, wait for all predecessors to be `ready`, then spawn. Within one topological level, tasks start in `position` order.
 - App-level Stop: reverse-topo. SIGTERM each task; after the global `kill_grace_ms`, escalate to SIGKILL on the process group; `tree-kill` fallback.
 - App-level Restart: stop + wait + start with the same task set.
-- Per-task Start/Stop is also exposed (mainly for debugging — start one task without its dependents). The orchestrator does not auto-start deps when a single task is started manually.
+- Per-task Start/Stop is also exposed (mainly for debugging - start one task without its dependents). The orchestrator does not auto-start deps when a single task is started manually.
 - A non-`one_shot` task that exits is treated as crashed at the app level. The app status reflects the worst task state.
 - Cycles in `depends_on` are rejected at save time with a clear error citing the cycle.
 
@@ -287,9 +296,16 @@ export interface NodeInstallation {
 
 ## Security note on secrets
 
-In v1, env var values (including `is_secret=1`) are stored **in plaintext** in the SQLite file. The DB lives in the user's `Application Support` directory, which is protected by macOS file permissions but not encrypted at rest by us.
+Since 1.1.0, env var values with `is_secret = 1` are **encrypted at rest** using Electron's
+`safeStorage` (macOS Keychain-backed). Encrypted values are stored as `enc1:<base64>` and
+decrypted transparently inside `EnvStore`, so the editor and `EnvBuilder` always see
+plaintext. A one-shot boot migration re-encrypts any pre-1.1.0 plaintext secret rows.
+Non-secret values remain plaintext. When OS encryption is unavailable, saves fall back to
+plaintext rather than failing; an undecryptable value is returned raw, never destroyed.
 
-This is an explicit v1 trade-off: it keeps setup simple and matches what every existing dev tool in this category does (Postman, Insomnia, etc.). Phase 5+ can move secret values to the macOS Keychain via the `keytar` package, with a per-app keychain entry. The `is_secret` flag is captured now so a migration is straightforward.
+Residual exposure: decrypted values flow over typed IPC to the env editor on demand (a
+single-user desktop trade-off), and any process running as the same user can use the same
+Keychain entry. The DB lives in the user's `Application Support` directory.
 
 ## Migrations
 
@@ -298,7 +314,12 @@ This is an explicit v1 trade-off: it keeps setup simple and matches what every e
 | File | Purpose |
 |---|---|
 | `0001_init.sql` | `apps`, `env_vars`, `run_history`, `settings` + indices, seed default settings |
-| `0002_tasks.sql` | `tasks` table + index. Schema-only — no data backfill. |
+| `0002_tasks.sql` | `tasks` table + index. Schema-only - no data backfill. |
+| `0003_run_history_tasks.sql` | `run_history.task_id` + `task_name` for per-task run rows. |
+| `0004_env_task_scope.sql` | `env_vars.task_id` for the third (task) scope. |
+| `0005_app_folders.sql` | `apps.folder` for sidebar grouping. |
+| `0006_env_scope_unique.sql` | Rebuilds `env_vars` without 0001's table-level `UNIQUE(app_id,key)`; adds the three per-scope partial unique indexes (see `env_vars` above); de-dupes any pre-existing violations keeping the most recently updated row. |
+| `0007_app_autostart.sql` | `apps.auto_start` - start the app automatically when DevHarbor launches. |
 
 ### Backfill for existing apps (Phase 1.5)
 
@@ -311,7 +332,7 @@ For each app where (apps:tasks count) == 0:
   else:                     do nothing (the app will require explicit task creation)
 ```
 
-`apps.default_script` and `apps.custom_command` are retained for now as a convenience — when a user has just one task, the App-level header still shows "Script: dev" by reflecting that single task's value. A future migration can drop those columns once the UI stops referencing them directly.
+`apps.default_script` and `apps.custom_command` are retained for now as a convenience - when a user has just one task, the App-level header still shows "Script: dev" by reflecting that single task's value. A future migration can drop those columns once the UI stops referencing them directly.
 
 ### `run_history` + tasks
 
@@ -321,4 +342,4 @@ For each app where (apps:tasks count) == 0:
 ALTER TABLE run_history ADD COLUMN task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL;
 ```
 
-This goes in `0003_run_history_tasks.sql` and is Phase 2 work — included here for completeness.
+This goes in `0003_run_history_tasks.sql` and is Phase 2 work - included here for completeness.
diff --git a/specs/03-features.md b/specs/03-features.md
index 86f65fa..cdb15f1 100644
--- a/specs/03-features.md
+++ b/specs/03-features.md
@@ -1,6 +1,6 @@
-# 03 — Features
+# 03 - Features
 
-Each feature has: a one-line summary, behaviour, edge cases, and acceptance criteria. Features are grouped by area. Phase tags (P1–P4) match [`05-roadmap.md`](05-roadmap.md).
+Each feature has: a one-line summary, behaviour, edge cases, and acceptance criteria. Features are grouped by area. Phase tags (P1-P4) match [`05-roadmap.md`](05-roadmap.md).
 
 ---
 
@@ -10,14 +10,14 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 **Behaviour.**
 - "Add App" (sidebar APPS-header `+` icon + Cmd-K) opens a native folder picker (`dialog.showOpenDialog`).
-- On selection, validate: directory exists, contains a `package.json` (warn but allow if not — useful for vanilla Node scripts).
+- On selection, validate: directory exists, contains a `package.json` (warn but allow if not - useful for vanilla Node scripts).
 - Run `DetectionService.detect(path)` and pre-fill: name (dir basename), package manager (lockfile + `packageManager` field), node version (`.nvmrc` / `.node-version` / `engines.node`), discovered scripts, discovered `.env*` files.
 - **Add drawer fields (Phase 10):** the confirmation drawer is fully editable before save:
-  - **Name** — defaults to dir basename.
-  - **Node version** — `NodeVersionPicker` (Auto / System / explicit installed version). Defaults to `auto`; a hint shows the project's pinned version if `.nvmrc`/`engines.node` was detected ("recommend based on the code").
-  - **Package manager** — dropdown pre-selected to the auto-detected PM (from lockfile / `packageManager` field), with an explicit "Auto-detect each run" option and manual npm/yarn/pnpm/bun overrides.
-  - **Default script → first task** — the chosen script is **materialised into the app's first Task on save**, so the app is immediately startable. (Pre-Phase-10 bug: the script was only stored on the app row and no task existed until the next app restart, so Start failed with "No enabled tasks." Fixed by creating the task via `tasks:add` during the add flow.) Choosing "don't create a task yet" is allowed for apps with no obvious entry script.
-  - **Environment variables (optional, collapsed)** — paste a `.env` blob; applied at the app scope on save (secret keys auto-masked).
+  - **Name** - defaults to dir basename.
+  - **Node version** - `NodeVersionPicker` (Auto / System / explicit installed version). Defaults to `auto`; a hint shows the project's pinned version if `.nvmrc`/`engines.node` was detected ("recommend based on the code").
+  - **Package manager** - dropdown pre-selected to the auto-detected PM (from lockfile / `packageManager` field), with an explicit "Auto-detect each run" option and manual npm/yarn/pnpm/bun overrides.
+  - **Default script → first task** - the chosen script is **materialised into the app's first Task on save**, so the app is immediately startable. (Pre-Phase-10 bug: the script was only stored on the app row and no task existed until the next app restart, so Start failed with "No enabled tasks." Fixed by creating the task via `tasks:add` during the add flow.) Choosing "don't create a task yet" is allowed for apps with no obvious entry script.
+  - **Environment variables (optional, collapsed)** - paste a `.env` blob; applied at the app scope on save (secret keys auto-masked).
 - Auto-assign a sidebar color from a fixed palette of 12; user can change later.
 
 **Edge cases.**
@@ -30,7 +30,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 - Add an app, see it appear in the sidebar.
 - Detected values are right for a vanilla CRA/Vite/Next project without any clicks.
 - Adding a path that's already registered jumps to it instead of duplicating.
-- **After adding with a default script selected, pressing Start works immediately** — a task exists, no "No enabled tasks" error.
+- **After adding with a default script selected, pressing Start works immediately** - a task exists, no "No enabled tasks" error.
 - The package manager dropdown reflects the detected PM by default; overriding to e.g. `bun` persists on the app.
 
 ---
@@ -62,7 +62,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 **Acceptance.**
 - An app with `.nvmrc=20.11.0` starts with that exact version on PATH.
 - An app with `engines.node=">=18 <21"` and installations `18.20.0`, `19.9.0`, `21.0.0` picks `19.9.0`.
-- Removing the installed version and clicking Start surfaces a blocking error with the install command — no silent fallback.
+- Removing the installed version and clicking Start surfaces a blocking error with the install command - no silent fallback.
 
 ---
 
@@ -113,7 +113,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 - User stops while orchestration in progress → cancel pending starts, kill what's already up in reverse-topo.
 
 **Acceptance.**
-- Killing `npm run dev` reliably stops the underlying node server and any nodemon/concurrent workers — `lsof -i :3000` is empty within 6s.
+- Killing `npm run dev` reliably stops the underlying node server and any nodemon/concurrent workers - `lsof -i :3000` is empty within 6s.
 - A multi-task app: `migrate` (one-shot) → `api` (port:4000) → `web` (port:3000). Start it. `migrate` runs to exit 0, then `api` spawns, listens on 4000, then `web` spawns. Stopping the app stops `web` first, then `api`. No orphans.
 - Crashed apps stay visible (don't disappear) until acknowledged or restarted.
 
@@ -121,7 +121,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 ## F5. Script picker  *(P1)*
 
-**Summary.** Choose what to run when creating a task — from `package.json` scripts or a custom command.
+**Summary.** Choose what to run when creating a task - from `package.json` scripts or a custom command.
 
 **Behaviour.**
 - Surfaces in two places: (a) the App header for a single-task app (changes that task's script in place), (b) the task editor when adding/editing a task.
@@ -139,12 +139,12 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 ## F6. Env vars (global + per-app + per-task)  *(P3; per-task added Phase 7)*
 
-**Summary.** Three-tier layered env editor — global defaults, per-app overrides, per-task overrides — with `.env` file integration.
+**Summary.** Three-tier layered env editor - global defaults, per-app overrides, per-task overrides - with `.env` file integration.
 
 **Why three tiers (and not two).** App-level env is still essential: shared values like `DATABASE_URL`, `AUTH_SECRET`, `STRIPE_KEY` belong to the whole app, not any single task. Task-level is for values that differ between the tasks of one app (most commonly `PORT`, but also `SERVICE_URL` pointing one task at another, or per-task feature flags). Without a task tier users were forced to either (a) duplicate vars across `customCommand` env prefixes, or (b) ship `.env.local` files with mixed concerns.
 
 **Behaviour.**
-- **Three-tab editor**: **Global**, **App · {name}**, **Task · {name}**. The Task tab only appears when the editor was opened with a task context (from the task tab's right-click menu, from TaskEditor's "Env" affordance, or by clicking the task strip in the EnvEditor itself). Single-task apps may still open the Task tab — useful if you want to keep app-level shared vars separate from one task's `PORT`.
+- **Three-tab editor**: **Global**, **App · {name}**, **Task · {name}**. The Task tab only appears when the editor was opened with a task context (from the task tab's right-click menu, from TaskEditor's "Env" affordance, or by clicking the task strip in the EnvEditor itself). Single-task apps may still open the Task tab - useful if you want to keep app-level shared vars separate from one task's `PORT`.
 - Same table shape on all three: `[enabled] KEY = VALUE [is_secret] [note] [⋯]`.
 - Per-row toggle for `enabled`. Secret rows render value as `••••••` until "show" is clicked.
 - **Inheritance hints**: the App tab shows `⤴ overrides global` next to keys also defined globally. The Task tab shows `⤴ overrides app` *and* `⤴ overrides global` chips next to overridden keys. Effective-merged preview pane lists all three layers stacked.
@@ -163,7 +163,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 **Acceptance.**
 - Set `PORT=4000` on the `api` task and `PORT=5173` on the `web` task → starting the app sees each task get its own port without touching app- or global-level env.
 - Set `DEBUG=app:*` globally, `DEBUG=app:auth` on the app, `DEBUG=app:auth:trace` on one task → that one task sees `app:auth:trace`; other tasks of the same app see `app:auth`; other apps see `app:*`.
-- Touching `.env.local` in Finder triggers a banner: "`.env.local` changed on disk — reload?"
+- Touching `.env.local` in Finder triggers a banner: "`.env.local` changed on disk - reload?"
 
 ---
 
@@ -190,13 +190,13 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 ## F8. Searchable log history  *(P4)*
 
-**Summary.** A virtualized, searchable, ANSI-styled view of the same task ring buffer that powers the Live xterm. Accessed via the `[Filter]` pill inside the Logs view (not a separate top-level tab — collapsed in the post-v1 polish).
+**Summary.** A virtualized, searchable, ANSI-styled view of the same task ring buffer that powers the Live xterm. Accessed via the `[Filter]` pill inside the Logs view (not a separate top-level tab - collapsed in the post-v1 polish).
 
 **Behaviour.**
 - Backed by `react-window` + `anser`.
 - Plain-text or regex search; case-sensitive toggle; match count.
 - Switches the Logs pane content; the `[Live]` pill returns to xterm.
-- Optional "save to disk" per app (writes `<userData>/logs/<appId>/<runId>.log`) — feature toggle in Settings is wired but the actual disk-write code is deferred.
+- Optional "save to disk" per app (writes `<userData>/logs/<appId>/<runId>.log`) - feature toggle in Settings is wired but the actual disk-write code is deferred.
 
 **Acceptance.**
 - Searching for `ECONNREFUSED` across a 10 k-line buffer returns matches in <50 ms.
@@ -206,17 +206,17 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 ## F9. Dashboard / home screen  *(P3; redesigned Phase 7 / Phase 13)*
 
-**Summary.** The **control room** — an aggregate "machine load" stat strip plus a stable card grid for every registered app. Deliberately distinct from the sidebar (the navigation *switcher*). **Card height is invariant across state transitions** — clicking Start never makes anything below jump.
+**Summary.** The **control room** - an aggregate "machine load" stat strip plus a stable card grid for every registered app. Deliberately distinct from the sidebar (the navigation *switcher*). **Card height is invariant across state transitions** - clicking Start never makes anything below jump.
 
 **Behaviour.**
 
-- **Aggregate stat strip (Phase 13)** — four tiles summing across all running tasks: Running (`N / M`, teal when > 0), CPU %, Memory (MB, rolls to GB past 1024), Open ports. This is the dashboard's unique value vs the sidebar.
-- ~~**Recent strip**~~ — **removed Phase 13.** It re-listed apps the sidebar and grid already show; recency quick-access is covered by the sidebar + ⌘K. `RecentStrip.tsx` deleted.
-- **All-apps grid** — stable **alphabetical** order. Cards never auto-reorder on state changes; the user's click target stays put. **Running apps are emphasised in place** — teal inset left edge + lifted surface — never reordered, no layout shift.
+- **Aggregate stat strip (Phase 13)** - four tiles summing across all running tasks: Running (`N / M`, teal when > 0), CPU %, Memory (MB, rolls to GB past 1024), Open ports. This is the dashboard's unique value vs the sidebar.
+- ~~**Recent strip**~~ - **removed Phase 13.** It re-listed apps the sidebar and grid already show; recency quick-access is covered by the sidebar + ⌘K. `RecentStrip.tsx` deleted.
+- **All-apps grid** - stable **alphabetical** order. Cards never auto-reorder on state changes; the user's click target stays put. **Running apps are emphasised in place** - teal inset left edge + lifted surface - never reordered, no layout shift.
 - One card per app: status dot, name, state pill (RUNNING / EXITED / IDLE / CRASHED), task count, running count, CPU%, memory MB, thin CPU progress bar, port chips.
-- **Layout-stable port row (Phase 7)** — every card reserves a fixed-height port-chip row even when the app is stopped (renders an `IDLE` em-dash placeholder chip per task, or just "no ports yet" placeholder text at the same height). Reserved space prevents the card from growing/shrinking when ports come and go. The whole card has a stable min-height so cards in the same row align.
+- **Layout-stable port row (Phase 7)** - every card reserves a fixed-height port-chip row even when the app is stopped (renders an `IDLE` em-dash placeholder chip per task, or just "no ports yet" placeholder text at the same height). Reserved space prevents the card from growing/shrinking when ports come and go. The whole card has a stable min-height so cards in the same row align.
 - Click a card name → open that app's detail view.
-- **Toolbar**: `[Filter by tag ▾]  [Stop all]`. Start-all removed by request — too easy to misfire across many apps.
+- **Toolbar**: `[Filter by tag ▾]  [Stop all]`. Start-all removed by request - too easy to misfire across many apps.
 - **⌘ R / cold boot always lands on Dashboard**.
 - **Sidebar Dashboard entry** shows a green badge with the running-apps count.
 
@@ -234,10 +234,10 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 **Behaviour.**
 
 - **Two-pronged detection** (results unioned, not exclusive):
-  - **Stdout parsing** — `localhost:<port>` / `http(s)://[host]:<port>` / `listening on [port] N` patterns. Adds to a per-task `hinted` set.
-  - **lsof poll** every 2 s — `lsof -nP -iTCP -sTCP:LISTEN -a -Fpn -p <pids>` over the task's process tree (walked via `pgrep -P` to depth 5: covers `npm → cross-spawn shell → tsx/nodemon → user binary`).
-  - **Immediate first tick on `track()`** — no 2 s lag for quickly-listening processes like Vite.
-- **One chip per task** (running OR registered), always with task-name prefix (`<taskName> :<port>`). Tasks with no detected port show a muted `<taskName> —` placeholder. **Phase 7**: the chip row is always rendered with reserved height, so the surrounding card/header doesn't reflow when an app starts. When the app is fully idle (no task running), the row shows one placeholder chip per registered task at the same height as the running version.
+  - **Stdout parsing** - `localhost:<port>` / `http(s)://[host]:<port>` / `listening on [port] N` patterns. Adds to a per-task `hinted` set.
+  - **lsof poll** every 2 s - `lsof -nP -iTCP -sTCP:LISTEN -a -Fpn -p <pids>` over the task's process tree (walked via `pgrep -P` to depth 5: covers `npm → cross-spawn shell → tsx/nodemon → user binary`).
+  - **Immediate first tick on `track()`** - no 2 s lag for quickly-listening processes like Vite.
+- **One chip per task** (running OR registered), always with task-name prefix (`<taskName> :<port>`). Tasks with no detected port show a muted `<taskName> - ` placeholder. **Phase 7**: the chip row is always rendered with reserved height, so the surrounding card/header doesn't reflow when an app starts. When the app is fully idle (no task running), the row shows one placeholder chip per registered task at the same height as the running version.
 - Chips render in **two places**: Dashboard cards, and the App Detail header (on their own row below the path, for breathing room with multi-port apps).
 - Click opens `http://localhost:<port>` externally via `shell.openExternal` (URL scheme allowlist: `http:` / `https:` only).
 
@@ -250,7 +250,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 **Acceptance.**
 
 - Single-task app (Astro): within 5 s of `npm run dev` printing "Local: http://localhost:4321/", a `dev :4321` chip appears.
-- Multi-task app: each running task gets its own chip with its name. A task that fails to bind shows `<taskName> —` (not blank).
+- Multi-task app: each running task gets its own chip with its name. A task that fails to bind shows `<taskName> - ` (not blank).
 
 ---
 
@@ -311,14 +311,14 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 ---
 
-## F15. Crash handling + run history  *(P3 — partial in v1)*
+## F15. Crash handling + run history  *(P3 - partial in v1)*
 
 **Summary.** Surface non-zero exits prominently. Run-history data is persisted to the DB for future tooling but **not surfaced in the UI** in v1.
 
 **Behaviour.**
 - On crash: state goes `crashed`, exit code shown, last 200 lines of log pinned above the live terminal via `CrashPin` (Restart + Dismiss inline).
 - `run_history` table populated on every task start/stop (one row per task per run). Includes started_at, ended_at, exit_code, exit_signal, was_killed_by_user, node_version, package_manager, command, script.
-- ~~Per-app "History" tab~~ — **dropped from the UI**. The previous tab was a glorified audit log that didn't earn its real estate; CrashPin covers the "why did this just crash" workflow, and "rerun" lives on the task tab strip. The `HistoryView.tsx` component was **deleted in the Phase 11 dead-code cleanup**; run data is still recorded and remains readable via the `runs:list` IPC for a future log-explorer feature.
+- ~~Per-app "History" tab~~ - **dropped from the UI**. The previous tab was a glorified audit log that didn't earn its real estate; CrashPin covers the "why did this just crash" workflow, and "rerun" lives on the task tab strip. The `HistoryView.tsx` component was **deleted in the Phase 11 dead-code cleanup**; run data is still recorded and remains readable via the `runs:list` IPC for a future log-explorer feature.
 
 **Acceptance.**
 - Killing the underlying process from outside (`kill -9`) shows up as `crashed` with no signal misattribution.
@@ -333,8 +333,8 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 **Behaviour.**
 - Register custom protocol on macOS.
 - Supported actions:
-  - `devharbor://open?path=/abs/path` — focus the app for that path (or offer to register if unknown).
-  - `devharbor://start?id=<appId>` — start the named app.
+  - `devharbor://open?path=/abs/path` - focus the app for that path (or offer to register if unknown).
+  - `devharbor://start?id=<appId>` - start the named app.
 
 **Acceptance.**
 - Pasting `devharbor://open?path=$PWD` from a terminal opens the matching app.
@@ -347,7 +347,7 @@ Each feature has: a one-line summary, behaviour, edge cases, and acceptance crit
 
 **Behaviour.**
 - On launch, check GitHub Releases (or configured feed).
-- If newer: download in background, show a non-blocking banner "Update ready — quit & install."
+- If newer: download in background, show a non-blocking banner "Update ready - quit & install."
 - Setting to disable.
 
 **Acceptance.**
@@ -376,22 +376,22 @@ This is the foundation for: monorepos (one task per workspace), single-repo mult
 
 **Concepts.**
 
-- **Task** — a unit of work, see [02-data-model.md](02-data-model.md). Has `commandKind` (`script` or `custom`), optional working dir / package manager / Node version override (for monorepo workspaces), `dependsOn`, `readiness`, `oneShot` flag.
-- **Readiness signal** — when has this task "completed startup"?
-  - `none` — proceed immediately after spawn (default, current Phase 1 behaviour).
-  - `port:N` — wait until the task's process group is listening on port `N`. Implementation: `lsof -iTCP -sTCP:LISTEN -P -n` filtered by PID group, polled every 500ms.
-  - `log:/regex/` — wait until a stdout chunk matches. Useful for "ready in Xms" banners or anything not bound to a port.
-  - `exit:0` — task is `oneShot`; ready means it exited with the expected code. Required for any `oneShot` task.
-  - `delay:N ms` — fixed timer, last-resort fallback.
-- **Dependency graph** — `dependsOn` is a DAG. Cycles rejected at save time with a clear error citing the cycle. Tasks at the same topological level start in parallel, in `position` order for UI determinism.
+- **Task** - a unit of work, see [02-data-model.md](02-data-model.md). Has `commandKind` (`script` or `custom`), optional working dir / package manager / Node version override (for monorepo workspaces), `dependsOn`, `readiness`, `oneShot` flag.
+- **Readiness signal** - when has this task "completed startup"?
+  - `none` - proceed immediately after spawn (default, current Phase 1 behaviour).
+  - `port:N` - wait until the task's process group is listening on port `N`. Implementation: `lsof -iTCP -sTCP:LISTEN -P -n` filtered by PID group, polled every 500ms.
+  - `log:/regex/` - wait until a stdout chunk matches. Useful for "ready in Xms" banners or anything not bound to a port.
+  - `exit:0` - task is `oneShot`; ready means it exited with the expected code. Required for any `oneShot` task.
+  - `delay:N ms` - fixed timer, last-resort fallback.
+- **Dependency graph** - `dependsOn` is a DAG. Cycles rejected at save time with a clear error citing the cycle. Tasks at the same topological level start in parallel, in `position` order for UI determinism.
 
 **Behaviour.**
 
-- **App start** — topo-sort enabled tasks. For each task in order: wait for all deps' `ready` events, then spawn. Per-task PTY, per-task log stream, per-task status events.
-- **App stop** — reverse-topo over running tasks. SIGTERM → grace → SIGKILL on the process group; `tree-kill` safety net.
-- **Per-task Start/Stop** — exposed in the task tab strip. Manual single-task start does NOT auto-resolve dependencies; surfaces a warning if deps aren't ready.
-- **App-level state** — derived from task states per the table in [02-data-model.md](02-data-model.md). The worst task wins.
-- **Crash blast radius** — if a non-one-shot task crashes mid-orchestration, cancel pending starts but leave already-started tasks alone (so you can inspect their logs). User decides whether to restart or stop the partial set.
+- **App start** - topo-sort enabled tasks. For each task in order: wait for all deps' `ready` events, then spawn. Per-task PTY, per-task log stream, per-task status events.
+- **App stop** - reverse-topo over running tasks. SIGTERM → grace → SIGKILL on the process group; `tree-kill` safety net.
+- **Per-task Start/Stop** - exposed in the task tab strip. Manual single-task start does NOT auto-resolve dependencies; surfaces a warning if deps aren't ready.
+- **App-level state** - derived from task states per the table in [02-data-model.md](02-data-model.md). The worst task wins.
+- **Crash blast radius** - if a non-one-shot task crashes mid-orchestration, cancel pending starts but leave already-started tasks alone (so you can inspect their logs). User decides whether to restart or stop the partial set.
 
 **Edge cases.**
 
@@ -418,12 +418,12 @@ This is the foundation for: monorepos (one task per workspace), single-repo mult
 - **App default** lives in `App.nodeVersionPref`, set via `AppConfigDrawer`'s **Node version** field.
 - **Task override** lives in `Task.nodeVersionPrefOverride`, set via `TaskEditor`'s Node version field. Has an extra "Inherit from app" choice (stored as `null`).
 - **Three preference kinds**:
-  - `auto` — `NodeResolver` reads `.nvmrc` → `.node-version` → `engines.node` from the task's working dir at start time. Standard nvm workflow.
-  - `system` — `which node` resolved on the user's PATH.
-  - `explicit { version }` — a specific installed version chosen from the dropdown.
+  - `auto` - `NodeResolver` reads `.nvmrc` → `.node-version` → `engines.node` from the task's working dir at start time. Standard nvm workflow.
+  - `system` - `which node` resolved on the user's PATH.
+  - `explicit { version }` - a specific installed version chosen from the dropdown.
 - **NodeVersionPicker component** queries `node:list` IPC, which scans `~/.nvm`, `~/.fnm` (3 known paths), `~/.volta`, `~/.asdf`, plus system Node. Versions are deduped across managers; sources displayed (`v20.11.0 · nvm, fnm`).
 - **At task start**, `NodeResolver.resolve(pref, workingDir)` returns a `NodeInstallation { source, version, binDir }`. The bin dir is prepended to the spawned task's `PATH`, so the child sees the right `node` / `npm` / `npx` first.
-- **No `nvm use` shell magic** — we bypass the shell function entirely by picking the binary off the filesystem.
+- **No `nvm use` shell magic** - we bypass the shell function entirely by picking the binary off the filesystem.
 
 **Edge cases.**
 
@@ -441,7 +441,7 @@ This is the foundation for: monorepos (one task per workspace), single-repo mult
 
 ## F21. Folders in the sidebar  *(Phase 8)*
 
-**Summary.** Optional one-level visual grouping of apps in the sidebar. Each app belongs to zero or one folder. Tags remain orthogonal — folders are hierarchy, tags are facets.
+**Summary.** Optional one-level visual grouping of apps in the sidebar. Each app belongs to zero or one folder. Tags remain orthogonal - folders are hierarchy, tags are facets.
 
 **Why not nesting / why not "use tags".**
 - *Nesting:* 95% of dev-tool sidebars (VS Code workspaces, Postman, TablePlus) get away with one level. Schema today is `folder TEXT`; if we later want nesting we change one column to `folder_path TEXT` and split on `/`. Don't pay the complexity now.
@@ -450,12 +450,12 @@ This is the foundation for: monorepos (one task per workspace), single-repo mult
 **Behaviour.**
 
 - **Data**: `apps.folder TEXT` (NULL = ungrouped). Migration `0005_app_folders.sql` adds the column; existing apps default to NULL and surface in the "(Ungrouped)" section.
-- **Sidebar render** — apps grouped by folder, folders sorted alphabetically (case-insensitive), "(Ungrouped)" pinned to the bottom. Each section has a `▾ Name (N)` header that toggles collapse on click. Folder collapse state stored in `localStorage["devharbor:folder-collapse"]` as a JSON object `{ [folderName]: true }` — per-machine, not synced.
-- **Move an app** — right-click an app in the sidebar → **Move to folder ▸** submenu with: existing folders, "New folder…" (prompts for name), and "Remove from folder" (if currently foldered). Or set the folder field in `AppConfigDrawer`.
-- **Rename a folder** — right-click folder header → **Rename folder…** → prompt. Implemented as one UPDATE across all apps with that folder name; the renamed folder picks up its new alphabetical slot.
-- **Delete a folder** — right-click folder header → **Delete folder** → confirm → apps fall back to NULL (move to "(Ungrouped)"). Files on disk are untouched, app rows remain.
-- **AppConfigDrawer Folder field** — text input with a datalist autocomplete of existing folder names. Empty value clears the folder.
-- **Empty state** — if no app has a folder, the sidebar renders the flat list it always did. The first time any app gets a folder, the grouped layout kicks in (with "(Ungrouped)" holding the rest).
+- **Sidebar render** - apps grouped by folder, folders sorted alphabetically (case-insensitive), "(Ungrouped)" pinned to the bottom. Each section has a `▾ Name (N)` header that toggles collapse on click. Folder collapse state stored in `localStorage["devharbor:folder-collapse"]` as a JSON object `{ [folderName]: true }` - per-machine, not synced.
+- **Move an app** - right-click an app in the sidebar → **Move to folder ▸** submenu with: existing folders, "New folder…" (prompts for name), and "Remove from folder" (if currently foldered). Or set the folder field in `AppConfigDrawer`.
+- **Rename a folder** - right-click folder header → **Rename folder…** → prompt. Implemented as one UPDATE across all apps with that folder name; the renamed folder picks up its new alphabetical slot.
+- **Delete a folder** - right-click folder header → **Delete folder** → confirm → apps fall back to NULL (move to "(Ungrouped)"). Files on disk are untouched, app rows remain.
+- **AppConfigDrawer Folder field** - text input with a datalist autocomplete of existing folder names. Empty value clears the folder.
+- **Empty state** - if no app has a folder, the sidebar renders the flat list it always did. The first time any app gets a folder, the grouped layout kicks in (with "(Ungrouped)" holding the rest).
 
 **Edge cases.**
 
@@ -477,7 +477,7 @@ This is the foundation for: monorepos (one task per workspace), single-repo mult
 ## Stretch (post-v1, not in this spec set)
 
 - Docker Compose integration (treat services as pseudo-apps).
-- Multi-app "scenes" — named bundles of *Apps* (across the registry) to start together. (Cross-app orchestration; within-app multi-process is handled by [F19](#f19-multi-task-orchestration-p15).)
+- Multi-app "scenes" - named bundles of *Apps* (across the registry) to start together. (Cross-app orchestration; within-app multi-process is handled by [F19](#f19-multi-task-orchestration-p15).)
 - HTTP request runner for the app's exposed port (would step on Postman's toes; deliberately deferred).
 - Plugins (let a user drop a JS file in `userData/plugins/` to add commands).
 - Per-app keychain-backed secrets.
diff --git a/specs/04-ui.md b/specs/04-ui.md
index 9e764ad..41590cf 100644
--- a/specs/04-ui.md
+++ b/specs/04-ui.md
@@ -1,11 +1,11 @@
-# 04 — UI Design
+# 04 - UI Design
 
-The aesthetic target: **calm, dense, professional dev tool**. Think Linear, Raycast, Vercel dashboard, modern VS Code — not Postman's bright UI. Monospace for paths/commands, sans for chrome.
+The aesthetic target: **calm, dense, professional dev tool**. Think Linear, Raycast, Vercel dashboard, modern VS Code - not Postman's bright UI. Monospace for paths/commands, sans for chrome.
 
 ## Window shell
 
 - Fixed two-pane shell:
-  - **Sidebar** (left, 240px, resizable 200–360): app list + dashboard link + settings.
+  - **Sidebar** (left, 240px, resizable 200-360): app list + dashboard link + settings.
   - **Main** (right): the currently selected view.
 - Native macOS title bar with traffic lights; the sidebar starts below them. No custom window chrome in v1.
 - Theme: dark by default, light available, follows system. Tailwind dark mode class strategy.
@@ -26,7 +26,7 @@ The aesthetic target: **calm, dense, professional dev tool**. Think Linear, Rayc
 │   ● auth-api             ⋮   │  ← no ring = idle
 │   ● admin                ⋮   │
 │ ▾ Side projects          (0) │  ← empty pinned folder
-│   *Empty — drop apps here.*  │
+│   *Empty - drop apps here.*  │
 │ ▾ (Ungrouped)            (1) │  ← reserved label, pinned to bottom
 │   ● scratch              ⋮   │
 ├──────────────────────────────┤
@@ -34,25 +34,25 @@ The aesthetic target: **calm, dense, professional dev tool**. Think Linear, Rayc
 └──────────────────────────────┘
 ```
 
-- **Each app row** (Phase 8.b): `[status dot]  [name]  [⋮ overflow menu]`. (Inline tag chips removed Phase 15 — tags surface via tag-grouping, sidebar filter, and ⌘P, so the row stays clean.)
+- **Each app row** (Phase 8.b): `[status dot]  [name]  [⋮ overflow menu]`. (Inline tag chips removed Phase 15 - tags surface via tag-grouping, sidebar filter, and ⌘P, so the row stays clean.)
   - Color dot = app identity (user-pickable hex).
   - State expressed as a colored **ring** around the dot, not a separate trailing dot. Idle = no ring; running = green; starting / exiting = amber; crashed = red. The ring lives in space the row already occupied, freeing the right slot for ⋮.
   - **⋮ button** is the primary trigger for the per-app menu. Hover-revealed on idle rows, always-visible on the currently selected row. Right-click on the row is preserved as a power-user fallback that opens the same menu.
 - **⋮ menu** items (same as the old right-click set, plus ⋮ is now the discoverable surface): Open · Start/Stop · Restart · → {folder…} entries · → New folder… · → Remove from folder · Reveal in Finder · Open in Terminal · Remove from DevHarbor…
-- **APPS header row** carries two action icons: **+** (Add app — same flow as before, just moved here from the bottom for discoverability) and **📁+** (Create folder — opens a modal asking for a name and immediately shows the empty folder in the sidebar, ready to accept drops).
+- **APPS header row** carries two action icons: **+** (Add app - same flow as before, just moved here from the bottom for discoverability) and **📁+** (Create folder - opens a modal asking for a name and immediately shows the empty folder in the sidebar, ready to accept drops).
 - **Group-by switcher** (Phase 15): the **APPS** header carries a Finder-style 2-segment control (Folder icon / Tag icon, active segment filled) that toggles how the list is organized. Persisted to `localStorage["devharbor:group-mode"]`.
   - **Folder mode** (default): groups by each app's single `folder`; supports create-folder (📁+), folder ⋮ rename/delete, drag-reorder, and drag-app-into-folder.
-  - **Tag mode**: groups by tag — an app appears under *every* tag it carries (tags are non-exclusive labels), apps with none fall into "(Untagged)" pinned last. Per-group folder affordances (⋮ rename/delete, drag-reorder) are hidden; instead **dragging an app onto a tag group adds that tag** (non-destructive; dropping on "(Untagged)" is a no-op). With no tags anywhere, falls back to a flat list with a hint to add tags. This is the cross-folder slice: tag `api` collects every API service regardless of which folder it lives in.
-  - The header action icons (group-by switcher, **+** add app, **📁+** create folder) are **identical in both modes** — no layout shift when toggling. Creating a folder from tag view **auto-switches to folder view** so the new folder is visible (a folder doesn't exist in the tag grouping).
-  - **App order within a folder/tag group, and in the flat list** (Phase 17) is controlled by a **sort toggle** in the header (⇅ icon → menu: **Name (A–Z)** · **Recently used** · **Running first**). This is a **single preference shared with the Dashboard** — stored as `appSort` in the renderer store (persisted to `localStorage["devharbor:app-sort"]`) so both views always agree and update live. Default **Name** is stable — it deliberately does NOT follow the DB's `updated_at DESC` (which jumps rows on start/edit). `Recently used` (by `lastStartedAt`) and `Running first` (live apps float up) are opt-ins that intentionally reorder; name is always the tiebreaker. The ⇅ icon tints accent when a non-default sort is active. Folders/tags keep their own ordering (folders: saved drag order then alphabetical; tags: alphabetical). Sort logic lives in `renderer/lib/sortApps.ts` (one comparator used by both views).
+  - **Tag mode**: groups by tag - an app appears under *every* tag it carries (tags are non-exclusive labels), apps with none fall into "(Untagged)" pinned last. Per-group folder affordances (⋮ rename/delete, drag-reorder) are hidden; instead **dragging an app onto a tag group adds that tag** (non-destructive; dropping on "(Untagged)" is a no-op). With no tags anywhere, falls back to a flat list with a hint to add tags. This is the cross-folder slice: tag `api` collects every API service regardless of which folder it lives in.
+  - The header action icons (group-by switcher, **+** add app, **📁+** create folder) are **identical in both modes** - no layout shift when toggling. Creating a folder from tag view **auto-switches to folder view** so the new folder is visible (a folder doesn't exist in the tag grouping).
+  - **App order within a folder/tag group, and in the flat list** (Phase 17) is controlled by a **sort toggle** in the header (⇅ icon → menu: **Name (A-Z)** · **Recently used** · **Running first**). This is a **single preference shared with the Dashboard** - stored as `appSort` in the renderer store (persisted to `localStorage["devharbor:app-sort"]`) so both views always agree and update live. Default **Name** is stable - it deliberately does NOT follow the DB's `updated_at DESC` (which jumps rows on start/edit). `Recently used` (by `lastStartedAt`) and `Running first` (live apps float up) are opt-ins that intentionally reorder; name is always the tiebreaker. The ⇅ icon tints accent when a non-default sort is active. Folders/tags keep their own ordering (folders: saved drag order then alphabetical; tags: alphabetical). Sort logic lives in `renderer/lib/sortApps.ts` (one comparator used by both views).
   - **The per-app ⋮ / right-click menu is view-appropriate**: in folder view its move section is `→ {folder} · → New folder… · → Remove from folder`; in tag view it becomes `Add tag: {tag} · New tag… · Remove tag: {tag}`. Everything else (Open / Start-Stop / Restart / Reveal / Terminal / Remove) is identical.
-- **Folder header** (Phase 15) mirrors app rows for consistency: `[collapse caret]  NAME  [⋮ overflow menu]`. The ⋮ is hover-revealed (right-click still works) and opens Rename folder… · Delete folder, both via `PromptModal` (replaces `window.prompt`, a no-op inside Electron BrowserWindow). (No per-folder count badge — removed Phase 15 as visual noise.)
+- **Folder header** (Phase 15) mirrors app rows for consistency: `[collapse caret]  NAME  [⋮ overflow menu]`. The ⋮ is hover-revealed (right-click still works) and opens Rename folder… · Delete folder, both via `PromptModal` (replaces `window.prompt`, a no-op inside Electron BrowserWindow). (No per-folder count badge - removed Phase 15 as visual noise.)
 - **Drag-and-drop** (Phase 8.b + 15): two drag types, distinguished by MIME so they never cross-trigger.
-  - *App drag* (`application/x-appmgr-app`): an app row is `draggable`; folder sections are drop targets — drop onto a section to set its `folder`, onto "(Ungrouped)" to clear it. Hovered section gets an accent ring.
+  - *App drag* (`application/x-appmgr-app`): an app row is `draggable`; folder sections are drop targets - drop onto a section to set its `folder`, onto "(Ungrouped)" to clear it. Hovered section gets an accent ring.
   - *Folder reorder* (`application/x-appmgr-folder`, Phase 15): a folder header is `draggable`; dropping one folder onto another reorders them. Order persists to `localStorage["devharbor:folder-order"]`; ordered folders sort first (in saved order), then unordered alphabetically, "(Ungrouped)" always last. The drop target shows a top accent border. No nested folders.
-- **Folders** *(Phase 8 — F21)*: one-level grouping. Apps with `folder = NULL` collect under "(Ungrouped)". Empty folders created via 📁+ are stored in `localStorage["devharbor:pinned-folders"]` so they survive reload until apps are dropped in or the folder is deleted. Collapse state in `localStorage["devharbor:folder-collapse"]`.
+- **Folders** *(Phase 8 - F21)*: one-level grouping. Apps with `folder = NULL` collect under "(Ungrouped)". Empty folders created via 📁+ are stored in `localStorage["devharbor:pinned-folders"]` so they survive reload until apps are dropped in or the folder is deleted. Collapse state in `localStorage["devharbor:folder-collapse"]`.
 - The Dashboard sidebar entry shows a green count badge with white text when ≥1 app is running.
-- **Bottom row** is just the **⚙ Settings** icon now — Add app moved to the header.
+- **Bottom row** is just the **⚙ Settings** icon now - Add app moved to the header.
 
 ## macOS application menu *(Phase 13)*
 
@@ -67,9 +67,9 @@ Menu → renderer flow: items in the main process `webContents.send` typed event
 
 ## Dashboard view
 
-The dashboard is the **control room**, deliberately distinct from the sidebar (the *switcher*). Where the sidebar navigates every app, the dashboard answers "what is my machine doing right now" and offers quick control. Layout: **aggregate stat strip** on top, **stable alphabetical card grid** below. (Phase 13: the old *Recent strip* was removed — it re-listed apps the sidebar + grid already show; recency quick-access is covered by the sidebar and ⌘K.)
+The dashboard is the **control room**, deliberately distinct from the sidebar (the *switcher*). Where the sidebar navigates every app, the dashboard answers "what is my machine doing right now" and offers quick control. Layout: **aggregate stat strip** on top, **stable alphabetical card grid** below. (Phase 13: the old *Recent strip* was removed - it re-listed apps the sidebar + grid already show; recency quick-access is covered by the sidebar and ⌘K.)
 
-**Aggregate stat strip** — four tiles summing across all running tasks; the dashboard's unique value (the sidebar can't show this):
+**Aggregate stat strip** - four tiles summing across all running tasks; the dashboard's unique value (the sidebar can't show this):
 
 ```
 ┌──────────┬──────────┬───────────┬─────────────┐
@@ -80,7 +80,7 @@ The dashboard is the **control room**, deliberately distinct from the sidebar (t
 
 The RUNNING value is teal when > 0. Memory rolls up to GB past 1024 MB. Ports = count of detected listening ports across running tasks.
 
-**All apps grid** — every registered app, ordered by the **shared sort** (⇅ in the header: Name · Recently used · Running first — the *same* `appSort` store value the Sidebar uses, so the two views always agree and sync live). Default **Name** is stable: running apps are emphasised **in place** — a teal inset left edge + lifted surface — never reordered (click targets stay put) and with no layout shift (inset box-shadow). (Picking *Running first* intentionally floats live apps to the top — handy for the control room.) Example card:
+**All apps grid** - every registered app, ordered by the **shared sort** (⇅ in the header: Name · Recently used · Running first - the *same* `appSort` store value the Sidebar uses, so the two views always agree and sync live). Default **Name** is stable: running apps are emphasised **in place** - a teal inset left edge + lifted surface - never reordered (click targets stay put) and with no layout shift (inset box-shadow). (Picking *Running first* intentionally floats live apps to the top - handy for the control room.) Example card:
 
 ```
 ┌─────────────────────────────────┐
@@ -93,9 +93,9 @@ The RUNNING value is teal when > 0. Memory rolls up to GB past 1024 MB. Ports =
 └─────────────────────────────────┘
 ```
 
-Each card shows one chip per task, format `<taskName> :<port>`. When the app is idle, each registered task still gets a placeholder chip (`<taskName> —`) so **the card has the same height whether running or stopped** (Phase 7 — eliminates the layout shift when clicking Start). Up to 6 chips, then `+N` overflow. The card itself has a `min-h` constraint so cards in one row stay aligned even when only one of them is running.
+Each card shows one chip per task, format `<taskName> :<port>`. When the app is idle, each registered task still gets a placeholder chip (`<taskName> - `) so **the card has the same height whether running or stopped** (Phase 7 - eliminates the layout shift when clicking Start). Up to 6 chips, then `+N` overflow. The card itself has a `min-h` constraint so cards in one row stay aligned even when only one of them is running.
 
-**Top toolbar**: `[Filter by tag ▾]  [Stop all]`. (Start-all removed — too easy to misfire.)
+**Top toolbar**: `[Filter by tag ▾]  [Stop all]`. (Start-all removed - too easy to misfire.)
 
 **Sidebar Dashboard entry** shows a green count badge (`success-strong` bg, `bg-base` fg) when ≥1 app is running.
 
@@ -103,7 +103,7 @@ Each card shows one chip per task, format `<taskName> :<port>`. When the app is
 
 ## App detail view
 
-No top-level tabs. The detail view is essentially a header + **task tabs strip (always-on, Phase 7)** + a unified Logs pane (Live or Filter mode). Env, App config are reachable via drawer buttons in the header. The header **no longer carries a "Tasks" drawer button** — the always-on strip's "Manage tasks" affordance covers that, removing the redundancy. **History was dropped from the UI** — `run_history` is still persisted to the DB, but the previous History tab didn't earn its real estate.
+No top-level tabs. The detail view is essentially a header + **task tabs strip (always-on, Phase 7)** + a unified Logs pane (Live or Filter mode). Env, App config are reachable via drawer buttons in the header. The header **no longer carries a "Tasks" drawer button** - the always-on strip's "Manage tasks" affordance covers that, removing the redundancy. **History was dropped from the UI** - `run_history` is still persisted to the DB, but the previous History tab didn't earn its real estate.
 
 ### Header (always visible)
 
@@ -113,19 +113,19 @@ No top-level tabs. The detail view is essentially a header + **task tabs strip (
 [ migrate ✓ ]  [ api :4000 ]  [ web :3000 ]      ← own row, **fixed height even when idle**
 ```
 
-- State pill (green / amber / red / blue) — **app-level**, derived from all task states.
-- ~~Script picker dropdown — removed Phase 7 round 2.~~ Single-task and multi-task apps now share the **identical** header. Editing a task's script lives in the task tab right-click → Edit, consistent across task counts.
+- State pill (green / amber / red / blue) - **app-level**, derived from all task states.
+- ~~Script picker dropdown - removed Phase 7 round 2.~~ Single-task and multi-task apps now share the **identical** header. Editing a task's script lives in the task tab right-click → Edit, consistent across task counts.
 - **Open in** menu: Finder, Terminal, VS Code, Cursor, Sublime (auto-detected via `which`).
-- **Env**: opens EnvEditor drawer (defaults to App scope; switch to Task scope from the editor's tab bar — Phase 7).
+- **Env**: opens EnvEditor drawer (defaults to App scope; switch to Task scope from the editor's tab bar - Phase 7).
 - **⚙**: opens AppConfigDrawer (name / tags / folder / auto-restart / watch globs / **Node version**). Color picker removed (Phase 14); Open in detects via bundle existence + LaunchServices, launched with `open -a` (Phase 14, not `which`).
 - Start / Stop / Restart act on the whole task graph. All three lifecycle buttons share `min-w-[88px]` so they're visually the same size regardless of label.
-- **Trash icon (smart delete, Phase 7 round 2)**: if the app is running, the confirm dialog asks "Stop all tasks and remove?" — clicking Yes stops the orchestrated graph then removes the app. If not running, it just confirms removal. Removes only from DevHarbor's registry; **never deletes files**.
+- **Trash icon (smart delete, Phase 7 round 2)**: if the app is running, the confirm dialog asks "Stop all tasks and remove?" - clicking Yes stops the orchestrated graph then removes the app. If not running, it just confirms removal. Removes only from DevHarbor's registry; **never deletes files**.
 - **Path row with copy icon (Phase 7)**: `~/code/auth-api  [⧉]`. Click the icon → `navigator.clipboard.writeText(app.path)`, brief checkmark flash.
-- **Port chip row (always rendered, Phase 7)**: own row, fixed height (`min-h-[26px]`). When running: one chip per task. When idle: one muted placeholder chip per registered task at the same height. The header height is constant across all state transitions — no reflow when the user clicks Start.
+- **Port chip row (always rendered, Phase 7)**: own row, fixed height (`min-h-[26px]`). When running: one chip per task. When idle: one muted placeholder chip per registered task at the same height. The header height is constant across all state transitions - no reflow when the user clicks Start.
 
 ### Task tabs *(Phase 1.5; always-on since Phase 7)*
 
-A horizontal strip directly below the header, above the log pane — **rendered for both single-task and multi-task apps**. Single-task apps show one tab plus the Manage button. Reason: consistency, no special-cased UI, and right-click affordances on tasks (Start / Stop / Restart this task / Disable / Edit / Remove) become available regardless of task count.
+A horizontal strip directly below the header, above the log pane - **rendered for both single-task and multi-task apps**. Single-task apps show one tab plus the Manage button. Reason: consistency, no special-cased UI, and right-click affordances on tasks (Start / Stop / Restart this task / Disable / Edit / Remove) become available regardless of task count.
 
 ```
  ┌──────────────────────────────────────────────────────────────────────────┐
@@ -154,11 +154,11 @@ xterm  OR  virtualized regex filter list
 - **Live** (default): xterm filling the pane, WebGL renderer, full ANSI / TUI fidelity. ⌘ F opens a small floating search overlay (step-through highlight). Jump-to-bottom chip appears when scrolled away. Font ± buttons in the toolbar.
 - **Filter**: virtualized list (`react-window` + `anser`) showing only matching lines, with regex / case-sensitive toggles, line numbers, match count.
 
-The right-side toolbar (Copy / Save / Clear) is visible in Live only — those operations don't apply to a filtered view (the in-pane search has its own controls).
+The right-side toolbar (Copy / Save / Clear) is visible in Live only - those operations don't apply to a filtered view (the in-pane search has its own controls).
 
-**Crash pin** (above the pane, Live mode only) — when the active task is in `crashed` state, a sticky red strip shows the last 200 lines + `[Restart task]` + dismiss. Auto-resets on task switch and on the next crash.
+**Crash pin** (above the pane, Live mode only) - when the active task is in `crashed` state, a sticky red strip shows the last 200 lines + `[Restart task]` + dismiss. Auto-resets on task switch and on the next crash.
 
-### History tab — *removed*
+### History tab - *removed*
 
 The History tab was dropped from the UI (Phase 7) and its `HistoryView.tsx` component deleted in the Phase 11 dead-code cleanup. Run data is still recorded to `run_history` (via `RunHistory`/`TaskRunner`) and remains readable through the `runs:list` IPC, but there is no UI surface for it today. A future "log explorer" / history view can re-add one against that data.
 
@@ -179,8 +179,8 @@ Tabs: **Global** · **App · {name}** · **Task · {name}** (third tab only pres
 ```
 
 - Tab order intentionally reads bottom-up: Global is the floor, App overrides Global, Task overrides App. Override chips on rows make this explicit.
-- Right-side panel: "Effective merged env (read-only) — grouped by winning scope" — sections in order **Task → App → Global**, each showing only the keys where that scope is the winner (shadowed values are intentionally omitted from the preview; the editable table is where you go to see/change them).
-- Sub-panel: ".env files found" — shows discovered files with last-modified.
+- Right-side panel: "Effective merged env (read-only) - grouped by winning scope" - sections in order **Task → App → Global**, each showing only the keys where that scope is the winner (shadowed values are intentionally omitted from the preview; the editable table is where you go to see/change them).
+- Sub-panel: ".env files found" - shows discovered files with last-modified.
 - The Task tab is opened from:
   - **Task strip right-click → "Edit task env…"**
   - **TaskEditor → Env section** (`Open task env in editor`)
@@ -190,15 +190,15 @@ Tabs: **Global** · **App · {name}** · **Task · {name}** (third tab only pres
 
 Two sub-sections: **App** (top) and **Tasks** (bottom).
 
-**App** (form layout — implemented as `AppConfigDrawer` accessed via the ⚙ button):
+**App** (form layout - implemented as `AppConfigDrawer` accessed via the ⚙ button):
 
 - Name
-- **Tags** (Phase 15) — `TagInput`: a chip editor with autocomplete. Type + Enter/comma adds a chip, Backspace on empty input removes the last, a dropdown suggests tags already used on other apps (↑/↓ to navigate, Esc to dismiss). Tags drive: sidebar search match + the two tags shown on each app row, the Dashboard "Filter by tag" dropdown, and the ⌘P switcher (typing a tag surfaces matching apps, which also display their tags). One free-form label set per app — the way to slice across folders.
-- **Folder** (Phase 15) — `FolderSelect` combobox replacing the old plain text+datalist: a button shows the current folder (or "No folder"); the dropdown lists "No folder" + every existing folder (checkmark on the current) and a "Create new folder…" action that reveals an inline name input. One folder per app.
+- **Tags** (Phase 15) - `TagInput`: a chip editor with autocomplete. Type + Enter/comma adds a chip, Backspace on empty input removes the last, a dropdown suggests tags already used on other apps (↑/↓ to navigate, Esc to dismiss). Tags drive: sidebar search match + the two tags shown on each app row, the Dashboard "Filter by tag" dropdown, and the ⌘P switcher (typing a tag surfaces matching apps, which also display their tags). One free-form label set per app - the way to slice across folders.
+- **Folder** (Phase 15) - `FolderSelect` combobox replacing the old plain text+datalist: a button shows the current folder (or "No folder"); the dropdown lists "No folder" + every existing folder (checkmark on the current) and a "Create new folder…" action that reveals an inline name input. One folder per app.
 - **Node version**: `Auto (.nvmrc / .node-version / engines.node) ▾` | `System Node` | explicit installed version (deduped across nvm/fnm/volta/asdf/system, sources shown)
 - Auto-restart on file change (toggle + glob list, default `src/**/*.{ts,tsx,js,jsx,mjs,cjs}`)
-- (Working directory, package manager override — schema supports; UI fields deferred)
-- (Save logs to disk, kill-grace override — schema supports; UI fields deferred)
+- (Working directory, package manager override - schema supports; UI fields deferred)
+- (Save logs to disk, kill-grace override - schema supports; UI fields deferred)
 
 Removal lives at the trash icon in the App Detail header, not the config drawer.
 
@@ -210,7 +210,7 @@ A table of tasks, drag-handle on the left for reordering:
 ┌──┬──────────┬──────────────────────┬──────────┬──────────────┬─────────┐
 │⋮⋮│ NAME     │ COMMAND              │ READY    │ DEPENDS ON   │ ⋯       │
 ├──┼──────────┼──────────────────────┼──────────┼──────────────┼─────────┤
-│⋮⋮│ migrate  │ pnpm -F api migrate  │ exit 0   │ —            │ ☑ enabled│
+│⋮⋮│ migrate  │ pnpm -F api migrate  │ exit 0   │ -            │ ☑ enabled│
 │⋮⋮│ api      │ npm run dev          │ port:4000│ migrate      │ ☑       │
 │⋮⋮│ web      │ npm run dev (apps/web)│ port:3000│ api          │ ☑       │
 └──┴──────────┴──────────────────────┴──────────┴──────────────┴─────────┘
@@ -223,7 +223,7 @@ Inline edit per row, or click a row → side panel with full editor:
 - Command kind: script (pick from package.json) or custom (raw shell line)
 - Working dir override (defaults to App's; lets one task target `apps/api`)
 - Package manager / Node version overrides (collapsed by default)
-- `dependsOn` — multi-select dropdown of sibling tasks
+- `dependsOn` - multi-select dropdown of sibling tasks
 - Readiness: radio of (none / port / log / exit / delay) + the parameter input
 - One-shot toggle (forces readiness=exit)
 - Per-task env overrides (small KEY=VALUE editor; full env layering UI lives in the Env tab)
@@ -233,28 +233,41 @@ Save-time validation: cycle detection on `dependsOn`, one-shot must have `readin
 
 ## Add-app flow
 
-Native folder picker → detection drawer:
+A **single, progressively-disclosed screen** (`AddAppDrawer`), not a wizard. You browse for a
+folder first; the rest reveals once a valid, not-already-registered folder is detected:
 
 ```
 ┌─ Add app ──────────────────────────────────────────┐
+│  ① Project folder                                  │
+│     [ 📁 ~/code/auth-api               Change ]     │
+│     (inline error if already added; "Scan this     │
+│      folder" gesture for deep-link paths)          │
 │                                                    │
-│  ~/code/auth-api                                   │
+│  What we found:  Scripts 4 · pnpm · .env, .env.local│
+│  (warns inline if no package.json found)           │
 │                                                    │
-│  Detected:                                         │
-│    Node version  20.11.0  (from .nvmrc)            │
-│    Package mgr   pnpm     (from pnpm-lock.yaml)    │
-│    Scripts       dev, build, test, lint            │
-│    Env files     .env, .env.local                  │
+│  ② How it runs                                     │
+│     Name            [auth-api          ]  (max 60) │
+│     Node version    [Auto ▾]  (follows .nvmrc pin) │
+│     Package manager [pnpm (detected) ▾]            │
+│     Start script    [dev ▾] → becomes first task   │
+│     ▸ Monorepo detected - N workspace packages     │
+│       [ ] Create a task per workspace package      │
 │                                                    │
-│  Name        [auth-api      ]                      │
-│  Default     [dev         ▾]                       │
-│  Tags        [backend, api ]                       │
+│  ③ Environment variables (optional, collapsed)     │
+│     ▸ Paste a .env blob                             │
 │                                                    │
-│                       [Cancel]   [Add]             │
+│                       [Cancel]   [Add app]         │
 └────────────────────────────────────────────────────┘
 ```
 
-If detection finds nothing actionable, the drawer says so and offers to register anyway with a custom command.
+Tags are **not** in this drawer (set later in App settings). The whole add is **one atomic
+`apps:create` IPC** - main commits the app + first task (or one task per workspace) + env vars
+in a single transaction with rollback, so a thrown step never leaves an orphan app row. The
+drawer is an accessible dialog (focus trap / Escape / focus restore via `useDialog`).
+
+Bulk import: **"Import projects…"** (EmptyState, sidebar `+` menu, ⌘K) shallow-scans a chosen
+folder for `package.json` projects and batch-registers the selected ones via `apps:create`.
 
 ## Command palette (Cmd-K)
 
@@ -280,22 +293,34 @@ If detection finds nothing actionable, the drawer says so and offers to register
 
 Non-modal, top-of-main-pane. Stackable, dismissable.
 
-- ".env.local changed on disk for auth-api — [Restart]"
-- "Update ready — Quit & install"
-- "Required Node v20.11.0 not installed — [Copy install command]"
+- ".env.local changed on disk for auth-api - [Restart]"
+- "Update ready - Quit & install"
+- "Required Node v20.11.0 not installed - [Copy install command]"
 - "Logs are being saved to disk for this run"
 
 ## Empty / first-run state
 
-If no apps registered:
+If no apps registered, the main pane shows a **welcome / teaching screen** (`EmptyState`) - it's
+seen once by a brand-new user, so it carries a short value prop + a 2×2 feature grid (Run &
+monitor / Multi-task apps / Per-project Node & env / Live logs & ports), keeping the recurring
+add flow lean:
 
 ```
-You haven't added any apps yet.
+            ◳ Welcome to DevHarbor
+
+  A harbor for your local dev servers - run and
+  monitor your Node.js projects from one window.
+  Everything stays local: no accounts, no cloud,
+  no telemetry.
+
+  ┌ Run & monitor ┐  ┌ Multi-task apps ┐
+  ┌ Per-project … ┐  ┌ Live logs & … ┐
 
-  [Add your first app]    or drag a folder here
+  [Add your first app]  [Import a folder of projects…]
 
-We'll detect the Node version, package manager,
-and scripts automatically.
+  Point DevHarbor at a Node.js project folder - it
+  detects the package manager, Node version, and
+  scripts for you.
 ```
 
 If no Node installations detected anywhere:
@@ -311,10 +336,10 @@ Install one with nvm, fnm, or Volta and click Refresh.
 
 - **Type.** UI: system sans (`-apple-system, SF Pro, system-ui`). Code/paths/logs: `'SF Mono', 'JetBrains Mono', ui-monospace`.
 - **Density.** Sidebar row height 32px. Table row height 28px. Tighter than default Tailwind.
-- **Color.** Semantic CSS-variable tokens (`bg-base` / `bg-surface` / `bg-elevated` / `border` / `border-strong` / `fg` / `fg-muted` / `fg-subtle` / `accent`) driven by the **Radix Colors slate scale** for both modes — what shadcn/ui, Linear, and Vercel use. Light and dark palettes set the variable values in `.light` and `.dark` blocks; toggling `theme` in Settings flips the entire palette without per-component overrides. Status colors (`danger` / `success` / `warn`) each ship a 5-slot family (`bg` / `bg-hover` / `fg` / `border` / `strong`) calibrated for both modes. Solid mid-tone state dots (`bg-red-500` / `bg-green-500` / `bg-amber-500` / `bg-blue-500`) stay unchanged across themes — saturated mid-tones read on both backgrounds.
+- **Color.** Semantic CSS-variable tokens (`bg-base` / `bg-surface` / `bg-elevated` / `border` / `border-strong` / `fg` / `fg-muted` / `fg-subtle` / `accent`) driven by the **Radix Colors slate scale** for both modes - what shadcn/ui, Linear, and Vercel use. Light and dark palettes set the variable values in `.light` and `.dark` blocks; toggling `theme` in Settings flips the entire palette without per-component overrides. Status colors (`danger` / `success` / `warn`) each ship a 5-slot family (`bg` / `bg-hover` / `fg` / `border` / `strong`) calibrated for both modes. Solid mid-tone state dots (`bg-red-500` / `bg-green-500` / `bg-amber-500` / `bg-blue-500`) stay unchanged across themes - saturated mid-tones read on both backgrounds.
 - **Motion.** Minimal. 120 ms ease for state pill transitions. No bouncy springs.
 - **Icons.** lucide-react.
-- **xterm.** Has its own dark color scheme regardless of UI theme. Intentional — matches VS Code's terminal pattern (most devs prefer dark terminals).
+- **xterm.** Has its own dark color scheme regardless of UI theme. Intentional - matches VS Code's terminal pattern (most devs prefer dark terminals).
 
 ## Accessibility
 
@@ -327,4 +352,4 @@ Install one with nvm, fnm, or Volta and click Refresh.
 - No marketing copy in the UI.
 - No animated illustrations or onboarding tours.
 - No tooltips that repeat the visible label.
-- No nested-card depth gymnastics — one layer of card chrome, max.
+- No nested-card depth gymnastics - one layer of card chrome, max.
diff --git a/specs/05-roadmap.md b/specs/05-roadmap.md
index 0c799d6..ceba190 100644
--- a/specs/05-roadmap.md
+++ b/specs/05-roadmap.md
@@ -1,8 +1,8 @@
-# 05 — Roadmap
+# 05 - Roadmap
 
 Phased delivery. Each phase is a coherent slice we could *ship* internally, not a vague time-bucket. Features map to the IDs in [`03-features.md`](03-features.md).
 
-## Phase 0 — Scaffold  *(must finish before P1)*
+## Phase 0 - Scaffold  *(must finish before P1)*
 
 - Init git repo + `.gitignore` + `.nvmrc` + `LICENSE`.
 - electron-vite scaffold with TS + React + Tailwind.
@@ -14,14 +14,14 @@ Phased delivery. Each phase is a coherent slice we could *ship* internally, not
 
 **Exit criteria.** `pnpm dev` opens an empty styled window. `window.api.ping()` round-trips. DB file is created on first launch.
 
-## Phase 1 — Register + Detect + Run  *(F1, F2, F3, F4, F5)*
+## Phase 1 - Register + Detect + Run  *(F1, F2, F3, F4, F5)*
 
 The smallest version that's actually useful.
 
 - App registry CRUD (`apps:list/add/update/remove/detect`).
 - `NodeResolver`: scan nvm/fnm/volta/asdf/system; resolve `.nvmrc` / `.node-version` / `engines.node`.
 - `PMDetector`: lockfile + `packageManager` field via `package-manager-detector`.
-- `ProcessManager`: PTY spawn, layered env (without per-app overrides yet — just sanitized base + `.env` files), detached process group kill.
+- `ProcessManager`: PTY spawn, layered env (without per-app overrides yet - just sanitized base + `.env` files), detached process group kill.
 - Script picker UI.
 - App detail view, Logs tab with xterm (no search yet).
 - Sidebar with add-app flow and detection drawer.
@@ -31,7 +31,7 @@ The smallest version that's actually useful.
 - Each starts with the right Node version and PM, streams correct colored logs.
 - Stop kills every descendant within 6s.
 
-## Phase 1.5 — Multi-task apps  *(F19, plus F4/F5 task-aware revisions)*
+## Phase 1.5 - Multi-task apps  *(F19, plus F4/F5 task-aware revisions)*
 
 Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run history). Per-task log panes change the shape of that UI; landing tasks first means Phase 2 polishes the right shape.
 
@@ -41,7 +41,7 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - Readiness watchers: `none`, `port` (lsof poll), `log` (regex against stream), `exit` (status hook), `delay` (timer).
 - New IPC channels: `tasks:list/add/update/remove/reorder`, `task:start/stop`, `task:log` and `task:status` event streams. App-level `proc:start/stop/restart` keep their semantics but now operate via the orchestrator.
 - UI: task tab strip in App Detail above the log pane; Tasks editor table in Config tab; per-task right-click menu.
-- Backwards compat: an app with one task renders without the tab strip — UI feels identical to Phase 1 for the common case.
+- Backwards compat: an app with one task renders without the tab strip - UI feels identical to Phase 1 for the common case.
 
 **Exit criteria.**
 
@@ -50,7 +50,7 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - Adding a dependency cycle in the editor surfaces an error with the cycle path; nothing is saved.
 - A monorepo registered as a single App with three workspace tasks (`apps/api`, `apps/web`, `packages/shared`) starts in the right order with `working_dir_override` per task.
 
-## Phase 2 — Logs polish + process hardening  *(F7, F15)*
+## Phase 2 - Logs polish + process hardening  *(F7, F15)*
 
 - xterm addons (search, webgl, fit). Cmd+F works.
 - Ring buffer with replay-on-tab-switch.
@@ -64,7 +64,7 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - A 30s noisy log burst stays at 60fps and loses no lines.
 - A crashed app stays visible with exit code and a Restart action.
 
-## Phase 3 — Env, Dashboard, Stats  *(F6, F9, F10, F11, F18)*
+## Phase 3 - Env, Dashboard, Stats  *(F6, F9, F10, F11, F18)*
 
 - `EnvStore` with global + per-app scopes.
 - Env editor (TanStack Table-based) on both Global and App scopes.
@@ -80,7 +80,7 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - Dashboard updates at 1Hz with 5 running apps and stays under 2% self-CPU.
 - Clickable `localhost:<port>` chip appears within 5s of an app being ready.
 
-## Phase 4 — Dev-friendly extras  *(F8, F12, F13, F14, F16, F17)*
+## Phase 4 - Dev-friendly extras  *(F8, F12, F13, F14, F16, F17)*
 
 - Cmd-K command palette (`cmdk`): apps, actions, recent scripts.
 - Virtualized log history pane (`react-window` + `anser`) with regex search.
@@ -93,7 +93,7 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - Editing a `.env` file in any editor surfaces a Reload banner within 500ms.
 - A new release on the feed produces an update banner on next launch.
 
-## Phase 5 — Package & ship  *(macOS only for v1)*
+## Phase 5 - Package & ship  *(macOS only for v1)*
 
 - `electron-builder` config: DMG, hardened runtime, entitlements.
 - Code signing (Developer ID) + notarization (`@electron/notarize`).
@@ -105,13 +105,13 @@ Why now (not later): Phase 2 is logs polish (xterm addons, ring buffer, run hist
 - Download DMG → drag to Applications → first launch passes Gatekeeper with no warnings.
 - App auto-updates from v0.1.0 → v0.1.1 with no user intervention beyond a quit & relaunch.
 
-## Stretch — post-v1
+## Stretch - post-v1
 
 Tracked but not in v1 scope:
 
 - Docker Compose integration (`dockerode`, parse compose, treat services as pseudo-apps).
 - Per-app keychain-backed secrets (`keytar`).
-- Multi-app "scenes" — named bundles of *Apps* (across the registry) to start together. (Within-app multi-process is Phase 1.5.)
+- Multi-app "scenes" - named bundles of *Apps* (across the registry) to start together. (Within-app multi-process is Phase 1.5.)
 - Plugin loader from `userData/plugins/`.
 - Windows + Linux validation.
 - Built-in API request runner for the detected port.
@@ -119,8 +119,8 @@ Tracked but not in v1 scope:
 ## Cross-cutting policies that apply from Phase 0
 
 - **Strict TypeScript.** `strict: true`, no `any` without comment, `noUncheckedIndexedAccess`.
-- **Lint + format on save.** Biome (or ESLint + Prettier — TBD in scaffold).
-- **No global IPC channels** — every call goes through the typed `window.api` surface.
+- **Lint + format on save.** Biome (or ESLint + Prettier - TBD in scaffold).
+- **No global IPC channels** - every call goes through the typed `window.api` surface.
 - **No process.env reads in the renderer.** Settings are pulled via IPC.
-- **Tests.** Vitest for pure modules (NodeResolver, PMDetector, env layering). Playwright (Electron mode) for one happy-path integration test per phase. No 100% coverage goal — test the gnarly bits.
+- **Tests.** Vitest for pure modules (NodeResolver, PMDetector, env layering). Playwright (Electron mode) for one happy-path integration test per phase. No 100% coverage goal - test the gnarly bits.
 - **CI.** GitHub Actions for typecheck + tests on PR; release workflow tagged `v*` builds the DMG.
diff --git a/specs/06-release.md b/specs/06-release.md
index d59a6a5..9bf06de 100644
--- a/specs/06-release.md
+++ b/specs/06-release.md
@@ -1,4 +1,4 @@
-# 06 — Release (macOS)
+# 06 - Release (macOS)
 
 How to ship a signed, notarized, auto-updating DMG.
 
@@ -8,14 +8,14 @@ This document is the prerequisite list and runbook for actually shipping. Most o
 
 ### Apple side
 
-1. **Apple Developer account** — $99 USD/year. https://developer.apple.com/
-2. **Developer ID Application certificate** — Xcode → Settings → Accounts → "Manage Certificates" → `+` → **Developer ID Application**. Export from Keychain Access as a `.p12` with a strong password.
-3. **App-specific password** for notarization — sign in to https://appleid.apple.com → "Sign-In and Security" → "App-Specific Passwords" → generate one. Save it.
-4. **Team ID** — at https://developer.apple.com/account → Membership Details (10-char alphanumeric).
+1. **Apple Developer account** - $99 USD/year. https://developer.apple.com/
+2. **Developer ID Application certificate** - Xcode → Settings → Accounts → "Manage Certificates" → `+` → **Developer ID Application**. Export from Keychain Access as a `.p12` with a strong password.
+3. **App-specific password** for notarization - sign in to https://appleid.apple.com → "Sign-In and Security" → "App-Specific Passwords" → generate one. Save it.
+4. **Team ID** - at https://developer.apple.com/account → Membership Details (10-char alphanumeric).
 
 ### GitHub side
 
-5. **A public repo** at `github.com/<owner>/<repo>` matching the `publish` block of [electron-builder.yml](../electron-builder.yml). (Currently `jainath/devharbor` — change it there if needed.)
+5. **A public repo** at `github.com/<owner>/<repo>` matching the `publish` block of [electron-builder.yml](../electron-builder.yml). (Currently `jainath/devharbor` - change it there if needed.)
 6. **GitHub Actions enabled** for that repo.
 7. **GitHub Secrets**, set under *Settings → Secrets and variables → Actions*:
 
@@ -72,7 +72,7 @@ export CSC_KEY_PASSWORD="your-export-password"
 pnpm pack:mac
 ```
 
-Notarization stapling takes 2–15 minutes; you'll see the `[notarize] done.` line when it's complete. Verify:
+Notarization stapling takes 2-15 minutes; you'll see the `[notarize] done.` line when it's complete. Verify:
 
 ```bash
 spctl --assess --verbose dist/mac/App\ Manager.app
@@ -109,7 +109,7 @@ The yaml file (`latest-mac.yml`) and the artifacts (`.dmg`, `.zip`, the `.blockm
 | "App is damaged and can't be opened" | Unsigned/unnotarized download | Either right-click → Open, or finish notarization |
 | Notarization fails with `Invalid credentials` | App-specific password not set, or set on the wrong Apple ID | Regenerate at appleid.apple.com, update the secret |
 | `electron-updater` logs `404 latest-mac.yml` | The Release isn't published (or repo `publish` config is wrong) | Check the release exists in GitHub and the owner/repo in `electron-builder.yml` |
-| Auto-update silently does nothing in dev | Expected — `Skip checkForUpdates because application is not packed` | Test updates against a packaged DMG, not `pnpm dev` |
+| Auto-update silently does nothing in dev | Expected - `Skip checkForUpdates because application is not packed` | Test updates against a packaged DMG, not `pnpm dev` |
 | `NODE_MODULE_VERSION` mismatch on launch | Native deps rebuilt against wrong ABI | `pnpm rebuild` runs `electron-rebuild` for better-sqlite3 + node-pty |
 | `ModuleNotFoundError: No module named 'distutils'` during pack | Python 3.12 removed `distutils` from stdlib; bundled node-gyp 9.x still imports it | `python3 -m pip install --user --break-system-packages setuptools` (or use a venv with setuptools installed) |
 | `cannot find valid "Developer ID Application" identity` | No signing certificate in the Keychain (local unsigned build) | Expected for local dev; ship with cert in CI per the secrets table above |
diff --git a/specs/IMPROVEMENT-PLAN.md b/specs/IMPROVEMENT-PLAN.md
new file mode 100644
index 0000000..fb47ef7
--- /dev/null
+++ b/specs/IMPROVEMENT-PLAN.md
@@ -0,0 +1,288 @@
+# DevHarbor - Comprehensive Review & Improvement Plan
+
+> **Date:** 2026-06-11 · **Reviewed:** v1.0.1 + the uncommitted add-flow redesign (working tree as-is)
+> **Method:** a 10-dimension internal audit (security ×2, reliability, data, performance, UX, accessibility, code quality, distribution, product). Every critical/high finding was independently re-verified against the code with the explicit goal of refuting it. **Zero findings were refuted.** Findings marked *(verified)* passed that second check; *(unverified)* items came from a final completeness pass and should be reproduced before fixing - though each cites concrete code.
+>
+> Severity: how much it hurts users or the project. Effort: **S** < half a day, **M** 1-3 days, **L** larger.
+
+---
+
+## 0. Implementation status (2026-06-11)
+
+This plan was **implemented in the same session** across six waves on branch `fix/improvement-plan`
+(see the 2026-06-11 entry in [`PROGRESS.md`](PROGRESS.md) for the full feature list). Gate after the
+pass: **typecheck + ESLint (83 files, 0 warnings) + 52 tests + production build all green**; all 7
+migrations validated against a real SQLite DB; restart-watcher and double-start-race fixes now have
+CI test coverage.
+
+**Done:** all of §4 (urgent), §5 (P1 correctness), §6 (security, except the explicit deferrals below),
+§7 (reliability), §8 (data), §9 (performance, except 7.6 below), §10 (UX), §11 (a11y), §12 (hygiene),
+§13 (observability/infra, except Homebrew), and §14 product items 1-10 (tray, notifications, quit
+confirm, monorepo, bulk import, auto-start/login, folder start-all, port conflicts, global log search,
+window bounds).
+
+**Post-implementation review (same day):** a second, equally skeptical review of the change set
+itself found 27 regressions/integration gaps in the new code; all were fixed in a follow-up pass.
+Highlights: batched-lsof partial-output salvage + zombie filtering in PortDetector (port chips no
+longer blank on a stale pid); cancellable starts so Stop/Restart are never queued behind readiness
+waits; readiness timeout no longer force-resolves `exit`/`delay` readiness; identity-aware stop
+helpers; a dialog STACK in `useDialog` (Escape on a stacked confirm no longer closes the parent
+drawer; inner comboboxes keep their Escape via `data-escape-stop`); DialogHost resolves displaced
+dialogs instead of hanging their awaits; EmptyState no longer flashes on boot; Sidebar keyboard ⋮
+fix + tag-collapse prune fix + case-only-rename fix; ContextMenu no longer steals focus on
+outside-click; UpdateBanner surfaces mid-download failures but stays silent on passive offline
+checks; log subscriptions reset on renderer reload; tray refreshes on app add/remove/rename;
+`Updater.stop()` so disabling auto-update takes effect immediately; login-item state reconciled
+FROM the OS instead of clobbering it; quit re-entry during teardown no longer bypasses it;
+mid-spawn starts counted/stopped by the quit path; `decMaybe` never destroys undecryptable secrets;
+dotenv unterminated-quote degrades to one line (+2 tests); workspace negation globs + flow-style
+`packages:` parsing; CrashPin port extraction anchored to the conflict line; pnpm/action-setup → v6
+(node24, verified upstream); workflow_dispatch is now a `--publish never` dry-run; `.prettierignore`
+added; tooling configs excluded from the asar. Gate after fixes: typecheck + lint + 54 tests +
+production build all green.
+
+**Deliberately deferred / partial (honest notes):**
+- **13.6 Homebrew cask** - not done (needs an external tap/PR; artifact naming fix landed as the prerequisite).
+- **6.8 secrets** - scoped to *encryption at rest* (`safeStorage`); values still decrypt over IPC for the editor (the masking/`env:reveal` UX was judged higher-risk than its marginal benefit on a single-user desktop).
+- **Electron fuse `EnableEmbeddedAsarIntegrityValidation`** - left OFF (can fail launch if the integrity header isn't embedded); enable only after a notarized build is confirmed to launch with it. The high-value fuses (RunAsNode/NODE_OPTIONS/inspect, OnlyLoadAppFromAsar) are on.
+- **7.6 stats tree-sum** - StatsMonitor still samples the root PTY pid (batched now); summing across the descendant tree is a follow-up.
+- **`EnvLayering.test.ts`** still mirrors the *old* `.env`-wins precedence; it's a self-contained pure-function mirror (doesn't exercise the real `EnvBuilder`), so it passes but no longer reflects the shipped precedence - worth rewriting against the real builder.
+- **Signed/notarized build** not produced here (no signing identity in this environment): the fuses + entitlement-trim changes need one real signed build to confirm launch + native-module loading before the next release.
+- **11.x polish remainder** - the big structural a11y fixes shipped; finer contrast-token tuning and `prefers-reduced-motion` sweeps remain incremental.
+- **`pnpm format` over the tree** - `.prettierignore` is in place, but `format:check` still flags ~60 src files (the codebase predates the config). Run `pnpm format` as a dedicated, format-only commit and then add `format:check` to CI; mixing it into this functional diff would have doubled its review surface.
+
+---
+
+## 1. What DevHarbor is (context for any new contributor)
+
+DevHarbor is a signed, notarized, auto-updating Electron 33 + React 18 + TypeScript macOS app: a local supervisor for Node.js dev servers. It registers project folders, detects package manager / Node version / scripts, runs multi-task apps in dependency order with readiness probes, and gives live logs (xterm), CPU/mem stats, port detection, layered env vars (global → app → task → `.env` files), folders/tags, a ⌘K palette, deep links (`devharbor://`), and GitHub-Releases auto-update. Main-process services own all process truth; the renderer is a view over typed IPC.
+
+## 2. Where the app stands - strengths worth protecting
+
+The review confirmed a lot of genuinely good engineering (worth stating so fixes don't regress it):
+
+- **Electron hardening is above-average:** `contextIsolation` + `sandbox` + `nodeIntegration:false`, `script-src 'self'` CSP, origin-checked `will-navigate`, `setWindowOpenHandler` that only forwards http(s), webview blocked, channel-whitelisted preload.
+- **Main process discipline:** every SQL statement is prepared/bound, FK constraints with cascades and `foreign_keys=ON`, WAL mode, per-migration transactions; all non-user command execution uses `execFile`/argv arrays (no shell interpolation); deep-link `start` is confirm-gated.
+- **Real performance engineering in hot paths:** PTY logs coalesced (33 ms / 16 KB) before IPC, memoized dashboard cards, bounded log rings.
+- **Strict TypeScript** (`noUncheckedIndexedAccess`, near-zero `any`), typed IPC surface, 47 green tests on the gnarly bits, honest specs.
+
+The dominant theme of what's wrong: **failure paths**. Happy paths are polished; error paths are silent, stuck, or lossy.
+
+---
+
+## 3. Headline issues (the short list)
+
+| # | Issue | Sev | Effort | Status |
+|---|-------|-----|--------|--------|
+| 1 | GitHub Actions Node 20 → 24 forced cutover **June 16 (5 days)**; release.yml is the only ship path and untested on node24 | high (time) | S | verified |
+| 2 | Restart-on-change is **silently dead**: chokidar 5 dropped glob support; watcher never fires | high | M | verified + reproduced |
+| 3 | Apps that have **ever run can never be removed** (sticky `exited` state vs `!== 'idle'` guard); sidebar remove fails silently | high | S | verified + reproduced |
+| 4 | `TaskRunner.start()` races: double-spawn + stale exit-handler can corrupt a live run's state | high | M | verified |
+| 5 | Failed start strands app in permanent "Starting"; start/stop errors invisible everywhere except AppDetail | high | M | verified |
+| 6 | Task-scoped env override of an app-scoped key **cannot be saved** (`UNIQUE(app_id,key)` from 0001 survived 0004); breaks env panel permanently for affected tasks | high | M | verified |
+| 7 | EnvEditor silently discards unsaved edits (close / task switch / cross-tab save) | high | M | verified |
+| 8 | Quit (incl. auto-update install) kills running servers abruptly - bypasses the graceful-stop machinery entirely | high | S-M | verified |
+| 9 | `db:export` / `db:reset` ignore the WAL file - backups can miss nearly all recent data; reset leaves an orphaned WAL | high | S | unverified - reproduce first |
+| 10 | dotenv parser mangles multiline values, `export` prefix, and `KEY="x" # comment` - and the mangled value *wins* over the framework's own parse | high | S | unverified - reproduce first |
+
+---
+
+## 4. Urgent - do this week
+
+### 4.1 Bump release workflow actions before the June 16 node24 cutover *(S, verified)*
+`release.yml` pins `actions/checkout@v4`, `setup-python@v5`, `pnpm/action-setup@v4`, `setup-node@v4`, `upload-artifact@v4` - all run on the Node 20 runtime that GitHub force-migrates to node24 on **2026-06-16**. Because there is no CI, the first run under node24 would be a real signing/notarization release. Bump to node24-native majors (`checkout@v5`, `setup-node@v5`, `setup-python@v6`, `upload-artifact@v5`; verify pnpm/action-setup) and exercise once via `workflow_dispatch` with `--publish never` semantics (see 13.3) before the deadline.
+Files: `.github/workflows/release.yml`
+
+---
+
+## 5. P1 - Correctness bugs (suggested scope for v1.0.2)
+
+These are shipped-feature breakages; all *(verified)* unless noted.
+
+### 5.1 Restart-on-change watcher is dead *(high, M)* - reproduced during review
+[RestartWatcher.ts:26](../src/main/services/RestartWatcher.ts) passes glob patterns (`src/**/*.{ts,tsx,...}`) straight to `chokidar.watch`, and glob strings to `ignored`. Installed chokidar is **5.0.0**; glob support was removed in v4. The patterns are treated as literal non-existent paths → the watcher never fires. Empirically confirmed: zero events on file changes before the fix.
+**Fix:** watch the app directory with a **function** `ignored` (path-segment checks or picomatch for node_modules/.git/dist), filter emitted paths against the configured globs with picomatch. ⚠️ A naive "watch the whole dir" fix without working ignores would recursively watch node_modules - pair the two. Add a real-FS test that touches a temp file and asserts the `restart` event.
+
+### 5.2 Apps can never be removed after they've run *(high, S)* - reproduced during review
+[ipc/index.ts:174](../src/main/ipc/index.ts) guards `apps:remove` with `appState(id) !== 'idle'`, but the sticky-outcome design (lastOutcome + boot seeding from run_history) means any app that ever ran reports `'exited'`/`'crashed'` forever. AppDetail shows the misleading "Stop the app before removing it."; the Sidebar ⋮ remove swallows the rejection in `console.error` - the user confirms the danger dialog and *nothing happens*.
+**Fix:** block only live states (`running | starting | exiting`); clear `lastOutcome` on remove; surface the rejection in Sidebar (toast/confirm host). Add a vitest for remove-after-run.
+
+### 5.3 `TaskRunner.start()` double-spawn race + exit-handler identity confusion *(high, M)*
+The `isRunning` check and `tracked.set` are separated by `await env.build(...)` - two concurrent starts (restart-watcher + user click; `proc:start` + `task:start`) both pass the guard and both spawn PTYs. Also `'exiting'` is not treated as running, so starting during the kill-grace window overwrites a live entry. The orphaned PTY's `onExit` then looks up by task id and mutates the *successor* run - marking a healthy process exited, finalizing the wrong run_history row, untracking live stats/ports.
+**Fix:** synchronous in-flight marker set before any `await`; treat `'exiting'` as not-startable (or await the pending stop); in `onData`/`onExit`/cleanup compare `tracked.get(task.id) === tracked` (closure identity) before mutating.
+Files: `src/main/services/TaskRunner.ts:131-272`
+
+### 5.4 Failed start strands the app in permanent "Starting" *(high, S)*
+`AppOrchestrator.startApp` emits `'starting'` then runs the level loop with no try/catch - if `runner.start` throws (folder moved, Node pin missing, env build failure) the terminal status never fires. UI shows amber "Starting" forever with a Stop button for a process that never spawned.
+**Fix:** wrap the level loop; on error emit a terminal `proc:status` (crashed, or a new `'failed'` state with message) before re-throwing - same pattern the RestartWatcher error path already uses.
+Files: `src/main/services/AppOrchestrator.ts:119-157`
+
+### 5.5 Start/stop failures invisible outside AppDetail *(high, M)*
+Only AppDetail catches lifecycle errors. Dashboard cards, ⌘K palette (which closes immediately), Sidebar ⋮, TaskTabs, and the env-changed banner all `void`-discard rejections. NodeResolver produces *good* error messages ("Node vX is not installed…") that no one ever sees.
+**Fix:** one global error surface (toast/banner at App.tsx root, like PromptModalHost) + route all lifecycle calls through a shared store helper instead of raw `void invoke(...)` at 8+ call sites. Pairs with the typed-error envelope (12.3).
+
+### 5.6 Task-level env overrides impossible to save *(high, M)*
+Migration 0004 added `task_id` to `env_vars` but left 0001's table-level `UNIQUE(app_id, key)`. A task-scoped var whose key exists at app scope - the whole point of layering, and the documented intent in EnvLayering tests - violates the constraint and rolls back the save. Worse: the lazy `ensureTaskBackfilled` hits the same violation inside `env:getTask`, so the env panel for that task rejects on *every read*. (Bonus: the constraint is inert for global scope since `app_id IS NULL` bypasses UNIQUE.)
+**Fix:** migration 0006 rebuilding `env_vars` (SQLite can't drop table constraints): three partial unique indexes - `UNIQUE(key) WHERE app_id IS NULL AND task_id IS NULL`, `UNIQUE(app_id,key) WHERE … task_id IS NULL`, `UNIQUE(task_id,key) WHERE task_id IS NOT NULL`. Add a real-DB integration test running the actual migrations.
+Files: `src/main/db/migrations/0001_init.sql:27`, `0004_env_task_scope.sql`, `src/main/services/EnvStore.ts:107,164`
+
+### 5.7 Deleted task env vars resurrect after relaunch *(medium, S, verified)*
+`ensureTaskBackfilled` re-runs the legacy `tasks.env_overrides` JSON backfill whenever a task has zero env rows, guarded only by an in-process Set. Delete all task vars → relaunch → frozen JSON re-inserts them (including secrets the user explicitly deleted). The 0004 migration comment specifies the missing persistent marker that was never implemented.
+**Fix:** `UPDATE tasks SET env_overrides='{}'` inside the backfill transaction (and on successful `setTask`).
+Files: `src/main/services/EnvStore.ts:30,164`
+
+### 5.8 EnvEditor silently discards unsaved edits three ways *(high, M)*
+(1) Close (X) has no dirty check - all unsaved rows across all three tabs vanish; (2) switching task in the picker refetches and clobbers unsaved task rows; (3) saving the Global tab refetches and resets unsaved App-tab edits. No success feedback on Save either.
+**Fix:** dirty flag per scope vs last-fetched snapshot; gate close/task-switch behind `openConfirm('Discard unsaved changes?')`; scope post-save refresh to the saved tab; transient "Saved ✓".
+Files: `src/renderer/components/EnvEditor.tsx:48,101`, `AppDetail.tsx:476`
+
+### 5.9 Graceful teardown on quit *(high product + medium reliability, S-M)*
+The only quit hook is `before-quit → closeDb()`. The SIGTERM → grace → SIGKILL → tree-kill machinery is **never invoked on quit** - children die via PTY teardown (or survive as orphans if they ignore SIGHUP), run_history rows are left open, and `quitAndInstall` (auto-update!) force-closes mid-serve. Also: DB closes *first*, and a late PTY exit event can lazily **re-open the DB** and re-run migrations during shutdown.
+**Fix:** `before-quit` → `preventDefault()` on first pass; if tasks are running, confirm ("3 servers running - stop and quit?"); reverse-topo stop bounded by `kill_grace_ms`; close DB last; re-entry flag; hook same path before `quitAndInstall`. Guard `db()` against reopening after `closeDb()`.
+Files: `src/main/index.ts:150`, `src/main/services/Updater.ts:48`, `src/main/db/index.ts:75`
+
+### 5.10 dotenv parser fidelity *(high, S, unverified - add failing tests first)*
+`parseDotEnv` (used at spawn time and for paste-import) diverges from real dotenv: multiline quoted values (PEM keys - common for Firebase/Google) become a mangled first-line fragment; `export KEY=value` lines are silently skipped; `KEY="x" # comment` keeps literal quotes. Because DevHarbor injects parsed values into the spawned env and frameworks don't override pre-existing process env, **the mangled value wins over the framework's own correct parse** - apps behave differently under DevHarbor than in a terminal, with no error.
+**Fix:** support multiline quoted values, `export ` prefix, trailing comments after closed quotes (or vendor motdotla/dotenv's `parse()`); extend `src/shared/__tests__/dotenv.test.ts` with all three cases.
+Files: `src/shared/dotenv.ts:11-37`
+
+### 5.11 `db:export` / `db:reset` ignore WAL *(high, S, unverified - reproduce first)*
+DB runs in WAL mode; `db:export` does `copyFileSync` of only the main file while the handle is open - for a DB this small, essentially *all* data since launch lives in the `-wal` file, so user backups can be near-empty. `db:reset` archives the same stale file, unlinks the live DB with the handle open, leaves `-wal`/`-shm` behind, then `app.exit(0)` - which **skips `before-quit`**, so the WAL is never checkpointed and may be recovered into the fresh DB on relaunch.
+**Fix:** export via better-sqlite3's online backup (`db().backup(path)`) or `VACUUM INTO`; reset: `closeDb()` first, move `.db` + `-wal` + `-shm` aside together, then relaunch.
+Files: `src/main/ipc/index.ts:274-305`, `src/main/db/index.ts:26`
+
+---
+
+## 6. Security
+
+Posture is strong (see §2). Remaining items are defense-in-depth, roughly in priority order:
+
+1. **Project `.env` outranks user-configured env and the computed PATH** *(medium, S)*. `EnvBuilder` layers on-disk `.env`/`.env.local` **last**, so a malicious (or just weird) repo's `.env` can override `PATH`, `NODE_OPTIONS`, `DYLD_*` - and the spawn resolves `npm`/`node` through that PATH, for *any* task the user runs in that app. It also silently overrides values the user set in the trusted UI. **Fix:** layer project `.env` below user-configured scopes, and/or deny-list process-control keys (PATH, NODE_OPTIONS, NODE_PATH, DYLD_*, LD_*) from file-sourced env; never let `.env` replace the computed PATH. (`EnvBuilder.ts:44,62,71`)
+2. **Electron fuses never configured** *(medium, M, verified)*. Shipped binary leaves `RunAsNode`, `NODE_OPTIONS`, `--inspect` enabled - any local process can run arbitrary code under DevHarbor's signed, notarized, entitled identity (`ELECTRON_RUN_AS_NODE=1`). **Fix:** `@electron/fuses` via afterPack: disable RunAsNode / NodeOptions / NodeCliInspect, enable `OnlyLoadAppFromAsar` + asar integrity. (electron-builder afterPack runs pre-sign, so fuses get covered by codesign.)
+3. **Trim over-broad entitlements** *(low, M, verified - already flagged in the plist's own comments)*. `disable-library-validation` + `allow-dyld-environment-variables` together permit library injection into the notarized process; `disable-executable-page-protection` is likely unneeded. electron-builder re-signs the native `.node` files with your Team ID, so library validation can probably stay on. **Fix:** remove `disable-executable-page-protection` first, then try removing `disable-library-validation`; verify the notarized build loads better-sqlite3/node-pty. (`build/entitlements.mac.plist`)
+4. **Pin Actions to commit SHAs in the signing job** *(medium, S)*. The job that decodes the .p12 and holds notarization secrets runs five third-party actions at floating major tags. Pin to full SHAs.
+5. **`apps:update` skips the validation `apps:add` enforces** *(low, S)*. Route patch `path`/`workingDir` through `normalisePath` (realpath + isDirectory) in `AppRegistry.update`. Also pin identity fields - a patch containing `id` currently retargets another row (mirror TaskRegistry's `id: current.id` pattern). (`AppRegistry.ts:99-135`)
+6. **Deep-link `open?path` auto-runs detection with no user gesture** *(low, S)*. A web page can pop the Add drawer and trigger `apps:detect` (package.json read + dir enumeration) on an arbitrary path. Require a user click in the drawer before detection runs for deep-link-supplied paths; realpath the path before `getByPath` so registered apps match. (`DeepLinks.ts:75`, `AddAppDrawer.tsx:82`)
+7. **CSP tightening** *(low, S)*: add `object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'`; narrow `ws:` to localhost. (`index.html:5`)
+8. **Secrets stored plaintext in SQLite** *(medium, M, verified)*. `is_secret` only switches the input to `type=password`; values sit unencrypted in `devharbor.db` and round-trip to the renderer on every `env:get*`. **Fix:** `safeStorage.encryptString` for secret values (versioned `enc1:` prefix), decrypt only in main inside `EnvBuilder.build`, masked placeholders over IPC + explicit `env:reveal` channel; migrate existing rows; fall back visibly if encryption unavailable. (`EnvStore.ts:140,202`)
+9. **Validate IPC payload shapes at the main boundary** *(low, M)*: the preload whitelist gates channel *names* only; add per-channel guards (zod/valibot or hand-rolled) for the handlers that touch fs/DB/spawn.
+
+## 7. Reliability & process lifecycle
+
+(5.3, 5.4, 5.9 above are the big three.) Also:
+
+1. **SIGTERM only reaches the PTY child** *(medium, S)*: `pty.kill('SIGTERM')` signals the wrapper; npm/shell chains don't forward it, so real servers usually skip graceful shutdown and get tree-SIGKILLed. Also SIGKILL escalation resolves without awaiting the exit event, making `'exiting'` a possible dead-end. **Fix:** `treeKill(pid,'SIGTERM')` (or signal the process group) for the graceful phase; after SIGKILL, bounded wait for exit then force-finalize. (`TaskRunner.ts:319-350`)
+2. **Readiness probes have no timeout** *(medium, S)*: port-never-opens or regex-never-matches → `startApp` hangs in "starting" forever (compounds 5.4). Add a per-task readiness timeout (default ~60 s) resolving `ready=false` with a distinguishable status. (`readiness/PortReadiness.ts`, `LogReadiness.ts`)
+3. **PTY orphaned if `RunHistory.start` throws post-spawn** *(medium, S)*: wrap post-spawn steps; kill the PTY on failure or make history non-fatal. (`TaskRunner.ts:168-185`)
+4. **Restart storms** *(medium, S)*: restart triggers can overlap each other and user actions (no per-app mutex; `restartApp` is stop → 100 ms → start). Keep a per-app in-flight promise; coalesce triggers. (`AppOrchestrator.ts:191`, `ipc/index.ts:106`)
+5. **Log-hinted ports never pruned** *(medium, S)*: "Port 3000 in use, trying 3001" pins 3000 to the task forever. Expire hints not confirmed by lsof within ~3 polls. (`PortDetector.ts:57,91`)
+6. **Stats only sample the wrapper PID** *(low, S)*: CPU/mem reflect the idle npm/shell wrapper, not the actual server. Reuse PortDetector's descendant walk; `pidusage` accepts pid arrays. (`StatsMonitor.ts:62`)
+7. **Concurrency is untested** *(low → fix alongside)*: add tests for double-start, start-during-exiting, SIGTERM-ignoring child escalation, readiness timeout, quit teardown.
+
+## 8. Data integrity & persistence
+
+(5.6, 5.7, 5.11 above.) Also:
+
+1. **DB open/migration failure UX** *(medium, S)*: `_db` is cached before migrations run; a migration throw escapes `whenReady` - dock icon, no window, no dialog, half-migrated cached handle. Assign `_db` only after success; `dialog.showErrorBox` with "quit" vs "move DB aside and start fresh". (`db/index.ts:25-45`)
+2. **`run_history` grows unbounded; `log_file` column is dead** *(medium, S)*: no DELETE path exists; restart-on-change (once fixed!) multiplies rows. Prune at boot (age or per-app cap) behind a retention setting. (`RunHistory.ts`)
+3. **Corrupt JSON cell breaks all listing** *(medium, S)*: bare `JSON.parse` in `rowToApp`/`rowToTask` - one bad cell rejects `apps:list` and the app renders empty. Add `safeJson(raw, fallback)` + warning log. (`AppRegistry.ts:199`, `TaskRegistry.ts:244`)
+4. **localStorage prefs orphan on folder rename** *(low, S)*: folder-keyed keys (collapse/pin/order) aren't migrated on rename and never pruned; validate shapes on read, rewrite keys during rename, prune on mount. (`Sidebar.tsx:36-62`)
+
+## 9. Performance & efficiency
+
+1. **LogSearchView re-reads the whole ring on every log event** *(medium, S, verified)*: filter mode + chatty task = up to ~30 × 5 MB IPC reads/sec + full 10k-line regex pass each time. Throttle to ~250-500 ms or append incrementally (events already arrive batched). (`LogSearchView.tsx:22`)
+2. **Process polling fork storm** *(medium, S+M)*: StatsMonitor execs one `ps` per task per tick (pidusage accepts pid arrays - batch to one call), and PortDetector spawns O(process-tree) `pgrep` + one `lsof` per task every 2 s (~25-35 forks/sec with 10 tasks). Snapshot the process table once per tick (`ps -axo pid=,ppid=`), build descendant sets in memory, one `lsof -p <all pids>`. (`StatsMonitor.ts:62`, `PortDetector.ts:87,132`)
+3. **Per-task stats IPC → N dashboard re-renders/sec** *(medium, M)*: batch the tick into one event/one store set; hoist per-app sorted-tasks/port-entries into `useMemo` keyed on `tasksByApp`. (`store.ts:309`, `Dashboard.tsx:182`)
+4. **LogBuffer: no global cap; buffers survive exit forever** *(medium, S)*: 50 apps × 5 MB rings can pin hundreds of MB in main indefinitely (and `chunk.length` undercounts real bytes ~2×). Global byte budget + LRU eviction of exited-task buffers. (`LogBuffer.ts:8`)
+5. **All log streams forwarded regardless of visibility** *(low, M)*: add subscribe/unsubscribe per task; replay-from-buffer already covers tab switches. (`ipc/index.ts:128`)
+6. **Full 5 MB replay + WebGL context rebuild per tab switch** *(low, S)*: replay only the tail (`task:tailBuffer` already exists) with "load full history". (`LogTerminal.tsx:117`)
+7. **Boot N+1 `tasks:list`** *(low, S)*: add `tasks:listAll` returning everything in one query; skip AppDetail refetch when populated. (`App.tsx:57`)
+8. **Env watcher handle count** *(low, S)*: one watcher × 8 paths per registered app, mostly nonexistent files → watch each app dir at depth 0 and filter by filename, or only watch running + open apps. (`EnvFileWatcher.ts:52`)
+
+## 10. UX & error feedback
+
+(5.2, 5.5, 5.8 above are the heart of it.) Also:
+
+1. **TaskEditor deletes tasks instantly, no confirm** *(medium, S)* - inconsistent with the task strip's confirmed flow; deletion also drops task env vars and dependency edges. Reuse the danger dialog. (`TaskEditor.tsx:278`)
+2. **Add-app accepts non-Node folders silently** *(medium, S)*: detection returns normally with zero scripts; "Add app" stays enabled. Carry `hasPackageJson` in DetectionResult; inline warning ("you can still add it and run custom commands"). (`DetectionService.ts:38`, `AddAppDrawer.tsx:95`)
+3. **Stale copy** *(low, S)*: "Click \"Tasks\" above" (button removed in Phase 7); "Add one in Config" (no Config affordance). Grep for drift. (`AppDetail.tsx:458`, `AppOrchestrator.ts:92`)
+4. **Long app names overflow** *(low, S)*: `min-w-0 flex-1 truncate` + `title=` on Dashboard card title and AppDetail h1; length-cap the name inputs. (`Dashboard.tsx:316`, `AppDetail.tsx:231`)
+
+## 11. Accessibility & theming
+
+The app is effectively mouse-only today; this is the largest single UX-quality gap. One shared fix covers most of it:
+
+1. **Dialog semantics + focus management everywhere** *(medium, M, verified)*: AddAppDrawer, SettingsDrawer, AppConfigDrawer, TaskEditor, EnvEditor are plain divs - no `role="dialog"`/`aria-modal`, no Escape, no focus trap/restore; global shortcuts (⌘↩ Start!) still fire underneath open drawers. Build one `useDialog` hook/wrapper and apply it to all five (+ move PromptModal's Escape to window level). 
+2. **ContextMenu keyboard support** *(medium, M, verified)*: many actions exist *only* in these menus (task edit/disable/remove, folder rename/delete, sort pickers) and the menu can't be operated by keyboard. Fixing this one component (roles, arrow keys, focus-in/restore, anchor-to-trigger) repairs every menu in the app. (`ContextMenu.tsx`)
+3. **Sidebar app rows are unfocusable divs** *(medium, S, verified)*: primary navigation is unreachable by keyboard. Real buttons + `aria-current` + visible focus ring. (`Sidebar.tsx:1050`)
+4. **`fg-subtle` fails WCAG AA in both themes** *(medium, S)*: ~3.2-3.7:1 used for 10-11 px functional text. Lift one Radix step per theme. (`styles.css:41,73`)
+5. **Status is color-only and silent to AT** *(medium, S)*: `role="img"` + `aria-label` on StatusDot; non-color cue for crashed (ring/✕). (`StatusDot.tsx:29`)
+6. **xterm invisible to screen readers; ignores light theme** *(medium, S)*: `screenReaderMode: true`; light LIVE_THEME variant keyed off `useTheme`. (`LogTerminal.tsx:84`)
+7. **Icon-only buttons: default `aria-label` from `title`** in IconButton/ToolbarButton so call sites can't regress *(medium, S)*.
+8. **TaskTab nests a `role="button"` span inside a `<button>`** *(medium, S)*: invalid nesting; per-task start/stop is mouse-only. Split into sibling buttons + visible ⋮ trigger.
+9. **Custom dropdowns (FolderSelect, OpenInMenu, TagInput)** *(medium, M)*: listbox/option roles, Escape, arrow nav.
+10. **Folder reorder is drag-only** *(low, S)*: add Move up/down to the folder menu (plumbing exists).
+
+## 12. Engineering hygiene
+
+1. **No CI at all** *(medium, S, verified)*: nothing runs `typecheck`/`test` on push/PR despite CONTRIBUTING.md promising it; first signal of rot is a failed signed release. Add `ci.yml` (pull_request + push-to-main): `pnpm install --frozen-lockfile` → typecheck → test on macos-14 (matches the release runner / native rebuilds). Optional weekly unsigned packaging smoke.
+2. **Zero lint/format infra; dead `eslint-disable` comments** *(medium, S, verified)*: 4 production disable-comments suppress nothing - hook-dependency decisions are unverified. ESLint flat config (@typescript-eslint + react-hooks; adoption cost is low - code already conforms) + Prettier check in CI; optional husky/lint-staged.
+3. **Typed IPC error envelope** *(medium, M, verified)*: 30+ handlers throw prose `Error`s; renderer shows `"Error invoking remote method 'proc:start': …"` verbatim or drops it. `register()` should classify into `{code, message}`; renderer `invokeOrToast()` helper. Foundation for 5.5.
+4. **Sidebar.tsx is a 1,084-line God component** *(medium, M)*: extract `useLocalStorageState`, pure `groupApps()` (instantly unit-testable), menu-builder hooks. Extract along seams that already exist.
+5. **Duplicated status predicates** *(medium, S)*: `isLive`/`isActive` hand-written 16+ times across 7 files - add `lib/processState.ts` (precedent: `sortApps.ts`).
+6. **Renderer has zero tests; TaskRunner/NodeResolver untested** *(medium, L)*: don't chase UI snapshots - target pure seams: kill-escalation/batching with a fake pty, NodeResolver against fixture trees, extracted `groupApps`, store transitions.
+7. **Add-app is a renderer-orchestrated 4-call transaction** *(medium, M)*: replace with one `apps:create` channel inside a single SQLite transaction; the manual-rollback code disappears. (`AddAppDrawer.tsx:97`)
+8. **Spec drift** *(medium, S - project convention)*: `specs/04-ui.md` still documents the old add flow and a drag-onto-empty-state that doesn't exist; PROGRESS.md lacks the redesign + 1.0.x milestones. Update before committing the redesign.
+9. **Channel list can silently drift** *(low, S)*: derive `INVOKE_CHANNELS` from a `satisfies Record<ChannelName, true>` object so omissions fail compile; remove or annotate dead channels (`runs:list`, `app:ping`).
+10. **`x-appmgr-*` drag MIME types survived the rebrand** *(low, S)*: rename to `x-devharbor-*` (single-file change). (`Sidebar.tsx:40`)
+
+## 13. Distribution, updates & observability
+
+1. **Crash observability is zero** *(medium, M, verified)*: no `uncaughtException`/`unhandledRejection` handlers, no `render-process-gone` handler, no persistent app log - when a user reports "it crashed," there is nothing to attach. Add electron-log (or minimal file logger to `app.getPath('logs')`), wire updater + process handlers into it, Help → "Open Logs Folder", reference in the bug template. Stays true to the no-telemetry promise (logs are local).
+2. **Renderer crash = permanent blank window** *(medium, S, unverified)*: no React ErrorBoundary; no `render-process-gone` recovery. Boundary with Reload button; auto-reload with retry cap - PTYs live in main and survive it.
+3. **Updates: one silent check per launch** *(medium, M)*: long-running Macs never learn about releases; all failure paths invisible; no "Check for Updates…" menu item; release notes dropped from the banner (users decide to quit-and-install blind). Periodic re-check (4-12 h), menu item, `update:error`/`update:none` events, forward `releaseNotes`, show version in Settings footer.
+4. **`workflow_dispatch` can publish from any ref** *(medium, S)*: add a guard comparing the tag to package.json version, or `--publish never` for dispatch runs (also gives you the safe node24 test run for §4.1).
+5. **dmg/zip naming inconsistency** *(low, S)*: `devharbor-*.dmg` vs `DevHarbor-*.zip`; unify via `${productName}` artifactName + update README. Prerequisite for:
+6. **Homebrew cask** *(low, M)*: `brew install --cask devharbor` is the expected channel for this audience and solves the arm64/x64 picking friction.
+
+## 14. Product opportunities (ranked by leverage for a solo maintainer)
+
+1. **Menubar/tray presence** *(M, verified gap)* - the single highest-leverage retention feature. The app already keeps servers running with the window closed, but there's zero ambient surface (this product category lives in the menubar: OrbStack, Docker Desktop). Tray icon reflecting aggregate state; menu = apps with start/stop + ports + "Stop all". All state already flows through main - no renderer dependency.
+2. **Crash/ready notifications** *(S, verified gap)* - a crashed server while DevHarbor is backgrounded goes unnoticed until the browser tab errors; the monitoring half of the value prop breaks on blur. Electron `Notification` on `crashed` (click → focus app), settings toggle; optional "ready on :3000" toggle.
+3. **Quit confirmation + graceful stop** - already in P1 (5.9); product-critical, not just hygiene.
+4. **Monorepo/workspace detection** *(M)* - specs promise it (F1 edge cases); the backend (multi-task + `working_dir_override`) was *designed* for it; only detection (pnpm-workspace.yaml / `workspaces` field) + an add-flow offer ("create a task per workspace package") is missing. The gap that makes DevHarbor feel like it doesn't understand modern repos.
+5. **Bulk import** *(M)* - "Import projects from a folder…": shallow-scan for package.json dirs, checklist UI, batch-register via existing IPC. Target user has 3-20 repos; onboarding is currently N full drawer flows.
+6. **Per-app auto-start + launch at login** *(S)* - `app.setLoginItemSettings` + an `autoStart` column; "I sit down, my stack is already up." Pairs with the tray.
+7. **Start/stop all in folder** *(S)* - folders are display-only; this is 80% of "scenes" for 5% of the effort.
+8. **Port-conflict awareness** *(S)* - match EADDRINUSE in crash logs, enrich CrashPin with which registered task holds the port + "Stop X and restart".
+9. **Global log search** *(M)* - "which service printed ECONNREFUSED?" currently requires opening every app/tab; LogBuffer already holds everything in main. ⌘⇧F fan-out + minimal run-history resurrection inside it.
+10. **Window bounds persistence** *(S, unverified)* - save/restore `getNormalBounds()` with display validation; daily paper cut for a keep-open app.
+11. **Polyglot via mise** *(L, post-1.x)* - per the analysis on 2026-06-11: detect-existing-mise first as an additional resolver (provisioning vs orchestration boundary), guided install second, bundling only if proven. Near-term zero-code step: document "any command" tasks (redis-server, docker run …) in onboarding/task placeholder.
+
+## 15. Suggested sequencing
+
+**This week (before June 16):**
+- §4.1 Actions bump + dispatch test run · 12.1 CI workflow (small, protects everything else) · 13.4 dispatch guard
+
+**v1.0.2 - correctness patch (≈1-2 weeks of S/M items):**
+- 5.1 restart-watcher fix · 5.2 app removal · 5.4 stranded "starting" · 5.7 env resurrection · 5.10 dotenv parser (+tests) · 5.11 WAL-safe export/reset · 10.3 stale copy · 13.5 artifact naming
+- Commit the add-flow redesign with 12.8 spec updates
+
+**v1.1.0 - robustness & feedback:**
+- 5.3 start races · 5.5 global error surface + 12.3 error envelope · 5.6 env schema migration · 5.8 EnvEditor dirty guards · 5.9 quit teardown · 7.1-7.4 lifecycle hardening · 13.1-13.3 observability + update UX · 6.1/6.2 (.env precedence, fuses)
+- 11.1-11.3 dialog/menu/sidebar keyboard support (the three structural a11y fixes)
+
+**v1.2.0 - performance + product:**
+- §9 items 1-4 · 14.1 tray · 14.2 notifications · 14.6 auto-start · 14.7 folder start-all · 14.10 window bounds
+
+**v1.3.0+:**
+- 14.4 monorepo detection · 14.5 bulk import · 14.8 port conflicts · 14.9 global log search · 6.8 secret encryption · 13.6 Homebrew cask · remaining a11y/perf polish
+
+**Post-1.x:** mise/polyglot (14.11) · Windows/Linux validation
+
+## 16. Notes on method & confidence
+
+- *(verified)* = the finding survived two independent re-checks made with the explicit goal of refuting it (one re-reading the cited code for evidence, one judging real-world impact/mitigations). 22 findings went through this; **none were refuted**, several had severity adjusted.
+- The two most consequential bugs (5.1 restart-watcher dead, 5.2 unremovable apps) were additionally reproduced directly: chokidar 5.0.0 confirmed installed with glob patterns passed to `watch()`, and the `!== 'idle'` guard confirmed at `ipc/index.ts:174` against the sticky-outcome design.
+- *(unverified)* items (5.10, 5.11, PathProbe rc-noise, SSH_AUTH_SOCK/.env.development fidelity, renderer crash recovery, window bounds) came from the completeness critic; each cites concrete code but write a failing test/repro before fixing.
+- Two further critic items not detailed above, worth a look while in EnvBuilder: **PathProbe** captures `$SHELL -l -i -c 'printf %s "$PATH"'` stdout verbatim - rc-file banners/nvm warnings corrupt the PATH base for every spawned task (wrap in sentinels, or drop `-i`); and the sanitized base env drops **SSH_AUTH_SOCK** (git-over-SSH fails under DevHarbor but works in a terminal) and ignores `.env.development`/`.env.*.local` variants that frameworks load.
diff --git a/specs/PROGRESS.md b/specs/PROGRESS.md
index 5f44f47..52e6b34 100644
--- a/specs/PROGRESS.md
+++ b/specs/PROGRESS.md
@@ -1,17 +1,17 @@
 # PROGRESS
 
-The build-status matrix for DevHarbor. **This file is authoritative** — if a feature is listed as shipped here, it's actually working in the codebase; if listed as planned, no code exists for it yet.
+The build-status matrix for DevHarbor. **This file is authoritative** - if a feature is listed as shipped here, it's actually working in the codebase; if listed as planned, no code exists for it yet.
 
 Maintained by hand. Update after every meaningful change.
 
 Legend:
 
-- ✅ shipped — code exists, exercised manually at least once
-- 🚧 in progress — partial implementation
-- 📐 spec'd — exists in `specs/`, no code yet
-- 💭 stretch — listed in `specs/` stretch sections, not committed for v1
+- ✅ shipped - code exists, exercised manually at least once
+- 🚧 in progress - partial implementation
+- 📐 spec'd - exists in `specs/`, no code yet
+- 💭 stretch - listed in `specs/` stretch sections, not committed for v1
 
-Last sync: **2026-05-22** (after Phase 6 polish marathon — audit findings closed).
+Last sync: **2026-05-22** (after Phase 6 polish marathon - audit findings closed).
 
 ---
 
@@ -20,35 +20,35 @@ Last sync: **2026-05-22** (after Phase 6 polish marathon — audit findings clos
 | # | Phase | Status | Notes |
 |---|---|---|---|
 | 0 | Scaffold | ✅ | electron-vite + React + TS + Tailwind + better-sqlite3 booted. Migration runner. IPC ping round-trip. |
-| 1 | Register + Detect + Run (F1–F5) | ✅ | App registry CRUD, NodeResolver, PMDetector, DetectionService, PTY-based ProcessManager, sidebar + detail view + xterm. |
+| 1 | Register + Detect + Run (F1-F5) | ✅ | App registry CRUD, NodeResolver, PMDetector, DetectionService, PTY-based ProcessManager, sidebar + detail view + xterm. |
 | 1.5 | Multi-task apps (F19, F4/F5 task-aware) | ✅ | `tasks` table + backfill, AppOrchestrator (topo start, reverse-topo stop), all four readiness watchers (none/port/log/exit/delay), TaskTabs strip in App Detail, TaskEditor drawer. Single-task apps still work unchanged. |
 | 2 | Logs polish + process hardening (F7, F15) | ✅ | Main-side `LogBuffer` ring buffer (5MB/10k lines per task) with `task:readBuffer` replay; coalesced IPC at ~30Hz / 16KB; xterm WebGL renderer + search addon (Cmd+F overlay); PTY resize on window resize via `task:resize`; `run_history` migration `0003` + writes per task; History sub-view in App Detail with Rerun; CrashPin component pins last 200 lines + Restart when a task crashes. |
-| 3 | Env, Dashboard, Stats (F6, F9–F11, F18) | ✅ | `EnvStore` (global + per-app) + `EnvBuilder` layering + chokidar `EnvFileWatcher` with disk-changed banner. `PathProbe` login-shell PATH on startup. `StatsMonitor` (pidusage @ 1Hz) and `PortDetector` (lsof + stdout parse) push `task:stats`/`task:ports`. Dashboard with per-app cards + CPU sparkline + clickable port chips. EnvEditor drawer (App/Global tabs, secret masking, effective merged preview, .env file panel). `Settings` service plumbed via IPC. |
-| 4 | Dev-friendly extras (F8, F12–F14, F16, F17) | ✅ | `cmdk` palette with Apps/Stop/Restart/Start/Actions sections (global ⌘K). `RestartWatcher` (chokidar, debounced 500ms) wired to `AppOrchestrator.restartApp` when `auto_restart_on_change` is enabled; `AppConfigDrawer` lets the user toggle it + edit globs. `LogSearchView` (react-window + anser) — virtualized regex/case-sensitive search with highlight + line numbers; new "Search" tab next to Logs/History. `DeepLinks` registers `devharbor://` protocol with `open` / `start` actions. `Updater` (`electron-updater`) plumbed end-to-end; no live feed yet (Phase 5). |
+| 3 | Env, Dashboard, Stats (F6, F9-F11, F18) | ✅ | `EnvStore` (global + per-app) + `EnvBuilder` layering + chokidar `EnvFileWatcher` with disk-changed banner. `PathProbe` login-shell PATH on startup. `StatsMonitor` (pidusage @ 1Hz) and `PortDetector` (lsof + stdout parse) push `task:stats`/`task:ports`. Dashboard with per-app cards + CPU sparkline + clickable port chips. EnvEditor drawer (App/Global tabs, secret masking, effective merged preview, .env file panel). `Settings` service plumbed via IPC. |
+| 4 | Dev-friendly extras (F8, F12-F14, F16, F17) | ✅ | `cmdk` palette with Apps/Stop/Restart/Start/Actions sections (global ⌘K). `RestartWatcher` (chokidar, debounced 500ms) wired to `AppOrchestrator.restartApp` when `auto_restart_on_change` is enabled; `AppConfigDrawer` lets the user toggle it + edit globs. `LogSearchView` (react-window + anser) - virtualized regex/case-sensitive search with highlight + line numbers; new "Search" tab next to Logs/History. `DeepLinks` registers `devharbor://` protocol with `open` / `start` actions. `Updater` (`electron-updater`) plumbed end-to-end; no live feed yet (Phase 5). |
 | 5 | Package + sign for macOS | ✅ | Full `electron-builder.yml` with hardened runtime, entitlements, asarUnpack for native deps, GitHub Releases publish target, deep-link URL scheme in Info.plist. `build/entitlements.mac.plist` + `build/notarize.cjs` afterSign hook. About panel set via `app.setAboutPanelOptions`. `UpdateBanner` consumes `update:available` / `update:ready`. `.github/workflows/release.yml` builds + signs + notarizes + publishes on `v*` tags. `specs/06-release.md` is the full runbook. **Unsigned arm64 DMG verified locally (105MB).** Signing requires Apple Developer credentials supplied via env vars / GitHub secrets. |
 | 6 | v1 polish marathon | ✅ | Theming overhaul (Radix slate scale, semantic CSS variables), dashboard redesign (Recent strip + stable alphabetical grid), tab consolidation (Logs · Live/Filter), Node version picker, per-task port chips, sidebar/task right-click menus, Cmd+Enter to start, EnvEditor bulk paste/export, deep-link app focus, updater progress %, full Vitest suite, danger-zone settings, signed icon. |
-| 7 | UI consistency + task-level env | ✅ | **Layout-stable cards & header** (port row + task strip reserve fixed height in IDLE state — no shift on Start; card min-h removed in round 2 since chip-row content already aligns same-task-count cards). **Three-tier env** (global / app / task) — `env_vars.task_id` column, EnvBuilder reads task rows from DB instead of `tasks.env_overrides` JSON (frozen via TaskRegistry guard), EnvEditor third tab + grouped preview Task→App→Global. **Detail header refactor** — header "Tasks" + "Script:" buttons both removed; single/multi-task headers identical. Smart delete (stop-then-remove when running). Lifecycle buttons share min-w. **Copy-path icon**. **Logs header typography**. **Sidebar count badge** switched to white text on success-strong green (was bg-base on green, ~2.8:1). EnvLayering test (9 cases) covers 3-scope precedence. |
+| 7 | UI consistency + task-level env | ✅ | **Layout-stable cards & header** (port row + task strip reserve fixed height in IDLE state - no shift on Start; card min-h removed in round 2 since chip-row content already aligns same-task-count cards). **Three-tier env** (global / app / task) - `env_vars.task_id` column, EnvBuilder reads task rows from DB instead of `tasks.env_overrides` JSON (frozen via TaskRegistry guard), EnvEditor third tab + grouped preview Task→App→Global. **Detail header refactor** - header "Tasks" + "Script:" buttons both removed; single/multi-task headers identical. Smart delete (stop-then-remove when running). Lifecycle buttons share min-w. **Copy-path icon**. **Logs header typography**. **Sidebar count badge** switched to white text on success-strong green (was bg-base on green, ~2.8:1). EnvLayering test (9 cases) covers 3-scope precedence. |
 | 8 | Folders in sidebar (F21) | ✅ | `apps.folder` column (migration 0005), AppRegistry helpers (listFolders, renameFolder, clearFolder), Sidebar grouped rendering with collapsible sections (localStorage state), right-click move/rename/delete, AppConfigDrawer folder field with datalist autocomplete. Tags remain orthogonal. |
-| 8.b | Sidebar UX overhaul | ✅ | **⋮ overflow menu** per app row (replaces hidden right-click; right-click still works as fallback). State conveyed via **colored ring around the color dot** (green/amber/red); idle = no ring. **+** (add app) and **📁+** (new folder) icons moved up next to the APPS section label — Postman-style discoverability. Bottom row reduced to just the Settings cog. **PromptModal** component replaces silently-no-op `window.prompt()` for new/rename folder flows. **HTML5 drag-and-drop** apps between folder sections (drop on "(Ungrouped)" to clear). Empty folders persisted in `localStorage["devharbor:pinned-folders"]`. |
+| 8.b | Sidebar UX overhaul | ✅ | **⋮ overflow menu** per app row (replaces hidden right-click; right-click still works as fallback). State conveyed via **colored ring around the color dot** (green/amber/red); idle = no ring. **+** (add app) and **📁+** (new folder) icons moved up next to the APPS section label - Postman-style discoverability. Bottom row reduced to just the Settings cog. **PromptModal** component replaces silently-no-op `window.prompt()` for new/rename folder flows. **HTML5 drag-and-drop** apps between folder sections (drop on "(Ungrouped)" to clear). Empty folders persisted in `localStorage["devharbor:pinned-folders"]`. |
 | 9 | Rebrand → DevHarbor | ✅ | App Manager → DevHarbor across package.json, electron-builder.yml (appId `app.devharbor.desktop`, productName, protocol `devharbor://`, repo), src/main (About panel, deep-link scheme, DB filename `devharbor.db`), all renderer strings + localStorage keys, README, specs, entitlements. New app icon (1024² → full .icns). DMG → `devharbor-0.1.0-arm64.dmg`. |
 | 10 | Add-app flow + in-app dialogs | ✅ | **Add-app fix**: chosen default script is now materialised into the app's first Task via `tasks:add` (was: script stored on app row but no task → Start failed "No enabled tasks"). Add drawer gains **NodeVersionPicker**, **package-manager override** (pre-selected to detected PM), and optional **.env paste**. **`openConfirm`** added to the dialog host; all 5 native `confirm()` calls (TaskTabs, SettingsDrawer, Sidebar ×2, AppDetail) replaced with the custom danger-styled modal. `PromptModalHost` aliased to `DialogHost`. |
-| 11 | DevHarbor UI-reference theme | ✅ | Ported the claude.ai/design reference: **teal accent `#2dd4bf`** + neutral near-black canvas, **single glowing status dot** (running=green+pulse) consistent across sidebar/dashboard/recent/detail, **thin CPU progress bar** (replaces sparkline), teal port numbers. Dashboard icon → Boxes, **count badge** = 18px green circle with dark text, settings gear → bottom-left dim. "Open in" detection fixed (`.app` bundle existence + `open -a`, PATH-independent). Color picker removed. Detail header **action row regrouped** (uniform icon buttons │ filled primary │ isolated destructive). |
-| 12 | Prod hardening | ✅ | **Custom application menu** (`menu.ts`) replaces the Electron default — drops Toggle DevTools / Force Reload from prod (kept in dev), keeps ⌘R Reload, includes Edit roles for copy/paste, Help → www.devharbor.app, app menu with About/Quit DevHarbor. **Single-instance lock** + focus-on-second-instance. **`will-navigate` guard** + `<webview>` block. Launch `backgroundColor` → `#0a0a0a` (no flash). Dead-code sweep (Sparkline, HistoryView, taskCpuHistory, unused imports). Already-present security kept: contextIsolation, sandbox, nodeIntegration off, window-open http/https-only, CSP, hardened runtime. |
-| 13 | Dashboard IA redesign | ✅ | **Removed the Recent strip** (redundant with sidebar + grid; `RecentStrip.tsx` deleted). Dashboard reframed as the **control room**: leads with an **aggregate stat strip** (Running / CPU / Memory / Open ports across all running tasks) — value the navigation-only sidebar can't provide. Dropped the redundant "ALL APPS" label. **Running cards emphasised in place** (teal inset left edge + lifted surface) — no reorder, no layout shift. Sidebar kept as the switcher; dashboard is now monitoring + control. |
+| 11 | DevHarbor theme refresh | ✅ | New look: **teal accent `#2dd4bf`** + neutral near-black canvas, **single glowing status dot** (running=green+pulse) consistent across sidebar/dashboard/recent/detail, **thin CPU progress bar** (replaces sparkline), teal port numbers. Dashboard icon → Boxes, **count badge** = 18px green circle with dark text, settings gear → bottom-left dim. "Open in" detection fixed (`.app` bundle existence + `open -a`, PATH-independent). Color picker removed. Detail header **action row regrouped** (uniform icon buttons │ filled primary │ isolated destructive). |
+| 12 | Prod hardening | ✅ | **Custom application menu** (`menu.ts`) replaces the Electron default - drops Toggle DevTools / Force Reload from prod (kept in dev), keeps ⌘R Reload, includes Edit roles for copy/paste, Help → www.devharbor.app, app menu with About/Quit DevHarbor. **Single-instance lock** + focus-on-second-instance. **`will-navigate` guard** + `<webview>` block. Launch `backgroundColor` → `#0a0a0a` (no flash). Dead-code sweep (Sparkline, HistoryView, taskCpuHistory, unused imports). Already-present security kept: contextIsolation, sandbox, nodeIntegration off, window-open http/https-only, CSP, hardened runtime. |
+| 13 | Dashboard IA redesign | ✅ | **Removed the Recent strip** (redundant with sidebar + grid; `RecentStrip.tsx` deleted). Dashboard reframed as the **control room**: leads with an **aggregate stat strip** (Running / CPU / Memory / Open ports across all running tasks) - value the navigation-only sidebar can't provide. Dropped the redundant "ALL APPS" label. **Running cards emphasised in place** (teal inset left edge + lifted surface) - no reorder, no layout shift. Sidebar kept as the switcher; dashboard is now monitoring + control. |
 | 13.b | macOS menu actions | ✅ | HIG-standard system-menu items wired to the renderer via typed `menu:*` events: **Settings… (⌘,)** in the app menu → opens the Settings drawer; **Add App… (⌘N)** + **Add Folder… (⌘⇧N)** in File. `installAppMenu` takes a window getter; `App.tsx` handles settings/add-app and relays new-folder to the sidebar via a DOM event. |
-| 15 | Code-review fixes (high-effort recall pass) | ✅ | **Add-app**: stop persisting `default_script` (killed backfill resurrecting a deleted task) + roll back the app if task/env creation throws (no orphan). **Shared `src/shared/dotenv.ts`** parser + `isSecretKey` replaces 3 diverged copies (EnvBuilder expanded escapes, renderer copies didn't) + 8 new tests. **Menu** create/focus a window when none is open (⌘,/⌘N/⌘⇧N no longer dead keys). **Dashboard** `React.memo(AppCard)` — idle cards skip the ~1Hz re-render. **OpenIn** detect editors via LaunchServices (`osascript`) so non-standard install locations aren't hidden. **store** clears CPU/mem/ports when a task leaves running (no stale values on restart). **AddAppDrawer** memoizes env key-count parse. **will-navigate** compares URL origin, not string prefix. **Sidebar** drops a folder from the pinned list once it has an app (no zombie empty folders). |
+| 15 | Code-review fixes (high-effort recall pass) | ✅ | **Add-app**: stop persisting `default_script` (killed backfill resurrecting a deleted task) + roll back the app if task/env creation throws (no orphan). **Shared `src/shared/dotenv.ts`** parser + `isSecretKey` replaces 3 diverged copies (EnvBuilder expanded escapes, renderer copies didn't) + 8 new tests. **Menu** create/focus a window when none is open (⌘,/⌘N/⌘⇧N no longer dead keys). **Dashboard** `React.memo(AppCard)` - idle cards skip the ~1Hz re-render. **OpenIn** detect editors via LaunchServices (`osascript`) so non-standard install locations aren't hidden. **store** clears CPU/mem/ports when a task leaves running (no stale values on restart). **AddAppDrawer** memoizes env key-count parse. **will-navigate** compares URL origin, not string prefix. **Sidebar** drops a folder from the pinned list once it has an app (no zombie empty folders). |
 
 ## Feature-by-feature
 
 | ID | Feature | Spec | Code | Notes |
 |---|---|---|---|---|
-| F1 | Register a local app | ✅ | ✅ | Direct-add (no confirmation drawer yet — Phase 1 trade-off). |
+| F1 | Register a local app | ✅ | ✅ | Direct-add (no confirmation drawer yet - Phase 1 trade-off). |
 | F2 | Detect & resolve Node version | ✅ | ✅ | nvm / fnm / volta / asdf / system. `.nvmrc` / `.node-version` / `engines.node`. Blocks start with install hint if missing. |
 | F3 | Detect & use package manager | ✅ | ✅ | `package-manager-detector` (lockfile + `packageManager` field). |
 | F4 | Start / stop / restart | ✅ | ✅ | App-level Start/Stop/Restart drives the orchestrator (topo start, reverse-topo stop). Per-task Start/Stop in tab strip. |
 | F5 | Script picker | ✅ | ✅ | Header dropdown for single-task apps, full task editor for multi-task. |
 | F6 | Env vars (global + per-app + per-task) | ✅ | ✅ | `EnvStore` with replace-semantics save, **three scopes since Phase 7** via `env_vars.task_id` column. UI: drawer with Global / App / Task tabs (task tab only with task context), secret masking, override-chip indicators per scope, effective merged preview, .env file list. Disk changes raise a Restart banner. |
-| F7 | Live logs (per app) | ✅ | ✅ | xterm + ANSI + WebGL + Cmd+F search + main-side ring buffer + coalesced IPC + PTY resize. Toolbar: copy all (clipboard), save to file (download), font size +/-, jump-to-bottom chip when scrolled. Long-line truncation in LogBuffer with `[line truncated]` marker. *(Autoscroll lock toggle deferred — a "jump to bottom" chip is shipped instead.)* |
+| F7 | Live logs (per app) | ✅ | ✅ | xterm + ANSI + WebGL + Cmd+F search + main-side ring buffer + coalesced IPC + PTY resize. Toolbar: copy all (clipboard), save to file (download), font size +/-, jump-to-bottom chip when scrolled. Long-line truncation in LogBuffer with `[line truncated]` marker. *(Autoscroll lock toggle deferred - a "jump to bottom" chip is shipped instead.)* |
 | F8 | Searchable log history | ✅ | ✅ | `LogSearchView` virtualizes the live ring buffer via `react-window`. ANSI rendered with `anser`. Plain or regex search, case toggle, match-count + clear. |
 | F9 | Dashboard / home screen | ✅ | ✅ | Cards per app with CPU sparkline, mem, port chips, Start/Stop. Start-all/Stop-all toolbar. |
 | F10 | Port detection + clickable links | ✅ | ✅ | `PortDetector` polls lsof every 2s + parses stdout for hints. Chips render in App Detail header and Dashboard cards. Click opens in default browser via `setWindowOpenHandler`. |
@@ -59,7 +59,7 @@ Last sync: **2026-05-22** (after Phase 6 polish marathon — audit findings clos
 | F15 | Crash handling + run history | ✅ | ✅ | `crashed` state with CrashPin showing last 200 lines + Restart. `run_history` populated per task via `RunHistory` service. History sub-view with Rerun action. |
 | F16 | Deep links (`devharbor://...`) | ✅ | ✅ | Protocol registered + `open-url` event. `open?path=` and `open?id=` push `deepLink:focusApp` to the renderer which selects the app. Unknown paths surface `deepLink:unknownPath` which opens the Add drawer pre-filled. `start?id=` focuses + starts. |
 | F17 | Auto-update | ✅ | ✅ | `Updater` + `update:available` / `update:progress` / `update:ready` / `update:install`. `UpdateBanner` shows download percentage and Quit & install. GitHub Releases publish wired. Activates once a signed Release is published. |
-| F18 | Settings | ✅ | ✅ | All settings honored: `kill_grace_ms` (TaskRunner), `log_ring_size` (LogBuffer + xterm scrollback), `theme` (renderer `<html>` class), `dashboard_refresh_ms` (StatsMonitor), `auto_update` (Updater). Node detection panel lists discovered nvm/fnm/volta/asdf/system installs. Danger zone: Export DB (file picker), Reset DB (archives + relaunches with empty DB). (The earlier inert `log_disk_persist_default` and `telemetry` flags were removed before 1.0 — no placeholder controls ship.) |
+| F18 | Settings | ✅ | ✅ | All settings honored: `kill_grace_ms` (TaskRunner), `log_ring_size` (LogBuffer + xterm scrollback), `theme` (renderer `<html>` class), `dashboard_refresh_ms` (StatsMonitor), `auto_update` (Updater). Node detection panel lists discovered nvm/fnm/volta/asdf/system installs. Danger zone: Export DB (file picker), Reset DB (archives + relaunches with empty DB). (The earlier inert `log_disk_persist_default` and `telemetry` flags were removed before 1.0 - no placeholder controls ship.) |
 | F19 | Multi-task orchestration | ✅ | ✅ | Full implementation: `tasks` table, TaskRegistry CRUD with cycle detection, AppOrchestrator with topo levels, all four readiness watchers (`none`/`port`/`log`/`exit`/`delay`), TaskTabs + TaskEditor UI, per-task and per-app lifecycle IPC. |
 
 ## Stack inventory
@@ -83,25 +83,25 @@ What's actually installed and used vs. spec'd-only:
 | tree-kill | ✅ | ✅ | ✅ |
 | ulid | ✅ | ✅ | ✅ |
 | lucide-react | ✅ | ✅ | ✅ |
-| `@tanstack/react-table` | ✅ | ⏳ | (env editor — Phase 3) |
-| `cmdk` | ✅ | ⏳ | (Cmd-K — Phase 4) |
-| chokidar | ✅ | ⏳ | (.env watching — Phase 4) |
-| pidusage | ✅ | ⏳ | (stats — Phase 3) |
+| `@tanstack/react-table` | ✅ | ⏳ | (env editor - Phase 3) |
+| `cmdk` | ✅ | ⏳ | (Cmd-K - Phase 4) |
+| chokidar | ✅ | ⏳ | (.env watching - Phase 4) |
+| pidusage | ✅ | ⏳ | (stats - Phase 3) |
 | dockerode | 💭 | ⏳ | (stretch) |
-| keytar | 💭 | ⏳ | (stretch — keychain secrets) |
+| keytar | 💭 | ⏳ | (stretch - keychain secrets) |
 
 ## Known limitations / known-broken (carry list)
 
 These are real and worth fixing; tracked here so they don't get lost. **Phase 6 is the polish marathon working through them.**
 
-- **DevTools auto-opens in dev** — intentional, but ungated. Add a setting in Phase 6 if there's time.
-- **Orchestrator can't await readiness on a task the user started manually** — if the user clicks Start on a single task and then starts the whole App, the orchestrator skips waiting on that task's readiness. Acceptable for v1.
+- **DevTools auto-opens in dev** - intentional, but ungated. Add a setting in Phase 6 if there's time.
+- **Orchestrator can't await readiness on a task the user started manually** - if the user clicks Start on a single task and then starts the whole App, the orchestrator skips waiting on that task's readiness. Acceptable for v1.
 
 ### Phase 6 audit close-out (all ✅ unless noted)
 
 All findings from the post-Phase-5 audit:
 
-- ✅ **Sidebar:** filter input + ⌘P, right-click context menu (Start/Stop/Restart/Reveal/Open Terminal/Remove), tag chips. *Drag-to-reorder and group-by-tag deferred — a `sort_position` migration is the cleanest path.*
+- ✅ **Sidebar:** filter input + ⌘P, right-click context menu (Start/Stop/Restart/Reveal/Open Terminal/Remove), tag chips. *Drag-to-reorder and group-by-tag deferred - a `sort_position` migration is the cleanest path.*
 - ✅ **App Detail:** Open-in menu (Finder/Terminal/VS Code/Cursor/Sublime, auto-detected), ⌘↩ to start.
 - ✅ **Log toolbar:** copy all, save to file, font size +/-, ⌘F search, jump-to-bottom chip on scroll-up. >10kB line truncation in LogBuffer.
 - ✅ **Tasks:** drag-to-reorder in TaskEditor list, right-click menu on tabs (Start/Stop/Restart/Disable/Edit/Remove).
@@ -116,28 +116,28 @@ All findings from the post-Phase-5 audit:
 
 ### Deferred items (not blocking v1)
 
-- **Drag-to-reorder sidebar apps** — needs a `sort_position` migration. Tasks are already reorderable; apps default to `updated_at DESC` order.
-- **Group sidebar by tag** — tag chips shipped; collapsible groups deferred.
-- **Autoscroll lock toggle in logs** — shipped as a "Jump to bottom" chip instead, which solves the same problem more cleanly.
-- **Per-run log save to disk** — not built; the placeholder `log_disk_persist_default` setting was **removed** before 1.0 (no dead controls ship). Revisit if/when disk persistence lands.
-- **Telemetry** — no telemetry pipeline, and the placeholder `telemetry` flag was **removed** before 1.0. (DevHarbor ships with no analytics.)
-- **DevTools auto-opens in dev** — intentional, but ungated.
-- **Orchestrator can't await readiness on a task the user started manually** — acceptable for v1.
+- **Drag-to-reorder sidebar apps** - needs a `sort_position` migration. Tasks are already reorderable; apps default to `updated_at DESC` order.
+- **Group sidebar by tag** - tag chips shipped; collapsible groups deferred.
+- **Autoscroll lock toggle in logs** - shipped as a "Jump to bottom" chip instead, which solves the same problem more cleanly.
+- **Per-run log save to disk** - not built; the placeholder `log_disk_persist_default` setting was **removed** before 1.0 (no dead controls ship). Revisit if/when disk persistence lands.
+- **Telemetry** - no telemetry pipeline, and the placeholder `telemetry` flag was **removed** before 1.0. (DevHarbor ships with no analytics.)
+- **DevTools auto-opens in dev** - intentional, but ungated.
+- **Orchestrator can't await readiness on a task the user started manually** - acceptable for v1.
 
 ## Recently fixed (carry-list closures)
 
-- **2026-05-22** — Phase 1.5 boot blank-screen / "Maximum update depth exceeded" — `useStore((s) => s.tasksByApp[id] ?? [])` returned a new `[]` per selector call, triggering a `useSyncExternalStore` re-render loop. Fixed with a module-level `EMPTY_TASKS` constant in AppDetail.tsx and TaskEditor.tsx.
-- **2026-05-22** — TaskEditor fired `tasks:update` IPC on every keystroke. Now coalesced via a `useDebouncedSave` hook (300ms) with optimistic local store updates so inputs stay snappy.
-- **2026-05-22** — Sticky error banners. Added a reusable `ErrorBanner` with a close-X; used in both AppDetail and TaskEditor.
-- **2026-05-22** — Phase 2: main-side `LogBuffer` + coalesced IPC, xterm WebGL + Cmd+F search, PTY resize sync, `run_history` per task, History sub-view, CrashPin.
-- **2026-05-22** — CrashPin dismissal bug in multi-task case (dismiss A → switch to B → back to A → A stayed hidden). Fixed by resetting dismissal when `taskId` changes via a `useEffect`.
-- **2026-05-22** — Phase 3: `PathProbe` (login-shell PATH on startup), `EnvStore` + `EnvBuilder` layering, `EnvFileWatcher` (chokidar) with disk-changed banner, `Settings` service + IPC, `StatsMonitor` (pidusage), `PortDetector` (lsof + stdout parse), Dashboard, EnvEditor, PortChip, Sparkline.
-- **2026-05-22** — `apps:update` was re-watching the env folder on every patch; now only re-watches when `path` actually changes.
-- **2026-05-22** — Settings UI pane shipped (sidebar gear icon → SettingsDrawer).
-- **2026-05-22** — Phase 4: `CommandPalette` (cmdk), `RestartWatcher` + `AppConfigDrawer`, `LogSearchView` (react-window + anser), `DeepLinks` (`devharbor://` protocol), `Updater` (electron-updater) plumbed.
-- **2026-05-22** — Cmd+K affordance: kbd-styled button in the sidebar header, clickable to open the palette.
-- **2026-05-22** — Phase 5: hardened-runtime entitlements, asarUnpack for native deps, deep-link URL scheme registered in Info.plist, About panel, UpdateBanner UI, GitHub Actions release workflow + `specs/06-release.md` runbook. Unsigned arm64 DMG built and verified locally.
-- **2026-05-22** — Phase 6 polish marathon (all audit findings):
+- **2026-05-22** - Phase 1.5 boot blank-screen / "Maximum update depth exceeded" - `useStore((s) => s.tasksByApp[id] ?? [])` returned a new `[]` per selector call, triggering a `useSyncExternalStore` re-render loop. Fixed with a module-level `EMPTY_TASKS` constant in AppDetail.tsx and TaskEditor.tsx.
+- **2026-05-22** - TaskEditor fired `tasks:update` IPC on every keystroke. Now coalesced via a `useDebouncedSave` hook (300ms) with optimistic local store updates so inputs stay snappy.
+- **2026-05-22** - Sticky error banners. Added a reusable `ErrorBanner` with a close-X; used in both AppDetail and TaskEditor.
+- **2026-05-22** - Phase 2: main-side `LogBuffer` + coalesced IPC, xterm WebGL + Cmd+F search, PTY resize sync, `run_history` per task, History sub-view, CrashPin.
+- **2026-05-22** - CrashPin dismissal bug in multi-task case (dismiss A → switch to B → back to A → A stayed hidden). Fixed by resetting dismissal when `taskId` changes via a `useEffect`.
+- **2026-05-22** - Phase 3: `PathProbe` (login-shell PATH on startup), `EnvStore` + `EnvBuilder` layering, `EnvFileWatcher` (chokidar) with disk-changed banner, `Settings` service + IPC, `StatsMonitor` (pidusage), `PortDetector` (lsof + stdout parse), Dashboard, EnvEditor, PortChip, Sparkline.
+- **2026-05-22** - `apps:update` was re-watching the env folder on every patch; now only re-watches when `path` actually changes.
+- **2026-05-22** - Settings UI pane shipped (sidebar gear icon → SettingsDrawer).
+- **2026-05-22** - Phase 4: `CommandPalette` (cmdk), `RestartWatcher` + `AppConfigDrawer`, `LogSearchView` (react-window + anser), `DeepLinks` (`devharbor://` protocol), `Updater` (electron-updater) plumbed.
+- **2026-05-22** - Cmd+K affordance: kbd-styled button in the sidebar header, clickable to open the palette.
+- **2026-05-22** - Phase 5: hardened-runtime entitlements, asarUnpack for native deps, deep-link URL scheme registered in Info.plist, About panel, UpdateBanner UI, GitHub Actions release workflow + `specs/06-release.md` runbook. Unsigned arm64 DMG built and verified locally.
+- **2026-05-22** - Phase 6 polish marathon (all audit findings):
   - 6.a Honesty pass + 3 real bug fixes (URL scheme validation, settings key validation, surface restart-on-change errors).
   - 6.b Wired all "dead" settings (kill_grace_ms, log_ring_size, theme).
   - 6.c Open-in menu, ⌘↩, log toolbar (copy/save/font), jump-to-bottom chip.
@@ -151,39 +151,50 @@ All findings from the post-Phase-5 audit:
   - 6.k Settings: Node-detection panel + Danger zone (Export DB / Reset DB).
   - 6.l Vitest 2 setup + 24 passing tests (topo, LogBuffer, PortDetector regex).
   - 6.m Long-line truncation (>10kB) with `[line truncated]` marker in LogBuffer.
-- **2026-05-22** — Dashboard now shows a consistent card grid for every app regardless of running state. **Real bug fix:** `AppOrchestrator.startApp` was not setting `lastStartedAt` (regression from the Phase 1 → 1.5 refactor) — now it does, and the renderer optimistically bumps the cached value on each `proc:status: starting`.
-- **2026-05-22** — Dashboard cards no longer jump on Start. Two-region design: a compact "Recent" strip up top (chips sorted by `lastStartedAt` DESC — they can re-order freely because they aren't the click target) + a stable **alphabetical** grid below that NEVER auto-reorders. Surfaces recency without disturbing the interaction surface. Pattern borrowed from Linear / VS Code "Recent" sections.
-- **2026-05-22** — Light mode actually works. Replaced hardcoded `bg-neutral-*` / `text-neutral-*` classes across all renderer components with semantic CSS-variable tokens (`bg-base` / `bg-surface` / `bg-elevated` / `border` / `border-strong` / `fg` / `fg-muted` / `fg-subtle` / `accent`). Variable values are set in `.dark` and `.light` blocks; toggling `theme` in Settings flips the whole palette without per-component overrides. (xterm log pane stays on a dark scheme regardless — intentional, matches VS Code.)
-- **2026-05-22** — Status colors (Stop buttons, Dashboard running-count badge, ErrorBanner, env-changed banner, CrashPin, etc.) had low light-mode contrast — the dark-red-at-30%-opacity tricks that worked on dark surfaces became invisible on white. Added semantic `danger` / `success` / `warn` token families (`bg`, `bg-hover`, `fg`, `border`, `strong`) with inverted dark/light palettes. Solid-color state dots (`bg-red-500`, `bg-green-500`, `bg-amber-500`) kept as-is since saturated mid-tones read on both backgrounds.
-- **2026-05-22** — Kbd shortcut hints now use a space between modifier and key (⌘ K, ⌘ P, ⌘ F, ⌘ ↩) — matches Apple's convention.
-- **2026-05-22** — Multi-task apps weren't showing port chips on the dashboard / detail. Three bugs in `PortDetector`:
+- **2026-05-22** - Dashboard now shows a consistent card grid for every app regardless of running state. **Real bug fix:** `AppOrchestrator.startApp` was not setting `lastStartedAt` (regression from the Phase 1 → 1.5 refactor) - now it does, and the renderer optimistically bumps the cached value on each `proc:status: starting`.
+- **2026-05-22** - Dashboard cards no longer jump on Start. Two-region design: a compact "Recent" strip up top (chips sorted by `lastStartedAt` DESC - they can re-order freely because they aren't the click target) + a stable **alphabetical** grid below that NEVER auto-reorders. Surfaces recency without disturbing the interaction surface. Pattern borrowed from Linear / VS Code "Recent" sections.
+- **2026-05-22** - Light mode actually works. Replaced hardcoded `bg-neutral-*` / `text-neutral-*` classes across all renderer components with semantic CSS-variable tokens (`bg-base` / `bg-surface` / `bg-elevated` / `border` / `border-strong` / `fg` / `fg-muted` / `fg-subtle` / `accent`). Variable values are set in `.dark` and `.light` blocks; toggling `theme` in Settings flips the whole palette without per-component overrides. (xterm log pane stays on a dark scheme regardless - intentional, matches VS Code.)
+- **2026-05-22** - Status colors (Stop buttons, Dashboard running-count badge, ErrorBanner, env-changed banner, CrashPin, etc.) had low light-mode contrast - the dark-red-at-30%-opacity tricks that worked on dark surfaces became invisible on white. Added semantic `danger` / `success` / `warn` token families (`bg`, `bg-hover`, `fg`, `border`, `strong`) with inverted dark/light palettes. Solid-color state dots (`bg-red-500`, `bg-green-500`, `bg-amber-500`) kept as-is since saturated mid-tones read on both backgrounds.
+- **2026-05-22** - Kbd shortcut hints now use a space between modifier and key (⌘ K, ⌘ P, ⌘ F, ⌘ ↩) - matches Apple's convention.
+- **2026-05-22** - Multi-task apps weren't showing port chips on the dashboard / detail. Three bugs in `PortDetector`:
   1. `collectDescendants` was adding PID `0` to the lsof query set (`Number('')` returns `0`, not `NaN`), which made lsof return nothing.
-  2. The merged port set used `observed` exclusively when non-empty, **discarding stdout hints**. Now it's a union — anything either source detected counts.
+  2. The merged port set used `observed` exclusively when non-empty, **discarding stdout hints**. Now it's a union - anything either source detected counts.
   3. First port poll fired up to 2s after `track()`. Now an immediate `tick()` runs on track.
   Plus bumped `pgrep` traversal depth from 3 → 5 to cover deeper chains (npm → shell → tsx → user binary), and made the renderer-side hydration populate `taskPorts` / `taskCpu` / `taskMemMB` from `task:list` on bootstrap (the events only fire on change, so post-refresh state was empty).
 
-- **2026-05-30** — Phase 15: sidebar/settings consistency pass.
-  - **Folder headers now match app rows** — a hover-revealed ⋮ overflow menu (Rename / Delete) instead of right-click-only, restructured from `<button>` to a draggable `<div>`.
-  - **Draggable folder reordering** — folder headers carry a distinct drag MIME (`application/x-appmgr-folder`) so reordering never collides with app-into-folder drops. Order persists to `localStorage["devharbor:folder-order"]`; ordered folders sort first, then alphabetical, "(Ungrouped)" always last. No nested folders.
-  - **`TagInput`** (new) — chip editor with autocomplete replaces the comma-separated text field in `AppConfigDrawer`. Suggests tags already used on other apps. Tags now also feed the ⌘P switcher search (typing a tag surfaces matching apps, which display their tags) on top of the existing sidebar search + Dashboard tag filter — giving tags a real cross-folder slicing purpose.
-  - **`FolderSelect`** (new) — combobox replacing the plain folder text+datalist: pick "No folder", an existing folder (checkmark on current), or "Create new folder…" with an inline name input.
-- **2026-05-30** — Phase 15b: sidebar **Group-by switcher** (Folder ⇄ Tag).
+- **2026-05-30** - Phase 15: sidebar/settings consistency pass.
+  - **Folder headers now match app rows** - a hover-revealed ⋮ overflow menu (Rename / Delete) instead of right-click-only, restructured from `<button>` to a draggable `<div>`.
+  - **Draggable folder reordering** - folder headers carry a distinct drag MIME (`application/x-appmgr-folder`) so reordering never collides with app-into-folder drops. Order persists to `localStorage["devharbor:folder-order"]`; ordered folders sort first, then alphabetical, "(Ungrouped)" always last. No nested folders.
+  - **`TagInput`** (new) - chip editor with autocomplete replaces the comma-separated text field in `AppConfigDrawer`. Suggests tags already used on other apps. Tags now also feed the ⌘P switcher search (typing a tag surfaces matching apps, which display their tags) on top of the existing sidebar search + Dashboard tag filter - giving tags a real cross-folder slicing purpose.
+  - **`FolderSelect`** (new) - combobox replacing the plain folder text+datalist: pick "No folder", an existing folder (checkmark on current), or "Create new folder…" with an inline name input.
+- **2026-05-30** - Phase 15b: sidebar **Group-by switcher** (Folder ⇄ Tag).
   - Finder-style 2-segment control in the APPS header toggles the list between grouping by `folder` and grouping by `tag`; persisted to `localStorage["devharbor:group-mode"]`.
   - **Tag mode** renders tag groups exactly like folders (collapsible), with an app showing under each of its tags and a pinned "(Untagged)" catch-all. Folder-only affordances (create-folder, ⋮ rename/delete, drag-reorder) are hidden in tag mode; **dragging an app onto a tag group adds that tag** (idempotent; drop on "(Untagged)" is a no-op). No tags anywhere → flat list with a hint.
   - **Removed the per-folder count badge** next to folder names (read as an "order number" after reorder shipped; visual noise).
 
-- **2026-05-31** — Phase 16: stopped-state consistency + binary slimming.
+- **2026-05-31** - Phase 16: stopped-state consistency + binary slimming.
   - **App no longer flickers Idle after a stop.** Root cause: `deriveAppState` never returned `'exited'` (an exited task fell through to the `'idle'` fallback), and once tasks were torn down (~1.5 s) nothing remembered the app had run. Fix in `AppOrchestrator`: (1) `deriveAppState` now returns `'exited'` for a tracked-but-exited task, removing the Idle→Exited→Idle flicker during teardown; (2) a sticky per-app `lastOutcome` map (`exited` / `crashed`, `crashed` wins) keeps the app reading **Stopped/Crashed** after teardown until the next start, which clears it. A freshly-added, never-run app still shows Idle.
-  - **Binary slimming — asar 40 MB → 4.3 MB.** Renderer-only libraries (react, react-dom, lucide-react [3,512 files], @xterm/*, cmdk, zustand, react-window, anser, clsx, cva, tailwind-merge) were listed as runtime `dependencies`, so electron-builder shipped them as raw `node_modules` **on top of** the Vite-bundled `out/renderer` — every one shipped twice. Moved all 14 to `devDependencies`; the renderer build bundles them, electron-builder no longer copies them. Verified none are imported by main/preload. arm64 `.app` Resources shrank ~36 MB uncompressed; arm64 DMG 109 MB → 103 MB, universal 189 MB → 183 MB. (The bulk of any Electron binary is the Chromium/V8 framework — ~200 MB arm64 / ~413 MB universal — which is irreducible; the universal target carries both arch slices.)
+  - **Binary slimming - asar 40 MB → 4.3 MB.** Renderer-only libraries (react, react-dom, lucide-react [3,512 files], @xterm/*, cmdk, zustand, react-window, anser, clsx, cva, tailwind-merge) were listed as runtime `dependencies`, so electron-builder shipped them as raw `node_modules` **on top of** the Vite-bundled `out/renderer` - every one shipped twice. Moved all 14 to `devDependencies`; the renderer build bundles them, electron-builder no longer copies them. Verified none are imported by main/preload. arm64 `.app` Resources shrank ~36 MB uncompressed; arm64 DMG 109 MB → 103 MB, universal 189 MB → 183 MB. (The bulk of any Electron binary is the Chromium/V8 framework - ~200 MB arm64 / ~413 MB universal - which is irreducible; the universal target carries both arch slices.)
 
-- **2026-05-31** — Phase 16b: stopped-state persists across restarts + regression tests.
+- **2026-05-31** - Phase 16b: stopped-state persists across restarts + regression tests.
   - The in-session fix (Phase 16) kept `lastOutcome` only in memory, so quitting DevHarbor and reopening reset every app to **Idle**. Now `registerAllIpcHandlers` seeds each app's sticky outcome on boot from its most recent `run_history` row: user-stopped / clean-exit / still-open-at-quit → `exited`; non-zero unexpected exit → `crashed`; never-run apps (no history) stay `idle`. Cleared on next start.
-  - Added regression coverage: `AppOrchestrator.state.test.ts` (fast, fake runner — drives the stop sequence + boot seeding) and `AppOrchestrator.e2e.test.ts` (spawns a **real** port-listening process through the real TaskRunner and asserts the emitted `proc:status` sequence stays `…→exited→exited` past the 1.5 s teardown, never `idle`). 47 tests pass.
-  - Diagnosis note: the "still Idle after stop" reports were two separate issues — (1) the in-memory `lastOutcome` never persisted, and (2) earlier observations were on a stale running instance (the single-instance lock refocuses an already-running copy instead of launching the rebuilt one). Proven via temporary main+renderer file-logging, since removed.
+  - Added regression coverage: `AppOrchestrator.state.test.ts` (fast, fake runner - drives the stop sequence + boot seeding) and `AppOrchestrator.e2e.test.ts` (spawns a **real** port-listening process through the real TaskRunner and asserts the emitted `proc:status` sequence stays `…→exited→exited` past the 1.5 s teardown, never `idle`). 47 tests pass.
+  - Diagnosis note: the "still Idle after stop" reports were two separate issues - (1) the in-memory `lastOutcome` never persisted, and (2) earlier observations were on a stale running instance (the single-instance lock refocuses an already-running copy instead of launching the rebuilt one). Proven via temporary main+renderer file-logging, since removed.
+
+- **2026-06-11** - Improvement-plan hardening + feature pass (see [`IMPROVEMENT-PLAN.md`](IMPROVEMENT-PLAN.md)). A comprehensive internal audit surfaced 88 findings; this pass implemented the great majority across six waves. Highlights:
+  - **Add-app redesign shipped** - single progressive screen (browse → detect → name/Node/PM/script → optional env), now a **single atomic `apps:create` IPC** that commits app + tasks + env in one transaction (no renderer-side rollback). New welcome **EmptyState** teaches first-run. Monorepo: `apps:detect` reads `pnpm-workspace.yaml` / `workspaces`, and the drawer offers "create a task per workspace package."
+  - **Correctness (P1 bugs):** restart-on-change was silently dead (chokidar v5 dropped globs) - now watches the dir with a function-ignore + picomatch filter; previously-run apps were **unremovable** (`!== 'idle'` vs sticky outcome) - guard now blocks only live states; failed starts no longer strand the app in "starting" (terminal state always emitted); `TaskRunner.start` double-spawn + stale-exit races fixed (in-flight dedup + closure-identity guards); readiness timeout; SIGTERM→grace→SIGKILL now **tree-kills**; PTY-orphan-on-history-throw guarded. **Graceful quit** confirms + reverse-topo stops every server (incl. auto-update install).
+  - **Data:** migration `0006` rebuilds `env_vars` with scope-aware **partial unique indexes** (task-overrides-app key now saves); deleted task vars no longer resurrect; **secret env values encrypted at rest** via `safeStorage`; `run_history` pruned on boot; corrupt-JSON cells no longer break listing; WAL-safe `db:export`/`db:reset` + migration-failure dialog.
+  - **Security/Electron:** Electron **fuses** (disable RunAsNode/NODE_OPTIONS/--inspect, OnlyLoadAppFromAsar) via afterPack; trimmed `disable-executable-page-protection`; tightened CSP; project `.env` can no longer override user-set env or PATH/process-control keys; `apps:update` validates + pins identity fields; deep-link paths require a user gesture before any FS read.
+  - **Perf:** StatsMonitor batches `pidusage` (1 fork/tick), PortDetector snapshots the process table once (1 `ps` + 1 `lsof`/tick) + prunes stale hints, LogBuffer has a 100 MB global cap with exited-buffer eviction, visibility-gated log streaming, `tasks:listAll` removes the boot N+1.
+  - **Accessibility:** focusable sidebar rows, `useDialog` (focus trap / Escape / restore) on every drawer, keyboard-navigable ContextMenu + dropdowns, StatusDot `role=img` + non-color crash cue, icon-button `aria-label`s, screen-reader xterm + light terminal theme.
+  - **Observability/infra:** local file logger (`~/Library/Logs/DevHarbor`) + uncaughtException/unhandledRejection + renderer `render-process-gone` auto-reload; ErrorBoundary; window bounds persisted; **CI workflow** (typecheck + lint + test on PR/push), **ESLint flat config + Prettier**, release workflow bumped to Node-24-native action majors + tag-match publish guard.
+  - **New features:** menubar **Tray** (aggregate state + per-app start/stop + Stop all), **crash/ready notifications**, **launch-at-login + per-app auto-start** (`0007`), **start/stop all in folder**, **bulk import** (scan a folder of repos), **global log search** (⌘⇧F), **port-conflict** callout in CrashPin, update **release notes** + error surfacing in the banner.
+  - Verification: typecheck + lint (83 files, 0 warnings) + 52 tests (incl. new restart-watcher and double-start-race coverage) + production build all green; all 7 migrations validated against a real SQLite DB.
 
 ## How to keep this file honest
 
 - Every PR that ships a feature should flip its row from 📐/🚧 → ✅.
 - Every spec change that introduces a new feature should add a row here as 📐.
-- Don't leave 🚧 rows undated — note what's left.
+- Don't leave 🚧 rows undated - note what's left.
 - This file lives in `specs/` because it *is* a spec: the spec of "what currently exists."
diff --git a/specs/WORKFLOW.md b/specs/WORKFLOW.md
index e76c019..a0408c0 100644
--- a/specs/WORKFLOW.md
+++ b/specs/WORKFLOW.md
@@ -2,17 +2,17 @@
 
 How we work on this project. Read this once; expect to reread it when habits slip.
 
-## Rule 1 — Specs are the source of truth
+## Rule 1 - Specs are the source of truth
 
 The `specs/` folder owns the design and the build status. Code does not.
 
 - **Before** any non-trivial change: re-read the relevant spec section.
 - **Before** writing code on any design shift: update the spec first, get the user's sign-off if it's a meaningful decision, *then* implement.
-- **After** a phase, feature, or significant chunk: update [`PROGRESS.md`](PROGRESS.md) — flip rows from 📐/🚧 → ✅, add new gaps to the known-limitations list.
+- **After** a phase, feature, or significant chunk: update [`PROGRESS.md`](PROGRESS.md) - flip rows from 📐/🚧 → ✅, add new gaps to the known-limitations list.
 
 `PROGRESS.md` is the canonical "where are we right now." Don't let it drift.
 
-## Rule 2 — Step back after every code or UI change
+## Rule 2 - Step back after every code or UI change
 
 Before declaring a chunk done or moving on, run a short review. The goal: surface follow-ups while context is fresh, so the user can decide what matters before it's buried.
 
@@ -25,27 +25,27 @@ Ask:
 - Cross-cutting concerns: types, performance, accessibility, error / crash / disconnect paths?
 - Did I update `PROGRESS.md`?
 
-Then surface the **top 3–5 follow-up items** in chat, each with a one-line description and a placement: *fix now* / *Phase N* / *drop* / *carry-list*. Don't auto-implement — the user decides.
+Then surface the **top 3-5 follow-up items** in chat, each with a one-line description and a placement: *fix now* / *Phase N* / *drop* / *carry-list*. Don't auto-implement - the user decides.
 
 Keep the in-chat review tight (under 15 lines). Heavy itemising goes into PROGRESS.md's known-limitations / followups section.
 
 This rule applies to **code/UI changes**. Spec edits ARE the bigger-picture review and don't need a second step-back.
 
-## Rule 3 — Don't assume; ask when in doubt
+## Rule 3 - Don't assume; ask when in doubt
 
 If the spec is silent on something the user just asked for, write the spec entry, surface the design call with one targeted question (or a recommendation), and wait. Avoid silent design decisions buried in implementation.
 
-## Rule 4 — Migration discipline
+## Rule 4 - Migration discipline
 
 - Schema changes go through numbered `.sql` migrations in `src/main/db/migrations/`.
 - Data backfills run in TypeScript (`src/main/db/backfill.ts`) so they can use ULIDs, JSON shapes, etc.
 - Migrations are forward-only and idempotent where possible.
 - Update [`specs/02-data-model.md`](02-data-model.md)'s Migrations table when adding a new file.
 
-## Rule 5 — Native deps need attention
+## Rule 5 - Native deps need attention
 
 `better-sqlite3` and `@homebridge/node-pty-prebuilt-multiarch` ship Node-ABI prebuilds. They MUST be rebuilt for Electron's ABI via `electron-rebuild`. The project's `postinstall` runs that automatically. If a fresh install fails at runtime with "NODE_MODULE_VERSION mismatch," run `pnpm rebuild`.
 
-## Rule 6 — Renderer state pitfalls
+## Rule 6 - Renderer state pitfalls
 
-Zustand selectors must return referentially stable values. Never use `?? []` or `?? {}` inside `useStore((s) => ...)` — each call creates a new reference and `useSyncExternalStore` will treat it as a change, causing an infinite render loop. Use a module-level stable empty constant instead.
+Zustand selectors must return referentially stable values. Never use `?? []` or `?? {}` inside `useStore((s) => ...)` - each call creates a new reference and `useSyncExternalStore` will treat it as a change, causing an infinite render loop. Use a module-level stable empty constant instead.
diff --git a/src/main/db/backfill.ts b/src/main/db/backfill.ts
index 3c09941..21e55e7 100644
--- a/src/main/db/backfill.ts
+++ b/src/main/db/backfill.ts
@@ -5,7 +5,7 @@ import { ulid } from 'ulid';
  * Phase 1.5 backfill: every existing App that doesn't yet have any tasks
  * gets one synthesised from its `default_script` / `custom_command`.
  *
- * Idempotent — re-running does nothing once the seed task exists.
+ * Idempotent - re-running does nothing once the seed task exists.
  */
 export function backfillTasksForExistingApps(): void {
   const d = db();
@@ -40,7 +40,7 @@ export function backfillTasksForExistingApps(): void {
       } else if (row.default_script) {
         insert.run(id, row.id, row.default_script, 'script', row.default_script, null, now, now);
       } else {
-        // No script and no custom command — skip. The app needs explicit task creation.
+        // No script and no custom command - skip. The app needs explicit task creation.
       }
     }
   });
diff --git a/src/main/db/index.ts b/src/main/db/index.ts
index 172d40f..da7f0d2 100644
--- a/src/main/db/index.ts
+++ b/src/main/db/index.ts
@@ -14,21 +14,49 @@ const migrationModules = import.meta.glob('./migrations/*.sql', {
 }) as Record<string, string>;
 
 let _db: DB | null = null;
+let shuttingDown = false;
+
+export function dbFile(): string {
+  return join(app.getPath('userData'), 'devharbor.db');
+}
 
 export function db(): DB {
   if (_db) return _db;
 
   const dir = app.getPath('userData');
   mkdirSync(dir, { recursive: true });
-
   const file = join(dir, 'devharbor.db');
-  _db = new Database(file);
-  _db.pragma('journal_mode = WAL');
-  _db.pragma('foreign_keys = ON');
 
-  ensureMigrationsTable(_db);
-  runMigrations(_db);
-  backfillTasksForExistingApps();
+  // A late write during shutdown (e.g. a final run_history UPDATE) must NOT re-run migrations
+  // + backfill on a freshly-opened handle. The schema already exists - open minimally.
+  if (shuttingDown) {
+    const reopened = new Database(file);
+    reopened.pragma('journal_mode = WAL');
+    reopened.pragma('foreign_keys = ON');
+    _db = reopened;
+    return _db;
+  }
+
+  const database = new Database(file);
+  database.pragma('journal_mode = WAL');
+  database.pragma('foreign_keys = ON');
+
+  try {
+    ensureMigrationsTable(database);
+    runMigrations(database);
+    // backfill reads through db(), so the handle must be assigned first - but only AFTER
+    // migrations succeed, so a thrown migration never leaves a half-migrated handle cached.
+    _db = database;
+    backfillTasksForExistingApps();
+  } catch (e) {
+    _db = null;
+    try {
+      database.close();
+    } catch {
+      // ignore
+    }
+    throw e;
+  }
 
   return _db;
 }
@@ -51,7 +79,7 @@ function runMigrations(d: DB): void {
 
   const entries = Object.entries(migrationModules)
     .map(([path, sql]) => {
-      // path looks like './migrations/0001_init.sql' — strip prefix + extension for the version key.
+      // path looks like './migrations/0001_init.sql' - strip prefix + extension for the version key.
       const file = path.split('/').pop() ?? path;
       const version = file.replace(/\.sql$/, '');
       return { version, sql };
@@ -73,6 +101,16 @@ function runMigrations(d: DB): void {
 }
 
 export function closeDb(): void {
-  _db?.close();
+  shuttingDown = true;
+  if (_db) {
+    // Flush the WAL into the main db file so an export/backup taken right after isn't missing
+    // recent writes, and so db:reset doesn't strand an orphaned -wal (IMPROVEMENT-PLAN 5.11).
+    try {
+      _db.pragma('wal_checkpoint(TRUNCATE)');
+    } catch {
+      // ignore
+    }
+    _db.close();
+  }
   _db = null;
 }
diff --git a/src/main/db/migrations/0004_env_task_scope.sql b/src/main/db/migrations/0004_env_task_scope.sql
index aba3c36..2f34466 100644
--- a/src/main/db/migrations/0004_env_task_scope.sql
+++ b/src/main/db/migrations/0004_env_task_scope.sql
@@ -2,7 +2,7 @@
 --
 -- Add `task_id` to env_vars so the three-scope layering (global / app / task)
 -- can be done with one table and one query per scope. NULL means "not scoped
--- to a specific task" — combined with `app_id` it gives:
+-- to a specific task" - combined with `app_id` it gives:
 --    app_id IS NULL AND task_id IS NULL  → global
 --    app_id = ?      AND task_id IS NULL  → app
 --    task_id = ?                          → task  (app_id denormalised for cascade)
diff --git a/src/main/db/migrations/0005_app_folders.sql b/src/main/db/migrations/0005_app_folders.sql
index f280778..32e29b6 100644
--- a/src/main/db/migrations/0005_app_folders.sql
+++ b/src/main/db/migrations/0005_app_folders.sql
@@ -1,6 +1,6 @@
 -- Phase 8 (F21): folders in the sidebar.
 --
--- One-level visual grouping. NULL means "(Ungrouped)". Tags remain orthogonal —
+-- One-level visual grouping. NULL means "(Ungrouped)". Tags remain orthogonal - 
 -- folder = hierarchy, tags = facets. See specs/03-features.md F21.
 
 ALTER TABLE apps ADD COLUMN folder TEXT;
diff --git a/src/main/db/migrations/0006_env_scope_unique.sql b/src/main/db/migrations/0006_env_scope_unique.sql
new file mode 100644
index 0000000..8fd6fcb
--- /dev/null
+++ b/src/main/db/migrations/0006_env_scope_unique.sql
@@ -0,0 +1,50 @@
+-- Fix layered env saves (IMPROVEMENT-PLAN 5.6).
+--
+-- 0001 created env_vars with a table-level UNIQUE(app_id, key). 0004 added task_id for
+-- three-scope layering (global / app / task), but the old constraint:
+--   * makes a TASK-scoped override of an app-scoped key impossible to save - the whole
+--     point of layering - rolling back the entire save transaction; and
+--   * is INERT for global scope (app_id IS NULL bypasses UNIQUE), so it constrains exactly
+--     where it shouldn't and not where it should.
+--
+-- SQLite can't drop a table-level constraint, so rebuild the table without it and replace
+-- it with three PARTIAL unique indexes - correct per-scope uniqueness. Nothing references
+-- env_vars, so the drop/rename is safe inside the migration transaction.
+
+CREATE TABLE env_vars_new (
+  id          TEXT PRIMARY KEY,
+  app_id      TEXT REFERENCES apps(id) ON DELETE CASCADE,
+  task_id     TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+  key         TEXT NOT NULL,
+  value       TEXT NOT NULL,
+  enabled     INTEGER NOT NULL DEFAULT 1,
+  is_secret   INTEGER NOT NULL DEFAULT 0,
+  note        TEXT,
+  created_at  INTEGER NOT NULL,
+  updated_at  INTEGER NOT NULL
+);
+
+INSERT INTO env_vars_new (id, app_id, task_id, key, value, enabled, is_secret, note, created_at, updated_at)
+  SELECT id, app_id, task_id, key, value, enabled, is_secret, note, created_at, updated_at FROM env_vars;
+
+DROP TABLE env_vars;
+ALTER TABLE env_vars_new RENAME TO env_vars;
+
+CREATE INDEX IF NOT EXISTS idx_env_vars_app ON env_vars(app_id);
+CREATE INDEX IF NOT EXISTS idx_env_vars_task ON env_vars(task_id) WHERE task_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_env_vars_app_scope ON env_vars(app_id, task_id);
+
+-- De-dupe any rows that would violate the new unique indexes (keep the most recently
+-- updated per scope+key), since the old schema permitted duplicate global keys.
+DELETE FROM env_vars WHERE id NOT IN (
+  SELECT id FROM (
+    SELECT id, ROW_NUMBER() OVER (
+      PARTITION BY IFNULL(app_id, '∅'), IFNULL(task_id, '∅'), key
+      ORDER BY updated_at DESC, id DESC
+    ) AS rn FROM env_vars
+  ) WHERE rn = 1
+);
+
+CREATE UNIQUE INDEX uq_env_global ON env_vars(key)          WHERE app_id IS NULL AND task_id IS NULL;
+CREATE UNIQUE INDEX uq_env_app    ON env_vars(app_id, key)  WHERE app_id IS NOT NULL AND task_id IS NULL;
+CREATE UNIQUE INDEX uq_env_task   ON env_vars(task_id, key) WHERE task_id IS NOT NULL;
diff --git a/src/main/db/migrations/0007_app_autostart.sql b/src/main/db/migrations/0007_app_autostart.sql
new file mode 100644
index 0000000..3c69edf
--- /dev/null
+++ b/src/main/db/migrations/0007_app_autostart.sql
@@ -0,0 +1,4 @@
+-- Per-app auto-start (IMPROVEMENT-PLAN 14.6). When set, the orchestrator starts the app on
+-- DevHarbor launch - pairs with the "Launch DevHarbor at login" setting so a dev's stack is
+-- already up when they sit down.
+ALTER TABLE apps ADD COLUMN auto_start INTEGER NOT NULL DEFAULT 0;
diff --git a/src/main/index.ts b/src/main/index.ts
index cc60d7b..47f89de 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -1,12 +1,60 @@
-import { app, BrowserWindow, shell } from 'electron';
+import { app, BrowserWindow, dialog, screen, shell } from 'electron';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { db, closeDb } from './db/index.js';
-import { registerAllIpcHandlers } from './ipc/index.js';
+import { registerAllIpcHandlers, type IpcRuntime } from './ipc/index.js';
 import { installAppMenu } from './menu.js';
+import { installProcessLogging, logger } from './services/Logger.js';
 
 const isDev = process.env.NODE_ENV === 'development' || !!process.env.ELECTRON_RENDERER_URL;
 
 let mainWindow: BrowserWindow | null = null;
+let ipcRuntime: IpcRuntime | null = null;
+let isQuitting = false;
+
+interface WindowBounds {
+  x?: number;
+  y?: number;
+  width: number;
+  height: number;
+}
+
+function boundsFile(): string {
+  return join(app.getPath('userData'), 'window-state.json');
+}
+
+/** Restore the last window bounds, validated against currently-connected displays. */
+function loadBounds(): WindowBounds {
+  const fallback: WindowBounds = { width: 1280, height: 820 };
+  try {
+    const raw = readFileSync(boundsFile(), 'utf8');
+    const b = JSON.parse(raw) as Partial<WindowBounds>;
+    if (typeof b.width !== 'number' || typeof b.height !== 'number') return fallback;
+    const w = Math.max(960, Math.min(b.width, 8000));
+    const h = Math.max(600, Math.min(b.height, 8000));
+    // Only keep x/y if the window would land on some connected display (avoid off-screen).
+    if (typeof b.x === 'number' && typeof b.y === 'number') {
+      const onScreen = screen.getAllDisplays().some((d) => {
+        const wa = d.workArea;
+        return b.x! < wa.x + wa.width && b.x! + w > wa.x && b.y! < wa.y + wa.height && b.y! + h > wa.y;
+      });
+      if (onScreen) return { x: b.x, y: b.y, width: w, height: h };
+    }
+    return { width: w, height: h };
+  } catch {
+    return fallback;
+  }
+}
+
+function saveBounds(win: BrowserWindow): void {
+  if (win.isDestroyed()) return;
+  try {
+    const b = win.getNormalBounds();
+    writeFileSync(boundsFile(), JSON.stringify({ x: b.x, y: b.y, width: b.width, height: b.height }));
+  } catch {
+    // ignore
+  }
+}
 
 // Single-instance lock: a second launch (or a deep-link open) focuses the existing
 // window instead of spawning a second process with its own DB handle.
@@ -16,20 +64,20 @@ if (!gotLock) {
 } else {
   app.on('second-instance', () => {
     // Re-launching while an instance holds the lock must surface a window. Previously this
-    // only focused an EXISTING window — if all windows were closed (app still alive on
+    // only focused an EXISTING window - if all windows were closed (app still alive on
     // macOS), the second launch did nothing, so the app looked like it "won't open".
     getOrCreateWindow();
   });
 }
 
 function createWindow(): BrowserWindow {
+  const bounds = loadBounds();
   const win = new BrowserWindow({
-    width: 1280,
-    height: 820,
+    ...bounds,
     minWidth: 960,
     minHeight: 600,
     show: false,
-    backgroundColor: '#18181b', // matches the zinc-900 theme base — no launch color flash
+    backgroundColor: '#18181b', // matches the zinc-900 theme base - no launch color flash
     titleBarStyle: 'hiddenInset',
     trafficLightPosition: { x: 12, y: 14 },
     webPreferences: {
@@ -43,12 +91,33 @@ function createWindow(): BrowserWindow {
 
   win.once('ready-to-show', () => win.show());
 
+  // Persist window size/position so the app reopens where the user left it.
+  win.on('close', () => saveBounds(win));
+
   win.on('closed', () => {
     if (mainWindow === win) mainWindow = null;
   });
 
+  // Reset per-renderer main-process state (log subscriptions) on reload/navigation, so a ⌘R
+  // can't leave log forwarding gated to taskIds the new renderer never subscribed to.
+  win.webContents.on('did-start-navigation', (_e, _url, _isInPlace, isMainFrame) => {
+    if (isMainFrame) ipcRuntime?.onRendererReload();
+  });
+
+  // Renderer crash recovery: a GPU/OOM crash (xterm WebGL contexts are a realistic source)
+  // would otherwise leave a blank window. Reload once so it self-heals - running PTYs live in
+  // the main process and survive (IMPROVEMENT-PLAN 13.2).
+  let reloadAttempts = 0;
+  win.webContents.on('render-process-gone', (_e, details) => {
+    logger.error('render-process-gone', details.reason, details.exitCode);
+    if (reloadAttempts < 2 && details.reason !== 'clean-exit' && !win.isDestroyed()) {
+      reloadAttempts += 1;
+      win.webContents.reload();
+    }
+  });
+
   win.webContents.setWindowOpenHandler(({ url }) => {
-    // Only forward http(s) — refuse file://, mailto:, etc. that a compromised
+    // Only forward http(s) - refuse file://, mailto:, etc. that a compromised
     // renderer could try to abuse.
     try {
       const parsed = new URL(url);
@@ -56,7 +125,7 @@ function createWindow(): BrowserWindow {
         shell.openExternal(url);
       }
     } catch {
-      // Invalid URL — ignore.
+      // Invalid URL - ignore.
     }
     return { action: 'deny' };
   });
@@ -67,7 +136,7 @@ function createWindow(): BrowserWindow {
   win.webContents.on('will-navigate', (event, url) => {
     const current = win.webContents.getURL();
     if (url === current) return;
-    // Compare by ORIGIN, not string prefix — a prefix check would let
+    // Compare by ORIGIN, not string prefix - a prefix check would let
     // `http://localhost:5173.evil.com` pass as the dev server.
     let sameDevServer = false;
     if (process.env.ELECTRON_RENDERER_URL) {
@@ -121,6 +190,9 @@ function getOrCreateWindow(): { win: BrowserWindow; created: boolean } {
 }
 
 app.whenReady().then(() => {
+  // Route uncaught exceptions / rejections to the local log file for support diagnostics.
+  installProcessLogging();
+
   // Configure the macOS About panel ( ⌘ → DevHarbor → About DevHarbor ).
   if (process.platform === 'darwin') {
     app.setAboutPanelOptions({
@@ -134,8 +206,39 @@ app.whenReady().then(() => {
   }
 
   installAppMenu(isDev, getOrCreateWindow);
-  db();
-  registerAllIpcHandlers(() => mainWindow);
+  // Opening the DB can fail (corrupt file, half-applied migration). Surface it instead of
+  // launching to a dock icon with no window and no error (IMPROVEMENT-PLAN 8.1).
+  try {
+    db();
+  } catch (e) {
+    logger.error('database open/migration failed', e);
+    const choice = dialog.showMessageBoxSync({
+      type: 'error',
+      title: 'DevHarbor - database error',
+      message: 'DevHarbor could not open its database.',
+      detail: `${(e as Error).message}\n\nThe database is at:\n${join(app.getPath('userData'), 'devharbor.db')}\n\nYou can move the corrupt database aside and start fresh, or quit.`,
+      buttons: ['Move aside & restart', 'Quit'],
+      defaultId: 0,
+      cancelId: 1
+    });
+    if (choice === 0) {
+      try {
+        const p = join(app.getPath('userData'), 'devharbor.db');
+        for (const suffix of ['', '-wal', '-shm']) {
+          if (existsSync(`${p}${suffix}`)) {
+            writeFileSync(`${p}${suffix}.corrupt-${Date.now()}.bak`, readFileSync(`${p}${suffix}`));
+          }
+        }
+        for (const suffix of ['', '-wal', '-shm']) rmSync(`${p}${suffix}`, { force: true });
+      } catch (moveErr) {
+        logger.error('failed to move corrupt DB aside', moveErr);
+      }
+      app.relaunch();
+    }
+    app.exit(choice === 0 ? 0 : 1);
+    return;
+  }
+  ipcRuntime = registerAllIpcHandlers(() => mainWindow, getOrCreateWindow);
   createWindow();
 
   app.on('activate', () => {
@@ -147,6 +250,48 @@ app.on('window-all-closed', () => {
   if (process.platform !== 'darwin') app.quit();
 });
 
-app.on('before-quit', () => {
-  closeDb();
+// Graceful teardown on quit (including auto-update's quitAndInstall). The whole point of the
+// app is "stop apps cleanly, no orphans" - but the only quit hook used to be closeDb(), so
+// running dev servers were killed abruptly via PTY teardown (or survived as orphans). Now we
+// confirm, run the reverse-topo graceful stop, then close the DB last (IMPROVEMENT-PLAN 5.9).
+let teardownInFlight = false;
+
+app.on('before-quit', (event) => {
+  if (isQuitting) return; // teardown finished - let the final quit proceed
+  if (teardownInFlight) {
+    // A second ⌘Q / dock-quit while we're still stopping tasks must NOT bypass the teardown
+    // (it would abandon the SIGTERM→grace sequence mid-flight and skip the DB close).
+    event.preventDefault();
+    return;
+  }
+  const running = ipcRuntime?.runningTaskCount() ?? 0;
+  if (running === 0) {
+    closeDb();
+    return;
+  }
+  event.preventDefault();
+  teardownInFlight = true;
+  void (async () => {
+    const { response } = await dialog.showMessageBox({
+      type: 'warning',
+      title: 'Quit DevHarbor?',
+      message: `${running} running ${running === 1 ? 'task is' : 'tasks are'} still active.`,
+      detail: 'DevHarbor will stop your running dev servers before quitting.',
+      buttons: ['Stop & Quit', 'Cancel'],
+      defaultId: 0,
+      cancelId: 1
+    });
+    if (response !== 0) {
+      teardownInFlight = false;
+      return; // cancelled - stay open
+    }
+    try {
+      await ipcRuntime?.stopAllRunning();
+    } catch (e) {
+      logger.error('teardown on quit failed', e);
+    }
+    closeDb();
+    isQuitting = true;
+    app.quit();
+  })();
 });
diff --git a/src/main/ipc/index.ts b/src/main/ipc/index.ts
index 2054d82..cff5acc 100644
--- a/src/main/ipc/index.ts
+++ b/src/main/ipc/index.ts
@@ -1,6 +1,9 @@
-import { BrowserWindow, dialog, ipcMain } from 'electron';
-import type { InvokeChannelName, InvokeChannels } from '@shared/ipc';
-import type { AppId, TaskId } from '@shared/types';
+import { BrowserWindow, dialog, ipcMain, Notification } from 'electron';
+import type { InvokeChannelName, InvokeChannels, ImportCandidate, GlobalLogMatch } from '@shared/ipc';
+import type { AppId, EnvVar, TaskId } from '@shared/types';
+import { closeDb, db, dbFile } from '../db/index.js';
+import { logger } from '../services/Logger';
+import { TrayController, type TrayApp } from '../services/TrayController';
 import { AppRegistry } from '../services/AppRegistry';
 import { DetectionService } from '../services/DetectionService';
 import { NodeResolver } from '../services/NodeResolver';
@@ -18,8 +21,8 @@ import { DeepLinks } from '../services/DeepLinks';
 import { Updater } from '../services/Updater';
 import { OpenIn } from '../services/OpenIn';
 import { app as electronApp, dialog as electronDialog } from 'electron';
-import { copyFileSync, existsSync, realpathSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readdirSync, realpathSync, renameSync, statSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import type { StatsTick } from '../services/StatsMonitor';
 import type { PortsEvent } from '../services/PortDetector';
 
@@ -31,7 +34,19 @@ function register<C extends InvokeChannelName>(channel: C, handler: Handler<C>):
   ipcMain.handle(channel, async (_evt, req) => handler(req));
 }
 
-export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
+export interface IpcRuntime {
+  /** Number of tasks currently live - for the quit confirmation. */
+  runningTaskCount: () => number;
+  /** Gracefully stop every running task (SIGTERM → grace → SIGKILL tree). */
+  stopAllRunning: () => Promise<void>;
+  /** Reset per-renderer state (log subscriptions) when the window reloads/navigates. */
+  onRendererReload: () => void;
+}
+
+export function registerAllIpcHandlers(
+  win: () => BrowserWindow | null,
+  getOrCreateWindow: () => { win: BrowserWindow; created: boolean }
+): IpcRuntime {
   const settings = new Settings();
   const pathProbe = new PathProbe();
   const detector = new DetectionService();
@@ -75,6 +90,24 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
   // Apply current log_ring_size to the LogBuffer.
   runner.logs.setLimits({ maxLines: settings.get('log_ring_size') });
 
+  // Boot maintenance: cap run_history growth and encrypt any plaintext secret env values
+  // left over from before encryption-at-rest landed (both are no-ops when already done).
+  try {
+    runHistory.prune(settings.get('run_history_limit'));
+  } catch (e) {
+    logger.warn('run_history prune failed', e);
+  }
+  try {
+    envStore.migratePlaintextSecrets();
+  } catch (e) {
+    logger.warn('secret migration failed', e);
+  }
+
+  // Visibility-gated log streaming: the renderer subscribes to the task(s) it's showing. Until
+  // it subscribes to anything we forward all task:log events (back-compat); once it subscribes,
+  // we only forward subscribed tasks, so background tasks' chatter doesn't flood the renderer.
+  const logSubs = new Set<string>();
+
   const updater = new Updater(win);
   if (settings.get('auto_update')) updater.start();
   const deepLinks = new DeepLinks(
@@ -126,6 +159,7 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
 
   // Forward task events to the renderer.
   runner.on('log', (evt: TaskLogEvent) => {
+    if (logSubs.size > 0 && !logSubs.has(evt.taskId)) return;
     win()?.webContents.send('task:log', evt);
   });
   runner.on('status', (evt: TaskStatusEvent) => {
@@ -144,6 +178,87 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
     win()?.webContents.send('env:fileChanged', evt);
   });
 
+  // --- Menubar tray (IMPROVEMENT-PLAN 14.1) ---------------------------------------------------
+  const aggregatePorts = (appId: AppId): number[] => {
+    const ports = new Set<number>();
+    for (const rt of runner.list()) if (rt.appId === appId) for (const p of rt.ports) ports.add(p);
+    return [...ports].sort((a, b) => a - b);
+  };
+  const trayApps = (): TrayApp[] =>
+    registry.list().map((a) => ({
+      id: a.id,
+      name: a.name,
+      state: orchestrator.appState(a.id),
+      ports: aggregatePorts(a.id)
+    }));
+  const tray = new TrayController({
+    listApps: trayApps,
+    start: (id) => void orchestrator.startApp(id).catch((e) => logger.warn('tray start failed', e)),
+    stop: (id) => void orchestrator.stopApp(id).catch((e) => logger.warn('tray stop failed', e)),
+    stopAll: () => void orchestrator.stopAllRunning(),
+    open: () => {
+      getOrCreateWindow();
+    },
+    quit: () => electronApp.quit()
+  });
+  if (settings.get('tray_enabled')) tray.enable();
+  // Port chips in the tray menu update as lsof discovers them.
+  runner.on('ports', () => tray.refresh());
+
+  // Reconcile launch-at-login with the OS - the OS wins. If the user removed (or added)
+  // DevHarbor under System Settings → Login Items, adopt that into our setting rather than
+  // re-asserting a stale stored value over their explicit choice; we only WRITE login-item
+  // state from the settings:set handler, i.e. when toggled in-app.
+  try {
+    const osValue = electronApp.getLoginItemSettings().openAtLogin;
+    if (osValue !== settings.get('launch_at_login')) {
+      settings.set('launch_at_login', osValue);
+    }
+  } catch (e) {
+    logger.warn('login-item reconcile failed', e);
+  }
+
+  // --- Crash / ready desktop notifications (IMPROVEMENT-PLAN 14.2) -----------------------------
+  const focusAppInWindow = (appId: AppId): void => {
+    const { win: w, created } = getOrCreateWindow();
+    const send = (): void => {
+      w.webContents.send('deepLink:focusApp', { appId });
+    };
+    if (created) w.webContents.once('did-finish-load', () => setTimeout(send, 200));
+    else send();
+  };
+  const taskReady = new Map<string, boolean>();
+  runner.on('status', (evt: TaskStatusEvent) => {
+    tray.refresh();
+    if (!Notification.isSupported()) return;
+    const appName = registry.get(evt.appId)?.name ?? 'App';
+    if (evt.state === 'crashed' && settings.get('notify_on_crash')) {
+      const n = new Notification({
+        title: `${appName} crashed`,
+        body: evt.exitCode != null ? `A task exited with code ${evt.exitCode}.` : 'A task crashed.'
+      });
+      n.on('click', () => focusAppInWindow(evt.appId));
+      n.show();
+    }
+    if (settings.get('notify_on_ready')) {
+      const was = taskReady.get(evt.taskId) ?? false;
+      if (evt.ready && !was) {
+        const n = new Notification({ title: `${appName} is ready`, body: 'A task reached its readiness signal.' });
+        n.on('click', () => focusAppInWindow(evt.appId));
+        n.show();
+      }
+    }
+    taskReady.set(evt.taskId, evt.ready);
+    if (evt.state === 'exited' || evt.state === 'crashed') taskReady.delete(evt.taskId);
+  });
+
+  // --- Auto-start flagged apps on launch (IMPROVEMENT-PLAN 14.6) -------------------------------
+  for (const a of registry.list()) {
+    if (a.autoStart) {
+      void orchestrator.startApp(a.id).catch((e) => logger.warn(`auto-start of ${a.name} failed`, e));
+    }
+  }
+
   register('app:ping', (msg) => `pong: ${msg}`);
 
   register('apps:list', () => registry.list());
@@ -151,6 +266,7 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
     const app = await registry.add(path);
     envFileWatcher.watch(app.id, app.path);
     syncRestartWatcher(app.id);
+    tray.refresh();
     return app;
   });
   register('apps:update', ({ id, patch }) => {
@@ -168,17 +284,116 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
     ) {
       syncRestartWatcher(app.id);
     }
+    tray.refresh(); // rename / folder changes show in the tray menu
     return app;
   });
   register('apps:remove', ({ id }) => {
-    if (orchestrator.appState(id as AppId) !== 'idle') {
+    // Only block removal while the app is actually LIVE. The sticky outcome design means an
+    // app that ever ran reports 'exited'/'crashed' forever, so the old `!== 'idle'` guard made
+    // every previously-run app permanently unremovable (IMPROVEMENT-PLAN 5.2).
+    const st = orchestrator.appState(id as AppId);
+    if (st === 'running' || st === 'starting' || st === 'exiting') {
       throw new Error('Stop the app before removing it.');
     }
     envFileWatcher.unwatch(id);
     restartWatcher.unwatch(id);
+    orchestrator.clearOutcome(id as AppId);
     registry.remove(id);
+    tray.refresh();
   });
   register('apps:detect', ({ path }) => detector.detect(path));
+
+  // Atomic create: app + first task + env vars in ONE main-process handler with rollback, so a
+  // partial failure (or a renderer reload mid-flow) can't leave an orphan app row
+  // (IMPROVEMENT-PLAN 12.7). FK cascade cleans tasks/env if we roll back.
+  register('apps:create', async (input) => {
+    const real = realpathSync(input.path);
+    if (registry.getByPath(real)) {
+      throw new Error('This folder is already registered.');
+    }
+    const app = await registry.add(input.path);
+    try {
+      const patched = registry.update(app.id, {
+        name: input.name?.trim() || app.name,
+        nodeVersionPref: input.nodeVersionPref ?? { kind: 'auto' },
+        packageManager: input.packageManager ?? null,
+        defaultScript: input.defaultScript ?? null
+      });
+      const taskSpecs = [...(input.firstTask ? [input.firstTask] : []), ...(input.tasks ?? [])];
+      for (const spec of taskSpecs) {
+        taskRegistry.add(app.id, {
+          name: spec.name,
+          commandKind: spec.commandKind,
+          script: spec.script ?? null,
+          customCommand: spec.customCommand ?? null,
+          workingDirOverride: spec.workingDirOverride ?? null,
+          enabled: true
+        });
+      }
+      if (input.envVars && input.envVars.length > 0) {
+        const vars: EnvVar[] = input.envVars
+          .filter((v) => v.key.trim())
+          .map((v) => ({
+            id: '',
+            appId: app.id,
+            key: v.key.trim(),
+            value: v.value,
+            enabled: true,
+            isSecret: v.isSecret ?? false
+          }));
+        envStore.setApp(app.id, vars);
+      }
+      envFileWatcher.watch(app.id, app.path);
+      syncRestartWatcher(app.id);
+      tray.refresh();
+      return patched;
+    } catch (err) {
+      try {
+        registry.remove(app.id);
+      } catch {
+        /* best-effort rollback */
+      }
+      throw err;
+    }
+  });
+
+  // Shallow-scan a folder for package.json projects (bulk import). One level deep; skips
+  // already-registered folders' "alreadyRegistered" flag so the picker can disable them.
+  register('apps:scanFolder', async ({ dir }) => {
+    const out: ImportCandidate[] = [];
+    let entries: string[];
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return out;
+    }
+    for (const name of entries) {
+      if (name.startsWith('.')) continue;
+      const full = join(dir, name);
+      try {
+        if (!statSync(full).isDirectory()) continue;
+        if (!existsSync(join(full, 'package.json'))) continue;
+      } catch {
+        continue;
+      }
+      let real = full;
+      try {
+        real = realpathSync(full);
+      } catch {
+        // use raw
+      }
+      const detection = await detector.detect(full);
+      out.push({
+        path: full,
+        name: basename(real),
+        alreadyRegistered: !!registry.getByPath(real),
+        packageManager: detection.packageManager,
+        suggestedScript: detection.suggestedDefaultScript,
+        scripts: Object.keys(detection.scripts)
+      });
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+  });
   register('apps:findByPath', ({ path }) => {
     try {
       const real = realpathSync(path);
@@ -200,6 +415,7 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
   register('proc:list', () => orchestrator.listApps());
 
   register('tasks:list', ({ appId }) => taskRegistry.list(appId));
+  register('tasks:listAll', () => taskRegistry.listAll());
   register('tasks:add', ({ appId, patch }) => taskRegistry.add(appId, patch));
   register('tasks:update', ({ id, patch }) => taskRegistry.update(id, patch));
   register('tasks:remove', ({ id }) => {
@@ -219,6 +435,46 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
   register('task:clearBuffer', ({ id }) => runner.clearBuffer(id));
   register('task:resize', ({ id, cols, rows }) => runner.resize(id, cols, rows));
 
+  register('task:subscribeLogs', ({ id }) => {
+    logSubs.add(id);
+  });
+  register('task:unsubscribeLogs', ({ id }) => {
+    logSubs.delete(id);
+  });
+
+  // Global log search: fan over every live task's ring buffer in main and return matches.
+  register('logs:searchAll', ({ query, flags, limit }) => {
+    const out: GlobalLogMatch[] = [];
+    if (!query.trim()) return out;
+    let re: RegExp;
+    try {
+      re = new RegExp(query, flags ?? 'i');
+    } catch {
+      // Fall back to a literal substring match if the regex is invalid.
+      re = new RegExp(query.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i');
+    }
+    const cap = limit ?? 500;
+    for (const rt of runner.list()) {
+      const app = registry.get(rt.appId);
+      const tasks = taskRegistry.list(rt.appId);
+      const taskName = tasks.find((t) => t.id === rt.taskId)?.name ?? '';
+      const buf = runner.readBuffer(rt.taskId);
+      for (const line of buf.split('\n')) {
+        if (re.test(line)) {
+          out.push({
+            appId: rt.appId,
+            taskId: rt.taskId,
+            appName: app?.name ?? '',
+            taskName,
+            line: line.length > 2000 ? line.slice(0, 2000) : line
+          });
+          if (out.length >= cap) return out;
+        }
+      }
+    }
+    return out;
+  });
+
   register('runs:list', ({ appId, limit }) => runHistory.list(appId, limit));
 
   register('env:getGlobal', () => envStore.getGlobal());
@@ -257,19 +513,37 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
       runner.logs.setLimits({ maxLines: patch.log_ring_size });
     }
     if (patch.auto_update === true) updater.start();
+    if (patch.auto_update === false) updater.stop();
+    // Apply OS-level + tray side effects immediately.
+    if (typeof patch.tray_enabled === 'boolean') {
+      if (patch.tray_enabled) tray.enable();
+      else tray.disable();
+      tray.refresh();
+    }
+    if (typeof patch.launch_at_login === 'boolean') {
+      electronApp.setLoginItemSettings({ openAtLogin: patch.launch_at_login, openAsHidden: true });
+    }
     return next;
   });
 
   register('update:install', () => {
     updater.quitAndInstall();
   });
+  register('update:check', () => {
+    updater.checkNow();
+  });
+
+  register('logs:path', () => logger.path());
+  register('logs:openFolder', () => {
+    logger.openFolder();
+  });
 
   const openIn = new OpenIn();
   register('openIn:caps', () => openIn.caps());
   register('openIn:open', ({ target, path }) => openIn.open(target, path));
 
   // Danger-zone DB helpers.
-  const dbPath = join(electronApp.getPath('userData'), 'devharbor.db');
+  const dbPath = dbFile();
   register('db:path', () => dbPath);
   register('db:export', async () => {
     const w = win();
@@ -280,23 +554,25 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
       filters: [{ name: 'SQLite DB', extensions: ['db'] }]
     });
     if (result.canceled || !result.filePath) return null;
-    copyFileSync(dbPath, result.filePath);
+    // Use SQLite's online backup, NOT a raw file copy: in WAL mode most recent writes live in
+    // the -wal sidecar, so copyFileSync of just the .db would silently miss them
+    // (IMPROVEMENT-PLAN 5.11). backup() produces a fully-consistent single file.
+    await db().backup(result.filePath);
     return result.filePath;
   });
   register('db:reset', () => {
-    // Best-effort wipe — the next launch creates a fresh DB via migrations.
-    // We DON'T delete in-place; we move the existing file aside in case of regret.
-    if (existsSync(dbPath)) {
-      const archive = `${dbPath}.reset-${Date.now()}.bak`;
+    // Close the handle FIRST (checkpoints the WAL into the main file), then move the .db AND
+    // its -wal/-shm sidecars aside together so the relaunch can't recover stale WAL into the
+    // fresh DB. closeDb() also sets the shutdown guard so nothing re-opens mid-reset.
+    closeDb();
+    const stamp = Date.now();
+    for (const suffix of ['', '-wal', '-shm']) {
+      const f = `${dbPath}${suffix}`;
+      if (!existsSync(f)) continue;
       try {
-        copyFileSync(dbPath, archive);
-      } catch {
-        // ignore
-      }
-      try {
-        unlinkSync(dbPath);
-      } catch {
-        // ignore
+        renameSync(f, `${f}.reset-${stamp}.bak`);
+      } catch (e) {
+        logger.warn(`db:reset could not move ${f} aside`, e);
       }
     }
     // Force a restart so migrations + handlers run against the empty DB.
@@ -321,4 +597,12 @@ export function registerAllIpcHandlers(win: () => BrowserWindow | null): void {
     if (result.canceled || result.filePaths.length === 0) return null;
     return result.filePaths[0] ?? null;
   });
+
+  return {
+    runningTaskCount: () => orchestrator.runningTaskCount(),
+    stopAllRunning: () => orchestrator.stopAllRunning(),
+    // A renderer reload (⌘R is kept in prod) loses the renderer-side unsubscribe calls; if the
+    // stale subscriptions lingered, log forwarding would stay gated to dead taskIds forever.
+    onRendererReload: () => logSubs.clear()
+  };
 }
diff --git a/src/main/menu.ts b/src/main/menu.ts
index cfb22bb..f7e600f 100644
--- a/src/main/menu.ts
+++ b/src/main/menu.ts
@@ -8,11 +8,11 @@ const WEBSITE = 'https://www.devharbor.app';
  * Install the application menu.
  *
  * The default Electron menu ships developer affordances (Toggle DevTools, Force Reload)
- * and a "Learn More → electronjs.org" Help link — neither belongs in a shipped app. This
+ * and a "Learn More → electronjs.org" Help link - neither belongs in a shipped app. This
  * builds a clean, native macOS menu instead.
  *
  * Notes:
- * - **Reload (⌘R) is kept in every build** — the renderer relies on a hard reload to
+ * - **Reload (⌘R) is kept in every build** - the renderer relies on a hard reload to
  *   re-bootstrap onto the Dashboard (see App.tsx). Force Reload + Toggle DevTools are
  *   gated to dev only.
  * - The **Edit** submenu (undo/cut/copy/paste/select-all) is required: once a custom
@@ -113,6 +113,10 @@ export function installAppMenu(
     {
       role: 'help',
       submenu: [
+        // Forwarded to the renderer so the result (toast / up-to-date / error) surfaces there.
+        { label: 'Check for Updates…', click: send('menu:checkUpdates') },
+        { label: 'Open Logs Folder', click: send('menu:openLogs') },
+        { type: 'separator' },
         {
           label: `${APP_NAME} Website`,
           click: () => void shell.openExternal(WEBSITE)
diff --git a/src/main/services/AppOrchestrator.ts b/src/main/services/AppOrchestrator.ts
index 85c5bb4..968b7b4 100644
--- a/src/main/services/AppOrchestrator.ts
+++ b/src/main/services/AppOrchestrator.ts
@@ -28,6 +28,17 @@ export class AppOrchestrator extends EventEmitter {
   // next start, so a stopped app stays visibly Stopped instead of flickering to Idle.
   private lastOutcome = new Map<AppId, 'exited' | 'crashed'>();
 
+  // Per-app operation lock. start/stop/restart for one app are serialised so a file-change
+  // restart can't overlap a user stop (or another restart) and double-spawn / interleave
+  // (IMPROVEMENT-PLAN 7.4). Different apps still run concurrently.
+  private readonly ops = new Map<AppId, Promise<unknown>>();
+
+  // Cancellation hooks for in-flight starts. The lock serialises a queued stop BEHIND the
+  // start - and doStartApp can sit awaiting readiness for up to readiness_timeout_ms per
+  // level, which is exactly when users reach for Stop. stopApp/restartApp invoke this
+  // synchronously (before enqueueing) so the blocked start bails out immediately.
+  private readonly startCancels = new Map<AppId, () => void>();
+
   constructor(
     private readonly apps: AppRegistry,
     private readonly tasks: TaskRegistry,
@@ -38,6 +49,29 @@ export class AppOrchestrator extends EventEmitter {
     this.runner.on('log', (e: TaskLogEvent) => this.emit('task:log', e));
   }
 
+  /** Serialise an app-scoped operation behind any in-flight one for the same app. */
+  private withLock<T>(appId: AppId, fn: () => Promise<T>): Promise<T> {
+    const prev = this.ops.get(appId) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    // Keep the chain alive even if fn rejects (callers still see the real rejection).
+    this.ops.set(
+      appId,
+      next.then(
+        () => undefined,
+        () => undefined
+      )
+    );
+    return next;
+  }
+
+  /** Drop the sticky stopped/crashed badge for an app (called when it's removed). */
+  clearOutcome(appId: AppId): void {
+    this.lastOutcome.delete(appId);
+    this.ops.delete(appId);
+    this.startCancels.get(appId)?.();
+    this.startCancels.delete(appId);
+  }
+
   /** Snapshot of every running task across all apps. */
   listTasks(): RunningTask[] {
     return this.runner.list();
@@ -47,7 +81,7 @@ export class AppOrchestrator extends EventEmitter {
    * App-level summaries. Includes every app with a running task PLUS any app that ran and
    * stopped this session (sticky `lastOutcome`) so a renderer reload (Cmd+R) re-hydrates the
    * Stopped/Crashed badge instead of snapping it back to Idle. Without the latter, the
-   * `setRunningApps` snapshot — built only from running tasks — would erase the exited state.
+   * `setRunningApps` snapshot - built only from running tasks - would erase the exited state.
    */
   listApps(): RunningProcess[] {
     const byApp = new Map<AppId, RunningTask[]>();
@@ -86,13 +120,17 @@ export class AppOrchestrator extends EventEmitter {
     return derived;
   }
 
-  async startApp(appId: AppId): Promise<void> {
+  startApp(appId: AppId): Promise<void> {
+    return this.withLock(appId, () => this.doStartApp(appId));
+  }
+
+  private async doStartApp(appId: AppId): Promise<void> {
     const allTasks = this.tasks.list(appId).filter((t) => t.enabled);
     if (allTasks.length === 0) {
-      throw new Error('No enabled tasks for this app. Add one in Config.');
+      throw new Error('No enabled tasks for this app. Add one via Manage tasks.');
     }
 
-    // Fresh run — drop any sticky "stopped/crashed" outcome from a previous run.
+    // Fresh run - drop any sticky "stopped/crashed" outcome from a previous run.
     this.lastOutcome.delete(appId);
 
     // Mark the app as recently used. Drives Dashboard recently-used sort and
@@ -123,35 +161,67 @@ export class AppOrchestrator extends EventEmitter {
 
     let cancelled = false;
 
-    for (const level of levels) {
-      // Skip tasks already running (e.g. user manually started one).
-      const toStart: Task[] = [];
-      const awaitFor: Promise<boolean>[] = [];
-
-      for (const id of level) {
-        const t = byId.get(id)!;
-        if (this.runner.isRunning(id)) {
-          // Already running — still need to wait for readiness if not already ready.
-          if (!this.runner.isReady(id)) {
-            // We don't have a handle on the existing readiness promise here; skip waiting.
-            // Practical effect: if the user manually started a task with a long readiness,
-            // the orchestrator won't block on it. Acceptable for v1; document.
+    // A queued stop/restart cancels this start synchronously, so we never sit on the lock
+    // through a long readiness wait while the user's Stop click is stuck behind us.
+    let stopRequested = false;
+    const stopSignal = new Promise<void>((resolve) => {
+      this.startCancels.set(appId, () => {
+        stopRequested = true;
+        resolve();
+      });
+    });
+
+    try {
+      for (const level of levels) {
+        if (stopRequested) break;
+        // Skip tasks already running (e.g. user manually started one).
+        const toStart: Task[] = [];
+        const awaitFor: Promise<boolean>[] = [];
+
+        for (const id of level) {
+          const t = byId.get(id)!;
+          if (this.runner.isRunning(id)) {
+            // Already running - still need to wait for readiness if not already ready.
+            if (!this.runner.isReady(id)) {
+              // We don't have a handle on the existing readiness promise here; skip waiting.
+              // Practical effect: if the user manually started a task with a long readiness,
+              // the orchestrator won't block on it. Acceptable for v1; document.
+            }
+            continue;
           }
-          continue;
+          toStart.push(t);
         }
-        toStart.push(t);
-      }
 
-      // Start the level in parallel.
-      const started = await Promise.all(toStart.map((t) => this.runner.start(t)));
-      for (const s of started) awaitFor.push(s.awaitReady);
-
-      // Wait for all to hit ready (or fail).
-      const results = await Promise.all(awaitFor);
-      if (results.some((ok) => !ok)) {
-        cancelled = true;
-        break;
+        // Start the level in parallel.
+        const started = await Promise.all(toStart.map((t) => this.runner.start(t)));
+        for (const s of started) awaitFor.push(s.awaitReady);
+
+        // Wait for all to hit ready (or fail) - or for a stop to cancel the sequence. The
+        // queued stop then tears down whatever already spawned.
+        const results = await Promise.race([
+          Promise.all(awaitFor),
+          stopSignal.then(() => null)
+        ]);
+        if (results === null) break; // cancelled by a queued stop/restart
+        if (results.some((ok) => !ok)) {
+          cancelled = true;
+          break;
+        }
       }
+    } catch (err) {
+      // A task threw while spawning (folder moved, Node version missing, env build failed).
+      // Always emit a terminal state so the renderer never hangs on 'starting'
+      // (IMPROVEMENT-PLAN 5.4); the rejection still propagates so the caller can surface it.
+      this.emit('proc:status', { appId, state: 'crashed' as ProcessState });
+      throw err;
+    } finally {
+      this.startCancels.delete(appId);
+    }
+
+    if (stopRequested) {
+      // The queued stop emits its own terminal status; just reflect the current state.
+      this.emit('proc:status', { appId, state: this.appState(appId) });
+      return;
     }
 
     this.emit('proc:status', {
@@ -160,7 +230,14 @@ export class AppOrchestrator extends EventEmitter {
     });
   }
 
-  async stopApp(appId: AppId): Promise<void> {
+  stopApp(appId: AppId): Promise<void> {
+    // Cancel any in-flight start FIRST (synchronously) so this stop isn't queued behind a
+    // readiness wait that can hold the lock for up to readiness_timeout_ms per level.
+    this.startCancels.get(appId)?.();
+    return this.withLock(appId, () => this.doStopApp(appId));
+  }
+
+  private async doStopApp(appId: AppId): Promise<void> {
     const enabledTasks = this.tasks.list(appId).filter((t) => t.enabled);
     const ids = enabledTasks.map((t) => t.id);
     const depsMap = new Map<TaskId, TaskId[]>();
@@ -188,10 +265,15 @@ export class AppOrchestrator extends EventEmitter {
     this.emit('proc:status', { appId, state: 'exited' as ProcessState });
   }
 
-  async restartApp(appId: AppId): Promise<void> {
-    await this.stopApp(appId);
-    await new Promise((r) => setTimeout(r, 100));
-    await this.startApp(appId);
+  restartApp(appId: AppId): Promise<void> {
+    // Cancel an in-flight start so the restart isn't queued behind its readiness waits.
+    this.startCancels.get(appId)?.();
+    // One lock acquisition for the whole stop→start so nothing interleaves between them.
+    return this.withLock(appId, async () => {
+      await this.doStopApp(appId);
+      await new Promise((r) => setTimeout(r, 100));
+      await this.doStartApp(appId);
+    });
   }
 
   async startTask(taskId: TaskId): Promise<RunningTask> {
@@ -205,6 +287,30 @@ export class AppOrchestrator extends EventEmitter {
     await this.runner.stop(taskId);
   }
 
+  /** How many tasks are currently live (for the quit confirmation). Includes mid-spawn starts. */
+  runningTaskCount(): number {
+    const live = this.runner
+      .list()
+      .filter((t) => t.state === 'running' || t.state === 'starting' || t.state === 'exiting');
+    const liveIds = new Set(live.map((t) => t.taskId));
+    const pending = this.runner.pendingStartIds().filter((id) => !liveIds.has(id));
+    return live.length + pending.length;
+  }
+
+  /**
+   * Stop every running task, bounded by each task's kill-grace. Called on quit so dev
+   * servers are torn down gracefully (SIGTERM → grace → SIGKILL tree) instead of being left
+   * as orphans when the PTY master closes (IMPROVEMENT-PLAN 5.9). Mid-spawn starts are
+   * included - runner.stop() awaits the pending spawn before killing it.
+   */
+  async stopAllRunning(): Promise<void> {
+    const ids = new Set<TaskId>([
+      ...this.runner.list().map((t) => t.taskId),
+      ...this.runner.pendingStartIds()
+    ]);
+    await Promise.allSettled([...ids].map((id) => this.runner.stop(id)));
+  }
+
   private onTaskStatus(e: TaskStatusEvent): void {
     this.emit('task:status', e);
     // Record a sticky app outcome when a task ends, so the app stays Stopped/Crashed
@@ -274,7 +380,7 @@ function deriveAppState(allTasks: Task[], running: RunningTask[]): ProcessState
   for (const t of allTasks) {
     const r = runningById.get(t.id);
     if (!r) {
-      // Not tracked — either never started or already torn down.
+      // Not tracked - either never started or already torn down.
       continue;
     }
     if (r.state === 'starting') anyStarting = true;
@@ -292,7 +398,7 @@ function deriveAppState(allTasks: Task[], running: RunningTask[]): ProcessState
   if (anyStarting || anyNotReady) return 'starting';
   if (anyRunning) return 'running';
   // A task that's tracked-but-exited (the brief post-stop window before teardown) reads
-  // as 'exited', not 'idle' — so the app doesn't flicker Idle → Exited → Idle on stop.
+  // as 'exited', not 'idle' - so the app doesn't flicker Idle → Exited → Idle on stop.
   if (anyExited) return 'exited';
   return 'idle';
 }
diff --git a/src/main/services/AppRegistry.ts b/src/main/services/AppRegistry.ts
index 9915c89..b3e5db4 100644
--- a/src/main/services/AppRegistry.ts
+++ b/src/main/services/AppRegistry.ts
@@ -23,6 +23,7 @@ type AppRow = {
   custom_command: string | null;
   working_dir: string;
   auto_restart_on_change: number;
+  auto_start: number;
   watch_globs: string;
   port_hint: number | null;
   tags: string;
@@ -100,14 +101,38 @@ export class AppRegistry {
     const current = this.get(id);
     if (!current) throw new Error(`App not found: ${id}`);
 
-    const next: App = { ...current, ...patch, updatedAt: Date.now() };
+    // Validate & canonicalise a changed working directory the same way add()
+    // validates the app path. Without this an IPC patch could point working_dir
+    // at a non-existent or non-directory location (or a non-canonical symlink),
+    // which would later break process spawning. Only re-validate when it
+    // actually changes so unrelated patches stay cheap.
+    let workingDir = current.workingDir;
+    if (patch.workingDir != null && patch.workingDir !== current.workingDir) {
+      workingDir = this.normaliseDir(patch.workingDir);
+    }
+
+    // Pin the identity / immutable fields to the CURRENT row's values. A patch
+    // is untrusted (it arrives over IPC) and must never be able to change which
+    // row we write - `id` is forced back so the WHERE clause below can't be
+    // retargeted at a different app, and `path`/`createdAt` are forced back so a
+    // stray field can't silently rewrite immutable provenance. updatedAt is
+    // always refreshed to now, exactly as before.
+    const next: App = {
+      ...current,
+      ...patch,
+      id: current.id,
+      path: current.path,
+      createdAt: current.createdAt,
+      workingDir,
+      updatedAt: Date.now()
+    };
 
     db()
       .prepare(
         `UPDATE apps SET
           name = ?, color = ?, icon = ?, node_version_pref = ?, package_manager = ?,
           default_script = ?, custom_command = ?, working_dir = ?,
-          auto_restart_on_change = ?, watch_globs = ?, port_hint = ?, tags = ?,
+          auto_restart_on_change = ?, auto_start = ?, watch_globs = ?, port_hint = ?, tags = ?,
           folder = ?, last_started_at = ?, last_exit_code = ?, updated_at = ?
         WHERE id = ?`
       )
@@ -121,6 +146,7 @@ export class AppRegistry {
         next.customCommand,
         next.workingDir,
         next.autoRestartOnChange ? 1 : 0,
+        next.autoStart ? 1 : 0,
         JSON.stringify(next.watchGlobs),
         next.portHint,
         JSON.stringify(next.tags),
@@ -140,7 +166,7 @@ export class AppRegistry {
 
   /**
    * Distinct folder names across all apps, sorted alphabetically (case-insensitive).
-   * Excludes NULL — that's the "(Ungrouped)" pseudo-folder, handled at render time.
+   * Excludes NULL - that's the "(Ungrouped)" pseudo-folder, handled at render time.
    */
   listFolders(): string[] {
     const rows = db()
@@ -178,17 +204,42 @@ export class AppRegistry {
   }
 
   private normalisePath(p: string): string {
+    return this.normaliseDir(p, 'path');
+  }
+
+  /**
+   * Resolve `p` to a canonical, existing directory. Shared by add() (app path)
+   * and update() (working_dir) so both enforce the same realpath + isDirectory
+   * invariant; `label` only tailors the error message for the caller.
+   */
+  private normaliseDir(p: string, label = 'workingDir'): string {
     try {
       const real = realpathSync(p);
       const s = statSync(real);
       if (!s.isDirectory()) throw new Error(`Not a directory: ${p}`);
       return real;
     } catch (err) {
-      throw new Error(`Invalid path: ${p} (${(err as Error).message})`);
+      throw new Error(`Invalid ${label}: ${p} (${(err as Error).message})`);
     }
   }
 }
 
+/**
+ * Parse a JSON column defensively. A single corrupt cell (e.g. truncated write,
+ * manual DB edit, or a schema-migration mishap) must not blow up the entire
+ * `list()` - one bad row would otherwise throw and hide every other app. On
+ * failure we warn once per call site and fall back to the column's default so
+ * the app still surfaces in the UI and can be repaired by re-saving.
+ */
+function safeJson<T>(raw: string, fallback: T): T {
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    console.warn(`[AppRegistry] Ignoring corrupt JSON column; using fallback. Raw: ${raw}`);
+    return fallback;
+  }
+}
+
 function rowToApp(r: AppRow): App {
   return {
     id: r.id as AppId,
@@ -196,15 +247,16 @@ function rowToApp(r: AppRow): App {
     path: r.path,
     color: r.color,
     icon: r.icon ?? undefined,
-    nodeVersionPref: JSON.parse(r.node_version_pref) as NodeVersionPref,
+    nodeVersionPref: safeJson<NodeVersionPref>(r.node_version_pref, { kind: 'auto' }),
     packageManager: (r.package_manager as PackageManager | null) ?? null,
     defaultScript: r.default_script,
     customCommand: r.custom_command,
     workingDir: r.working_dir,
     autoRestartOnChange: !!r.auto_restart_on_change,
-    watchGlobs: JSON.parse(r.watch_globs) as string[],
+    autoStart: !!r.auto_start,
+    watchGlobs: safeJson<string[]>(r.watch_globs, []),
     portHint: r.port_hint,
-    tags: JSON.parse(r.tags) as string[],
+    tags: safeJson<string[]>(r.tags, []),
     folder: r.folder ?? null,
     lastStartedAt: r.last_started_at,
     lastExitCode: r.last_exit_code,
diff --git a/src/main/services/DeepLinks.ts b/src/main/services/DeepLinks.ts
index d1b4298..e918b73 100644
--- a/src/main/services/DeepLinks.ts
+++ b/src/main/services/DeepLinks.ts
@@ -1,4 +1,5 @@
 import { app, BrowserWindow } from 'electron';
+import { realpathSync } from 'node:fs';
 import type { AppRegistry } from './AppRegistry';
 import type { AppOrchestrator } from './AppOrchestrator';
 import type { AppId } from '@shared/types';
@@ -14,7 +15,7 @@ const PROTOCOL = 'devharbor';
  *                                            can offer to register it).
  *   - devharbor://open?id=<appId>         → focus by id
  *   - devharbor://start?id=<appId>        → focus the app and ask the renderer to CONFIRM
- *                                            starting it (never starts silently — a link
+ *                                            starting it (never starts silently - a link
  *                                            from any web page must not run shell commands
  *                                            without the user's consent)
  *
@@ -73,11 +74,18 @@ export class DeepLinks {
         }
       }
       if (path) {
-        const existing = this.registry.getByPath(path);
+        // Registered apps store their realpath'd, canonical path (AppRegistry.add →
+        // normalisePath → realpathSync), so a symlinked or otherwise non-canonical path
+        // from the URL would never match an existing entry on a raw string compare. Resolve
+        // it the same way before the lookup. If the path doesn't exist on disk, realpathSync
+        // throws - fall back to the raw value, which simply won't match and proceeds to the
+        // unknownPath branch exactly as before.
+        const canonicalPath = this.canonicalise(path);
+        const existing = this.registry.getByPath(canonicalPath);
         if (existing) {
           win.webContents.send('deepLink:focusApp', { appId: existing.id });
         } else {
-          win.webContents.send('deepLink:unknownPath', { path });
+          win.webContents.send('deepLink:unknownPath', { path: canonicalPath });
         }
       }
     } else if (host === 'start') {
@@ -93,4 +101,18 @@ export class DeepLinks {
       }
     }
   }
+
+  /**
+   * Resolve a filesystem path to its canonical (symlink-free) form so it can be compared
+   * against the realpath'd paths stored in the registry. Wrapped in try/catch because the
+   * path may not exist on disk - in that case we keep the raw value, which won't match any
+   * registered app and falls through to the unknownPath flow, preserving prior behaviour.
+   */
+  private canonicalise(path: string): string {
+    try {
+      return realpathSync(path);
+    } catch {
+      return path;
+    }
+  }
 }
diff --git a/src/main/services/DetectionService.ts b/src/main/services/DetectionService.ts
index 7c55c4d..be7da46 100644
--- a/src/main/services/DetectionService.ts
+++ b/src/main/services/DetectionService.ts
@@ -1,11 +1,15 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import type { DetectionResult } from '@shared/types';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import type { DetectionResult, WorkspaceCandidate } from '@shared/types';
 import { PMDetector } from './PMDetector';
 import { NodeResolver } from './NodeResolver';
 
 const SCRIPT_PRIORITY = ['dev', 'start', 'serve', 'develop'];
 
+function pickSuggested(scriptNames: string[]): string | null {
+  return SCRIPT_PRIORITY.find((s) => scriptNames.includes(s)) ?? scriptNames[0] ?? null;
+}
+
 export class DetectionService {
   constructor(
     private readonly pms = new PMDetector(),
@@ -17,13 +21,11 @@ export class DetectionService {
     const nodeVersionFromProject =
       this.node.readProjectNodeVersion(projectPath) ?? this.node.readEnginesNode(projectPath);
 
+    const hasPackageJson = existsSync(join(projectPath, 'package.json'));
     const scripts = this.readScripts(projectPath);
     const envFiles = this.findEnvFiles(projectPath);
 
-    const suggestedDefaultScript =
-      SCRIPT_PRIORITY.find((s) => Object.prototype.hasOwnProperty.call(scripts, s)) ??
-      Object.keys(scripts)[0] ??
-      null;
+    const suggestedDefaultScript = pickSuggested(Object.keys(scripts));
 
     return {
       packageManager,
@@ -31,8 +33,103 @@ export class DetectionService {
       scripts,
       hasEnvFile: envFiles.length > 0,
       envFiles,
-      suggestedDefaultScript
+      suggestedDefaultScript,
+      hasPackageJson,
+      workspaces: this.detectWorkspaces(projectPath)
+    };
+  }
+
+  /**
+   * Monorepo support: read pnpm-workspace.yaml / package.json "workspaces" globs, expand one
+   * level, and return each workspace package that defines runnable scripts. Lets the add flow
+   * offer "create a task per workspace package" instead of hand-building each task.
+   */
+  private detectWorkspaces(root: string): WorkspaceCandidate[] {
+    const { include, exclude } = this.workspaceGlobs(root);
+    if (include.length === 0) return [];
+    const dirs = new Set<string>();
+    for (const g of include) {
+      for (const d of expandGlob(root, g)) dirs.add(d);
+    }
+    // pnpm supports negated entries (e.g. `- '!packages/legacy'`) - subtract their expansions
+    // so excluded packages aren't offered as workspace-task candidates.
+    for (const g of exclude) {
+      for (const d of expandGlob(root, g)) dirs.delete(d);
+    }
+    const out: WorkspaceCandidate[] = [];
+    for (const dir of dirs) {
+      const pkgPath = join(dir, 'package.json');
+      if (!existsSync(pkgPath)) continue;
+      try {
+        const data = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        const scriptNames =
+          data?.scripts && typeof data.scripts === 'object'
+            ? Object.keys(data.scripts).filter((k) => typeof data.scripts[k] === 'string')
+            : [];
+        if (scriptNames.length === 0) continue;
+        out.push({
+          name: typeof data?.name === 'string' ? data.name : relative(root, dir),
+          relPath: relative(root, dir),
+          scripts: scriptNames,
+          suggestedScript: pickSuggested(scriptNames)
+        });
+      } catch {
+        // skip unreadable / malformed package.json
+      }
+    }
+    return out.sort((a, b) => a.relPath.localeCompare(b.relPath)).slice(0, 50);
+  }
+
+  private workspaceGlobs(root: string): { include: string[]; exclude: string[] } {
+    const include: string[] = [];
+    const exclude: string[] = [];
+    const push = (raw: string): void => {
+      const g = raw.trim();
+      if (!g) return;
+      if (g.startsWith('!')) exclude.push(g.slice(1));
+      else include.push(g);
     };
+    // pnpm-workspace.yaml (light line parse - no YAML dep). Handles both the block list
+    // (`packages:\n - 'apps/*'`) and the inline flow form (`packages: ['apps/*', 'libs/*']`).
+    const pnpmWs = join(root, 'pnpm-workspace.yaml');
+    if (existsSync(pnpmWs)) {
+      try {
+        let inPackages = false;
+        for (const raw of readFileSync(pnpmWs, 'utf8').split(/\r?\n/)) {
+          const flow = raw.match(/^packages:\s*\[(.*)\]\s*$/);
+          if (flow) {
+            for (const part of (flow[1] ?? '').split(',')) {
+              push(part.replace(/['"]/g, ''));
+            }
+            continue;
+          }
+          if (/^packages:\s*$/.test(raw)) {
+            inPackages = true;
+            continue;
+          }
+          if (inPackages) {
+            const m = raw.match(/^\s*-\s*['"]?([^'"#]+?)['"]?\s*$/);
+            if (m && m[1]) push(m[1]);
+            else if (/^\S/.test(raw)) inPackages = false; // dedented → left the list
+          }
+        }
+      } catch {
+        // ignore
+      }
+    }
+    // package.json "workspaces" (npm/yarn) - array or { packages: [...] }.
+    const pkgPath = join(root, 'package.json');
+    if (existsSync(pkgPath)) {
+      try {
+        const data = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        const ws = data?.workspaces;
+        const arr = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
+        for (const g of arr) if (typeof g === 'string') push(g);
+      } catch {
+        // ignore
+      }
+    }
+    return { include: [...new Set(include)], exclude: [...new Set(exclude)] };
   }
 
   private readScripts(projectPath: string): Record<string, string> {
@@ -62,3 +159,36 @@ export class DetectionService {
     }
   }
 }
+
+/**
+ * Expand a single workspace glob one level deep. Handles the common monorepo shapes - 
+ * `packages/*`, `apps/*`, or an exact relative path - returning absolute directory paths.
+ * Deliberately not a full glob engine; deeper/`**` patterns just resolve their static prefix.
+ */
+function expandGlob(root: string, glob: string): string[] {
+  const clean = glob.replace(/\/+$/, '');
+  const starIdx = clean.indexOf('*');
+  if (starIdx === -1) {
+    const abs = join(root, clean);
+    return isDir(abs) ? [abs] : [];
+  }
+  const prefix = clean.slice(0, starIdx).replace(/\/+$/, '');
+  const parent = join(root, prefix);
+  if (!isDir(parent)) return [];
+  try {
+    return readdirSync(parent)
+      .filter((name) => !name.startsWith('.'))
+      .map((name) => join(parent, name))
+      .filter(isDir);
+  } catch {
+    return [];
+  }
+}
+
+function isDir(p: string): boolean {
+  try {
+    return statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
diff --git a/src/main/services/EnvBuilder.ts b/src/main/services/EnvBuilder.ts
index 14ad38f..969aca3 100644
--- a/src/main/services/EnvBuilder.ts
+++ b/src/main/services/EnvBuilder.ts
@@ -5,16 +5,36 @@ import { parseDotEnv } from '@shared/dotenv';
 import type { EnvStore } from './EnvStore';
 import type { PathProbe } from './PathProbe';
 
+/**
+ * Process-control keys that an on-disk project `.env` is NEVER allowed to set.
+ *
+ * IMPROVEMENT-PLAN 6.1: a checked-in or malicious `.env` could otherwise hijack
+ * the spawned process by overriding the computed PATH (shadowing real binaries
+ * with attacker-controlled ones on disk), or by injecting loader/runtime hooks
+ * via NODE_OPTIONS / NODE_PATH / DYLD_* / LD_* (e.g. DYLD_INSERT_LIBRARIES code
+ * injection on macOS). We strip these from file vars entirely - they can only
+ * come from the sanitized base, the computed PATH, or user-configured env_vars.
+ */
+const PROCESS_CONTROL_KEYS = new Set(['PATH', 'NODE_OPTIONS', 'NODE_PATH']);
+
+/** True if a key from a project `.env` must be dropped (see {@link PROCESS_CONTROL_KEYS}). */
+function isProcessControlKey(key: string): boolean {
+  return PROCESS_CONTROL_KEYS.has(key) || /^(DYLD_|LD_)/.test(key);
+}
+
 /**
  * Build the env handed to a spawned task.
  *
- * Layering order (later wins):
- *   1. Sanitized OS base (HOME, USER, LANG, …)
- *   2. User's full PATH from the login-shell probe (Node bin prepended in front)
- *   3. Global env_vars rows (enabled only)
- *   4. App env_vars rows (enabled only)
- *   5. Task env_vars rows (enabled only) — Phase 7
- *   6. .env, .env.local from the task's working dir
+ * Layering order (later wins). IMPROVEMENT-PLAN 6.1: user-configured vars now
+ * sit ABOVE project `.env` files so the UI is the source of truth, and project
+ * files can never override process-control keys (see {@link isProcessControlKey}).
+ *
+ *   1. Sanitized OS base (HOME, USER, LANG, SSH_AUTH_SOCK, …)
+ *   2. Computed PATH (Node bin dir prepended to the login-shell PATH probe)
+ *   3. Project .env files (process-control keys stripped - see parseEnvFiles)
+ *   4. Global env_vars rows (enabled only)
+ *   5. App env_vars rows (enabled only)
+ *   6. Task env_vars rows (enabled only) - Phase 7
  *   7. Hard-coded runtime (FORCE_COLOR, TERM)
  */
 export class EnvBuilder {
@@ -37,7 +57,14 @@ export class EnvBuilder {
       'LANG',
       'LC_ALL',
       'TMPDIR',
-      'SHELL'
+      'SHELL',
+      // Forward the agent socket so git-over-SSH / `ssh` in a task authenticates
+      // the same way it does in the user's terminal instead of prompting/failing.
+      'SSH_AUTH_SOCK',
+      // Terminal identity hints so CLIs that probe these (e.g. for hyperlink or
+      // truecolor support) behave like they would in a real terminal.
+      'TERM_PROGRAM',
+      'COLORTERM'
     ]);
 
     const userPath = await this.pathProbe.get();
@@ -46,21 +73,22 @@ export class EnvBuilder {
       PATH: `${nodeBinDir}:${userPath}`
     };
 
+    // Project .env files first, so user-configured env_vars below always win and
+    // process-control keys (PATH, NODE_OPTIONS, …) are stripped (see parseEnvFiles).
+    Object.assign(env, this.parseEnvFiles(cwd));
+
     // Global env vars (from settings → env_vars table)
     layerVars(env, this.envStore.getGlobal());
 
     // App env vars
     layerVars(env, this.envStore.getApp(app.id as AppId));
 
-    // Task env vars — Phase 7. EnvStore.getTask backfills from legacy
+    // Task env vars - Phase 7. EnvStore.getTask backfills from legacy
     // tasks.env_overrides JSON on first read if no rows exist yet.
     if (task) {
       layerVars(env, this.envStore.getTask(task.id));
     }
 
-    // .env files in cwd
-    Object.assign(env, this.parseEnvFiles(cwd));
-
     // Hard-coded runtime
     env.FORCE_COLOR = '1';
     env.TERM = 'xterm-256color';
@@ -69,13 +97,21 @@ export class EnvBuilder {
   }
 
   private parseEnvFiles(dir: string): Record<string, string> {
-    const files = ['.env', '.env.local'];
+    // Conventional dev-tool precedence (later wins): base, then env-specific,
+    // then local overrides, then env-specific local overrides. All of these
+    // still sit BELOW user-configured env_vars in build().
+    const files = ['.env', '.env.development', '.env.local', '.env.development.local'];
     const out: Record<string, string> = {};
     for (const f of files) {
       const p = join(dir, f);
       if (!existsSync(p)) continue;
       try {
-        Object.assign(out, parseDotEnv(readFileSync(p, 'utf8')));
+        const parsed = parseDotEnv(readFileSync(p, 'utf8'));
+        for (const [key, value] of Object.entries(parsed)) {
+          // Never let a project file hijack the process - drop control keys.
+          if (isProcessControlKey(key)) continue;
+          out[key] = value;
+        }
       } catch {
         // ignore unreadable env file
       }
diff --git a/src/main/services/EnvStore.ts b/src/main/services/EnvStore.ts
index 8e83e2b..5cde142 100644
--- a/src/main/services/EnvStore.ts
+++ b/src/main/services/EnvStore.ts
@@ -1,7 +1,15 @@
+import { safeStorage } from 'electron';
 import { ulid } from 'ulid';
 import { db } from '../db/index.js';
 import type { AppId, EnvVar, TaskId } from '@shared/types';
 
+/**
+ * Prefix tagging a value as encrypted-at-rest via Electron safeStorage.
+ * Versioned so a future scheme change (e.g. 'enc2:') can be distinguished without
+ * a destructive migration. Plaintext rows carry no prefix.
+ */
+const ENC_PREFIX = 'enc1:';
+
 type EnvRow = {
   id: string;
   app_id: string | null;
@@ -61,7 +69,7 @@ export class EnvStore {
         `SELECT * FROM env_vars WHERE app_id IS NULL AND task_id IS NULL ORDER BY key ASC`
       )
       .all()
-      .map(rowToEnvVar);
+      .map(this.rowToEnvVar);
   }
 
   private listApp(appId: AppId): EnvVar[] {
@@ -70,7 +78,7 @@ export class EnvStore {
         `SELECT * FROM env_vars WHERE app_id = ? AND task_id IS NULL ORDER BY key ASC`
       )
       .all(appId)
-      .map(rowToEnvVar);
+      .map(this.rowToEnvVar);
   }
 
   private listTask(taskId: TaskId): EnvVar[] {
@@ -79,7 +87,7 @@ export class EnvStore {
         `SELECT * FROM env_vars WHERE task_id = ? ORDER BY key ASC`
       )
       .all(taskId)
-      .map(rowToEnvVar);
+      .map(this.rowToEnvVar);
   }
 
   private replaceGlobal(incoming: EnvVar[]): void {
@@ -112,8 +120,19 @@ export class EnvStore {
     if (!row) throw new Error(`Task ${taskId} not found`);
     const appId = row.app_id as AppId;
     const deleteAll = db().prepare(`DELETE FROM env_vars WHERE task_id = ?`);
+    // Permanently neutralise the legacy tasks.env_overrides JSON in the SAME
+    // transaction as the delete+insert. Without this, deleting all of a task's
+    // vars (setTask(id, [])) leaves COUNT(env_vars)=0, and on next launch
+    // ensureTaskBackfilled would re-insert the frozen JSON, resurrecting the
+    // deleted values (IMPROVEMENT-PLAN 5.7). '{}' is the persistent done-marker.
+    const neutralizeLegacy = db().prepare(
+      `UPDATE tasks SET env_overrides = '{}' WHERE id = ?`
+    );
     this.replaceTx(
-      () => deleteAll.run(taskId),
+      () => {
+        deleteAll.run(taskId);
+        neutralizeLegacy.run(taskId);
+      },
       incoming,
       { appId, taskId }
     );
@@ -142,7 +161,9 @@ export class EnvStore {
           scope.appId,
           scope.taskId,
           key,
-          v.value ?? '',
+          // Encrypt secret values at rest; non-secrets stored verbatim. getX still
+          // returns decrypted plaintext via rowToEnvVar, so callers are unaffected.
+          this.encMaybe(v.value ?? '', v.isSecret),
           v.enabled ? 1 : 0,
           v.isSecret ? 1 : 0,
           v.note ?? null,
@@ -160,6 +181,12 @@ export class EnvStore {
    * Idempotent: if the task already has any rows in env_vars (task_id = ?) we assume
    * it's already migrated and skip. We also remember the taskId in-memory so we don't
    * re-check on every call within one process lifetime.
+   *
+   * IMPROVEMENT-PLAN 5.7: on EVERY return path we collapse tasks.env_overrides to
+   * '{}' (the persistent done-marker from the 0004 migration). Without this, a task
+   * whose vars were all deleted would have COUNT(env_vars)=0 on next launch and the
+   * frozen JSON would be re-backfilled, resurrecting the deleted values. Stamping
+   * '{}' once and for all makes resurrection impossible across relaunches.
    */
   private ensureTaskBackfilled(taskId: TaskId): void {
     if (this.backfilledTasks.has(taskId)) return;
@@ -169,6 +196,7 @@ export class EnvStore {
       )
       .get(taskId);
     if (existing && existing.n > 0) {
+      this.neutralizeLegacyOverrides(taskId);
       this.backfilledTasks.add(taskId);
       return;
     }
@@ -178,6 +206,7 @@ export class EnvStore {
       )
       .get(taskId);
     if (!row || !row.env_overrides) {
+      this.neutralizeLegacyOverrides(taskId);
       this.backfilledTasks.add(taskId);
       return;
     }
@@ -185,11 +214,13 @@ export class EnvStore {
     try {
       parsed = JSON.parse(row.env_overrides) as Record<string, unknown>;
     } catch {
+      this.neutralizeLegacyOverrides(taskId);
       this.backfilledTasks.add(taskId);
       return;
     }
     const entries = Object.entries(parsed).filter(([, v]) => typeof v === 'string');
     if (entries.length === 0) {
+      this.neutralizeLegacyOverrides(taskId);
       this.backfilledTasks.add(taskId);
       return;
     }
@@ -201,19 +232,89 @@ export class EnvStore {
       enabled: true,
       isSecret: /SECRET|TOKEN|PASSWORD|KEY|PRIVATE/i.test(k)
     }));
+    // replaceTask already stamps env_overrides='{}' inside its transaction, so the
+    // backfill itself is self-neutralising; the explicit stamps above cover the
+    // paths where replaceTask is never reached.
     this.replaceTask(taskId, incoming);
     this.backfilledTasks.add(taskId);
   }
-}
 
-function rowToEnvVar(r: EnvRow): EnvVar {
-  return {
+  /** Collapse a task's legacy env_overrides JSON to the '{}' done-marker (idempotent). */
+  private neutralizeLegacyOverrides(taskId: TaskId): void {
+    db()
+      .prepare(`UPDATE tasks SET env_overrides = '{}' WHERE id = ?`)
+      .run(taskId);
+  }
+
+  /**
+   * Encrypt a value for storage when it is a secret and OS-backed encryption is
+   * available. Returns 'enc1:'+base64(ciphertext) for secrets, otherwise the value
+   * verbatim. When safeStorage is unavailable (e.g. headless/Linux without a keyring)
+   * we silently fall back to plaintext rather than block saves.
+   */
+  private encMaybe(value: string, isSecret: boolean): string {
+    if (isSecret && safeStorage.isEncryptionAvailable()) {
+      return ENC_PREFIX + safeStorage.encryptString(value).toString('base64');
+    }
+    return value;
+  }
+
+  /**
+   * Inverse of encMaybe: decrypt 'enc1:'-tagged SECRET values back to plaintext; pass
+   * everything else through unchanged. Only rows flagged is_secret are ever decrypted - 
+   * a non-secret value that legitimately begins with 'enc1:' must not be interpreted as
+   * ciphertext. On decrypt failure (keychain unavailable, corrupt blob) we return the RAW
+   * stored string rather than '' - destroying the value would make a transient keychain
+   * hiccup permanent the moment the user hits Save.
+   */
+  private decMaybe(value: string, isSecret: boolean): string {
+    if (isSecret && value.startsWith(ENC_PREFIX)) {
+      try {
+        return safeStorage.decryptString(
+          Buffer.from(value.slice(ENC_PREFIX.length), 'base64')
+        );
+      } catch {
+        return value;
+      }
+    }
+    return value;
+  }
+
+  /**
+   * One-shot, idempotent boot migration: re-encrypt any secret rows still stored
+   * as plaintext (is_secret = 1 AND value NOT LIKE 'enc1:%'). Called once on boot by
+   * the IPC layer. No-op when encryption is unavailable, so plaintext stays readable.
+   */
+  migratePlaintextSecrets(): void {
+    if (!safeStorage.isEncryptionAvailable()) return;
+    const rows = db()
+      .prepare<unknown[], { id: string; value: string }>(
+        `SELECT id, value FROM env_vars WHERE is_secret = 1 AND value NOT LIKE 'enc1:%'`
+      )
+      .all();
+    if (rows.length === 0) return;
+    const update = db().prepare(`UPDATE env_vars SET value = ? WHERE id = ?`);
+    const tx = db().transaction(() => {
+      for (const r of rows) {
+        update.run(this.encMaybe(r.value, true), r.id);
+      }
+    });
+    tx();
+  }
+
+  /**
+   * Map a raw env_vars row to the public EnvVar shape, transparently decrypting
+   * secret values so EnvBuilder/EnvEditor always see plaintext. Arrow-bound so it
+   * can be passed directly to Array.map without losing `this` (needs this.decMaybe).
+   */
+  private readonly rowToEnvVar = (r: EnvRow): EnvVar => ({
     id: r.id,
     appId: (r.app_id as AppId | null) ?? null,
     key: r.key,
-    value: r.value,
+    value: this.decMaybe(r.value, !!r.is_secret),
     enabled: !!r.enabled,
     isSecret: !!r.is_secret,
     note: r.note ?? undefined
-  };
+  });
 }
+
diff --git a/src/main/services/LogBuffer.ts b/src/main/services/LogBuffer.ts
index 4001af8..ad1775b 100644
--- a/src/main/services/LogBuffer.ts
+++ b/src/main/services/LogBuffer.ts
@@ -3,23 +3,32 @@ import type { TaskId } from '@shared/types';
 interface Buffer {
   chunks: string[];
   bytes: number;
+  lastTouch: number;
+  exited: boolean;
 }
 
 const DEFAULT_MAX_BYTES = 5 * 1024 * 1024; // 5 MB per task
 const DEFAULT_MAX_LINES = 10_000;          // hard upper bound on chunk count
 const MAX_SINGLE_CHUNK_BYTES = 10 * 1024;  // truncate any single chunk this long
+const GLOBAL_MAX_BYTES = 100 * 1024 * 1024; // 100 MB across ALL tasks
+const EXITED_TTL_MS = 10 * 60 * 1000;       // free an exited task's buffer ~10 min after exit
 
 /**
  * Main-side authoritative ring buffer for each task's log stream.
  *
- * - Bounded by both bytes and chunk count.
+ * - Bounded per-task by both bytes and chunk count.
+ * - Bounded GLOBALLY by a total byte budget with LRU eviction of EXITED-task buffers first,
+ *   so a long session that ran dozens of tasks can't pin hundreds of MB in main forever
+ *   (IMPROVEMENT-PLAN 9.4). An exited task's buffer is also freed ~10 min after exit.
  * - Single chunks larger than `MAX_SINGLE_CHUNK_BYTES` are truncated with a marker.
- * - Survives task exits (the renderer can still scroll back).
+ * - Survives task exits (the renderer can still scroll back) until evicted/timed-out.
  * - Cleared explicitly via `clear()` or when the app is removed.
  * - Bounds live-updatable via `setLimits()` so Settings changes take effect immediately.
  */
 export class LogBuffer {
   private readonly buffers = new Map<TaskId, Buffer>();
+  private readonly expiry = new Map<TaskId, NodeJS.Timeout>();
+  private totalBytes = 0;
   private maxBytes: number;
   private maxLines: number;
 
@@ -44,34 +53,94 @@ export class LogBuffer {
 
     let buf = this.buffers.get(taskId);
     if (!buf) {
-      buf = { chunks: [], bytes: 0 };
+      buf = { chunks: [], bytes: 0, lastTouch: Date.now(), exited: false };
       this.buffers.set(taskId, buf);
     }
+    // Fresh output means the task is alive again (e.g. a restart) - un-mark it as exited.
+    if (buf.exited) {
+      buf.exited = false;
+      const t = this.expiry.get(taskId);
+      if (t) {
+        clearTimeout(t);
+        this.expiry.delete(taskId);
+      }
+    }
     buf.chunks.push(chunk);
     buf.bytes += chunk.length;
+    this.totalBytes += chunk.length;
+    buf.lastTouch = Date.now();
 
     while (buf.chunks.length > this.maxLines || buf.bytes > this.maxBytes) {
       const dropped = buf.chunks.shift();
       if (!dropped) break;
       buf.bytes -= dropped.length;
+      this.totalBytes -= dropped.length;
     }
+
+    if (this.totalBytes > GLOBAL_MAX_BYTES) this.enforceGlobalCap(taskId);
   }
 
   read(taskId: TaskId): string {
     const buf = this.buffers.get(taskId);
     if (!buf) return '';
+    buf.lastTouch = Date.now();
     return buf.chunks.join('');
   }
 
   tail(taskId: TaskId, maxLines = 200): string {
     const buf = this.buffers.get(taskId);
     if (!buf) return '';
+    buf.lastTouch = Date.now();
     const joined = buf.chunks.join('');
     const lines = joined.split(/\r?\n/);
     return lines.slice(Math.max(0, lines.length - maxLines)).join('\n');
   }
 
+  /** Mark a task as exited: its buffer becomes preferentially evictable and self-frees later. */
+  markExited(taskId: TaskId): void {
+    const buf = this.buffers.get(taskId);
+    if (!buf) return;
+    buf.exited = true;
+    const existing = this.expiry.get(taskId);
+    if (existing) clearTimeout(existing);
+    const timer = setTimeout(() => this.clear(taskId), EXITED_TTL_MS);
+    // Don't keep the process alive just to expire a log buffer.
+    timer.unref?.();
+    this.expiry.set(taskId, timer);
+  }
+
   clear(taskId: TaskId): void {
+    const buf = this.buffers.get(taskId);
+    if (buf) this.totalBytes -= buf.bytes;
     this.buffers.delete(taskId);
+    const t = this.expiry.get(taskId);
+    if (t) {
+      clearTimeout(t);
+      this.expiry.delete(taskId);
+    }
+  }
+
+  /** Evict whole buffers until under the global budget - exited tasks first, then LRU. */
+  private enforceGlobalCap(protectedId: TaskId): void {
+    while (this.totalBytes > GLOBAL_MAX_BYTES) {
+      let victim: TaskId | null = null;
+      let victimTouch = Infinity;
+      let victimExited = false;
+      for (const [id, buf] of this.buffers) {
+        if (id === protectedId) continue; // never evict the task we're actively writing
+        // Prefer exited buffers; among same exited-ness, evict the least recently touched.
+        const better =
+          victim === null ||
+          (buf.exited && !victimExited) ||
+          (buf.exited === victimExited && buf.lastTouch < victimTouch);
+        if (better) {
+          victim = id;
+          victimExited = buf.exited;
+          victimTouch = buf.lastTouch;
+        }
+      }
+      if (victim === null) break; // only the protected buffer remains
+      this.clear(victim);
+    }
   }
 }
diff --git a/src/main/services/Logger.ts b/src/main/services/Logger.ts
new file mode 100644
index 0000000..d5862f6
--- /dev/null
+++ b/src/main/services/Logger.ts
@@ -0,0 +1,64 @@
+import { app, shell } from 'electron';
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Minimal local file logger. DevHarbor ships with no telemetry, so when a user reports "it
+ * crashed" or "updates don't work" there was previously nothing to attach (IMPROVEMENT-PLAN
+ * 13.1). This writes plain-text diagnostics to the OS logs dir (~/Library/Logs/DevHarbor on
+ * macOS) - purely local, nothing leaves the machine. Deliberately dependency-free.
+ */
+
+let logFilePath: string | null = null;
+
+function file(): string {
+  if (logFilePath) return logFilePath;
+  const dir = app.getPath('logs');
+  try {
+    mkdirSync(dir, { recursive: true });
+  } catch {
+    // ignore
+  }
+  logFilePath = join(dir, 'devharbor.log');
+  return logFilePath;
+}
+
+function fmt(a: unknown): string {
+  if (a instanceof Error) return a.stack ?? `${a.name}: ${a.message}`;
+  if (typeof a === 'string') return a;
+  try {
+    return JSON.stringify(a);
+  } catch {
+    return String(a);
+  }
+}
+
+function write(level: string, args: unknown[]): void {
+  const line = `[${new Date().toISOString()}] [${level}] ${args.map(fmt).join(' ')}\n`;
+  try {
+    appendFileSync(file(), line);
+  } catch {
+    // never let logging throw
+  }
+}
+
+export const logger = {
+  info: (...a: unknown[]): void => write('INFO', a),
+  warn: (...a: unknown[]): void => write('WARN', a),
+  error: (...a: unknown[]): void => write('ERROR', a),
+  path: (): string => file(),
+  openFolder: (): void => {
+    void shell.showItemInFolder(file());
+  }
+};
+
+/**
+ * Route process-level faults into the log file. Without these, an uncaught exception or
+ * rejected promise in the packaged main process vanishes (no console attached). We log and
+ * keep running rather than letting the default handler tear the app down.
+ */
+export function installProcessLogging(): void {
+  process.on('uncaughtException', (err) => write('UNCAUGHT', [err]));
+  process.on('unhandledRejection', (reason) => write('UNHANDLED_REJECTION', [reason]));
+  write('INFO', [`DevHarbor ${app.getVersion()} starting`]);
+}
diff --git a/src/main/services/NodeResolver.ts b/src/main/services/NodeResolver.ts
index 1f2b785..0dc5942 100644
--- a/src/main/services/NodeResolver.ts
+++ b/src/main/services/NodeResolver.ts
@@ -9,7 +9,7 @@ import type { NodeInstallation, NodeVersionPref } from '@shared/types';
  * Discover Node installations across nvm / fnm / volta / asdf / system,
  * and resolve a project's preferred version to an absolute bin directory.
  *
- * Filesystem-based — does NOT shell out to nvm (which is a shell function).
+ * Filesystem-based - does NOT shell out to nvm (which is a shell function).
  */
 export class NodeResolver {
   private cache: NodeInstallation[] | null = null;
diff --git a/src/main/services/OpenIn.ts b/src/main/services/OpenIn.ts
index 33c272e..dbd6a7b 100644
--- a/src/main/services/OpenIn.ts
+++ b/src/main/services/OpenIn.ts
@@ -19,7 +19,7 @@ export interface OpenInCapabilities {
 
 /**
  * macOS .app bundle names per editor. We detect by bundle existence and launch via
- * `open -a "<App Name>"` — NOT by probing CLI shims (`code`, `cursor`, `subl`) on PATH.
+ * `open -a "<App Name>"` - NOT by probing CLI shims (`code`, `cursor`, `subl`) on PATH.
  *
  * Why: a GUI-launched macOS app inherits a minimal PATH (`/usr/bin:/bin:/usr/sbin:/sbin`)
  * that excludes `/usr/local/bin` and `/opt/homebrew/bin` where those CLI shims live. So
@@ -44,7 +44,7 @@ function bundleExists(bundles: string[]): boolean {
 
 /**
  * Ask LaunchServices whether an app of this display name is installed ANYWHERE
- * (Setapp, nested folders, /Applications/Utilities, etc.) — `open -a "<name>"` resolves
+ * (Setapp, nested folders, /Applications/Utilities, etc.) - `open -a "<name>"` resolves
  * the same way, so this matches what the launch will actually do. Returns false on any
  * error (osascript exits non-zero when the app is unknown).
  */
@@ -69,7 +69,7 @@ export class OpenIn {
   async caps(): Promise<OpenInCapabilities> {
     if (this.capsCache) return this.capsCache;
     // Fast path: bundle present in the standard dirs. Fallback: ask LaunchServices, which
-    // finds the app wherever it's installed — matching what `open -a` will actually do.
+    // finds the app wherever it's installed - matching what `open -a` will actually do.
     const detect = async (e: { appName: string; bundles: string[] }): Promise<boolean> =>
       bundleExists(e.bundles) || launchServicesKnows(e.appName);
     const [vscode, cursor, sublime] = await Promise.all([
diff --git a/src/main/services/PathProbe.ts b/src/main/services/PathProbe.ts
index 849e939..c6f4bda 100644
--- a/src/main/services/PathProbe.ts
+++ b/src/main/services/PathProbe.ts
@@ -3,6 +3,35 @@ import { promisify } from 'node:util';
 
 const execFileP = promisify(execFile);
 
+/**
+ * Unique markers printed around the real PATH so we can recover it from stdout that may
+ * also contain interactive-rc noise (banners, version-manager warnings, etc.). They must
+ * be unlikely to appear in any legitimate PATH or rc output.
+ */
+const PATH_BEGIN = '__DH_PATH_BEGIN__';
+const PATH_END = '__DH_PATH_END__';
+
+/**
+ * Recovers the real PATH from probe stdout. Prefers the substring between the sentinels
+ * (so rc banners/warnings printed before or after the marker are discarded). If the
+ * markers are missing - e.g. an old shell that mangled the printf - falls back to the last
+ * non-empty line, which is the most likely place for a bare `echo $PATH`-style value.
+ * Returns '' when nothing usable is found so the caller can drop to process.env.PATH.
+ */
+function extractPath(stdout: string): string {
+  const start = stdout.indexOf(PATH_BEGIN);
+  const end = stdout.indexOf(PATH_END, start + PATH_BEGIN.length);
+  if (start !== -1 && end !== -1) {
+    return stdout.slice(start + PATH_BEGIN.length, end).trim();
+  }
+  const lines = stdout.split('\n');
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i]?.trim();
+    if (line) return line;
+  }
+  return '';
+}
+
 /**
  * Apps launched from Finder/Spotlight inherit a stripped PATH that lacks the user's
  * shell additions (pnpm, asdf shims, /opt/homebrew, etc.). Probing a login shell on
@@ -21,13 +50,20 @@ export class PathProbe {
     this.probed = true;
     try {
       const shell = process.env.SHELL || '/bin/zsh';
-      // `-l` login, `-i` interactive — read full user rc files. `print -r --` is zsh-safe
-      // and bash treats it as printing a string too.
-      const { stdout } = await execFileP(shell, ['-l', '-i', '-c', 'printf %s "$PATH"'], {
-        timeout: 3000,
-        maxBuffer: 1 << 20
-      });
-      const probed = stdout.trim();
+      // `-l` login, `-i` interactive - read full user rc files. But `-i` runs the user's
+      // interactive rc, and anything those files print to stdout (shell banners,
+      // fastfetch/neofetch, "nvm is not compatible…" warnings, fnm/asdf messages) lands in
+      // our captured stdout and would corrupt PATH. Wrap the real value in unique sentinels
+      // so we can slice out exactly the PATH and discard any surrounding rc noise.
+      const { stdout } = await execFileP(
+        shell,
+        ['-l', '-i', '-c', `printf '${PATH_BEGIN}%s${PATH_END}' "$PATH"`],
+        {
+          timeout: 3000,
+          maxBuffer: 1 << 20
+        }
+      );
+      const probed = extractPath(stdout);
       if (probed) {
         this.cached = probed;
         return probed;
diff --git a/src/main/services/PortDetector.ts b/src/main/services/PortDetector.ts
index 4d8d677..6609322 100644
--- a/src/main/services/PortDetector.ts
+++ b/src/main/services/PortDetector.ts
@@ -5,6 +5,10 @@ import type { AppId, TaskId } from '@shared/types';
 
 const execFileP = promisify(execFile);
 const POLL_MS = 2000;
+// A log-hinted port that lsof never confirms within this many polls is dropped, so a
+// transient "Port 3000 in use, trying 3001" line doesn't pin :3000 forever (IMPROVEMENT-PLAN 7.5).
+const HINT_MAX_MISSES = 3;
+const MAX_TREE_DEPTH = 6;
 
 export interface PortsEvent {
   taskId: TaskId;
@@ -19,6 +23,8 @@ interface Tracked {
   knownPorts: Set<number>;
   /** Ports inferred from stdout (e.g. "localhost:3000"); merged with lsof results. */
   hinted: Set<number>;
+  /** Per-hint count of consecutive polls where lsof did NOT confirm the port. */
+  hintMisses: Map<number, number>;
 }
 
 const URL_PORT_RE = /\blocalhost:(\d{2,5})\b|\b(?:https?|ws):\/\/[^\s/]+:(\d{2,5})\b/g;
@@ -26,14 +32,15 @@ const LISTEN_PORT_RE = /\blistening\s+on\s+(?:port\s+)?:?(\d{2,5})\b/gi;
 
 /**
  * Detects which TCP ports each task is listening on. Two pronged:
- *  - Stdout parsing for `localhost:<port>` and "listening on :<port>" patterns.
- *  - `lsof` poll every 2s over the task's process tree.
+ * - Stdout parsing for `localhost:<port>` and "listening on :<port>" patterns.
+ * - `lsof` poll every 2s over the task's process tree.
  *
  * Emits 'ports' { taskId, appId, ports } when the set changes.
  */
 export class PortDetector extends EventEmitter {
   private readonly tracked = new Map<TaskId, Tracked>();
   private timer: NodeJS.Timeout | null = null;
+  private inFlight = false;
 
   track(taskId: TaskId, appId: AppId, pid: number): void {
     this.tracked.set(taskId, {
@@ -41,7 +48,8 @@ export class PortDetector extends EventEmitter {
       appId,
       pid,
       knownPorts: new Set(),
-      hinted: new Set()
+      hinted: new Set(),
+      hintMisses: new Map()
     });
     this.start();
     // Immediate tick so quickly-listening processes (Vite, Astro) show their port
@@ -85,9 +93,59 @@ export class PortDetector extends EventEmitter {
   }
 
   private async tick(): Promise<void> {
-    for (const t of this.tracked.values()) {
-      try {
-        const observed = await this.listListeningPortsFor(t);
+    const tasks = [...this.tracked.values()];
+    if (tasks.length === 0 || this.inFlight) return;
+    this.inFlight = true;
+    try {
+      // ONE `ps` snapshot for the whole machine instead of one `pgrep -P` per process in
+      // every task's tree, every tick (IMPROVEMENT-PLAN 9.2). With N tasks this turns
+      // ~25-35 forks/sec into 2: one ps + one lsof.
+      const childrenByPpid = await snapshotProcessTree();
+
+      const descByTask = new Map<TaskId, Set<number>>();
+      const allPids = new Set<number>();
+      for (const t of tasks) {
+        const desc = descendantsFromSnapshot(t.pid, childrenByPpid, MAX_TREE_DEPTH);
+        descByTask.set(t.taskId, desc);
+        for (const p of desc) allPids.add(p);
+      }
+
+      const lsofResult =
+        allPids.size > 0
+          ? await lsofPortsByPid([...allPids])
+          : { byPid: new Map<number, Set<number>>(), failed: false };
+      const portsByPid = lsofResult.byPid;
+
+      for (const t of tasks) {
+        const desc = descByTask.get(t.taskId) ?? new Set<number>();
+        const observed = new Set<number>();
+        for (const pid of desc) {
+          const ps = portsByPid.get(pid);
+          if (ps) for (const p of ps) observed.add(p);
+        }
+
+        // Prune stale hints: a hinted port lsof hasn't confirmed for HINT_MAX_MISSES polls is
+        // dropped (kills the "Port 3000 in use, trying 3001" false positive). A tick where
+        // lsof itself produced nothing (failed with no output) proves nothing about any hint - 
+        // counting it as a miss would erase every hinted port within seconds, so skip pruning.
+        for (const port of [...t.hinted]) {
+          if (observed.has(port)) {
+            t.hintMisses.delete(port);
+          } else if (!lsofResult.failed) {
+            const misses = (t.hintMisses.get(port) ?? 0) + 1;
+            if (misses >= HINT_MAX_MISSES) {
+              t.hinted.delete(port);
+              t.hintMisses.delete(port);
+            } else {
+              t.hintMisses.set(port, misses);
+            }
+          }
+        }
+
+        // Same reasoning for lsof-confirmed ports: on a failed tick, keep the previous set
+        // instead of blanking every task's chips because one pid in the union was stale.
+        if (lsofResult.failed && observed.size === 0) continue;
+
         const merged = new Set<number>([...observed, ...t.hinted]);
         if (!setsEqual(t.knownPorts, merged)) {
           t.knownPorts = merged;
@@ -97,57 +155,55 @@ export class PortDetector extends EventEmitter {
             ports: [...merged].sort((a, b) => a - b)
           } satisfies PortsEvent);
         }
-      } catch {
-        // ignore transient lsof failure
       }
+    } catch {
+      // ignore transient ps/lsof failure
+    } finally {
+      this.inFlight = false;
     }
   }
+}
 
-  private async listListeningPortsFor(t: Tracked): Promise<Set<number>> {
-    // Walk the task's process group via `pgrep -P`. Depth 5 covers typical chains
-    // (pty → npm → cross-spawn shell → tsx/nodemon → user binary).
-    const pids = await collectDescendants(t.pid, 5);
-    if (pids.size === 0) return new Set();
-    const args = ['-nP', '-iTCP', '-sTCP:LISTEN', '-a', '-Fpn', '-p', [...pids].join(',')];
-    try {
-      const { stdout } = await execFileP('lsof', args);
-      const out = new Set<number>();
-      for (const line of stdout.split(/\r?\n/)) {
-        if (!line.startsWith('n')) continue;
-        // Possible formats: "n*:3000", "n127.0.0.1:3000", "n[::1]:3000"
-        const m = line.match(/:(\d{2,5})$/);
-        if (m) {
-          const p = Number(m[1]);
-          if (p >= 1 && p <= 65535) out.add(p);
-        }
-      }
-      return out;
-    } catch {
-      // lsof exits non-zero when nothing matches the filter — treat as "no ports".
-      return new Set();
+/**
+ * One `ps` for the whole process table → map of ppid → child pids. Zombies are excluded:
+ * a reaped-but-unwaited child would otherwise poison the batched lsof call below (lsof
+ * exits non-zero when ANY pid in `-p` can't be opened).
+ */
+async function snapshotProcessTree(): Promise<Map<number, number[]>> {
+  const byPpid = new Map<number, number[]>();
+  try {
+    const { stdout } = await execFileP('ps', ['-axo', 'pid=,ppid=,stat=']);
+    for (const line of stdout.split(/\r?\n/)) {
+      const m = line.trim().match(/^(\d+)\s+(\d+)\s+(\S+)/);
+      if (!m) continue;
+      if (m[3]!.startsWith('Z')) continue; // zombie - skip
+      const pid = Number(m[1]);
+      const ppid = Number(m[2]);
+      const arr = byPpid.get(ppid);
+      if (arr) arr.push(pid);
+      else byPpid.set(ppid, [pid]);
     }
+  } catch {
+    // ps failed - return what we have (empty), callers treat as "no descendants".
   }
+  return byPpid;
 }
 
-async function collectDescendants(rootPid: number, maxDepth: number): Promise<Set<number>> {
+/** BFS the snapshot to collect a root pid and all its descendants (bounded depth). */
+function descendantsFromSnapshot(
+  rootPid: number,
+  childrenByPpid: Map<number, number[]>,
+  maxDepth: number
+): Set<number> {
   const all = new Set<number>([rootPid]);
   let frontier = [rootPid];
   for (let d = 0; d < maxDepth && frontier.length > 0; d++) {
     const next: number[] = [];
     for (const pid of frontier) {
-      try {
-        const { stdout } = await execFileP('pgrep', ['-P', String(pid)]);
-        for (const line of stdout.split(/\r?\n/)) {
-          const trimmed = line.trim();
-          if (!trimmed) continue;
-          const n = Number(trimmed);
-          if (!Number.isFinite(n) || n <= 0) continue;
-          if (all.has(n)) continue;
-          all.add(n);
-          next.push(n);
-        }
-      } catch {
-        // pgrep exits 1 when no children; treat as none.
+      for (const child of childrenByPpid.get(pid) ?? []) {
+        if (all.has(child)) continue;
+        all.add(child);
+        next.push(child);
       }
     }
     frontier = next;
@@ -155,6 +211,55 @@ async function collectDescendants(rootPid: number, maxDepth: number): Promise<Se
   return all;
 }
 
+/**
+ * One `lsof` for ALL tracked pids → map of pid → listening ports.
+ *
+ * lsof exits non-zero whenever ANY pid in `-p p1,p2,…` can't be located (it died between the
+ * ps snapshot and this call) - even though it still prints valid records for the live pids.
+ * promisified execFile rejects on non-zero exit but carries the stdout, so SALVAGE it: with
+ * a union of many tasks' pids, discarding the output on every stale pid would blank port
+ * chips for every task whenever one short-lived child is reaped mid-tick.
+ * `failed` is true only when there was no output at all (proves nothing about any port).
+ */
+async function lsofPortsByPid(
+  pids: number[]
+): Promise<{ byPid: Map<number, Set<number>>; failed: boolean }> {
+  const out = new Map<number, Set<number>>();
+  const args = ['-nP', '-iTCP', '-sTCP:LISTEN', '-a', '-Fpn', '-p', pids.join(',')];
+  let stdout: string;
+  try {
+    ({ stdout } = await execFileP('lsof', args));
+  } catch (e) {
+    const salvaged = (e as { stdout?: string }).stdout;
+    if (!salvaged) {
+      // No output at all - lsof genuinely failed (or nothing matched). Mark failed so the
+      // caller keeps previous state instead of treating this as "no ports anywhere".
+      return { byPid: out, failed: true };
+    }
+    stdout = salvaged;
+  }
+  // -Fpn output interleaves `p<pid>` (process) records with `n<name>` (file) records.
+  let currentPid: number | null = null;
+  for (const line of stdout.split(/\r?\n/)) {
+    if (line.startsWith('p')) {
+      const n = Number(line.slice(1));
+      currentPid = Number.isFinite(n) ? n : null;
+    } else if (line.startsWith('n') && currentPid != null) {
+      // "n*:3000", "n127.0.0.1:3000", "n[::1]:3000"
+      const m = line.match(/:(\d{2,5})$/);
+      if (m) {
+        const p = Number(m[1]);
+        if (p >= 1 && p <= 65535) {
+          const set = out.get(currentPid) ?? new Set<number>();
+          set.add(p);
+          out.set(currentPid, set);
+        }
+      }
+    }
+  }
+  return { byPid: out, failed: false };
+}
+
 function setsEqual(a: Set<number>, b: Set<number>): boolean {
   if (a.size !== b.size) return false;
   for (const v of a) if (!b.has(v)) return false;
diff --git a/src/main/services/RestartWatcher.ts b/src/main/services/RestartWatcher.ts
index 423548a..b114b10 100644
--- a/src/main/services/RestartWatcher.ts
+++ b/src/main/services/RestartWatcher.ts
@@ -1,18 +1,49 @@
 import { EventEmitter } from 'node:events';
+import { relative, sep } from 'node:path';
 import chokidar, { type FSWatcher } from 'chokidar';
+import picomatch from 'picomatch';
 import type { AppId } from '@shared/types';
 
 const DEFAULT_GLOBS = ['src/**/*.{ts,tsx,js,jsx,mjs,cjs}'];
 const DEBOUNCE_MS = 500;
-const IGNORE_GLOBS = [
-  '**/node_modules/**',
-  '**/.git/**',
-  '**/dist/**',
-  '**/build/**',
-  '**/.next/**',
-  '**/.cache/**',
-  '**/coverage/**'
-];
+// Directory names that must never be recursively watched (FD/CPU blowup).
+const IGNORE_SEGMENTS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.next',
+  '.cache',
+  'coverage'
+]);
+
+/**
+ * Builds the match/ignore predicates for one app's watch globs.
+ *
+ * chokidar v4+ REMOVED glob support, so passing `src/**` to chokidar.watch (as before) made
+ * the watcher silently dead - it treated the pattern as a literal non-existent path and never
+ * fired, disabling restart-on-change entirely (IMPROVEMENT-PLAN 5.1). The working approach is
+ * to watch the app DIRECTORY with a function-based `ignored` (so node_modules/.git/dist are
+ * pruned, avoiding a recursive-watch blowup), then filter emitted paths through picomatch.
+ */
+function makePredicates(dir: string, globs: string[]): {
+  ignored: (p: string) => boolean;
+  matches: (p: string) => boolean;
+} {
+  const patterns = globs.length > 0 ? globs : DEFAULT_GLOBS;
+  const isMatch = picomatch(patterns, { dot: false });
+  const ignored = (p: string): boolean => {
+    const rel = relative(dir, p);
+    if (rel === '') return false; // the watched root itself
+    if (rel.startsWith('..')) return true; // outside the app dir
+    return rel.split(sep).some((seg) => IGNORE_SEGMENTS.has(seg));
+  };
+  const matches = (p: string): boolean => {
+    const rel = relative(dir, p);
+    return rel !== '' && !rel.startsWith('..') && isMatch(rel);
+  };
+  return { ignored, matches };
+}
 
 /**
  * Watches each app's source files; when they change, emits a debounced 'restart' event.
@@ -24,16 +55,16 @@ export class RestartWatcher extends EventEmitter {
 
   watch(appId: AppId, dir: string, globs: string[]): void {
     this.unwatch(appId);
-    const patterns = (globs.length > 0 ? globs : DEFAULT_GLOBS).map((g) =>
-      g.startsWith('/') ? g : `${dir}/${g}`
-    );
-    const w = chokidar.watch(patterns, {
-      ignored: IGNORE_GLOBS,
+    const { ignored, matches } = makePredicates(dir, globs);
+    const w = chokidar.watch(dir, {
+      ignored,
       ignoreInitial: true,
       awaitWriteFinish: { stabilityThreshold: 100, pollInterval: 30 },
       followSymlinks: false
     });
     const trigger = (path: string): void => {
+      // Only the configured globs count - we watch the whole tree but restart on src changes.
+      if (!matches(path)) return;
       const t = this.timers.get(appId);
       if (t) clearTimeout(t);
       this.timers.set(
diff --git a/src/main/services/RunHistory.ts b/src/main/services/RunHistory.ts
index fa5ab1b..32aa2b9 100644
--- a/src/main/services/RunHistory.ts
+++ b/src/main/services/RunHistory.ts
@@ -90,6 +90,39 @@ export class RunHistory {
       .all(appId, limit);
     return rows.map(toRow);
   }
+
+  /**
+   * Trim run_history to the most recent `perAppLimit` rows per app.
+   *
+   * WHY: nothing else ever deletes from run_history, and with
+   * restart-on-change a single app can append hundreds of rows/day. Left
+   * unchecked the table grows without bound, bloating the DB and slowing
+   * list() queries. Pruning per app_id (rather than a global cap) keeps a
+   * usable window of history for every app regardless of how active others
+   * are. The DELETE runs as one statement so it stays atomic and cheap to
+   * call once on boot.
+   *
+   * A non-positive limit is treated as "no cap" and is a no-op - we never
+   * want a misconfigured setting to wipe the entire table.
+   */
+  prune(perAppLimit: number): void {
+    if (perAppLimit <= 0) return;
+    db()
+      .prepare(
+        `DELETE FROM run_history
+         WHERE id NOT IN (
+           SELECT id FROM (
+             SELECT id,
+                    ROW_NUMBER() OVER (
+                      PARTITION BY app_id ORDER BY started_at DESC
+                    ) AS rn
+             FROM run_history
+           )
+           WHERE rn <= ?
+         )`
+      )
+      .run(perAppLimit);
+  }
 }
 
 function toRow(r: DbRow): RunHistoryRow {
diff --git a/src/main/services/Settings.ts b/src/main/services/Settings.ts
index af002fc..3f21bd5 100644
--- a/src/main/services/Settings.ts
+++ b/src/main/services/Settings.ts
@@ -6,6 +6,12 @@ export type SettingsMap = {
   auto_update: boolean;
   theme: 'light' | 'dark' | 'system';
   dashboard_refresh_ms: number;
+  notify_on_crash: boolean;
+  notify_on_ready: boolean;
+  launch_at_login: boolean;
+  tray_enabled: boolean;
+  run_history_limit: number;
+  readiness_timeout_ms: number;
 };
 
 const DEFAULTS: SettingsMap = {
@@ -13,7 +19,13 @@ const DEFAULTS: SettingsMap = {
   kill_grace_ms: 5000,
   auto_update: true,
   theme: 'system',
-  dashboard_refresh_ms: 1000
+  dashboard_refresh_ms: 1000,
+  notify_on_crash: true,
+  notify_on_ready: false,
+  launch_at_login: false,
+  tray_enabled: true,
+  run_history_limit: 500,
+  readiness_timeout_ms: 60_000
 };
 
 export class Settings {
@@ -27,7 +39,13 @@ export class Settings {
       kill_grace_ms: parseNumber(map.get('kill_grace_ms'), DEFAULTS.kill_grace_ms),
       auto_update: parseBool(map.get('auto_update'), DEFAULTS.auto_update),
       theme: parseTheme(map.get('theme')),
-      dashboard_refresh_ms: parseNumber(map.get('dashboard_refresh_ms'), DEFAULTS.dashboard_refresh_ms)
+      dashboard_refresh_ms: parseNumber(map.get('dashboard_refresh_ms'), DEFAULTS.dashboard_refresh_ms),
+      notify_on_crash: parseBool(map.get('notify_on_crash'), DEFAULTS.notify_on_crash),
+      notify_on_ready: parseBool(map.get('notify_on_ready'), DEFAULTS.notify_on_ready),
+      launch_at_login: parseBool(map.get('launch_at_login'), DEFAULTS.launch_at_login),
+      tray_enabled: parseBool(map.get('tray_enabled'), DEFAULTS.tray_enabled),
+      run_history_limit: parseNumber(map.get('run_history_limit'), DEFAULTS.run_history_limit),
+      readiness_timeout_ms: parseNumber(map.get('readiness_timeout_ms'), DEFAULTS.readiness_timeout_ms)
     };
   }
 
@@ -51,7 +69,13 @@ export class Settings {
       'kill_grace_ms',
       'auto_update',
       'theme',
-      'dashboard_refresh_ms'
+      'dashboard_refresh_ms',
+      'notify_on_crash',
+      'notify_on_ready',
+      'launch_at_login',
+      'tray_enabled',
+      'run_history_limit',
+      'readiness_timeout_ms'
     ]);
     const tx = db().transaction(() => {
       for (const [k, v] of Object.entries(patch)) {
diff --git a/src/main/services/StatsMonitor.ts b/src/main/services/StatsMonitor.ts
index 6054332..3a41ac1 100644
--- a/src/main/services/StatsMonitor.ts
+++ b/src/main/services/StatsMonitor.ts
@@ -23,6 +23,7 @@ export class StatsMonitor extends EventEmitter {
   private readonly tracked = new Map<TaskId, Tracked>();
   private timer: NodeJS.Timeout | null = null;
   private intervalMs: number;
+  private inFlight = false;
 
   constructor(intervalMs = 1000) {
     super();
@@ -60,27 +61,45 @@ export class StatsMonitor extends EventEmitter {
   }
 
   private async tick(): Promise<void> {
-    if (this.tracked.size === 0) return;
-    const entries = [...this.tracked.values()];
-    const results = await Promise.all(
-      entries.map(async (t) => {
-        try {
-          const stats = await pidusage(t.pid);
-          return { t, cpu: stats.cpu, memMB: Math.round(stats.memory / (1024 * 1024)) };
-        } catch {
-          // Process exited between ticks — drop silently; the runner's onExit will untrack.
-          return null;
-        }
-      })
-    );
-    for (const r of results) {
-      if (!r) continue;
-      this.emit('stats', {
-        taskId: r.t.taskId,
-        appId: r.t.appId,
-        cpu: Math.max(0, r.cpu),
-        memMB: r.memMB
-      } satisfies StatsTick);
+    if (this.tracked.size === 0 || this.inFlight) return;
+    this.inFlight = true;
+    try {
+      const entries = [...this.tracked.values()];
+      const pids = entries.map((e) => e.pid);
+
+      // ONE `ps` for all tracked pids instead of one fork per task per tick (pidusage
+      // comma-joins an array into a single ps call). With 10 running tasks this turns 10
+      // fork+exec per second into 1 (IMPROVEMENT-PLAN 9.2).
+      let byPid: Record<number, { cpu: number; memory: number }> = {};
+      try {
+        byPid = (await pidusage(pids)) as Record<number, { cpu: number; memory: number }>;
+      } catch {
+        // pidusage rejects the WHOLE batch if any pid vanished mid-tick - fall back to
+        // per-pid so the survivors still report (the runner's onExit untracks the dead one).
+        await Promise.all(
+          entries.map(async (e) => {
+            try {
+              const s = await pidusage(e.pid);
+              byPid[e.pid] = { cpu: s.cpu, memory: s.memory };
+            } catch {
+              // process gone - skip
+            }
+          })
+        );
+      }
+
+      for (const e of entries) {
+        const s = byPid[e.pid];
+        if (!s) continue;
+        this.emit('stats', {
+          taskId: e.taskId,
+          appId: e.appId,
+          cpu: Math.max(0, s.cpu),
+          memMB: Math.round(s.memory / (1024 * 1024))
+        } satisfies StatsTick);
+      }
+    } finally {
+      this.inFlight = false;
     }
   }
 
diff --git a/src/main/services/TaskRegistry.ts b/src/main/services/TaskRegistry.ts
index 736f2cd..645474a 100644
--- a/src/main/services/TaskRegistry.ts
+++ b/src/main/services/TaskRegistry.ts
@@ -41,6 +41,26 @@ export class TaskRegistry {
     return rows.map(rowToTask);
   }
 
+  /**
+   * Load every task across every app in a single query, grouped by app id.
+   * The boot path needs tasks for all apps at once; doing this as one ordered
+   * scan replaces an N+1 of per-app `list()` calls. Rows arrive pre-sorted by
+   * (app_id, position, created_at) so each group is already in position order.
+   */
+  listAll(): Record<string, Task[]> {
+    const rows = db()
+      .prepare<unknown[], TaskRow>(
+        'SELECT * FROM tasks ORDER BY app_id ASC, position ASC, created_at ASC'
+      )
+      .all();
+    const grouped: Record<string, Task[]> = {};
+    for (const row of rows) {
+      const task = rowToTask(row);
+      (grouped[task.appId] ??= []).push(task);
+    }
+    return grouped;
+  }
+
   get(id: TaskId): Task | null {
     const row = db()
       .prepare<unknown[], TaskRow>('SELECT * FROM tasks WHERE id = ?')
@@ -112,7 +132,7 @@ export class TaskRegistry {
   update(id: TaskId, patch: Partial<Task>): Task {
     const current = this.get(id);
     if (!current) throw new Error(`Task not found: ${id}`);
-    // Phase 7: tasks.env_overrides is frozen — the source of truth is now
+    // Phase 7: tasks.env_overrides is frozen - the source of truth is now
     // env_vars rows with task_id set. Ignore any patch.envOverrides so the
     // legacy JSON column can never silently drift from the rows.
     const next: Task = {
@@ -171,7 +191,7 @@ export class TaskRegistry {
     const dependents = siblings.filter((t) => t.dependsOn.includes(id));
     if (dependents.length > 0) {
       throw new Error(
-        `Can't remove "${task.name}" — these tasks depend on it: ${dependents.map((d) => d.name).join(', ')}`
+        `Can't remove "${task.name}" - these tasks depend on it: ${dependents.map((d) => d.name).join(', ')}`
       );
     }
     db().prepare('DELETE FROM tasks WHERE id = ?').run(id);
@@ -230,6 +250,23 @@ export class TaskRegistry {
   }
 }
 
+/**
+ * Parse a JSON column defensively. A single hand-edited or corrupt cell must not
+ * take down the whole tasks:list query (IMPROVEMENT-PLAN 8.3): a bad row should
+ * degrade to its fallback rather than throw and blank out every task in the app.
+ * `null` is treated as "absent" and returns the fallback without warning, since
+ * NULL is a legitimate empty state for these columns.
+ */
+function safeJson<T>(raw: string | null, fallback: T): T {
+  if (raw == null) return fallback;
+  try {
+    return JSON.parse(raw) as T;
+  } catch (err) {
+    console.warn('TaskRegistry: ignoring corrupt JSON column, using fallback', err);
+    return fallback;
+  }
+}
+
 function rowToTask(r: TaskRow): Task {
   return {
     id: r.id as TaskId,
@@ -241,14 +278,15 @@ function rowToTask(r: TaskRow): Task {
     customCommand: r.custom_command,
     workingDirOverride: r.working_dir_override,
     packageManagerOverride: (r.package_manager_override as PackageManager | null) ?? null,
+    // Only parse when the column is non-null so the absent case stays null (no warning).
     nodeVersionPrefOverride: r.node_version_pref_override
-      ? (JSON.parse(r.node_version_pref_override) as NodeVersionPref)
+      ? safeJson<NodeVersionPref | null>(r.node_version_pref_override, null)
       : null,
-    dependsOn: (JSON.parse(r.depends_on) as string[]).map((s) => s as TaskId),
-    readiness: JSON.parse(r.readiness) as ReadinessSignal,
+    dependsOn: safeJson<string[]>(r.depends_on, []).map((s) => s as TaskId),
+    readiness: safeJson<ReadinessSignal>(r.readiness, { kind: 'none' }),
     oneShot: !!r.one_shot,
     enabled: !!r.enabled,
-    envOverrides: JSON.parse(r.env_overrides) as Record<string, string>,
+    envOverrides: safeJson<Record<string, string>>(r.env_overrides, {}),
     createdAt: r.created_at,
     updatedAt: r.updated_at
   };
diff --git a/src/main/services/TaskRunner.ts b/src/main/services/TaskRunner.ts
index 165d014..2b2518f 100644
--- a/src/main/services/TaskRunner.ts
+++ b/src/main/services/TaskRunner.ts
@@ -77,6 +77,10 @@ export type TaskStatusEvent = {
  */
 export class TaskRunner extends EventEmitter {
   private readonly tracked = new Map<TaskId, Tracked>();
+  // Serialises concurrent start() calls for the SAME task to a single spawn. Without this,
+  // `proc:start` + `task:start` (or restart-watcher + a user click) race between the
+  // isRunning check and tracked.set and both spawn a PTY (IMPROVEMENT-PLAN 5.3).
+  private readonly pending = new Map<TaskId, Promise<{ snapshot: RunningTask; awaitReady: Promise<boolean> }>>();
 
   constructor(
     private readonly registry: AppRegistry,
@@ -100,7 +104,7 @@ export class TaskRunner extends EventEmitter {
     return this.logs.read(taskId);
   }
 
-  /** Last N lines from the buffer — used by the crash-pin UI. */
+  /** Last N lines from the buffer - used by the crash-pin UI. */
   tailBuffer(taskId: TaskId, maxLines = 200): string {
     return this.logs.tail(taskId, maxLines);
   }
@@ -123,6 +127,12 @@ export class TaskRunner extends EventEmitter {
     return [...this.tracked.values()].map(toRunningTask);
   }
 
+  /** Task ids whose start() is still mid-spawn (not yet tracked). The quit path must count
+      and stop these too, or a spawn completing after teardown leaves an orphan process. */
+  pendingStartIds(): TaskId[] {
+    return [...this.pending.keys()];
+  }
+
   get(taskId: TaskId): RunningTask | null {
     const t = this.tracked.get(taskId);
     return t ? toRunningTask(t) : null;
@@ -141,13 +151,48 @@ export class TaskRunner extends EventEmitter {
    * Start one task. Returns a snapshot of the running state.
    * `awaitReady` returns a promise that resolves to true if the task hits its
    * readiness signal, false if it exited first.
+   *
+   * Concurrency-safe: if the task is already live (starting/running/exiting) the existing
+   * run is returned; if another start() for the same task is mid-flight, its promise is
+   * shared rather than spawning a second PTY.
    */
-  async start(task: Task): Promise<{ snapshot: RunningTask; awaitReady: Promise<boolean> }> {
-    if (this.isRunning(task.id)) {
-      const t = this.tracked.get(task.id)!;
-      return { snapshot: toRunningTask(t), awaitReady: t.readinessWatcher?.ready ?? Promise.resolve(t.ready) };
+  start(task: Task): Promise<{ snapshot: RunningTask; awaitReady: Promise<boolean> }> {
+    const cur = this.tracked.get(task.id);
+    if (cur && (cur.state === 'starting' || cur.state === 'running')) {
+      return Promise.resolve({
+        snapshot: toRunningTask(cur),
+        awaitReady: cur.readinessWatcher?.ready ?? Promise.resolve(cur.ready)
+      });
     }
+    const inflight = this.pending.get(task.id);
+    if (inflight) return inflight;
+    // 'exiting' = a stop's kill-grace window. Returning the DYING run here would make the
+    // caller's start a no-op (its awaitReady may even already be true), so the user's fresh
+    // Start would silently never restart the task. Wait for the teardown to finish, then
+    // spawn a new run - deduped through `pending` like any other start.
+    const p = (
+      cur && cur.state === 'exiting'
+        ? this.waitForTeardown(task.id, cur).then(() => this.doStart(task))
+        : this.doStart(task)
+    ).finally(() => this.pending.delete(task.id));
+    this.pending.set(task.id, p);
+    return p;
+  }
+
+  /** Resolve once the given run is gone from tracking (or replaced). Bounded wait. */
+  private async waitForTeardown(taskId: TaskId, run: Tracked): Promise<void> {
+    const grace = this.settings?.get('kill_grace_ms') ?? DEFAULT_KILL_GRACE_MS;
+    const deadline = Date.now() + grace + 5000;
+    while (Date.now() < deadline) {
+      const cur = this.tracked.get(taskId);
+      if (cur !== run || cur.state === 'exited' || cur.state === 'crashed') return;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+  }
 
+  private async doStart(
+    task: Task
+  ): Promise<{ snapshot: RunningTask; awaitReady: Promise<boolean> }> {
     const app = this.registry.get(task.appId);
     if (!app) throw new Error(`Unknown app for task: ${task.appId}`);
 
@@ -163,6 +208,7 @@ export class TaskRunner extends EventEmitter {
       customCommand: task.customCommand
     });
 
+    // env.build is BEFORE spawn - a failure here throws with no live process to orphan.
     const env = await this.env.build({ app, task, nodeBinDir: node.binDir, cwd });
 
     const pty = ptySpawn(file, args, {
@@ -173,16 +219,22 @@ export class TaskRunner extends EventEmitter {
       env
     });
 
-    // Open a run_history row.
-    const runId = this.history.start({
-      appId: app.id,
-      taskId: task.id,
-      taskName: task.name,
-      script: task.script,
-      customCommand: task.customCommand,
-      nodeVersion: node.version,
-      packageManager: pm
-    });
+    // Open a run_history row. NON-FATAL: a DB hiccup here must not leave a spawned PTY with
+    // no tracked entry / handlers (an unstoppable orphan) - the rest tolerates runId === null.
+    let runId: string | null = null;
+    try {
+      runId = this.history.start({
+        appId: app.id,
+        taskId: task.id,
+        taskName: task.name,
+        script: task.script,
+        customCommand: task.customCommand,
+        nodeVersion: node.version,
+        packageManager: pm
+      });
+    } catch (e) {
+      console.warn('[taskrunner] run_history.start failed; continuing without a history row', e);
+    }
 
     const tracked: Tracked = {
       pty,
@@ -216,7 +268,10 @@ export class TaskRunner extends EventEmitter {
     this.ports.track(task.id, app.id, pty.pid);
 
     // Bridge PTY → durable log buffer + coalesced IPC + readiness + port hint listeners.
+    // Identity-guarded: a stale PTY (from a superseded run of the same task) must not feed
+    // its output into the successor run.
     pty.onData((chunk: string) => {
+      if (this.tracked.get(task.id) !== tracked) return;
       this.logs.append(task.id, chunk);
       this.ports.observeChunk(task.id, chunk);
       for (const l of tracked.logListeners) {
@@ -230,64 +285,62 @@ export class TaskRunner extends EventEmitter {
     });
 
     pty.onExit(({ exitCode, signal }) => {
-      const t = this.tracked.get(task.id);
-      if (!t) return;
-      // Flush any pending coalesced log chunk before status flips.
-      this.flushLogEmit(t);
-      t.exitCode = exitCode;
-      t.exitSignal = signal ? String(signal) : null;
-      t.state = t.userKilled
-        ? 'exited'
-        : exitCode === 0
-        ? 'exited'
-        : 'crashed';
-
-      // Close the run_history row.
-      if (t.runId) {
-        this.history.finish(t.runId, {
-          exitCode: t.exitCode,
-          exitSignal: t.exitSignal,
-          wasKilledByUser: t.userKilled
+      // Operate on THIS closure's own Tracked instance, never look it up by id - otherwise a
+      // stale PTY's exit would mutate the successor run (mark it exited, finish its history,
+      // untrack its live stats). Only touch shared/monitoring state if we're still current.
+      const isCurrent = this.tracked.get(task.id) === tracked;
+      this.flushLogEmit(tracked);
+      tracked.exitCode = exitCode;
+      tracked.exitSignal = signal ? String(signal) : null;
+      tracked.state = tracked.userKilled ? 'exited' : exitCode === 0 ? 'exited' : 'crashed';
+
+      if (tracked.runId) {
+        this.history.finish(tracked.runId, {
+          exitCode: tracked.exitCode,
+          exitSignal: tracked.exitSignal,
+          wasKilledByUser: tracked.userKilled
         });
+        tracked.runId = null; // guard against a later force-finalize double-finishing
       }
 
-      for (const l of t.statusListeners) {
+      for (const l of tracked.statusListeners) {
         try {
-          l(t.state, t.exitCode);
+          l(tracked.state, tracked.exitCode);
         } catch {
           // ignore
         }
       }
-      this.emitStatus(t);
-      // Stop monitoring this task immediately.
+      tracked.readinessWatcher?.dispose();
+
+      if (!isCurrent) return; // a newer run replaced this task - leave its state alone
+      this.emitStatus(tracked);
       this.stats.untrack(task.id);
       this.ports.untrack(task.id);
-      // Keep around briefly so the renderer can read final state.
+      this.logs.markExited(task.id); // buffer becomes evictable + self-frees after a delay
+
+      // Keep around briefly so the renderer can read final state, then delete (identity-checked).
       setTimeout(() => {
-        const cur = this.tracked.get(task.id);
-        if (cur && (cur.state === 'exited' || cur.state === 'crashed')) {
-          cur.readinessWatcher?.dispose();
+        if (this.tracked.get(task.id) === tracked) {
           this.tracked.delete(task.id);
         }
       }, 1500);
     });
 
     // Flip to 'running' next tick so the UI sees the transition.
-    // Guarded: if the process exited synchronously (instant crash), onExit already
-    // set state to exited/crashed — don't overwrite.
+    // Guarded: if the process exited synchronously (instant crash), onExit already set
+    // state to exited/crashed - don't overwrite; and only act if still the current run.
     setTimeout(() => {
-      const t = this.tracked.get(task.id);
-      if (!t) return;
-      if (t.state !== 'starting') return;
-      t.state = 'running';
-      for (const l of t.statusListeners) {
+      if (this.tracked.get(task.id) !== tracked) return;
+      if (tracked.state !== 'starting') return;
+      tracked.state = 'running';
+      for (const l of tracked.statusListeners) {
         try {
-          l(t.state, null);
+          l(tracked.state, null);
         } catch {
           // ignore
         }
       }
-      this.emitStatus(t);
+      this.emitStatus(tracked);
     }, 0);
 
     // Set up the readiness watcher.
@@ -306,17 +359,69 @@ export class TaskRunner extends EventEmitter {
     tracked.readinessWatcher = watcher;
 
     void watcher.ready.then((ok) => {
-      const t = this.tracked.get(task.id);
-      if (!t) return;
-      t.ready = ok;
-      this.emitStatus(t);
+      if (this.tracked.get(task.id) !== tracked) return;
+      tracked.ready = ok;
+      this.emitStatus(tracked);
     });
 
+    // Readiness timeout: without a deadline a port that never opens or a regex that never
+    // matches leaves startApp blocked forever and the UI stuck on 'starting'
+    // (IMPROVEMENT-PLAN 7.2). On timeout, if the task is still alive we stop blocking and
+    // treat it as ready (so the spinner clears) rather than killing a healthy server.
+    //
+    // Deliberately NOT applied to 'exit' readiness (one-shots: migrations/builds - "ready"
+    // means the process FINISHED; forcing ready at 60s would start dependents before the
+    // prerequisite completed). For 'delay', honour the user's explicit wait even past the
+    // timeout (plus slack) rather than cutting it short.
+    const baseTimeout = this.settings?.get('readiness_timeout_ms') ?? 60_000;
+    const timeoutMs =
+      task.readiness.kind === 'exit'
+        ? 0
+        : task.readiness.kind === 'delay'
+          ? Math.max(baseTimeout, task.readiness.ms + 5000)
+          : baseTimeout;
+    const awaitReady: Promise<boolean> =
+      timeoutMs > 0
+        ? new Promise<boolean>((resolve) => {
+            let settled = false;
+            const finish = (v: boolean): void => {
+              if (settled) return;
+              settled = true;
+              clearTimeout(to);
+              resolve(v);
+            };
+            const to = setTimeout(() => {
+              if (this.tracked.get(task.id) === tracked && tracked.state === 'running') {
+                console.warn(
+                  `[taskrunner] readiness timed out for "${task.name}" after ${timeoutMs}ms; treating as ready`
+                );
+                tracked.ready = true;
+                this.emitStatus(tracked);
+                finish(true);
+              } else {
+                finish(false);
+              }
+            }, timeoutMs);
+            void watcher.ready.then(finish);
+          })
+        : watcher.ready;
+
     this.emitStatus(tracked);
-    return { snapshot: toRunningTask(tracked), awaitReady: watcher.ready };
+    return { snapshot: toRunningTask(tracked), awaitReady };
   }
 
   async stop(taskId: TaskId): Promise<void> {
+    // A start() may still be mid-flight (awaiting env build, before tracked.set). Without
+    // waiting for it, this stop would silently no-op and the process would spawn anyway - 
+    // the user's click lost. Await the pending spawn, then stop the now-tracked run.
+    const inflight = this.pending.get(taskId);
+    if (inflight) {
+      try {
+        await inflight;
+      } catch {
+        // the start itself failed - nothing to stop
+      }
+    }
     const t = this.tracked.get(taskId);
     if (!t) return;
     if (t.state !== 'running' && t.state !== 'starting') return;
@@ -325,31 +430,82 @@ export class TaskRunner extends EventEmitter {
     t.state = 'exiting';
     this.emitStatus(t);
 
+    const grace = this.settings?.get('kill_grace_ms') ?? DEFAULT_KILL_GRACE_MS;
+
+    // Graceful: signal the WHOLE process tree, not just the PTY child. For `npm run dev`
+    // the real server is a grandchild, and a non-interactive `$SHELL -l -c` wrapper does not
+    // forward SIGTERM - so signalling only the pty child usually skips graceful shutdown
+    // (IMPROVEMENT-PLAN 7.1).
+    //
+    // All checks below are identity-aware (compare against THIS run's Tracked instance, not a
+    // by-id lookup): if a new run of the same task spawns mid-wait, "the old instance is gone
+    // from the map" means this stop is complete - it must never burn grace against, SIGKILL,
+    // or force-finalize the successor's healthy process.
+    this.signalTree(t.pid, 'SIGTERM');
+    await this.waitForExit(taskId, t, grace);
+    if (this.isRunExited(taskId, t)) return;
+
+    // Escalate: SIGKILL the tree, then wait a bounded window for the exit event to actually
+    // arrive before giving up - so 'exiting' is never a permanent dead-end.
+    this.signalTree(t.pid, 'SIGKILL');
+    await this.waitForExit(taskId, t, 2000);
+    if (this.isRunExited(taskId, t)) return;
+
+    // The OS never reported the exit - force the tracked entry to a terminal state so the UI
+    // and orchestrator don't hang on a zombie 'exiting'.
+    this.forceFinalize(taskId, t);
+  }
+
+  private signalTree(pid: number, signal: 'SIGTERM' | 'SIGKILL'): void {
     try {
-      t.pty.kill('SIGTERM');
+      treeKill(pid, signal, () => {});
     } catch {
-      // ignore
+      // process may already be gone
     }
+  }
 
-    const grace = this.settings?.get('kill_grace_ms') ?? DEFAULT_KILL_GRACE_MS;
+  /** True when THIS run is finished - exited/crashed, or no longer the tracked entry. */
+  private isRunExited(taskId: TaskId, run: Tracked): boolean {
+    const cur = this.tracked.get(taskId);
+    if (cur !== run) return true; // replaced or torn down - the old run is gone
+    return cur.state === 'exited' || cur.state === 'crashed';
+  }
 
+  private async waitForExit(taskId: TaskId, run: Tracked, timeoutMs: number): Promise<void> {
     await new Promise<void>((resolve) => {
-      const escalate = setTimeout(() => {
-        treeKill(t.pid, 'SIGKILL', () => {});
-        resolve();
-      }, grace);
-
-      const tickUntilExit = setInterval(() => {
-        const cur = this.tracked.get(taskId);
-        if (!cur || cur.state === 'exited' || cur.state === 'crashed') {
-          clearTimeout(escalate);
-          clearInterval(tickUntilExit);
+      const deadline = Date.now() + timeoutMs;
+      const tick = setInterval(() => {
+        if (this.isRunExited(taskId, run) || Date.now() >= deadline) {
+          clearInterval(tick);
           resolve();
         }
       }, 100);
     });
   }
 
+  /** Last-resort: SIGKILL+grace elapsed and no exit event arrived. Synthesise the teardown. */
+  private forceFinalize(taskId: TaskId, run: Tracked): void {
+    if (this.tracked.get(taskId) !== run) return; // a successor run owns the slot now
+    if (run.state === 'exited' || run.state === 'crashed') return;
+    // Mirror the normal onExit teardown so nothing leaks from this synthetic path.
+    this.flushLogEmit(run);
+    run.state = 'exited';
+    if (run.runId) {
+      this.history.finish(run.runId, {
+        exitCode: run.exitCode,
+        exitSignal: run.exitSignal ?? 'SIGKILL',
+        wasKilledByUser: true
+      });
+      run.runId = null;
+    }
+    run.readinessWatcher?.dispose();
+    this.emitStatus(run);
+    this.stats.untrack(taskId);
+    this.ports.untrack(taskId);
+    this.logs.markExited(taskId);
+    this.tracked.delete(taskId);
+  }
+
   private queueLogEmit(t: Tracked, chunk: string): void {
     t.batchedChunks.push(chunk);
     t.batchedBytes += chunk.length;
diff --git a/src/main/services/TrayController.ts b/src/main/services/TrayController.ts
new file mode 100644
index 0000000..3efbe95
--- /dev/null
+++ b/src/main/services/TrayController.ts
@@ -0,0 +1,142 @@
+import { Tray, Menu, nativeImage, type MenuItemConstructorOptions } from 'electron';
+import type { AppId, ProcessState } from '@shared/types';
+
+export interface TrayApp {
+  id: AppId;
+  name: string;
+  state: ProcessState;
+  ports: number[];
+}
+
+export interface TrayCallbacks {
+  listApps: () => TrayApp[];
+  start: (id: AppId) => void;
+  stop: (id: AppId) => void;
+  stopAll: () => void;
+  open: () => void;
+  quit: () => void;
+}
+
+function isLive(s: ProcessState): boolean {
+  return s === 'running' || s === 'starting' || s === 'exiting';
+}
+
+/**
+ * Menubar (Tray) presence (IMPROVEMENT-PLAN 14.1). A supervisor for long-running background
+ * processes is exactly the category that lives in the menubar - the app already keeps servers
+ * running with its window closed, but had zero ambient surface to see/control them. The tray
+ * icon reflects aggregate state and its menu lists every app with Start/Stop + detected ports.
+ * Pure main-process: all state flows through the callbacks; no renderer dependency.
+ */
+export class TrayController {
+  private tray: Tray | null = null;
+
+  constructor(private readonly cb: TrayCallbacks) {}
+
+  enable(): void {
+    if (this.tray) return;
+    try {
+      this.tray = new Tray(this.makeIcon('idle'));
+      this.tray.setToolTip('DevHarbor');
+      this.refresh();
+    } catch {
+      // Tray creation can fail in a display-less environment - never let it block boot.
+      this.tray = null;
+    }
+  }
+
+  disable(): void {
+    this.tray?.destroy();
+    this.tray = null;
+  }
+
+  get enabled(): boolean {
+    return this.tray !== null;
+  }
+
+  /** Rebuild the menu + icon from current state. Call on any task status change. */
+  refresh(): void {
+    if (!this.tray) return;
+    const apps = this.cb.listApps();
+    const runningCount = apps.filter((a) => isLive(a.state)).length;
+    const anyCrashed = apps.some((a) => a.state === 'crashed');
+
+    this.tray.setImage(this.makeIcon(anyCrashed ? 'crashed' : runningCount > 0 ? 'running' : 'idle'));
+    this.tray.setToolTip(
+      runningCount > 0 ? `DevHarbor - ${runningCount} running` : 'DevHarbor - idle'
+    );
+
+    const appItems: MenuItemConstructorOptions[] = apps
+      .slice()
+      .sort((a, b) => a.name.localeCompare(b.name))
+      .map((a) => {
+        const live = isLive(a.state);
+        const portLabel = a.ports.length ? `  :${a.ports.join(' :')}` : '';
+        const dot = a.state === 'crashed' ? '⊘' : live ? '●' : '○';
+        return {
+          label: `${dot} ${a.name}${portLabel}`,
+          submenu: [
+            { label: live ? 'Stop' : 'Start', click: () => (live ? this.cb.stop(a.id) : this.cb.start(a.id)) }
+          ]
+        } satisfies MenuItemConstructorOptions;
+      });
+
+    const template: MenuItemConstructorOptions[] = [
+      { label: 'Open DevHarbor', click: () => this.cb.open() },
+      { type: 'separator' },
+      ...(appItems.length ? appItems : [{ label: 'No apps registered', enabled: false }]),
+      { type: 'separator' },
+      { label: 'Stop all', enabled: runningCount > 0, click: () => this.cb.stopAll() },
+      { type: 'separator' },
+      { label: 'Quit DevHarbor', click: () => this.cb.quit() }
+    ];
+    this.tray.setContextMenu(Menu.buildFromTemplate(template));
+  }
+
+  /**
+   * Render a tiny template-image dot so the menubar icon tints to the macOS theme. A filled
+   * dot for idle, a ringed dot for running, an X-ish mark for crashed - distinguishable
+   * without colour (the menubar is monochrome anyway).
+   */
+  private makeIcon(kind: 'idle' | 'running' | 'crashed'): Electron.NativeImage {
+    const size = 36; // rendered at 2x for crisp retina menubars (18pt logical)
+    const canvas = drawDot(size, kind);
+    const img = nativeImage.createFromBuffer(canvas, { width: size, height: size, scaleFactor: 2 });
+    img.setTemplateImage(true);
+    return img;
+  }
+}
+
+/**
+ * Minimal RGBA bitmap of a centered glyph. Avoids shipping icon assets for the tray: a solid
+ * disc (idle/running) or a ring with a gap (crashed). Template image → macOS recolours it.
+ */
+function drawDot(size: number, kind: 'idle' | 'running' | 'crashed'): Buffer {
+  const buf = Buffer.alloc(size * size * 4, 0);
+  const cx = (size - 1) / 2;
+  const cy = (size - 1) / 2;
+  const rOuter = size * 0.34;
+  const rInner = size * 0.18;
+  for (let y = 0; y < size; y++) {
+    for (let x = 0; x < size; x++) {
+      const d = Math.hypot(x - cx, y - cy);
+      let on = false;
+      if (kind === 'running') {
+        on = d <= rOuter && d >= rInner; // ring
+      } else if (kind === 'crashed') {
+        // X mark
+        on = (Math.abs(x - y) <= 1 || Math.abs(x + y - (size - 1)) <= 1) && d <= rOuter;
+      } else {
+        on = d <= rOuter; // solid disc
+      }
+      if (on) {
+        const i = (y * size + x) * 4;
+        buf[i] = 0;
+        buf[i + 1] = 0;
+        buf[i + 2] = 0;
+        buf[i + 3] = 255;
+      }
+    }
+  }
+  return buf;
+}
diff --git a/src/main/services/Updater.ts b/src/main/services/Updater.ts
index f74acb7..f954be2 100644
--- a/src/main/services/Updater.ts
+++ b/src/main/services/Updater.ts
@@ -1,23 +1,35 @@
 import { BrowserWindow } from 'electron';
-import { autoUpdater } from 'electron-updater';
+import { autoUpdater, type UpdateInfo } from 'electron-updater';
+
+/** How often to re-poll the release feed after the initial launch check. */
+const RECHECK_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6 hours
 
 /**
- * Auto-update plumbing.
+ * Auto-update plumbing - ACTIVE in production.
+ *
+ * The packaged app ships an `app-update.yml` pointing at the GitHub Releases feed, so
+ * `start()` actually polls for updates: once on launch, then every 6 hours. We forward
+ * the full lifecycle to the renderer over IPC (`update:available` / `update:progress` /
+ * `update:ready` / `update:notAvailable` / `update:error`) so the UI can surface
+ * progress, release notes, and failures instead of swallowing them.
  *
- * Phase 4: wired but NOT activated — no release feed is configured yet (that's Phase 5
- * packaging + signing). We listen for events and forward an `update:ready` IPC payload
- * to the renderer when the time comes; for now `start()` is a no-op unless the host
- * environment has a feed URL set.
+ * In dev (or any build without a feed) `checkForUpdates()` rejects; we swallow that
+ * rejection so the absence of a feed is a no-op rather than a thrown error.
  */
 export class Updater {
   private started = false;
+  /** Handle for the periodic re-check timer so start() can't stack duplicate intervals. */
+  private recheckTimer: ReturnType<typeof setInterval> | null = null;
 
   constructor(private readonly getWin: () => BrowserWindow | null) {
     autoUpdater.autoDownload = true;
     autoUpdater.autoInstallOnAppQuit = true;
 
     autoUpdater.on('update-available', (info) => {
-      this.getWin()?.webContents.send('update:available', { version: info.version });
+      this.getWin()?.webContents.send('update:available', {
+        version: info.version,
+        releaseNotes: Updater.normalizeReleaseNotes(info)
+      });
     });
     autoUpdater.on('download-progress', (p) => {
       this.getWin()?.webContents.send('update:progress', {
@@ -28,24 +40,86 @@ export class Updater {
       });
     });
     autoUpdater.on('update-downloaded', (info) => {
-      this.getWin()?.webContents.send('update:ready', { version: info.version });
+      this.getWin()?.webContents.send('update:ready', {
+        version: info.version,
+        releaseNotes: Updater.normalizeReleaseNotes(info)
+      });
+    });
+    autoUpdater.on('update-not-available', (info) => {
+      // Lets a manual "Check for Updates…" confirm the app is current instead of going silent.
+      this.getWin()?.webContents.send('update:notAvailable', { version: info.version });
     });
     autoUpdater.on('error', (err) => {
+      // Keep the local log, but also surface the failure so the UI doesn't fail silently.
       console.warn('[updater]', err.message);
+      this.getWin()?.webContents.send('update:error', { message: err.message });
     });
   }
 
-  /** Check for updates if a feed is configured. Safe to call repeatedly. */
+  /**
+   * Begin update polling: an immediate check plus a 6-hour repeating check so a
+   * long-running session still picks up releases. Guarded so it only arms once;
+   * use {@link checkNow} for explicit user-triggered checks.
+   */
   start(): void {
     if (this.started) return;
     this.started = true;
-    // electron-updater throws if no feed (or no app-update.yml) is configured — silence it.
+    // Re-assert the download/install flags - stop() clears them when auto-update is
+    // toggled off, and the user may have toggled it back on in the same session.
+    autoUpdater.autoDownload = true;
+    autoUpdater.autoInstallOnAppQuit = true;
+    // electron-updater rejects if no feed (or no app-update.yml) is configured - silence it;
+    // any real failure is reported via the 'error' handler above.
     autoUpdater.checkForUpdates().catch(() => {
-      // No feed configured yet (Phase 5). That's fine in dev/v0.1.x.
+      // No feed configured (dev build). That's fine.
     });
+    this.recheckTimer = setInterval(() => {
+      autoUpdater.checkForUpdates().catch(() => {});
+    }, RECHECK_INTERVAL_MS);
+  }
+
+  /**
+   * Manual "Check for Updates…" trigger. Unlike {@link start} it has no started-once
+   * guard, so the user can re-check on demand; errors surface via the 'error' handler.
+   */
+  checkNow(): void {
+    autoUpdater.checkForUpdates().catch(() => {});
+  }
+
+  /**
+   * Stop background polling - called when the user turns auto-update OFF in Settings.
+   * Without this, disabling the setting only took effect after a relaunch: the 6-hour
+   * interval kept checking and a downloaded update would still install on quit.
+   */
+  stop(): void {
+    if (this.recheckTimer) {
+      clearInterval(this.recheckTimer);
+      this.recheckTimer = null;
+    }
+    this.started = false;
+    autoUpdater.autoDownload = false;
+    autoUpdater.autoInstallOnAppQuit = false;
   }
 
   quitAndInstall(): void {
     autoUpdater.quitAndInstall(true, true);
   }
+
+  /**
+   * Collapse electron-updater's polymorphic `releaseNotes` (string, array of
+   * `{ note }`, or null/undefined) into a single string for the renderer. Array notes
+   * are joined with newlines; nullish notes become `undefined` so the payload omits them.
+   */
+  private static normalizeReleaseNotes(info: UpdateInfo): string | undefined {
+    const notes = info.releaseNotes;
+    if (typeof notes === 'string') return notes;
+    if (Array.isArray(notes)) {
+      const joined = notes
+        .map((n) => n.note ?? '')
+        .filter((note) => note.length > 0)
+        .join('\n');
+      return joined.length > 0 ? joined : undefined;
+    }
+    return undefined;
+  }
 }
diff --git a/src/main/services/__tests__/AppOrchestrator.e2e.test.ts b/src/main/services/__tests__/AppOrchestrator.e2e.test.ts
index 1db48ae..2716816 100644
--- a/src/main/services/__tests__/AppOrchestrator.e2e.test.ts
+++ b/src/main/services/__tests__/AppOrchestrator.e2e.test.ts
@@ -7,7 +7,7 @@ import type { App, ProcessState, Task } from '@shared/types';
 /**
  * REAL end-to-end check: spawns an actual short-lived process via TaskRunner, runs the true
  * Start → Stop cycle through AppOrchestrator, and records every `proc:status` the renderer
- * WOULD receive — INCLUDING after the ~1.5s post-exit teardown. Only the DB/FS-touching
+ * WOULD receive - INCLUDING after the ~1.5s post-exit teardown. Only the DB/FS-touching
  * collaborators are stubbed; the pty, event wiring, and state derivation are the real code.
  *
  * This is the definitive reproduction for the "app reverts to Idle after stop" report.
@@ -28,6 +28,7 @@ function makeApp(): App {
     customCommand: null,
     workingDir: process.cwd(),
     autoRestartOnChange: false,
+    autoStart: false,
     watchGlobs: [],
     portHint: null,
     tags: [],
@@ -72,7 +73,7 @@ function makeRunner(): TaskRunner {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const nodes: any = { resolve: () => ({ binDir: '', version: 'system', source: 'system' }) };
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const logs: any = { append: () => {}, read: () => '', tail: () => '', clear: () => {} };
+  const logs: any = { append: () => {}, read: () => '', tail: () => '', clear: () => {}, markExited: () => {} };
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const history: any = { start: () => 'run1', finish: () => {} };
   class FakeMon extends EventEmitter {
@@ -96,7 +97,7 @@ function makeRunner(): TaskRunner {
 }
 
 describe('AppOrchestrator REAL start→stop (spawns a process)', () => {
-  it('stays "exited" after stop — including past the 1.5s teardown', async () => {
+  it('stays "exited" after stop - including past the 1.5s teardown', async () => {
     const runner = makeRunner();
     const task = makeTask();
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -127,4 +128,20 @@ describe('AppOrchestrator REAL start→stop (spawns a process)', () => {
     // The renderer must never have been told 'idle' at any point.
     expect(log.map((l) => l.state)).not.toContain('idle');
   }, 15000);
+
+  it('two concurrent start()s spawn exactly one PTY (IMPROVEMENT-PLAN 5.3)', async () => {
+    const runner = makeRunner();
+    const task = makeTask();
+
+    // Fire both starts in the same tick - the old code passed the isRunning guard twice (the
+    // check and tracked.set are separated by `await env.build`) and spawned two PTYs.
+    const [a, b] = await Promise.all([runner.start(task), runner.start(task)]);
+
+    expect(runner.list().length).toBe(1); // only one tracked run for the task
+    expect(a.snapshot.pid).toBe(b.snapshot.pid); // both callers observe the same run
+
+    await runner.stop(task.id);
+    await delay(2000); // past the 1500ms post-exit teardown window
+    expect(runner.list().length).toBe(0);
+  }, 15000);
 });
diff --git a/src/main/services/__tests__/AppOrchestrator.state.test.ts b/src/main/services/__tests__/AppOrchestrator.state.test.ts
index a10dc91..480ed7f 100644
--- a/src/main/services/__tests__/AppOrchestrator.state.test.ts
+++ b/src/main/services/__tests__/AppOrchestrator.state.test.ts
@@ -59,7 +59,7 @@ describe('AppOrchestrator app-state on stop', () => {
     runner.emit('status', { taskId: 't1', appId: 'a1', state, ready, exitCode: null });
   };
 
-  it('settles on "exited" after a stop — never reverts to "idle"', () => {
+  it('settles on "exited" after a stop - never reverts to "idle"', () => {
     // Running.
     driveTask('running', true);
     expect(orch.appState('a1' as never)).toBe('running');
diff --git a/src/main/services/__tests__/EnvLayering.test.ts b/src/main/services/__tests__/EnvLayering.test.ts
index 7b5afa0..655be51 100644
--- a/src/main/services/__tests__/EnvLayering.test.ts
+++ b/src/main/services/__tests__/EnvLayering.test.ts
@@ -1,155 +1,149 @@
-import { describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { App, AppId, EnvVar, Task, TaskId } from '@shared/types';
+import { EnvBuilder } from '../EnvBuilder';
 
 /**
- * Mirrors the layering performed inside EnvBuilder.build():
- *   process < global < app < task < .env  (later wins)
+ * Exercises the REAL EnvBuilder.build() (not a pure-function mirror - the old version of this
+ * file re-implemented the layering and silently kept asserting the pre-hardening precedence).
  *
- * This is replicated as a pure function here (same pattern as PortDetector.test.ts) —
- * any change to EnvBuilder's order must also change this test, surfacing the diff.
+ * Shipped precedence (later wins) - IMPROVEMENT-PLAN 6.1:
+ *   sanitized base < computed PATH < project .env files < global < app < task < FORCE_COLOR/TERM
  *
- * See specs/03-features.md F6 and specs/02-data-model.md "Scope layering".
+ * Key inversions vs the old behavior, asserted here:
+ *   - USER-configured env_vars now override project .env files (UI is the source of truth).
+ *   - A project .env can never set process-control keys (PATH, NODE_OPTIONS, DYLD_*, …).
+ *
+ * EnvBuilder's EnvStore/PathProbe deps are type-only imports, so plain stubs work - no
+ * better-sqlite3 needed. The .env files are real files in a temp dir.
  */
-type EnvRow = { key: string; value: string; enabled: boolean };
 
-function layer(
-  base: Record<string, string>,
-  rows: EnvRow[]
-): Record<string, string> {
-  const out: Record<string, string> = { ...base };
-  for (const r of rows) {
-    if (!r.enabled || !r.key) continue;
-    out[r.key] = r.value;
-  }
-  return out;
-}
+const row = (key: string, value: string, enabled = true): EnvVar => ({
+  id: key,
+  appId: null,
+  key,
+  value,
+  enabled,
+  isSecret: false
+});
 
-function buildEffective(args: {
-  processEnv: Record<string, string>;
-  global: EnvRow[];
-  app: EnvRow[];
-  task: EnvRow[];
-  dotEnv: Record<string, string>;
-}): Record<string, string> {
-  let env = { ...args.processEnv };
-  env = layer(env, args.global);
-  env = layer(env, args.app);
-  env = layer(env, args.task);
-  env = { ...env, ...args.dotEnv };
-  return env;
+function makeBuilder(scopes: { global?: EnvVar[]; app?: EnvVar[]; task?: EnvVar[] }): EnvBuilder {
+  const envStore = {
+    getGlobal: () => scopes.global ?? [],
+    getApp: (_id: AppId) => scopes.app ?? [],
+    getTask: (_id: TaskId) => scopes.task ?? []
+  };
+  const pathProbe = { get: async () => '/probe/bin:/usr/bin' };
+  // Type-only constructor params - structural stubs are sufficient.
+  return new EnvBuilder(envStore as never, pathProbe as never);
 }
 
-describe('env layering (3-scope, Phase 7)', () => {
-  it('global value wins when no app or task override', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'DEBUG', value: 'app:*', enabled: true }],
-      app: [],
-      task: [],
-      dotEnv: {}
-    });
-    expect(env.DEBUG).toBe('app:*');
-  });
+const app = { id: 'a1' as AppId } as App;
+const task = { id: 't1' as TaskId } as Task;
 
-  it('app value overrides global', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'DEBUG', value: 'app:*', enabled: true }],
-      app: [{ key: 'DEBUG', value: 'app:auth', enabled: true }],
-      task: [],
-      dotEnv: {}
-    });
-    expect(env.DEBUG).toBe('app:auth');
+let cwd: string;
+beforeAll(() => {
+  cwd = mkdtempSync(join(tmpdir(), 'envlayer-'));
+});
+afterAll(() => {
+  rmSync(cwd, { recursive: true, force: true });
+});
+
+const build = (
+  b: EnvBuilder,
+  opts?: { withTask?: boolean; dir?: string }
+): Promise<Record<string, string>> =>
+  b.build({
+    app,
+    task: opts?.withTask === false ? null : task,
+    nodeBinDir: '/node/bin',
+    cwd: opts?.dir ?? cwd
   });
 
-  it('task value overrides app and global', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'DEBUG', value: 'app:*', enabled: true }],
-      app: [{ key: 'DEBUG', value: 'app:auth', enabled: true }],
-      task: [{ key: 'DEBUG', value: 'app:auth:trace', enabled: true }],
-      dotEnv: {}
-    });
+describe('EnvBuilder layering (real builder, shipped precedence)', () => {
+  it('global < app < task (later scope wins)', async () => {
+    const env = await build(
+      makeBuilder({
+        global: [row('DEBUG', 'app:*')],
+        app: [row('DEBUG', 'app:auth')],
+        task: [row('DEBUG', 'app:auth:trace')]
+      })
+    );
     expect(env.DEBUG).toBe('app:auth:trace');
   });
 
-  it('task can override global directly with no app row in between', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'NODE_ENV', value: 'development', enabled: true }],
-      app: [],
-      task: [{ key: 'NODE_ENV', value: 'test', enabled: true }],
-      dotEnv: {}
-    });
-    expect(env.NODE_ENV).toBe('test');
+  it('user-configured vars override the project .env (UI is source of truth)', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'envlayer-uservs-'));
+    writeFileSync(join(dir, '.env'), 'API_URL=https://dotenv\nONLY_FILE=file-val\n');
+    const env = await build(makeBuilder({ app: [row('API_URL', 'https://user')] }), { dir });
+    rmSync(dir, { recursive: true, force: true });
+    expect(env.API_URL).toBe('https://user'); // OLD behavior was 'https://dotenv'
+    expect(env.ONLY_FILE).toBe('file-val'); // untouched keys still flow through
+  });
+
+  it('.env can never set process-control keys (PATH / NODE_OPTIONS / DYLD_*)', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'envlayer-ctl-'));
+    writeFileSync(
+      join(dir, '.env'),
+      'PATH=/tmp/evil\nNODE_OPTIONS=--require /tmp/evil.js\nDYLD_INSERT_LIBRARIES=/tmp/evil.dylib\nSAFE=ok\n'
+    );
+    const env = await build(makeBuilder({}), { dir });
+    rmSync(dir, { recursive: true, force: true });
+    expect(env.PATH).toBe('/node/bin:/probe/bin:/usr/bin'); // computed PATH intact
+    expect(env.NODE_OPTIONS).toBeUndefined();
+    expect(env.DYLD_INSERT_LIBRARIES).toBeUndefined();
+    expect(env.SAFE).toBe('ok');
+  });
+
+  it('.env variants load in conventional order (.env < .env.development < .env.local)', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'envlayer-variants-'));
+    writeFileSync(join(dir, '.env'), 'A=base\nB=base\nC=base\n');
+    writeFileSync(join(dir, '.env.development'), 'B=dev\nC=dev\n');
+    writeFileSync(join(dir, '.env.local'), 'C=local\n');
+    const env = await build(makeBuilder({}), { dir });
+    rmSync(dir, { recursive: true, force: true });
+    expect(env.A).toBe('base');
+    expect(env.B).toBe('dev');
+    expect(env.C).toBe('local');
   });
 
-  it('disabled rows are skipped at every scope', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'PORT', value: '3000', enabled: true }],
-      app: [{ key: 'PORT', value: '4000', enabled: false }],
-      task: [{ key: 'PORT', value: '5000', enabled: false }],
-      dotEnv: {}
-    });
-    // app + task rows are disabled → global wins
+  it('disabled rows are skipped at every scope', async () => {
+    const env = await build(
+      makeBuilder({
+        global: [row('PORT', '3000')],
+        app: [row('PORT', '4000', false)],
+        task: [row('PORT', '5000', false)]
+      })
+    );
     expect(env.PORT).toBe('3000');
   });
 
-  it('.env from the task cwd is the outermost layer and overrides everything', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: 'API_URL', value: 'https://global', enabled: true }],
-      app: [{ key: 'API_URL', value: 'https://app', enabled: true }],
-      task: [{ key: 'API_URL', value: 'https://task', enabled: true }],
-      dotEnv: { API_URL: 'https://dotenv' }
-    });
-    expect(env.API_URL).toBe('https://dotenv');
+  it('task scope is only applied when a task is passed', async () => {
+    const env = await build(makeBuilder({ task: [row('ONLY_TASK', 'x')] }), { withTask: false });
+    expect(env.ONLY_TASK).toBeUndefined();
   });
 
-  it('inherits process keys that no scope touches', () => {
-    const env = buildEffective({
-      processEnv: { HOME: '/Users/me', PATH: '/usr/bin' },
-      global: [],
-      app: [],
-      task: [],
-      dotEnv: {}
-    });
-    expect(env.HOME).toBe('/Users/me');
-    expect(env.PATH).toBe('/usr/bin');
+  it('computed PATH prepends the node bin dir to the probed login-shell PATH', async () => {
+    const env = await build(makeBuilder({}));
+    expect(env.PATH).toBe('/node/bin:/probe/bin:/usr/bin');
   });
 
-  it('different tasks of the same app get distinct PORT values', () => {
-    const base = {
-      processEnv: {},
-      global: [{ key: 'NODE_ENV', value: 'development', enabled: true }],
-      app: [{ key: 'DATABASE_URL', value: 'postgres://local', enabled: true }],
-      dotEnv: {}
-    };
-    const apiEnv = buildEffective({
-      ...base,
-      task: [{ key: 'PORT', value: '4000', enabled: true }]
-    });
-    const webEnv = buildEffective({
-      ...base,
-      task: [{ key: 'PORT', value: '5173', enabled: true }]
-    });
-    expect(apiEnv.PORT).toBe('4000');
-    expect(webEnv.PORT).toBe('5173');
-    // App-shared values still present in both
-    expect(apiEnv.DATABASE_URL).toBe('postgres://local');
-    expect(webEnv.DATABASE_URL).toBe('postgres://local');
-    expect(apiEnv.NODE_ENV).toBe('development');
-    expect(webEnv.NODE_ENV).toBe('development');
+  it('hard-coded runtime keys cap the stack', async () => {
+    const env = await build(makeBuilder({ task: [row('TERM', 'dumb'), row('FORCE_COLOR', '0')] }));
+    // FORCE_COLOR/TERM are set after all scopes - even a task row can't change them.
+    expect(env.FORCE_COLOR).toBe('1');
+    expect(env.TERM).toBe('xterm-256color');
   });
 
-  it('empty key is ignored (defensive)', () => {
-    const env = buildEffective({
-      processEnv: {},
-      global: [{ key: '', value: 'whatever', enabled: true }],
-      app: [],
-      task: [],
-      dotEnv: {}
-    });
-    expect(env['']).toBeUndefined();
+  it('different tasks of the same app get distinct task-scope values', async () => {
+    const base = { global: [row('NODE_ENV', 'development')], app: [row('DB', 'postgres://local')] };
+    const api = await build(makeBuilder({ ...base, task: [row('PORT', '4000')] }));
+    const web = await build(makeBuilder({ ...base, task: [row('PORT', '5173')] }));
+    expect(api.PORT).toBe('4000');
+    expect(web.PORT).toBe('5173');
+    expect(api.DB).toBe('postgres://local');
+    expect(web.NODE_ENV).toBe('development');
   });
 });
diff --git a/src/main/services/__tests__/RestartWatcher.test.ts b/src/main/services/__tests__/RestartWatcher.test.ts
new file mode 100644
index 0000000..42ac526
--- /dev/null
+++ b/src/main/services/__tests__/RestartWatcher.test.ts
@@ -0,0 +1,37 @@
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it, expect } from 'vitest';
+import type { AppId } from '@shared/types';
+import { RestartWatcher } from '../RestartWatcher';
+
+/**
+ * Regression guard for IMPROVEMENT-PLAN 5.1: chokidar v4+ removed glob support, so the old
+ * `chokidar.watch(['src/**'])` watcher was silently dead. The watcher must (a) fire on a
+ * change to a file matching the configured globs and (b) ignore node_modules.
+ */
+describe('RestartWatcher (chokidar v5 directory-watch + glob filter)', () => {
+  it('fires on a matching src change and ignores node_modules', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'rw-test-'));
+    mkdirSync(join(dir, 'src'));
+    mkdirSync(join(dir, 'node_modules'));
+
+    const w = new RestartWatcher();
+    const fired: string[] = [];
+    w.on('restart', ({ path }: { path: string }) => fired.push(path));
+    w.watch('app1' as AppId, dir, []); // [] → DEFAULT_GLOBS (src/**/*.{ts,...})
+
+    // Let the watcher finish its initial scan before touching files.
+    await new Promise((r) => setTimeout(r, 800));
+    writeFileSync(join(dir, 'node_modules', 'junk.ts'), 'x'); // must be ignored
+    writeFileSync(join(dir, 'src', 'a.ts'), 'x'); // must trigger (after 500ms debounce)
+    await new Promise((r) => setTimeout(r, 1500));
+
+    w.unwatch('app1' as AppId);
+    rmSync(dir, { recursive: true, force: true });
+
+    expect(fired.length).toBeGreaterThan(0);
+    expect(fired.every((p) => !p.includes('node_modules'))).toBe(true);
+    expect(fired.some((p) => p.endsWith('a.ts'))).toBe(true);
+  }, 10000);
+});
diff --git a/src/main/services/__tests__/Settings.test.ts b/src/main/services/__tests__/Settings.test.ts
index ab5d72c..04e17f6 100644
--- a/src/main/services/__tests__/Settings.test.ts
+++ b/src/main/services/__tests__/Settings.test.ts
@@ -5,7 +5,7 @@ import { join } from 'node:path';
 
 /**
  * Settings.ts depends on the better-sqlite3 native module which is built for Electron's
- * ABI, not Node's — so we can't import it directly under vitest. We test the parsing
+ * ABI, not Node's - so we can't import it directly under vitest. We test the parsing
  * helpers indirectly by importing them once they're refactored out.
  *
  * This file is a placeholder showing the test scaffold; the meaningful Settings tests
@@ -21,7 +21,7 @@ afterAll(() => {
 });
 
 describe('Settings (parsing helpers)', () => {
-  it('placeholder — see Playwright suite for the integration tests', () => {
+  it('placeholder - see Playwright suite for the integration tests', () => {
     expect(true).toBe(true);
   });
 });
diff --git a/src/main/services/readiness/LogReadiness.ts b/src/main/services/readiness/LogReadiness.ts
index fa03e75..c58d885 100644
--- a/src/main/services/readiness/LogReadiness.ts
+++ b/src/main/services/readiness/LogReadiness.ts
@@ -15,7 +15,7 @@ export function makeLogWatcher(
   try {
     regex = new RegExp(pattern, flags ?? '');
   } catch (e) {
-    // Bad regex — emit a non-ready and let the orchestrator decide.
+    // Bad regex - emit a non-ready and let the orchestrator decide.
     queueMicrotask(() => resolveReady(false));
     return { ready, dispose: () => {} };
   }
diff --git a/src/main/services/readiness/PortReadiness.ts b/src/main/services/readiness/PortReadiness.ts
index c792292..ea308fe 100644
--- a/src/main/services/readiness/PortReadiness.ts
+++ b/src/main/services/readiness/PortReadiness.ts
@@ -66,7 +66,7 @@ async function listListeningPidsOnPort(port: number): Promise<Set<number>> {
     }
     return pids;
   } catch (e) {
-    // lsof exits 1 when nothing matches — that's "not yet listening", not an error.
+    // lsof exits 1 when nothing matches - that's "not yet listening", not an error.
     const err = e as { code?: number; stdout?: string };
     if (typeof err.code === 'number' && err.code === 1) return new Set();
     throw e;
diff --git a/src/renderer/App.tsx b/src/renderer/App.tsx
index dae3b09..b38d913 100644
--- a/src/renderer/App.tsx
+++ b/src/renderer/App.tsx
@@ -10,10 +10,15 @@ import { CommandPalette } from './components/CommandPalette';
 import { SettingsDrawer } from './components/SettingsDrawer';
 import { UpdateBanner } from './components/UpdateBanner';
 import { AddAppDrawer } from './components/AddAppDrawer';
+import { ImportProjectsDrawer } from './components/ImportProjectsDrawer';
+import { GlobalLogSearch } from './components/GlobalLogSearch';
+import { ToastHost } from './components/Toast';
+import { invokeOrToast } from './lib/invoke';
 import { useTheme } from './hooks/useTheme';
 
 export function App(): JSX.Element {
   const apps = useStore((s) => s.apps);
+  const loaded = useStore((s) => s.loaded);
   const view = useStore((s) => s.view);
   const selectedId = useStore((s) => s.selectedAppId);
   const setApps = useStore((s) => s.setApps);
@@ -28,11 +33,15 @@ export function App(): JSX.Element {
   const applyTaskPorts = useStore((s) => s.applyTaskPorts);
   const applyEnvFileChange = useStore((s) => s.applyEnvFileChange);
 
-  const [adding, setAdding] = useState(false);
-  const [addError, setAddError] = useState<string | null>(null);
-  const [pendingAddPath, setPendingAddPath] = useState<string | null>(null);
+  const [addOpen, setAddOpen] = useState(false);
+  const [addInitialPath, setAddInitialPath] = useState<string | null>(null);
+  // Whether the add-drawer should auto-detect its initial path. False when the path arrived
+  // from an untrusted devharbor:// deep link - the user must click "Scan this folder" first.
+  const [addAutoDetect, setAddAutoDetect] = useState(true);
   const [paletteOpen, setPaletteOpen] = useState(false);
   const [settingsOpen, setSettingsOpen] = useState(false);
+  const [importOpen, setImportOpen] = useState(false);
+  const [logSearchOpen, setLogSearchOpen] = useState(false);
 
   // Latest onAddApp without re-subscribing the event effect when it changes.
   const onAddAppRef = useRef<(() => Promise<void>) | null>(null);
@@ -50,21 +59,17 @@ export function App(): JSX.Element {
       setApps(list);
       setRunningApps(running);
       setRunningTasks(runningTasks);
-      // Pre-load tasks for every registered app so the Dashboard knows their
-      // task counts + port chips without waiting for the user to open each
-      // AppDetail. (Before this, `tasksByApp` was populated lazily on AppDetail
-      // mount, so multi-task apps the user only Started from the Dashboard had
-      // empty tasks → no port chips.)
-      await Promise.all(
-        list.map(async (a) => {
-          try {
-            const t = await window.api.invoke('tasks:list', { appId: a.id });
-            useStore.getState().setTasksForApp(a.id, t);
-          } catch {
-            // best-effort
-          }
-        })
-      );
+      // Pre-load tasks for every registered app so the Dashboard knows their task counts +
+      // port chips without waiting for the user to open each AppDetail. One tasks:listAll
+      // round-trip instead of the old per-app N+1 loop (IMPROVEMENT-PLAN 9.7).
+      try {
+        const all = await window.api.invoke('tasks:listAll', undefined);
+        for (const a of list) {
+          useStore.getState().setTasksForApp(a.id, all[a.id] ?? []);
+        }
+      } catch {
+        // best-effort
+      }
       // Always land on Dashboard on cold boot / Cmd+R reload. App detail is
       // reached by clicking an app in the sidebar.
       setView('dashboard');
@@ -92,9 +97,12 @@ export function App(): JSX.Element {
       setSelected(appId);
     });
     const offDeepUnknown = window.api.on('deepLink:unknownPath', ({ path }) => {
-      setPendingAddPath(path);
+      // Path came from a web-page-triggerable deep link: prefill but don't auto-read the FS.
+      setAddInitialPath(path);
+      setAddAutoDetect(false);
+      setAddOpen(true);
     });
-    // A devharbor://start link asks to run an app's tasks. Confirm first — a link from any
+    // A devharbor://start link asks to run an app's tasks. Confirm first - a link from any
     // web page must not silently execute local shell commands.
     const offDeepConfirmStart = window.api.on('deepLink:confirmStart', ({ appId, appName }) => {
       setSelected(appId);
@@ -103,7 +111,7 @@ export function App(): JSX.Element {
         description: 'A devharbor:// link asked to start this app, which runs its tasks (including any custom shell commands).',
         confirmLabel: 'Start app'
       }).then((ok) => {
-        if (ok) void window.api.invoke('proc:start', { id: appId });
+        if (ok) void invokeOrToast('proc:start', { id: appId }, { context: 'Start failed' });
       });
     });
     // macOS menu actions (Settings ⌘, / Add App ⌘N / Add Folder ⌘⇧N).
@@ -112,6 +120,13 @@ export function App(): JSX.Element {
     const offMenuNewFolder = window.api.on('menu:newFolder', () =>
       window.dispatchEvent(new CustomEvent('devharbor:new-folder'))
     );
+    // Help-menu actions are forwarded here so their result surfaces in the renderer.
+    const offMenuCheckUpdates = window.api.on('menu:checkUpdates', () => {
+      void window.api.invoke('update:check', undefined);
+    });
+    const offMenuOpenLogs = window.api.on('menu:openLogs', () => {
+      void window.api.invoke('logs:openFolder', undefined);
+    });
     return () => {
       offTaskStatus();
       offAppStatus();
@@ -124,6 +139,8 @@ export function App(): JSX.Element {
       offMenuSettings();
       offMenuAddApp();
       offMenuNewFolder();
+      offMenuCheckUpdates();
+      offMenuOpenLogs();
     };
   }, [
     setApps,
@@ -138,38 +155,27 @@ export function App(): JSX.Element {
     applyEnvFileChange
   ]);
 
+  // Open the add-app wizard. Folder browsing + the already-registered check now live
+  // inside the wizard's first step.
   const onAddApp = useCallback(async (): Promise<void> => {
-    if (adding) return;
-    setAdding(true);
-    setAddError(null);
-    try {
-      const path = await window.api.invoke('dialog:browse', undefined);
-      if (!path) return;
-      // If this path is already registered, focus that app instead of re-adding.
-      const existing = await window.api.invoke('apps:findByPath', { path });
-      if (existing) {
-        setSelected(existing.id as AppId);
-        setAddError(`"${existing.name}" is already registered — focused it.`);
-        return;
-      }
-      // Otherwise open the confirm-before-add drawer.
-      setPendingAddPath(path);
-    } catch (e) {
-      setAddError((e as Error).message);
-    } finally {
-      setAdding(false);
-    }
-  }, [adding, setSelected]);
+    setAddInitialPath(null);
+    setAddAutoDetect(true);
+    setAddOpen(true);
+  }, []);
 
   onAddAppRef.current = onAddApp;
 
-  // Global Cmd+K / Ctrl+K to toggle the command palette.
+  // Global Cmd+K (command palette) and Cmd+Shift+F (search all logs).
   useEffect(() => {
     const onKey = (e: KeyboardEvent): void => {
       if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === 'k' && !e.shiftKey) {
         e.preventDefault();
         setPaletteOpen((v) => !v);
       }
+      if ((e.metaKey || e.ctrlKey) && e.shiftKey && e.key.toLowerCase() === 'f') {
+        e.preventDefault();
+        setLogSearchOpen((v) => !v);
+      }
     };
     window.addEventListener('keydown', onKey);
     return () => window.removeEventListener('keydown', onKey);
@@ -178,7 +184,15 @@ export function App(): JSX.Element {
   const selected = apps.find((a) => a.id === selectedId);
 
   let main: JSX.Element;
-  if (view === 'dashboard') {
+  if (!loaded) {
+    // apps:list hasn't resolved yet - render a blank pane instead of flashing the
+    // first-run welcome screen at every boot/reload for users who DO have apps.
+    main = <main className="flex-1" />;
+  } else if (apps.length === 0) {
+    // Brand-new user: the welcome / teaching screen is the zero-apps experience,
+    // regardless of which view is selected.
+    main = <EmptyState onAddApp={onAddApp} onImport={() => setImportOpen(true)} />;
+  } else if (view === 'dashboard') {
     main = <Dashboard />;
   } else if (selected) {
     main = <AppDetail app={selected} />;
@@ -192,33 +206,51 @@ export function App(): JSX.Element {
         onAddApp={onAddApp}
         onOpenSettings={() => setSettingsOpen(true)}
         onOpenPalette={() => setPaletteOpen(true)}
+        onImportProjects={() => setImportOpen(true)}
       />
       {main}
-      {addError && (
-        <div className="pointer-events-none absolute bottom-4 right-4 max-w-md rounded-md border border-danger-border bg-danger-bg px-3 py-2 text-xs text-danger-fg shadow-lg">
-          {addError}
-        </div>
-      )}
       <CommandPalette
         open={paletteOpen}
         onOpenChange={setPaletteOpen}
         onAddApp={onAddApp}
         onOpenSettings={() => setSettingsOpen(true)}
+        onImportProjects={() => setImportOpen(true)}
+        onSearchLogs={() => setLogSearchOpen(true)}
       />
       {settingsOpen && <SettingsDrawer onClose={() => setSettingsOpen(false)} />}
-      {pendingAddPath && (
+      {addOpen && (
         <AddAppDrawer
-          path={pendingAddPath}
-          onCancel={() => setPendingAddPath(null)}
+          initialPath={addInitialPath}
+          autoDetectInitial={addAutoDetect}
+          onCancel={() => setAddOpen(false)}
           onConfirm={(app) => {
-            setPendingAddPath(null);
+            setAddOpen(false);
             upsertApp(app);
             setSelected(app.id as AppId);
           }}
         />
       )}
+      {importOpen && (
+        <ImportProjectsDrawer
+          onClose={() => setImportOpen(false)}
+          onImported={(created) => {
+            setImportOpen(false);
+            for (const app of created) upsertApp(app);
+          }}
+        />
+      )}
+      {logSearchOpen && (
+        <GlobalLogSearch
+          onClose={() => setLogSearchOpen(false)}
+          onSelectApp={(id) => {
+            setLogSearchOpen(false);
+            setSelected(id);
+          }}
+        />
+      )}
       <UpdateBanner />
       <PromptModalHost />
+      <ToastHost />
     </div>
   );
 }
diff --git a/src/renderer/components/AddAppDrawer.tsx b/src/renderer/components/AddAppDrawer.tsx
index 5aee23e..acf15bb 100644
--- a/src/renderer/components/AddAppDrawer.tsx
+++ b/src/renderer/components/AddAppDrawer.tsx
@@ -1,142 +1,188 @@
-import { useEffect, useMemo, useState } from 'react';
-import { X, FolderOpen, ChevronDown, ChevronRight } from 'lucide-react';
-import type { App, DetectionResult, NodeVersionPref, PackageManager, EnvVar } from '@shared/types';
-import { ulid } from 'ulid';
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { X, FolderOpen, AlertCircle, ChevronDown, ChevronRight } from 'lucide-react';
+import type { App, DetectionResult, NodeVersionPref, PackageManager } from '@shared/types';
+import type { CreateAppInput, CreateTaskSpec } from '@shared/ipc';
 import { parseDotEnv, isSecretKey } from '@shared/dotenv';
 import { ErrorBanner } from './ErrorBanner';
 import { NodeVersionPicker } from './NodeVersionPicker';
+import { cn } from '../lib/cn';
+import { basename } from '../lib/processState';
+import { useDialog } from '../hooks/useDialog';
+import { invokeOrToast } from '../lib/invoke';
+
+/** Stable id for the dialog heading so aria-labelledby can point at it. */
+const TITLE_ID = 'add-app-title';
 
 const PMS: (PackageManager | null)[] = [null, 'npm', 'yarn', 'pnpm', 'bun'];
 
 /**
- * Confirm-before-add drawer. Shows detected node version / package manager / scripts /
- * .env files, and lets the user set: name, Node version, package manager, the default
- * script (which becomes the app's first task), and optionally paste a .env blob.
+ * Add-app screen - a single, progressively-disclosed form (not a wizard).
+ *
+ * You browse for a project folder first; an inline error appears if it's already
+ * registered. Once a valid, not-yet-added folder is detected, the rest of the form reveals:
+ * how it runs (Node version, package manager, default script → first task) and an optional
+ * environment-variables section. Each section carries a short "why this matters" hint so a
+ * newcomer sees the whole shape of an app at once, while a regular adds in seconds.
  *
- * Key behaviour (Phase 10 fix): the chosen default script is materialised into a real
- * Task on add, so the app is immediately startable. Previously the script was only
- * stored on the app row and no task existed until the next app restart → Start failed.
+ * The chosen default script is materialised into a real Task on add (so the app is
+ * immediately startable). The whole add is a SINGLE `apps:create` invoke - main commits the
+ * app + first task + env vars in one DB transaction, so a thrown step can never leave an
+ * orphan app row (no renderer-side rollback to get wrong).
  */
 export function AddAppDrawer({
-  path,
+  initialPath,
+  autoDetectInitial = true,
   onCancel,
   onConfirm
 }: {
-  path: string;
+  /** Pre-selected folder (e.g. from a devharbor:// deep link). Otherwise the user browses. */
+  initialPath?: string | null;
+  /**
+   * Whether to immediately validate + detect `initialPath` on open. False for paths that
+   * arrived from an untrusted source (a devharbor:// deep link) - we prefill but require an
+   * explicit "Scan this folder" click before touching the filesystem, so a web page can't
+   * make DevHarbor probe arbitrary directories without a user gesture (IMPROVEMENT-PLAN 6.6).
+   */
+  autoDetectInitial?: boolean;
   onCancel: () => void;
   onConfirm: (app: App) => void;
 }): JSX.Element {
+  const [path, setPath] = useState<string | null>(initialPath ?? null);
   const [detection, setDetection] = useState<DetectionResult | null>(null);
-  const [name, setName] = useState<string>(() => basename(path));
-  const [defaultScript, setDefaultScript] = useState<string | null>(null);
+  const [detecting, setDetecting] = useState(false);
+  const [pathError, setPathError] = useState<string | null>(null);
+
+  const [name, setName] = useState('');
   const [nodePref, setNodePref] = useState<NodeVersionPref>({ kind: 'auto' });
   const [pm, setPm] = useState<PackageManager | null>(null);
+  const [defaultScript, setDefaultScript] = useState<string | null>(null);
+  // When a monorepo is detected, the user can opt to materialise one task per workspace package
+  // instead of a single start-script task (IMPROVEMENT-PLAN 14.4).
+  const [perWorkspaceTasks, setPerWorkspaceTasks] = useState(false);
   const [envText, setEnvText] = useState('');
   const [envOpen, setEnvOpen] = useState(false);
+
   const [error, setError] = useState<string | null>(null);
   const [adding, setAdding] = useState(false);
 
-  useEffect(() => {
-    let cancelled = false;
-    void window.api
-      .invoke('apps:detect', { path })
-      .then((d) => {
-        if (cancelled) return;
-        setDetection(d);
-        setDefaultScript(d.suggestedDefaultScript);
-        setPm(d.packageManager); // pre-select detected PM; user can override
-      })
-      .catch((e) => {
-        if (!cancelled) setError((e as Error).message);
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, [path]);
+  // Focus trap / Escape-to-close / focus-restore + role=dialog wiring shared with every drawer.
+  const { dialogProps } = useDialog(onCancel, TITLE_ID);
 
-  const add = async (): Promise<void> => {
+  // Validate + detect a freshly chosen folder. Sets the inline path error if it's already
+  // registered; otherwise runs detection to fill in sensible defaults.
+  const choosePath = useCallback(async (p: string): Promise<void> => {
     setError(null);
-    setAdding(true);
+    setPathError(null);
+    setDetection(null);
+    setPath(p);
+    setName(basename(p));
     try {
-      const app = await window.api.invoke('apps:add', { path });
-      // apps:add committed the app row. Everything after must succeed or we roll the
-      // app back — otherwise a thrown tasks:add/env:setApp leaves an orphan in the DB
-      // that's invisible until reload.
-      try {
-        // Persist name / node version / package manager. We deliberately do NOT persist
-        // `defaultScript` on the app row: the task created below is the source of truth.
-        // Storing default_script would let the startup backfill resurrect a task the
-        // user later deletes (it seeds a task for any app that has default_script + 0 tasks).
-        const patched = await window.api.invoke('apps:update', {
-          id: app.id,
-          patch: {
-            name: name.trim() || app.name,
-            nodeVersionPref: nodePref,
-            packageManager: pm
-          }
-        });
-
-        // Materialise the chosen script into the app's first task so Start works
-        // immediately. Only if a script was actually chosen (not "don't create a task yet").
-        if (defaultScript) {
-          await window.api.invoke('tasks:add', {
-            appId: app.id,
-            patch: {
-              name: defaultScript,
-              commandKind: 'script',
-              script: defaultScript,
-              enabled: true
-            }
-          });
-        }
-
-        // Optional: apply pasted .env to the app scope.
-        const parsed = parseDotEnv(envText);
-        const keys = Object.keys(parsed);
-        if (keys.length > 0) {
-          const vars: EnvVar[] = keys.map((key) => ({
-            id: ulid(),
-            appId: app.id,
-            key,
-            value: parsed[key]!,
-            enabled: true,
-            isSecret: isSecretKey(key)
-          }));
-          await window.api.invoke('env:setApp', { id: app.id, vars });
-        }
-
-        onConfirm(patched);
-      } catch (inner) {
-        // Roll back the half-created app so we don't leave an orphan.
-        try {
-          await window.api.invoke('apps:remove', { id: app.id });
-        } catch {
-          /* best-effort rollback */
-        }
-        throw inner;
+      const existing = await window.api.invoke('apps:findByPath', { path: p });
+      if (existing) {
+        setPathError(`This folder is already added as “${existing.name}”.`);
+        return;
       }
+    } catch (e) {
+      setError((e as Error).message);
+      return;
+    }
+    setDetecting(true);
+    try {
+      const d = await window.api.invoke('apps:detect', { path: p });
+      setDetection(d);
+      setDefaultScript(d.suggestedDefaultScript);
+      setPm(d.packageManager);
+      // A fresh scan starts opted-out; the user re-opts per folder if it's a monorepo.
+      setPerWorkspaceTasks(false);
     } catch (e) {
       setError((e as Error).message);
     } finally {
-      setAdding(false);
+      setDetecting(false);
     }
+  }, []);
+
+  // A trusted pre-filled folder is validated immediately. An untrusted one (deep link) is
+  // only prefilled - the user must click "Scan this folder" before any filesystem read.
+  useEffect(() => {
+    if (initialPath && autoDetectInitial) void choosePath(initialPath);
+  }, [initialPath, autoDetectInitial, choosePath]);
+
+  const browse = async (): Promise<void> => {
+    const p = await window.api.invoke('dialog:browse', undefined);
+    if (p) await choosePath(p);
   };
 
   const scriptCount = detection ? Object.keys(detection.scripts).length : 0;
-  // Only re-parse when the env text changes (was re-parsing the whole blob every keystroke).
-  const envKeyCount = useMemo(
-    () => (envOpen ? Object.keys(parseDotEnv(envText)).length : 0),
-    [envText, envOpen]
+  const envKeyCount = useMemo(() => Object.keys(parseDotEnv(envText)).length, [envText]);
+
+  // Monorepo workspace packages that have at least one runnable script. Packages with no
+  // scripts can't be materialised into a startable task, so we exclude them from both the
+  // count shown to the user and the apps:create payload below.
+  const workspaces = detection?.workspaces ?? [];
+  const runnableWorkspaces = useMemo(
+    // Derive from `detection` inside the memo so the dep array is exactly [detection]; the
+    // `workspaces` const above is just a render-time convenience for the JSX below.
+    () => (detection?.workspaces ?? []).filter((ws) => (ws.suggestedScript ?? ws.scripts[0]) != null),
+    [detection]
   );
 
+  // Ready to add once a valid, not-already-added folder has finished detecting.
+  const ready = !!path && !pathError && !detecting && detection != null;
+
+  const add = async (): Promise<void> => {
+    if (!path || !ready) return;
+    setError(null);
+    setAdding(true);
+
+    // Monorepo mode: the workspace packages ARE the tasks (one task per package, each pinned
+    // to its subdir via workingDirOverride), so we send `tasks` and clear firstTask. Otherwise
+    // keep the single start-script-as-first-task behavior.
+    const useWorkspaceTasks = perWorkspaceTasks && runnableWorkspaces.length > 0;
+    const tasks: CreateTaskSpec[] | undefined = useWorkspaceTasks
+      ? runnableWorkspaces.map((ws) => ({
+          name: ws.name || ws.relPath,
+          commandKind: 'script',
+          script: ws.suggestedScript ?? ws.scripts[0],
+          workingDirOverride: ws.relPath
+        }))
+      : undefined;
+
+    // One atomic create: main commits app + first task + env vars in a single transaction,
+    // so a failure mid-way can never strand an orphan app row (was a 4-call add + rollback).
+    const input: CreateAppInput = {
+      path,
+      name: name.trim() || undefined,
+      nodeVersionPref: nodePref,
+      packageManager: pm,
+      defaultScript: defaultScript ?? null,
+      firstTask: useWorkspaceTasks
+        ? null
+        : defaultScript
+          ? { name: defaultScript, commandKind: 'script', script: defaultScript }
+          : null,
+      tasks,
+      envVars: Object.entries(parseDotEnv(envText)).map(([key, value]) => ({
+        key,
+        value,
+        isSecret: isSecretKey(key)
+      }))
+    };
+
+    const app = await invokeOrToast('apps:create', input, { context: 'Add failed' });
+    setAdding(false);
+    if (app) onConfirm(app);
+  };
+
   return (
     <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
-      <div className="flex max-h-[90vh] w-full max-w-lg flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+      <div
+        {...dialogProps}
+        className="flex max-h-[90vh] w-full max-w-lg flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
-          <div className="flex items-center gap-2">
-            <FolderOpen className="h-4 w-4 text-fg-muted" />
-            <h2 className="text-sm font-medium text-fg">Add app</h2>
-          </div>
+          <h2 id={TITLE_ID} className="text-sm font-medium text-fg">
+            Add app
+          </h2>
           <button
             onClick={onCancel}
             className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
@@ -146,108 +192,209 @@ export function AddAppDrawer({
             <X className="h-4 w-4" />
           </button>
         </header>
+
         {error && (
           <ErrorBanner message={error} onDismiss={() => setError(null)} className="m-3 rounded-md" />
         )}
+
         <div className="flex-1 overflow-y-auto p-5">
-          <div className="mb-4">
-            <div className="text-[10px] uppercase tracking-wider text-fg-subtle">Path</div>
-            <div className="mt-0.5 truncate font-mono text-xs text-fg-muted">{path}</div>
-          </div>
+          {/* 1 - Project folder */}
+          <SectionHeader
+            n={1}
+            title="Project folder"
+            desc="Pick the root of a Node.js project - the folder with its package.json. DevHarbor reads it to fill in smart defaults below."
+          />
+          <button
+            onClick={() => void browse()}
+            data-autofocus
+            className={cn(
+              'flex w-full items-center gap-2 rounded-md border bg-surface px-3 py-2 text-sm hover:border-border-strong',
+              pathError ? 'border-danger-border' : 'border-border'
+            )}
+          >
+            <FolderOpen className="h-4 w-4 shrink-0 text-fg-muted" />
+            {path ? (
+              <span className="min-w-0 flex-1 truncate text-left font-mono text-xs text-fg">{path}</span>
+            ) : (
+              <span className="flex-1 text-left text-fg-subtle">Browse for a folder…</span>
+            )}
+            <span className="shrink-0 rounded bg-elevated px-1.5 py-0.5 text-[10px] text-fg-muted">
+              {path ? 'Change' : 'Browse'}
+            </span>
+          </button>
+          {pathError && (
+            <p className="mt-1.5 flex items-center gap-1 text-[11px] text-danger-fg">
+              <AlertCircle className="h-3 w-3 shrink-0" /> {pathError}
+            </p>
+          )}
+          {/* Deep-link path: require an explicit gesture before detecting (no auto fs read). */}
+          {path && !detection && !detecting && !pathError && (
+            <button
+              onClick={() => void choosePath(path)}
+              className="mt-2 rounded-md border border-border bg-surface px-2.5 py-1 text-xs text-fg hover:border-border-strong"
+            >
+              Scan this folder
+            </button>
+          )}
+          {detecting && <p className="mt-2 text-sm text-fg-subtle">Detecting…</p>}
 
-          {!detection ? (
-            <div className="text-sm text-fg-subtle">Detecting…</div>
-          ) : (
+          {/* Everything below reveals once a valid folder is detected. */}
+          {ready && detection && (
             <>
-              <div className="mb-5 grid grid-cols-2 gap-3 text-xs">
-                <Detected
-                  label="Detected scripts"
-                  value={scriptCount > 0 ? `${scriptCount} found` : 'none'}
+              {/* What we found - teaches by showing. */}
+              <div className="mt-3 grid grid-cols-3 gap-3 rounded-md border border-border bg-base/50 p-3 text-xs">
+                <Found label="Scripts" value={scriptCount > 0 ? `${scriptCount} found` : 'none'} />
+                <Found
+                  label="Package mgr"
+                  value={detection.packageManager ?? 'not detected'}
                 />
-                <Detected
+                <Found
                   label=".env files"
-                  value={detection.envFiles.length > 0 ? detection.envFiles.join(', ') : 'none'}
+                  value={detection.envFiles.length ? detection.envFiles.join(', ') : 'none'}
                 />
               </div>
 
-              <Row label="Name">
-                <input
-                  value={name}
-                  onChange={(e) => setName(e.target.value)}
-                  className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
-                />
-              </Row>
+              {/* No package.json here: auto-detection can't help, but the folder is still
+                  addable as a custom-command app - warn, don't block (IMPROVEMENT-PLAN 10.2). */}
+              {!detection.hasPackageJson && (
+                <p className="mt-2 flex items-start gap-1.5 rounded-md border border-border bg-surface px-2.5 py-1.5 text-[11px] leading-snug text-fg-muted">
+                  <AlertCircle className="mt-px h-3 w-3 shrink-0 text-fg-subtle" />
+                  <span>
+                    No package.json found here - you can still add it and run custom shell
+                    commands, but auto-detection won&apos;t help.
+                  </span>
+                </p>
+              )}
 
-              <Row
-                label="Node version"
-                hint={
-                  detection.nodeVersionFromProject
-                    ? `Project pins ${detection.nodeVersionFromProject} (.nvmrc / engines) — "Auto" uses it.`
-                    : 'No project pin found — "Auto" falls back to your latest installed.'
-                }
-              >
-                <NodeVersionPicker value={nodePref} onChange={(v) => setNodePref(v ?? { kind: 'auto' })} />
-              </Row>
+              {/* 2 - How it runs */}
+              <div className="mt-6">
+                <SectionHeader
+                  n={2}
+                  title="How it runs"
+                  desc="Sensible defaults are pre-filled from your project - adjust if you like."
+                />
+                <Row label="Name">
+                  <input
+                    value={name}
+                    onChange={(e) => setName(e.target.value)}
+                    maxLength={60}
+                    className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
+                  />
+                </Row>
 
-              <Row
-                label="Package manager"
-                hint={
-                  detection.packageManager
-                    ? `Detected ${detection.packageManager} from lockfile / packageManager field.`
-                    : 'Nothing detected — defaults to npm at run time.'
-                }
-              >
-                <select
-                  value={pm ?? ''}
-                  onChange={(e) => setPm((e.target.value || null) as PackageManager | null)}
-                  className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
+                <Row
+                  label="Node version"
+                  hint={
+                    detection.nodeVersionFromProject
+                      ? `“Auto” follows your project's pin (${detection.nodeVersionFromProject} from .nvmrc / engines).`
+                      : '“Auto” falls back to your latest installed Node. DevHarbor reads nvm / fnm / volta / asdf.'
+                  }
                 >
-                  {PMS.map((p) => (
-                    <option key={p ?? 'auto'} value={p ?? ''}>
-                      {p
-                        ? `${p}${detection.packageManager === p ? ' (detected)' : ''}`
-                        : 'Auto-detect each run'}
-                    </option>
-                  ))}
-                </select>
-              </Row>
+                  <NodeVersionPicker value={nodePref} onChange={(v) => setNodePref(v ?? { kind: 'auto' })} />
+                </Row>
 
-              {scriptCount > 0 ? (
                 <Row
-                  label="Default script → first task"
-                  hint="Becomes the app's first task so you can Start immediately. Add more tasks later."
+                  label="Package manager"
+                  hint={
+                    detection.packageManager
+                      ? `Detected ${detection.packageManager} from the lockfile / packageManager field.`
+                      : 'Nothing detected - defaults to npm at run time.'
+                  }
                 >
                   <select
-                    value={defaultScript ?? ''}
-                    onChange={(e) => setDefaultScript(e.target.value || null)}
+                    value={pm ?? ''}
+                    onChange={(e) => setPm((e.target.value || null) as PackageManager | null)}
                     className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
                   >
-                    <option value="">— don't create a task yet —</option>
-                    {Object.entries(detection.scripts).map(([k, v]) => (
-                      <option key={k} value={k}>
-                        {k} — {v}
+                    {PMS.map((p) => (
+                      <option key={p ?? 'auto'} value={p ?? ''}>
+                        {p ? `${p}${detection.packageManager === p ? ' (detected)' : ''}` : 'Auto-detect each run'}
                       </option>
                     ))}
                   </select>
                 </Row>
-              ) : (
-                <Row label="Tasks" hint="No package.json scripts found. Add a task (script or custom command) after creating.">
-                  <span className="text-xs text-fg-subtle">No scripts detected.</span>
-                </Row>
-              )}
 
-              {/* Optional env paste — collapsed by default to keep the drawer light. */}
-              <div className="mt-2 border-t border-surface pt-3">
+                {scriptCount > 0 ? (
+                  <Row
+                    label="Start script → first task"
+                    hint="This becomes the app's first task, so you can Start it right away. Add more tasks anytime."
+                  >
+                    <select
+                      value={defaultScript ?? ''}
+                      onChange={(e) => setDefaultScript(e.target.value || null)}
+                      className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
+                    >
+                      <option value=""> - don't create a task yet - </option>
+                      {Object.entries(detection.scripts).map(([k, v]) => (
+                        <option key={k} value={k}>
+                          {k} - {v}
+                        </option>
+                      ))}
+                    </select>
+                  </Row>
+                ) : (
+                  <Row
+                    label="Tasks"
+                    hint="No package.json scripts found. You can add a task (a script or any shell command) after creating the app."
+                  >
+                    <span className="text-xs text-fg-subtle">No scripts detected.</span>
+                  </Row>
+                )}
+
+                {/* Monorepo offer - when workspace packages are detected, let the user create
+                    one task per package (each pinned to its subdir) instead of a single start
+                    task. Only packages with a runnable script become tasks (IMPROVEMENT-PLAN 14.4). */}
+                {workspaces.length > 0 && (
+                  <div className="mb-4 rounded-md border border-border bg-base/50 p-3">
+                    <div className="text-xs font-medium text-fg">
+                      Monorepo detected - {workspaces.length} workspace package
+                      {workspaces.length === 1 ? '' : 's'} found
+                    </div>
+                    <label className="mt-2 flex items-start gap-2 text-xs text-fg-muted">
+                      <input
+                        type="checkbox"
+                        checked={perWorkspaceTasks}
+                        onChange={(e) => setPerWorkspaceTasks(e.target.checked)}
+                        disabled={runnableWorkspaces.length === 0}
+                        className="mt-0.5 shrink-0 accent-accent"
+                      />
+                      <span>
+                        Create a task per workspace package
+                        {runnableWorkspaces.length === 0 && (
+                          <span className="text-fg-subtle"> - none have runnable scripts</span>
+                        )}
+                      </span>
+                    </label>
+                    {perWorkspaceTasks && runnableWorkspaces.length > 0 && (
+                      <p className="mt-1.5 pl-6 text-[10px] text-fg-subtle">
+                        {runnableWorkspaces.length} task
+                        {runnableWorkspaces.length === 1 ? '' : 's'} will be created, one per
+                        package with a script
+                        {runnableWorkspaces.length < workspaces.length &&
+                          ` (${workspaces.length - runnableWorkspaces.length} skipped - no scripts)`}
+                        . The start-script task above is skipped.
+                      </p>
+                    )}
+                  </div>
+                )}
+              </div>
+
+              {/* 3 - Environment variables (optional, collapsed) */}
+              <div className="mt-6">
+                <SectionHeader
+                  n={3}
+                  title="Environment variables"
+                  desc="Optional. DevHarbor already watches .env files in your project - paste here only to seed app-level variables now."
+                />
                 <button
                   onClick={() => setEnvOpen((v) => !v)}
-                  title={envOpen ? 'Collapse environment variables' : 'Expand to paste environment variables'}
-                  className="flex items-center gap-1 text-[11px] uppercase tracking-wider text-fg-subtle hover:text-fg-muted"
+                  className="flex w-full items-center gap-1.5 rounded-md border border-border bg-surface px-2 py-1.5 text-[11px] text-fg-muted hover:text-fg"
                 >
                   {envOpen ? <ChevronDown className="h-3 w-3" /> : <ChevronRight className="h-3 w-3" />}
-                  Environment variables (optional)
+                  Paste a .env blob
                   {envKeyCount > 0 && (
-                    <span className="ml-1 normal-case tracking-normal text-fg-muted">
-                      · {envKeyCount} key{envKeyCount === 1 ? '' : 's'}
+                    <span className="ml-auto text-fg-muted">
+                      {envKeyCount} key{envKeyCount === 1 ? '' : 's'}
                     </span>
                   )}
                 </button>
@@ -256,13 +403,12 @@ export function AddAppDrawer({
                     <textarea
                       value={envText}
                       onChange={(e) => setEnvText(e.target.value)}
-                      rows={5}
+                      rows={6}
                       placeholder={'DATABASE_URL=postgres://…\nAPI_KEY=…\n# comments allowed'}
                       className="w-full resize-none rounded-md border border-border bg-surface px-2 py-1 font-mono text-xs text-fg"
                     />
                     <p className="mt-1 text-[10px] text-fg-subtle">
-                      Applied at the app scope. SECRET/TOKEN/PASSWORD/KEY/PRIVATE keys are
-                      auto-masked. You can edit these later under Env.
+                      SECRET/TOKEN/PASSWORD/KEY/PRIVATE keys are auto-masked. Edit later under Env.
                     </p>
                   </div>
                 )}
@@ -270,19 +416,18 @@ export function AddAppDrawer({
             </>
           )}
         </div>
+
         <footer className="flex items-center justify-end gap-2 border-t border-border px-4 py-2">
-          <button
-            onClick={onCancel}
-            className="rounded-md px-2.5 py-1 text-sm text-fg-muted hover:bg-surface"
-          >
+          <button onClick={onCancel} className="rounded-md px-2.5 py-1 text-sm text-fg-muted hover:bg-surface">
             Cancel
           </button>
           <button
             onClick={() => void add()}
-            disabled={adding || !detection}
-            className="rounded-md bg-accent px-2.5 py-1 text-sm text-accent-fg hover:bg-accent/90 disabled:opacity-50"
+            disabled={!ready || adding}
+            title={ready ? undefined : 'Pick a valid, not-yet-added folder first'}
+            className="rounded-md bg-accent px-3 py-1 text-sm text-accent-fg hover:bg-accent/90 disabled:opacity-50"
           >
-            {adding ? 'Adding…' : 'Add'}
+            {adding ? 'Adding…' : 'Add app'}
           </button>
         </footer>
       </div>
@@ -290,6 +435,20 @@ export function AddAppDrawer({
   );
 }
 
+function SectionHeader({ n, title, desc }: { n: number; title: string; desc: string }): JSX.Element {
+  return (
+    <div className="mb-2">
+      <div className="flex items-center gap-2">
+        <span className="inline-grid h-4 w-4 place-items-center rounded-full bg-elevated text-[10px] font-semibold text-fg-muted">
+          {n}
+        </span>
+        <span className="text-sm font-medium text-fg">{title}</span>
+      </div>
+      <p className="mt-0.5 pl-6 text-[11px] leading-snug text-fg-subtle">{desc}</p>
+    </div>
+  );
+}
+
 function Row({
   label,
   hint,
@@ -308,16 +467,13 @@ function Row({
   );
 }
 
-function Detected({ label, value }: { label: string; value: string }): JSX.Element {
+function Found({ label, value }: { label: string; value: string }): JSX.Element {
   return (
-    <div>
+    <div className="min-w-0">
       <div className="text-[10px] uppercase tracking-wider text-fg-subtle">{label}</div>
-      <div className="mt-0.5 truncate font-mono text-xs text-fg">{value}</div>
+      <div className="mt-0.5 truncate font-mono text-xs text-fg" title={value}>
+        {value}
+      </div>
     </div>
   );
 }
-
-function basename(p: string): string {
-  const i = p.lastIndexOf('/');
-  return i === -1 ? p : p.slice(i + 1);
-}
diff --git a/src/renderer/components/AppConfigDrawer.tsx b/src/renderer/components/AppConfigDrawer.tsx
index bbf8451..5f154cd 100644
--- a/src/renderer/components/AppConfigDrawer.tsx
+++ b/src/renderer/components/AppConfigDrawer.tsx
@@ -6,8 +6,11 @@ import { ErrorBanner } from './ErrorBanner';
 import { NodeVersionPicker } from './NodeVersionPicker';
 import { TagInput } from './TagInput';
 import { FolderSelect } from './FolderSelect';
+import { useDialog } from '../hooks/useDialog';
 import { cn } from '../lib/cn';
 
+const TITLE_ID = 'app-config-drawer-title';
+
 const DEFAULT_GLOBS = ['src/**/*.{ts,tsx,js,jsx,mjs,cjs}'];
 
 export function AppConfigDrawer({
@@ -20,6 +23,7 @@ export function AppConfigDrawer({
   const apps = useStore((s) => s.apps);
   const upsertApp = useStore((s) => s.upsertApp);
   const [name, setName] = useState(app.name);
+  const [autoStart, setAutoStart] = useState(app.autoStart);
   const [autoRestart, setAutoRestart] = useState(app.autoRestartOnChange);
   const [globsText, setGlobsText] = useState((app.watchGlobs.length ? app.watchGlobs : DEFAULT_GLOBS).join('\n'));
   const [tags, setTags] = useState<string[]>(app.tags);
@@ -28,8 +32,12 @@ export function AppConfigDrawer({
   const [error, setError] = useState<string | null>(null);
   const [saving, setSaving] = useState(false);
 
+  // Focus trap + Escape-to-close + focus restore; aria wires the heading as the dialog label.
+  const { dialogProps } = useDialog(onClose, TITLE_ID);
+
   useEffect(() => {
     setName(app.name);
+    setAutoStart(app.autoStart);
     setAutoRestart(app.autoRestartOnChange);
     setGlobsText((app.watchGlobs.length ? app.watchGlobs : DEFAULT_GLOBS).join('\n'));
     setTags(app.tags);
@@ -38,6 +46,7 @@ export function AppConfigDrawer({
   }, [
     app.id,
     app.name,
+    app.autoStart,
     app.autoRestartOnChange,
     app.watchGlobs,
     app.tags,
@@ -67,6 +76,7 @@ export function AppConfigDrawer({
         id: app.id,
         patch: {
           name: name.trim() || app.name,
+          autoStart,
           autoRestartOnChange: autoRestart,
           watchGlobs,
           tags,
@@ -85,9 +95,14 @@ export function AppConfigDrawer({
 
   return (
     <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
-      <div className="flex h-full max-h-[640px] w-full max-w-2xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+      <div
+        {...dialogProps}
+        className="flex h-full max-h-[640px] w-full max-w-2xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
-          <h2 className="text-sm font-medium text-fg">App settings — {app.name}</h2>
+          <h2 id={TITLE_ID} className="text-sm font-medium text-fg">
+            App settings - {app.name}
+          </h2>
           <button
             onClick={onClose}
             className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
@@ -108,6 +123,10 @@ export function AppConfigDrawer({
               <input
                 value={name}
                 onChange={(e) => setName(e.target.value)}
+                // Cap at 60 (matches the folder-name limit) so a pasted path or scoped
+                // package name can't overflow the sidebar / ⌘P switcher downstream.
+                maxLength={60}
+                data-autofocus
                 className="w-72 rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
               />
             </Field>
@@ -135,26 +154,49 @@ export function AppConfigDrawer({
 
             <div className="border-t border-border pt-5">
               <Field
-                label="Auto-restart on file change"
-                description="When enabled, file changes matching the globs below restart the running app (debounced 500ms). Off by default."
+                label="Start automatically when DevHarbor launches"
+                description="When enabled, this app's default task starts on app launch (after a short stagger). Off by default."
               >
                 <button
-                  onClick={() => setAutoRestart((v) => !v)}
+                  onClick={() => setAutoStart((v) => !v)}
                   className={cn(
                     'inline-flex h-5 w-9 items-center rounded-full transition-colors',
-                    autoRestart ? 'bg-accent' : 'bg-elevated'
+                    autoStart ? 'bg-accent' : 'bg-elevated'
                   )}
-                  aria-pressed={autoRestart}
+                  aria-pressed={autoStart}
                 >
                   <span
                     className={cn(
                       'inline-block h-4 w-4 rounded-full bg-white transition-transform',
-                      autoRestart ? 'translate-x-4' : 'translate-x-0.5'
+                      autoStart ? 'translate-x-4' : 'translate-x-0.5'
                     )}
                   />
                 </button>
               </Field>
 
+              <div className="mt-5">
+                <Field
+                  label="Auto-restart on file change"
+                  description="When enabled, file changes matching the globs below restart the running app (debounced 500ms). Off by default."
+                >
+                  <button
+                    onClick={() => setAutoRestart((v) => !v)}
+                    className={cn(
+                      'inline-flex h-5 w-9 items-center rounded-full transition-colors',
+                      autoRestart ? 'bg-accent' : 'bg-elevated'
+                    )}
+                    aria-pressed={autoRestart}
+                  >
+                    <span
+                      className={cn(
+                        'inline-block h-4 w-4 rounded-full bg-white transition-transform',
+                        autoRestart ? 'translate-x-4' : 'translate-x-0.5'
+                      )}
+                    />
+                  </button>
+                </Field>
+              </div>
+
               <div className="mt-3">
                 <div className="mb-1 text-[11px] uppercase tracking-wider text-fg-subtle">
                   Watch globs (one per line, relative to project path)
diff --git a/src/renderer/components/AppDetail.tsx b/src/renderer/components/AppDetail.tsx
index b767255..441fc78 100644
--- a/src/renderer/components/AppDetail.tsx
+++ b/src/renderer/components/AppDetail.tsx
@@ -15,6 +15,8 @@ import { AppConfigDrawer } from './AppConfigDrawer';
 import { LogSearchView } from './LogSearchView';
 import { OpenInMenu } from './OpenInMenu';
 import { cn } from '../lib/cn';
+import { isLive as isLiveState, isActive, basename } from '../lib/processState';
+import { invokeOrToast } from '../lib/invoke';
 
 const EMPTY_TASKS: Task[] = [];
 
@@ -79,7 +81,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
   }, [running]);
 
   const state = appState ?? 'idle';
-  const isLive = state === 'running' || state === 'starting' || state === 'exiting';
+  const isLive = isLiveState(state);
 
   const start = async (): Promise<void> => {
     setBusy('start');
@@ -188,7 +190,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
 
   // One entry per **registered** task (not just running) so the header height
   // is invariant across start/stop. Running tasks show their detected port;
-  // idle tasks show a muted "—" placeholder. Multi-port tasks fan out.
+  // idle tasks show a muted "-" placeholder. Multi-port tasks fan out.
   const taskPortEntries: {
     taskId: string;
     taskName: string;
@@ -199,7 +201,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
     .filter((t) => t.enabled)
     .sort((a, b) => a.name.localeCompare(b.name));
   for (const t of orderedTasksForPorts) {
-    const isRunning = taskState[t.id] === 'running' || taskState[t.id] === 'starting';
+    const isRunning = isActive(taskState[t.id]);
     const ports = isRunning ? taskPorts[t.id] ?? [] : [];
     if (ports.length === 0) {
       taskPortEntries.push({
@@ -225,19 +227,21 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
       <div className="titlebar-drag h-10 shrink-0" />
       <header className="titlebar-no-drag border-b border-border px-6 py-3">
         <div className="flex items-center gap-2.5">
-          {/* Single status dot — green+glow when running, muted otherwise (was
+          {/* Single status dot - green+glow when running, muted otherwise (was
               color-identity dot + separate status dot). */}
           <StatusDot state={state} />
-          <h1 className="text-base font-medium text-fg">{app.name}</h1>
-          <span className="text-xs text-fg-subtle">
+          <h1 className="min-w-0 flex-1 truncate text-base font-medium text-fg" title={app.name}>
+            {app.name}
+          </h1>
+          <span className="shrink-0 text-xs text-fg-subtle">
             {labelForState(state)}
             {uptime ? ` · ${uptime}` : ''}
           </span>
-          <div className="ml-auto flex items-center gap-2">
-            {/* Script picker dropdown removed Phase 7 round 2 — single-task and multi-task
+          <div className="ml-auto flex shrink-0 items-center gap-2">
+            {/* Script picker dropdown removed Phase 7 round 2 - single-task and multi-task
                 apps now share the exact same header. Editing a task's script lives in
                 the task tab right-click → Edit (consistent across task counts). */}
-            {/* Secondary utilities — uniform icon-only buttons with tooltips. */}
+            {/* Secondary utilities - uniform icon-only buttons with tooltips. */}
             <OpenInMenu path={app.path} />
             <IconButton
               onClick={() => {
@@ -245,18 +249,19 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
                 setEnvOpen(true);
               }}
               title="Environment variables"
+              aria-label="Environment variables"
             >
               <KeyRound className="h-4 w-4" />
             </IconButton>
-            {/* "Tasks" header button removed Phase 7 — the always-on task strip below
+            {/* "Tasks" header button removed Phase 7 - the always-on task strip below
                 carries a "Manage tasks" button, which avoids two doors to the same UI. */}
-            <IconButton onClick={() => setConfigOpen(true)} title="App settings">
+            <IconButton onClick={() => setConfigOpen(true)} title="App settings" aria-label="App settings">
               <Cog className="h-4 w-4" />
             </IconButton>
 
             <Divider />
 
-            {/* Primary lifecycle — the one filled button (or Restart + Stop when running).
+            {/* Primary lifecycle - the one filled button (or Restart + Stop when running).
                 Shared min-w so the labels don't change the button size between states. */}
             {!isLive ? (
               <Button
@@ -292,11 +297,12 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
 
             <Divider />
 
-            {/* Destructive — isolated after a divider; red on hover. */}
+            {/* Destructive - isolated after a divider; red on hover. */}
             <IconButton
               onClick={onRemove}
               disabled={busy != null}
               title="Remove from DevHarbor"
+              aria-label="Remove from DevHarbor"
               danger
             >
               <Trash2 className="h-4 w-4" />
@@ -325,7 +331,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
           )}
         </div>
         {/* Port row: always rendered with reserved height so the header doesn't
-            reflow when an app starts/stops. Idle tasks render a muted "—" chip. */}
+            reflow when an app starts/stops. Idle tasks render a muted "-" chip. */}
         <div className="mt-2 flex min-h-[26px] flex-wrap items-center gap-1.5">
           {taskPortEntries.map((entry) => (
             <PortChip
@@ -350,7 +356,9 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
             </span>
             <Button
               onClick={() => {
-                void window.api.invoke('proc:restart', { id: app.id });
+                // Fire-and-forget: route through invokeOrToast so a restart failure
+                // surfaces as a toast instead of a silent unhandled rejection.
+                void invokeOrToast('proc:restart', { id: app.id }, { context: 'Restart failed' });
                 dismissEnvFileChanges(app.id);
               }}
               title="Restart the app to load the changed env files"
@@ -372,7 +380,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
         )}
       </header>
 
-      {/* Always-on task strip (Phase 7). Single-task apps see one tab + Manage button —
+      {/* Always-on task strip (Phase 7). Single-task apps see one tab + Manage button - 
           gives single-task apps the same right-click affordances as multi-task. Zero-task
           apps get a minimal placeholder strip with an "Add task" entry point so the user
           isn't stranded. */}
@@ -456,7 +464,7 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
         <div className="flex-1 overflow-hidden p-2">
           {!activeTaskId ? (
             <div className="flex h-full items-center justify-center text-sm text-fg-subtle">
-              No tasks. Click "Tasks" above to add one.
+              No tasks yet. Use "Add task" in the strip above.
             </div>
           ) : logsMode === 'filter' ? (
             <LogSearchView taskId={activeTaskId} />
@@ -490,11 +498,6 @@ export function AppDetail({ app }: { app: App }): JSX.Element {
   );
 }
 
-function basename(p: string): string {
-  const i = p.lastIndexOf('/');
-  return i === -1 ? p : p.slice(i + 1);
-}
-
 function ModePill({
   active,
   onClick,
diff --git a/src/renderer/components/CommandPalette.tsx b/src/renderer/components/CommandPalette.tsx
index 2fc5de0..843cb87 100644
--- a/src/renderer/components/CommandPalette.tsx
+++ b/src/renderer/components/CommandPalette.tsx
@@ -7,22 +7,29 @@ import {
   Settings,
   Boxes,
   FolderPlus,
+  FolderInput,
+  Search,
   ArrowRight
 } from 'lucide-react';
 import type { AppId, TaskId } from '@shared/types';
 import { useStore } from '../store/store';
+import { invokeOrToast } from '../lib/invoke';
 import './CommandPalette.css';
 
 export function CommandPalette({
   open,
   onOpenChange,
   onAddApp,
-  onOpenSettings
+  onOpenSettings,
+  onImportProjects,
+  onSearchLogs
 }: {
   open: boolean;
   onOpenChange: (v: boolean) => void;
   onAddApp: () => void;
   onOpenSettings: () => void;
+  onImportProjects: () => void;
+  onSearchLogs: () => void;
 }): JSX.Element | null {
   const apps = useStore((s) => s.apps);
   const appState = useStore((s) => s.appState);
@@ -74,20 +81,28 @@ export function CommandPalette({
     close();
   };
 
-  const startApp = async (id: AppId): Promise<void> => {
-    void window.api.invoke('proc:start', { id });
+  // The palette closes the instant an action is picked, so a rejected lifecycle invoke
+  // (zero enabled tasks, missing Node version, moved folder) would otherwise vanish with no
+  // surface. Route every invoke through invokeOrToast so failures land as a toast post-close.
+  const startApp = (id: AppId): void => {
+    void invokeOrToast('proc:start', { id }, { context: 'Start failed' });
     close();
   };
-  const stopApp = async (id: AppId): Promise<void> => {
-    void window.api.invoke('proc:stop', { id });
+  const stopApp = (id: AppId): void => {
+    void invokeOrToast('proc:stop', { id }, { context: 'Stop failed' });
     close();
   };
-  const restartApp = async (id: AppId): Promise<void> => {
-    void window.api.invoke('proc:restart', { id });
+  const restartApp = (id: AppId): void => {
+    void invokeOrToast('proc:restart', { id }, { context: 'Restart failed' });
     close();
   };
-  const stopTask = async (id: TaskId): Promise<void> => {
-    void window.api.invoke('task:stop', { id });
+  const stopTask = (id: TaskId): void => {
+    void invokeOrToast('task:stop', { id }, { context: 'Stop failed' });
+    close();
+  };
+  // "Stop all" fans out concurrently; each failure toasts independently.
+  const stopAll = (): void => {
+    for (const a of running) void invokeOrToast('proc:stop', { id: a.id }, { context: 'Stop failed' });
     close();
   };
 
@@ -150,7 +165,7 @@ export function CommandPalette({
                   <Command.Item
                     key={`stop-${a.id}`}
                     value={`stop ${a.name}`}
-                    onSelect={() => void stopApp(a.id as AppId)}
+                    onSelect={() => stopApp(a.id as AppId)}
                     className="cmdk-item"
                   >
                     <Square className="h-3.5 w-3.5 text-danger-strong" />
@@ -163,7 +178,7 @@ export function CommandPalette({
                   <Command.Item
                     key={`restart-${a.id}`}
                     value={`restart ${a.name}`}
-                    onSelect={() => void restartApp(a.id as AppId)}
+                    onSelect={() => restartApp(a.id as AppId)}
                     className="cmdk-item"
                   >
                     <RotateCw className="h-3.5 w-3.5 text-warn-strong" />
@@ -181,7 +196,7 @@ export function CommandPalette({
                   <Command.Item
                     key={`stop-task-${t.taskId}`}
                     value={`stop task ${t.appName} ${t.taskName}`}
-                    onSelect={() => void stopTask(t.taskId)}
+                    onSelect={() => stopTask(t.taskId)}
                     className="cmdk-item"
                   >
                     <Square className="h-3.5 w-3.5 text-danger-strong" />
@@ -202,7 +217,7 @@ export function CommandPalette({
                     <Command.Item
                       key={`start-${a.id}`}
                       value={`start ${a.name}`}
-                      onSelect={() => void startApp(a.id as AppId)}
+                      onSelect={() => startApp(a.id as AppId)}
                       className="cmdk-item"
                     >
                       <Play className="h-3.5 w-3.5 text-success-strong" />
@@ -237,6 +252,29 @@ export function CommandPalette({
                 <FolderPlus className="h-3.5 w-3.5 text-fg-muted" />
                 <span className="flex-1">Add app…</span>
               </Command.Item>
+              <Command.Item
+                value="import projects scan folder bulk register"
+                onSelect={() => {
+                  close();
+                  onImportProjects();
+                }}
+                className="cmdk-item"
+              >
+                <FolderInput className="h-3.5 w-3.5 text-fg-muted" />
+                <span className="flex-1">Import projects…</span>
+              </Command.Item>
+              <Command.Item
+                value="search all logs global grep find"
+                onSelect={() => {
+                  close();
+                  onSearchLogs();
+                }}
+                className="cmdk-item"
+              >
+                <Search className="h-3.5 w-3.5 text-fg-muted" />
+                <span className="flex-1">Search all logs…</span>
+                <kbd className="rounded bg-elevated px-1 text-[10px] text-fg-subtle">⌘⇧F</kbd>
+              </Command.Item>
               <Command.Item
                 value="settings preferences theme refresh"
                 onSelect={() => {
@@ -251,10 +289,7 @@ export function CommandPalette({
               {running.length > 0 && (
                 <Command.Item
                   value="stop all stop everything"
-                  onSelect={() => {
-                    for (const a of running) void window.api.invoke('proc:stop', { id: a.id });
-                    close();
-                  }}
+                  onSelect={stopAll}
                   className="cmdk-item"
                 >
                   <Square className="h-3.5 w-3.5 text-danger-strong" />
diff --git a/src/renderer/components/ContextMenu.tsx b/src/renderer/components/ContextMenu.tsx
index fbd1ae1..414612a 100644
--- a/src/renderer/components/ContextMenu.tsx
+++ b/src/renderer/components/ContextMenu.tsx
@@ -15,11 +15,22 @@ interface State {
   x: number;
   y: number;
   items: MenuItem[];
+  /**
+   * The element that opened the menu. Focus returns here on close so keyboard
+   * users aren't dumped at the top of the document. Held outside React state as
+   * a plain ref-like field since it never needs to trigger a re-render.
+   */
+  trigger: HTMLElement | null;
 }
 
 /**
  * Tiny portal-based context menu. Use `useContextMenu()` to open it from any onContextMenu.
  * Renders into document.body so it isn't clipped by overflow:hidden parents.
+ *
+ * Accessibility (11.2): the portal is a real ARIA menu - role="menu" on the
+ * container, role="menuitem" on each entry. Opening moves focus to the first
+ * enabled item; ArrowUp/Down (wrapping), Home/End, Enter/Space and Escape/Tab
+ * are all handled, and focus is restored to the trigger on close.
  */
 export function useContextMenu(): {
   open: (e: React.MouseEvent, items: MenuItem[]) => void;
@@ -27,15 +38,35 @@ export function useContextMenu(): {
 } {
   const [state, setState] = useState<State | null>(null);
   const ref = useRef<HTMLDivElement | null>(null);
+  /** Live refs to each rendered menuitem button, in render order, for roving focus. */
+  const itemRefs = useRef<(HTMLButtonElement | null)[]>([]);
+
+  // Restore focus to the trigger when the menu closes. Kept separate from the
+  // open() closure so it fires for every close path (outside-click, Escape,
+  // item activation) rather than only the one that knew about the trigger.
+  const triggerRef = useRef<HTMLElement | null>(null);
+
+  const close = (restoreFocus = true): void => {
+    const t = triggerRef.current;
+    setState(null);
+    // Defer so the portal has unmounted before we move focus back; otherwise the
+    // focus can land on the trigger and immediately be stolen by unmount churn.
+    // Keyboard closes restore focus to the trigger; an outside CLICK must not - the
+    // user just focused something else (e.g. the filter input) and yanking focus
+    // back would leave them typing into nothing.
+    if (t && restoreFocus) requestAnimationFrame(() => t.focus());
+  };
 
   useEffect(() => {
     if (!state) return;
-    const close = (): void => setState(null);
     const onKey = (e: KeyboardEvent): void => {
-      if (e.key === 'Escape') close();
+      if (e.key === 'Escape') {
+        e.preventDefault();
+        close();
+      }
     };
     const onClick = (e: MouseEvent): void => {
-      if (ref.current && !ref.current.contains(e.target as Node)) close();
+      if (ref.current && !ref.current.contains(e.target as Node)) close(false);
     };
     window.addEventListener('keydown', onKey);
     window.addEventListener('mousedown', onClick);
@@ -45,17 +76,110 @@ export function useContextMenu(): {
     };
   }, [state]);
 
+  // Move focus to the first enabled item once the menu has rendered.
+  useEffect(() => {
+    if (!state) return;
+    const first = itemRefs.current.find((el) => el && !el.disabled);
+    first?.focus();
+  }, [state]);
+
   const open = (e: React.MouseEvent, items: MenuItem[]): void => {
     e.preventDefault();
     e.stopPropagation();
     if (items.length === 0) return;
-    setState({ x: e.clientX, y: e.clientY, items });
+    // Anchor to the trigger's bounding rect for keyboard/click opens (no real
+    // cursor position), but honour the cursor for genuine right-clicks so the
+    // menu still appears under the pointer.
+    const triggerEl = e.currentTarget as HTMLElement;
+    const isPointer = e.type === 'contextmenu' && (e.clientX !== 0 || e.clientY !== 0);
+    let x = e.clientX;
+    let y = e.clientY;
+    if (!isPointer && triggerEl) {
+      const r = triggerEl.getBoundingClientRect();
+      x = r.left;
+      y = r.bottom + 2;
+    }
+    triggerRef.current = triggerEl ?? null;
+    setState({ x, y, items, trigger: triggerEl ?? null });
+  };
+
+  /** Roving focus across enabled items; `dir` is +1 (down) or -1 (up). */
+  const focusStep = (fromIndex: number, dir: 1 | -1): void => {
+    const els = itemRefs.current;
+    const n = els.length;
+    if (n === 0) return;
+    for (let step = 1; step <= n; step++) {
+      const i = (((fromIndex + dir * step) % n) + n) % n;
+      const el = els[i];
+      if (el && !el.disabled) {
+        el.focus();
+        return;
+      }
+    }
   };
 
+  const focusEdge = (dir: 1 | -1): void => {
+    const els = itemRefs.current;
+    if (dir === 1) {
+      for (let i = 0; i < els.length; i++) {
+        if (els[i] && !els[i]!.disabled) return void els[i]!.focus();
+      }
+    } else {
+      for (let i = els.length - 1; i >= 0; i--) {
+        if (els[i] && !els[i]!.disabled) return void els[i]!.focus();
+      }
+    }
+  };
+
+  const activate = (item: MenuItem): void => {
+    if (item.disabled) return;
+    close();
+    item.onSelect();
+  };
+
+  const onMenuKeyDown = (e: React.KeyboardEvent, index: number, item: MenuItem): void => {
+    switch (e.key) {
+      case 'ArrowDown':
+        e.preventDefault();
+        focusStep(index, 1);
+        break;
+      case 'ArrowUp':
+        e.preventDefault();
+        focusStep(index, -1);
+        break;
+      case 'Home':
+        e.preventDefault();
+        focusEdge(1);
+        break;
+      case 'End':
+        e.preventDefault();
+        focusEdge(-1);
+        break;
+      case 'Enter':
+      case ' ':
+        e.preventDefault();
+        activate(item);
+        break;
+      case 'Tab':
+        // Tab leaves the menu - close and restore focus rather than trapping
+        // the user inside the portal.
+        e.preventDefault();
+        close();
+        break;
+      // Escape is handled at the window level so it also works mid-render.
+    }
+  };
+
+  // Reset the per-render ref array so stale entries from a previous menu don't
+  // linger and break roving focus / first-item focus.
+  itemRefs.current = [];
+
   const node = state
     ? createPortal(
         <div
           ref={ref}
+          role="menu"
+          aria-orientation="vertical"
           style={{ left: state.x, top: state.y }}
           className="fixed z-[100] min-w-[180px] rounded-md border border-border bg-base py-1 shadow-2xl"
           onClick={(e) => e.stopPropagation()}
@@ -64,20 +188,24 @@ export function useContextMenu(): {
             const showSep = item.separatorBefore && i > 0;
             return (
               <div key={i}>
-                {showSep && <div className="my-1 border-t border-border" />}
+                {showSep && <div className="my-1 border-t border-border" role="separator" />}
                 <button
-                  disabled={item.disabled}
-                  onClick={() => {
-                    if (item.disabled) return;
-                    setState(null);
-                    item.onSelect();
+                  ref={(el) => {
+                    itemRefs.current[i] = el;
                   }}
+                  role="menuitem"
+                  tabIndex={-1}
+                  disabled={item.disabled}
+                  aria-disabled={item.disabled || undefined}
+                  onClick={() => activate(item)}
+                  onKeyDown={(e) => onMenuKeyDown(e, i, item)}
                   className={cn(
-                    'flex w-full items-center gap-2 px-3 py-1.5 text-left text-xs',
+                    'flex w-full items-center gap-2 px-3 py-1.5 text-left text-xs outline-none',
+                    'focus-visible:bg-surface',
                     item.disabled
                       ? 'text-fg-subtle'
                       : item.danger
-                      ? 'text-danger-fg hover:bg-danger-bg'
+                      ? 'text-danger-fg hover:bg-danger-bg focus-visible:bg-danger-bg'
                       : 'text-fg hover:bg-surface'
                   )}
                 >
diff --git a/src/renderer/components/CrashPin.tsx b/src/renderer/components/CrashPin.tsx
index 3ad3fd9..0957f13 100644
--- a/src/renderer/components/CrashPin.tsx
+++ b/src/renderer/components/CrashPin.tsx
@@ -1,6 +1,40 @@
-import { useEffect, useState } from 'react';
-import { AlertTriangle, RotateCw, X } from 'lucide-react';
+import { useEffect, useMemo, useState } from 'react';
+import { AlertTriangle, Plug, RotateCw, X } from 'lucide-react';
 import type { TaskId } from '@shared/types';
+import { useStore } from '../store/store';
+
+/**
+ * Scan crashed-task output for an "address already in use" signal and, when
+ * present, recover the offending port. Node/Vite/webpack/etc. all surface this
+ * differently (`EADDRINUSE`, `Error: listen EADDRINUSE: address already in use
+ * :::3000`, `address already in use`, `port 3000 is already in use`), so we
+ * accept any of those phrasings and then look for a port number near the match.
+ *
+ * Returns `null` when no port-conflict signal is found so the caller can render
+ * the pin exactly as before - this enrichment is purely additive.
+ */
+function detectPortConflict(text: string): { port: number | null } | null {
+  const signal = text.match(/EADDRINUSE|address already in use/i);
+  if (!signal || signal.index == null) return null;
+
+  // Anchor extraction to the CONFLICT LINE (plus the next line for wrapped messages) - the
+  // full 200-line tail is littered with other `:NN` tokens (timestamps, stack frames,
+  // unrelated URLs) that a whole-text scan would happily report as "the" port.
+  const lineStart = text.lastIndexOf('\n', signal.index) + 1;
+  let lineEnd = text.indexOf('\n', signal.index);
+  if (lineEnd !== -1) lineEnd = text.indexOf('\n', lineEnd + 1); // include one extra line
+  const near = text.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
+
+  // Prefer an explicit "port 3000" phrasing, then fall back to a `:3000`-style
+  // suffix (covers `:::3000`, `127.0.0.1:3000`, `0.0.0.0:3000`). Ports are
+  // 2-5 digits; \b keeps us from swallowing a longer trailing number.
+  const byKeyword = near.match(/port\s+(\d{2,5})\b/i);
+  const byColon = near.match(/:(\d{2,5})\b/);
+  const raw = byKeyword?.[1] ?? byColon?.[1];
+  const port = raw != null ? Number(raw) : NaN;
+
+  return { port: Number.isInteger(port) && port > 0 && port <= 65535 ? port : null };
+}
 
 export function CrashPin({
   taskId,
@@ -16,6 +50,34 @@ export function CrashPin({
   const [tail, setTail] = useState<string>('');
   const [dismissed, setDismissed] = useState<boolean>(false);
 
+  // Stable store slices only - never `?? []`/`?? {}` inside a selector (it
+  // returns a fresh reference each render and triggers an infinite re-render
+  // loop under React 18). We select the raw maps and derive below.
+  const apps = useStore((s) => s.apps);
+  const tasksByApp = useStore((s) => s.tasksByApp);
+  const taskPorts = useStore((s) => s.taskPorts);
+
+  // Detect an "address already in use" signal in the pinned output.
+  const conflict = useMemo(() => detectPortConflict(tail), [tail]);
+
+  // When we know the conflicting port, find which OTHER registered task
+  // currently holds it so we can name the culprit in the callout.
+  const holder = useMemo(() => {
+    const port = conflict?.port;
+    if (port == null) return null;
+    for (const [appId, tasks] of Object.entries(tasksByApp)) {
+      for (const t of tasks) {
+        if (t.id === taskId) continue; // skip the crashed task itself
+        const ports = taskPorts[t.id] ?? [];
+        if (ports.includes(port)) {
+          const appName = apps.find((a) => a.id === appId)?.name ?? 'Unknown app';
+          return { appName, taskName: t.name };
+        }
+      }
+    }
+    return null;
+  }, [conflict, tasksByApp, taskPorts, apps, taskId]);
+
   useEffect(() => {
     // Reset dismissal when the user switches to a different task's pin.
     setDismissed(false);
@@ -56,6 +118,19 @@ export function CrashPin({
           </button>
         </div>
       </div>
+      {conflict ? (
+        <div className="flex items-start gap-2 border-t border-danger-border bg-danger-bg/60 px-4 py-2 text-[11px]">
+          <Plug className="mt-0.5 h-3.5 w-3.5 shrink-0 text-danger-strong" />
+          <span className="text-danger-fg">
+            {conflict.port != null
+              ? `Port ${conflict.port} is already in use - another process is bound to it.`
+              : 'That address is already in use - another process is bound to this port.'}
+            {holder != null
+              ? ` Held by ${holder.appName} / ${holder.taskName}.`
+              : ''}
+          </span>
+        </div>
+      ) : null}
       <pre className="max-h-40 overflow-auto whitespace-pre-wrap bg-base/60 px-4 py-2 font-mono text-[11px] text-fg-muted">
         {tail || '(no output captured)'}
       </pre>
diff --git a/src/renderer/components/Dashboard.tsx b/src/renderer/components/Dashboard.tsx
index 7c9cf5f..a42534e 100644
--- a/src/renderer/components/Dashboard.tsx
+++ b/src/renderer/components/Dashboard.tsx
@@ -1,11 +1,13 @@
 import { memo, useMemo, useState } from 'react';
 import { Play, Square, FileText, Filter, ArrowDownUp, ArrowDownAZ, Clock, Check } from 'lucide-react';
-import type { App, AppId, ProcessState } from '@shared/types';
+import type { App, AppId, ProcessState, Task } from '@shared/types';
 import { useStore } from '../store/store';
 import { PortChip } from './PortChip';
 import { StatusDot } from './StatusDot';
 import { useContextMenu, type MenuItem } from './ContextMenu';
 import { sortApps, type AppSortMode } from '../lib/sortApps';
+import { isLive, isActive } from '../lib/processState';
+import { invokeOrToast } from '../lib/invoke';
 import { cn } from '../lib/cn';
 
 export function Dashboard(): JSX.Element {
@@ -29,19 +31,16 @@ export function Dashboard(): JSX.Element {
     return [...s].sort((a, b) => a.localeCompare(b));
   }, [apps]);
 
-  // Sort shared with the Sidebar (store). Default 'name' is stable — cards don't reorder on
+  // Sort shared with the Sidebar (store). Default 'name' is stable - cards don't reorder on
   // state changes, so the click target stays put. 'running'/'recent' are explicit opt-ins.
-  const sortedApps = useMemo(() => {
-    const isRunning = (id: string): boolean => {
-      const st = appState[id];
-      return st === 'running' || st === 'starting' || st === 'exiting';
-    };
-    return sortApps(apps, sortMode, isRunning);
-  }, [apps, sortMode, appState]);
+  const sortedApps = useMemo(
+    () => sortApps(apps, sortMode, (id) => isLive(appState[id])),
+    [apps, sortMode, appState]
+  );
 
   const openSortMenu = (e: React.MouseEvent): void => {
     const opts: { mode: AppSortMode; label: string; icon: JSX.Element }[] = [
-      { mode: 'name', label: 'Name (A–Z)', icon: <ArrowDownAZ className="h-3.5 w-3.5" /> },
+      { mode: 'name', label: 'Name (A-Z)', icon: <ArrowDownAZ className="h-3.5 w-3.5" /> },
       { mode: 'recent', label: 'Recently used', icon: <Clock className="h-3.5 w-3.5" /> },
       { mode: 'running', label: 'Running first', icon: <Play className="h-3.5 w-3.5" /> }
     ];
@@ -61,15 +60,11 @@ export function Dashboard(): JSX.Element {
   );
 
   const running = useMemo(
-    () =>
-      visibleApps.filter((a) => {
-        const st = appState[a.id];
-        return st === 'running' || st === 'starting' || st === 'exiting';
-      }),
+    () => visibleApps.filter((a) => isLive(appState[a.id])),
     [visibleApps, appState]
   );
 
-  // Machine-wide aggregate across all running tasks — the dashboard's unique value
+  // Machine-wide aggregate across all running tasks - the dashboard's unique value
   // versus the sidebar (which only navigates). "How much is my machine doing right now."
   const aggregate = useMemo(() => {
     let cpu = 0;
@@ -77,8 +72,7 @@ export function Dashboard(): JSX.Element {
     let ports = 0;
     for (const a of visibleApps) {
       for (const t of tasksByApp[a.id] ?? []) {
-        const st = taskState[t.id] ?? 'idle';
-        if (st === 'running' || st === 'starting') {
+        if (isActive(taskState[t.id])) {
           cpu += taskCpu[t.id] ?? 0;
           mem += taskMemMB[t.id] ?? 0;
           ports += (taskPorts[t.id] ?? []).length;
@@ -88,8 +82,24 @@ export function Dashboard(): JSX.Element {
     return { cpu, mem, ports };
   }, [visibleApps, tasksByApp, taskState, taskCpu, taskMemMB, taskPorts]);
 
+  // Hoist the per-app task sort out of the per-tick render path. It depends only on the task
+  // registry (tasksByApp) - the names/order don't change on a 1Hz stats tick - so without this
+  // memo every card would re-run [...tasks].sort() each second. Keyed on tasksByApp alone keeps
+  // the sort cold while CPU/mem/port numbers churn.
+  const orderedTasksByApp = useMemo(() => {
+    const out: Record<string, Task[]> = {};
+    for (const id of Object.keys(tasksByApp)) {
+      out[id] = [...(tasksByApp[id] ?? [])]
+        .filter((t) => t.enabled)
+        .sort((a, b) => a.name.localeCompare(b.name));
+    }
+    return out;
+  }, [tasksByApp]);
+
   const stopAll = async (): Promise<void> => {
-    await Promise.all(running.map((a) => window.api.invoke('proc:stop', { id: a.id })));
+    await Promise.all(
+      running.map((a) => invokeOrToast('proc:stop', { id: a.id }, { context: 'Stop failed' }))
+    );
   };
 
   return (
@@ -126,9 +136,9 @@ export function Dashboard(): JSX.Element {
           )}
           <button
             onClick={openSortMenu}
-            title={`Sort apps — ${
+            title={`Sort apps - ${
               sortMode === 'name'
-                ? 'Name (A–Z)'
+                ? 'Name (A-Z)'
                 : sortMode === 'recent'
                   ? 'Recently used'
                   : 'Running first'
@@ -163,7 +173,7 @@ export function Dashboard(): JSX.Element {
           </div>
         ) : (
           <>
-            {/* Aggregate stat strip — the dashboard's "control room" identity: a glance
+            {/* Aggregate stat strip - the dashboard's "control room" identity: a glance
                 at total machine load that the (navigation-only) sidebar can't provide. */}
             <div className="mb-5 grid grid-cols-2 gap-3 sm:grid-cols-4">
               <StatTile
@@ -175,42 +185,37 @@ export function Dashboard(): JSX.Element {
               <StatTile label="Memory" value={formatMem(aggregate.mem)} />
               <StatTile
                 label="Open ports"
-                value={aggregate.ports === 0 ? '—' : String(aggregate.ports)}
+                value={aggregate.ports === 0 ? '-' : String(aggregate.ports)}
               />
             </div>
             <div className="grid grid-cols-1 gap-3 md:grid-cols-2 xl:grid-cols-3">
             {visibleApps.map((app) => {
               const tasks = tasksByApp[app.id] ?? [];
+              const orderedTasks = orderedTasksByApp[app.id] ?? [];
               const state = appState[app.id] ?? 'idle';
-              const runningTasks = tasks.filter(
-                (t) => (taskState[t.id] ?? 'idle') === 'running' || taskState[t.id] === 'starting'
-              );
+              const runningTasks = orderedTasks.filter((t) => isActive(taskState[t.id]));
               const totalCpu = runningTasks.reduce((s, t) => s + (taskCpu[t.id] ?? 0), 0);
               const totalMem = runningTasks.reduce((s, t) => s + (taskMemMB[t.id] ?? 0), 0);
               // One entry per **registered** task (not just running) so the card height
               // is invariant across start/stop. Running tasks show their detected port;
-              // idle / not-yet-bound tasks show a muted "—" placeholder. Multi-port
-              // tasks fan out into separate chips. Stable order: by task name.
+              // idle / not-yet-bound tasks show a muted "-" placeholder. Multi-port
+              // tasks fan out into separate chips. Iterates the pre-sorted orderedTasks
+              // (sort is hoisted into orderedTasksByApp, off the per-tick path).
               const taskPortEntries: {
                 taskId: string;
                 taskName: string;
                 port: number | null;
                 running: boolean;
               }[] = [];
-              const orderedTasks = [...tasks]
-                .filter((t) => t.enabled)
-                .sort((a, b) => a.name.localeCompare(b.name));
               for (const t of orderedTasks) {
-                const isRunning =
-                  (taskState[t.id] ?? 'idle') === 'running' ||
-                  taskState[t.id] === 'starting';
-                const ports = isRunning ? taskPorts[t.id] ?? [] : [];
+                const active = isActive(taskState[t.id]);
+                const ports = active ? taskPorts[t.id] ?? [] : [];
                 if (ports.length === 0) {
                   taskPortEntries.push({
                     taskId: t.id,
                     taskName: t.name,
                     port: null,
-                    running: isRunning
+                    running: active
                   });
                 } else {
                   for (const p of [...ports].sort((a, b) => a - b)) {
@@ -218,7 +223,7 @@ export function Dashboard(): JSX.Element {
                       taskId: t.id,
                       taskName: t.name,
                       port: p,
-                      running: isRunning
+                      running: active
                     });
                   }
                 }
@@ -234,8 +239,12 @@ export function Dashboard(): JSX.Element {
                   memMB={totalMem}
                   taskPortEntries={taskPortEntries}
                   onOpen={() => setSelected(app.id as AppId)}
-                  onStart={() => void window.api.invoke('proc:start', { id: app.id })}
-                  onStop={() => void window.api.invoke('proc:stop', { id: app.id })}
+                  onStart={() =>
+                    void invokeOrToast('proc:start', { id: app.id }, { context: 'Start failed' })
+                  }
+                  onStop={() =>
+                    void invokeOrToast('proc:stop', { id: app.id }, { context: 'Stop failed' })
+                  }
                 />
               );
             })}
@@ -268,7 +277,7 @@ function portsKey(entries: AppCardProps['taskPortEntries']): string {
 /**
  * Memoized so idle cards don't re-render on every ~1Hz stats tick (Dashboard re-runs each
  * tick because it subscribes to taskCpu/taskMemMB/taskPorts). The handlers are recreated
- * each render but are intentionally excluded from the comparison — they only close over the
+ * each render but are intentionally excluded from the comparison - they only close over the
  * stable app.id, so a card re-renders only when its own data actually changes.
  */
 const AppCard = memo(
@@ -295,33 +304,34 @@ function AppCardImpl({
   onStart,
   onStop
 }: AppCardProps): JSX.Element {
-  const isLive = state === 'running' || state === 'starting' || state === 'exiting';
+  const live = isLive(state);
   return (
     // Card sizes to content. Port chips always render (one per registered task) so cards
     // with the same task count align. Running apps get an inset teal left edge + lifted
-    // surface — emphasis in place, NO reorder (keeps click targets put), NO layout shift
+    // surface - emphasis in place, NO reorder (keeps click targets put), NO layout shift
     // (inset box-shadow doesn't affect geometry).
     <div
       className={cn(
         'group flex flex-col rounded-md border p-3 transition-colors',
-        isLive
+        live
           ? 'border-border-strong bg-surface/60 shadow-[inset_2px_0_0_0_rgb(var(--accent))]'
           : 'border-border bg-base/50 hover:border-border-strong'
       )}
     >
       <div className="flex items-center gap-2">
-        {/* Single status dot (green+glow when running, muted otherwise) — replaces the
+        {/* Single status dot (green+glow when running, muted otherwise) - replaces the
             old color-identity dot + separate status dot. Matches the UI reference. */}
         <StatusDot state={state} />
         <button
           onClick={onOpen}
-          className="text-sm font-medium text-fg hover:underline"
+          title={app.name}
+          className="min-w-0 flex-1 truncate text-left text-sm font-medium text-fg hover:underline"
         >
           {app.name}
         </button>
         <span
           className={cn(
-            'ml-auto font-mono text-[10px] uppercase tracking-wider',
+            'shrink-0 font-mono text-[10px] uppercase tracking-wider',
             state === 'running' ? 'text-success-strong' : 'text-fg-subtle'
           )}
         >
@@ -359,7 +369,7 @@ function AppCardImpl({
         )}
       </div>
       <div className="mt-3 flex items-center gap-1">
-        {!isLive ? (
+        {!live ? (
           <button
             onClick={onStart}
             title="Start all tasks in this app"
diff --git a/src/renderer/components/EmptyState.tsx b/src/renderer/components/EmptyState.tsx
index 190a375..d77bf6a 100644
--- a/src/renderer/components/EmptyState.tsx
+++ b/src/renderer/components/EmptyState.tsx
@@ -1,27 +1,94 @@
-import { FolderPlus } from 'lucide-react';
+import { Boxes, Play, Workflow, Layers, ScrollText } from 'lucide-react';
 
-export function EmptyState({ onAddApp }: { onAddApp: () => void }): JSX.Element {
+/**
+ * First-run / empty state. This is the natural place to teach what DevHarbor does - it's
+ * seen once, by a brand-new user - so it carries a short value prop + feature highlights,
+ * keeping the recurring Add-app flow itself lean.
+ */
+export function EmptyState({
+  onAddApp,
+  onImport
+}: {
+  onAddApp: () => void;
+  onImport?: () => void;
+}): JSX.Element {
   return (
-    <main className="flex flex-1 flex-col">
+    <main className="flex flex-1 flex-col overflow-y-auto">
       <div className="titlebar-drag h-10 shrink-0" />
-      <div className="flex flex-1 items-center justify-center">
-        <div className="max-w-md text-center">
-          <FolderPlus className="mx-auto h-10 w-10 text-fg-subtle" />
-          <h2 className="mt-3 text-base font-medium text-fg">
-            No apps registered yet
-          </h2>
-          <p className="mt-1 text-sm text-fg-subtle">
-            Add a local project folder. We'll detect the Node version, package manager,
-            and scripts automatically.
+      <div className="flex flex-1 items-center justify-center p-8">
+        <div className="w-full max-w-xl text-center">
+          <Boxes className="mx-auto h-11 w-11 text-accent" />
+          <h2 className="mt-4 text-lg font-semibold text-fg">Welcome to DevHarbor</h2>
+          <p className="mx-auto mt-1.5 max-w-md text-sm text-fg-subtle">
+            A harbor for your local dev servers. Run and monitor your Node.js projects from one
+            window. Everything stays local: no accounts, no cloud, no telemetry.
+          </p>
+
+          <div className="mx-auto mt-6 grid max-w-lg grid-cols-1 gap-3 text-left sm:grid-cols-2">
+            <Feature
+              icon={<Play className="h-4 w-4" />}
+              title="Run & monitor"
+              desc="Start, stop, and restart your dev servers, with live CPU, memory, and ports."
+            />
+            <Feature
+              icon={<Workflow className="h-4 w-4" />}
+              title="Multi-task apps"
+              desc="Apps with several services start in dependency order and wait for readiness."
+            />
+            <Feature
+              icon={<Layers className="h-4 w-4" />}
+              title="Per-project Node & env"
+              desc="Auto-switch Node versions and layer environment variables: global → app → task."
+            />
+            <Feature
+              icon={<ScrollText className="h-4 w-4" />}
+              title="Live logs &amp; ports"
+              desc="Searchable xterm logs and auto-detected ports with clickable localhost links."
+            />
+          </div>
+
+          <div className="mt-7 flex items-center justify-center gap-2">
+            <button
+              onClick={onAddApp}
+              className="rounded-md bg-accent px-4 py-2 text-sm font-medium text-accent-fg hover:bg-accent/90"
+            >
+              Add your first app
+            </button>
+            {onImport && (
+              <button
+                onClick={onImport}
+                className="rounded-md border border-border px-4 py-2 text-sm font-medium text-fg hover:bg-surface"
+              >
+                Import a folder of projects…
+              </button>
+            )}
+          </div>
+          <p className="mt-2 text-[11px] text-fg-subtle">
+            Point DevHarbor at a Node.js project folder - it detects the package manager, Node
+            version, and scripts for you.
           </p>
-          <button
-            onClick={onAddApp}
-            className="mt-5 rounded-md bg-accent px-3 py-1.5 text-sm text-accent-fg hover:bg-accent/90"
-          >
-            Add your first app
-          </button>
         </div>
       </div>
     </main>
   );
 }
+
+function Feature({
+  icon,
+  title,
+  desc
+}: {
+  icon: JSX.Element;
+  title: string;
+  desc: string;
+}): JSX.Element {
+  return (
+    <div className="rounded-md border border-border bg-base/50 p-3">
+      <div className="flex items-center gap-2 text-fg">
+        <span className="text-accent">{icon}</span>
+        <span className="text-sm font-medium">{title}</span>
+      </div>
+      <p className="mt-1 text-[11px] leading-snug text-fg-subtle">{desc}</p>
+    </div>
+  );
+}
diff --git a/src/renderer/components/EnvEditor.tsx b/src/renderer/components/EnvEditor.tsx
index efc8200..71ee5f9 100644
--- a/src/renderer/components/EnvEditor.tsx
+++ b/src/renderer/components/EnvEditor.tsx
@@ -1,16 +1,31 @@
-import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { Eye, EyeOff, Plus, Trash2, X, FileText, ClipboardPaste, ClipboardCopy } from 'lucide-react';
 import { ulid } from 'ulid';
 import type { AppId, EnvVar, Task, TaskId } from '@shared/types';
 import type { EnvFileInfo } from '@shared/ipc';
 import { parseDotEnv, isSecretKey } from '@shared/dotenv';
 import { ErrorBanner } from './ErrorBanner';
+import { useDialog } from '../hooks/useDialog';
+import { openConfirm } from './PromptModal';
 import { cn } from '../lib/cn';
 
 type Scope = 'global' | 'app' | 'task';
 
 const EMPTY: EnvVar[] = [];
 
+/**
+ * Stable serialisation of a row set for dirty comparison. Only the fields the
+ * editor lets the user mutate are included (and in a fixed order) so the result
+ * is byte-identical when nothing meaningful has changed. Row `id`s ARE included
+ * because adding/removing rows must count as dirty even if a paste happens to
+ * reproduce the same keys/values.
+ */
+function snapshotRows(rows: EnvVar[]): string {
+  return JSON.stringify(
+    rows.map((r) => [r.id, r.key, r.value, r.enabled, r.isSecret, r.note ?? ''])
+  );
+}
+
 export function EnvEditor({
   appId,
   appName,
@@ -21,7 +36,7 @@ export function EnvEditor({
 }: {
   appId: AppId;
   appName: string;
-  /** Tasks for this app — needed for the Task tab + per-task picker. */
+  /** Tasks for this app - needed for the Task tab + per-task picker. */
   tasks?: Task[];
   initialTab?: 'app' | 'global' | 'task';
   /** If provided, the editor opens on the Task tab pre-selected to this task. */
@@ -44,7 +59,31 @@ export function EnvEditor({
   const [showSecrets, setShowSecrets] = useState(false);
   const [pasteOpen, setPasteOpen] = useState(false);
   const [pasteText, setPasteText] = useState('');
+  // Transient "Saved" confirmation on the Save button (cleared after ~1.5s).
+  const [justSaved, setJustSaved] = useState(false);
 
+  // Last-fetched snapshot per scope. A scope is "dirty" when its current rows
+  // serialise differently from its snapshot - this is what gates closing the
+  // editor and switching tasks so unsaved edits are never silently discarded.
+  const [snapshots, setSnapshots] = useState<Record<Scope, string>>({
+    global: snapshotRows(EMPTY),
+    app: snapshotRows(EMPTY),
+    task: snapshotRows(EMPTY)
+  });
+
+  const dirty = useMemo(
+    () => ({
+      global: snapshotRows(globalVars) !== snapshots.global,
+      app: snapshotRows(appVars) !== snapshots.app,
+      task: snapshotRows(taskVars) !== snapshots.task
+    }),
+    [globalVars, appVars, taskVars, snapshots]
+  );
+  const anyDirty = dirty.global || dirty.app || dirty.task;
+
+  // Refresh only the GLOBAL + APP scopes (and the discovered .env file list).
+  // Kept separate from the task scope so saving one scope never clobbers
+  // unsaved edits in another (IMPROVEMENT-PLAN 5.8).
   const refresh = useCallback(async (): Promise<void> => {
     const [a, g, files] = await Promise.all([
       window.api.invoke('env:getApp', { id: appId }),
@@ -54,15 +93,40 @@ export function EnvEditor({
     setAppVars(a);
     setGlobalVars(g);
     setEnvFiles(files);
+    setSnapshots((s) => ({ ...s, app: snapshotRows(a), global: snapshotRows(g) }));
+  }, [appId]);
+
+  // Re-fetch only the GLOBAL scope (+ envFiles), leaving app/task rows untouched.
+  const refreshGlobal = useCallback(async (): Promise<void> => {
+    const [g, files] = await Promise.all([
+      window.api.invoke('env:getGlobal', undefined),
+      window.api.invoke('env:files', { id: appId })
+    ]);
+    setGlobalVars(g);
+    setEnvFiles(files);
+    setSnapshots((s) => ({ ...s, global: snapshotRows(g) }));
+  }, [appId]);
+
+  // Re-fetch only the APP scope (+ envFiles), leaving global/task rows untouched.
+  const refreshApp = useCallback(async (): Promise<void> => {
+    const [a, files] = await Promise.all([
+      window.api.invoke('env:getApp', { id: appId }),
+      window.api.invoke('env:files', { id: appId })
+    ]);
+    setAppVars(a);
+    setEnvFiles(files);
+    setSnapshots((s) => ({ ...s, app: snapshotRows(a) }));
   }, [appId]);
 
   const refreshTask = useCallback(async (): Promise<void> => {
     if (!activeTaskId) {
       setTaskVars(EMPTY);
+      setSnapshots((s) => ({ ...s, task: snapshotRows(EMPTY) }));
       return;
     }
     const t = await window.api.invoke('env:getTask', { id: activeTaskId });
     setTaskVars(t);
+    setSnapshots((s) => ({ ...s, task: snapshotRows(t) }));
   }, [activeTaskId]);
 
   useEffect(() => {
@@ -98,24 +162,75 @@ export function EnvEditor({
     setCurrent((rows) => rows.filter((r) => r.id !== id));
   };
 
+  const savedTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  useEffect(() => {
+    return () => {
+      if (savedTimer.current) clearTimeout(savedTimer.current);
+    };
+  }, []);
+
+  const flashSaved = (): void => {
+    setJustSaved(true);
+    if (savedTimer.current) clearTimeout(savedTimer.current);
+    savedTimer.current = setTimeout(() => setJustSaved(false), 1500);
+  };
+
   const onSave = async (): Promise<void> => {
     setError(null);
     try {
+      // Re-fetch ONLY the saved scope so persisting one tab never resets unsaved
+      // edits in another (IMPROVEMENT-PLAN 5.8).
       if (tab === 'app') {
         await window.api.invoke('env:setApp', { id: appId, vars: appVars });
-        await refresh();
+        await refreshApp();
       } else if (tab === 'global') {
         await window.api.invoke('env:setGlobal', { vars: globalVars });
-        await refresh();
+        await refreshGlobal();
       } else if (tab === 'task' && activeTaskId) {
         await window.api.invoke('env:setTask', { id: activeTaskId, vars: taskVars });
         await refreshTask();
       }
+      flashSaved();
     } catch (e) {
       setError((e as Error).message);
     }
   };
 
+  // Gate destructive navigation (close / overlay / task-switch) behind a
+  // discard confirmation whenever the relevant scope has unsaved edits.
+  const requestClose = useCallback(async (): Promise<void> => {
+    if (
+      anyDirty &&
+      !(await openConfirm({
+        title: 'Discard unsaved changes?',
+        description: 'You have unsaved environment-variable edits. Closing will lose them.',
+        danger: true,
+        confirmLabel: 'Discard'
+      }))
+    ) {
+      return;
+    }
+    onClose();
+  }, [anyDirty, onClose]);
+
+  // Switching the picked task silently overwrites taskVars via refreshTask, so
+  // confirm a discard first when the task scope is dirty.
+  const requestSelectTask = async (next: TaskId): Promise<void> => {
+    if (next === activeTaskId) return;
+    if (
+      dirty.task &&
+      !(await openConfirm({
+        title: 'Discard unsaved changes?',
+        description: 'You have unsaved edits for this task. Switching will lose them.',
+        danger: true,
+        confirmLabel: 'Discard'
+      }))
+    ) {
+      return;
+    }
+    setActiveTaskId(next);
+  };
+
   const applyPaste = (): void => {
     const parsed = parseDotEnv(pasteText);
     const incoming: EnvVar[] = Object.entries(parsed).map(([key, value]) => ({
@@ -126,7 +241,7 @@ export function EnvEditor({
       enabled: true,
       isSecret: isSecretKey(key)
     }));
-    // Merge by key — incoming overrides existing values, preserves disabled flag.
+    // Merge by key - incoming overrides existing values, preserves disabled flag.
     setCurrent((rows) => {
       const byKey = new Map(rows.map((r) => [r.key, r]));
       for (const r of incoming) {
@@ -146,7 +261,7 @@ export function EnvEditor({
     const lines: string[] = [
       `# Effective env for ${appName}${activeTask ? ` · task ${activeTask.name}` : ''}`,
       `# generated ${new Date().toISOString()}`,
-      `# layering (later wins): global < app < task < .env`
+      `# layering (later wins): .env files < global < app < task`
     ];
     const merged = new Map<string, { value: string; source: Source }>();
     for (const v of globalVars) {
@@ -171,7 +286,7 @@ export function EnvEditor({
   };
 
   // Compute "effective" merged env for the right-hand preview pane.
-  // When the Task tab is active, fold task vars into the merge too — gives the
+  // When the Task tab is active, fold task vars into the merge too - gives the
   // user the exact env the task will see at spawn time.
   const effective = useMemo(() => {
     const merged = new Map<string, { value: string; source: Source }>();
@@ -200,12 +315,27 @@ export function EnvEditor({
     return { globalKeys, appKeys };
   }, [globalVars, appVars]);
 
+  const titleId = 'env-editor-title';
+  // Escape-to-close routes through requestClose so the discard guard still fires.
+  const { dialogProps } = useDialog(() => void requestClose(), titleId);
+
   return (
-    <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
-      <div className="flex h-full max-h-[760px] w-full max-w-6xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+    <div
+      className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6"
+      onMouseDown={(e) => {
+        // Overlay click closes - gated behind the discard confirm.
+        if (e.target === e.currentTarget) void requestClose();
+      }}
+    >
+      <div
+        {...dialogProps}
+        className="flex h-full max-h-[760px] w-full max-w-6xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
           <div className="flex items-center gap-3">
-            <h2 className="text-sm font-medium text-fg">Environment variables</h2>
+            <h2 id={titleId} className="text-sm font-medium text-fg">
+              Environment variables
+            </h2>
             <div className="flex gap-1 rounded-md border border-border bg-surface p-0.5 text-xs">
               <button
                 onClick={() => setTab('global')}
@@ -241,7 +371,7 @@ export function EnvEditor({
             {tab === 'task' && tasks.length > 1 && (
               <select
                 value={activeTaskId ?? ''}
-                onChange={(e) => setActiveTaskId(e.target.value as TaskId)}
+                onChange={(e) => void requestSelectTask(e.target.value as TaskId)}
                 className="rounded-md border border-border bg-surface px-2 py-0.5 text-xs text-fg outline-none"
               >
                 {tasks.map((t) => (
@@ -275,7 +405,7 @@ export function EnvEditor({
               {showSecrets ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
             </button>
             <button
-              onClick={onClose}
+              onClick={() => void requestClose()}
               className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
               title="Close env editor"
               aria-label="Close"
@@ -314,9 +444,14 @@ export function EnvEditor({
                 </button>
                 <button
                   onClick={() => void onSave()}
-                  className="rounded-md bg-accent px-2 py-0.5 text-[11px] text-accent-fg hover:bg-accent/90"
+                  className={cn(
+                    'rounded-md px-2 py-0.5 text-[11px]',
+                    justSaved
+                      ? 'bg-surface text-fg-muted'
+                      : 'bg-accent text-accent-fg hover:bg-accent/90'
+                  )}
                 >
-                  Save
+                  {justSaved ? 'Saved' : 'Save'}
                 </button>
               </div>
             </div>
@@ -401,7 +536,7 @@ export function EnvEditor({
                             <input
                               value={row.note ?? ''}
                               onChange={(e) => onChangeRow(row.id, { note: e.target.value })}
-                              placeholder="—"
+                              placeholder="-"
                               className="w-full rounded bg-transparent px-1 py-0.5 text-xs text-fg-muted outline-none focus:bg-surface"
                             />
                           </td>
@@ -423,7 +558,7 @@ export function EnvEditor({
             </div>
           </div>
 
-          {/* Right side panel — effective merged env, grouped by winning scope. */}
+          {/* Right side panel - effective merged env, grouped by winning scope. */}
           <aside className="flex w-72 shrink-0 flex-col border-l border-border">
             <div className="border-b border-surface px-4 py-1.5 text-[11px] uppercase tracking-wider text-fg-subtle">
               Effective merged env
@@ -438,7 +573,7 @@ export function EnvEditor({
                 (() => {
                   // Partition winners by their source. Task on top (most specific),
                   // then App, then Global. Shadowed (overridden) lower-scope values
-                  // are intentionally not shown — the editor table itself shows them.
+                  // are intentionally not shown - the editor table itself shows them.
                   const groups: Record<
                     Source,
                     [string, { value: string; source: Source }][]
diff --git a/src/renderer/components/ErrorBoundary.tsx b/src/renderer/components/ErrorBoundary.tsx
new file mode 100644
index 0000000..a8a2498
--- /dev/null
+++ b/src/renderer/components/ErrorBoundary.tsx
@@ -0,0 +1,52 @@
+import { Component, type ErrorInfo, type ReactNode } from 'react';
+
+interface Props {
+  children: ReactNode;
+}
+interface State {
+  error: Error | null;
+}
+
+/**
+ * Top-level renderer error boundary. Without it, any uncaught render/effect exception makes
+ * React 18 unmount the whole root, leaving a permanently blank window whose only recovery is
+ * a Cmd-R the user has to know about (IMPROVEMENT-PLAN 13.2). Running apps are unaffected - 
+ * they live in the main process and survive a renderer reload.
+ */
+export class ErrorBoundary extends Component<Props, State> {
+  state: State = { error: null };
+
+  static getDerivedStateFromError(error: Error): State {
+    return { error };
+  }
+
+  componentDidCatch(error: Error, info: ErrorInfo): void {
+    console.error('[renderer] uncaught error:', error, info.componentStack);
+  }
+
+  render(): ReactNode {
+    if (this.state.error) {
+      return (
+        <div className="flex h-full w-full items-center justify-center bg-base p-8">
+          <div className="max-w-md text-center">
+            <h2 className="text-lg font-semibold text-fg">DevHarbor hit an error</h2>
+            <p className="mt-2 text-sm text-fg-subtle">
+              The interface crashed, but your running apps are unaffected - they run in the
+              background process and keep going. Reloading rebuilds the window.
+            </p>
+            <pre className="mt-3 max-h-40 overflow-auto rounded-md border border-border bg-surface p-2 text-left text-[11px] text-danger-fg">
+              {this.state.error.message}
+            </pre>
+            <button
+              onClick={() => window.location.reload()}
+              className="mt-4 rounded-md bg-accent px-4 py-2 text-sm font-medium text-accent-fg hover:bg-accent/90"
+            >
+              Reload
+            </button>
+          </div>
+        </div>
+      );
+    }
+    return this.props.children;
+  }
+}
diff --git a/src/renderer/components/FolderSelect.tsx b/src/renderer/components/FolderSelect.tsx
index 2b1339e..9bc538e 100644
--- a/src/renderer/components/FolderSelect.tsx
+++ b/src/renderer/components/FolderSelect.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import { Check, ChevronDown, FolderPlus, Plus } from 'lucide-react';
 import { cn } from '../lib/cn';
 
@@ -6,6 +6,10 @@ import { cn } from '../lib/cn';
  * Pick a folder for an app: choose "(No folder)", select an existing folder, or create a
  * new one inline. Replaces the plain text+datalist field so the available folders are
  * explicit and creating a new one is a clear, distinct action.
+ *
+ * Exposes proper listbox semantics (trigger = aria-haspopup="listbox", list = role="listbox",
+ * items = role="option" + aria-selected) and full keyboard support - ArrowUp/Down move a
+ * highlight, Enter chooses it, Escape closes - so the dropdown is usable without a pointer.
  */
 export function FolderSelect({
   value,
@@ -21,17 +25,30 @@ export function FolderSelect({
   const [open, setOpen] = useState(false);
   const [creating, setCreating] = useState(false);
   const [draft, setDraft] = useState('');
+  // Index into `entries` that the keyboard highlight currently sits on.
+  const [activeIdx, setActiveIdx] = useState(0);
   const ref = useRef<HTMLDivElement | null>(null);
+  const triggerRef = useRef<HTMLButtonElement | null>(null);
   const newInputRef = useRef<HTMLInputElement | null>(null);
+  const listId = 'folder-select-listbox';
+
+  // Flat, ordered list of selectable rows: "No folder" first, then existing folders.
+  // Drives both rendering and ArrowUp/Down navigation so the highlight maps 1:1 to rows.
+  const entries = useMemo(
+    () => [{ label: 'No folder', value: '' }, ...options.map((f) => ({ label: f, value: f }))],
+    [options]
+  );
+
+  const close = (): void => {
+    setOpen(false);
+    setCreating(false);
+    setDraft('');
+  };
 
   useEffect(() => {
     if (!open) return;
     const onClick = (e: MouseEvent): void => {
-      if (ref.current && !ref.current.contains(e.target as Node)) {
-        setOpen(false);
-        setCreating(false);
-        setDraft('');
-      }
+      if (ref.current && !ref.current.contains(e.target as Node)) close();
     };
     window.addEventListener('mousedown', onClick);
     return () => window.removeEventListener('mousedown', onClick);
@@ -41,11 +58,18 @@ export function FolderSelect({
     if (creating) requestAnimationFrame(() => newInputRef.current?.focus());
   }, [creating]);
 
+  // When opening, start the highlight on the currently-selected folder so the user
+  // lands where they already are rather than at the top.
+  useEffect(() => {
+    if (!open) return;
+    const sel = entries.findIndex((e) => e.value.toLowerCase() === value.toLowerCase());
+    setActiveIdx(sel >= 0 ? sel : 0);
+  }, [open, entries, value]);
+
   const pick = (folder: string): void => {
     onChange(folder);
-    setOpen(false);
-    setCreating(false);
-    setDraft('');
+    close();
+    triggerRef.current?.focus();
   };
 
   const commitNew = (): void => {
@@ -54,10 +78,46 @@ export function FolderSelect({
     pick(t);
   };
 
+  // Keyboard handling for the trigger button: open + move the highlight + choose.
+  // Only active while not editing the new-folder input (that input owns its own keys).
+  const onTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>): void => {
+    if (e.key === 'Escape') {
+      if (open) {
+        e.preventDefault();
+        close();
+      }
+      return;
+    }
+    if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+      e.preventDefault();
+      if (!open) {
+        setOpen(true);
+        return;
+      }
+      if (creating) return;
+      setActiveIdx((i) =>
+        e.key === 'ArrowDown'
+          ? Math.min(i + 1, entries.length - 1)
+          : Math.max(i - 1, 0)
+      );
+      return;
+    }
+    if ((e.key === 'Enter' || e.key === ' ') && open && !creating) {
+      e.preventDefault();
+      const entry = entries[activeIdx];
+      if (entry) pick(entry.value);
+    }
+  };
+
   return (
-    <div ref={ref} className="relative w-72">
+    <div ref={ref} className="relative w-72" data-escape-stop={open ? '' : undefined}>
       <button
+        ref={triggerRef}
         onClick={() => setOpen((o) => !o)}
+        onKeyDown={onTriggerKeyDown}
+        aria-haspopup="listbox"
+        aria-expanded={open}
+        aria-controls={open ? listId : undefined}
         className="flex w-full items-center justify-between gap-2 rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg hover:border-border-strong"
       >
         <span className={cn('truncate', !value && 'text-fg-subtle')}>
@@ -68,18 +128,31 @@ export function FolderSelect({
 
       {open && (
         <div className="absolute z-30 mt-1 w-full overflow-hidden rounded-md border border-border bg-base py-1 shadow-lg">
-          <Option label="No folder" selected={!value} muted onSelect={() => pick('')} />
-          {options.length > 0 && <div className="my-1 border-t border-border" />}
-          <div className="max-h-44 overflow-y-auto">
-            {options.map((f) => (
-              <Option
-                key={f}
-                label={f}
-                selected={f.toLowerCase() === value.toLowerCase()}
-                onSelect={() => pick(f)}
-              />
-            ))}
-          </div>
+          <ul id={listId} role="listbox" aria-label="Folder" className="max-h-44 overflow-y-auto">
+            <Option
+              label="No folder"
+              selected={!value}
+              active={activeIdx === 0}
+              muted
+              onSelect={() => pick('')}
+              onHover={() => setActiveIdx(0)}
+            />
+            {options.length > 0 && <li role="presentation" className="my-1 border-t border-border" />}
+            {options.map((f, i) => {
+              // +1 offsets the leading "No folder" entry so indices line up with `entries`.
+              const idx = i + 1;
+              return (
+                <Option
+                  key={f}
+                  label={f}
+                  selected={f.toLowerCase() === value.toLowerCase()}
+                  active={activeIdx === idx}
+                  onSelect={() => pick(f)}
+                  onHover={() => setActiveIdx(idx)}
+                />
+              );
+            })}
+          </ul>
           <div className="my-1 border-t border-border" />
           {creating ? (
             <div className="flex items-center gap-1 px-2 py-1">
@@ -94,8 +167,12 @@ export function FolderSelect({
                     commitNew();
                   }
                   if (e.key === 'Escape') {
+                    e.preventDefault();
+                    // First Escape backs out of the create flow; a second (handled by the
+                    // trigger when re-focused) would close the whole list.
                     setCreating(false);
                     setDraft('');
+                    triggerRef.current?.focus();
                   }
                 }}
                 placeholder="New folder name…"
@@ -126,24 +203,35 @@ export function FolderSelect({
 function Option({
   label,
   selected,
+  active,
   muted = false,
-  onSelect
+  onSelect,
+  onHover
 }: {
   label: string;
   selected: boolean;
+  /** Keyboard highlight is on this row (visual only; selection is `selected`). */
+  active: boolean;
   muted?: boolean;
   onSelect: () => void;
+  onHover: () => void;
 }): JSX.Element {
   return (
-    <button
-      onClick={onSelect}
-      className={cn(
-        'flex w-full items-center gap-2 px-3 py-1.5 text-left text-sm hover:bg-surface',
-        muted ? 'text-fg-subtle' : 'text-fg'
-      )}
-    >
-      <Check className={cn('h-3.5 w-3.5 shrink-0', selected ? 'opacity-100 text-accent' : 'opacity-0')} />
-      <span className="truncate">{label}</span>
-    </button>
+    <li role="presentation">
+      <button
+        role="option"
+        aria-selected={selected}
+        onClick={onSelect}
+        onMouseEnter={onHover}
+        className={cn(
+          'flex w-full items-center gap-2 px-3 py-1.5 text-left text-sm',
+          active ? 'bg-surface' : 'hover:bg-surface',
+          muted ? 'text-fg-subtle' : 'text-fg'
+        )}
+      >
+        <Check className={cn('h-3.5 w-3.5 shrink-0', selected ? 'opacity-100 text-accent' : 'opacity-0')} />
+        <span className="truncate">{label}</span>
+      </button>
+    </li>
   );
 }
diff --git a/src/renderer/components/GlobalLogSearch.tsx b/src/renderer/components/GlobalLogSearch.tsx
new file mode 100644
index 0000000..8937f2a
--- /dev/null
+++ b/src/renderer/components/GlobalLogSearch.tsx
@@ -0,0 +1,136 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { X, Search } from 'lucide-react';
+import type { AppId } from '@shared/types';
+import type { GlobalLogMatch } from '@shared/ipc';
+import { useDialog } from '../hooks/useDialog';
+
+const TITLE_ID = 'global-log-search-title';
+
+/**
+ * Cross-task log search (IMPROVEMENT-PLAN 14.9). With several servers running, "which service
+ * printed ECONNREFUSED?" used to mean opening each app, each task tab, and searching one at a
+ * time. LogBuffer already holds every live task's output in main, so this fans a single
+ * logs:searchAll query across all of them and groups the matches; picking one jumps to its app.
+ */
+export function GlobalLogSearch({
+  onClose,
+  onSelectApp
+}: {
+  onClose: () => void;
+  onSelectApp: (id: AppId) => void;
+}): JSX.Element {
+  const { dialogProps } = useDialog(onClose, TITLE_ID);
+  const [query, setQuery] = useState('');
+  const [matches, setMatches] = useState<GlobalLogMatch[]>([]);
+  const [searching, setSearching] = useState(false);
+  const inputRef = useRef<HTMLInputElement>(null);
+
+  // Debounced search across all live task buffers.
+  useEffect(() => {
+    const q = query.trim();
+    if (!q) {
+      setMatches([]);
+      return;
+    }
+    setSearching(true);
+    const handle = setTimeout(() => {
+      void window.api
+        .invoke('logs:searchAll', { query: q, limit: 300 })
+        .then((res) => setMatches(res))
+        .catch(() => setMatches([]))
+        .finally(() => setSearching(false));
+    }, 250);
+    return () => clearTimeout(handle);
+  }, [query]);
+
+  useEffect(() => {
+    requestAnimationFrame(() => inputRef.current?.focus());
+  }, []);
+
+  // Group matches by app + task for a scannable result list.
+  const groups = useMemo(() => {
+    const byKey = new Map<string, { appId: AppId; appName: string; taskName: string; lines: string[] }>();
+    for (const m of matches) {
+      const key = `${m.appId}::${m.taskId}`;
+      const g = byKey.get(key) ?? { appId: m.appId, appName: m.appName, taskName: m.taskName, lines: [] };
+      g.lines.push(m.line);
+      byKey.set(key, g);
+    }
+    return [...byKey.values()];
+  }, [matches]);
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-start justify-center bg-black/60 pt-[12vh]"
+      onMouseDown={(e) => {
+        if (e.target === e.currentTarget) onClose();
+      }}
+    >
+      <div
+        {...dialogProps}
+        className="flex max-h-[70vh] w-full max-w-2xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
+        <div className="flex items-center gap-2 border-b border-border px-4 py-3">
+          <Search className="h-4 w-4 shrink-0 text-fg-subtle" />
+          <h2 id={TITLE_ID} className="sr-only">
+            Search all logs
+          </h2>
+          <input
+            ref={inputRef}
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+            placeholder="Search all running tasks' logs… (regex)"
+            className="flex-1 bg-transparent text-sm text-fg placeholder:text-fg-subtle outline-none"
+          />
+          <button
+            onClick={onClose}
+            className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
+            aria-label="Close"
+          >
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+
+        <div className="flex-1 overflow-y-auto p-2">
+          {query.trim() && !searching && groups.length === 0 && (
+            <p className="px-3 py-6 text-center text-xs text-fg-subtle">No matches in any live task.</p>
+          )}
+          {!query.trim() && (
+            <p className="px-3 py-6 text-center text-xs text-fg-subtle">
+              Type to search across every running task's log buffer.
+            </p>
+          )}
+          {groups.map((g) => (
+            <div key={`${g.appId}-${g.taskName}`} className="mb-2">
+              <button
+                onClick={() => {
+                  onSelectApp(g.appId);
+                  onClose();
+                }}
+                className="flex w-full items-center gap-2 rounded px-2 py-1 text-left text-xs hover:bg-surface"
+              >
+                <span className="font-medium text-fg">{g.appName}</span>
+                <span className="text-fg-subtle">/ {g.taskName}</span>
+                <span className="ml-auto text-[10px] text-fg-subtle">{g.lines.length} match{g.lines.length === 1 ? '' : 'es'}</span>
+              </button>
+              <div className="mt-0.5 space-y-0.5 pl-2">
+                {g.lines.slice(0, 8).map((line, i) => (
+                  <div
+                    key={i}
+                    className="truncate rounded bg-elevated/40 px-2 py-0.5 font-mono text-[11px] text-fg-muted"
+                    title={line}
+                  >
+                    {line || ' '}
+                  </div>
+                ))}
+                {g.lines.length > 8 && (
+                  <div className="pl-2 text-[10px] text-fg-subtle">+{g.lines.length - 8} more…</div>
+                )}
+              </div>
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/src/renderer/components/ImportProjectsDrawer.tsx b/src/renderer/components/ImportProjectsDrawer.tsx
new file mode 100644
index 0000000..e932583
--- /dev/null
+++ b/src/renderer/components/ImportProjectsDrawer.tsx
@@ -0,0 +1,202 @@
+import { useState } from 'react';
+import { X, FolderOpen, Loader2, CheckCircle2 } from 'lucide-react';
+import type { App } from '@shared/types';
+import type { ImportCandidate } from '@shared/ipc';
+import { useDialog } from '../hooks/useDialog';
+import { invokeOrToast } from '../lib/invoke';
+import { pushToast } from './Toast';
+
+const TITLE_ID = 'import-projects-title';
+
+/**
+ * Bulk import (IMPROVEMENT-PLAN 14.5). The target user keeps 3-20 repos under one folder, but
+ * the only way to register them was the add drawer, one at a time. This shallow-scans a chosen
+ * folder for package.json projects (apps:scanFolder), shows a checklist with detected package
+ * manager + start script, and batch-registers the selected ones via apps:create - reusing all
+ * the existing detection + atomic-create machinery.
+ */
+export function ImportProjectsDrawer({
+  onClose,
+  onImported
+}: {
+  onClose: () => void;
+  onImported: (apps: App[]) => void;
+}): JSX.Element {
+  const { dialogProps } = useDialog(onClose, TITLE_ID);
+  const [dir, setDir] = useState<string | null>(null);
+  const [scanning, setScanning] = useState(false);
+  const [candidates, setCandidates] = useState<ImportCandidate[]>([]);
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [importing, setImporting] = useState(false);
+
+  const chooseFolder = async (): Promise<void> => {
+    const picked = await window.api.invoke('dialog:browse', undefined);
+    if (!picked) return;
+    setDir(picked);
+    setScanning(true);
+    setCandidates([]);
+    try {
+      const found = await window.api.invoke('apps:scanFolder', { dir: picked });
+      setCandidates(found);
+      // Pre-select everything not already registered.
+      setSelected(new Set(found.filter((c) => !c.alreadyRegistered).map((c) => c.path)));
+    } catch (e) {
+      pushToast(`Scan failed: ${(e as Error).message}`, { kind: 'error' });
+    } finally {
+      setScanning(false);
+    }
+  };
+
+  const toggle = (path: string): void =>
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(path)) next.delete(path);
+      else next.add(path);
+      return next;
+    });
+
+  const selectableCount = candidates.filter((c) => !c.alreadyRegistered).length;
+  const chosen = candidates.filter((c) => selected.has(c.path) && !c.alreadyRegistered);
+
+  const doImport = async (): Promise<void> => {
+    if (chosen.length === 0) return;
+    setImporting(true);
+    const created: App[] = [];
+    for (const c of chosen) {
+      const app = await invokeOrToast(
+        'apps:create',
+        {
+          path: c.path,
+          name: c.name,
+          packageManager: c.packageManager,
+          defaultScript: c.suggestedScript,
+          firstTask: c.suggestedScript
+            ? { name: c.suggestedScript, commandKind: 'script', script: c.suggestedScript }
+            : null
+        },
+        { context: `Import "${c.name}" failed` }
+      );
+      if (app) created.push(app);
+    }
+    setImporting(false);
+    if (created.length > 0) {
+      pushToast(`Imported ${created.length} project${created.length === 1 ? '' : 's'}.`, {
+        kind: 'success'
+      });
+      onImported(created);
+    }
+  };
+
+  return (
+    <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
+      <div
+        {...dialogProps}
+        className="flex max-h-[90vh] w-full max-w-lg flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
+        <header className="flex items-center justify-between border-b border-border px-4 py-3">
+          <h2 id={TITLE_ID} className="text-sm font-medium text-fg">
+            Import projects
+          </h2>
+          <button
+            onClick={onClose}
+            className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
+            title="Close"
+            aria-label="Close"
+          >
+            <X className="h-4 w-4" />
+          </button>
+        </header>
+
+        <div className="flex-1 overflow-y-auto p-5">
+          <p className="mb-3 text-[11px] leading-snug text-fg-subtle">
+            Point DevHarbor at a folder that contains several project folders. It scans one level
+            deep for <code className="text-fg-muted">package.json</code> projects and registers the
+            ones you pick.
+          </p>
+          <button
+            data-autofocus
+            onClick={() => void chooseFolder()}
+            className="flex w-full items-center gap-2 rounded-md border border-border bg-surface px-3 py-2 text-sm hover:border-border-strong"
+          >
+            <FolderOpen className="h-4 w-4 shrink-0 text-fg-muted" />
+            {dir ? (
+              <span className="min-w-0 flex-1 truncate text-left font-mono text-xs text-fg">{dir}</span>
+            ) : (
+              <span className="flex-1 text-left text-fg-subtle">Choose a folder of projects…</span>
+            )}
+            <span className="shrink-0 rounded bg-elevated px-1.5 py-0.5 text-[10px] text-fg-muted">
+              {dir ? 'Change' : 'Browse'}
+            </span>
+          </button>
+
+          {scanning && (
+            <p className="mt-3 flex items-center gap-2 text-sm text-fg-subtle">
+              <Loader2 className="h-4 w-4 animate-spin" /> Scanning…
+            </p>
+          )}
+
+          {!scanning && dir && candidates.length === 0 && (
+            <p className="mt-3 text-sm text-fg-subtle">No package.json projects found in that folder.</p>
+          )}
+
+          {candidates.length > 0 && (
+            <ul className="mt-3 space-y-1">
+              {candidates.map((c) => {
+                const isSel = selected.has(c.path);
+                return (
+                  <li key={c.path}>
+                    <label
+                      className={`flex cursor-pointer items-center gap-2 rounded-md border px-2.5 py-2 text-sm ${
+                        c.alreadyRegistered
+                          ? 'cursor-not-allowed border-border bg-base/50 opacity-60'
+                          : 'border-border bg-surface hover:border-border-strong'
+                      }`}
+                    >
+                      <input
+                        type="checkbox"
+                        checked={c.alreadyRegistered ? true : isSel}
+                        disabled={c.alreadyRegistered}
+                        onChange={() => toggle(c.path)}
+                        className="shrink-0 accent-accent"
+                      />
+                      <span className="min-w-0 flex-1">
+                        <span className="block truncate font-medium text-fg">{c.name}</span>
+                        <span className="block truncate text-[10px] text-fg-subtle">
+                          {c.packageManager ?? 'npm'}
+                          {c.suggestedScript ? ` · ${c.suggestedScript}` : ' · no script'}
+                        </span>
+                      </span>
+                      {c.alreadyRegistered && (
+                        <span className="flex shrink-0 items-center gap-1 text-[10px] text-fg-subtle">
+                          <CheckCircle2 className="h-3 w-3" /> added
+                        </span>
+                      )}
+                    </label>
+                  </li>
+                );
+              })}
+            </ul>
+          )}
+        </div>
+
+        <footer className="flex items-center justify-between gap-2 border-t border-border px-4 py-2">
+          <span className="text-[11px] text-fg-subtle">
+            {selectableCount > 0 ? `${chosen.length} of ${selectableCount} selected` : ''}
+          </span>
+          <div className="flex items-center gap-2">
+            <button onClick={onClose} className="rounded-md px-2.5 py-1 text-sm text-fg-muted hover:bg-surface">
+              Cancel
+            </button>
+            <button
+              onClick={() => void doImport()}
+              disabled={chosen.length === 0 || importing}
+              className="rounded-md bg-accent px-3 py-1 text-sm text-accent-fg hover:bg-accent/90 disabled:opacity-50"
+            >
+              {importing ? 'Importing…' : `Add ${chosen.length || ''} selected`.trim()}
+            </button>
+          </div>
+        </footer>
+      </div>
+    </div>
+  );
+}
diff --git a/src/renderer/components/LogSearchView.tsx b/src/renderer/components/LogSearchView.tsx
index ed06909..6da2190 100644
--- a/src/renderer/components/LogSearchView.tsx
+++ b/src/renderer/components/LogSearchView.tsx
@@ -8,9 +8,11 @@ import { cn } from '../lib/cn';
 /**
  * Virtualized, searchable view over a task's full log buffer.
  *
- * Pulls the current ring buffer via `task:readBuffer`, refreshes on every `task:log` event
- * (we just re-read; bounded buffer makes this cheap). ANSI is parsed once per line via
- * `anser` and rendered as inline spans.
+ * Pulls the current ring buffer via `task:readBuffer`. A noisy task can emit ~30 `task:log`
+ * events/sec, and each refresh re-reads (and splits) the whole multi-MB buffer - re-reading
+ * per event pins the renderer. We coalesce bursts behind a 300ms trailing throttle so the
+ * search view stays current without thrashing on every chunk. ANSI is parsed once per line
+ * via `anser` and rendered as inline spans.
  */
 export function LogSearchView({ taskId }: { taskId: TaskId }): JSX.Element {
   const [lines, setLines] = useState<string[]>([]);
@@ -18,6 +20,7 @@ export function LogSearchView({ taskId }: { taskId: TaskId }): JSX.Element {
   const [useRegex, setUseRegex] = useState(false);
   const [caseSensitive, setCaseSensitive] = useState(false);
   const listRef = useRef<ListImperativeAPI | null>(null);
+  const throttleRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   const refresh = useCallback(async (): Promise<void> => {
     const buf = await window.api.invoke('task:readBuffer', { id: taskId });
@@ -25,12 +28,28 @@ export function LogSearchView({ taskId }: { taskId: TaskId }): JSX.Element {
   }, [taskId]);
 
   useEffect(() => {
+    // Initial load is immediate; live updates are coalesced to a trailing 300ms refresh so a
+    // burst of chunks results in at most one buffer re-read per window (search stays correct
+    // because we always read the full buffer, never a delta).
     void refresh();
+    const scheduleRefresh = (): void => {
+      if (throttleRef.current) return; // a trailing refresh is already pending
+      throttleRef.current = setTimeout(() => {
+        throttleRef.current = null;
+        void refresh();
+      }, 300);
+    };
     const off = window.api.on('task:log', (e) => {
       if (e.taskId !== taskId) return;
-      void refresh();
+      scheduleRefresh();
     });
-    return off;
+    return () => {
+      off();
+      if (throttleRef.current) {
+        clearTimeout(throttleRef.current);
+        throttleRef.current = null;
+      }
+    };
   }, [taskId, refresh]);
 
   // Filter to matching lines (with their original index for the line-number column).
diff --git a/src/renderer/components/LogTerminal.tsx b/src/renderer/components/LogTerminal.tsx
index 06dad17..4e9a441 100644
--- a/src/renderer/components/LogTerminal.tsx
+++ b/src/renderer/components/LogTerminal.tsx
@@ -8,11 +8,11 @@ import { X, Search, ChevronUp, ChevronDown, Type, ArrowDown } from 'lucide-react
 import type { TaskId } from '@shared/types';
 import { cn } from '../lib/cn';
 
-const LIVE_THEME = {
+const LIVE_THEME_DARK = {
   // Chrome aligned to the zinc + teal app theme; the ANSI 16 below stay a readable,
   // vivid log palette (terminal output colors are conventionally their own set).
   background: '#141417', // a hair darker than the zinc-900 base for subtle terminal depth
-  foreground: '#e4e4e7', // zinc-200 — soft white
+  foreground: '#e4e4e7', // zinc-200 - soft white
   cursor: '#2dd4bf', // harbor teal
   selectionBackground: '#3f3f46', // zinc-700
   black: '#1a1b26',
@@ -33,6 +33,36 @@ const LIVE_THEME = {
   brightWhite: '#c0caf5'
 };
 
+const LIVE_THEME_LIGHT = {
+  // Chrome aligned to the slate + teal light app theme; ANSI 16 are darkened so
+  // colored log output stays legible against the near-white background.
+  background: '#fbfcfd', // slate-1 - matches the app's light base
+  foreground: '#11181c', // slate-12 - primary text
+  cursor: '#0d9488', // teal-600 - harbor brand at light contrast
+  selectionBackground: '#cdd2d8', // slate-6 selection wash
+  black: '#11181c',
+  red: '#c5253a',
+  green: '#207935',
+  yellow: '#946800',
+  blue: '#0552b5',
+  magenta: '#8347b9',
+  cyan: '#0e7090',
+  white: '#687076',
+  brightBlack: '#889096',
+  brightRed: '#dc3545',
+  brightGreen: '#2a9e44',
+  brightYellow: '#ad7c00',
+  brightBlue: '#0a6bd6',
+  brightMagenta: '#9c52c4',
+  brightCyan: '#1090b8',
+  brightWhite: '#11181c'
+};
+
+/** Pick the xterm theme matching the current app theme (the `light` class on `<html>`). */
+function currentTheme(): typeof LIVE_THEME_DARK {
+  return document.documentElement.classList.contains('light') ? LIVE_THEME_LIGHT : LIVE_THEME_DARK;
+}
+
 const MIN_FONT = 9;
 const MAX_FONT = 22;
 
@@ -88,7 +118,10 @@ export const LogTerminal = forwardRef<LogTerminalRef, { taskId: TaskId }>(functi
       lineHeight: 1.2,
       scrollback: 10000,
       convertEol: true,
-      theme: LIVE_THEME,
+      // Render an off-screen ARIA live region so screen readers announce log output.
+      // WebGL rendering still applies to the visible canvas; this only adds the a11y mirror.
+      screenReaderMode: true,
+      theme: currentTheme(),
       allowProposedApi: true
     });
     const fit = new FitAddon();
@@ -149,11 +182,29 @@ export const LogTerminal = forwardRef<LogTerminalRef, { taskId: TaskId }>(functi
     };
     term.onScroll(onScroll);
 
+    // Gate streaming: tell main we want live output for this task. Main only forwards
+    // `task:log` for subscribed tasks once any subscription exists; the buffer replay above
+    // (task:readBuffer) covers anything emitted before this point, so nothing is missed.
+    void window.api.invoke('task:subscribeLogs', { id: taskId });
+
     const offLog = window.api.on('task:log', (e) => {
       if (e.taskId !== taskId) return;
       term.write(e.chunk);
     });
 
+    // Keep the xterm palette in sync with the app theme. The app toggles `light`/`dark`
+    // classes on <html> (see useTheme); a MutationObserver on that attribute flips the
+    // terminal theme immediately, and `settings-changed` covers theme=system re-evaluation.
+    const applyTheme = (): void => {
+      term.options.theme = currentTheme();
+    };
+    const themeObserver = new MutationObserver(applyTheme);
+    themeObserver.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ['class']
+    });
+    window.addEventListener('settings-changed', applyTheme);
+
     const onKey = (e: KeyboardEvent): void => {
       if ((e.metaKey || e.ctrlKey) && e.key === 'f') {
         // Only intercept when focus is in the log area (or document body)
@@ -172,7 +223,11 @@ export const LogTerminal = forwardRef<LogTerminalRef, { taskId: TaskId }>(functi
     return () => {
       cancelled = true;
       window.removeEventListener('keydown', onKey);
+      window.removeEventListener('settings-changed', applyTheme);
+      themeObserver.disconnect();
       offLog();
+      // Stop live forwarding for this task before tearing down (or before switching tasks).
+      void window.api.invoke('task:unsubscribeLogs', { id: taskId });
       ro.disconnect();
       term.dispose();
       termRef.current = null;
@@ -219,7 +274,7 @@ export const LogTerminal = forwardRef<LogTerminalRef, { taskId: TaskId }>(functi
     <div className="relative h-full w-full">
       <div ref={hostRef} className="h-full w-full" data-selectable />
 
-      {/* Floating compact toolbar — bottom-right when scrolled up, top-right always for tools */}
+      {/* Floating compact toolbar - bottom-right when scrolled up, top-right always for tools */}
       <div className="absolute right-2 top-2 z-10 flex items-center gap-1 rounded-md border border-border bg-base/90 px-1 py-0.5 backdrop-blur">
         <ToolbarButton
           title="Find (⌘ F)"
diff --git a/src/renderer/components/NodeVersionPicker.tsx b/src/renderer/components/NodeVersionPicker.tsx
index 9d4f31c..7b9ba78 100644
--- a/src/renderer/components/NodeVersionPicker.tsx
+++ b/src/renderer/components/NodeVersionPicker.tsx
@@ -4,10 +4,10 @@ import type { NodeInstallation, NodeVersionPref } from '@shared/types';
 /**
  * Picks a Node version preference for an app or a task.
  *
- *   auto       — let NodeResolver read .nvmrc / .node-version / engines.node from the
+ *   auto       - let NodeResolver read .nvmrc / .node-version / engines.node from the
  *                project at start time
- *   system     — whatever `node` resolves to on the user's PATH
- *   explicit   — a specific installed version (across nvm/fnm/volta/asdf/system)
+ *   system     - whatever `node` resolves to on the user's PATH
+ *   explicit   - a specific installed version (across nvm/fnm/volta/asdf/system)
  *
  * Versions discovered from any installed manager appear in one list, deduped by version.
  */
@@ -66,7 +66,7 @@ export function NodeVersionPicker({
       </select>
       {versions.length === 0 && (
         <span className="text-[10px] text-fg-subtle">
-          No installations detected — try `nvm install &lt;version&gt;`
+          No installations detected - try `nvm install &lt;version&gt;`
         </span>
       )}
     </div>
diff --git a/src/renderer/components/OpenInMenu.tsx b/src/renderer/components/OpenInMenu.tsx
index 8357710..6a5495d 100644
--- a/src/renderer/components/OpenInMenu.tsx
+++ b/src/renderer/components/OpenInMenu.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import { ExternalLink } from 'lucide-react';
 import type { OpenInCapabilities, OpenInTarget } from '@shared/ipc';
 import { cn } from '../lib/cn';
@@ -17,15 +17,31 @@ const ITEMS: Item[] = [
   { target: 'sublime', label: 'Sublime Text', available: (c) => c.sublime }
 ];
 
+/**
+ * "Open in…" overflow menu. Presents the app's reveal/edit targets (Finder, Terminal,
+ * editors) as a listbox so it carries proper ARIA (role="listbox"/"option") and full
+ * keyboard support: ArrowUp/Down move the highlight over *enabled* targets only, Enter
+ * activates, and Escape closes the menu (it previously had no keyboard close at all).
+ */
 export function OpenInMenu({ path }: { path: string }): JSX.Element {
   const [open, setOpen] = useState(false);
   const [caps, setCaps] = useState<OpenInCapabilities | null>(null);
+  const [activeIdx, setActiveIdx] = useState(0);
   const ref = useRef<HTMLDivElement | null>(null);
+  const triggerRef = useRef<HTMLButtonElement | null>(null);
+  const listId = 'open-in-listbox';
 
   useEffect(() => {
     void window.api.invoke('openIn:caps', undefined).then(setCaps);
   }, []);
 
+  // Indices of targets the host can actually open - arrow navigation hops between these
+  // so the highlight never lands on a "not found" row the user can't activate.
+  const enabledIdxs = useMemo(
+    () => (caps ? ITEMS.map((it, i) => (it.available(caps) ? i : -1)).filter((i) => i >= 0) : []),
+    [caps]
+  );
+
   useEffect(() => {
     if (!open) return;
     const onClick = (e: MouseEvent): void => {
@@ -35,8 +51,19 @@ export function OpenInMenu({ path }: { path: string }): JSX.Element {
     return () => window.removeEventListener('mousedown', onClick);
   }, [open]);
 
+  // On open, seat the highlight on the first enabled target.
+  useEffect(() => {
+    if (open) setActiveIdx(enabledIdxs[0] ?? 0);
+  }, [open, enabledIdxs]);
+
+  const close = (): void => {
+    setOpen(false);
+    triggerRef.current?.focus();
+  };
+
   const onPick = async (target: OpenInTarget): Promise<void> => {
     setOpen(false);
+    triggerRef.current?.focus();
     try {
       await window.api.invoke('openIn:open', { target, path });
     } catch (e) {
@@ -44,10 +71,52 @@ export function OpenInMenu({ path }: { path: string }): JSX.Element {
     }
   };
 
+  // Step the highlight to the next/previous *enabled* target, wrapping at the ends.
+  const move = (dir: 1 | -1): void => {
+    if (enabledIdxs.length === 0) return;
+    const pos = enabledIdxs.indexOf(activeIdx);
+    const nextPos =
+      pos < 0
+        ? 0
+        : (pos + dir + enabledIdxs.length) % enabledIdxs.length;
+    setActiveIdx(enabledIdxs[nextPos]!);
+  };
+
+  const onTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>): void => {
+    if (e.key === 'Escape') {
+      if (open) {
+        e.preventDefault();
+        close();
+      }
+      return;
+    }
+    if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+      e.preventDefault();
+      if (!open) {
+        setOpen(true);
+        return;
+      }
+      move(e.key === 'ArrowDown' ? 1 : -1);
+      return;
+    }
+    if ((e.key === 'Enter' || e.key === ' ') && open) {
+      const it = ITEMS[activeIdx];
+      if (it && caps && it.available(caps)) {
+        e.preventDefault();
+        void onPick(it.target);
+      }
+    }
+  };
+
   return (
     <div ref={ref} className="relative inline-block">
       <button
+        ref={triggerRef}
         onClick={() => setOpen((o) => !o)}
+        onKeyDown={onTriggerKeyDown}
+        aria-haspopup="listbox"
+        aria-expanded={open}
+        aria-controls={open && caps ? listId : undefined}
         className="inline-flex h-8 w-8 items-center justify-center rounded-md text-fg-muted transition-colors hover:bg-surface hover:text-fg"
         title="Open this project in an editor…"
         aria-label="Open this project in an editor"
@@ -55,27 +124,40 @@ export function OpenInMenu({ path }: { path: string }): JSX.Element {
         <ExternalLink className="h-4 w-4" />
       </button>
       {open && caps && (
-        <div className="absolute right-0 z-30 mt-1 w-48 overflow-hidden rounded-md border border-border bg-base py-1 shadow-lg">
-          {ITEMS.map((it) => {
+        <ul
+          id={listId}
+          role="listbox"
+          aria-label="Open in"
+          className="absolute right-0 z-30 mt-1 w-48 overflow-hidden rounded-md border border-border bg-base py-1 shadow-lg"
+        >
+          {ITEMS.map((it, i) => {
             const enabled = it.available(caps);
+            const active = enabled && i === activeIdx;
             return (
-              <button
-                key={it.target}
-                disabled={!enabled}
-                onClick={() => void onPick(it.target)}
-                className={cn(
-                  'flex w-full items-center px-3 py-1.5 text-left text-sm',
-                  enabled
-                    ? 'text-fg hover:bg-surface'
-                    : 'text-fg-subtle'
-                )}
-              >
-                {it.label}
-                {!enabled && <span className="ml-auto text-[10px] text-fg-subtle">not found</span>}
-              </button>
+              <li role="presentation" key={it.target}>
+                <button
+                  role="option"
+                  aria-selected={active}
+                  aria-disabled={!enabled}
+                  disabled={!enabled}
+                  onClick={() => void onPick(it.target)}
+                  onMouseEnter={() => enabled && setActiveIdx(i)}
+                  className={cn(
+                    'flex w-full items-center px-3 py-1.5 text-left text-sm',
+                    enabled
+                      ? active
+                        ? 'bg-surface text-fg'
+                        : 'text-fg hover:bg-surface'
+                      : 'text-fg-subtle'
+                  )}
+                >
+                  {it.label}
+                  {!enabled && <span className="ml-auto text-[10px] text-fg-subtle">not found</span>}
+                </button>
+              </li>
             );
           })}
-        </div>
+        </ul>
       )}
     </div>
   );
diff --git a/src/renderer/components/PortChip.tsx b/src/renderer/components/PortChip.tsx
index 8462479..d311680 100644
--- a/src/renderer/components/PortChip.tsx
+++ b/src/renderer/components/PortChip.tsx
@@ -21,10 +21,10 @@ export function PortChip({
           'inline-flex items-center gap-1 rounded-md border border-border px-1.5 py-0.5 font-mono text-[11px] text-fg-subtle',
           className
         )}
-        title={label ? `${label} — no listening port detected` : 'no listening port'}
+        title={label ? `${label} - no listening port detected` : 'no listening port'}
       >
         {label && <span>{label}</span>}
-        <span>—</span>
+        <span>-</span>
       </span>
     );
   }
diff --git a/src/renderer/components/PromptModal.tsx b/src/renderer/components/PromptModal.tsx
index 3226f8d..ba1da02 100644
--- a/src/renderer/components/PromptModal.tsx
+++ b/src/renderer/components/PromptModal.tsx
@@ -1,9 +1,10 @@
 import { useEffect, useRef, useState } from 'react';
 import { createPortal } from 'react-dom';
 import { X, AlertTriangle } from 'lucide-react';
+import { useDialog } from '../hooks/useDialog';
 
 /**
- * Lightweight in-app dialogs — replace `window.prompt()` / `window.confirm()`,
+ * Lightweight in-app dialogs - replace `window.prompt()` / `window.confirm()`,
  * which are silently no-op'd or visually inconsistent inside Electron's
  * BrowserWindow. Promise-style API:
  *
@@ -56,54 +57,38 @@ type PromptState = PromptArgs & { mode: 'prompt'; resolve: (v: string | null) =>
 type ConfirmState = ConfirmArgs & { mode: 'confirm'; resolve: (v: boolean) => void };
 type DialogState = PromptState | ConfirmState;
 
+// Stable id for the dialog heading so aria-labelledby can point at it.
+const TITLE_ID = 'prompt-modal-title';
+
 /**
- * Mount once at the root. Renders nothing until openPrompt()/openConfirm() is awaited.
- * Backwards-compatible alias `PromptModalHost` is exported below.
+ * The actual dialog panel. Split out from DialogHost so it mounts only while a
+ * dialog is open - useDialog's effect runs on mount/unmount, which is exactly
+ * the open/close lifecycle we want for its focus-into / Tab-trap / Escape /
+ * focus-restore behaviour. (Mounting useDialog on the always-present DialogHost
+ * would capture the wrong "previously focused" element and never restore.)
  */
-export function DialogHost(): JSX.Element | null {
-  const [state, setState] = useState<DialogState | null>(null);
-  const [value, setValue] = useState('');
+function DialogPanel({
+  state,
+  onClose
+}: {
+  state: DialogState;
+  onClose: () => void;
+}): JSX.Element {
+  const [value, setValue] = useState(state.mode === 'prompt' ? state.defaultValue ?? '' : '');
   const [error, setError] = useState<string | null>(null);
   const inputRef = useRef<HTMLInputElement | null>(null);
-  const confirmBtnRef = useRef<HTMLButtonElement | null>(null);
 
-  useEffect(() => {
-    openPromptImpl = (args) =>
-      new Promise<string | null>((resolve) => {
-        setValue(args.defaultValue ?? '');
-        setError(null);
-        setState({ ...args, mode: 'prompt', resolve });
-      });
-    openConfirmImpl = (args) =>
-      new Promise<boolean>((resolve) => {
-        setState({ ...args, mode: 'confirm', resolve });
-      });
-    return () => {
-      openPromptImpl = null;
-      openConfirmImpl = null;
-    };
-  }, []);
+  // Delegates Escape (window-level capture → keeps working after focus leaves
+  // the input), Tab/Shift+Tab focus trap, and focus restore on close to the
+  // shared hook. onClose here means "cancel" - same as the X / backdrop click.
+  // useDialog focuses the [data-autofocus] element (the input here); we follow
+  // up to select its contents so a prefilled defaultValue is overwrite-ready.
+  const { dialogProps } = useDialog(onClose, TITLE_ID);
 
-  // Focus the input (prompt) or the confirm button (confirm) when shown.
   useEffect(() => {
-    if (!state) return;
-    requestAnimationFrame(() => {
-      if (state.mode === 'prompt') {
-        inputRef.current?.focus();
-        inputRef.current?.select();
-      } else {
-        confirmBtnRef.current?.focus();
-      }
-    });
-  }, [state]);
-
-  if (!state) return null;
-
-  const cancel = (): void => {
-    if (state.mode === 'prompt') state.resolve(null);
-    else state.resolve(false);
-    setState(null);
-  };
+    if (state.mode !== 'prompt') return;
+    requestAnimationFrame(() => inputRef.current?.select());
+  }, [state.mode]);
 
   const confirmPrompt = (): void => {
     if (state.mode !== 'prompt') return;
@@ -120,13 +105,11 @@ export function DialogHost(): JSX.Element | null {
       return;
     }
     state.resolve(trimmed);
-    setState(null);
   };
 
   const confirmConfirm = (): void => {
     if (state.mode !== 'confirm') return;
     state.resolve(true);
-    setState(null);
   };
 
   const danger = state.mode === 'confirm' && state.danger;
@@ -134,31 +117,34 @@ export function DialogHost(): JSX.Element | null {
     ? 'rounded-md border border-danger-border bg-danger-bg px-3 py-1 text-sm text-danger-fg hover:bg-danger-bg-hover'
     : 'rounded-md bg-accent px-3 py-1 text-sm text-accent-fg hover:bg-accent/90';
 
-  return createPortal(
+  return (
     <div
       className="fixed inset-0 z-[60] flex items-center justify-center bg-black/60"
       onMouseDown={(e) => {
-        if (e.target === e.currentTarget) cancel();
+        if (e.target === e.currentTarget) onClose();
       }}
       onKeyDown={(e) => {
-        if (e.key === 'Escape') {
-          e.preventDefault();
-          cancel();
-        }
+        // Enter-to-confirm for the confirm dialog (the prompt input handles its
+        // own Enter). Escape/Tab are owned by useDialog at the window level.
         if (e.key === 'Enter' && state.mode === 'confirm') {
           e.preventDefault();
           confirmConfirm();
         }
       }}
     >
-      <div className="w-full max-w-md overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+      <div
+        {...dialogProps}
+        className="w-full max-w-md overflow-hidden rounded-lg border border-border bg-base shadow-2xl outline-none"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
           <div className="flex items-center gap-2">
             {danger && <AlertTriangle className="h-4 w-4 text-danger-fg" />}
-            <h3 className="text-sm font-medium text-fg">{state.title}</h3>
+            <h3 id={TITLE_ID} className="text-sm font-medium text-fg">
+              {state.title}
+            </h3>
           </div>
           <button
-            onClick={cancel}
+            onClick={onClose}
             className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
             title="Cancel"
             aria-label="Cancel"
@@ -174,6 +160,7 @@ export function DialogHost(): JSX.Element | null {
             <>
               <input
                 ref={inputRef}
+                data-autofocus
                 value={value}
                 onChange={(e) => {
                   setValue(e.target.value);
@@ -194,13 +181,13 @@ export function DialogHost(): JSX.Element | null {
         </div>
         <footer className="flex items-center justify-end gap-2 border-t border-border px-4 py-2">
           <button
-            onClick={cancel}
+            onClick={onClose}
             className="rounded-md px-2.5 py-1 text-sm text-fg-muted hover:bg-surface"
           >
             {state.mode === 'confirm' ? state.cancelLabel ?? 'Cancel' : 'Cancel'}
           </button>
           <button
-            ref={confirmBtnRef}
+            data-autofocus={state.mode === 'confirm' ? true : undefined}
             onClick={state.mode === 'prompt' ? confirmPrompt : confirmConfirm}
             className={confirmBtnClass}
           >
@@ -208,10 +195,71 @@ export function DialogHost(): JSX.Element | null {
           </button>
         </footer>
       </div>
-    </div>,
-    document.body
+    </div>
   );
 }
 
-/** Backwards-compatible alias — App.tsx mounts this. */
+/**
+ * Mount once at the root. Renders nothing until openPrompt()/openConfirm() is awaited.
+ * Backwards-compatible alias `PromptModalHost` is exported below.
+ */
+export function DialogHost(): JSX.Element | null {
+  const [state, setState] = useState<DialogState | null>(null);
+  // Monotonic id per shown dialog: keys DialogPanel so a replacement remounts it (fresh
+  // input state), and lets us detect staleness.
+  const [dialogId, setDialogId] = useState(0);
+  // Live mirror of `state` so the open* impls can settle a DISPLACED dialog's promise.
+  // Without this, opening a second prompt/confirm while one is showing would silently drop
+  // the first dialog's `resolve` and its `await` would hang forever.
+  const currentRef = useRef<DialogState | null>(null);
+  currentRef.current = state;
+
+  useEffect(() => {
+    const displace = (): void => {
+      const prev = currentRef.current;
+      if (!prev) return;
+      if (prev.mode === 'prompt') prev.resolve(null);
+      else prev.resolve(false);
+    };
+    openPromptImpl = (args) =>
+      new Promise<string | null>((resolve) => {
+        displace();
+        setDialogId((n) => n + 1);
+        setState({ ...args, mode: 'prompt', resolve });
+      });
+    openConfirmImpl = (args) =>
+      new Promise<boolean>((resolve) => {
+        displace();
+        setDialogId((n) => n + 1);
+        setState({ ...args, mode: 'confirm', resolve });
+      });
+    return () => {
+      openPromptImpl = null;
+      openConfirmImpl = null;
+    };
+  }, []);
+
+  if (!state) return null;
+
+  // Cancel resolves with the negative value (null / false) and closes.
+  const cancel = (): void => {
+    if (state.mode === 'prompt') state.resolve(null);
+    else state.resolve(false);
+    setState(null);
+  };
+
+  // DialogPanel resolves the positive cases directly via state.resolve, but only
+  // the host can null out `state` to unmount the panel (and let useDialog restore
+  // focus). So we hand the panel a state whose resolve also clears host state.
+  // The ternary keeps the discriminated union intact - spreading the union as a
+  // whole would widen `resolve`'s parameter to `string | null | boolean`.
+  const wrapped: DialogState =
+    state.mode === 'prompt'
+      ? { ...state, resolve: (v: string | null) => { state.resolve(v); setState(null); } }
+      : { ...state, resolve: (v: boolean) => { state.resolve(v); setState(null); } };
+
+  return createPortal(<DialogPanel key={dialogId} state={wrapped} onClose={cancel} />, document.body);
+}
+
+/** Backwards-compatible alias - App.tsx mounts this. */
 export const PromptModalHost = DialogHost;
diff --git a/src/renderer/components/SettingsDrawer.tsx b/src/renderer/components/SettingsDrawer.tsx
index eaabdeb..36d5dc2 100644
--- a/src/renderer/components/SettingsDrawer.tsx
+++ b/src/renderer/components/SettingsDrawer.tsx
@@ -4,9 +4,15 @@ import type { NodeInstallation } from '@shared/types';
 import type { SettingsState } from '@shared/ipc';
 import { ErrorBanner } from './ErrorBanner';
 import { openConfirm } from './PromptModal';
+import { useDialog } from '../hooks/useDialog';
 import { cn } from '../lib/cn';
 
+/** id linking the dialog panel (aria-labelledby) to its visible heading for screen readers. */
+const SETTINGS_TITLE_ID = 'settings-drawer-title';
+
 export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Element {
+  // Focus trap / Escape-to-close / focus-restore + role=dialog/aria-modal/aria-labelledby.
+  const { dialogProps } = useDialog(onClose, SETTINGS_TITLE_ID);
   const [settings, setSettings] = useState<SettingsState | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [nodeInstalls, setNodeInstalls] = useState<NodeInstallation[]>([]);
@@ -33,9 +39,14 @@ export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Elemen
 
   return (
     <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
-      <div className="flex h-full max-h-[680px] w-full max-w-2xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+      <div
+        {...dialogProps}
+        className="flex h-full max-h-[680px] w-full max-w-2xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
-          <h2 className="text-sm font-medium text-fg">Settings</h2>
+          <h2 id={SETTINGS_TITLE_ID} className="text-sm font-medium text-fg">
+            Settings
+          </h2>
           <button
             onClick={onClose}
             className="rounded-md p-1 text-fg-subtle hover:bg-surface hover:text-fg"
@@ -62,6 +73,7 @@ export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Elemen
               <Section title="General">
                 <Field label="Theme" description="Color scheme for the UI.">
                   <select
+                    data-autofocus
                     value={settings.theme}
                     onChange={(e) =>
                       void update({ theme: e.target.value as SettingsState['theme'] })
@@ -79,6 +91,33 @@ export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Elemen
                   checked={settings.auto_update}
                   onChange={(v) => void update({ auto_update: v })}
                 />
+                <Toggle
+                  label="Launch DevHarbor at login"
+                  description="Start DevHarbor automatically when you log in to your Mac."
+                  checked={settings.launch_at_login}
+                  onChange={(v) => void update({ launch_at_login: v })}
+                />
+                <Toggle
+                  label="Show menubar icon"
+                  description="Keep a tray icon in the macOS menubar for quick access and background control."
+                  checked={settings.tray_enabled}
+                  onChange={(v) => void update({ tray_enabled: v })}
+                />
+              </Section>
+
+              <Section title="Notifications">
+                <Toggle
+                  label="Notify when an app crashes"
+                  description="Show a desktop notification when a task exits unexpectedly while DevHarbor is backgrounded."
+                  checked={settings.notify_on_crash}
+                  onChange={(v) => void update({ notify_on_crash: v })}
+                />
+                <Toggle
+                  label="Notify when an app is ready"
+                  description="Show a desktop notification when an app finishes starting (readiness reached)."
+                  checked={settings.notify_on_ready}
+                  onChange={(v) => void update({ notify_on_ready: v })}
+                />
               </Section>
 
               <Section title="Dashboard">
@@ -111,6 +150,19 @@ export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Elemen
                     max={100000}
                   />
                 </Field>
+                <Field
+                  label="Keep run history per app"
+                  description="Maximum run_history rows retained per app. Older rows are pruned on boot."
+                >
+                  <NumberInput
+                    value={settings.run_history_limit}
+                    onCommit={(v) => void update({ run_history_limit: clamp(v, 10, 10000) })}
+                    suffix="runs"
+                    step={50}
+                    min={10}
+                    max={10000}
+                  />
+                </Field>
               </Section>
 
               <Section title="Processes">
@@ -127,11 +179,24 @@ export function SettingsDrawer({ onClose }: { onClose: () => void }): JSX.Elemen
                     max={30000}
                   />
                 </Field>
+                <Field
+                  label="Readiness timeout"
+                  description="Abort a task's start if its readiness signal hasn't fired within this many ms."
+                >
+                  <NumberInput
+                    value={settings.readiness_timeout_ms}
+                    onCommit={(v) => void update({ readiness_timeout_ms: clamp(v, 1000, 600000) })}
+                    suffix="ms"
+                    step={1000}
+                    min={1000}
+                    max={600000}
+                  />
+                </Field>
               </Section>
 
               <Section title="Node detection">
                 <div className="text-[11px] text-fg-subtle">
-                  Installations discovered on this machine (read-only — the list is rescanned every
+                  Installations discovered on this machine (read-only - the list is rescanned every
                   time an app starts). To add a new version, install it via your usual manager
                   (nvm / fnm / volta / asdf) and click an app's Start.
                 </div>
diff --git a/src/renderer/components/Sidebar.tsx b/src/renderer/components/Sidebar.tsx
index 49b4866..200ab2c 100644
--- a/src/renderer/components/Sidebar.tsx
+++ b/src/renderer/components/Sidebar.tsx
@@ -13,6 +13,7 @@ import {
   Tag,
   ChevronRight,
   ChevronDown,
+  ChevronUp,
   MoreVertical,
   Trash2,
   Edit3,
@@ -30,6 +31,8 @@ import { useContextMenu, type MenuItem } from './ContextMenu';
 import { openPrompt, openConfirm } from './PromptModal';
 import { StatusDot } from './StatusDot';
 import { sortApps, type AppSortMode } from '../lib/sortApps';
+import { isLive } from '../lib/processState';
+import { invokeOrToast } from '../lib/invoke';
 
 const UNGROUPED = '(Ungrouped)';
 const UNTAGGED = '(Untagged)';
@@ -37,8 +40,8 @@ const COLLAPSE_KEY = 'devharbor:folder-collapse';
 const PINNED_KEY = 'devharbor:pinned-folders';
 const ORDER_KEY = 'devharbor:folder-order';
 const GROUPMODE_KEY = 'devharbor:group-mode'; // 'folder' | 'tag'
-const DRAG_MIME = 'application/x-appmgr-app-id'; // dragging an app
-const FOLDER_MIME = 'application/x-appmgr-folder'; // dragging a folder header to reorder
+const DRAG_MIME = 'application/x-devharbor-app-id'; // dragging an app
+const FOLDER_MIME = 'application/x-devharbor-folder'; // dragging a folder header to reorder
 
 type GroupMode = 'folder' | 'tag';
 
@@ -57,18 +60,42 @@ function writeJson(key: string, value: unknown): void {
   try {
     localStorage.setItem(key, JSON.stringify(value));
   } catch {
-    // ignore — storage unavailable / quota'd
+    // ignore - storage unavailable / quota'd
   }
 }
 
+/**
+ * Shape-validated reads for our three folder-name-keyed blobs. A hand-edited or corrupt
+ * localStorage entry of the wrong type (e.g. an object where we expect an array) would
+ * otherwise crash downstream `.indexOf` / `.filter` calls - so coerce anything malformed
+ * back to a safe empty value rather than trusting `JSON.parse`'s output blindly.
+ */
+function readStringArray(key: string): string[] {
+  const v = readJson<unknown>(key, []);
+  return Array.isArray(v) ? v.filter((x): x is string => typeof x === 'string') : [];
+}
+function readBoolRecord(key: string): Record<string, boolean> {
+  const v = readJson<unknown>(key, {});
+  if (typeof v !== 'object' || v === null || Array.isArray(v)) return {};
+  const out: Record<string, boolean> = {};
+  for (const [k, val] of Object.entries(v as Record<string, unknown>)) {
+    if (typeof val === 'boolean') out[k] = val;
+  }
+  return out;
+}
+
 export function Sidebar({
   onAddApp,
   onOpenSettings,
-  onOpenPalette
+  onOpenPalette,
+  onImportProjects
 }: {
   onAddApp: () => void;
   onOpenSettings: () => void;
   onOpenPalette: () => void;
+  /** IMPROVEMENT-PLAN 14.5 entry point - open the bulk "Import projects…" flow.
+      Optional so the sidebar degrades gracefully until App.tsx wires it. */
+  onImportProjects?: () => void;
 }): JSX.Element {
   const apps = useStore((s) => s.apps);
   const view = useStore((s) => s.view);
@@ -81,12 +108,12 @@ export function Sidebar({
   const filterRef = useRef<HTMLInputElement>(null);
   const [filter, setFilter] = useState('');
   const [collapsed, setCollapsed] = useState<Record<string, boolean>>(() =>
-    readJson(COLLAPSE_KEY, {})
+    readBoolRecord(COLLAPSE_KEY)
   );
-  const [pinned, setPinned] = useState<string[]>(() => readJson<string[]>(PINNED_KEY, []));
+  const [pinned, setPinned] = useState<string[]>(() => readStringArray(PINNED_KEY));
   // User-chosen folder order (lowercased keys). Folders not listed sort alphabetically
   // after the ordered ones; "(Ungrouped)" is always pinned last.
-  const [folderOrder, setFolderOrder] = useState<string[]>(() => readJson<string[]>(ORDER_KEY, []));
+  const [folderOrder, setFolderOrder] = useState<string[]>(() => readStringArray(ORDER_KEY));
   // Group the app list by folder or by tag. A view preference, persisted locally.
   const [groupMode, setGroupMode] = useState<GroupMode>(() =>
     readJson<GroupMode>(GROUPMODE_KEY, 'folder')
@@ -95,7 +122,7 @@ export function Sidebar({
     setGroupMode(m);
     writeJson(GROUPMODE_KEY, m);
   }, []);
-  // App sort within the list / each group — shared with the Dashboard via the store, so the
+  // App sort within the list / each group - shared with the Dashboard via the store, so the
   // two views always agree and stay in sync live. 'name' is the stable default.
   const sortMode = useStore((s) => s.appSort);
   const setSortModePersist = useStore((s) => s.setAppSort);
@@ -104,17 +131,11 @@ export function Sidebar({
   const [draggingFolder, setDraggingFolder] = useState<string | null>(null);
   const { open: openMenu, node: menuNode } = useContextMenu();
 
-  const runningCount = apps.filter((a) => {
-    const st = lastState[a.id];
-    return st === 'running' || st === 'starting' || st === 'exiting';
-  }).length;
+  const runningCount = apps.filter((a) => isLive(lastState[a.id])).length;
 
   const filtered = useMemo(() => {
     const q = filter.trim().toLowerCase();
-    const isRunning = (id: string): boolean => {
-      const st = lastState[id];
-      return st === 'running' || st === 'starting' || st === 'exiting';
-    };
+    const isRunning = (id: string): boolean => isLive(lastState[id]);
     const sorted = sortApps(apps, sortMode, isRunning);
     if (!q) return sorted;
     return sorted.filter(
@@ -272,7 +293,7 @@ export function Sidebar({
           patch: { folder }
         });
         upsertApp(next);
-        // The folder now has an app, so it's no longer an "empty pinned" folder — drop it
+        // The folder now has an app, so it's no longer an "empty pinned" folder - drop it
         // from the pinned list to keep "pinned = empty folders only" and avoid a zombie
         // empty folder reappearing if its last app later leaves.
         if (folder) {
@@ -312,7 +333,7 @@ export function Sidebar({
     (name: string): void => {
       const trimmed = name.trim();
       if (!trimmed) return;
-      // Drop "(Ungrouped)" attempts — that label is reserved.
+      // Drop "(Ungrouped)" attempts - that label is reserved.
       if (trimmed.toLowerCase() === UNGROUPED.toLowerCase()) return;
       setPinned((prev) => {
         if (prev.some((p) => p.toLowerCase() === trimmed.toLowerCase())) return prev;
@@ -360,7 +381,7 @@ export function Sidebar({
       } else {
         addPinnedFolder(name);
       }
-      // A newly created folder only exists in the folder view — switch to it so the
+      // A newly created folder only exists in the folder view - switch to it so the
       // result is visible instead of silently landing in a hidden grouping.
       setGroupModePersist('folder');
     },
@@ -424,15 +445,40 @@ export function Sidebar({
       if (to == null || to === from) return;
       try {
         await window.api.invoke('folders:rename', { from, to });
+        // Our three folder-name-keyed localStorage blobs key off the folder name (collapse +
+        // order use the lowercased key; pinned stores the display name). A rename must carry
+        // those entries over from old→new name, otherwise the collapse/pin/order preference
+        // orphans against a folder that no longer exists and silently resets.
+        const fromKey = from.toLowerCase();
+        const toKey = to.toLowerCase();
         // Update pinned list too if this was an empty pinned folder.
         setPinned((prev) => {
-          const idx = prev.findIndex((p) => p.toLowerCase() === from.toLowerCase());
+          const idx = prev.findIndex((p) => p.toLowerCase() === fromKey);
           if (idx === -1) return prev;
           const next = [...prev];
           next[idx] = to;
           writeJson(PINNED_KEY, next);
           return next;
         });
+        // Carry the collapsed flag (keyed by folder key) over to the new name. Skipped for a
+        // case-only rename (same lowercased key): the delete would erase the entry just copied.
+        setCollapsed((prev) => {
+          if (fromKey === toKey || !(fromKey in prev)) return prev;
+          const next = { ...prev };
+          next[toKey] = next[fromKey] ?? false;
+          delete next[fromKey];
+          writeJson(COLLAPSE_KEY, next);
+          return next;
+        });
+        // Carry the saved order position (a list of folder keys) over to the new name.
+        setFolderOrder((prev) => {
+          const idx = prev.indexOf(fromKey);
+          if (idx === -1) return prev;
+          const next = [...prev];
+          next[idx] = toKey;
+          writeJson(ORDER_KEY, next);
+          return next;
+        });
         const list = await window.api.invoke('apps:list', undefined);
         useStore.setState({ apps: list });
       } catch (err) {
@@ -486,19 +532,51 @@ export function Sidebar({
     return () => window.removeEventListener('devharbor:new-folder', onNewFolder);
   }, [promptForNewFolder]);
 
+  // Prune orphaned folder-name-keyed localStorage once the app list has loaded. A folder
+  // deleted while DevHarbor was closed (or via another window) leaves dangling collapse/order
+  // keys; sweep them against the live set of folder keys (app folders ∪ pinned) so stale
+  // entries don't accumulate. Gated on the first non-empty load - pruning against the cold-boot
+  // empty `apps` would wrongly wipe keys for folders that simply haven't streamed in yet. Pinned
+  // entries are self-defining (user-created empty folders), so they're always valid here.
+  const prunedRef = useRef(false);
+  useEffect(() => {
+    if (prunedRef.current) return;
+    if (apps.length === 0) return; // wait for the real list before deciding what's orphaned
+    prunedRef.current = true;
+    const valid = new Set<string>([UNGROUPED.toLowerCase()]);
+    for (const a of apps) {
+      const k = (a.folder?.trim() || '').toLowerCase();
+      if (k) valid.add(k);
+    }
+    for (const p of pinned) valid.add(p.toLowerCase());
+    setCollapsed((prev) => {
+      // Tag-mode group keys live in the same blob under a 'tag:' prefix; they're keyed by
+      // tag name (churns freely) so they're never considered orphaned here.
+      const next = Object.fromEntries(
+        Object.entries(prev).filter(([k]) => k.startsWith('tag:') || valid.has(k))
+      );
+      if (Object.keys(next).length === Object.keys(prev).length) return prev;
+      writeJson(COLLAPSE_KEY, next);
+      return next;
+    });
+    setFolderOrder((prev) => {
+      const next = prev.filter((k) => valid.has(k));
+      if (next.length === prev.length) return prev;
+      writeJson(ORDER_KEY, next);
+      return next;
+    });
+  }, [apps, pinned]);
+
   /**
    * Build the per-app overflow menu (used by both ⋮ click and right-click).
-   * Identical set of actions — the ⋮ button is the primary trigger, right-click is
+   * Identical set of actions - the ⋮ button is the primary trigger, right-click is
    * the power-user fallback.
    */
   const buildAppMenu = useCallback(
     (app: App): MenuItem[] => {
-      const isLive =
-        lastState[app.id] === 'running' ||
-        lastState[app.id] === 'starting' ||
-        lastState[app.id] === 'exiting';
+      const live = isLive(lastState[app.id]);
       // The grouping section of the menu is view-appropriate: folder moves in folder
-      // view, tag add/remove in tag view — so the ⋮ menu matches what the user is looking at.
+      // view, tag add/remove in tag view - so the ⋮ menu matches what the user is looking at.
       let moveItems: MenuItem[];
       if (groupMode === 'tag') {
         const appTagsLower = new Set(app.tags.map((t) => t.toLowerCase()));
@@ -566,16 +644,21 @@ export function Sidebar({
           onSelect: () => setSelected(app.id as AppId)
         },
         {
-          label: isLive ? 'Stop' : 'Start',
-          icon: isLive ? <Square className="h-3.5 w-3.5" /> : <Play className="h-3.5 w-3.5" />,
+          label: live ? 'Stop' : 'Start',
+          icon: live ? <Square className="h-3.5 w-3.5" /> : <Play className="h-3.5 w-3.5" />,
+          // Literal channels (not a union expression) so the generic `InvokeReq<C>` resolves
+          // cleanly, matching every other invokeOrToast call site.
           onSelect: () =>
-            void window.api.invoke(isLive ? 'proc:stop' : 'proc:start', { id: app.id })
+            void (live
+              ? invokeOrToast('proc:stop', { id: app.id }, { context: 'Stop failed' })
+              : invokeOrToast('proc:start', { id: app.id }, { context: 'Start failed' }))
         },
         {
           label: 'Restart',
           icon: <RotateCw className="h-3.5 w-3.5" />,
-          disabled: !isLive,
-          onSelect: () => void window.api.invoke('proc:restart', { id: app.id })
+          disabled: !live,
+          onSelect: () =>
+            void invokeOrToast('proc:restart', { id: app.id }, { context: 'Restart failed' })
         },
         ...moveItems,
         {
@@ -596,7 +679,7 @@ export function Sidebar({
           icon: <Trash2 className="h-3.5 w-3.5" />,
           danger: true,
           separatorBefore: true,
-          disabled: isLive,
+          disabled: live,
           onSelect: async () => {
             const ok = await openConfirm({
               title: `Remove "${app.name}" from DevHarbor?`,
@@ -605,12 +688,11 @@ export function Sidebar({
               danger: true
             });
             if (!ok) return;
-            try {
-              await window.api.invoke('apps:remove', { id: app.id });
-              removeApp(app.id);
-            } catch (err) {
-              console.error('remove failed', err);
-            }
+            // `apps:remove` resolves void (→ undefined) on success and invokeOrToast returns
+            // null on failure, so only drop the app from local state when the IPC succeeded - 
+            // otherwise the row would vanish even though the backend still has it.
+            const res = await invokeOrToast('apps:remove', { id: app.id }, { context: 'Remove failed' });
+            if (res !== null) removeApp(app.id);
           }
         }
       ];
@@ -630,19 +712,87 @@ export function Sidebar({
     ]
   );
 
+  /**
+   * IMPROVEMENT-PLAN 14.7 - start/stop every app in a folder group.
+   * Iterates the group's currently-listed apps and fires proc:start|proc:stop one at a
+   * time. The await-in-a-loop is deliberate: starting concurrently would race apps onto
+   * the same dev port before the first has bound it, so we serialise on start (and keep
+   * stop symmetric). Start skips apps already live; stop skips ones already idle - so the
+   * action is a no-op on rows that are already in the target state.
+   */
+  const startStopFolder = useCallback(
+    async (folderKey: string, action: 'start' | 'stop'): Promise<void> => {
+      const group = groups.find((g) => g.key === folderKey);
+      if (!group) return;
+      const verb = action === 'start' ? 'Start all' : 'Stop all';
+      for (const app of group.apps) {
+        const live = isLive(lastState[app.id]);
+        if (action === 'start' && live) continue; // already running
+        if (action === 'stop' && !live) continue; // already stopped
+        // Literal channels (not a union expression) so the generic `InvokeReq<C>` resolves
+        // cleanly, matching every other invokeOrToast call site.
+        if (action === 'start') {
+          await invokeOrToast('proc:start', { id: app.id }, { context: `${verb} - ${app.name}` });
+        } else {
+          await invokeOrToast('proc:stop', { id: app.id }, { context: `${verb} - ${app.name}` });
+        }
+      }
+    },
+    [groups, lastState]
+  );
+
   const onFolderContextMenu = (
     e: React.MouseEvent,
     folderName: string,
-    appCount: number
+    appCount: number,
+    folderKey: string
   ): void => {
     const isReserved = folderName === UNGROUPED;
+    // Keyboard/menu counterpart to drag-reorder: find this folder's neighbours in the same
+    // ordered, non-ungrouped key list reorderFolder works against, then move relative to them.
+    const ungroupedKey = UNGROUPED.toLowerCase();
+    const reorderKeys = groups.map((g) => g.key).filter((k) => k !== ungroupedKey);
+    const pos = reorderKeys.indexOf(folderKey);
+    const prevKey = pos > 0 ? reorderKeys[pos - 1] : undefined;
+    const nextKey =
+      pos !== -1 && pos < reorderKeys.length - 1 ? reorderKeys[pos + 1] : undefined;
     const items: MenuItem[] = [
+      {
+        label: 'Start all',
+        icon: <Play className="h-3.5 w-3.5" />,
+        disabled: isReserved,
+        onSelect: () => void startStopFolder(folderKey, 'start')
+      },
+      {
+        label: 'Stop all',
+        icon: <Square className="h-3.5 w-3.5" />,
+        disabled: isReserved,
+        onSelect: () => void startStopFolder(folderKey, 'stop')
+      },
       {
         label: 'Rename folder…',
         icon: <Edit3 className="h-3.5 w-3.5" />,
+        separatorBefore: true,
         disabled: isReserved,
         onSelect: () => void renameFolder(folderName)
       },
+      {
+        label: 'Move up',
+        icon: <ChevronUp className="h-3.5 w-3.5" />,
+        separatorBefore: true,
+        disabled: isReserved || prevKey === undefined,
+        onSelect: () => {
+          if (prevKey !== undefined) reorderFolder(folderKey, prevKey);
+        }
+      },
+      {
+        label: 'Move down',
+        icon: <ChevronDown className="h-3.5 w-3.5" />,
+        disabled: isReserved || nextKey === undefined,
+        onSelect: () => {
+          if (nextKey !== undefined) reorderFolder(folderKey, nextKey);
+        }
+      },
       {
         label: 'Delete folder',
         icon: <Trash2 className="h-3.5 w-3.5" />,
@@ -678,7 +828,7 @@ export function Sidebar({
 
   // A section accepts drops that depend on the grouping mode:
   //  • folder mode: an APP (move into this folder) or a FOLDER header (reorder folders)
-  //  • tag mode: an APP (add this tag) — but not onto the "(Untagged)" catch-all
+  //  • tag mode: an APP (add this tag) - but not onto the "(Untagged)" catch-all
   // The dataTransfer type tells app-drag from folder-drag apart.
   const onSectionDragOver = (e: React.DragEvent, key: string, catchAll: boolean): void => {
     const types = Array.from(e.dataTransfer.types);
@@ -707,7 +857,7 @@ export function Sidebar({
     setDragOverKey(null);
 
     if (groupMode === 'tag') {
-      if (group.catchAll) return; // "(Untagged)" — no-op (clearing tags via DnD is too destructive)
+      if (group.catchAll) return; // "(Untagged)" - no-op (clearing tags via DnD is too destructive)
       const appId = e.dataTransfer.getData(DRAG_MIME);
       if (!appId) return;
       const app = apps.find((a) => a.id === appId);
@@ -716,7 +866,7 @@ export function Sidebar({
       return;
     }
 
-    // Folder mode — reorder?
+    // Folder mode - reorder?
     const folderKey = e.dataTransfer.getData(FOLDER_MIME);
     if (folderKey) {
       reorderFolder(folderKey, group.key);
@@ -735,7 +885,7 @@ export function Sidebar({
   // Sort picker (radio-style menu): active option gets a check, others their own glyph.
   const openSortMenu = (e: React.MouseEvent): void => {
     const opts: { mode: AppSortMode; label: string; icon: JSX.Element }[] = [
-      { mode: 'name', label: 'Name (A–Z)', icon: <ArrowDownAZ className="h-3.5 w-3.5" /> },
+      { mode: 'name', label: 'Name (A-Z)', icon: <ArrowDownAZ className="h-3.5 w-3.5" /> },
       { mode: 'recent', label: 'Recently used', icon: <Clock className="h-3.5 w-3.5" /> },
       { mode: 'running', label: 'Running first', icon: <Play className="h-3.5 w-3.5" /> }
     ];
@@ -781,7 +931,7 @@ export function Sidebar({
           )}
         </button>
 
-        <div className="mb-2 flex items-center gap-1.5 rounded-md border border-border bg-surface px-2 py-1">
+        <div className="mb-2 flex items-center gap-1.5 rounded-md border border-border bg-surface px-2 py-1 focus-within:ring-1 focus-within:ring-accent">
           <Search className="h-3 w-3 text-fg-subtle" />
           <input
             ref={filterRef}
@@ -792,7 +942,7 @@ export function Sidebar({
           />
         </div>
 
-        {/* APPS header — label + group-by switcher + action icons. */}
+        {/* APPS header - label + group-by switcher + action icons. */}
         <div className="mb-1 flex items-center gap-1 px-2 text-[10px] uppercase tracking-wider text-fg-subtle">
           <span className="min-w-0 flex-1 truncate">
             Apps {filter && `· ${filtered.length} of ${apps.length}`}
@@ -826,9 +976,9 @@ export function Sidebar({
           </div>
           <button
             onClick={openSortMenu}
-            title={`Sort apps — ${
+            title={`Sort apps - ${
               sortMode === 'name'
-                ? 'Name (A–Z)'
+                ? 'Name (A-Z)'
                 : sortMode === 'recent'
                   ? 'Recently used'
                   : 'Running first'
@@ -855,7 +1005,19 @@ export function Sidebar({
                   label: 'New folder…',
                   icon: <FolderPlus className="h-3.5 w-3.5" />,
                   onSelect: () => void promptForNewFolder()
-                }
+                },
+                // IMPROVEMENT-PLAN 14.5 - bulk-import existing projects from a chosen
+                // directory. Only offered when the parent wires the handler.
+                ...(onImportProjects
+                  ? [
+                      {
+                        label: 'Import projects…',
+                        icon: <Boxes className="h-3.5 w-3.5" />,
+                        separatorBefore: true,
+                        onSelect: onImportProjects
+                      } as MenuItem
+                    ]
+                  : [])
               ])
             }
             title="Add app or folder"
@@ -897,12 +1059,9 @@ export function Sidebar({
             // Folder-only affordances (reorder, rename/delete menu) never apply to the
             // catch-all bucket or to tag groups (tags live on apps, not as standalone entities).
             const canFolderActions = groupMode === 'folder' && !g.catchAll;
-            // A collapsed group hides its rows — surface a glowing dot on the header when one
+            // A collapsed group hides its rows - surface a glowing dot on the header when one
             // of its apps is live, so "Running first" / monitoring isn't defeated by collapse.
-            const hasRunning = g.apps.some((a) => {
-              const st = lastState[a.id];
-              return st === 'running' || st === 'starting' || st === 'exiting';
-            });
+            const hasRunning = g.apps.some((a) => isLive(lastState[a.id]));
             const headerTitle =
               groupMode === 'tag'
                 ? g.catchAll
@@ -941,7 +1100,7 @@ export function Sidebar({
                     onClick={() => toggleCollapse(g.key)}
                     onContextMenu={
                       canFolderActions
-                        ? (e) => onFolderContextMenu(e, g.displayName, g.totalCount)
+                        ? (e) => onFolderContextMenu(e, g.displayName, g.totalCount, g.key)
                         : undefined
                     }
                     className="flex min-w-0 flex-1 items-center gap-1 text-left hover:text-fg-muted"
@@ -970,7 +1129,7 @@ export function Sidebar({
                     <button
                       onClick={(e) => {
                         e.stopPropagation();
-                        onFolderContextMenu(e, g.displayName, g.totalCount);
+                        onFolderContextMenu(e, g.displayName, g.totalCount, g.key);
                       }}
                       className="shrink-0 rounded p-0.5 text-fg-subtle opacity-0 transition-opacity hover:bg-elevated hover:text-fg group-hover:opacity-100"
                       title="Folder actions"
@@ -982,7 +1141,7 @@ export function Sidebar({
                 </div>
                 {groupMode === 'folder' && !isCollapsed && g.apps.length === 0 && (
                   <div className="pl-5 pr-2 py-1 text-[11px] italic text-fg-subtle">
-                    Empty — drop apps here.
+                    Empty - drop apps here.
                   </div>
                 )}
                 {!isCollapsed &&
@@ -1003,9 +1162,9 @@ export function Sidebar({
           })
         )}
       </nav>
-      {/* Settings gear — bottom-LEFT, dim (reference .mk-side-foot: padding 12px 8px,
+      {/* Settings gear - bottom-LEFT, dim (reference .mk-side-foot: padding 12px 8px,
           left-aligned, opacity 0.55, size 15). "+ Add app" lives in the APPS header. */}
-      {/* Settings as a full-width nav row — bookends the Dashboard entry at the top.
+      {/* Settings as a full-width nav row - bookends the Dashboard entry at the top.
           Replaces the lone dim gear (balanced + more discoverable). ⌘, also opens it. */}
       <div className="titlebar-no-drag border-t border-border p-2">
         <button
@@ -1027,7 +1186,7 @@ export function Sidebar({
  * One app row. Three slots:
  *   [status dot]  [name]  [⋮ menu trigger (hover)]
  *
- * Single status dot (green+glow when running, muted otherwise) — consistent with the
+ * Single status dot (green+glow when running, muted otherwise) - consistent with the
  * dashboard, recent strip, and detail header. The ⋮ trigger lives on the right.
  */
 function AppRow({
@@ -1049,15 +1208,32 @@ function AppRow({
 }): JSX.Element {
   return (
     <div
+      // The row is a custom interactive control, not a native <button> (it has to be a drag
+      // source and host its own ⋮ button). Expose it to AT/keyboard as a button: focusable,
+      // Enter/Space opens the app (mirrors onClick), aria-current marks the open row, and a
+      // focus-visible ring gives keyboard users the affordance mouse users get on hover.
+      role="button"
+      tabIndex={0}
+      aria-current={active ? 'true' : undefined}
       draggable
       onDragStart={(e) => {
         e.dataTransfer.setData(DRAG_MIME, app.id);
         e.dataTransfer.effectAllowed = 'move';
       }}
       onClick={onSelect}
+      onKeyDown={(e) => {
+        // Only act on keys originating on the row itself - Enter/Space on the nested
+        // "More actions" ⋮ button must activate the button, not navigate to the app.
+        if (e.target !== e.currentTarget) return;
+        if (e.key === 'Enter' || e.key === ' ') {
+          e.preventDefault(); // Space would otherwise scroll the sidebar
+          onSelect();
+        }
+      }}
       onContextMenu={onContextMenu}
       className={cn(
         'group mb-0.5 flex w-full cursor-pointer items-center gap-2 rounded-md py-1.5 text-left text-sm',
+        'focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent',
         indent ? 'pl-5 pr-1' : 'pl-2 pr-1',
         active ? 'bg-surface text-fg' : 'text-fg-muted hover:bg-surface/60'
       )}
diff --git a/src/renderer/components/StatusDot.tsx b/src/renderer/components/StatusDot.tsx
index 6e83e9b..efbb628 100644
--- a/src/renderer/components/StatusDot.tsx
+++ b/src/renderer/components/StatusDot.tsx
@@ -5,11 +5,16 @@ import { cn } from '../lib/cn';
  * Single status dot (DevHarbor UI reference): one dot conveys run state.
  *   running           → green + glow + pulse
  *   starting/exiting   → amber, static
- *   crashed            → red, static
+ *   crashed            → red, static + ring (non-color cue)
  *   idle/exited        → muted gray, no glow
  *
  * The glow/pulse + colors live as `.status-dot*` classes in styles.css so the
  * box-shadow halo and keyframes are reusable and theme-token driven.
+ *
+ * Accessibility (11.5): the dot is the only signal for run state, so it carries
+ * role="img" + an aria-label rather than a hover-only `title`. Crashed adds a
+ * ring outline (via `.status-dot-danger`) so it stays distinguishable from idle
+ * for users who can't perceive the red/gray hue difference.
  */
 export function StatusDot({
   state,
@@ -26,5 +31,18 @@ export function StatusDot({
       : state === 'crashed'
       ? 'status-dot-danger'
       : 'status-dot-off';
-  return <span className={cn('status-dot', variant, className)} title={state ?? 'idle'} />;
+  // Non-color cue for crashed: a contrasting outline ring so the state reads as
+  // "something is wrong" without depending on the red-vs-gray hue alone. Applied
+  // inline (rather than in styles.css) to keep the change scoped to this file.
+  const crashedRing =
+    state === 'crashed' ? 'ring-1 ring-danger-border ring-offset-1 ring-offset-base' : '';
+  const label = state ?? 'idle';
+  return (
+    <span
+      className={cn('status-dot', variant, crashedRing, className)}
+      role="img"
+      aria-label={label}
+      title={label}
+    />
+  );
 }
diff --git a/src/renderer/components/TagInput.tsx b/src/renderer/components/TagInput.tsx
index 3ff56ae..c4ea499 100644
--- a/src/renderer/components/TagInput.tsx
+++ b/src/renderer/components/TagInput.tsx
@@ -6,6 +6,11 @@ import { cn } from '../lib/cn';
  * Chip-based tag editor with autocomplete. Type and press Enter/comma to add a tag,
  * Backspace on an empty input removes the last chip, and a dropdown suggests existing
  * tags (from other apps) that match what you're typing.
+ *
+ * The suggestion dropdown is a real combobox+listbox: the input owns the focus and points
+ * at the highlighted option via aria-activedescendant (role="listbox"/option on the list),
+ * so screen readers announce the active suggestion. ArrowUp/Down move the highlight, Enter
+ * adds it, and Escape closes the list while keeping the typed draft.
  */
 export function TagInput({
   value,
@@ -23,6 +28,8 @@ export function TagInput({
   const [open, setOpen] = useState(false);
   const [activeIdx, setActiveIdx] = useState(0);
   const inputRef = useRef<HTMLInputElement | null>(null);
+  const listId = 'tag-suggestions-listbox';
+  const optionId = (i: number): string => `tag-suggestion-${i}`;
 
   const norm = (t: string): string => t.trim();
   const has = (t: string): boolean => value.some((v) => v.toLowerCase() === t.toLowerCase());
@@ -32,6 +39,8 @@ export function TagInput({
     .filter((s) => (draft ? s.toLowerCase().includes(draft.toLowerCase()) : true))
     .slice(0, 8);
 
+  const listOpen = open && matches.length > 0;
+
   const addTag = (raw: string): void => {
     const t = norm(raw);
     if (!t || has(t)) {
@@ -48,7 +57,7 @@ export function TagInput({
   const onKeyDown = (e: React.KeyboardEvent<HTMLInputElement>): void => {
     if (e.key === 'Enter' || e.key === ',') {
       e.preventDefault();
-      if (open && matches[activeIdx]) addTag(matches[activeIdx]!);
+      if (listOpen && matches[activeIdx]) addTag(matches[activeIdx]!);
       else if (draft.trim()) addTag(draft);
     } else if (e.key === 'Backspace' && draft === '' && value.length > 0) {
       removeTag(value[value.length - 1]!);
@@ -60,12 +69,13 @@ export function TagInput({
       e.preventDefault();
       setActiveIdx((i) => Math.max(i - 1, 0));
     } else if (e.key === 'Escape') {
+      // Close the suggestions but keep the draft so the user can keep typing.
       setOpen(false);
     }
   };
 
   return (
-    <div className="relative w-72">
+    <div className="relative w-72" data-escape-stop={listOpen ? '' : undefined}>
       <div
         className="flex flex-wrap items-center gap-1 rounded-md border border-border bg-surface px-1.5 py-1 focus-within:border-border-strong"
         onClick={() => inputRef.current?.focus()}
@@ -92,6 +102,11 @@ export function TagInput({
         <input
           ref={inputRef}
           value={draft}
+          role="combobox"
+          aria-expanded={listOpen}
+          aria-controls={listOpen ? listId : undefined}
+          aria-autocomplete="list"
+          aria-activedescendant={listOpen ? optionId(activeIdx) : undefined}
           onChange={(e) => {
             setDraft(e.target.value);
             setOpen(true);
@@ -108,25 +123,34 @@ export function TagInput({
           className="min-w-[80px] flex-1 bg-transparent px-1 py-0.5 text-sm text-fg outline-none placeholder:text-fg-subtle"
         />
       </div>
-      {open && matches.length > 0 && (
-        <div className="absolute z-30 mt-1 w-full overflow-hidden rounded-md border border-border bg-base py-1 shadow-lg">
+      {listOpen && (
+        <ul
+          id={listId}
+          role="listbox"
+          aria-label="Tag suggestions"
+          className="absolute z-30 mt-1 w-full overflow-hidden rounded-md border border-border bg-base py-1 shadow-lg"
+        >
           {matches.map((s, i) => (
-            <button
-              key={s}
-              onMouseDown={(e) => {
-                e.preventDefault();
-                addTag(s);
-              }}
-              onMouseEnter={() => setActiveIdx(i)}
-              className={cn(
-                'flex w-full items-center px-3 py-1.5 text-left text-sm',
-                i === activeIdx ? 'bg-surface text-fg' : 'text-fg-muted'
-              )}
-            >
-              {s}
-            </button>
+            <li role="presentation" key={s}>
+              <button
+                id={optionId(i)}
+                role="option"
+                aria-selected={i === activeIdx}
+                onMouseDown={(e) => {
+                  e.preventDefault();
+                  addTag(s);
+                }}
+                onMouseEnter={() => setActiveIdx(i)}
+                className={cn(
+                  'flex w-full items-center px-3 py-1.5 text-left text-sm',
+                  i === activeIdx ? 'bg-surface text-fg' : 'text-fg-muted'
+                )}
+              >
+                {s}
+              </button>
+            </li>
           ))}
-        </div>
+        </ul>
       )}
     </div>
   );
diff --git a/src/renderer/components/TaskEditor.tsx b/src/renderer/components/TaskEditor.tsx
index cbac3f6..9c73333 100644
--- a/src/renderer/components/TaskEditor.tsx
+++ b/src/renderer/components/TaskEditor.tsx
@@ -13,6 +13,10 @@ import { useStore } from '../store/store';
 import { cn } from '../lib/cn';
 import { useDebouncedSave } from '../lib/useDebouncedSave';
 import { ErrorBanner } from './ErrorBanner';
+import { useDialog } from '../hooks/useDialog';
+import { openConfirm } from './PromptModal';
+
+const TASK_EDITOR_TITLE_ID = 'task-editor-title';
 
 const EMPTY_TASKS: Task[] = [];
 
@@ -34,6 +38,9 @@ export function TaskEditor({
   const dragIdRef = useRef<TaskId | null>(null);
   const [dragOverId, setDragOverId] = useState<TaskId | null>(null);
 
+  // Overlay dialog: focus trap, Escape to close, focus restore, aria wiring.
+  const { dialogProps } = useDialog(onClose, TASK_EDITOR_TITLE_ID);
+
   useEffect(() => {
     void window.api.invoke('apps:detect', { path: appPath }).then(setDetection);
   }, [appPath]);
@@ -80,12 +87,22 @@ export function TaskEditor({
 
   const applyPatch = (patch: Partial<Task>): void => {
     if (!editing) return;
-    // Optimistic local update — input echoes immediately.
+    // Optimistic local update - input echoes immediately.
     upsertTask({ ...editing, ...patch, updatedAt: Date.now() } as Task);
     queueSave({ id: editing.id, patch });
   };
 
   const onRemove = async (id: TaskId): Promise<void> => {
+    // Match the task-strip context menu, which always confirms before deleting.
+    // Removing a task also discards its task-scoped env vars, so this is destructive.
+    const name = tasks.find((t) => t.id === id)?.name ?? 'task';
+    const ok = await openConfirm({
+      title: `Remove task "${name}"?`,
+      description: 'Its task-scoped environment variables are deleted too.',
+      danger: true,
+      confirmLabel: 'Remove'
+    });
+    if (!ok) return;
     setError(null);
     flushSave();
     try {
@@ -99,10 +116,15 @@ export function TaskEditor({
 
   return (
     <div className="fixed inset-0 z-40 flex items-center justify-center bg-black/60 p-6">
-      <div className="flex h-full max-h-[680px] w-full max-w-5xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl">
+      <div
+        {...dialogProps}
+        className="flex h-full max-h-[680px] w-full max-w-5xl flex-col overflow-hidden rounded-lg border border-border bg-base shadow-2xl"
+      >
         <header className="flex items-center justify-between border-b border-border px-4 py-3">
           <div>
-            <h2 className="text-sm font-medium text-fg">Tasks</h2>
+            <h2 id={TASK_EDITOR_TITLE_ID} className="text-sm font-medium text-fg">
+              Tasks
+            </h2>
             <p className="mt-0.5 text-[11px] text-fg-subtle">
               Define what this app runs. Multiple tasks start in dependency order.
             </p>
@@ -267,6 +289,7 @@ function TaskForm({
       <div className="flex items-start justify-between">
         <div>
           <input
+            data-autofocus
             value={task.name}
             onChange={(e) => void onChange({ name: e.target.value })}
             className="w-full rounded-md bg-transparent text-base font-medium text-fg outline-none focus:ring-1 focus:ring-accent"
@@ -304,7 +327,7 @@ function TaskForm({
               onChange={(e) => void onChange({ script: e.target.value || null })}
               className="w-full rounded-md border border-border bg-surface px-2 py-1 text-sm text-fg"
             >
-              <option value="">— select —</option>
+              <option value=""> - select - </option>
               {scriptChoices.map((s) => (
                 <option key={s} value={s}>
                   {s} {detection?.scripts[s] ? `(${detection.scripts[s]})` : ''}
@@ -510,7 +533,7 @@ function RadioPill({
 function readinessLabel(r: ReadinessSignal): string {
   switch (r.kind) {
     case 'none':
-      return '—';
+      return '-';
     case 'port':
       return `:${r.port}`;
     case 'log':
diff --git a/src/renderer/components/TaskTabs.tsx b/src/renderer/components/TaskTabs.tsx
index 738d09e..c7e043e 100644
--- a/src/renderer/components/TaskTabs.tsx
+++ b/src/renderer/components/TaskTabs.tsx
@@ -1,10 +1,36 @@
-import { Play, Square, RotateCw, EyeOff, Eye, Edit3, KeyRound, Trash2 } from 'lucide-react';
+import {
+  Play,
+  Square,
+  RotateCw,
+  EyeOff,
+  Eye,
+  Edit3,
+  KeyRound,
+  Trash2,
+  MoreVertical
+} from 'lucide-react';
 import type { AppId, ProcessState, ReadinessSignal, Task, TaskId } from '@shared/types';
 import { useStore } from '../store/store';
 import { cn } from '../lib/cn';
+import { isLive } from '../lib/processState';
+import { invokeOrToast } from '../lib/invoke';
 import { useContextMenu, type MenuItem } from './ContextMenu';
 import { openConfirm } from './PromptModal';
 
+/**
+ * Start a task and reflect the running record in the store, surfacing any rejection as a toast.
+ * Shared by the tab strip's start button and the context menu's Start/Restart so all three
+ * routes report failures identically (5.5) and the store is only updated on success.
+ */
+async function startTask(id: TaskId, context = 'Start failed'): Promise<void> {
+  const rt = await invokeOrToast('task:start', { id }, { context });
+  if (!rt) return;
+  useStore.setState((s) => ({
+    runningTasks: { ...s.runningTasks, [rt.taskId]: rt },
+    taskState: { ...s.taskState, [rt.taskId]: rt.state }
+  }));
+}
+
 export function TaskTabs({
   appId,
   tasks,
@@ -26,35 +52,31 @@ export function TaskTabs({
   const { open: openMenu, node: menuNode } = useContextMenu();
 
   const buildItems = (task: Task): MenuItem[] => {
-    const st = taskState[task.id];
-    const isLive = st === 'running' || st === 'starting' || st === 'exiting';
+    const live = isLive(taskState[task.id]);
     return [
       {
-        label: isLive ? 'Stop this task' : 'Start this task',
-        icon: isLive ? <Square className="h-3.5 w-3.5" /> : <Play className="h-3.5 w-3.5" />,
+        label: live ? 'Stop this task' : 'Start this task',
+        icon: live ? <Square className="h-3.5 w-3.5" /> : <Play className="h-3.5 w-3.5" />,
         onSelect: async () => {
-          if (isLive) await window.api.invoke('task:stop', { id: task.id });
-          else {
-            const rt = await window.api.invoke('task:start', { id: task.id });
-            useStore.setState((s) => ({
-              runningTasks: { ...s.runningTasks, [rt.taskId]: rt },
-              taskState: { ...s.taskState, [rt.taskId]: rt.state }
-            }));
-          }
+          if (live) await invokeOrToast('task:stop', { id: task.id }, { context: 'Stop failed' });
+          else await startTask(task.id);
         }
       },
       {
         label: 'Restart this task',
         icon: <RotateCw className="h-3.5 w-3.5" />,
-        disabled: !isLive,
+        disabled: !live,
         onSelect: async () => {
-          await window.api.invoke('task:stop', { id: task.id });
-          setTimeout(async () => {
-            const rt = await window.api.invoke('task:start', { id: task.id });
-            useStore.setState((s) => ({
-              runningTasks: { ...s.runningTasks, [rt.taskId]: rt },
-              taskState: { ...s.taskState, [rt.taskId]: rt.state }
-            }));
+          const stopped = await invokeOrToast(
+            'task:stop',
+            { id: task.id },
+            { context: 'Restart failed' }
+          );
+          // Only proceed to the start half once the stop actually resolved, so a failed stop
+          // doesn't silently spawn a duplicate process via the timer.
+          if (stopped === null) return;
+          setTimeout(() => {
+            void startTask(task.id, 'Restart failed');
           }, 150);
         }
       },
@@ -66,7 +88,7 @@ export function TaskTabs({
           <Eye className="h-3.5 w-3.5" />
         ),
         separatorBefore: true,
-        disabled: isLive,
+        disabled: live,
         onSelect: async () => {
           const next = await window.api.invoke('tasks:update', {
             id: task.id,
@@ -94,7 +116,7 @@ export function TaskTabs({
         icon: <Trash2 className="h-3.5 w-3.5" />,
         danger: true,
         separatorBefore: true,
-        disabled: isLive,
+        disabled: live,
         onSelect: async () => {
           const ok = await openConfirm({
             title: `Remove task "${task.name}"?`,
@@ -125,7 +147,7 @@ export function TaskTabs({
             state={taskState[t.id]}
             ready={!!taskReady[t.id]}
             onClick={() => selectTaskTab(appId, t.id)}
-            onContextMenu={(e) => openMenu(e, buildItems(t))}
+            onOpenMenu={(e) => openMenu(e, buildItems(t))}
           />
         ))}
       </div>
@@ -146,68 +168,82 @@ function TaskTab({
   state,
   ready,
   onClick,
-  onContextMenu
+  onOpenMenu
 }: {
   task: Task;
   active: boolean;
   state: ProcessState | undefined;
   ready: boolean;
   onClick: () => void;
-  onContextMenu: (e: React.MouseEvent) => void;
+  /** Opens the per-task action menu at the pointer; used by both right-click and the ⋮ button. */
+  onOpenMenu: (e: React.MouseEvent) => void;
 }): JSX.Element {
-  const isLive = state === 'running' || state === 'starting' || state === 'exiting';
+  const live = isLive(state);
+  // Prefer the semantic status tokens; the oneShot-exited "info" case has no semantic dot token,
+  // so it falls back to the accent colour rather than the old raw bg-blue-500.
   const stateColor = !task.enabled
     ? 'bg-border-strong/50'
     : state === 'crashed'
-    ? 'bg-red-500'
+    ? 'bg-danger-strong'
     : state === 'starting' || state === 'exiting'
-    ? 'bg-amber-500'
+    ? 'bg-warn-strong'
     : state === 'running' && ready
-    ? 'bg-green-500'
+    ? 'bg-success-strong'
     : state === 'running'
-    ? 'bg-amber-500'
+    ? 'bg-warn-strong'
     : task.oneShot && state === 'exited'
-    ? 'bg-blue-500'
+    ? 'bg-accent'
     : 'bg-fg-subtle';
 
-  const startStop = async (e: React.MouseEvent): Promise<void> => {
+  const toggle = (e: React.MouseEvent): void => {
     e.stopPropagation();
-    if (isLive) {
-      await window.api.invoke('task:stop', { id: task.id });
-    } else {
-      const rt = await window.api.invoke('task:start', { id: task.id });
-      useStore.setState((s) => ({
-        runningTasks: { ...s.runningTasks, [rt.taskId]: rt },
-        taskState: { ...s.taskState, [rt.taskId]: rt.state }
-      }));
-    }
+    if (live) void invokeOrToast('task:stop', { id: task.id }, { context: 'Stop failed' });
+    else void startTask(task.id);
   };
 
+  // A group of sibling controls - no nested interactive elements. Right-click anywhere on the
+  // group opens the action menu; the ⋮ button exposes the same menu without a mouse.
   return (
-    <button
-      onClick={onClick}
-      onContextMenu={onContextMenu}
+    <div
+      onContextMenu={onOpenMenu}
       className={cn(
-        'group flex items-center gap-1.5 rounded-md border px-2 py-1 text-xs',
+        'group flex items-center gap-1.5 rounded-md border px-1 py-0.5 text-xs',
         active
           ? 'border-border-strong bg-surface text-fg'
           : 'border-transparent text-fg-muted hover:bg-surface/60 hover:text-fg',
         !task.enabled && 'opacity-50'
       )}
-      title={tooltipFor(task)}
     >
-      <span className={cn('h-1.5 w-1.5 shrink-0 rounded-full', stateColor)} />
-      <span className="font-medium">{task.name}</span>
-      <span className="text-[10px] text-fg-subtle">{readinessLabel(task.readiness)}</span>
-      <span
-        role="button"
-        onClick={(e) => void startStop(e)}
-        className="ml-1 rounded p-0.5 text-fg-subtle hover:bg-elevated hover:text-fg"
-        title={isLive ? 'Stop task' : 'Start task'}
+      <button
+        type="button"
+        onClick={onClick}
+        className="flex items-center gap-1.5 rounded px-1 py-0.5"
+        title={tooltipFor(task)}
+        aria-pressed={active}
+      >
+        <span className={cn('h-1.5 w-1.5 shrink-0 rounded-full', stateColor)} />
+        <span className="font-medium">{task.name}</span>
+        <span className="text-[10px] text-fg-subtle">{readinessLabel(task.readiness)}</span>
+      </button>
+      <button
+        type="button"
+        onClick={toggle}
+        className="rounded p-0.5 text-fg-subtle hover:bg-elevated hover:text-fg"
+        aria-label={live ? `Stop ${task.name}` : `Start ${task.name}`}
+        title={live ? 'Stop task' : 'Start task'}
+      >
+        {live ? <Square className="h-3 w-3" /> : <Play className="h-3 w-3" />}
+      </button>
+      <button
+        type="button"
+        onClick={onOpenMenu}
+        className="rounded p-0.5 text-fg-subtle hover:bg-elevated hover:text-fg"
+        aria-label={`More actions for ${task.name}`}
+        title="More actions"
       >
-        {isLive ? <Square className="h-3 w-3" /> : <Play className="h-3 w-3" />}
-      </span>
-    </button>
+        <MoreVertical className="h-3 w-3" />
+      </button>
+    </div>
   );
 }
 
diff --git a/src/renderer/components/Toast.tsx b/src/renderer/components/Toast.tsx
new file mode 100644
index 0000000..e88f407
--- /dev/null
+++ b/src/renderer/components/Toast.tsx
@@ -0,0 +1,88 @@
+import { useEffect, useState, useCallback } from 'react';
+import { createPortal } from 'react-dom';
+import { X, AlertCircle, Info, CheckCircle2 } from 'lucide-react';
+
+/**
+ * Global, app-wide toast surface. Mount <ToastHost /> once at the app root; call
+ * `pushToast(message, { kind })` from anywhere - including non-React code like the
+ * `invokeOrToast` IPC helper - so failures from any view surface instead of being
+ * swallowed into an unhandled promise rejection (IMPROVEMENT-PLAN 5.5).
+ */
+export type ToastKind = 'error' | 'info' | 'success';
+
+interface Toast {
+  id: number;
+  message: string;
+  kind: ToastKind;
+}
+
+let pushImpl: ((message: string, opts?: { kind?: ToastKind; durationMs?: number }) => void) | null =
+  null;
+let counter = 0;
+
+export function pushToast(
+  message: string,
+  opts?: { kind?: ToastKind; durationMs?: number }
+): void {
+  if (pushImpl) pushImpl(message, opts);
+  else console.error('[toast]', message);
+}
+
+export function ToastHost(): JSX.Element | null {
+  const [toasts, setToasts] = useState<Toast[]>([]);
+  const dismiss = useCallback((id: number) => setToasts((t) => t.filter((x) => x.id !== id)), []);
+
+  useEffect(() => {
+    pushImpl = (message, opts) => {
+      const id = ++counter;
+      const kind = opts?.kind ?? 'info';
+      setToasts((t) => [...t, { id, message, kind }]);
+      const dur = opts?.durationMs ?? (kind === 'error' ? 8000 : 4000);
+      setTimeout(() => setToasts((t) => t.filter((x) => x.id !== id)), dur);
+    };
+    return () => {
+      pushImpl = null;
+    };
+  }, []);
+
+  if (toasts.length === 0) return null;
+
+  return createPortal(
+    <div
+      className="fixed bottom-4 right-4 z-[80] flex w-80 flex-col gap-2"
+      role="region"
+      aria-label="Notifications"
+    >
+      {toasts.map((t) => (
+        <div
+          key={t.id}
+          role={t.kind === 'error' ? 'alert' : 'status'}
+          className={`flex items-start gap-2 rounded-md border px-3 py-2 text-xs shadow-lg ${
+            t.kind === 'error'
+              ? 'border-danger-border bg-danger-bg text-danger-fg'
+              : t.kind === 'success'
+                ? 'border-border bg-surface text-fg'
+                : 'border-border bg-surface text-fg'
+          }`}
+        >
+          {t.kind === 'error' ? (
+            <AlertCircle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+          ) : t.kind === 'success' ? (
+            <CheckCircle2 className="mt-0.5 h-3.5 w-3.5 shrink-0 text-accent" />
+          ) : (
+            <Info className="mt-0.5 h-3.5 w-3.5 shrink-0 text-fg-subtle" />
+          )}
+          <span className="flex-1 whitespace-pre-line break-words">{t.message}</span>
+          <button
+            onClick={() => dismiss(t.id)}
+            className="shrink-0 rounded p-0.5 opacity-70 hover:bg-black/10 hover:opacity-100"
+            aria-label="Dismiss notification"
+          >
+            <X className="h-3 w-3" />
+          </button>
+        </div>
+      ))}
+    </div>,
+    document.body
+  );
+}
diff --git a/src/renderer/components/UpdateBanner.tsx b/src/renderer/components/UpdateBanner.tsx
index 3668a18..58a6632 100644
--- a/src/renderer/components/UpdateBanner.tsx
+++ b/src/renderer/components/UpdateBanner.tsx
@@ -1,75 +1,167 @@
-import { useEffect, useState } from 'react';
-import { Download, RefreshCw, X } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+import { AlertTriangle, CheckCircle2, ChevronDown, ChevronUp, Download, RefreshCw, X } from 'lucide-react';
 
 type UpdateState =
   | { kind: 'idle' }
-  | { kind: 'available'; version: string; percent: number }
-  | { kind: 'ready'; version: string };
+  | { kind: 'available'; version: string; percent: number; releaseNotes?: string }
+  | { kind: 'ready'; version: string; releaseNotes?: string }
+  | { kind: 'error'; message: string }
+  // Only shown when the user explicitly asked ("Check for Updates…"); the passive boot
+  // check stays silent so we don't nag on every launch.
+  | { kind: 'upToDate'; version: string };
 
 /**
  * Floating bottom-right banner that surfaces updater events.
  *
- *   update:available  → "Downloading vX.Y.Z…"
- *   update:ready      → "vX.Y.Z is ready. [Quit & Install]"
+ *   update:available    → "Downloading vX.Y.Z…" (+ optional release notes)
+ *   update:ready        → "vX.Y.Z is ready. [Quit & Install]" (+ optional release notes)
+ *   update:error        → "Update check failed: <message>" (dismissible)
+ *   update:notAvailable → "You're up to date" ONLY if a manual check is in flight
  *
  * Dismissed locally; reappears on the next update.
  */
 export function UpdateBanner(): JSX.Element | null {
   const [state, setState] = useState<UpdateState>({ kind: 'idle' });
   const [dismissed, setDismissed] = useState(false);
+  // Expandable release-notes drawer for available/ready states.
+  const [notesOpen, setNotesOpen] = useState(false);
+  // Mirror of state.kind for the event listeners (registered once, so they can't read state).
+  const kindRef = useRef<UpdateState['kind']>('idle');
+  kindRef.current = state.kind;
 
   useEffect(() => {
-    const offA = window.api.on('update:available', ({ version }) => {
+    // A manual "Check for Updates…" is in flight. update:check is fired from App.tsx on the
+    // same menu:checkUpdates event, so the banner can independently tell a user-initiated
+    // check (worth a "You're up to date" confirmation) from the silent periodic/boot check.
+    let manualCheckPending = false;
+    const offMenuCheck = window.api.on('menu:checkUpdates', () => {
+      manualCheckPending = true;
+    });
+
+    const offA = window.api.on('update:available', ({ version, releaseNotes }) => {
+      manualCheckPending = false;
       setDismissed(false);
-      setState({ kind: 'available', version, percent: 0 });
+      setNotesOpen(false);
+      setState({ kind: 'available', version, percent: 0, releaseNotes });
     });
     const offP = window.api.on('update:progress', ({ percent }) => {
       setState((s) => (s.kind === 'available' ? { ...s, percent } : s));
     });
-    const offR = window.api.on('update:ready', ({ version }) => {
+    const offR = window.api.on('update:ready', ({ version, releaseNotes }) => {
+      manualCheckPending = false;
+      setDismissed(false);
+      setState({ kind: 'ready', version, releaseNotes });
+    });
+    const offErr = window.api.on('update:error', ({ message }) => {
+      // Passive boot/periodic checks fail routinely (offline, rate-limited) - surfacing each
+      // one would nag every 6h on a plane, so those stay in the local log only. But a failure
+      // while a DOWNLOAD is showing must always surface, or the banner would sit frozen on
+      // "Downloading vX… 37%" forever. Manual check failures always surface too.
+      const downloadInFlight = kindRef.current === 'available';
+      if (!manualCheckPending && !downloadInFlight) return;
+      manualCheckPending = false;
       setDismissed(false);
-      setState({ kind: 'ready', version });
+      setState({ kind: 'error', message });
     });
+    const offNA = window.api.on('update:notAvailable', ({ version }) => {
+      // Silent on the passive boot/periodic check - only confirm when the user asked.
+      if (!manualCheckPending) return;
+      manualCheckPending = false;
+      setDismissed(false);
+      setState({ kind: 'upToDate', version });
+    });
+
     return () => {
+      offMenuCheck();
       offA();
       offP();
       offR();
+      offErr();
+      offNA();
     };
   }, []);
 
   if (state.kind === 'idle' || dismissed) return null;
 
+  // Release notes are present only on available/ready; keep the toggle out of error/upToDate.
+  const releaseNotes =
+    state.kind === 'available' || state.kind === 'ready' ? state.releaseNotes?.trim() : undefined;
+
   return (
-    <div className="pointer-events-auto fixed bottom-4 right-4 z-30 flex items-center gap-3 rounded-md border border-accent/40 bg-base px-3 py-2 text-xs text-fg shadow-lg">
-      {state.kind === 'available' ? (
-        <>
-          <Download className="h-3.5 w-3.5 text-accent" />
-          <span>
-            Downloading <strong>v{state.version}</strong>… {state.percent > 0 ? `${state.percent}%` : ''}
-          </span>
-        </>
-      ) : (
-        <>
-          <RefreshCw className="h-3.5 w-3.5 text-accent" />
-          <span>
-            Update <strong>v{state.version}</strong> ready
-          </span>
+    <div className="pointer-events-auto fixed bottom-4 right-4 z-30 flex max-w-sm flex-col gap-2 rounded-md border border-accent/40 bg-base px-3 py-2 text-xs text-fg shadow-lg">
+      <div className="flex items-center gap-3">
+        {state.kind === 'available' && (
+          <>
+            <Download className="h-3.5 w-3.5 shrink-0 text-accent" />
+            <span className="flex-1">
+              Downloading <strong>v{state.version}</strong>…{' '}
+              {state.percent > 0 ? `${state.percent}%` : ''}
+            </span>
+          </>
+        )}
+
+        {state.kind === 'ready' && (
+          <>
+            <RefreshCw className="h-3.5 w-3.5 shrink-0 text-accent" />
+            <span className="flex-1">
+              Update <strong>v{state.version}</strong> ready
+            </span>
+            <button
+              onClick={() => void window.api.invoke('update:install', undefined)}
+              className="shrink-0 rounded-md bg-accent px-2 py-0.5 text-[11px] text-accent-fg hover:bg-accent/90"
+            >
+              Quit & install
+            </button>
+          </>
+        )}
+
+        {state.kind === 'error' && (
+          <>
+            <AlertTriangle className="h-3.5 w-3.5 shrink-0 text-danger-fg" />
+            <span className="flex-1">
+              Update check failed: <span className="text-fg-muted">{state.message}</span>
+            </span>
+          </>
+        )}
+
+        {state.kind === 'upToDate' && (
+          <>
+            <CheckCircle2 className="h-3.5 w-3.5 shrink-0 text-accent" />
+            <span className="flex-1">
+              You&rsquo;re up to date <span className="text-fg-subtle">(v{state.version})</span>
+            </span>
+          </>
+        )}
+
+        {/* Release-notes toggle - only when notes exist, so the user can preview what
+            they're installing before "Quit & install". */}
+        {releaseNotes && (
           <button
-            onClick={() => void window.api.invoke('update:install', undefined)}
-            className="rounded-md bg-accent px-2 py-0.5 text-[11px] text-accent-fg hover:bg-accent/90"
+            onClick={() => setNotesOpen((v) => !v)}
+            className="shrink-0 rounded p-0.5 text-fg-subtle hover:bg-surface hover:text-fg"
+            title={notesOpen ? 'Hide release notes' : "Show what's new"}
+            aria-expanded={notesOpen}
+            aria-label="Toggle release notes"
           >
-            Quit & install
+            {notesOpen ? <ChevronUp className="h-3.5 w-3.5" /> : <ChevronDown className="h-3.5 w-3.5" />}
           </button>
-        </>
+        )}
+
+        <button
+          onClick={() => setDismissed(true)}
+          className="shrink-0 rounded p-0.5 text-fg-subtle hover:bg-surface hover:text-fg"
+          title="Dismiss this update notice"
+          aria-label="Dismiss"
+        >
+          <X className="h-3.5 w-3.5" />
+        </button>
+      </div>
+
+      {releaseNotes && notesOpen && (
+        <div className="max-h-40 overflow-y-auto whitespace-pre-wrap border-t border-border pt-2 text-[11px] leading-relaxed text-fg-muted">
+          {releaseNotes}
+        </div>
       )}
-      <button
-        onClick={() => setDismissed(true)}
-        className="rounded p-0.5 text-fg-subtle hover:bg-surface hover:text-fg"
-        title="Dismiss this update notice"
-        aria-label="Dismiss"
-      >
-        <X className="h-3.5 w-3.5" />
-      </button>
     </div>
   );
 }
diff --git a/src/renderer/hooks/useDialog.ts b/src/renderer/hooks/useDialog.ts
new file mode 100644
index 0000000..bc674af
--- /dev/null
+++ b/src/renderer/hooks/useDialog.ts
@@ -0,0 +1,113 @@
+import { useEffect, useRef, type RefObject } from 'react';
+
+const FOCUSABLE =
+  'a[href], button:not([disabled]), textarea:not([disabled]), input:not([disabled]), select:not([disabled]), [tabindex]:not([tabindex="-1"])';
+
+function isVisible(el: HTMLElement): boolean {
+  return !!(el.offsetWidth || el.offsetHeight || el.getClientRects().length);
+}
+
+/**
+ * Stack of currently-open dialogs (tokens pushed on mount, popped on unmount). Dialogs can
+ * STACK - a confirm (PromptModal) opens on top of a drawer that also uses this hook, and both
+ * register document-level capture listeners. `stopPropagation` does NOT silence other
+ * listeners on the same node, so without this stack one Escape press would fire EVERY open
+ * dialog's close handler (closing the whole drawer when the user only meant to dismiss the
+ * confirm). Only the TOP-most dialog may handle Escape/Tab.
+ */
+const dialogStack: symbol[] = [];
+
+export interface UseDialogResult {
+  containerRef: RefObject<HTMLDivElement>;
+  /** Spread onto the dialog's root element: role/aria-modal/aria-labelledby + ref. */
+  dialogProps: {
+    ref: RefObject<HTMLDivElement>;
+    role: 'dialog';
+    'aria-modal': boolean;
+    'aria-labelledby'?: string;
+  };
+}
+
+/**
+ * Accessible modal-dialog behaviour shared by every overlay drawer: focus moves into the
+ * dialog on open, Tab/Shift+Tab is trapped inside it, Escape closes it, and focus is
+ * restored to whatever was focused before it opened. Document-level keydown (capture) means
+ * Escape keeps working even after focus leaves the first field, and shortcuts bound on the
+ * window (⌘N, ⌘↩) still reach their handlers - callers gate those on dialog-open state.
+ *
+ * Mark a preferred initial-focus element with `data-autofocus`; otherwise the first
+ * focusable element (or the container) is focused.
+ *
+ * Inner widgets that consume Escape themselves (e.g. a combobox closing its popup) can mark
+ * their root with `data-escape-stop` WHILE their popup is open - Escape originating inside
+ * such an element is left to the widget instead of closing the dialog.
+ */
+export function useDialog(onClose: () => void, labelledBy?: string): UseDialogResult {
+  const containerRef = useRef<HTMLDivElement>(null);
+  const onCloseRef = useRef(onClose);
+  onCloseRef.current = onClose;
+
+  useEffect(() => {
+    const prevActive = document.activeElement as HTMLElement | null;
+    const el = containerRef.current;
+    const token = Symbol('dialog');
+    dialogStack.push(token);
+
+    const focusTarget =
+      el?.querySelector<HTMLElement>('[data-autofocus]') ??
+      el?.querySelector<HTMLElement>(FOCUSABLE) ??
+      el;
+    // Defer so the element is laid out before we focus it.
+    requestAnimationFrame(() => focusTarget?.focus());
+
+    const onKey = (e: KeyboardEvent): void => {
+      // Only the top-most open dialog reacts - a stacked confirm owns Escape/Tab while open.
+      if (dialogStack[dialogStack.length - 1] !== token) return;
+      if (e.key === 'Escape') {
+        // An open inner popup (combobox/tag suggestions) gets first claim on Escape.
+        const target = e.target as HTMLElement | null;
+        if (target?.closest('[data-escape-stop]')) return;
+        e.preventDefault();
+        e.stopImmediatePropagation();
+        onCloseRef.current();
+        return;
+      }
+      if (e.key === 'Tab' && el) {
+        const items = [...el.querySelectorAll<HTMLElement>(FOCUSABLE)].filter(isVisible);
+        if (items.length === 0) {
+          e.preventDefault();
+          return;
+        }
+        const first = items[0]!;
+        const last = items[items.length - 1]!;
+        const active = document.activeElement as HTMLElement | null;
+        if (e.shiftKey && (active === first || !el.contains(active))) {
+          e.preventDefault();
+          last.focus();
+        } else if (!e.shiftKey && active === last) {
+          e.preventDefault();
+          first.focus();
+        }
+      }
+    };
+    // Capture phase so Escape fires before background window handlers.
+    document.addEventListener('keydown', onKey, true);
+    return () => {
+      document.removeEventListener('keydown', onKey, true);
+      const idx = dialogStack.indexOf(token);
+      if (idx !== -1) dialogStack.splice(idx, 1);
+      // Restore focus to the trigger.
+      if (prevActive && typeof prevActive.focus === 'function') prevActive.focus();
+    };
+  }, []);
+
+  return {
+    containerRef,
+    dialogProps: {
+      ref: containerRef,
+      role: 'dialog',
+      'aria-modal': true,
+      ...(labelledBy ? { 'aria-labelledby': labelledBy } : {})
+    }
+  };
+}
diff --git a/src/renderer/index.html b/src/renderer/index.html
index e9b8aef..229f024 100644
--- a/src/renderer/index.html
+++ b/src/renderer/index.html
@@ -2,7 +2,7 @@
 <html lang="en" class="dark">
   <head>
     <meta charset="UTF-8" />
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' data: blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws: http://localhost:*" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self' 'unsafe-inline' data: blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws://localhost:* ws://127.0.0.1:* http://localhost:* http://127.0.0.1:*; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" />
     <title>DevHarbor</title>
   </head>
   <body class="bg-base text-fg font-sans antialiased">
diff --git a/src/renderer/lib/invoke.ts b/src/renderer/lib/invoke.ts
new file mode 100644
index 0000000..b63c694
--- /dev/null
+++ b/src/renderer/lib/invoke.ts
@@ -0,0 +1,36 @@
+import type { InvokeChannelName, InvokeReq, InvokeRes } from '@shared/ipc';
+import { pushToast } from '../components/Toast';
+
+/**
+ * Electron serialises a thrown main-process Error as
+ * `Error invoking remote method 'proc:start': Error: <message>`. Strip that wrapper so the
+ * user sees the actual message (e.g. "Node v20 is not installed. Install it first.").
+ */
+export function cleanIpcError(e: unknown): string {
+  const raw = e instanceof Error ? e.message : String(e);
+  const stripped = raw
+    .replace(/^Error invoking remote method '[^']*':\s*/i, '')
+    .replace(/^(?:Uncaught )?Error:\s*/i, '')
+    .trim();
+  return stripped || 'Something went wrong.';
+}
+
+/**
+ * Invoke an IPC channel and surface any rejection as a toast instead of letting it become a
+ * silent unhandled rejection. Returns the result, or null on failure. Route fire-and-forget
+ * lifecycle actions (start/stop/restart) from every view through this so failures are never
+ * invisible - previously only AppDetail caught and showed them.
+ */
+export async function invokeOrToast<C extends InvokeChannelName>(
+  channel: C,
+  req: InvokeReq<C>,
+  opts?: { context?: string }
+): Promise<InvokeRes<C> | null> {
+  try {
+    return await window.api.invoke(channel, req);
+  } catch (e) {
+    const base = cleanIpcError(e);
+    pushToast(opts?.context ? `${opts.context}: ${base}` : base, { kind: 'error' });
+    return null;
+  }
+}
diff --git a/src/renderer/lib/processState.ts b/src/renderer/lib/processState.ts
new file mode 100644
index 0000000..645dfa4
--- /dev/null
+++ b/src/renderer/lib/processState.ts
@@ -0,0 +1,46 @@
+import type { ProcessState, Task } from '@shared/types';
+
+/**
+ * Shared process-state predicates. These were hand-inlined 16+ times across Sidebar,
+ * Dashboard, AppDetail, TaskTabs, CommandPalette and StatusDot; centralising them means a
+ * new ProcessState only has to be classified once.
+ */
+
+/** "Live" = spawned or transitioning. Gates Stop/Restart affordances. */
+export function isLive(state: ProcessState | undefined | null): boolean {
+  return state === 'running' || state === 'starting' || state === 'exiting';
+}
+
+/** "Active" = started and not yet tearing down. Use where 'exiting' should read as stopping. */
+export function isActive(state: ProcessState | undefined | null): boolean {
+  return state === 'running' || state === 'starting';
+}
+
+/** Last path segment, e.g. /Users/me/proj → "proj". */
+export function basename(p: string): string {
+  const parts = p.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? p;
+}
+
+export interface TaskPortEntry {
+  taskId: Task['id'];
+  taskName: string;
+  ports: number[];
+}
+
+/**
+ * Per-task port chips for an app, in task display order, skipping tasks with no ports.
+ * Shared by the Dashboard cards and the AppDetail header so the two never diverge.
+ */
+export function buildTaskPortEntries(
+  tasks: Task[],
+  taskPorts: Record<string, number[]>
+): TaskPortEntry[] {
+  const out: TaskPortEntry[] = [];
+  for (const t of tasks) {
+    const ports = taskPorts[t.id] ?? [];
+    if (ports.length === 0) continue;
+    out.push({ taskId: t.id, taskName: t.name, ports });
+  }
+  return out;
+}
diff --git a/src/renderer/main.tsx b/src/renderer/main.tsx
index b079cfc..3b80223 100644
--- a/src/renderer/main.tsx
+++ b/src/renderer/main.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { createRoot } from 'react-dom/client';
 import { App } from './App';
+import { ErrorBoundary } from './components/ErrorBoundary';
 import './styles.css';
 
 const rootEl = document.getElementById('root');
@@ -8,6 +9,8 @@ if (!rootEl) throw new Error('No #root element');
 
 createRoot(rootEl).render(
   <React.StrictMode>
-    <App />
+    <ErrorBoundary>
+      <App />
+    </ErrorBoundary>
   </React.StrictMode>
 );
diff --git a/src/renderer/styles.css b/src/renderer/styles.css
index e18fdfa..131060f 100644
--- a/src/renderer/styles.css
+++ b/src/renderer/styles.css
@@ -4,7 +4,7 @@
 
 @layer base {
   /*
-   * Theme palettes — driven by Radix Colors (slate gray scale) for both modes,
+   * Theme palettes - driven by Radix Colors (slate gray scale) for both modes,
    * which is what shadcn/ui, Linear, Vercel, and most modern dev tools use.
    * Each step in the scale has an explicit semantic role:
    *   1  app background
@@ -24,25 +24,25 @@
 
   /*
    * Default = dark theme. Built on Tailwind's **zinc** scale (the shadcn/ui default
-   * dark family) — a soft, slightly-cool dark gray, deliberately lifted off pure black.
+   * dark family) - a soft, slightly-cool dark gray, deliberately lifted off pure black.
    * The earlier near-black (#0a0a0a) + near-white (#fafafa) read as harsh / high-contrast;
    * zinc-900 base + an off-white (#ededf0) foreground is the comfortable, modern default
    * (Linear / Vercel / shadcn). Brand accent stays harbor-teal (#2dd4bf).
    */
   :root,
   .dark {
-    --bg-base: 24 24 27;          /* #18181b  zinc-900 — app background (soft dark gray) */
-    --bg-surface: 32 32 36;       /* #202024  one step up — cards / inputs */
-    --bg-elevated: 42 42 47;      /* #2a2a2f  zinc-800-ish — hover / elevated */
-    --border: 39 39 43;           /* #27272b  zinc-800 — visible but quiet on the base */
-    --border-strong: 63 63 70;    /* #3f3f46  zinc-700 — stronger separators / focus */
-    --fg: 237 237 240;            /* #ededf0  soft off-white — primary text (not harsh) */
-    --fg-muted: 161 161 170;      /* #a1a1aa  zinc-400 — secondary text */
-    --fg-subtle: 113 113 122;     /* #71717a  zinc-500 — tertiary / placeholders */
-    --accent: 45 212 191;         /* #2dd4bf  teal-400 — harbor brand */
-    --accent-fg: 9 9 11;          /* #09090b  near-black — dark text reads on the teal button */
+    --bg-base: 24 24 27;          /* #18181b  zinc-900 - app background (soft dark gray) */
+    --bg-surface: 32 32 36;       /* #202024  one step up - cards / inputs */
+    --bg-elevated: 42 42 47;      /* #2a2a2f  zinc-800-ish - hover / elevated */
+    --border: 39 39 43;           /* #27272b  zinc-800 - visible but quiet on the base */
+    --border-strong: 63 63 70;    /* #3f3f46  zinc-700 - stronger separators / focus */
+    --fg: 237 237 240;            /* #ededf0  soft off-white - primary text (not harsh) */
+    --fg-muted: 161 161 170;      /* #a1a1aa  zinc-400 - secondary text */
+    --fg-subtle: 113 113 122;     /* #71717a  zinc-500 - tertiary / placeholders */
+    --accent: 45 212 191;         /* #2dd4bf  teal-400 - harbor brand */
+    --accent-fg: 9 9 11;          /* #09090b  near-black - dark text reads on the teal button */
 
-    /* Status palettes — DARK. Success uses the reference "run" green (#22c55e). */
+    /* Status palettes - DARK. Success uses the reference "run" green (#22c55e). */
     --danger-bg: 72 26 29;            /* red-4 dark   #481a1d */
     --danger-bg-hover: 84 27 31;      /* red-5 dark   #541b1f */
     --danger-fg: 255 153 154;         /* red-11 dark  #ff9592 */
@@ -53,7 +53,7 @@
     --success-bg-hover: 26 58 38;
     --success-fg: 134 239 172;        /* green-300 */
     --success-border: 34 84 52;
-    --success-strong: 34 197 94;      /* #22c55e  green-500 — reference run-green */
+    --success-strong: 34 197 94;      /* #22c55e  green-500 - reference run-green */
 
     --warn-bg: 74 39 0;               /* amber-4 dark #4a2700 */
     --warn-bg-hover: 91 51 0;         /* amber-5 dark #5b3300 */
@@ -65,16 +65,16 @@
   .light {
     --bg-base: 252 252 253;       /* slate-1   #fbfcfd */
     --bg-surface: 255 255 255;    /* pure white for cards on tinted base */
-    --bg-elevated: 241 243 245;   /* slate-3   #f1f3f5 — hover / button bg */
-    --border: 223 227 230;        /* slate-6   #dfe3e6 — borders visibly separate */
+    --bg-elevated: 241 243 245;   /* slate-3   #f1f3f5 - hover / button bg */
+    --border: 223 227 230;        /* slate-6   #dfe3e6 - borders visibly separate */
     --border-strong: 215 219 223; /* slate-7   #d7dbdf */
     --fg: 17 24 28;               /* slate-12  #11181c */
     --fg-muted: 104 112 118;      /* slate-11  #687076 */
     --fg-subtle: 136 144 150;     /* slate-9   #889096 */
-    --accent: 13 148 136;         /* teal-600  #0d9488 — harbor brand, readable on white */
+    --accent: 13 148 136;         /* teal-600  #0d9488 - harbor brand, readable on white */
     --accent-fg: 255 255 255;
 
-    /* Status palettes — LIGHT: soft bg, deep fg. (Radix red/grass/amber light steps.) */
+    /* Status palettes - LIGHT: soft bg, deep fg. (Radix red/grass/amber light steps.) */
     --danger-bg: 255 239 239;         /* red-3   #ffefef */
     --danger-bg-hover: 255 220 220;   /* red-4   #ffdcdc */
     --danger-fg: 197 36 51;           /* red-11  #c52433 */
@@ -120,7 +120,7 @@ textarea,
 }
 
 /*
- * Status dot — single dot per app/task (DevHarbor UI reference).
+ * Status dot - single dot per app/task (DevHarbor UI reference).
  *   running  → green, soft ring + pulse halo (the "glow")
  *   starting → amber, static
  *   crashed  → red, static
diff --git a/src/shared/__tests__/dotenv.test.ts b/src/shared/__tests__/dotenv.test.ts
index f076b79..5420396 100644
--- a/src/shared/__tests__/dotenv.test.ts
+++ b/src/shared/__tests__/dotenv.test.ts
@@ -26,6 +26,37 @@ describe('parseDotEnv', () => {
   it('skips invalid keys', () => {
     expect(parseDotEnv('1BAD=x\nGOOD=y\nNO_EQUALS')).toEqual({ GOOD: 'y' });
   });
+
+  it('strips a leading "export " prefix before key validation', () => {
+    expect(parseDotEnv('export A=1\nexport B="two"')).toEqual({ A: '1', B: 'two' });
+  });
+
+  it('consumes subsequent lines for a multiline double-quoted value (PEM block)', () => {
+    const pem = [
+      'PRIVATE_KEY="-----BEGIN PRIVATE KEY-----',
+      'MIIBVAIBADANBgkqhkiG9w0BAQEF',
+      'AASCAT4wggE6AgEAAkEA-----END PRIVATE KEY-----"',
+      'NEXT=ok',
+    ].join('\n');
+    expect(parseDotEnv(pem)).toEqual({
+      PRIVATE_KEY:
+        '-----BEGIN PRIVATE KEY-----\nMIIBVAIBADANBgkqhkiG9w0BAQEF\nAASCAT4wggE6AgEAAkEA-----END PRIVATE KEY-----',
+      NEXT: 'ok',
+    });
+  });
+
+  it('strips a trailing comment after a closed double-quoted value', () => {
+    expect(parseDotEnv('A="x" # comment')).toEqual({ A: 'x' });
+  });
+
+  it('an unterminated double quote degrades to a single-line value - later vars survive', () => {
+    // Without the EOF fallback, E=" would swallow X and Y into E's "multiline value".
+    expect(parseDotEnv('E="oops\nX=1\nY=2')).toEqual({ E: 'oops', X: '1', Y: '2' });
+  });
+
+  it('unterminated quote at EOF yields the line remainder, not the rest of the file', () => {
+    expect(parseDotEnv('A="never closed')).toEqual({ A: 'never closed' });
+  });
 });
 
 describe('isSecretKey', () => {
diff --git a/src/shared/dotenv.ts b/src/shared/dotenv.ts
index d1b757f..986669f 100644
--- a/src/shared/dotenv.ts
+++ b/src/shared/dotenv.ts
@@ -2,34 +2,95 @@
  * The single .env parser + secret heuristic, shared by main and renderer.
  *
  * Previously this logic was copy-pasted in three places (EnvBuilder, EnvEditor,
- * AddAppDrawer) and had already drifted — the main-side copy expanded `\n`/`\r`/`\t`
+ * AddAppDrawer) and had already drifted - the main-side copy expanded `\n`/`\r`/`\t`
  * inside double-quoted values while the renderer copies did not, so a pasted `.env`
  * parsed differently than the same file read at spawn time. This is now the one source.
  */
 
-/** Parse a `.env` blob into a key→value map. Comments + blank lines ignored. */
+/**
+ * Find the index of the first unescaped `"` in `s` at or after `from`.
+ * Used to locate the closing quote of a double-quoted value: a `\"` inside the
+ * value is an escaped quote and must not terminate the string (matches
+ * motdotla/dotenv, which lets PEM blocks and JSON survive intact). Returns -1
+ * when no unescaped closing quote exists on this physical segment.
+ */
+function findClosingDoubleQuote(s: string, from: number): number {
+  for (let i = from; i < s.length; i++) {
+    if (s[i] === '"') {
+      // Count the run of backslashes immediately preceding this quote; an even
+      // count (including zero) means the quote itself is unescaped.
+      let backslashes = 0;
+      for (let j = i - 1; j >= 0 && s[j] === '\\'; j--) backslashes++;
+      if (backslashes % 2 === 0) return i;
+    }
+  }
+  return -1;
+}
+
+/**
+ * Parse a `.env` blob into a key→value map. Comments + blank lines ignored.
+ *
+ * Index-based rather than a simple `for…of` over split lines because a
+ * double-quoted value may span multiple physical lines (e.g. a `PRIVATE_KEY`
+ * PEM block). When the opening `"` has no unescaped closing `"` on its own line,
+ * subsequent lines are consumed verbatim (newline-joined) until the closing
+ * quote is found - otherwise such a value would be truncated to its first line
+ * with a stray leading quote, and EnvBuilder would inject that mangled fragment
+ * into the spawned process env where it WINS over the framework's own dotenv.
+ */
 export function parseDotEnv(src: string): Record<string, string> {
   const out: Record<string, string> = {};
-  for (const rawLine of src.split(/\r?\n/)) {
-    const line = rawLine.trim();
+  const lines = src.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    // `lines[i]` is always defined (i < lines.length), but noUncheckedIndexedAccess
+    // widens it to `string | undefined`; the `?? ''` is the narrowing, not a default.
+    const line = (lines[i] ?? '').trim();
     if (!line || line.startsWith('#')) continue;
-    const eq = line.indexOf('=');
+    // Strip an optional `export ` prefix (e.g. shell-sourceable `.env` files)
+    // before key validation, otherwise `export FOO` fails the key regex.
+    const withoutExport = line.replace(/^export\s+/, '');
+    const eq = withoutExport.indexOf('=');
     if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
+    const key = withoutExport.slice(0, eq).trim();
     if (!key || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
-    let value = line.slice(eq + 1).trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      const quoted = value.slice(1, -1);
-      // Double-quoted values expand escape sequences; single-quoted are literal.
-      value = value.startsWith('"')
-        ? quoted.replace(/\\n/g, '\n').replace(/\\r/g, '\r').replace(/\\t/g, '\t')
-        : quoted;
+    let rest = withoutExport.slice(eq + 1).trimStart();
+
+    let value: string;
+    if (rest.startsWith('"')) {
+      // Double-quoted: find the closing unescaped quote, consuming further lines
+      // for multiline values (PEM blocks, embedded JSON, etc.).
+      let close = findClosingDoubleQuote(rest, 1);
+      let acc = rest;
+      const startLine = i;
+      while (close === -1 && i + 1 < lines.length) {
+        i++;
+        acc += '\n' + (lines[i] ?? '');
+        close = findClosingDoubleQuote(acc, 1);
+      }
+      if (close === -1) {
+        // Unterminated quote (no closing `"` anywhere): degrade to a SINGLE-LINE value
+        // like motdotla/dotenv does, and rewind so the consumed lines parse normally - 
+        // otherwise one malformed line would silently swallow every var below it.
+        i = startLine;
+        value = rest.slice(1);
+        const hash = value.indexOf(' #');
+        if (hash !== -1) value = value.slice(0, hash).trim();
+      } else {
+        const quoted = acc.slice(1, close);
+        // Double-quoted values expand escape sequences.
+        value = quoted.replace(/\\n/g, '\n').replace(/\\r/g, '\r').replace(/\\t/g, '\t');
+      }
+      // Anything after the closing quote (e.g. ` # comment`) is discarded.
+    } else if (rest.startsWith("'")) {
+      // Single-quoted: literal, no escape expansion. Closing quote ends the value.
+      const close = rest.indexOf("'", 1);
+      value = close === -1 ? rest.slice(1) : rest.slice(1, close);
     } else {
-      const hash = value.indexOf(' #');
-      if (hash !== -1) value = value.slice(0, hash).trim();
+      // Unquoted: drop an inline ` #` comment, then trim trailing whitespace.
+      rest = rest.trimEnd();
+      const hash = rest.indexOf(' #');
+      if (hash !== -1) rest = rest.slice(0, hash).trim();
+      value = rest;
     }
     out[key] = value;
   }
diff --git a/src/shared/ipc.ts b/src/shared/ipc.ts
index 0d2af5b..d506992 100644
--- a/src/shared/ipc.ts
+++ b/src/shared/ipc.ts
@@ -1,9 +1,12 @@
 import type {
   App,
   AppId,
+  CommandKind,
   DetectionResult,
   EnvVar,
   NodeInstallation,
+  NodeVersionPref,
+  PackageManager,
   ProcessState,
   RunningProcess,
   RunningTask,
@@ -11,6 +14,48 @@ import type {
   TaskId
 } from './types';
 
+export interface CreateTaskSpec {
+  name: string;
+  commandKind: CommandKind;
+  script?: string | null;
+  customCommand?: string | null;
+  /** Run from this subdir (relative to the app path) - used for monorepo workspace tasks. */
+  workingDirOverride?: string | null;
+}
+
+/** Atomic add-app payload - main creates the app + tasks + env in one DB transaction. */
+export interface CreateAppInput {
+  path: string;
+  name?: string;
+  nodeVersionPref?: NodeVersionPref;
+  packageManager?: PackageManager | null;
+  defaultScript?: string | null;
+  /** A single first task (the common case). */
+  firstTask?: CreateTaskSpec | null;
+  /** Multiple tasks (e.g. one per monorepo workspace package). Created after firstTask. */
+  tasks?: CreateTaskSpec[];
+  envVars?: { key: string; value: string; isSecret?: boolean }[];
+}
+
+/** One candidate project found by a shallow folder scan (bulk import). */
+export interface ImportCandidate {
+  path: string;
+  name: string;
+  alreadyRegistered: boolean;
+  packageManager: PackageManager | null;
+  suggestedScript: string | null;
+  scripts: string[];
+}
+
+/** A single matching log line from a cross-task global search. */
+export interface GlobalLogMatch {
+  appId: AppId;
+  taskId: TaskId;
+  appName: string;
+  taskName: string;
+  line: string;
+}
+
 /** Mirrored from src/main/services/RunHistory.ts so the renderer can render rows. */
 export interface RunHistoryRow {
   id: string;
@@ -39,10 +84,14 @@ export type InvokeChannels = {
 
   'apps:list': { req: void; res: App[] };
   'apps:add': { req: { path: string }; res: App };
+  /** Atomic create: app + first task + env vars in one transaction (replaces the renderer's 4-call add). */
+  'apps:create': { req: CreateAppInput; res: App };
   'apps:update': { req: { id: AppId; patch: Partial<App> }; res: App };
   'apps:remove': { req: { id: AppId }; res: void };
   'apps:detect': { req: { path: string }; res: DetectionResult };
   'apps:findByPath': { req: { path: string }; res: App | null };
+  /** Shallow-scan a folder for package.json projects (bulk import). */
+  'apps:scanFolder': { req: { dir: string }; res: ImportCandidate[] };
 
   // App-level lifecycle (orchestrator coordinates all tasks).
   'proc:start': { req: { id: AppId }; res: void };
@@ -52,6 +101,8 @@ export type InvokeChannels = {
 
   // Task CRUD.
   'tasks:list': { req: { appId: AppId }; res: Task[] };
+  /** All tasks for all apps in one query - used at boot instead of N+1 tasks:list calls. */
+  'tasks:listAll': { req: void; res: Record<string, Task[]> };
   'tasks:add': { req: { appId: AppId; patch: Partial<Task> }; res: Task };
   'tasks:update': { req: { id: TaskId; patch: Partial<Task> }; res: Task };
   'tasks:remove': { req: { id: TaskId }; res: void };
@@ -67,13 +118,21 @@ export type InvokeChannels = {
   'task:tailBuffer': { req: { id: TaskId; maxLines?: number }; res: string };
   'task:clearBuffer': { req: { id: TaskId }; res: void };
 
+  // Visibility-gated log streaming: the renderer subscribes to the task(s) it's showing so
+  // main only forwards `task:log` events for those, instead of every running task.
+  'task:subscribeLogs': { req: { id: TaskId }; res: void };
+  'task:unsubscribeLogs': { req: { id: TaskId }; res: void };
+
+  // Cross-task global log search (fans over every live task's buffer in main).
+  'logs:searchAll': { req: { query: string; flags?: string; limit?: number }; res: GlobalLogMatch[] };
+
   // Resize the PTY when the renderer's xterm grid changes.
   'task:resize': { req: { id: TaskId; cols: number; rows: number }; res: void };
 
   // Run history.
   'runs:list': { req: { appId: AppId; limit?: number }; res: RunHistoryRow[] };
 
-  // Env files discovered in a project (read-only — for the side panel).
+  // Env files discovered in a project (read-only - for the side panel).
   'env:files': { req: { id: AppId }; res: EnvFileInfo[] };
 
   // Settings.
@@ -82,6 +141,12 @@ export type InvokeChannels = {
 
   // Apply a downloaded auto-update (quit & install).
   'update:install': { req: void; res: void };
+  /** Manual "Check for Updates…" - re-runs the feed check now. */
+  'update:check': { req: void; res: void };
+
+  // Diagnostics: DevHarbor's own local log file (no telemetry - for bug reports).
+  'logs:path': { req: void; res: string };
+  'logs:openFolder': { req: void; res: void };
 
   // DB danger zone.
   'db:export': { req: void; res: string | null };          // returns the saved-to path, or null if user cancelled
@@ -99,7 +164,7 @@ export type InvokeChannels = {
   'env:getTask': { req: { id: TaskId }; res: EnvVar[] };
   'env:setTask': { req: { id: TaskId; vars: EnvVar[] }; res: void };
 
-  // Phase 8 — F21 folder operations. App-level folder field is set via apps:update.
+  // Phase 8 - F21 folder operations. App-level folder field is set via apps:update.
   'folders:list': { req: void; res: string[] };
   'folders:rename': { req: { from: string; to: string }; res: void };
   'folders:clear': { req: { name: string }; res: void };
@@ -156,13 +221,19 @@ export type EventChannels = {
   };
 
   /** An update is available (download starting). */
-  'update:available': { version: string };
+  'update:available': { version: string; releaseNotes?: string };
 
   /** Download progress for an in-flight update. */
   'update:progress': { percent: number; bytesPerSecond: number; transferred: number; total: number };
 
   /** An update has finished downloading; the user should restart to install. */
-  'update:ready': { version: string };
+  'update:ready': { version: string; releaseNotes?: string };
+
+  /** The update feed could not be reached / validated (offline, rate-limited, signature). */
+  'update:error': { message: string };
+
+  /** A manual or periodic check found no newer version. */
+  'update:notAvailable': { version: string };
 
   /** Deep link: focus a specific app. The renderer selects it in the sidebar. */
   'deepLink:focusApp': { appId: AppId };
@@ -171,8 +242,8 @@ export type EventChannels = {
   'deepLink:unknownPath': { path: string };
 
   /**
-   * Deep link: `devharbor://start?id=…` asked to start an app. We do NOT start it silently —
-   * any web page can fire this — so the renderer must confirm with the user first, then call
+   * Deep link: `devharbor://start?id=…` asked to start an app. We do NOT start it silently - 
+   * any web page can fire this - so the renderer must confirm with the user first, then call
    * `proc:start`. This keeps a clicked link from running local shell commands without consent.
    */
   'deepLink:confirmStart': { appId: AppId; appName: string };
@@ -181,6 +252,10 @@ export type EventChannels = {
   'menu:openSettings': Record<string, never>;
   'menu:addApp': Record<string, never>;
   'menu:newFolder': Record<string, never>;
+  /** Help → Check for Updates… - renderer invokes update:check so the result toasts. */
+  'menu:checkUpdates': Record<string, never>;
+  /** Help → Open Logs Folder - renderer invokes logs:openFolder. */
+  'menu:openLogs': Record<string, never>;
 };
 
 export interface EnvFileInfo {
@@ -205,6 +280,18 @@ export interface SettingsState {
   auto_update: boolean;
   theme: 'light' | 'dark' | 'system';
   dashboard_refresh_ms: number;
+  /** Show a desktop notification when a task crashes while DevHarbor is backgrounded. */
+  notify_on_crash: boolean;
+  /** Show a desktop notification when an app finishes starting (readiness reached). */
+  notify_on_ready: boolean;
+  /** Launch DevHarbor automatically at macOS login. */
+  launch_at_login: boolean;
+  /** Show the menubar tray icon. */
+  tray_enabled: boolean;
+  /** Keep at most this many run_history rows per app (older rows pruned on boot). */
+  run_history_limit: number;
+  /** Abort a task's start if its readiness signal hasn't fired within this many ms. */
+  readiness_timeout_ms: number;
 }
 
 export type InvokeChannelName = keyof InvokeChannels;
@@ -214,71 +301,93 @@ export type InvokeReq<C extends InvokeChannelName> = InvokeChannels[C]['req'];
 export type InvokeRes<C extends InvokeChannelName> = InvokeChannels[C]['res'];
 export type EventPayload<C extends EventChannelName> = EventChannels[C];
 
-export const INVOKE_CHANNELS: readonly InvokeChannelName[] = [
-  'app:ping',
-  'apps:list',
-  'apps:add',
-  'apps:update',
-  'apps:remove',
-  'apps:detect',
-  'apps:findByPath',
-  'proc:start',
-  'proc:stop',
-  'proc:restart',
-  'proc:list',
-  'tasks:list',
-  'tasks:add',
-  'tasks:update',
-  'tasks:remove',
-  'tasks:reorder',
-  'task:start',
-  'task:stop',
-  'task:list',
-  'task:readBuffer',
-  'task:tailBuffer',
-  'task:clearBuffer',
-  'task:resize',
-  'runs:list',
-  'env:files',
-  'settings:get',
-  'settings:set',
-  'update:install',
-  'openIn:caps',
-  'openIn:open',
-  'db:export',
-  'db:reset',
-  'db:path',
-  'env:getGlobal',
-  'env:setGlobal',
-  'env:getApp',
-  'env:setApp',
-  'env:getTask',
-  'env:setTask',
-  'folders:list',
-  'folders:rename',
-  'folders:clear',
-  'node:list',
-  'node:resolve',
-  'dialog:browse'
-] as const;
-
-export const EVENT_CHANNELS: readonly EventChannelName[] = [
-  'task:log',
-  'task:status',
-  'task:stats',
-  'task:ports',
-  'proc:status',
-  'env:fileChanged',
-  'update:available',
-  'update:progress',
-  'update:ready',
-  'deepLink:focusApp',
-  'deepLink:unknownPath',
-  'deepLink:confirmStart',
-  'menu:openSettings',
-  'menu:addApp',
-  'menu:newFolder'
-] as const;
+/**
+ * The runtime allow-lists the preload bridge checks against. Derived from a `satisfies
+ * Record<…, true>` map so that adding a channel to the type but forgetting it here is a
+ * COMPILE error (and vice-versa) - the arrays can no longer silently drift from the types.
+ */
+const INVOKE_CHANNEL_FLAGS = {
+  'app:ping': true,
+  'apps:list': true,
+  'apps:add': true,
+  'apps:create': true,
+  'apps:update': true,
+  'apps:remove': true,
+  'apps:detect': true,
+  'apps:findByPath': true,
+  'apps:scanFolder': true,
+  'proc:start': true,
+  'proc:stop': true,
+  'proc:restart': true,
+  'proc:list': true,
+  'tasks:list': true,
+  'tasks:listAll': true,
+  'tasks:add': true,
+  'tasks:update': true,
+  'tasks:remove': true,
+  'tasks:reorder': true,
+  'task:start': true,
+  'task:stop': true,
+  'task:list': true,
+  'task:readBuffer': true,
+  'task:tailBuffer': true,
+  'task:clearBuffer': true,
+  'task:subscribeLogs': true,
+  'task:unsubscribeLogs': true,
+  'logs:searchAll': true,
+  'task:resize': true,
+  'runs:list': true,
+  'env:files': true,
+  'settings:get': true,
+  'settings:set': true,
+  'update:install': true,
+  'update:check': true,
+  'logs:path': true,
+  'logs:openFolder': true,
+  'openIn:caps': true,
+  'openIn:open': true,
+  'db:export': true,
+  'db:reset': true,
+  'db:path': true,
+  'env:getGlobal': true,
+  'env:setGlobal': true,
+  'env:getApp': true,
+  'env:setApp': true,
+  'env:getTask': true,
+  'env:setTask': true,
+  'folders:list': true,
+  'folders:rename': true,
+  'folders:clear': true,
+  'node:list': true,
+  'node:resolve': true,
+  'dialog:browse': true
+} satisfies Record<InvokeChannelName, true>;
+
+export const INVOKE_CHANNELS = Object.keys(INVOKE_CHANNEL_FLAGS) as InvokeChannelName[];
+
+const EVENT_CHANNEL_FLAGS = {
+  'task:log': true,
+  'task:status': true,
+  'task:stats': true,
+  'task:ports': true,
+  'proc:status': true,
+  'env:fileChanged': true,
+  'update:available': true,
+  'update:progress': true,
+  'update:ready': true,
+  'update:error': true,
+  'update:notAvailable': true,
+  'deepLink:focusApp': true,
+  'deepLink:unknownPath': true,
+  'deepLink:confirmStart': true,
+  'menu:openSettings': true,
+  'menu:addApp': true,
+  'menu:newFolder': true,
+  'menu:checkUpdates': true,
+  'menu:openLogs': true
+} satisfies Record<EventChannelName, true>;
+
+export const EVENT_CHANNELS = Object.keys(EVENT_CHANNEL_FLAGS) as EventChannelName[];
 
 export type Api = {
   invoke: <C extends InvokeChannelName>(
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 1c058d2..96bb591 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -19,6 +19,8 @@ export interface App {
   customCommand: string | null;
   workingDir: string;
   autoRestartOnChange: boolean;
+  /** Start this app automatically when DevHarbor launches. */
+  autoStart: boolean;
   watchGlobs: string[];
   portHint: number | null;
   tags: string[];
@@ -112,6 +114,15 @@ export interface RunningTask {
   exitSignal: string | null;
 }
 
+export interface WorkspaceCandidate {
+  /** Package name (or directory name) of the workspace package. */
+  name: string;
+  /** Path relative to the repo root, e.g. "apps/api". */
+  relPath: string;
+  scripts: string[];
+  suggestedScript: string | null;
+}
+
 export interface DetectionResult {
   packageManager: PackageManager | null;
   nodeVersionFromProject: string | null;
@@ -119,6 +130,10 @@ export interface DetectionResult {
   hasEnvFile: boolean;
   envFiles: string[];
   suggestedDefaultScript: string | null;
+  /** False when the chosen folder has no package.json - the add flow warns instead of silently accepting. */
+  hasPackageJson: boolean;
+  /** Workspace packages found via pnpm-workspace.yaml / package.json "workspaces" (monorepo support). */
+  workspaces: WorkspaceCandidate[];
 }
 
 export interface NodeInstallation {