diff --git a/AGENTS.md b/AGENTS.md
index bce678f9..0266ba44 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -161,11 +161,16 @@ All file operations go through Rust commands - never use Node.js fs APIs.
 - **CI**: Runs `npm audit`, `npm run check`, `npm test`, `npm run test:vitest` and
   `cargo test` on PRs
 
-Two kinds of assertion live in this suite: behavior tests, which import and run the real
-modules, and source-shape assertions, which match the source text for a contract the
-compiler cannot check — a Tauri command name, an i18n key, a second copy of a fixed
-behavior. A green run is not a claim that every behavior is covered; a source-shape
-assertion passes as long as the line it matches is still spelled that way.
+Tests run the real code and assert what it does. A test does not read source as text —
+no regex over a file, no slicing a function body, no cutting code out of a component and
+evaluating it: such a test guards a spelling, goes red on a rename and stays green on a
+regression. When the logic sits in a component where a test cannot call it, move it into a
+`.ts` or `.svelte.ts` module the component calls, and test the module.
+
+The `*.checks.*` files are the one exception, and are meant to shrink: they hold contract
+checks (a Tauri command or event name, a config key, an i18n key — the spelling that joins
+Rust and TypeScript) and convention checks ("one implementation of this behavior"), until
+those move to generated bindings and lint rules.
 
 ### Where a test goes
 
@@ -198,22 +203,11 @@ what an effect writes cannot fail. Under vitest the module is compiled for real
 **Leave it as `*.test.ts` (`node --test`) otherwise.** Plain TypeScript modules run fine
 there, the runner is already configured, and moving a passing file buys nothing.
 
-**Do not migrate `.svelte` component tests.** Mounting a component here means jsdom
-standing in for Monaco, mermaid and KaTeX, and the assertion it earns — "the handler is
-wired up" — is weaker than the source-shape assertion it replaced, not stronger.
-
-### What must never be migrated
-
-Two categories are correct *because* they are text assertions, and a runtime test cannot
-express them at all:
-
-- **Cross-language contracts.** A `#[tauri::command]` name, an event name, a config key: one
-  side is Rust and the other is TypeScript, and nothing but the spelling connects them.
-  Running the TypeScript proves the TypeScript.
-- **Single-implementation conventions.** "There is exactly one copy of this behavior", "no
-  other caller passes this flag", "this constant is not hard-coded a second time". These are
-  claims about the *absence* of a second implementation. Executing the one implementation
-  that exists cannot observe a second one; only reading the source can.
+**Mount a component only for its markup wiring, and only one that does not need Monaco,
+mermaid or KaTeX.** The suite mounts `Toc`, `HomePage`, `Settings`, `TitleBar`, `Tab`,
+`UpdateDialog` and `ContextMenu` this way (vitest, jsdom; stub `Element.prototype.animate`
+for transitions). `MarkdownViewer.svelte` and `Editor.svelte` are not mounted: their logic is
+tested through the modules they call.
 
 ### Migrating a file
 
diff --git a/samples/stress-test.md b/samples/stress-test.md
index 0fa6a689..39db8f0a 100644
--- a/samples/stress-test.md
+++ b/samples/stress-test.md
@@ -505,8 +505,8 @@ the preprocessing passes look for.
 
 The one dimension this file cannot carry is line endings — it is LF throughout,
 and the original was CRLF. That half is covered by
-`scripts/taskToggleLineEndings.test.ts`, which drives both endings through the
-real write-back.
+`scripts/documents.save.spec.ts` ("task toggle line endings"), which drives
+both endings through the real write-back.
 
 ## Task-Like Text That Is Not A Task
 
diff --git a/scripts/documents.checks.spec.ts b/scripts/documents.checks.spec.ts
deleted file mode 100644
index 804a3a50..00000000
--- a/scripts/documents.checks.spec.ts
+++ /dev/null
@@ -1,1071 +0,0 @@
-import assert from 'node:assert/strict';
-
-import ts from 'typescript';
-import { afterAll, beforeAll, describe, test } from 'vitest';
-
-import { reviewDirtyTabs } from '../src/lib/sessions/closeReview.js';
-import { sourceAtPoint } from '../src/lib/utils/previewCursor.js';
-import { callbackBodies, functionSource, offsetOf, readSource, sliceBetween, sliceFrom } from './sourceTree.js';
-
-// Each describe installs its own Tauri stub in `beforeAll`. This one only
-// answers the settings store, which boots when the modules below are imported.
-(window as any).__TAURI_INTERNALS__ = {
-	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
-};
-
-const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
-const { settings } = await import('../src/lib/stores/settings.svelte.js');
-const { createDocumentSession } = await import('../src/lib/sessions/documentSession.svelte.js');
-
-// An unanswered external-change conflict is a question only the user can
-// answer. The viewer's saves that nobody asked for — leaving the editor or
-// split view, and the exit's auto-save — used to go through the same wrapper as
-// Cmd+S, which authorises the overwrite whenever the bar is up. So Ctrl+E or
-// quitting wrote the buffer over the other program's change and took the bar
-// down without asking.
-//
-// The functions are lifted out of MarkdownViewer.svelte and RUN against the
-// real document session, so what is asserted is what reaches the disk.
-describe('silent saves keep conflicts', () => {
-	const disk = new Map<string, string>();
-
-	beforeAll(() => {
-		(window as any).__TAURI_INTERNALS__ = {
-			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-			invoke: (cmd: string, args: any) => {
-				if (cmd === 'canonicalize_path') return Promise.resolve(args.path);
-				if (cmd === 'read_file_content_checked') return Promise.resolve([disk.get(args.path) ?? '', false, 'UTF-8']);
-				if (cmd === 'open_markdown_preview') return Promise.resolve([disk.get(args.path) ?? '', true, false, 'UTF-8']);
-				if (cmd === 'save_file_content') {
-					disk.set(args.path, args.content);
-					return Promise.resolve(null);
-				}
-				if (cmd === 'get_os_type') return Promise.resolve('macos');
-				return Promise.resolve(null);
-			},
-		};
-	});
-
-	const LIFTED = [
-		'hasExternalChangeConflict',
-		'noteExternalChangeConflict',
-		'clearExternalChangeConflict',
-		'resolveExternalChangeByKeepingBuffer',
-		'saveContent',
-		'saveSilently',
-		'flushBeforeLeavingEditableMode',
-		'settleForExit',
-	];
-
-	function makeViewer() {
-		const closeQuestions: boolean[] = [];
-		const toasts: string[] = [];
-		const scope: Record<string, unknown> = {
-			tabManager,
-			externalChangeConflicts: {},
-			comparison: null,
-			settings: { autoSave: true, language: 'en', restoreStateOnReopen: false },
-			t: (key: string) => key,
-			addToast: (message: string) => void toasts.push(message),
-			invoke: async () => null,
-			tick: async () => {},
-			reviewDirtyTabs,
-			isCloseWalkActive: false,
-			pinFilesAtClose: null,
-			openFilePaths: () => [],
-			savePinnedTagIfNeeded: async () => {},
-			persistWindowState: async () => {},
-		};
-		const session = createDocumentSession({
-			setShowHome: () => {},
-			currentFile: () => tabManager.activeTab?.path ?? '',
-			resetScrollHistory: () => {},
-			renderMarkdown: async (raw: string) => raw,
-			afterLoad: async () => {},
-			saveRecentFile: () => {},
-			deleteRecentFile: () => {},
-			setLoadingTabs: () => {},
-			measureInitialViewport: () => {},
-			isScrolling: () => false,
-			onError: () => {},
-			onDiskChangedUnderSave: (id: string) => (fns.noteExternalChangeConflict as (id: string) => void)(id),
-			cancelPendingAutoSave: () => {},
-			askClose: async (_title: string, diskMoved: boolean) => {
-				closeQuestions.push(diskMoved);
-				return 'cancel' as const;
-			},
-			onCloseSaveNewerEdits: () => {},
-			onCloseAutoSaveFailed: () => {},
-			onPartialCopySaved: () => {},
-		});
-		scope.documentSession = session;
-		scope.canCloseTab = (id: string) => session.canCloseTab(id);
-
-		const source = readSource('src/lib/MarkdownViewer.svelte');
-		const declarations = LIFTED.map((name) => `const ${name} = ${functionSource(source, name)};`).join('\n');
-		const js = ts.transpileModule(declarations, {
-			compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-		}).outputText;
-		const fns = new Function('scope', `with (scope) { ${js}\nreturn { ${LIFTED.join(', ')} }; }`)(
-			new Proxy(scope, { has: (target, key) => key in target }),
-		) as Record<string, (...args: any[]) => Promise<unknown>>;
-		return { fns, scope, closeQuestions, toasts };
-	}
-
-	/** a.md was saved, another program then changed it, and the user typed once more. */
-	function conflicted(viewer: ReturnType<typeof makeViewer>) {
-		tabManager.closeAll();
-		disk.clear();
-		disk.set('/notes/a.md', 'saved');
-		tabManager.addTab('/notes/a.md', 'saved');
-		const tab = tabManager.activeTab!;
-		tab.originalContent = 'saved';
-		tab.isEditing = true;
-		disk.set('/notes/a.md', 'theirs');
-		tabManager.updateTabRawContent(tab.id, 'saved!');
-		(viewer.fns.noteExternalChangeConflict as unknown as (id: string) => void)(tab.id);
-		return tab;
-	}
-
-	test('leaving the editor keeps the edit in the buffer and the bar up', async () => {
-		const viewer = makeViewer();
-		const tab = conflicted(viewer);
-
-		await viewer.fns.flushBeforeLeavingEditableMode(tab);
-
-		assert.equal(disk.get('/notes/a.md'), 'theirs', 'the other program\'s change was overwritten');
-		assert.equal(tab.rawContent, 'saved!');
-		assert.equal(viewer.fns.hasExternalChangeConflict(tab.id), true, 'the bar came down');
-		assert.deepEqual(viewer.toasts, [], 'the bar already says why nothing was written');
-	});
-
-	test('closing the window asks about a conflicted tab instead of saving it', async () => {
-		const viewer = makeViewer();
-		const tab = conflicted(viewer);
-
-		assert.equal(await viewer.fns.settleForExit(), false);
-
-		assert.equal(disk.get('/notes/a.md'), 'theirs', 'the other program\'s change was overwritten');
-		assert.equal(tab.rawContent, 'saved!');
-		assert.deepEqual(viewer.closeQuestions, [true], 'the walk asked the changed-on-disk question');
-	});
-
-	test('the exit still auto-saves the other dirty tabs', async () => {
-		const viewer = makeViewer();
-		conflicted(viewer);
-		disk.set('/notes/b.md', 'b');
-		tabManager.addTab('/notes/b.md', 'b');
-		const b = tabManager.activeTab!;
-		b.originalContent = 'b';
-		tabManager.updateTabRawContent(b.id, 'b edited');
-
-		await viewer.fns.settleForExit();
-
-		assert.equal(disk.get('/notes/b.md'), 'b edited');
-		assert.equal(disk.get('/notes/a.md'), 'theirs');
-	});
-
-	test('Cmd+S on a conflicted tab is still the answer "keep mine"', async () => {
-		const viewer = makeViewer();
-		const tab = conflicted(viewer);
-
-		assert.equal(await viewer.fns.saveContent(tab.id), true);
-
-		assert.equal(disk.get('/notes/a.md'), 'saved!');
-		assert.equal(viewer.fns.hasExternalChangeConflict(tab.id), false);
-	});
-
-	test('"Keep mine" from the comparison answers for the tab it was opened on', async () => {
-		const viewer = makeViewer();
-		const a = conflicted(viewer);
-		// The user switched tabs with the comparison open: b.md is in front, edited,
-		// and another program has just written it too.
-		disk.set('/notes/b.md', 'b');
-		tabManager.addTab('/notes/b.md', 'b');
-		const b = tabManager.activeTab!;
-		b.originalContent = 'b';
-		tabManager.updateTabRawContent(b.id, 'b edited');
-		disk.set('/notes/b.md', 'b theirs');
-
-		// What the overlay's button passes: the tab the comparison was opened on.
-		await viewer.fns.resolveExternalChangeByKeepingBuffer(a.id);
-		await viewer.fns.saveSilently(b.id);
-
-		assert.equal(disk.get('/notes/b.md'), 'b theirs', 'b.md was overwritten on an answer given about a.md');
-		assert.equal(await viewer.fns.saveSilently(a.id), true, 'a.md did not get the answer');
-	});
-
-	test('a conflict does not follow its tab onto another file', async () => {
-		const viewer = makeViewer();
-		const tab = conflicted(viewer);
-		// A link in a.md: the close dialog is answered Don't Save, and b.md loads
-		// into the same tab.
-		disk.set('/notes/b.md', 'b');
-		tab.rawContent = tab.originalContent;
-		await (viewer.scope.documentSession as { loadMarkdown: (path: string, options: object) => Promise<void> })
-			.loadMarkdown('/notes/b.md', { navigate: true });
-		assert.equal(tab.path, '/notes/b.md');
-
-		// b.md is edited, and changed by another program before the watcher says so.
-		tabManager.updateTabRawContent(tab.id, 'b edited');
-		disk.set('/notes/b.md', 'b theirs');
-
-		assert.equal(await viewer.fns.saveContent(tab.id), false);
-		assert.equal(disk.get('/notes/b.md'), 'b theirs', 'Cmd+S used the answer about a.md to overwrite b.md');
-	});
-});
-
-/*
- * A keystroke reaches the document by ONE route, and the dirty flag is not a
- * flag.
- *
- * THE DEFECT. Typing used to write the buffer twice. `MarkdownViewer` passed
- * the editor `bind:value={tabManager.activeTab.rawContent}`, so Svelte's
- * assignment put the new text on the tab; the same listener then called
- * `tabManager.updateTabRawContent`, which put it there again and recomputed
- * `isDirty` from it. Both writes carried the same text, so the app worked — and
- * it worked *because* Svelte's assignment happened to run first. Delete the
- * store call and the editor still edited, the preview still re-rendered, and
- * nothing maintained `isDirty`: no dirty dot, no auto-save, no unsaved-changes
- * prompt on close, and no type error anywhere to say so.
- *
- * WHAT IT IS NOW. `value` is a plain prop — a getter over the parent's
- * `tabManager.activeTab.rawContent` — and the listener's call to the store is
- * the only write. Remove it and the editor stops editing the document, which is
- * a failure you can see; these tests are the ones that see it first.
- *
- * `isDirty` went the same way: a getter on the tab, exactly
- * `rawContent !== originalContent`, so nothing can hold an opinion about
- * "changed?" that its two buffers do not support.
- *
- * WHAT RUNS HERE. The component's own `onDidChangeModelContent` listener,
- * lifted out of Editor.svelte and evaluated against the REAL `TabManager`. Only
- * Monaco is a fake, and only the two methods the listener touches.
- */
-describe('editor writes through the store', () => {
-	// ---------------------------------------------------------------- environment
-	// Svelte runes and the Tauri bridge, faked as the other lifting tests do, so
-	// `tabs.svelte.ts` imports under plain node.
-
-	// The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
-	// Svelte plugin, so the store and the session run under real reactivity, and jsdom
-	// supplies `window` and `localStorage`. Only the Tauri backend is stubbed.
-	beforeAll(() => {
-		(window as any).__TAURI_INTERNALS__ = {
-			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-			invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
-		};
-	});
-
-	// ------------------------------------------------- the component, as written
-
-	const EDITOR = 'src/lib/components/Editor.svelte';
-	const source = readSource(EDITOR);
-
-	const contentChangeBody = (() => {
-		const bodies = callbackBodies(source, 'editor.onDidChangeModelContent');
-		assert.equal(bodies.length, 1, `expected exactly one model-content listener in ${EDITOR}, found ${bodies.length}`);
-		return bodies[0];
-	})();
-
-	/**
-	 * The lifted body is TypeScript and `new Function` only parses JavaScript, so
-	 * it goes through `tsc` first, as tabs.checks.spec.ts and
-	 * editor.imageUndo.checks.spec.ts already do. Types are erased, nothing else: the
-	 * statements that run are the component's.
-	 */
-	const factorySource = ts.transpileModule(
-		`const __component = (tabManager, editor) => {
-			// The status bar readings. Stubbed rather than lifted because they are
-			// the listener's other errand and have their own tests; what is under
-			// test here is where the text goes.
-			const syncStatusFromModel = () => {};
-			let emittedText = null;
-			return { contentChanged: () => ${contentChangeBody} };
-		};`,
-		{ compilerOptions: { target: ts.ScriptTarget.ES2022 } },
-	).outputText;
-
-	/**
-	 * The `value` prop, modelled as what Svelte compiles a dynamic prop to: a
-	 * getter over the parent's expression, `value={tabManager.activeTab.rawContent}`.
-	 * Modelling it as a local copy would be re-introducing the second buffer this
-	 * whole change removed.
-	 *
-	 * A null-prototype object so `with` captures this one name and not
-	 * `toString`, `constructor` and the rest of Object.prototype.
-	 */
-	const propsScope = Object.defineProperty(Object.create(null), 'value', {
-		get: () => tabManager.activeTab?.rawContent ?? '',
-	});
-
-	function editorShowing(text: string) {
-		let onScreen = text;
-		const editor = { getValue: () => onScreen };
-		const factory = new Function(
-			'__props',
-			`with (__props) { ${factorySource}\nreturn __component; }`,
-		)(propsScope) as (tabManager: unknown, editor: unknown) => { contentChanged: () => void };
-		const component = factory(tabManager, editor);
-
-		return {
-			/** A keystroke: Monaco's buffer changes, then it fires the listener. */
-			type: (next: string) => {
-				onScreen = next;
-				component.contentChanged();
-			},
-		};
-	}
-
-	function activeTab() {
-		const tab = tabManager.activeTab;
-		assert.ok(tab, 'precondition: a tab is active');
-		return tab!;
-	}
-
-	// ------------------------------------------------------------------ the tests
-
-	test('a keystroke reaches the document, and the document knows it is unsaved', () => {
-		tabManager.closeAll();
-		tabManager.addTab('/notes/a.md', 'saved text');
-		const editor = editorShowing('saved text');
-
-		assert.equal(activeTab().isDirty, false, 'precondition: a freshly opened tab is clean');
-
-		editor.type('saved text and more');
-
-		assert.equal(
-			activeTab().rawContent,
-			'saved text and more',
-			'the keystroke never reached the document: the editor is writing to something else, or to nothing',
-		);
-		assert.equal(
-			activeTab().isDirty,
-			true,
-			'the document has unsaved edits and does not say so — no dirty dot, no auto-save, no prompt on close',
-		);
-	});
-
-	test('typing the saved text back makes the tab clean again, with nobody clearing a flag', () => {
-		// The point of deriving it. Undo, or retyping what was deleted, leaves a
-		// buffer that IS the saved text — and the only thing that has to happen for
-		// the tab to say so is that the two buffers agree.
-		tabManager.closeAll();
-		tabManager.addTab('/notes/b.md', 'saved text');
-		const editor = editorShowing('saved text');
-
-		editor.type('saved text!');
-		assert.equal(activeTab().isDirty, true);
-
-		editor.type('saved text');
-		assert.equal(activeTab().isDirty, false, 'the buffer is the saved text and the tab still reads dirty');
-	});
-
-	test('following a link does not leave the tab dirty against the file it just left', () => {
-		// `navigate` repoints the tab at another file before the load lands, so for
-		// that window `path` is the new file and `rawContent` is the old document.
-		// A tab left dirty there arms the auto-save effect, which writes the
-		// document the reader left into the file they opened.
-		tabManager.closeAll();
-		tabManager.addTab('/notes/c.md', 'saved text');
-		const editor = editorShowing('saved text');
-		editor.type('unsaved edits');
-
-		tabManager.navigate(activeTab().id, '/notes/linked.md');
-
-		assert.equal(activeTab().path, '/notes/linked.md');
-		assert.equal(activeTab().isDirty, false, 'the tab claims unsaved edits to a document it no longer holds');
-	});
-});
-
-// Issue #168, second report by @dayeggpi: "allow user to switch to rendered
-// view without saving/creating file ... no way to see rendered view until file
-// is saved".
-//
-// The cause was that reading mode was drawn from DISK: leaving the editor
-// called `loadMarkdown(tab.path)`, so a dirty tab had to be flushed first —
-// silently with auto-save on, through a modal otherwise — or the reader would
-// have shown the pre-edit file. The modal was never protecting the buffer; the
-// buffer survives a view toggle. It was protecting the screen from lying.
-//
-// These tests run the REAL `toggleEdit` / `toggleSplitView` / the real
-// `renderTabPreviewFromRaw` out of MarkdownViewer.svelte against the real
-// TabManager, with the disk, the renderer and the modal faked. `loadMarkdown`
-// is faked to behave like the real one (dirty short-circuit included) and to
-// serve a DIFFERENT text than the buffer, so any route that goes back to the
-// file is visible in the rendered output rather than merely in the call log.
-//
-// The boundary tests at the bottom are the other half of the argument: closing
-// a tab and closing the window still ask, because there the buffer really is
-// about to disappear.
-describe('view mode without saving', () => {
-	// ---------------------------------------------------------------- environment
-
-	// The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
-	// Svelte plugin, so the store and the session run under real reactivity, and jsdom
-	// supplies `window` and `localStorage`. Only the Tauri backend is stubbed.
-	beforeAll(() => {
-		(window as any).__TAURI_INTERNALS__ = {
-			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-			invoke: () => Promise.reject(new Error('no invoke expected in these tests')),
-		};
-	});
-
-	// `settings` is one store for the whole file: put back what this block changes.
-	let settingsBefore: { autoSave: typeof settings.autoSave };
-	beforeAll(() => {
-		settingsBefore = { autoSave: settings.autoSave };
-	});
-	afterAll(() => {
-		Object.assign(settings, settingsBefore);
-	});
-
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	// ------------------------------------------------------------ source plucking
-
-	/**
-	 * Slice one `async function <name>(...) { ... }` out of the component.
-	 *
-	 * Brace counting, but string/template/comment aware — a naive count trips over
-	 * the first `{` inside a comment or a template literal and silently returns a
-	 * body that stops in the middle, which would make every assertion below
-	 * meaningless in exactly the direction that hides bugs.
-	 */
-	function pluck(name: string, required = true): string {
-		const asyncStart = viewer.indexOf(`async function ${name}(`);
-		const syncStart = viewer.indexOf(`\tfunction ${name}(`);
-		const start = asyncStart !== -1 ? asyncStart : syncStart === -1 ? -1 : syncStart + 1;
-		if (start === -1) {
-			assert.ok(!required, `expected MarkdownViewer.svelte to define ${name}`);
-			return '';
-		}
-		let i = offsetOf(viewer, '{', offsetOf(viewer, ')', start));
-		let depth = 0;
-		for (; i < viewer.length; i++) {
-			const c = viewer[i];
-			const next = viewer[i + 1];
-			if (c === '/' && next === '/') {
-				i = viewer.indexOf('\n', i);
-				continue;
-			}
-			if (c === '/' && next === '*') {
-				i = viewer.indexOf('*/', i) + 1;
-				continue;
-			}
-			if (c === "'" || c === '"' || c === '`') {
-				const quote = c;
-				for (i++; i < viewer.length; i++) {
-					if (viewer[i] === '\\') i++;
-					else if (viewer[i] === quote) break;
-				}
-				continue;
-			}
-			if (c === '{') depth++;
-			else if (c === '}' && --depth === 0) return viewer.slice(start, i + 1);
-		}
-		assert.fail(`unbalanced braces while slicing ${name}`);
-	}
-
-	type Harness = {
-		toggleEdit: () => Promise<void>;
-		toggleSplitView: (tabId: string) => Promise<void>;
-	};
-
-	type Fakes = {
-		disk: Map<string, string>;
-		askCustomCalls: string[];
-		saveCalls: string[];
-		loadCalls: string[];
-		renderedFrom: string[];
-		toasts: string[];
-		saveFails: boolean;
-		/** Text the "user" appends while `saveContent` is awaiting (TOCTOU). */
-		typeDuringSave: string;
-	};
-
-	/** `renderMarkdownPreview`'s stand-in: the output names what it was given. */
-	const rendered = (raw: string) => `<html>${raw}</html>`;
-
-	function buildHarness(fakes: Fakes, isEditing: boolean, panes: Record<string, unknown> = {}): Harness {
-		const source = [
-			pluck('renderTabPreviewFromRaw'),
-			// Absent on the pre-fix baseline, where both toggles inline their own
-			// save/modal flow. Optional so this file runs — and fails on behaviour
-			// rather than on a missing symbol — against either version.
-			pluck('flushBeforeLeavingEditableMode', false),
-			pluck('renderPreviewLeavingEditableMode', false),
-			pluck('toggleEdit'),
-			pluck('toggleSplitView'),
-		].join('\n\n');
-
-		const js = ts.transpileModule(source, {
-			compilerOptions: { target: ts.ScriptTarget.ES2022 },
-		}).outputText;
-
-		const factory = new Function(
-			'deps',
-			`"use strict";
-			const {
-				tabManager, settings, t, addToast, askCustom, saveSilently, hasExternalChangeConflict,
-				cancelPendingAutoSave, renderMarkdownPreview, loadMarkdown,
-				documentSession, invoke, isEditing, liveMode, toggleLiveMode,
-				tick, renderRichContent, editorPane, markdownBody,
-				getPreviewScrollSyncPosition, restoreAfterLeavingEditor,
-			} = deps;
-			let previewPlacing = false;
-			${js}
-			return { toggleEdit, toggleSplitView };`,
-		);
-
-		return factory({
-			tabManager,
-			settings,
-			isEditing,
-			hasExternalChangeConflict: () => false,
-			t: (key: string) => key,
-			addToast: (message: string) => fakes.toasts.push(message),
-			askCustom: async (message: string) => {
-				fakes.askCustomCalls.push(message);
-				return 'save' as const;
-			},
-			// Mirrors documentSession.saveContent for a tab that has a path.
-			saveSilently: async (tabId: string) => {
-				fakes.saveCalls.push(tabId);
-				const tab = tabManager.tabs.find((item) => item.id === tabId)!;
-				if (fakes.saveFails) return false;
-				const snapshot = tab.rawContent;
-				await Promise.resolve();
-				if (fakes.typeDuringSave) tab.rawContent = snapshot + fakes.typeDuringSave;
-				fakes.disk.set(tab.path, snapshot);
-				tab.originalContent = snapshot;
-				return true;
-			},
-			cancelPendingAutoSave: () => {},
-			renderMarkdownPreview: async (raw: string) => {
-				fakes.renderedFrom.push(raw);
-				return rendered(raw);
-			},
-			// The disk route, with the real function's dirty short-circuit.
-			loadMarkdown: async (path: string, options: any = {}) => {
-				fakes.loadCalls.push(path);
-				const activeId = tabManager.activeTabId!;
-				const receiving = tabManager.tabs.find((item) => item.id === activeId)!;
-				if (receiving.isDirty && receiving.path === path && !options.discardUnsavedBuffer) return;
-				const content = fakes.disk.get(path) ?? '';
-				fakes.renderedFrom.push(content);
-				tabManager.updateTabContent(activeId, rendered(content));
-				tabManager.setTabRawContent(activeId, content);
-			},
-			documentSession: { ensureFullContent: async () => true, isLossySaveRefused: () => false },
-			invoke: async () => {
-				throw new Error('no invoke expected while leaving an editable pane');
-			},
-			liveMode: false,
-			toggleLiveMode: () => {},
-			tick: async () => {},
-			// No panes unless a test asks: where the reader lands (#799) is not
-			// what the rest of this file is about.
-			editorPane: undefined,
-			markdownBody: undefined,
-			...panes,
-		});
-	}
-
-	function freshFakes(): Fakes {
-		return {
-			disk: new Map(),
-			askCustomCalls: [],
-			saveCalls: [],
-			loadCalls: [],
-			renderedFrom: [],
-			toasts: [],
-			saveFails: false,
-			typeDuringSave: '',
-		};
-	}
-
-	const ON_DISK = '# saved heading\n';
-	const IN_BUFFER = '# saved heading\n\nan edit that was never written to disk\n';
-
-	/**
-	 * A tab holding unsaved edits to a real file, in whichever editable pane the
-	 * caller names, with the file on disk still carrying the pre-edit text.
-	 */
-	function dirtyTab(mode: 'edit' | 'split', path = '/notes/note.md') {
-		tabManager.closeAll();
-		const fakes = freshFakes();
-		fakes.disk.set(path, ON_DISK);
-		tabManager.addTab(path);
-		const tab = tabManager.activeTab!;
-		tabManager.setTabRawContent(tab.id, ON_DISK);
-		tab.isEditing = mode === 'edit';
-		tabManager.setSplitEnabled(tab.id, mode === 'split');
-		tabManager.updateTabRawContent(tab.id, IN_BUFFER);
-		assert.equal(tab.isDirty, true, 'precondition: the tab is dirty');
-		return { tab, fakes, harness: buildHarness(fakes, mode === 'edit') };
-	}
-
-	/**
-	 * `autoSave` used to be half of a pair — the other, `confirmBeforeSave`, could
-	 * veto it, and every decision in the app read `autoSave && !confirmBeforeSave`.
-	 * The pair is now the one switch that expression always described, so the two
-	 * old combinations that meant "do not write silently" are the single `false`
-	 * here.
-	 */
-	function setSettings(autoSave: boolean) {
-		settings.autoSave = autoSave;
-	}
-
-	// ------------------------------------------------------- leaving edit mode
-
-	test('a dirty file switches to reading mode without a modal and without writing', async () => {
-		setSettings(false);
-		const { tab, fakes, harness } = dirtyTab('edit');
-
-		await harness.toggleEdit();
-
-		assert.deepEqual(fakes.askCustomCalls, [], 'no unsaved-changes modal on a view toggle');
-		assert.deepEqual(fakes.saveCalls, [], 'nothing is written to disk');
-		assert.equal(fakes.disk.get(tab.path), ON_DISK, 'the file is untouched');
-		assert.equal(tab.isEditing, false, 'the user actually reaches reading mode');
-		assert.equal(tab.isDirty, true, 'the edits are still unsaved, and still flagged as such');
-		assert.equal(tab.rawContent, IN_BUFFER, 'the buffer is intact');
-	});
-
-	test('reading mode shows the buffer, not the file', async () => {
-		setSettings(false);
-		const { tab, harness, fakes } = dirtyTab('edit');
-
-		await harness.toggleEdit();
-
-		// The whole point of the bug: with a disk read here, this is `ON_DISK`.
-		assert.equal(tab.content, rendered(IN_BUFFER));
-		assert.deepEqual(
-			fakes.renderedFrom,
-			[IN_BUFFER],
-			'the preview is rendered once, from the buffer',
-		);
-		assert.deepEqual(fakes.loadCalls, [], 'the file is not re-read to leave the editor');
-	});
-
-	test('an untitled buffer never reaches the Save dialog on a view toggle', async () => {
-		setSettings(true);
-		tabManager.closeAll();
-		const fakes = freshFakes();
-		tabManager.addTab('');
-		const tab = tabManager.activeTab!;
-		tab.isEditing = true;
-		tabManager.updateTabRawContent(tab.id, '# untitled\n');
-		const harness = buildHarness(fakes, true);
-
-		await harness.toggleEdit();
-
-		assert.deepEqual(fakes.saveCalls, [], 'saveContent would open the Save dialog for a pathless tab');
-		assert.equal(tab.isEditing, false);
-		assert.equal(tab.content, rendered('# untitled\n'));
-	});
-
-	test('auto-save still flushes on the way out, because the debounce is about to be dropped', async () => {
-		// The auto-save effect requires `isEditing || isSplit`, so this is the last
-		// chance to honour "save automatically" for these edits.
-		setSettings(true);
-		const { tab, fakes, harness } = dirtyTab('edit');
-
-		await harness.toggleEdit();
-
-		assert.deepEqual(fakes.saveCalls, [tab.id]);
-		assert.equal(fakes.disk.get(tab.path), IN_BUFFER, 'the flush actually wrote the buffer');
-		assert.deepEqual(fakes.askCustomCalls, [], 'the flush is silent — it is the user\'s own setting');
-		assert.equal(tab.isDirty, false);
-		assert.equal(tab.isEditing, false);
-		assert.equal(tab.content, rendered(IN_BUFFER));
-	});
-
-	test('a file that cannot be written no longer traps the user in the editor', async () => {
-		// Read-only path, or a buffer the lossy-decode guard refuses: saveContent
-		// returns false forever, and the old code returned early on that, so
-		// reading mode was unreachable for the life of the tab.
-		setSettings(true);
-		const { tab, fakes, harness } = dirtyTab('edit');
-		fakes.saveFails = true;
-
-		await harness.toggleEdit();
-
-		assert.deepEqual(fakes.saveCalls, [tab.id], 'the flush was attempted');
-		assert.ok(fakes.toasts.includes('toast.autoSaveFailed'), 'and the failure was reported');
-		assert.equal(tab.isEditing, false, 'but the view still switches');
-		assert.equal(tab.content, rendered(IN_BUFFER));
-		assert.equal(tab.isDirty, true, 'the buffer is still there to be rescued');
-	});
-
-	test('edits typed during the flush are shown, and reported as not yet on disk', async () => {
-		setSettings(true);
-		const { tab, fakes, harness } = dirtyTab('edit');
-		fakes.typeDuringSave = 'typed while saving\n';
-
-		await harness.toggleEdit();
-
-		assert.equal(tab.isDirty, true);
-		assert.ok(fakes.toasts.includes('toast.savedNewerEdits'), 'the disk is one revision behind');
-		assert.equal(tab.isEditing, false, 'the TOCTOU case is no longer a reason to stay in the editor');
-		assert.equal(
-			tab.content,
-			rendered(IN_BUFFER + 'typed while saving\n'),
-			'the preview shows the newest text, which is exactly what is NOT on disk',
-		);
-	});
-
-	// --------------------------------------------------- closing the split view
-
-	test('closing split view on a dirty file neither asks nor writes', async () => {
-		setSettings(false);
-		const { tab, fakes, harness } = dirtyTab('split');
-
-		await harness.toggleSplitView(tab.id);
-
-		assert.deepEqual(fakes.askCustomCalls, []);
-		assert.deepEqual(fakes.saveCalls, []);
-		assert.deepEqual(fakes.loadCalls, []);
-		assert.equal(fakes.disk.get(tab.path), ON_DISK, 'the file is untouched');
-		assert.equal(tab.isSplit, false);
-		assert.equal(tab.isDirty, true);
-		assert.equal(tab.content, rendered(IN_BUFFER), 'the surviving pane keeps showing the buffer');
-	});
-
-	test('closing split view honours auto-save the same way leaving edit mode does', async () => {
-		setSettings(true);
-		const { tab, fakes, harness } = dirtyTab('split');
-
-		await harness.toggleSplitView(tab.id);
-
-		assert.deepEqual(fakes.saveCalls, [tab.id]);
-		assert.deepEqual(fakes.askCustomCalls, []);
-		assert.equal(tab.isSplit, false);
-		assert.equal(tab.content, rendered(IN_BUFFER));
-	});
-
-	test('closing the window still reviews unsaved tabs', () => {
-		// The close handler is where the buffer is really at stake: it dies with
-		// the window. Source-level, because it is wired to a Tauri window event.
-		// Quit goes through the same handler now — `appExit` closes windows and
-		// decides nothing about their buffers (#390).
-		const exit = pluck('appExit');
-		assert.doesNotMatch(exit, /askCustom/, 'quit asks nothing of its own; the close handler does the asking');
-
-		const closeHandler = sliceBetween(viewer, 'appWindow.onCloseRequested', 'onDragDropEvent');
-		assert.match(closeHandler, /await settleForExit\(/, 'the close still runs the review');
-		assert.match(pluck('settleForExit'), /canCloseTab,\n/, 'the walk still runs the per-tab dialog');
-	});
-
-	test('the view toggles no longer re-read the file to leave an editable pane', () => {
-		// Belt and braces for the behaviour above: neither toggle may reach for
-		// the disk again. `renderTabPreviewFromRaw` is the shared "render THIS
-		// tab's buffer under its own path" helper (it also serves the PDF export).
-		const toggleEdit = pluck('toggleEdit');
-		const leaveEditMode = toggleEdit.slice(0, offsetOf(toggleEdit, '// Switch to edit'));
-		assert.doesNotMatch(leaveEditMode, /loadMarkdown/);
-		assert.doesNotMatch(leaveEditMode, /askCustom/);
-
-		const toggleSplit = pluck('toggleSplitView');
-		const closeSplit = sliceFrom(toggleSplit, 'setSplitEnabled(tab.id, false)');
-		assert.doesNotMatch(closeSplit, /loadMarkdown/);
-		assert.doesNotMatch(toggleSplit, /askCustom/);
-	});
-
-	// ------------------------------------------------ where the reader lands (#799)
-
-	test('Ctrl+E hands each pane the line the other one was showing', async () => {
-		setSettings(false);
-		const { tab, fakes } = dirtyTab('edit');
-		const fromEditor = { section: 'body', ratio: 0.4, line: 120 };
-		const fromPreview = { section: 'body', ratio: 0.7, line: 300 };
-		const synced: unknown[] = [];
-		const restored: unknown[] = [];
-		const panes = {
-			editorPane: {
-				scrollSyncPosition: () => fromEditor,
-				syncScrollToPosition: (position: unknown) => synced.push(position),
-			},
-			markdownBody: {},
-			getPreviewScrollSyncPosition: () => fromPreview,
-			restoreAfterLeavingEditor: (_id: string, position: unknown) => restored.push(position),
-		};
-
-		await buildHarness(fakes, true, panes).toggleEdit();
-		assert.equal(tab.isEditing, false);
-		assert.deepEqual(restored, [fromEditor], 'the preview was not sent to the editor\'s line');
-
-		await buildHarness(fakes, false, panes).toggleEdit();
-		assert.equal(tab.isEditing, true);
-		assert.deepEqual(synced, [fromPreview], 'the editor was not sent to the preview\'s line');
-	});
-
-	test('Ctrl+E brings the cursor on screen only when the outline follows it', async () => {
-		// An outline marking the cursor's heading while the editor shows another
-		// one reads as wrong, so with 'cursor' the handoff moves a cursor left off
-		// screen. With 'scroll' the outline never looks at the cursor, and moving
-		// it would only lose the reader's place.
-		const asked: unknown[] = [];
-		for (const follows of ['cursor', 'scroll'] as const) {
-			settings.tocFollows = follows;
-			const { tab, fakes } = dirtyTab('edit');
-			tab.isEditing = false;
-			await buildHarness(fakes, false, {
-				editorPane: { syncScrollToPosition: (_position: unknown, options: unknown) => asked.push(options) },
-				markdownBody: {},
-				getPreviewScrollSyncPosition: () => ({ section: 'body', ratio: 0.5, line: 40 }),
-			}).toggleEdit();
-		}
-		settings.tocFollows = 'scroll';
-		assert.deepEqual(asked, [{ cursorIntoView: true }, { cursorIntoView: false }]);
-	});
-
-	// Scroll sync is split view's. The tab keeps `isScrollSynced` after the split
-	// closes, and out of split the other pane is still mounted at zero width, so
-	// syncing through it dragged the visible pane off its line on every Ctrl+E.
-	function buildSyncHarness(panes: Record<string, unknown>) {
-		const source = [
-			pluck('handleEditorScrollSync'),
-			pluck('splitScrollSyncOn', false),
-			pluck('syncEditorToPreviewScroll'),
-			pluck('restoreAfterLeavingEditor'),
-			pluck('followToc'),
-			pluck('handleEditorCursor'),
-			pluck('placePreviewCursor'),
-		].join('\n\n');
-		const js = ts.transpileModule(source, { compilerOptions: { target: ts.ScriptTarget.ES2022 } }).outputText;
-		const factory = new Function(
-			'deps',
-			`"use strict";
-			const {
-				tabManager, tick, viewerPaneEl, markdownBody, editorPane, lineCoords,
-				tabAnchorForEditorTopLine, asBufferLine, scrollPreviewToSyncPosition,
-				getPreviewScrollSyncPosition, getPreviewScrollAnchor, settings, hasEditorPane, hasPreviewPane, isEditing, isSplit,
-				previewBlocks, sourceAtPoint, readRendererLine,
-			} = deps;
-			let tocActiveLine = null;
-			let previewPlacing = false;
-			const cursorByTab = {};
-			const activeCursor = deps.activeCursor ?? null;
-			${js}
-			return {
-				handleEditorScrollSync, syncEditorToPreviewScroll, restoreAfterLeavingEditor, handleEditorCursor, followToc, placePreviewCursor,
-				toc: () => tocActiveLine,
-				cursors: () => cursorByTab,
-				startPlacing: () => { previewPlacing = true; },
-			};`,
-		);
-		return factory({
-			tabManager,
-			tick: async () => {},
-			viewerPaneEl: undefined,
-			markdownBody: {},
-			lineCoords: { toRendererLine: (line: number) => line - 3, toBufferLine: (line: number) => line + 3 },
-			settings,
-			hasEditorPane: false,
-			hasPreviewPane: true,
-			isEditing: false,
-			isSplit: false,
-			tabAnchorForEditorTopLine: (_coords: unknown, line: number) => line,
-			asBufferLine: (line: number) => line,
-			getPreviewScrollSyncPosition: () => ({ section: 'body', ratio: 0.5, line: 40 }),
-			...panes,
-		});
-	}
-
-	test('scroll sync left on in split view stays off once the split closes', async () => {
-		tabManager.closeAll();
-		tabManager.addTab('/notes/note.md');
-		const tab = tabManager.activeTab!;
-		tabManager.setSplitEnabled(tab.id, true);
-		if (!tab.isScrollSynced) tabManager.toggleScrollSync(tab.id);
-		const toPreview: unknown[] = [];
-		const toEditor: unknown[] = [];
-		const harness = buildSyncHarness({
-			scrollPreviewToSyncPosition: (position: unknown) => toPreview.push(position),
-			editorPane: { syncScrollToPosition: (position: unknown) => toEditor.push(position) },
-		});
-		const position = { section: 'body', ratio: 0.5, line: 40 };
-
-		harness.handleEditorScrollSync(position);
-		harness.syncEditorToPreviewScroll({});
-		assert.equal(toPreview.length, 1, 'precondition: split view syncs the preview');
-		assert.equal(toEditor.length, 1, 'precondition: split view syncs the editor');
-
-		tabManager.setSplitEnabled(tab.id, false);
-		tab.isEditing = true;
-		assert.equal(tab.isScrollSynced, true, 'the tab still remembers the choice');
-
-		harness.handleEditorScrollSync(position);
-		harness.syncEditorToPreviewScroll({});
-		assert.equal(toPreview.length, 1, 'the hidden preview was scrolled from the editor');
-		assert.equal(toEditor.length, 1, 'the editor was scrolled from the hidden preview');
-		assert.equal(harness.toc(), 40, 'the outline still follows the editor');
-	});
-
-	test('leaving the editor moves the outline to the line the preview lands on', async () => {
-		tabManager.closeAll();
-		tabManager.addTab('/notes/note.md');
-		const tab = tabManager.activeTab!;
-		tab.isEditing = false;
-		const harness = buildSyncHarness({
-			scrollPreviewToSyncPosition: () => {},
-			getPreviewScrollAnchor: () => 57,
-		});
-
-		await harness.restoreAfterLeavingEditor(tab.id, { section: 'body', ratio: 0.5, line: 58 });
-
-		assert.equal(tab.anchorLine, 57);
-		assert.equal(harness.toc(), 57, 'the outline kept the entry from before the switch');
-	});
-
-	// #799: "the table of contents should follow the cursor". An editor setting,
-	// because only the editor has one: the preview alone always follows the scroll.
-	describeOutlineSource('cursor', true, (h) => {
-		h.handleEditorCursor(20, 1);
-		assert.equal(h.toc(), 17, 'the cursor line, in the outline\'s numbering');
-		h.handleEditorScrollSync({ section: 'body', ratio: 0.5, line: 60 });
-		assert.equal(h.toc(), 17, 'scrolling the editor left it on the cursor');
-		h.handleEditorCursor(30, 1);
-		assert.equal(h.toc(), 27);
-	});
-
-	describeOutlineSource('cursor', false, async (h) => {
-		h.handleEditorCursor(20, 1);
-		assert.equal(h.toc(), null, 'no editor on screen, so no cursor to follow');
-		await h.restoreAfterLeavingEditor(tabManager.activeTab!.id, { section: 'body', ratio: 0.5, line: 58 });
-		assert.equal(h.toc(), 57, 'the preview alone follows its scroll');
-	});
-
-	describeOutlineSource('scroll', true, (h) => {
-		h.handleEditorCursor(20, 1);
-		assert.equal(h.toc(), null, 'the default ignores the cursor');
-		h.handleEditorScrollSync({ section: 'body', ratio: 0.5, line: 60 });
-		assert.equal(h.toc(), 60);
-		// The editor alone keeps the preview mounted at zero width, and its
-		// scroll events put the outline on a heading from that layout.
-		h.followToc('preview', 90);
-		assert.equal(h.toc(), 60, 'the hidden preview moved the outline');
-	});
-
-	function describeOutlineSource(
-		follows: 'cursor' | 'scroll',
-		editorOnScreen: boolean,
-		run: (harness: ReturnType<typeof buildSyncHarness>) => void | Promise<void>,
-	) {
-		test(`the outline follows the ${follows} setting with the editor ${editorOnScreen ? 'on' : 'off'} screen`, async () => {
-			tabManager.closeAll();
-			tabManager.addTab('/notes/note.md');
-			tabManager.activeTab!.isEditing = editorOnScreen;
-			settings.tocFollows = follows;
-			try {
-				await run(buildSyncHarness({
-					hasEditorPane: editorOnScreen,
-					hasPreviewPane: !editorOnScreen,
-					isEditing: editorOnScreen,
-					scrollPreviewToSyncPosition: () => {},
-					getPreviewScrollAnchor: () => 57,
-				}));
-			} finally {
-				settings.tocFollows = 'scroll';
-			}
-		});
-	}
-
-	test('the preview does not move the outline after Ctrl+E until it is placed', async () => {
-		// Its scroll events before that report the old position, and the outline
-		// flashed the first headings until the preview was placed.
-		tabManager.closeAll();
-		tabManager.addTab('/notes/note.md');
-		const tab = tabManager.activeTab!;
-		tab.isEditing = false;
-		const harness = buildSyncHarness({ scrollPreviewToSyncPosition: () => {}, getPreviewScrollAnchor: () => 57 });
-
-		harness.handleEditorScrollSync({ section: 'body', ratio: 0.5, line: 40 });
-		harness.startPlacing();
-		harness.followToc('preview', 2);
-		assert.equal(harness.toc(), 40, 'an unplaced preview put the outline on its own line');
-
-		await harness.restoreAfterLeavingEditor(tab.id, { section: 'body', ratio: 0.5, line: 58 });
-		assert.equal(harness.toc(), 57, 'the placed preview decides');
-		harness.followToc('preview', 60);
-		assert.equal(harness.toc(), 60, 'and keeps deciding once placed');
-	});
-
-	test('reading with a cursor placed, the outline stays on it only while the preview draws it', () => {
-		tabManager.closeAll();
-		tabManager.addTab('/notes/note.md');
-		tabManager.activeTab!.isEditing = false;
-		settings.tocFollows = 'cursor';
-		try {
-			settings.previewCursor = true;
-			const drawn = buildSyncHarness({ activeCursor: { line: 20, column: 3 }, hasEditorPane: false });
-			drawn.followToc('cursor', 17);
-			drawn.followToc('preview', 90);
-			assert.equal(drawn.toc(), 17, 'the preview scroll moved the outline off the drawn cursor');
-
-			// Off, the editor's last cursor is still there for Ctrl+E, but the
-			// preview shows nothing, so an outline pinned to it would look stuck.
-			settings.previewCursor = false;
-			const hidden = buildSyncHarness({ activeCursor: { line: 20, column: 3 }, hasEditorPane: false });
-			hidden.followToc('cursor', 17);
-			hidden.followToc('preview', 90);
-			assert.equal(hidden.toc(), 90, 'the outline stayed on a cursor the preview does not show');
-
-			const without = buildSyncHarness({ hasEditorPane: false });
-			without.followToc('preview', 90);
-			assert.equal(without.toc(), 90, 'with no cursor yet, the outline follows the scroll');
-		} finally {
-			settings.tocFollows = 'scroll';
-			settings.previewCursor = false;
-		}
-	});
-
-	test('a click in the preview places the cursor only with its setting on, whatever the outline follows', () => {
-		// #799: the shared cursor is an editing aid in its own right, so Ctrl+E
-		// lands on the clicked character in either outline mode. The drawn caret
-		// is visual noise to some readers, so the whole aid is off by default.
-		const root = document.createElement('div');
-		root.innerHTML = '<p data-sourcepos="2:1-2:11">hello world</p>';
-		const text = root.querySelector('p')!.firstChild!;
-		(document as any).caretRangeFromPoint = () => {
-			const range = document.createRange();
-			range.setStart(text, 6);
-			return range;
-		};
-		tabManager.closeAll();
-		tabManager.addTab('/notes/note.md');
-		const tab = tabManager.activeTab!;
-		tab.isEditing = false;
-		const click = () => {
-			const harness = buildSyncHarness({
-				previewBlocks: root,
-				sourceAtPoint,
-				readRendererLine: (line: number) => (line === 2 ? 'hello world' : ''),
-				activeCursor: { line: 5, column: 7 },
-			});
-			harness.placePreviewCursor({ detail: 1, clientX: 0, clientY: 0 } as MouseEvent);
-			return harness;
-		};
-		try {
-			settings.tocFollows = 'cursor';
-			const off = click();
-			assert.deepEqual(off.cursors(), {}, 'off by default: the click leaves the cursor alone');
-			assert.equal(off.toc(), null);
-
-			settings.previewCursor = true;
-			for (const follows of ['scroll', 'cursor'] as const) {
-				settings.tocFollows = follows;
-				const harness = click();
-				assert.deepEqual(harness.cursors()[tab.id], { line: 5, column: 7 }, `${follows}: the click placed the cursor on the "w"`);
-				assert.equal(harness.toc(), follows === 'cursor' ? 2 : null, `${follows}: the outline`);
-			}
-		} finally {
-			settings.tocFollows = 'scroll';
-			settings.previewCursor = false;
-			delete (document as any).caretRangeFromPoint;
-		}
-	});
-});
diff --git a/scripts/documents.checks.test.ts b/scripts/documents.checks.test.ts
index be56917e..af7aedd7 100644
--- a/scripts/documents.checks.test.ts
+++ b/scripts/documents.checks.test.ts
@@ -1,16 +1,9 @@
 import assert from 'node:assert/strict';
-import { existsSync } from 'node:fs';
 import { describe, test } from 'node:test';
 
 import { LIST_MARKER, TASK_BOX } from '../src/lib/utils/listSyntax.js';
 import { MARKDOWN_LINK_EXTENSIONS } from '../src/lib/utils/markdownLinks.js';
-import { DEFAULT_OPEN_FILE_MODE } from '../src/lib/utils/openFileMode.js';
-import { viewerCommandTable } from './keymapHarness.js';
 import {
-	callbackBodies,
-	filesMatching,
-	functionSource,
-	offsetOf,
 	readDictionarySource,
 	readRustBackend,
 	readSource,
@@ -79,60 +72,12 @@ describe('checked read migration', () => {
 		assert.doesNotMatch(rust, /^\s*read_file_content,\s*$/m, 'and must not be registered again');
 	});
 
-	test('entering the editor reads the fidelity and stores it', () => {
-		const toggle = sliceBetween(viewer, 'async function toggleEdit', 'async function saveContent');
-		assert.match(toggle, /\[content, lossy, encoding\] = \(await invoke\('read_file_content_checked', \{ path: tab\.path \}\)\)/);
-		const read = offsetOf(toggle, 'read_file_content_checked');
-		const flag = offsetOf(toggle, 'setTabDecodedLossy(tab.id, lossy)');
-		const store = offsetOf(toggle, 'setTabRawContent(tab.id, content)');
-		assert.ok(read < flag && flag < store, 'flag the tab before the buffer is published');
-	});
-
-	test('entering split view reads the fidelity and stores it', () => {
-		const enter = sliceBetween(viewer, 'async function toggleSplitView', '} else {');
-		assert.match(enter, /\[content, lossy, encoding\] = \(await invoke\('read_file_content_checked', \{ path: tab\.path \}\)\)/);
-		const flag = offsetOf(enter, 'setTabDecodedLossy(tab.id, lossy)');
-		const store = offsetOf(enter, 'setTabRawContent(tab.id, content)');
-		assert.ok(flag < store, 'flag the tab before the buffer is published');
-	});
-
 	// --- the repeating toast ------------------------------------------------------
 
-	test('the session can tell a refusal from a failure', () => {
-		// `saveContent` returns false for both, which is why the auto-save timer
-		// could not tell them apart. The predicate is no longer set membership on
-		// its own: the set records what was SAID, and whether the refusal still
-		// stands is asked of the tab. `documents.save.spec.ts` exercises
-		// both halves for real; this only pins that the tab is consulted at all,
-		// since a predicate that answers from memory alone is the defect.
-		const body = sliceBetween(
-			readSource('src/lib/sessions/documentSession.svelte.ts'),
-			'function isLossySaveRefused(',
-			'function updateLoading',
-		);
-		assert.match(body, /lossySaveWarnedTabs\.has\(tabId\)/);
-		assert.match(body, /hasReplacementChars/, 'the live tab decides whether anything is still being refused');
-	});
-
-	test('a refused save does not add a generic toast to its own explanation', () => {
-		const body = sliceBetween(viewer, 'Auto-save effect.', 'for (const id of [');
-		const check = offsetOf(body, 'if (documentSession.isLossySaveRefused(s.id)) return;');
-		const toast = offsetOf(body, "t('toast.autoSaveFailed'");
-		assert.ok(check < toast, 'the refusal must be recognised before the generic toast is raised');
-	});
-
 	test('a tab that can only be refused stops re-arming the timer', () => {
-		// Auto-save re-arms on every keystroke. Without this the guard was reached
-		// again every 1.5s for as long as the user kept typing — each time
-		// producing the console warning, the wasted round trip, and (before the
-		// test above) the toast.
-		const body = sliceBetween(viewer, 'Auto-save effect.', 'for (const id of [');
-		assert.match(body, /decodedLossily: tab\.hasReplacementChars/);
-		assert.match(body, /const eligible = [^;]*!\(s\.decodedLossily && documentSession\.isLossySaveRefused\(s\.id\)\)/);
-		// The FIRST attempt must still happen: it is what produces the explanation.
-		// `isLossySaveRefused` is false until the guard has spoken, so eligibility
-		// only drops afterwards — and "Save As" to a new file clears
-		// `hasReplacementChars`, which restores it.
+		// The eligibility rule runs in documents.test.ts "auto-save debounce". What
+		// is left: "Save As" to a new file forgets that the refusal was said, so a
+		// later lossy load into the same tab is explained again.
 		assert.match(
 			readSource('src/lib/sessions/documentSession.svelte.ts'),
 			/lossySaveWarnedTabs\.delete\(tab\.id\)/,
@@ -161,224 +106,27 @@ describe('checked read migration', () => {
 // it is the user's only way out.
 describe('lossy decode save guard', () => {
 	const session = readSource('src/lib/sessions/documentSession.svelte.ts');
-	const windowSession = readSource('src/lib/sessions/windowSession.svelte.ts');
-	const tabs = readSource('src/lib/stores/tabs.svelte.ts');
 	const rust = readRustBackend();
 
-	const loadMarkdown = () => sliceBetween(session, 'async function loadMarkdown', 'async function saveContent');
-	const saveContent = () => sliceBetween(session, 'async function saveContent(', 'async function saveContentAs');
-	const saveContentAs = () => sliceBetween(session, 'async function saveContentAs', 'async function toggleTaskCheckbox');
-	const guard = () => sliceBetween(session, 'function refuseIfLossilyDecoded', 'function updateLoading');
-
-	test('one decoder, and it reports what it destroyed', () => {
-		// The fact is known exactly once — when the bytes are decoded — and was
-		// thrown away. Detection (#372) made the decode able to succeed where it
-		// used to substitute, but not able to always succeed, so the decoder still
-		// carries the verdict rather than growing a second path.
-		assert.match(rust, /struct DecodedText \{[^}]*\bcontent: String,[^}]*\blossy: bool/s);
-		assert.match(rust, /fn decode_text\(bytes: &\[u8\]\) -> DecodedText/);
-		assert.match(rust, /fn read_to_string_lossy\(path: &str\) -> std::io::Result<DecodedText>/);
-		assert.equal(rust.match(/fn decode_text\(/g)?.length, 1, 'exactly one decoder');
-	});
-
 	test('both read commands can report fidelity', () => {
 		assert.match(rust, /async fn open_markdown_preview\([^)]*\)\s*-> Result<\(String, bool, bool, String\), String>/s);
 		assert.match(rust, /async fn read_file_content_checked\(path: String\) -> Result<\(String, bool, String\), String>/);
 		assert.match(rust, /read_file_content_checked,/, 'the command must be registered');
 	});
 
-	test('a preview cut inside a multi-byte character is not called lossy', () => {
-		// The preview stops at a fixed byte count, so a perfectly valid UTF-8 file
-		// is routinely cut mid-character. Reporting that as lossy would lock every
-		// large CJK/emoji document out of saving — a guard worse than the bug.
-		const preview = sliceBetween(rust, 'fn build_markdown_preview', '#[tauri::command]');
-		const trim = offsetOf(preview, 'utf8_truncation_boundary');
-		assert.ok(trim < offsetOf(preview, 'decode_text('), 'the split tail is dropped before fidelity is judged');
-	});
-
-	test('the tab carries the fidelity of its buffer', () => {
-		// Required, not optional: a construction site that forgot it would default
-		// to "safe to overwrite", and the failure mode is a destroyed document.
-		assert.match(tabs, /hasReplacementChars: boolean;/);
-		assert.doesNotMatch(tabs, /hasReplacementChars\?: boolean;/);
-		assert.match(tabs, /setTabDecodedLossy\(id: string, lossy: boolean\)/);
-		assert.equal(tabs.match(/hasReplacementChars: false/g)?.length, 4);
-	});
-
-	test('every load decides the flag instead of leaving it stale', () => {
-		// A reload of a file the user has since converted to UTF-8 must clear it.
-		const body = loadMarkdown();
-		assert.match(body, /as \[string, boolean, boolean, string\]/);
-		assert.match(body, /setTabDecodedLossy\(activeId, lossy\)/);
-		// The full load REPLACES the preview's buffer, so it brings its own
-		// verdict: a file can be valid UTF-8 for the first 50KB and not after.
-		assert.match(body, /read_file_content_checked/);
-		assert.match(body, /setTabDecodedLossy\(activeId, fullLossy\)/);
-	});
-
-	test('the editable-pane shortcut reports fidelity too', () => {
-		// #374 added a second way into loadMarkdown: a pane that can WRITE skips
-		// the preview and reads the whole file up front. That branch fills an
-		// editable buffer, so it is exactly the kind of caller that must not use
-		// the bare command — it would hand the editor unflagged mojibake.
-		const body = loadMarkdown();
-		assert.match(
-			body,
-			/if \(initialIsEditing \|\| initialIsSplit\) \{\s*\[content, lossy, encoding\] = \(await invoke\('read_file_content_checked'/,
-		);
-		// `ensureFullContent` was the one place the bare command survived, and only
-		// because it re-read a file whose tab loadMarkdown had already flagged —
-		// an invariant enforced by two call sites agreeing rather than by the code.
-		// It now reads the fidelity itself, so no writable buffer in this file is
-		// filled by a command that cannot report one.
-		const bare = session.match(/invoke\('read_file_content'/g)?.length ?? 0;
-		assert.equal(bare, 0, 'no writable buffer may be filled by the unchecked command');
-		assert.match(
-			sliceBetween(session, 'async function ensureFullContent', 'const lossySaveWarnedTabs'),
-			/invoke\('read_file_content_checked'/,
-		);
-		assert.match(
-			sliceBetween(session, 'async function ensureFullContent', 'const lossySaveWarnedTabs'),
-			/setTabDecodedLossy\(tabId, lossy\)/,
-		);
-	});
-
-	test('the flag is set before the buffer can reach a writer', () => {
-		const body = loadMarkdown();
-		const set = offsetOf(body, 'setTabDecodedLossy(activeId, lossy)');
-		const buffer = offsetOf(body, 'setTabRawContent(activeId, content');
-		assert.ok(set < buffer, 'the flag must be set before the buffer it describes');
-		assert.doesNotMatch(body.slice(set, buffer), /await /, 'and in the same synchronous block');
-	});
-
-	test('window restore cannot launder the flag away', () => {
-		// Restore reads each file back into an editable buffer. With the bare
-		// command it produced mojibake that looked safe to save, so reopening the
-		// app was a way around the guard. It now reads through `loadMarkdown`,
-		// which sets the flag on every load, and reads nothing itself.
-		assert.doesNotMatch(windowSession, /invoke\('read_file/);
-		assert.match(sliceBetween(session, 'function readRestoredTab', 'function readActiveIfUnread'), /return loadMarkdown\(tab\.path,/);
-		assert.match(loadMarkdown(), /tabManager\.setTabDecodedLossy\(activeId, lossy\)/);
-	});
-
-	test('saveContent refuses to write a lossy buffer over its own file', () => {
-		const body = saveContent();
-		const refusal = offsetOf(body, 'refuseIfLossilyDecoded');
-		assert.match(body.slice(refusal, refusal + 120), /return false;/);
-		assert.ok(
-			refusal < offsetOf(body, "invoke('save_file_content'"),
-			'the guard must run before save_file_content is invoked',
-		);
-	});
-
-	test('the guard protects the source file only', () => {
-		const body = guard();
-		// An untitled buffer has no source file to destroy, and any other path is
-		// a new UTF-8 file — neither is blocked.
-		assert.match(body, /targetPath === ''/);
-		assert.match(body, /targetPath !== tab\.path/);
-		assert.match(body, /return true;/);
-	});
-
-	test('saveContent is the choke point auto-save and the close dialogs share', () => {
-		// Auto-save lives in MarkdownViewer.svelte's debounce effect and the close
-		// flow in canCloseTab; both reach saveContent, so guarding it covers them
-		// without touching either.
-		assert.match(session, /const success = await saveContent\(tabId\);/);
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		assert.match(viewer, /saveSilently\(s\.id\)\.then\(/);
-		assert.match(functionSource(viewer, 'saveSilently'), /documentSession\.saveContent\(tabId\)/);
-	});
-
-	test('Save As to a new file stays open as the escape hatch', () => {
-		const body = saveContentAs();
-		// Explicitly UTF-8, never the tab's own encoding: the copy exists to be
-		// readable when the original could not be read, or could not represent
-		// what the user typed into it.
-		assert.match(body, /invoke\('save_file_content', \{ path: selected, content: snapshot, encoding: 'UTF-8' \}\)/);
-		// Once written, the buffer matches a UTF-8 file of its own.
-		assert.match(body, /setTabDecodedLossy\(tab\.id, false\)/);
-		assert.match(body, /setTabEncoding\(tab\.id, 'UTF-8'\)/);
-	});
-
-	test('Save As onto the same file is still a destructive overwrite', () => {
-		const body = saveContentAs();
-		// "The same file", not "the same string": the dialog can come back with
-		// another spelling of the source file — a different case, or accents
-		// composed differently — and on macOS and Windows that still lands on the
-		// same bytes. The guard is therefore handed the target's resolved identity
-		// as well as its path. See tabs.spec.ts, which drives
-		// that refusal for real instead of reading for it.
-		const refusal = offsetOf(body, 'refuseIfLossilyDecoded(tab, selected');
-		assert.ok(
-			refusal < offsetOf(body, "invoke('save_file_content'"),
-			'the guard must run before save_file_content is invoked',
-		);
-	});
-
-	test('the refusal tells the user what to do and is not repeated per keystroke', () => {
-		// Auto-save re-arms on every edit; an undeduplicated toast would fire
-		// every 1.5s. The message names "Save As" because that is the only exit.
-		const body = guard();
-		assert.match(body, /toast\.lossySaveBlocked/);
-		assert.match(body, /lossySaveWarnedTabs\.has\(tab\.id\)/);
+	test('the refusal names Save As, the only exit', () => {
+		// i18n wording. That the session raises this message once per tab is
+		// driven in documents.session.spec.ts.
 		const i18n = readDictionarySource();
 		assert.match(i18n, /lossySaveBlocked: 'Not saved: parts of this file could not be read in any encoding/);
 		assert.match(i18n, /use "Save As" to write a copy/);
 	});
 });
 
-describe('save from reading mode', () => {
-	test('the browser save dialog is always suppressed', () => {
-		// preventDefault has to run for every mode, including the no-op case, or
-		// reading mode would surface the webview's own Save Page dialog. It is one
-		// unconditional call on the command rather than one per branch now, so this
-		// reads the six-line handler rather than the branch it used to sit in — and
-		// covers all twenty-two commands instead of Save alone.
-		const handler = functionSource(readSource('src/lib/MarkdownViewer.svelte'), 'handleKeyDown');
-		assert.match(
-			handler,
-			/if \(!command\) return;\s*\n\s*e\.preventDefault\(\);/,
-			'a command that runs must have had the keystroke prevented first',
-		);
-	});
-
-	/*
-	 * The three below are the residue of this seam, and they say so.
-	 *
-	 * What Ctrl+S DOES is a closure over `tabManager.activeTab` inside the
-	 * component, which is the one thing that could not move: see the note on
-	 * `viewerCommandTable` in `keymapHarness.ts`. They are still text assertions —
-	 * but text anchored on a `case 'save':` label rather than on a chord condition,
-	 * so the rename that reddened five of these in #647 no longer reaches them.
-	 */
-	const saveCommand = () => viewerCommandTable()['save'];
-
-	test('an untitled buffer can be saved from reading mode', () => {
-		// `path === ''` is the untitled case; documentSession.saveContent opens
-		// the Save dialog for it, so no extra plumbing is needed here.
-		assert.match(saveCommand(), /saveTarget\.path === ''/);
-	});
-
-	test('a saved, unmodified document does not write on Ctrl+S', () => {
-		// Writing unconditionally would touch mtime and wake the file watcher,
-		// which in live mode reloads the tab -- a keystroke that reads as a no-op
-		// to the user should not move the document underneath them.
-		assert.match(saveCommand(), /saveTarget\.isDirty \|\| saveTarget\.path === ''/);
-	});
-
-	test('the HOME tab is not savable', () => {
-		// HOME carries the sentinel path 'HOME' and is never dirty, so the guard
-		// excludes it without naming it. This pins that reasoning: if the guard
-		// ever becomes unconditional, HOME would start opening a Save dialog.
-		assert.doesNotMatch(saveCommand(), /^\s*saveContent\(\);\s*$/m);
-	});
-});
-
 describe('unsaved recovery', () => {
 	test('the close decision commands are spelled the same in the viewer and in Rust', () => {
 		// Cross-language contract: only the string connects invoke() to the command.
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
+		const viewer = readSource('src/lib/sessions/windowExit.ts');
 		const rust = readSource('src-tauri/src/window_runtime.rs');
 		for (const name of ['keeps_unsaved_on_close', 'set_quitting']) {
 			assert.ok(viewer.includes(`invoke<boolean>('${name}'`) || viewer.includes(`invoke('${name}'`), `viewer does not invoke ${name}`);
@@ -392,64 +140,20 @@ describe('live mode watched path', () => {
 	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 
 	test('a watcher notification is routed to its watched path', () => {
+		// The event name across Rust and TypeScript. What the viewer does with the
+		// event runs in documents.conflicts.spec.ts (handleFileChanged).
 		assert.match(runtime, /emit_to\(event_label\.as_str\(\), "file-changed", watched_path\.clone\(\)\)/);
-		// `async` because deciding what an event means now reads the file: the
-		// answer to "did somebody else write this" is the file itself, not a clock.
-		assert.match(viewer, /await appWindow\.listen\('file-changed', async \(event\) => \{/);
-		assert.match(viewer, /const changedPath = event\.payload as string;/);
-		// The listener no longer compares the payload with the active file itself:
-		// resolveExternalChange looks up the tab that OWNS the changed path (and
-		// refuses to reload it when it has unsaved edits). See
-		// documents.load.spec.ts for the routing behaviour.
-		assert.match(viewer, /await documentSession\.resolveExternalChange\(changedPath\)/);
-		// A conflict is reported with Live Mode off too; Live Mode gates only the reload.
-		assert.match(viewer, /if \(liveMode\) loadMarkdown\(outcome\.path\);/);
-		const session = readSource('src/lib/sessions/documentSession.svelte.ts');
-		assert.match(session, /tabManager\.tabs\.find\(\(tab\) => tab\.path === changedPath\)/);
+		assert.match(viewer, /await appWindow\.listen\('file-changed', \(event\) => externalChange\.handleFileChanged\(event\.payload as string, liveMode\)\)/);
 	});
 
-	test('the watcher follows the active file instead of retaining a previous tab watcher', () => {
-		assert.match(viewer, /if \(currentFile\) \{\n\t\t\tinvoke\('watch_file', \{ path: currentFile \}\)/);
-
-		// The defect #296 fixed was `documentSession` re-issuing `watch_file` on
-		// every load, so the watcher followed whichever document loaded last rather
-		// than the active one. It used to be pinned as
-		// `/isLiveMode\(\)\) invoke\('watch_file'/` — the exact one-line spelling
-		// the defect happened to be written in, against a file where neither token
-		// occurs any more. Rewriting the same call as an ordinary `if (…) { … }`
-		// evaded it. What has to hold is who may call it: the effect above, alone.
-		const watchers = filesMatching(readSourceFiles('src'), /invoke\(\s*'watch_file'/);
-		assert.deepEqual(watchers, ['src/lib/MarkdownViewer.svelte'], 'one owner for the file watcher');
-
-		const watchingEffects = callbackBodies(viewer, '$effect').filter((body) => /'watch_file'/.test(body));
-		assert.equal(watchingEffects.length, 1, 'and one effect inside it');
-		assert.match(watchingEffects[0], /invoke\('unwatch_file'\)/, 'the same effect gives the watcher up');
-
+	test('toggling Live Mode does not reload the document', () => {
+		// The watcher half of this case is driven in documents.session.spec.ts
+		// (fileWatch.svelte.ts). The toggle is one assignment inside the viewer.
 		const toggleLiveMode = sliceBetween(viewer, 'function toggleLiveMode', 'async function saveImageAs');
 		assert.doesNotMatch(toggleLiveMode, /loadMarkdown\(/);
 	});
 });
 
-describe('editor line ending', () => {
-	test('the status bar renders the measured label and no longer a translation key', () => {
-		const editor = readSource('src/lib/components/Editor.svelte');
-		const statusBar = sliceBetween(editor, '<div class="status-bar">', '</div>\n{/if}');
-
-		assert.match(statusBar, /<div class="status-item">\{lineEnding\}<\/div>/, 'the line-ending item shows the state');
-		assert.doesNotMatch(editor, /editor\.status\.crlf/, 'the hardcoded CRLF string is gone');
-		assert.match(
-			editor,
-			/lineEnding = lineEndingLabel\(model\)/,
-			'and it is filled from the model, in the function that refreshes document-wide readings',
-		);
-
-		// One line-ending decision reaches this component. A second one — a `\r\n`
-		// test of its own over `getValue()` — is the defect this fix replaces, in a
-		// new place.
-		assert.doesNotMatch(editor, /includes\('\\r\\n'\)/, 'no hand-rolled line-ending detection in the editor');
-	});
-});
-
 describe('file associations', () => {
 	const config = JSON.parse(readSource('src-tauri/tauri.conf.json')) as {
 		bundle: {
@@ -491,22 +195,12 @@ describe('file associations', () => {
 	// note, so the Open dialog has to offer them.
 	test('the Open dialog offers every extension Markpad treats as a document', () => {
 		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		const links = readSource('src/lib/utils/markdownLinks.ts');
 
-		assert.match(links, /MARKDOWN_LINK_EXTENSIONS = \[[^\]]*'txt'/);
-		assert.match(viewer, /\{ name: 'Markdown', extensions: MARKDOWN_LINK_EXTENSIONS \}/);
-		// A literal list is how the two drifted apart in the first place.
+		// The list itself runs in documents.test.ts. What stays is that the viewer's
+		// Open dialog uses it: a literal list is how the two drifted apart.
+		assert.match(viewer, /filters: MARKDOWN_OPEN_FILTERS,/);
 		assert.doesNotMatch(viewer, /extensions: \['md/);
 	});
-
-	test('the Save dialogs offer the same document extensions', () => {
-		// Both hard-coded `['md']`, so a `.txt` note saved under a new name had to
-		// go through "All Files".
-		const session = readSource('src/lib/sessions/documentSession.svelte.ts');
-
-		assert.equal(session.match(/\{ name: 'Markdown', extensions: MARKDOWN_LINK_EXTENSIONS \}/g)?.length, 2);
-		assert.doesNotMatch(session, /extensions: \['md/);
-	});
 });
 
 /**
@@ -539,10 +233,7 @@ describe('file associations', () => {
  *      auto-saving the truncation back over the file.
  */
 describe('open file mode', () => {
-	const sessionSource = readSource(new URL('../src/lib/sessions/documentSession.svelte.ts', import.meta.url));
 	const settingsSource = readSource(new URL('../src/lib/stores/settings.svelte.ts', import.meta.url));
-	const settingsComponentSource = readSource(new URL('../src/lib/components/Settings.svelte', import.meta.url));
-	const tabsSource = readSource(new URL('../src/lib/stores/tabs.svelte.ts', import.meta.url));
 
 	test('the old key is read, never written — a rollback still finds its setting', () => {
 		assert.match(settingsSource, /const LEGACY_START_IN_EDITOR_KEY = 'editor\.startInEditor'/);
@@ -556,74 +247,12 @@ describe('open file mode', () => {
 		assert.doesNotMatch(settingsSource, /key: 'editor\.startInEditor'/);
 	});
 
-	/* ------------------------------------------------------------- the wiring */
-
-	test('opening a document applies the choice, split through the same door the toggle uses', () => {
-		assert.match(sessionSource, /tab\.isEditing = settings\.openFileMode === 'editor'/);
-		assert.match(
-			sessionSource,
-			/if \(settings\.openFileMode === 'split'\) tabManager\.setSplitEnabled\(tab\.id, true\)/,
-		);
-		// The premise of point 1 above: a fresh tab has sync off, and
-		// `setSplitEnabled` is the only place the preference is applied.
-		assert.match(tabsSource, /isScrollSynced: false/);
-		assert.match(
-			tabsSource,
-			/setSplitEnabled\(id: string, enabled: boolean\)[\s\S]{0,200}?tab\.isScrollSynced = this\.splitScrollSyncPreference/,
-		);
-	});
-
-	test('the choice is applied before the load decides how much of the file to read', () => {
-		const applied = sessionSource.indexOf("if (settings.openFileMode === 'split')");
-		const read = sessionSource.indexOf('const initialIsSplit = tab?.isSplit ?? false');
-		const fullRead = sessionSource.indexOf('if (initialIsEditing || initialIsSplit)');
-
-		assert.ok(applied > 0 && read > 0 && fullRead > 0);
-		assert.ok(
-			applied < read && read < fullRead,
-			'a document opening into an editable mode must take the full-read branch, ' +
-				'or the editor is bound to the 50KB preview slice',
-		);
-	});
-
-	test('it applies to a newly opened document only', () => {
-		// Not to a reload that is preserving the mode, and not to a file already
-		// open in a tab — reopening a document must not flip the mode the reader
-		// chose for it. The same guard the checkbox always had.
-		assert.match(sessionSource, /if \(tab && !loadOptions\.preserveEditState && !existing\) \{/);
-	});
-
-	test('a new empty document keeps its own preference', () => {
-		// `Ctrl+N` asks a different question — what an empty buffer opens as — and
-		// answers it with `newFileDefaultMode`. This change must not annex it.
-		assert.match(tabsSource, /isEditing: settings\.newFileDefaultMode/);
-	});
-
-	test('the setting is one control, defaulting to preview', () => {
-		assert.match(settingsSource, /openFileMode = \$state<OpenFileMode>\(DEFAULT_OPEN_FILE_MODE\)/);
-		assert.equal(DEFAULT_OPEN_FILE_MODE, 'preview');
-		assert.match(settingsComponentSource, /<select id="files-open-file-mode" bind:value=\{settings\.openFileMode\}>/);
-		for (const value of ['preview', 'editor', 'split']) {
-			assert.match(settingsComponentSource, new RegExp(`<option value="${value}">`));
-		}
-	});
 });
 
 describe('file drop routing', () => {
 	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 
-	test('the viewer routes both panes through it, and acts on all three answers', () => {
-		const dropHandler = sliceBetween(
-			viewerSource,
-			"} else if (event.payload.type === 'drop') {",
-			'isDragging = false;',
-		);
-
-		assert.match(dropHandler, /const pane = dropPaneFor\(dragTarget, !!currentEditor\);/);
-		assert.match(dropHandler, /switch \(routeDroppedFile\(path, pane\)\)/);
-		assert.match(dropHandler, /case 'insert':[\s\S]{0,120}?handleDroppedFile\(path, x, y\)/);
-		assert.match(dropHandler, /case 'open':[\s\S]{0,80}?loadMarkdown\(path\)/);
-		assert.match(dropHandler, /case 'unsupported':[\s\S]{0,80}?reportUnsupportedDrop\(path\)/);
+	test('the unsupported-drop toast names the file with toast.unsupportedFile', () => {
 		// One toast helper for both panes: the message used to be built inline in
 		// the preview branch, which is part of why the editor branch had nothing
 		// to say.
@@ -635,33 +264,6 @@ describe('file drop routing', () => {
 });
 
 describe('document encoding round trip', () => {
-	// ---------------------------------------------------------- the status bar
-	//
-	// Detection without an indicator is worse than no detection: a GBK document
-	// now opens, reads correctly and saves back as GBK, and the slot that is
-	// supposed to name the encoding was still rendering the literal `UTF-8` it
-	// had rendered since before Markpad could open the file at all. The one place
-	// the user could have caught a misdetection was asserting the opposite.
-	//
-	// This is the same defect #540 fixed one slot to the left, where the line
-	// ending was hardcoded `CRLF`.
-
-	test('the status bar names the encoding the document was decoded from', () => {
-		const editor = readSource('src/lib/components/Editor.svelte');
-		const statusBar = sliceBetween(editor, '<div class="status-bar">', '</div>\n{/if}');
-
-		assert.match(statusBar, /<div class="status-item">\{encoding\}<\/div>/, 'the slot shows the state');
-		assert.doesNotMatch(editor, /editor\.status\.utf8/, 'the hardcoded UTF-8 string is gone');
-
-		// Off the tab, not off Monaco: the encoding belongs to the file the buffer
-		// was decoded from, and the store is what carries it through a save.
-		assert.match(
-			editor,
-			/let encoding = \$derived\(tabManager\.activeTab\?\.encoding \?\? 'UTF-8'\)/,
-			'and it is read from the tab rather than kept as a synced copy',
-		);
-	});
-
 	test('no locale still translates a hardcoded UTF-8 label', () => {
 		// A dead key reads like a supported feature to whoever finds it next.
 		assert.doesNotMatch(readDictionarySource(), /utf8:/);
@@ -703,28 +305,10 @@ describe('document encoding round trip', () => {
 			assert.match(line, /\{\{encoding\}\}/, `no encoding placeholder: ${line.trim().slice(0, 60)}`);
 		}
 	});
-
-	test('the code is turned into the translation, and only that code is', () => {
-		const session = readSource('src/lib/sessions/documentSession.svelte.ts');
-		const describe = functionSource(session, 'describeSaveFailure');
-
-		assert.match(describe, /toast\.encodingUnmappable/);
-		assert.match(describe, /replace\('\{\{encoding\}\}', tab\.encoding\)/,
-			'the encoding comes off the tab, not back out of the error');
-		assert.match(describe, /return \{ message: 'Failed to save file', detail: error \}/,
-			'an I/O failure still reads as one, OS message and all');
-
-		// `onError` renders `${message}: ${detail}`, so returning the raw error as
-		// the detail printed the code the user was never meant to see:
-		//   …请用"另存为"写入一份 UTF-8 副本: ENCODING_UNMAPPABLE:GBK
-		// The translated branch sends the document's path instead, which is what
-		// `toast.lossySaveBlocked` has always done.
-		assert.match(describe, /detail: tab\.path,/, 'the marker never reaches the toast');
-	});
 });
 
 describe('explicit save cancels auto-save', () => {
-	test('no call site takes the cancel duty back from saveContent', async () => {
+	test('no call site takes the cancel duty back from saveContent', () => {
 		// The regression this guards is not a broken save — it is the duty
 		// drifting back out to the call sites, where the next entry point can
 		// forget it again. A cancel immediately before a `saveContent` is the
@@ -737,16 +321,6 @@ describe('explicit save cancels auto-save', () => {
 				`${path} pairs a manual cancel with a save; saveContent already does this`,
 			);
 		}
-
-		// And the duty is discharged before the write, not after — the source-level
-		// mirror of the ordering test above, so a refactor that reorders the two
-		// inside `saveContent` is caught even if the stub harness stops seeing it.
-		const session = readSource('src/lib/sessions/documentSession.svelte.ts');
-		const saveContentBody = session.slice(session.indexOf('async function saveContent('));
-		const cancel = saveContentBody.indexOf('options.cancelPendingAutoSave(');
-		const write = saveContentBody.indexOf("invoke('save_file_content'");
-		assert.ok(cancel !== -1, 'saveContent must cancel the pending auto-save');
-		assert.ok(cancel < write, 'the cancel must come before the write it protects');
 	});
 });
 
@@ -755,38 +329,13 @@ describe('external change reload', () => {
 
 	// --- wiring that cannot be executed outside a Svelte runtime ---
 
-	test('the watcher listener routes every event through the guarded resolution', () => {
-		const body = sliceBetween(viewer, "listen('file-changed'", '}),');
-		assert.match(body, /resolveExternalChange/);
-		// The old body called loadMarkdown(currentFile) directly.
-		assert.doesNotMatch(body, /loadMarkdown\(currentFile\)/);
-	});
-
-	test('a conflict is surfaced with both choices instead of resolving itself', () => {
-		assert.match(viewer, /externalChangeConflicts/);
-		assert.match(viewer, /t\('externalChange\.reload'/);
-		assert.match(viewer, /t\('externalChange\.keepMine'/);
-	});
-
-	test('the debounced auto-save is held back while a conflict is unanswered', () => {
-		// Otherwise the 1.5s timer fires while the bar is still asking "reload or
-		// keep mine": the user's edits survive, but the external change is gone
-		// from disk before either answer can be given.
-		const body = sliceBetween(viewer, 'Auto-save effect.', 'for (const id of [');
-		assert.match(body, /hasPendingConflict: hasExternalChangeConflict\(tab\.id\)/);
-		assert.match(body, /const eligible = [^;]*!s\.hasPendingConflict/);
-	});
-
-	test('an explicit save answers the conflict and takes the bar down', () => {
-		// Pressing Cmd+S is a decision. Leaving the bar up afterwards would ask a
-		// question the user already answered.
-		const body = sliceBetween(viewer, 'async function saveContent(tabId?: string)', 'async function saveContentAs');
-		assert.match(body, /clearExternalChangeConflict/);
-	});
-
 	test('turning Live Mode on does not reload', () => {
 		// Enabling reload is not a request to discard the buffer, and this was
 		// the one loadMarkdown call in the app with no canCloseTab in front of it.
+		//
+		// An absence claim on a one-line toggle. lint-candidate: no-restricted-syntax
+		// on `CallExpression[callee.name='loadMarkdown']` inside
+		// `FunctionDeclaration[id.name='toggleLiveMode']`.
 		const body = sliceBetween(viewer, 'function toggleLiveMode', '\n\t}');
 		assert.doesNotMatch(body, /loadMarkdown/);
 	});
@@ -800,67 +349,11 @@ describe('external change reload', () => {
 		// not follow the file. The button and the chord are now offered in all
 		// three modes; a kill here would take the state straight back off.
 		//
-		// An absence claim about a component that cannot be imported, so it is
-		// matched as source text — the same reason as the four assertions above.
-		const body = sliceBetween(viewer, 'async function toggleSplitView', '\n\t}');
-		assert.doesNotMatch(body, /toggleLiveMode|liveMode\s*=/);
-	});
-
-	// --- #4: the irreversible answer is now visible before it is given ---
-
-	test('the conflict bar offers Compare beside the two answers', () => {
-		// Reload replaces the buffer and `setValue` clears the undo stack with it,
-		// so the bar asks for an irreversible decision. VS Code and Sublime both
-		// put a Compare next to the same two choices.
-		const bar = sliceBetween(viewer, 'external-change-bar', '{/if}');
-		assert.match(bar, /t\('externalChange\.compare'/);
-		assert.match(bar, /t\('externalChange\.reload'/);
-		assert.match(bar, /t\('externalChange\.keepMine'/);
-	});
-
-	test('Compare reads the file at the moment it is asked, not when the bar went up', () => {
-		// The bar can stand for a while. What the user needs to see is the file as
-		// it is when they are actually answering.
-		const fn = sliceBetween(viewer, 'async function compareExternalChange', '\n\t}');
-		assert.match(fn, /read_file_content_checked/);
-		assert.match(fn, /tab\.rawContent/);
-	});
-
-	test('answering the bar closes the comparison with it', () => {
-		// Otherwise the overlay outlives the question and shows a diff against a
-		// version that is no longer either side of anything.
-		for (const name of ['resolveExternalChangeByReloading', 'resolveExternalChangeByKeepingBuffer']) {
-			const fn = sliceBetween(viewer, `function ${name}`, '\n\t}');
-			assert.match(fn, /comparison = null/, `${name} left the comparison open`);
-		}
-	});
-
-	test('the diff view owns its models and never edits the document', () => {
-		// Handing it the tab's live model would put a second editor on a buffer
-		// Editor.svelte owns, and a read-only view of a document is not a place to
-		// change it from.
-		const overlay = readSource('src/lib/components/DiffOverlay.svelte');
-		assert.match(overlay, /createModel\(/);
-		assert.match(overlay, /readOnly: true/);
-		assert.match(overlay, /originalEditable: false/);
-		// Every model it creates is disposed, or opening the view repeatedly leaks
-		// one document's worth of text each time.
-		assert.match(overlay, /for \(const model of models\) model\.dispose\(\)/);
-	});
-});
-
-describe('large file load revision', () => {
-	const sessionPath = 'src/lib/sessions/documentSession.svelte.ts';
-	const session = existsSync(sessionPath) ? readSource(sessionPath) : '';
-
-	test('large-file completion requires the current clean load revision and unchanged view mode', () => {
-		// The revision, the path and the untouched buffer are `claimTabForRead`'s
-		// test; the view mode is the completion's own.
-		assert.match(session, /const mayApplyFull = claimTabForRead\(activeId\);/);
-		assert.match(
-			session,
-			/mayApplyFull\(\) && targetTab\?\.isEditing === initialIsEditing && targetTab\?\.isSplit === initialIsSplit/,
-		);
+		// An absence claim: the view toggles live in `sessions/viewMode`, which
+		// is not handed Live Mode at all. lint-candidate: no-restricted-syntax on
+		// `liveMode` / `toggleLiveMode` identifiers in that module.
+		const viewMode = readSource('src/lib/sessions/viewMode.svelte.ts');
+		assert.doesNotMatch(viewMode, /toggleLiveMode|liveMode/);
 	});
 });
 
@@ -868,106 +361,17 @@ describe('reopening a dirty document', () => {
 	// Cwd-relative, not `import.meta.url`: see the note on `readSource`.
 	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 
-	// A link opened in a new tab takes the ordinary open path, which resolves the
-	// file's identity before picking a tab. Putting the path on a tab first and
-	// loading with `skipTabManagement` compared spellings, so `C:/n/b.md` from a
-	// link opened a second tab beside the `C:\n\b.md` the user already had open.
-	test('a link opened in a new tab goes through the ordinary open path', () => {
-		const fn = sliceBetween(viewer, 'async function openMarkdownTargetInNewTab', '\n\tasync function');
-		assert.doesNotMatch(fn, /tabManager\.addTab\(/);
-		assert.match(fn, /await loadMarkdown\(resolved, \{ inNewTab: true \}\);/);
-	});
-
 	// --- reverting is still possible, and only by saying so ---
 	//
 	// Authorization is declared by the caller, never inferred by the session from
-	// nearby state. An earlier draft let an unanswered external-change conflict
-	// stand in for the user's "Reload" click; that is guessing intent from an
-	// adjacent flag, and two callers can be in that state for different reasons.
-
-	// The two revert commands, and only those two. Anything else that starts
-	// passing this flag is a caller claiming the user chose to lose work.
-	for (const name of ['resolveExternalChangeByReloading', 'reloadFromDisk']) {
-		test(`${name} declares that it is discarding the buffer`, () => {
-			const fn = sliceBetween(viewer, `async function ${name}`, '\n\t}');
-			assert.match(fn, /loadMarkdown\(/);
-			assert.match(fn, /discardUnsavedBuffer: true/);
-		});
-	}
-
+	// nearby state. The two revert commands (Reload on the conflict bar, Reload
+	// from disk) declare it; `documents.conflicts.spec.ts` runs both. Anything
+	// else that starts passing this flag is a caller claiming the user chose to
+	// lose work.
 	test('nothing else in the viewer asks to discard a buffer', () => {
-		assert.equal(viewer.match(/discardUnsavedBuffer: true/g)?.length, 2);
-	});
-});
-
-describe('truncated buffer guard', () => {
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	// --- wiring that cannot be executed outside a Svelte runtime ---
-
-	test('entering split view completes a partial buffer instead of trusting it', () => {
-		// The old guard was `!tab.rawContent`, which a partial buffer satisfies:
-		// split view opened on the truncated text, the first keystroke made it
-		// dirty, and auto-save wrote it back 1.5s later.
-		const enter = sliceBetween(viewer, 'async function toggleSplitView', '} else {');
-		assert.match(enter, /ensureFullContent/);
-		// And it has to stop when the buffer could not be completed, rather than
-		// opening an editor over the partial text anyway.
-		assert.match(enter, /if \(!\(await documentSession\.ensureFullContent\(tab\.id\)\)\) \{[\s\S]*?return;/);
-		// The empty-buffer read must go through the store so the tab does not keep
-		// a stale "partial" flag that would then block every save.
-		assert.match(enter, /tabManager\.setTabRawContent\(tab\.id, content\)/);
-	});
-
-	test('a partial buffer cannot be handed to another window', () => {
-		// The destination rebuilds the tab from the payload alone and has no way
-		// to know the text is incomplete, so its auto-save would truncate the file.
-		//
-		// Each subject is extracted by its own name. The previous form sliced
-		// `'canTransfer: (tabId)'` → `'transferPayload:'`, which ran past
-		// `canDetach`, and `'async function handleDetach'` → `'async function
-		// carryActiveTabToNextWindow'`, which ran past `moveTabToWindow`. Both
-		// swallowed neighbours end in a character-identical copy of the guard being
-		// asserted, so the `assert.match` was satisfied either way: deleting
-		// `&& !tab.isTruncated` from `canTransfer`, and separately deleting the whole
-		// four-line `ensureFullContent` guard from `handleDetach`, each left the
-		// suite green — on the transfer-then-auto-save path this file is named for.
-		//
-		// The two neighbours were therefore never asserted about, only stood in
-		// front of. Both are the same guard on the same path, so both are named.
-		for (const predicate of ['canTransfer', 'canDetach']) {
-			assert.match(
-				functionSource(viewer, predicate),
-				/!tab\.isTruncated/,
-				`${predicate} must refuse a tab whose buffer is still the preview slice`,
-			);
-		}
-		for (const mover of ['handleDetach', 'moveTabToWindow']) {
-			assert.match(
-				functionSource(viewer, mover),
-				/if \(!\(await documentSession\.ensureFullContent\(tabId\)\)\) \{[\s\S]*?return false;/,
-				`${mover} must complete the buffer before the payload is built, and stop when it cannot`,
-			);
-		}
-	});
-
-	test('front matter edits in preview mode complete the buffer first', () => {
-		for (const entry of ['async function handleFrontMatterEdit', 'async function handleFrontMatterListChange']) {
-			// One handler is followed by a `function`, the other by an `async
-			// function`, so the slice ends at whichever comes first. The previous
-			// expression was `indexOf(a) + 1 || indexOf(b) + 1`, which reads as
-			// "or else" but is really "or else, if the first is absent *or at
-			// offset 0*" — and when the first form appeared later in the file than
-			// the second it won anyway, widening the body past the handler and
-			// letting a neighbouring function satisfy the `assert.match` below.
-			const handler = sliceFrom(viewer, entry);
-			const ends = ['\n\tfunction ', '\n\tasync function ']
-				.map((marker) => handler.indexOf(marker))
-				.filter((at) => at !== -1);
-			assert.ok(ends.length > 0, `${entry} must be followed by a declaration that bounds it`);
-			const body = handler.slice(0, Math.min(...ends));
-			assert.match(body, /ensureFullContent/, `${entry} must not edit a partial buffer`);
-		}
+		assert.equal(viewer.match(/discardUnsavedBuffer: true/g), null);
+		const saves = readSource('src/lib/sessions/externalChange.svelte.ts');
+		assert.equal(saves.match(/discardUnsavedBuffer: true/g)?.length, 2);
 	});
 });
 
@@ -998,17 +402,4 @@ describe('task toggle line endings', () => {
 			);
 		}
 	});
-
-	const sessionSource = readSource('src/lib/sessions/documentSession.svelte.ts');
-
-	test('it is marked before anything can be awaited', () => {
-		// The render effect arms its 16ms timer the moment the buffer changes and
-		// checks the field BEFORE that — so marking after an `await` would be too
-		// late to prevent the render it has already scheduled.
-		const fn = sliceBetween(sessionSource, 'async function toggleTaskCheckbox(', '\n\tasync function ');
-		const marked = fn.indexOf('tab.previewedRawContent = updated;');
-		const awaited = fn.indexOf('await saveContent');
-		assert.ok(marked > 0, 'the toggle marks the preview');
-		assert.ok(marked < awaited, 'marked before the first await after the write');
-	});
 });
diff --git a/scripts/documents.conflicts.spec.ts b/scripts/documents.conflicts.spec.ts
new file mode 100644
index 00000000..3e86fac1
--- /dev/null
+++ b/scripts/documents.conflicts.spec.ts
@@ -0,0 +1,397 @@
+import assert from 'node:assert/strict';
+
+import { beforeAll, describe, test } from 'vitest';
+
+// This stub only answers the settings store, which boots when the modules
+// below are imported. The describe installs the one the tests use.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { createDocumentSession } = await import('../src/lib/sessions/documentSession.svelte.js');
+const { createWindowExit } = await import('../src/lib/sessions/windowExit.js');
+const { createExternalChange } = await import('../src/lib/sessions/externalChange.svelte.js');
+const { HOME_TAB_PATH } = await import('../src/lib/utils/homeTab.js');
+
+// An unanswered external-change conflict is a question only the user can
+// answer. The viewer's saves that nobody asked for — leaving the editor or
+// split view, and the exit's auto-save — used to go through the same wrapper as
+// Cmd+S, which authorises the overwrite whenever the bar is up. So Ctrl+E or
+// quitting wrote the buffer over the other program's change and took the bar
+// down without asking.
+//
+// Everything below runs the viewer's real save and conflict module against the
+// real document session, so what is asserted is what reaches the disk.
+describe('external change conflicts', () => {
+	const disk = new Map<string, string>();
+
+	beforeAll(() => {
+		(window as any).__TAURI_INTERNALS__ = {
+			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+			invoke: (cmd: string, args: any) => {
+				if (cmd === 'canonicalize_path') return Promise.resolve(args.path);
+				if (cmd === 'read_file_content_checked') return Promise.resolve([disk.get(args.path) ?? '', false, 'UTF-8']);
+				if (cmd === 'open_markdown_preview') return Promise.resolve([disk.get(args.path) ?? '', true, false, 'UTF-8']);
+				if (cmd === 'save_file_content') {
+					disk.set(args.path, args.content);
+					return Promise.resolve(null);
+				}
+				if (cmd === 'get_os_type') return Promise.resolve('macos');
+				return Promise.resolve(null);
+			},
+		};
+	});
+
+	function makeViewer(overrides: { canCloseTab?: (id: string) => Promise<boolean> } = {}) {
+		const closeQuestions: boolean[] = [];
+		const toasts: string[] = [];
+		const session = createDocumentSession({
+			setShowHome: () => {},
+			currentFile: () => tabManager.activeTab?.path ?? '',
+			resetScrollHistory: () => {},
+			renderMarkdown: async (raw: string) => raw,
+			afterLoad: async () => {},
+			saveRecentFile: () => {},
+			deleteRecentFile: () => {},
+			setLoadingTabs: () => {},
+			measureInitialViewport: () => {},
+			isScrolling: () => false,
+			onError: () => {},
+			onDiskChangedUnderSave: (id: string) => conflicts.noteExternalChangeConflict(id),
+			cancelPendingAutoSave: () => {},
+			askClose: async (_title: string, diskMoved: boolean) => {
+				closeQuestions.push(diskMoved);
+				return 'cancel' as const;
+			},
+			onCloseSaveNewerEdits: () => {},
+			onCloseAutoSaveFailed: () => {},
+			onPartialCopySaved: () => {},
+		});
+		const conflicts = createExternalChange({
+			tabManager,
+			settings: { autoSave: true, language: 'en' },
+			documentSession: session,
+			loadMarkdown: (path, options) => session.loadMarkdown(path, options),
+			canCloseTab: overrides.canCloseTab ?? ((id) => session.canCloseTab(id)),
+			readFile: async (path) => [disk.get(path) ?? '', false, 'UTF-8'],
+			editorLanguageFor: () => 'markdown',
+			addToast: (message) => void toasts.push(message),
+			t: (key) => key,
+		});
+		const exit = createWindowExit({
+			tabManager,
+			settings: { autoSave: true, restoreStateOnReopen: false, closeWindowWithLastTab: true, persistOpenEditors: false },
+			appWindow: { label: 'main', close: async () => {}, destroy: async () => {} },
+			allWindows: async () => [],
+			recovery: { isReady: () => false, keep: async () => true, drop: async () => true },
+			persistWindowState: async () => {},
+			canCloseTab: (id) => session.canCloseTab(id),
+			saveSilently: conflicts.saveSilently,
+			hasExternalChangeConflict: conflicts.hasExternalChangeConflict,
+			onAutoSaveFailed: () => void toasts.push('toast.autoSaveFailed'),
+			settle: async () => {},
+			loadMarkdown: async () => {},
+			setShowHome: () => {},
+			moveTabToWindow: async () => {},
+		});
+		const settleForExit = () => exit.settleForExit(async () => true);
+		return { conflicts, session, settleForExit, closeQuestions, toasts };
+	}
+
+	/** a.md was saved, another program then changed it, and the user typed once more. */
+	function conflicted(viewer: ReturnType<typeof makeViewer>) {
+		tabManager.closeAll();
+		disk.clear();
+		disk.set('/notes/a.md', 'saved');
+		tabManager.addTab('/notes/a.md', 'saved');
+		const tab = tabManager.activeTab!;
+		tab.originalContent = 'saved';
+		tab.isEditing = true;
+		disk.set('/notes/a.md', 'theirs');
+		tabManager.updateTabRawContent(tab.id, 'saved!');
+		viewer.conflicts.noteExternalChangeConflict(tab.id);
+		return tab;
+	}
+
+	test('leaving the editor keeps the edit in the buffer and the bar up', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+
+		await viewer.conflicts.flushBeforeLeavingEditableMode(tab);
+
+		assert.equal(disk.get('/notes/a.md'), 'theirs', 'the other program\'s change was overwritten');
+		assert.equal(tab.rawContent, 'saved!');
+		assert.equal(viewer.conflicts.hasExternalChangeConflict(tab.id), true, 'the bar came down');
+		assert.deepEqual(viewer.toasts, [], 'the bar already says why nothing was written');
+	});
+
+	test('closing the window asks about a conflicted tab instead of saving it', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+
+		assert.equal(await viewer.settleForExit(), false);
+
+		assert.equal(disk.get('/notes/a.md'), 'theirs', 'the other program\'s change was overwritten');
+		assert.equal(tab.rawContent, 'saved!');
+		assert.deepEqual(viewer.closeQuestions, [true], 'the walk asked the changed-on-disk question');
+	});
+
+	test('the exit still auto-saves the other dirty tabs', async () => {
+		const viewer = makeViewer();
+		conflicted(viewer);
+		disk.set('/notes/b.md', 'b');
+		tabManager.addTab('/notes/b.md', 'b');
+		const b = tabManager.activeTab!;
+		b.originalContent = 'b';
+		tabManager.updateTabRawContent(b.id, 'b edited');
+
+		await viewer.settleForExit();
+
+		assert.equal(disk.get('/notes/b.md'), 'b edited');
+		assert.equal(disk.get('/notes/a.md'), 'theirs');
+	});
+
+	// Pressing Cmd+S is a decision. Leaving the bar up afterwards would ask a
+	// question the user already answered.
+	test('Cmd+S on a conflicted tab is still the answer "keep mine"', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+
+		assert.equal(await viewer.conflicts.saveContent(tab.id), true);
+
+		assert.equal(disk.get('/notes/a.md'), 'saved!');
+		assert.equal(viewer.conflicts.hasExternalChangeConflict(tab.id), false);
+
+		// The answered question stays answered when the file comes back to the
+		// text it was raised against.
+		tabManager.updateTabRawContent(tab.id, 'saved');
+		assert.equal(await viewer.conflicts.saveContent(tab.id), true);
+		assert.equal(viewer.conflicts.hasExternalChangeConflict(tab.id), false);
+	});
+
+	test('"Keep mine" from the comparison answers for the tab it was opened on', async () => {
+		const viewer = makeViewer();
+		const a = conflicted(viewer);
+		// The user switched tabs with the comparison open: b.md is in front, edited,
+		// and another program has just written it too.
+		disk.set('/notes/b.md', 'b');
+		tabManager.addTab('/notes/b.md', 'b');
+		const b = tabManager.activeTab!;
+		b.originalContent = 'b';
+		tabManager.updateTabRawContent(b.id, 'b edited');
+		disk.set('/notes/b.md', 'b theirs');
+
+		// What the overlay's button passes: the tab the comparison was opened on.
+		viewer.conflicts.resolveExternalChangeByKeepingBuffer(a.id);
+		await viewer.conflicts.saveSilently(b.id);
+
+		assert.equal(disk.get('/notes/b.md'), 'b theirs', 'b.md was overwritten on an answer given about a.md');
+		assert.equal(await viewer.conflicts.saveSilently(a.id), true, 'a.md did not get the answer');
+	});
+
+	test('a conflict does not follow its tab onto another file', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+		// A link in a.md: the close dialog is answered Don't Save, and b.md loads
+		// into the same tab. It holds the same text a.md was saved with, so only
+		// the path tells the two questions apart.
+		disk.set('/notes/b.md', 'saved');
+		tab.rawContent = tab.originalContent;
+		await viewer.session.loadMarkdown('/notes/b.md', { navigate: true });
+		assert.equal(tab.path, '/notes/b.md');
+
+		// b.md is edited, and changed by another program before the watcher says so.
+		tabManager.updateTabRawContent(tab.id, 'b edited');
+		disk.set('/notes/b.md', 'b theirs');
+
+		assert.equal(await viewer.conflicts.saveContent(tab.id), false);
+		assert.equal(disk.get('/notes/b.md'), 'b theirs', 'Cmd+S used the answer about a.md to overwrite b.md');
+	});
+
+	// The bar can stand for a while. What the user needs to see is the file as
+	// it is when they are actually answering.
+	test('Compare reads the file at the moment it is asked, not when the bar went up', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+		disk.set('/notes/a.md', 'theirs, edited again');
+
+		await viewer.conflicts.compareExternalChange();
+
+		assert.deepEqual(viewer.conflicts.comparison, {
+			tabId: tab.id,
+			onDisk: 'theirs, edited again',
+			mine: 'saved!',
+			language: 'markdown',
+		});
+	});
+
+	// Otherwise the overlay outlives the question and shows a diff against a
+	// version that is no longer either side of anything.
+	test('answering the bar closes the comparison with it', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+		await viewer.conflicts.compareExternalChange();
+		viewer.conflicts.resolveExternalChangeByKeepingBuffer(tab.id);
+		assert.equal(viewer.conflicts.comparison, null, 'Keep mine left the comparison open');
+
+		viewer.conflicts.noteExternalChangeConflict(tab.id);
+		await viewer.conflicts.compareExternalChange();
+		assert.notEqual(viewer.conflicts.comparison, null);
+		await viewer.conflicts.resolveExternalChangeByReloading(tab.id);
+		assert.equal(viewer.conflicts.comparison, null, 'Reload left the comparison open');
+	});
+
+	// --- reverting is still possible, and only by saying so ---
+	//
+	// Every other caller of loadMarkdown is an open, and an open leaves an
+	// edited buffer alone. The two revert commands replace it.
+
+	test('Reload on the conflict bar replaces the unsaved edits with the file', async () => {
+		const viewer = makeViewer();
+		const tab = conflicted(viewer);
+
+		await viewer.conflicts.resolveExternalChangeByReloading(tab.id);
+
+		assert.equal(tab.rawContent, 'theirs');
+		assert.equal(tab.isDirty, false);
+		assert.equal(viewer.conflicts.hasExternalChangeConflict(tab.id), false);
+	});
+
+	test('Reload from disk replaces edits typed while the close question was out', async () => {
+		let tab!: ReturnType<typeof conflicted>;
+		// canCloseTab has resolved the buffer, and the user typed during its await.
+		const viewer = makeViewer({
+			canCloseTab: async (id) => {
+				tabManager.updateTabRawContent(id, 'typed during the question');
+				return true;
+			},
+		});
+		tab = conflicted(viewer);
+
+		await viewer.conflicts.reloadFromDisk();
+
+		assert.equal(tab.rawContent, 'theirs');
+		assert.deepEqual(viewer.toasts, ['toast.reloadedFromDisk']);
+	});
+
+	// --- the watcher's `file-changed` event ---
+
+	/** a.md in the background, b.md on screen, both saved and clean. */
+	function twoSavedTabs() {
+		tabManager.closeAll();
+		disk.clear();
+		for (const path of ['/notes/a.md', '/notes/b.md']) {
+			disk.set(path, `saved ${path}`);
+			tabManager.addTab(path, `saved ${path}`);
+			tabManager.activeTab!.originalContent = `saved ${path}`;
+		}
+		return tabManager.tabs;
+	}
+
+	test('a watcher notification is routed to its watched path', async () => {
+		const viewer = makeViewer();
+		const [a, b] = twoSavedTabs();
+		disk.set('/notes/b.md', 'changed by another program');
+
+		await viewer.conflicts.handleFileChanged('/notes/b.md', false);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(b.rawContent, 'saved /notes/b.md', 'Live Mode off: the change is not loaded');
+
+		await viewer.conflicts.handleFileChanged('/notes/b.md', true);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(b.rawContent, 'changed by another program');
+		assert.equal(a.rawContent, 'saved /notes/a.md', 'only the tab that owns the path is touched');
+
+		// An event for the background file does not reload the one on screen.
+		disk.set('/notes/a.md', 'a changed');
+		disk.set('/notes/b.md', 'b changed again');
+		await viewer.conflicts.handleFileChanged('/notes/a.md', true);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(b.rawContent, 'changed by another program');
+	});
+
+	test('the watcher listener routes every event through the guarded resolution', async () => {
+		// A watcher event never reloads over unsaved edits, Live Mode or not: the
+		// tab is marked conflicted instead.
+		const viewer = makeViewer();
+		const [, b] = twoSavedTabs();
+		tabManager.updateTabRawContent(b.id, 'typed here');
+		disk.set('/notes/b.md', 'changed by another program');
+
+		await viewer.conflicts.handleFileChanged('/notes/b.md', true);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+
+		assert.equal(b.rawContent, 'typed here');
+		assert.equal(viewer.conflicts.hasExternalChangeConflict(b.id), true);
+	});
+});
+
+// Ctrl+S from any mode, on the tab in front.
+describe('save from reading mode', () => {
+	function makeSaves() {
+		const saved: string[] = [];
+		const conflicts = createExternalChange({
+			tabManager,
+			settings: { autoSave: false, language: 'en' },
+			documentSession: {
+				saveContent: async (id) => {
+					saved.push(tabManager.tabs.find((tab) => tab.id === id)!.path);
+					return true;
+				},
+				allowOverwriteOnce: () => {},
+				resolveExternalChange: async () => ({ action: 'ignore' as const }),
+			},
+			loadMarkdown: async () => {},
+			canCloseTab: async () => true,
+			readFile: async () => ['', false, 'UTF-8'],
+			editorLanguageFor: () => 'markdown',
+			addToast: () => {},
+			t: (key) => key,
+		});
+		return { conflicts, saved };
+	}
+
+	test('an untitled buffer can be saved from reading mode', async () => {
+		// The session opens the Save dialog for `path === ''`.
+		const { conflicts, saved } = makeSaves();
+		tabManager.closeAll();
+		tabManager.addTab('', '');
+
+		await conflicts.saveActiveTab();
+
+		assert.deepEqual(saved, ['']);
+	});
+
+	test('a saved, unmodified document does not write on Ctrl+S', async () => {
+		// Writing unconditionally would touch mtime and wake the file watcher,
+		// which in live mode reloads the tab -- a keystroke that reads as a no-op
+		// to the user should not move the document underneath them.
+		const { conflicts, saved } = makeSaves();
+		tabManager.closeAll();
+		tabManager.addTab('/notes/a.md', 'saved');
+		const tab = tabManager.activeTab!;
+		tab.originalContent = 'saved';
+
+		await conflicts.saveActiveTab();
+		assert.deepEqual(saved, []);
+
+		tabManager.updateTabRawContent(tab.id, 'saved!');
+		await conflicts.saveActiveTab();
+		assert.deepEqual(saved, ['/notes/a.md']);
+	});
+
+	test('the HOME tab is not savable', async () => {
+		// HOME carries the sentinel path and is never dirty, so the guard excludes
+		// it without naming it. Saving it would open a Save dialog.
+		const { conflicts, saved } = makeSaves();
+		tabManager.closeAll();
+		tabManager.addHomeTab();
+		assert.equal(tabManager.activeTab?.path, HOME_TAB_PATH);
+
+		await conflicts.saveActiveTab();
+
+		assert.deepEqual(saved, []);
+	});
+});
diff --git a/scripts/documents.editor.spec.ts b/scripts/documents.editor.spec.ts
new file mode 100644
index 00000000..e7943643
--- /dev/null
+++ b/scripts/documents.editor.spec.ts
@@ -0,0 +1,139 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'vitest';
+
+// Importing the store boots the settings singleton, which asks for the OS type,
+// so a backend answering it has to be in place before the imports below.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { EditorDocument } = await import('../src/lib/utils/editorDocument.svelte.js');
+
+/**
+ * The editor's `EditorDocument` over the REAL `TabManager`. Monaco is a fake
+ * with the few methods these paths read: the editor's text and its attached
+ * model's language, line ending and text.
+ */
+function editorShowing(text: string, eol = '\n') {
+	let onScreen = text;
+	const model = { getLanguageId: () => 'markdown', getEOL: () => eol, getValue: () => onScreen };
+	const editor = { getValue: () => onScreen, getModel: () => model };
+	const doc = new EditorDocument({
+		monaco: () => {
+			throw new Error('no model is built on these paths');
+		},
+		editor: () => editor as any,
+		tabs: tabManager,
+		// The `value` prop is `value={tabManager.activeTab.rawContent}`: read, never copied.
+		value: () => tabManager.activeTab?.rawContent ?? '',
+		showWordCount: () => false,
+	});
+
+	return {
+		doc,
+		/** A keystroke: Monaco's buffer changes, then it fires the content listener. */
+		type: (next: string) => {
+			onScreen = next;
+			doc.contentChanged();
+		},
+	};
+}
+
+function activeTab() {
+	const tab = tabManager.activeTab;
+	assert.ok(tab, 'precondition: a tab is active');
+	return tab!;
+}
+
+/*
+ * The editor writes through the store. `value` is a plain prop and nothing in
+ * the editor writes it back, so the content listener is the only route from a
+ * keystroke to the document, and `isDirty` is a getter on the tab, exactly
+ * `rawContent !== originalContent`.
+ */
+describe('editor writes through the store', () => {
+	test('a keystroke reaches the document, and the document knows it is unsaved', () => {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/a.md', 'saved text');
+		const editor = editorShowing('saved text');
+
+		assert.equal(activeTab().isDirty, false, 'precondition: a freshly opened tab is clean');
+
+		editor.type('saved text and more');
+
+		assert.equal(
+			activeTab().rawContent,
+			'saved text and more',
+			'the keystroke never reached the document: the editor is writing to something else, or to nothing',
+		);
+		assert.equal(
+			activeTab().isDirty,
+			true,
+			'the document has unsaved edits and does not say so — no dirty dot, no auto-save, no prompt on close',
+		);
+	});
+
+	test('typing the saved text back makes the tab clean again, with nobody clearing a flag', () => {
+		// Undo, or retyping what was deleted, leaves a buffer that IS the saved
+		// text — and the only thing that has to happen for the tab to say so is
+		// that the two buffers agree.
+		tabManager.closeAll();
+		tabManager.addTab('/notes/b.md', 'saved text');
+		const editor = editorShowing('saved text');
+
+		editor.type('saved text!');
+		assert.equal(activeTab().isDirty, true);
+
+		editor.type('saved text');
+		assert.equal(activeTab().isDirty, false, 'the buffer is the saved text and the tab still reads dirty');
+	});
+
+	test('following a link does not leave the tab dirty against the file it just left', () => {
+		// `navigate` repoints the tab at another file before the load lands, so for
+		// that window `path` is the new file and `rawContent` is the old document.
+		// A tab left dirty there arms the auto-save effect, which writes the
+		// document the reader left into the file they opened.
+		tabManager.closeAll();
+		tabManager.addTab('/notes/c.md', 'saved text');
+		const editor = editorShowing('saved text');
+		editor.type('unsaved edits');
+
+		tabManager.navigate(activeTab().id, '/notes/linked.md');
+
+		assert.equal(activeTab().path, '/notes/linked.md');
+		assert.equal(activeTab().isDirty, false, 'the tab claims unsaved edits to a document it no longer holds');
+	});
+});
+
+describe('editor status readings', () => {
+	test('the status bar renders the measured label and no longer a translation key', () => {
+		// The line ending is the model's own EOL (`lineEndingLabel`, driven
+		// against real Monaco buffers in documents.test.ts), refreshed
+		// with the other document-wide readings. It used to be a hardcoded CRLF.
+		tabManager.closeAll();
+		tabManager.addTab('/notes/crlf.md', 'a\r\nb');
+		const crlf = editorShowing('a\r\nb', '\r\n');
+		crlf.doc.syncStatus();
+		assert.equal(crlf.doc.lineEnding, 'CRLF');
+
+		const lf = editorShowing('a\nb', '\n');
+		lf.doc.syncStatus();
+		assert.equal(lf.doc.lineEnding, 'LF');
+	});
+
+	test('the status bar names the encoding the document was decoded from', () => {
+		// Off the tab, not off Monaco: the encoding belongs to the file the buffer
+		// was decoded from, and the store is what carries it through a save. The
+		// slot used to render a literal `UTF-8` whatever the file was.
+		tabManager.closeAll();
+		tabManager.addTab('/notes/gbk.md', '中文');
+		const { doc } = editorShowing('中文');
+		tabManager.setTabEncoding(activeTab().id, 'GBK');
+		assert.equal(doc.encoding, 'GBK');
+
+		tabManager.addTab('/notes/plain.md', 'plain');
+		assert.equal(doc.encoding, 'UTF-8', 'the reading follows the active tab');
+	});
+});
diff --git a/scripts/documents.frontMatter.spec.ts b/scripts/documents.frontMatter.spec.ts
new file mode 100644
index 00000000..114fa4d4
--- /dev/null
+++ b/scripts/documents.frontMatter.spec.ts
@@ -0,0 +1,124 @@
+import assert from 'node:assert/strict';
+
+import { beforeAll, describe, test } from 'vitest';
+
+// Importing the store boots the settings singleton, which asks for the OS type.
+let handleInvoke: (cmd: string, args: Record<string, unknown>) => unknown = (cmd) => (cmd === 'get_os_type' ? 'macos' : null);
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string, args?: Record<string, unknown>) => Promise.resolve(handleInvoke(cmd, args ?? {})),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { createDocumentSession } = await import('../src/lib/sessions/documentSession.svelte.js');
+const { createFrontMatterEdit } = await import('../src/lib/sessions/frontMatterEdit.js');
+const { updateFrontMatterField } = await import('../src/lib/utils/frontMatter.js');
+
+type Tab = NonNullable<typeof tabManager.activeTab>;
+
+/*
+ * The front matter panel is editable from reading mode, which a large file
+ * reaches while its buffer is still the preview slice. Rewriting the slice and
+ * saving it would drop the rest of the document, so an edit completes the
+ * buffer first, through the real `documentSession.ensureFullContent`.
+ */
+describe('front matter edits in preview mode', () => {
+	const PARTIAL = '---\ntitle: old\n---\n# first half';
+	const FULL = '---\ntitle: old\n---\n# first half\n\nand the rest of the file\n';
+	const field = { key: 'title', value: 'old', kind: 'string', displayValue: 'old', editable: true } as const;
+
+	beforeAll(() => {
+		handleInvoke = (cmd) => {
+			if (cmd === 'get_os_type') return 'macos';
+			if (cmd === 'read_file_content_checked') return [FULL, false, 'UTF-8'];
+			throw new Error(`unexpected invoke: ${cmd}`);
+		};
+	});
+
+	function build() {
+		const session = createDocumentSession({
+			setShowHome: () => {},
+			currentFile: () => tabManager.activeTab?.path ?? '',
+			resetScrollHistory: () => {},
+			renderMarkdown: async () => '',
+			afterLoad: async () => {},
+			saveRecentFile: () => {},
+			deleteRecentFile: () => {},
+			setLoadingTabs: () => {},
+			measureInitialViewport: () => {},
+			isScrolling: () => false,
+			onError: () => {},
+			onDiskChangedUnderSave: () => {},
+			cancelPendingAutoSave: () => {},
+			askClose: async () => 'discard' as const,
+			onCloseSaveNewerEdits: () => {},
+			onCloseAutoSaveFailed: () => {},
+			onPartialCopySaved: () => {},
+		});
+		const applied: string[] = [];
+		const toasts: string[] = [];
+		// The viewer's `applyFrontMatter`: rewrite the field in the buffer it is handed.
+		const applyFrontMatter = async (tab: Tab, f: { key: string }, nextValue: () => unknown) => {
+			applied.push(tab.rawContent);
+			tabManager.updateTabRawContent(tab.id, updateFrontMatterField(tab.rawContent, f.key, nextValue()));
+		};
+		const edit = createFrontMatterEdit({
+			tabManager,
+			settings,
+			documentSession: session,
+			addToast: (message: string) => void toasts.push(message),
+			t: (key: string) => key,
+			applyFrontMatter,
+		});
+		return { edit, applied, toasts };
+	}
+
+	/** A large file in reading mode whose buffer is still the preview slice. */
+	function partialTab() {
+		tabManager.closeAll();
+		tabManager.addTab('/docs/big.md');
+		const tab = tabManager.activeTab!;
+		tabManager.setTabRawContent(tab.id, PARTIAL, true);
+		assert.equal(tab.isTruncated, true, 'precondition: the buffer is partial');
+		return tab;
+	}
+
+	test('a field edit completes the buffer before rewriting it', async () => {
+		const tab = partialTab();
+		const { edit, applied } = build();
+
+		await edit.handleFrontMatterEdit(field, 'new');
+
+		assert.deepEqual(applied, [FULL], 'the edit is applied to the whole file, not the slice');
+		assert.equal(tab.isTruncated, false);
+		assert.match(tab.rawContent, /title: new/);
+		assert.match(tab.rawContent, /and the rest of the file/, 'the rest of the document survives the edit');
+	});
+
+	test('a list edit completes the buffer before rewriting it', async () => {
+		const tab = partialTab();
+		const { edit, applied } = build();
+
+		await edit.handleFrontMatterListChange({ ...field, key: 'tags', kind: 'list' } as never, ['a']);
+
+		assert.deepEqual(applied, [FULL]);
+		assert.match(tab.rawContent, /and the rest of the file/);
+	});
+
+	test('an edit that cannot complete the buffer is refused, not applied to the slice', async () => {
+		// A partial buffer that is already dirty cannot be completed from disk.
+		const tab = partialTab();
+		tabManager.updateTabRawContent(tab.id, PARTIAL + ' typed');
+		tabManager.setTabRawContent(tab.id, tab.rawContent, true);
+		tab.originalContent = PARTIAL;
+		assert.equal(tab.isDirty && tab.isTruncated, true, 'precondition: dirty and partial');
+		const { edit, applied, toasts } = build();
+
+		await edit.handleFrontMatterEdit(field, 'new');
+		await edit.handleFrontMatterListChange({ ...field, key: 'tags', kind: 'list' } as never, ['a']);
+
+		assert.deepEqual(applied, [], 'nothing rewrites the slice');
+		assert.deepEqual(toasts, ['toast.partialDocument', 'toast.partialDocument']);
+	});
+});
diff --git a/scripts/documents.load.spec.ts b/scripts/documents.load.spec.ts
index c81ac898..d193eb8f 100644
--- a/scripts/documents.load.spec.ts
+++ b/scripts/documents.load.spec.ts
@@ -274,7 +274,7 @@ describe('external change reload', () => {
 	 */
 	const disk = new Map<string, string>();
 
-	let handleInvoke: (cmd: string, args: any) => unknown = (cmd, args) => {
+	const diskInvoke = (cmd: string, args: any): unknown => {
 		if (cmd === 'canonicalize_path') return args.path;
 		if (cmd === 'read_file_content_checked') {
 			if (!disk.has(args.path)) throw new Error(`no such file: ${args.path}`);
@@ -286,6 +286,7 @@ describe('external change reload', () => {
 		}
 		throw new Error(`unexpected invoke: ${cmd}`);
 	};
+	let handleInvoke = diskInvoke;
 	beforeAll(() => {
 		(window as any).__TAURI_INTERNALS__ = {
 			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
@@ -335,6 +336,7 @@ describe('external change reload', () => {
 	function reset() {
 		tabManager.closeAll();
 		disk.clear();
+		handleInvoke = diskInvoke;
 		refusedSaves = [];
 		closeQuestions = [];
 		closeAnswer = 'discard';
@@ -582,6 +584,7 @@ describe('external change reload', () => {
 		//
 		// `loadMarkdown(path)` with no options is exactly the call the
 		// `file-changed` listener makes for a `reload` outcome.
+		reset();
 		const session = makeSession();
 		const tab = open('/notes/live.md', 'before');
 		tab.isEditing = true;
diff --git a/scripts/documents.save.spec.ts b/scripts/documents.save.spec.ts
index 7de8d120..3d3252bb 100644
--- a/scripts/documents.save.spec.ts
+++ b/scripts/documents.save.spec.ts
@@ -12,6 +12,7 @@ import { afterAll, beforeAll, describe, test } from 'vitest';
 const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
 const { settings } = await import('../src/lib/stores/settings.svelte.js');
 const { createDocumentSession } = await import('../src/lib/sessions/documentSession.svelte.js');
+const { createExternalChange } = await import('../src/lib/sessions/externalChange.svelte.js');
 const { buildTransferredTab, snapshotTab, validateTransferPayload } = await import(
 	'../src/lib/utils/tabTransfer.js'
 );
@@ -814,6 +815,8 @@ describe('lossy save refusal scope', () => {
 
 	/** Whether `save_file_content` succeeds. Set per test. */
 	let writeFails = false;
+	/** Every `save_file_content` that reached the backend. */
+	let writes = 0;
 	const LOSSY = 'text with � in it';
 
 	beforeAll(() => {
@@ -826,6 +829,7 @@ describe('lossy save refusal scope', () => {
 				if (cmd === 'open_markdown_preview') return Promise.resolve([LOSSY, true, true]);
 				if (cmd === 'read_file_content_checked') return Promise.resolve([LOSSY, true]);
 				if (cmd === 'save_file_content') {
+					writes++;
 					return writeFails ? Promise.reject(new Error('Os { code: 28, kind: StorageFull }')) : Promise.resolve(null);
 				}
 				return Promise.resolve(null);
@@ -936,6 +940,55 @@ describe('lossy save refusal scope', () => {
 		assert.equal(toasts.length, 1, 'still only the one explanation');
 	});
 
+	test('saveContent is the choke point auto-save and the close dialogs share', async () => {
+		// Auto-save (saveSilently, the debounce's writer) and the close dialog's
+		// Save both reach saveContent, so the lossy guard covers them without
+		// either repeating it.
+		const { tab } = await refusedTab();
+		writes = 0;
+		const autoSave = settings.autoSave;
+		settings.autoSave = true;
+		try {
+			const session = createDocumentSession({
+				setShowHome: () => {},
+				currentFile: () => tabManager.activeTab?.path ?? '',
+				resetScrollHistory: () => {},
+				renderMarkdown: async () => '',
+				afterLoad: async () => {},
+				saveRecentFile: () => {},
+				deleteRecentFile: () => {},
+				setLoadingTabs: () => {},
+				measureInitialViewport: () => {},
+				isScrolling: () => false,
+				onError: () => {},
+				onDiskChangedUnderSave: () => {},
+				cancelPendingAutoSave: () => {},
+				askClose: async () => 'save' as const,
+				onCloseSaveNewerEdits: () => {},
+				onCloseAutoSaveFailed: () => {},
+				onPartialCopySaved: () => {},
+			});
+			const silent = createExternalChange({
+				tabManager,
+				settings: { autoSave: true, language: 'en' },
+				documentSession: session,
+				loadMarkdown: async () => {},
+				canCloseTab: async () => true,
+				readFile: async () => [LOSSY, true, 'UTF-8'],
+				editorLanguageFor: () => 'markdown',
+				addToast: () => {},
+				t: (key) => key,
+			});
+
+			assert.equal(await silent.saveSilently(tab.id), false, 'auto-save is refused');
+			assert.equal(await session.canCloseTab(tab.id), false, 'Save in the close dialog is refused');
+			assert.equal(writes, 0);
+			assert.equal(tab.rawContent, 'edited');
+		} finally {
+			settings.autoSave = autoSave;
+		}
+	});
+
 	test('a closed tab is not remembered as refused', async () => {
 		// `closeTab` splices the tab out with no dispose hook, so the set keeps
 		// the id forever. Ids are `crypto.randomUUID()` and never reused, so this
diff --git a/scripts/documents.session.spec.ts b/scripts/documents.session.spec.ts
new file mode 100644
index 00000000..307750ef
--- /dev/null
+++ b/scripts/documents.session.spec.ts
@@ -0,0 +1,492 @@
+import assert from 'node:assert/strict';
+
+import { afterAll, beforeAll, beforeEach, describe, test } from 'vitest';
+
+import { flushSync, untrack } from 'svelte';
+
+import { runeEffect } from './runeEffect.svelte.js';
+import { t } from '../src/lib/utils/i18n.js';
+import { MARKDOWN_LINK_EXTENSIONS } from '../src/lib/utils/markdownLinks.js';
+
+// Importing the store boots the settings singleton, which asks for the OS type.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { createDocumentSession } = await import('../src/lib/sessions/documentSession.svelte.js');
+const { followActiveFile } = await import('../src/lib/sessions/fileWatch.svelte.js');
+
+/*
+ * The document session driven end to end against a scripted disk: the store
+ * and the session run under the compiler's runes, only Tauri is stubbed.
+ *
+ * Every read path decodes leniently (#371), so a file nothing can decode opens
+ * with U+FFFD in place of the bytes it lost. Writing that buffer back over its
+ * own file destroys the document, so the tab carries the decode's verdict and
+ * the session refuses that one write — while Save As to another file stays
+ * open as the way out.
+ */
+describe('document session', () => {
+	type File = { body: string; lossy?: boolean; encoding?: string };
+	const disk = new Map<string, File>();
+	let calls: Array<{ cmd: string; args: any }> = [];
+	/** What the Save dialog answers next. */
+	let dialogAnswer: string | null = null;
+	/** Overrides for one test; return undefined to fall through to the disk. */
+	let override: (cmd: string, args: any) => unknown = () => undefined;
+	let errors: Array<{ message: string; detail: unknown }> = [];
+
+	beforeAll(() => {
+		(window as any).__TAURI_INTERNALS__ = {
+			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+			invoke: (cmd: string, args: any) => {
+				calls.push({ cmd, args });
+				const answer = override(cmd, args);
+				if (answer !== undefined) return Promise.resolve(answer);
+				const file = disk.get(args?.path);
+				switch (cmd) {
+					case 'get_os_type':
+						return Promise.resolve('macos');
+					case 'canonicalize_path':
+						return Promise.resolve(args.path);
+					case 'open_markdown_preview':
+						return Promise.resolve([file?.body ?? '', true, file?.lossy ?? false, file?.encoding ?? 'UTF-8']);
+					case 'read_file_content_checked':
+						return file
+							? Promise.resolve([file.body, file.lossy ?? false, file.encoding ?? 'UTF-8'])
+							: Promise.reject(new Error('No such file or directory (os error 2)'));
+					case 'save_file_content':
+						disk.set(args.path, { body: args.content, encoding: args.encoding });
+						return Promise.resolve(null);
+					case 'plugin:dialog|save':
+						return Promise.resolve(dialogAnswer);
+					default:
+						return Promise.resolve(null);
+				}
+			},
+		};
+	});
+
+	let settingsBefore: Pick<typeof settings, 'openFileMode' | 'newFileDefaultMode' | 'splitScrollSync' | 'autoSave'>;
+	beforeAll(() => {
+		settingsBefore = {
+			openFileMode: settings.openFileMode,
+			newFileDefaultMode: settings.newFileDefaultMode,
+			splitScrollSync: settings.splitScrollSync,
+			autoSave: settings.autoSave,
+		};
+	});
+	afterAll(() => {
+		Object.assign(settings, settingsBefore);
+		tabManager.closeAll();
+		tabManager.recentlyClosed.length = 0;
+		localStorage.clear();
+	});
+
+	beforeEach(() => {
+		Object.assign(settings, settingsBefore, { openFileMode: 'preview' });
+		tabManager.closeAll();
+		disk.clear();
+		calls = [];
+		dialogAnswer = null;
+		override = () => undefined;
+		errors = [];
+	});
+
+	function makeSession() {
+		return createDocumentSession({
+			setShowHome: () => {},
+			currentFile: () => tabManager.activeTab?.path ?? '',
+			resetScrollHistory: () => {},
+			renderMarkdown: async (raw: string) => raw,
+			afterLoad: async () => {},
+			saveRecentFile: () => {},
+			deleteRecentFile: () => {},
+			setLoadingTabs: () => {},
+			measureInitialViewport: () => {},
+			isScrolling: () => false,
+			onError: (message, detail) => void errors.push({ message, detail }),
+			onDiskChangedUnderSave: () => {},
+			cancelPendingAutoSave: () => {},
+			askClose: async () => 'discard' as const,
+			onCloseSaveNewerEdits: () => {},
+			onCloseAutoSaveFailed: () => {},
+			onPartialCopySaved: () => {},
+		});
+	}
+
+	const writes = () => calls.filter((call) => call.cmd === 'save_file_content').map((call) => call.args);
+	const dialogs = () => calls.filter((call) => call.cmd === 'plugin:dialog|save').map((call) => call.args.options);
+	const LOSSY = '# legacy ��';
+
+	// --- the flag -----------------------------------------------------------------
+
+	test('the tab carries the fidelity of its buffer', () => {
+		// Required, not optional: a construction site that forgot it would read
+		// as "safe to overwrite", and the failure mode is a destroyed document.
+		tabManager.restoreState(JSON.stringify({ version: 2, tabs: [{ path: '/notes/restored.md' }] }));
+		tabManager.addTab('/notes/a.md');
+		tabManager.addNewTab();
+		tabManager.addHomeTab();
+		for (const tab of tabManager.tabs) assert.equal(tab.hasReplacementChars, false, `${tab.title} starts undecided`);
+
+		const id = tabManager.activeTabId!;
+		tabManager.setTabDecodedLossy(id, true);
+		assert.equal(tabManager.activeTab!.hasReplacementChars, true);
+	});
+
+	test('every load decides the flag instead of leaving it stale', async () => {
+		// A reload of a file the user has since converted to UTF-8 must clear it.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		await session.loadMarkdown('/notes/legacy.md');
+		assert.equal(tabManager.activeTab!.hasReplacementChars, true);
+
+		disk.set('/notes/legacy.md', { body: '# legacy, converted' });
+		await session.loadMarkdown('/notes/legacy.md', { skipTabManagement: true, discardUnsavedBuffer: true });
+		assert.equal(tabManager.activeTab!.hasReplacementChars, false);
+	});
+
+	test('the editable-pane shortcut reports fidelity too', async () => {
+		// A pane that can WRITE skips the preview and reads the whole file up
+		// front (#374); that read must flag the buffer like the preview does.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		tabManager.addTab('/notes/legacy.md');
+		tabManager.activeTab!.isEditing = true;
+
+		await session.loadMarkdown('/notes/legacy.md', { skipTabManagement: true, preserveEditState: true });
+
+		assert.equal(calls.some((call) => call.cmd === 'open_markdown_preview'), false, 'precondition: the full read ran');
+		assert.equal(tabManager.activeTab!.hasReplacementChars, true);
+		tabManager.updateTabRawContent(tabManager.activeTabId!, `${LOSSY} edited`);
+		assert.equal(await session.saveContent(), false);
+		assert.deepEqual(writes(), []);
+	});
+
+	test('the flag is set before the buffer can reach a writer', async () => {
+		// The auto-save effect reacts to the new buffer. Whenever it first sees
+		// the lossy text, it must already see the flag that refuses it.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		const seen: boolean[] = [];
+		const stop = runeEffect(() => {
+			const tab = tabManager.activeTab;
+			if (tab?.rawContent === LOSSY) seen.push(tab.hasReplacementChars);
+		});
+		try {
+			await session.loadMarkdown('/notes/legacy.md');
+		} finally {
+			stop();
+		}
+		assert.ok(seen.length > 0, 'precondition: the buffer was published');
+		assert.deepEqual([...new Set(seen)], [true]);
+	});
+
+	test('window restore cannot launder the flag away', async () => {
+		// Restore reads each file back into an editable buffer. Reopening the app
+		// must not turn a lossy buffer into one that looks safe to save.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		tabManager.restoreState(JSON.stringify({ version: 2, tabs: [{ path: '/notes/legacy.md', isEditing: true }] }));
+		const tab = tabManager.activeTab!;
+
+		await session.readRestoredTab(tab.id);
+
+		assert.equal(tab.rawContent, LOSSY);
+		assert.equal(tab.hasReplacementChars, true);
+		tabManager.updateTabRawContent(tab.id, `${LOSSY} edited`);
+		assert.equal(await session.saveContent(tab.id), false);
+		assert.deepEqual(writes(), []);
+	});
+
+	// --- the guard ----------------------------------------------------------------
+
+	test('the guard protects the source file only', async () => {
+		// An untitled buffer has no source file to destroy, and any other path is
+		// a new UTF-8 file — neither is blocked.
+		const session = makeSession();
+		tabManager.addNewTab();
+		const untitled = tabManager.activeTab!;
+		tabManager.updateTabRawContent(untitled.id, LOSSY);
+		tabManager.setTabDecodedLossy(untitled.id, true);
+		dialogAnswer = '/notes/rescued.md';
+		assert.equal(await session.saveContent(untitled.id), true);
+
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		await session.loadMarkdown('/notes/legacy.md');
+		dialogAnswer = '/notes/copy.md';
+		assert.equal(await session.saveContentAs(), true);
+
+		assert.deepEqual(writes().map((write) => write.path), ['/notes/rescued.md', '/notes/copy.md']);
+		assert.deepEqual(errors, []);
+	});
+
+	test('Save As to a new file stays open as the escape hatch', async () => {
+		// Written as UTF-8 whatever the tab was read as: the copy exists to be
+		// readable when the original could not be. Afterwards the tab is a UTF-8
+		// document of its own, so ordinary saves work again.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true, encoding: 'GBK' });
+		await session.loadMarkdown('/notes/legacy.md');
+		const tab = tabManager.activeTab!;
+		tabManager.setTabEncoding(tab.id, 'GBK');
+
+		dialogAnswer = '/notes/copy.md';
+		assert.equal(await session.saveContentAs(), true);
+		assert.deepEqual(writes(), [{ path: '/notes/copy.md', content: LOSSY, encoding: 'UTF-8' }]);
+		assert.equal(tab.hasReplacementChars, false);
+		assert.equal(tab.encoding, 'UTF-8');
+
+		tabManager.updateTabRawContent(tab.id, 'fixed by hand');
+		assert.equal(await session.saveContent(tab.id), true);
+		assert.equal(disk.get('/notes/copy.md')?.body, 'fixed by hand');
+	});
+
+	test('the refusal tells the user what to do and is not repeated per keystroke', async () => {
+		// Auto-save re-arms on every edit; an undeduplicated toast would fire
+		// every 1.5s. The one message is the Save As explanation.
+		const session = makeSession();
+		disk.set('/notes/legacy.md', { body: LOSSY, lossy: true });
+		await session.loadMarkdown('/notes/legacy.md');
+		const tab = tabManager.activeTab!;
+		for (const text of ['a', 'ab', 'abc']) {
+			tabManager.updateTabRawContent(tab.id, text);
+			assert.equal(await session.saveContent(tab.id), false);
+		}
+		assert.deepEqual(errors, [{ message: t('toast.lossySaveBlocked', settings.language), detail: '/notes/legacy.md' }]);
+	});
+
+	// --- save failures and dialogs ------------------------------------------------
+
+	test('the code is turned into the translation, and only that code is', async () => {
+		// `onError` renders `${message}: ${detail}`, so the raw code must never be
+		// the detail: the translated branch names the document instead.
+		const session = makeSession();
+		disk.set('/notes/gbk.md', { body: 'text', encoding: 'GBK' });
+		await session.loadMarkdown('/notes/gbk.md');
+		const tab = tabManager.activeTab!;
+		tabManager.setTabEncoding(tab.id, 'GBK');
+		override = (cmd) => (cmd === 'save_file_content' ? Promise.reject('ENCODING_UNMAPPABLE:GBK') : undefined);
+		tabManager.updateTabRawContent(tab.id, 'text 😀');
+		assert.equal(await session.saveContent(tab.id), false);
+		assert.deepEqual(errors, [
+			{
+				message: t('toast.encodingUnmappable', settings.language).replace('{{encoding}}', 'GBK'),
+				detail: '/notes/gbk.md',
+			},
+		]);
+
+		// An I/O failure keeps the OS's own words.
+		errors = [];
+		const io = new Error('Permission denied (os error 13)');
+		override = (cmd) => (cmd === 'save_file_content' ? Promise.reject(io) : undefined);
+		assert.equal(await session.saveContent(tab.id), false);
+		assert.deepEqual(errors, [{ message: 'Failed to save file', detail: io }]);
+	});
+
+	test('the Save dialogs offer the same document extensions', async () => {
+		// Both hard-coded `['md']` once, so a `.txt` note saved under a new name
+		// had to go through "All Files".
+		const session = makeSession();
+		tabManager.addNewTab();
+		await session.saveContent();
+		disk.set('/notes/a.md', { body: 'a' });
+		await session.loadMarkdown('/notes/a.md');
+		await session.saveContentAs();
+
+		const offered = dialogs().map((options) => options.filters);
+		assert.equal(offered.length, 2);
+		for (const filters of offered) {
+			assert.deepEqual(filters[0], { name: 'Markdown', extensions: MARKDOWN_LINK_EXTENSIONS });
+			assert.ok(filters[0].extensions.includes('txt'));
+		}
+	});
+
+	test('the untitled save dialog prefills the numbered tab title', async () => {
+		const session = makeSession();
+		tabManager.addNewTab();
+		tabManager.addNewTab();
+		await session.saveContent();
+		assert.equal(dialogs()[0].defaultPath, tabManager.activeTab!.title);
+		assert.match(tabManager.activeTab!.title, / 2$/);
+	});
+
+	test('save-as writes a snapshot rather than the buffer as it stands', async () => {
+		// A keystroke landing during the write is not in the file and leaves the
+		// tab unsaved.
+		const session = makeSession();
+		disk.set('/notes/a.md', { body: 'before' });
+		await session.loadMarkdown('/notes/a.md');
+		const tab = tabManager.activeTab!;
+		tabManager.updateTabRawContent(tab.id, 'saved text');
+		let finishWrite!: () => void;
+		override = (cmd, args) => {
+			if (cmd !== 'save_file_content') return undefined;
+			// Typed after the snapshot was taken, while the write is out.
+			tabManager.updateTabRawContent(tab.id, 'saved text, then more');
+			disk.set(args.path, { body: args.content });
+			return new Promise<null>((resolve) => (finishWrite = () => resolve(null)));
+		};
+		dialogAnswer = '/notes/b.md';
+		const saving = session.saveContentAs();
+		while (!finishWrite) await Promise.resolve();
+		finishWrite();
+		assert.equal(await saving, true);
+
+		assert.equal(disk.get('/notes/b.md')?.body, 'saved text');
+		assert.equal(tab.rawContent, 'saved text, then more');
+		assert.equal(tab.isDirty, true);
+	});
+
+	// --- open file mode (#183) ----------------------------------------------------
+
+	test('opening a document applies the choice, split through the same door the toggle uses', async () => {
+		// Split carries the scroll-sync preference the toggle would have given
+		// it; a fresh tab is created with sync off and would drop it.
+		const session = makeSession();
+		settings.openFileMode = 'split';
+		settings.splitScrollSync = true;
+		disk.set('/notes/a.md', { body: '# a' });
+		await session.loadMarkdown('/notes/a.md');
+		const tab = tabManager.activeTab!;
+		assert.equal(tab.isSplit, true);
+		assert.equal(tab.isEditing, false);
+		assert.equal(tab.isScrollSynced, true);
+
+		settings.openFileMode = 'editor';
+		disk.set('/notes/b.md', { body: '# b' });
+		await session.loadMarkdown('/notes/b.md');
+		assert.equal(tabManager.activeTab!.isEditing, true);
+		assert.equal(tabManager.activeTab!.isSplit, false);
+	});
+
+	test('the choice is applied before the load decides how much of the file to read', async () => {
+		// An editor bound to the preview slice is one keystroke away from
+		// auto-saving it back over the whole file.
+		for (const mode of ['editor', 'split'] as const) {
+			tabManager.closeAll();
+			calls = [];
+			settings.openFileMode = mode;
+			const session = makeSession();
+			disk.set('/notes/big.md', { body: 'the whole file' });
+			override = (cmd) => (cmd === 'open_markdown_preview' ? ['the whole', false, false, 'UTF-8'] : undefined);
+			await session.loadMarkdown('/notes/big.md');
+			const tab = tabManager.activeTab!;
+			assert.equal(calls.some((call) => call.cmd === 'open_markdown_preview'), false, `${mode} read the preview slice`);
+			assert.equal(tab.rawContent, 'the whole file');
+			assert.notEqual(tab.isTruncated, true);
+		}
+	});
+
+	test('it applies to a newly opened document only', async () => {
+		// Not to a file already open in a tab, and not to a reload preserving
+		// the mode: reopening a document must not flip the mode the reader chose.
+		const session = makeSession();
+		disk.set('/notes/a.md', { body: '# a' });
+		await session.loadMarkdown('/notes/a.md');
+		const tab = tabManager.activeTab!;
+		assert.equal(tab.isEditing, false);
+
+		settings.openFileMode = 'editor';
+		await session.loadMarkdown('/notes/a.md');
+		assert.equal(tabManager.tabs.length, 1);
+		assert.equal(tab.isEditing, false, 'reopening an open file kept its mode');
+
+		await session.loadMarkdown('/notes/a.md', { skipTabManagement: true, preserveEditState: true });
+		assert.equal(tab.isEditing, false, 'a reload kept its mode');
+	});
+
+	test('a new empty document keeps its own preference', () => {
+		// Ctrl+N answers what an empty buffer opens as with `newFileDefaultMode`.
+		settings.openFileMode = 'split';
+		for (const preference of [true, false]) {
+			settings.newFileDefaultMode = preference;
+			tabManager.addNewTab();
+			assert.equal(tabManager.activeTab!.isEditing, preference);
+			assert.equal(tabManager.activeTab!.isSplit, false);
+		}
+	});
+
+	// --- reads that land later ----------------------------------------------------
+
+	test('large-file completion requires the current clean load revision and unchanged view mode', async () => {
+		// The background full read is not applied after the user switched mode:
+		// the pane that now shows the buffer was entered with its own read.
+		const session = makeSession();
+		disk.set('/notes/big.md', { body: 'the whole file' });
+		let finishFull!: () => void;
+		override = (cmd) => {
+			if (cmd === 'open_markdown_preview') return ['the whole', false, false, 'UTF-8'];
+			if (cmd === 'read_file_content_checked') {
+				return new Promise((resolve) => (finishFull = () => resolve(['the whole file', false, 'UTF-8'])));
+			}
+			return undefined;
+		};
+		await session.loadMarkdown('/notes/big.md');
+		const tab = tabManager.activeTab!;
+		assert.equal(tab.rawContent, 'the whole');
+
+		tab.isEditing = true;
+		finishFull();
+		await new Promise((resolve) => setTimeout(resolve, 300));
+		assert.equal(tab.rawContent, 'the whole', 'the completion landed in a pane it was not read for');
+	});
+
+	test('it is marked before anything can be awaited', async () => {
+		// The preview render effect compares `previewedRawContent` with the
+		// buffer the moment the buffer changes; marking later than that rebuilds
+		// the article the reader just ticked a box in, and loses the scroll.
+		const session = makeSession();
+		settings.autoSave = true;
+		disk.set('/notes/tasks.md', { body: '- [ ] one\n' });
+		await session.loadMarkdown('/notes/tasks.md');
+		const tab = tabManager.activeTab!;
+		override = (cmd) => (cmd === 'save_file_content' ? new Promise(() => {}) : undefined);
+		const stale: string[] = [];
+		const stop = runeEffect(() => {
+			if (tab.rawContent !== '- [ ] one\n' && tab.previewedRawContent !== tab.rawContent) stale.push(tab.rawContent);
+		});
+		try {
+			void session.toggleTaskCheckbox(1, true);
+			for (let i = 0; i < 20; i++) await Promise.resolve();
+		} finally {
+			stop();
+		}
+		assert.equal(tab.rawContent, '- [x] one\n', 'precondition: the box was ticked');
+		assert.deepEqual(stale, []);
+	});
+
+	// --- the file watcher ---------------------------------------------------------
+
+	test('the watcher follows the active file instead of retaining a previous tab watcher', async () => {
+		// #296: the session re-issued `watch_file` on every load, so the watcher
+		// followed whichever document loaded last rather than the active one.
+		const session = makeSession();
+		disk.set('/notes/a.md', { body: 'a' });
+		disk.set('/notes/b.md', { body: 'b' });
+		const watches = () =>
+			calls.filter((call) => call.cmd === 'watch_file' || call.cmd === 'unwatch_file').map((call) => call.args?.path ?? '-');
+
+		await session.loadMarkdown('/notes/a.md');
+		await session.loadMarkdown('/notes/b.md');
+		assert.deepEqual(watches(), [], 'a load asked for a watch of its own');
+
+		const first = tabManager.tabs[0].id;
+		// Untracked, so only the watcher's own effect re-runs, as in the component.
+		const stop = runeEffect(() => untrack(() => followActiveFile(() => tabManager.activeTab?.path ?? '')));
+		try {
+			flushSync();
+			tabManager.activeTabId = first;
+			flushSync();
+			tabManager.closeAll();
+			flushSync();
+		} finally {
+			stop();
+		}
+		assert.deepEqual(watches(), ['/notes/b.md', '/notes/a.md', '-']);
+	});
+});
diff --git a/scripts/documents.test.ts b/scripts/documents.test.ts
index 12898d1b..88e30ce8 100644
--- a/scripts/documents.test.ts
+++ b/scripts/documents.test.ts
@@ -10,20 +10,24 @@ import {
 	DROPPABLE_IMAGE_EXTENSIONS,
 	dropPaneFor,
 	dropZoneLabel,
+	handleDrop,
 	routeDroppedFile,
 	type DropAction,
 	type DropPane,
 } from '../src/lib/utils/fileDrop.js';
+import { openDiffView } from '../src/lib/utils/diffView.js';
 import { HOME_TAB_PATH } from '../src/lib/utils/homeTab.js';
+import { autoSaveFailureNeedsToast, isAutoSaveEligible, type AutoSaveTabState } from '../src/lib/utils/autoSaveTimer.js';
 import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
 import {
 	DEFAULT_OPEN_FILE_MODE,
 	isOpenFileMode,
 	resolveOpenFileMode,
 } from '../src/lib/utils/openFileMode.js';
+import { MARKDOWN_OPEN_FILTERS } from '../src/lib/utils/markdownLinks.js';
 import { lineEndingLabel } from '../src/lib/utils/tabModels.js';
 import { buildTransferredTab, snapshotTab, validateTransferPayload, type TransferableTab } from '../src/lib/utils/tabTransfer.js';
-import { viewerCommandFor, type KeyContext } from '../src/lib/utils/viewerKeymap.js';
+import { dispatchViewerKey, viewerCommandFor, type KeyContext } from '../src/lib/utils/viewerKeymap.js';
 
 describe('lossy decode save guard', () => {
 	// --- Behavioural: the flag survives a cross-window move ------------------
@@ -134,6 +138,58 @@ describe('save from reading mode', () => {
 			}
 		}
 	});
+
+	test('the browser save dialog is always suppressed', () => {
+		// Reading mode would otherwise surface the webview's own Save Page dialog.
+		// The keystroke is prevented before the command runs, in every mode.
+		for (const isEditing of [false, true]) {
+			const events: string[] = [];
+			const stroke = { ...MOD_S, preventDefault: () => void events.push('prevented') };
+			dispatchViewerKey(stroke, { ...READING, isEditing }, (command) => void events.push(`run:${command}`));
+			assert.deepEqual(events, ['prevented', 'run:save'], `isEditing=${isEditing}`);
+		}
+
+		// A chord that means nothing keeps its default.
+		const events: string[] = [];
+		const stroke = { ...MOD_S, key: 'j', code: 'KeyJ', ctrlKey: false, preventDefault: () => void events.push('prevented') };
+		dispatchViewerKey(stroke, READING, (command) => void events.push(`run:${command}`));
+		assert.deepEqual(events, []);
+	});
+});
+
+describe('auto-save debounce', () => {
+	/** A dirty file in the editor, the state the timer exists for. */
+	const EDITING: AutoSaveTabState = {
+		id: 'a', path: '/notes/a.md', isDirty: true, editable: true, hasPendingConflict: false, decodedLossily: false,
+	};
+	const never = () => false;
+	const always = () => true;
+
+	test('the debounced auto-save is held back while a conflict is unanswered', () => {
+		// Otherwise the 1.5s timer fires while the bar is still asking "reload or
+		// keep mine": the user's edits survive, but the external change is gone
+		// from disk before either answer can be given.
+		assert.equal(isAutoSaveEligible(EDITING, never), true);
+		assert.equal(isAutoSaveEligible({ ...EDITING, hasPendingConflict: true }, never), false);
+	});
+
+	test('a tab that can only be refused stops re-arming the timer', () => {
+		// Auto-save re-arms on every keystroke. Without this the guard was reached
+		// again every 1.5s for as long as the user kept typing.
+		const lossy = { ...EDITING, decodedLossily: true };
+		// The FIRST attempt still happens: it is what produces the explanation.
+		assert.equal(isAutoSaveEligible(lossy, never), true);
+		assert.equal(isAutoSaveEligible(lossy, always), false);
+		// "Save As" to a new file clears the lossy flag, which restores it.
+		assert.equal(isAutoSaveEligible(EDITING, always), true);
+	});
+
+	test('a refused save does not add a generic toast to its own explanation', () => {
+		assert.equal(autoSaveFailureNeedsToast('a', { isLossySaveRefused: always, hasExternalChangeConflict: never }), false);
+		assert.equal(autoSaveFailureNeedsToast('a', { isLossySaveRefused: never, hasExternalChangeConflict: always }), false);
+		// A genuine write failure still says so.
+		assert.equal(autoSaveFailureNeedsToast('a', { isLossySaveRefused: never, hasExternalChangeConflict: never }), true);
+	});
 });
 
 describe('unsaved recovery', () => {
@@ -443,6 +499,48 @@ describe('editor line ending', () => {
 	});
 });
 
+describe('external change comparison', () => {
+	test('the diff view owns its models and never edits the document', () => {
+		// Handing it the tab's live model would put a second editor on a buffer
+		// Editor.svelte owns, and a read-only view of a document is not a place to
+		// change it from.
+		const disposed: string[] = [];
+		const created: { text: string; language: string }[] = [];
+		let options: Record<string, unknown> = {};
+		let shown: { original: unknown; modified: unknown } | null = null;
+		const fakeMonaco = {
+			editor: {
+				createModel: (text: string, language: string) => {
+					created.push({ text, language });
+					return { dispose: () => disposed.push(`model:${text}`) };
+				},
+				createDiffEditor: (_element: unknown, given: Record<string, unknown>) => {
+					options = given;
+					return {
+						setModel: (pair: { original: unknown; modified: unknown }) => { shown = pair; },
+						dispose: () => disposed.push('editor'),
+					};
+				},
+			},
+		} as unknown as Parameters<typeof openDiffView>[0];
+
+		const close = openDiffView(fakeMonaco, {} as HTMLElement, 'on disk', 'mine', 'markdown');
+		assert.deepEqual(created, [
+			{ text: 'on disk', language: 'markdown' },
+			{ text: 'mine', language: 'markdown' },
+		]);
+		assert.ok(shown, 'the diff editor was given its own two models');
+		assert.equal(options.readOnly, true);
+		assert.equal(options.originalEditable, false);
+		assert.deepEqual(disposed, []);
+
+		// Every model it creates is disposed, or opening the view repeatedly leaks
+		// one document's worth of text each time.
+		close();
+		assert.deepEqual(disposed.sort(), ['editor', 'model:mine', 'model:on disk']);
+	});
+});
+
 describe('open file mode', () => {
 	/* ------------------------------------------------- the stored preference */
 
@@ -561,4 +659,42 @@ describe('file drop routing', () => {
 		assert.equal(dropPaneFor('editor', false), 'preview');
 		assert.equal(dropPaneFor('preview', true), 'preview');
 	});
+
+	test('the viewer routes both panes through it, and acts on all three answers', () => {
+		const drop = (target: DropPane | null, hasEditor: boolean, paths: string[]) => {
+			const calls: string[] = [];
+			handleDrop(paths, target, hasEditor, {
+				insert: (path) => calls.push(`insert ${path}`),
+				open: (path) => calls.push(`open ${path}`),
+				unsupported: (path) => calls.push(`unsupported ${path}`),
+			});
+			return calls;
+		};
+		const batch = ['/n/spec.md', '/n/figure.png', '/n/archive.zip'];
+
+		assert.deepEqual(drop('editor', true, batch), [
+			'open /n/spec.md',
+			'insert /n/figure.png',
+			'unsupported /n/archive.zip',
+		]);
+		assert.deepEqual(drop('preview', true, batch), [
+			'open /n/spec.md',
+			'unsupported /n/figure.png',
+			'unsupported /n/archive.zip',
+		]);
+		// Off both panes, a document still opens.
+		assert.deepEqual(drop(null, true, ['/n/spec.md']), ['open /n/spec.md']);
+		// No editor mounted: the editor pane answers as the preview.
+		assert.deepEqual(drop('editor', false, ['/n/figure.png']), ['unsupported /n/figure.png']);
+	});
+});
+
+describe('the Open dialog', () => {
+	test('the Open dialog offers every extension Markpad treats as a document', () => {
+		// Markpad opens, renders and saves `.txt` like any other note (#535); a
+		// shorter list hid those files behind "All Files".
+		const [markdown, all] = MARKDOWN_OPEN_FILTERS;
+		assert.deepEqual([...markdown.extensions].sort(), ['markdown', 'md', 'mdown', 'mkd', 'txt']);
+		assert.deepEqual(all.extensions, ['*']);
+	});
 });
diff --git a/scripts/documents.viewMode.spec.ts b/scripts/documents.viewMode.spec.ts
new file mode 100644
index 00000000..e54e26c4
--- /dev/null
+++ b/scripts/documents.viewMode.spec.ts
@@ -0,0 +1,671 @@
+import assert from 'node:assert/strict';
+
+import { afterAll, beforeAll, describe, test } from 'vitest';
+
+// Importing the store boots the settings singleton, which asks for the OS type.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { createExternalChange } = await import('../src/lib/sessions/externalChange.svelte.js');
+const { createViewMode } = await import('../src/lib/sessions/viewMode.svelte.js');
+const { asBufferLine, lineCoordinates } = await import('../src/lib/utils/lineCoordinates.js');
+
+type Tab = NonNullable<typeof tabManager.activeTab>;
+type ViewModeOptions = Parameters<typeof createViewMode>[0];
+
+// Issue #168, second report by @dayeggpi: "allow user to switch to rendered
+// view without saving/creating file ... no way to see rendered view until file
+// is saved".
+//
+// The cause was that reading mode was drawn from DISK: leaving the editor
+// called `loadMarkdown(tab.path)`, so a dirty tab had to be flushed first —
+// silently with auto-save on, through a modal otherwise — or the reader would
+// have shown the pre-edit file. The modal was never protecting the buffer; the
+// buffer survives a view toggle. It was protecting the screen from lying.
+//
+// Reading mode now renders the buffer.
+
+/*
+ * The viewer's view toggles and scroll sync, run through `sessions/viewMode`
+ * against the real tab store and the real flush from `externalChange`. The
+ * doubles are the backend (the file read, the Rust render, the disk) and the
+ * two panes, whose measurements are not what these tests are about.
+ */
+describe('view mode without saving', () => {
+	beforeAll(() => {
+		(window as any).__TAURI_INTERNALS__ = {
+			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+			invoke: () => Promise.reject(new Error('no invoke expected in these tests')),
+		};
+	});
+
+	// `settings` is one store for the whole file: put back what this block changes.
+	let settingsBefore: Pick<typeof settings, 'autoSave' | 'tocFollows' | 'previewCursor'>;
+	beforeAll(() => {
+		settingsBefore = { autoSave: settings.autoSave, tocFollows: settings.tocFollows, previewCursor: settings.previewCursor };
+	});
+	afterAll(() => {
+		Object.assign(settings, settingsBefore);
+	});
+
+	type Fakes = {
+		disk: Map<string, string>;
+		/** What `read_file_content_checked` answers with besides the text. */
+		lossy: boolean;
+		encoding: string;
+		saveCalls: string[];
+		readCalls: string[];
+		renderedFrom: string[];
+		toasts: string[];
+		saveFails: boolean;
+		/** Text the "user" appends while the save is awaiting (TOCTOU). */
+		typeDuringSave: string;
+		fullContent: boolean;
+	};
+
+	/** The Rust render's stand-in: the output names what it was given. */
+	const rendered = (raw: string) => `<html>${raw}</html>`;
+
+	/** Three lines of front matter, so the two line numberings differ by 3. */
+	const coords = lineCoordinates('---\na: 1\n---\n# body\n');
+
+	/** A scroll-sync position in the body, at buffer line `line`. */
+	const at = (line: number, ratio = 0.5) => ({ section: 'body' as const, ratio, line: asBufferLine(line) });
+
+	function freshFakes(): Fakes {
+		return {
+			disk: new Map(),
+			lossy: false,
+			encoding: 'UTF-8',
+			saveCalls: [],
+			readCalls: [],
+			renderedFrom: [],
+			toasts: [],
+			saveFails: false,
+			typeDuringSave: '',
+			fullContent: true,
+		};
+	}
+
+	function buildViewMode(fakes: Fakes, panes: Partial<ViewModeOptions> = {}) {
+		// Mirrors documentSession.saveContent for a tab that has a path.
+		const saveSilently = async (tabId: string) => {
+			fakes.saveCalls.push(tabId);
+			const tab = tabManager.tabs.find((item) => item.id === tabId)!;
+			if (fakes.saveFails) return false;
+			const snapshot = tab.rawContent;
+			await Promise.resolve();
+			if (fakes.typeDuringSave) tab.rawContent = snapshot + fakes.typeDuringSave;
+			fakes.disk.set(tab.path, snapshot);
+			tab.originalContent = snapshot;
+			return true;
+		};
+		const { flushBeforeLeavingEditableMode } = createExternalChange({
+			tabManager,
+			settings,
+			documentSession: { saveContent: saveSilently, allowOverwriteOnce: () => {}, resolveExternalChange: async () => ({ action: 'ignore' as const }) },
+			loadMarkdown: async () => {},
+			canCloseTab: async () => true,
+			readFile: async () => ['', false, 'UTF-8'],
+			editorLanguageFor: () => 'markdown',
+			addToast: (message: string) => void fakes.toasts.push(message),
+			t: (key: string) => key,
+		});
+		return createViewMode({
+			tabManager,
+			settings,
+			documentSession: { ensureFullContent: async () => fakes.fullContent },
+			flushBeforeLeavingEditableMode,
+			readFile: async (path: string) => {
+				fakes.readCalls.push(path);
+				return [fakes.disk.get(path) ?? '', fakes.lossy, fakes.encoding];
+			},
+			renderTabPreviewFromRaw: async (tab: Tab) => {
+				fakes.renderedFrom.push(tab.rawContent);
+				tabManager.updateTabContent(tab.id, rendered(tab.rawContent));
+			},
+			tick: async () => {},
+			addToast: (message: string) => void fakes.toasts.push(message),
+			t: (key: string) => key,
+			// No panes unless a test asks: where the reader lands (#799) is not
+			// what most of this file is about.
+			editorPane: undefined,
+			markdownBody: undefined,
+			previewBlocks: undefined,
+			lineCoords: coords,
+			readRendererLine: () => '',
+			getPreviewScrollSyncPosition: () => at(40),
+			scrollPreviewToSyncPosition: () => {},
+			getPreviewScrollAnchor: () => null,
+			...panes,
+		} as ViewModeOptions);
+	}
+
+	const ON_DISK = '# saved heading\n';
+	const IN_BUFFER = '# saved heading\n\nan edit that was never written to disk\n';
+
+	/**
+	 * A tab holding unsaved edits to a real file, in whichever editable pane the
+	 * caller names, with the file on disk still carrying the pre-edit text.
+	 */
+	function dirtyTab(mode: 'edit' | 'split', path = '/notes/note.md') {
+		tabManager.closeAll();
+		const fakes = freshFakes();
+		fakes.disk.set(path, ON_DISK);
+		tabManager.addTab(path);
+		const tab = tabManager.activeTab!;
+		tabManager.setTabRawContent(tab.id, ON_DISK);
+		tab.isEditing = mode === 'edit';
+		tabManager.setSplitEnabled(tab.id, mode === 'split');
+		tabManager.updateTabRawContent(tab.id, IN_BUFFER);
+		assert.equal(tab.isDirty, true, 'precondition: the tab is dirty');
+		return { tab, fakes, viewMode: buildViewMode(fakes) };
+	}
+
+	/** A saved, clean file in reading mode whose buffer holds what the read left. */
+	function readingTab(raw: string, path = '/notes/note.md') {
+		tabManager.closeAll();
+		tabManager.addTab(path);
+		const tab = tabManager.activeTab!;
+		tabManager.setTabRawContent(tab.id, raw);
+		return tab;
+	}
+
+	// ------------------------------------------------------- leaving edit mode
+
+	test('a dirty file switches to reading mode without a modal and without writing', async () => {
+		settings.autoSave = false;
+		const { tab, fakes, viewMode } = dirtyTab('edit');
+
+		await viewMode.toggleEdit();
+
+		assert.deepEqual(fakes.saveCalls, [], 'nothing is written to disk');
+		assert.equal(fakes.disk.get(tab.path), ON_DISK, 'the file is untouched');
+		assert.equal(tab.isEditing, false, 'the user actually reaches reading mode');
+		assert.equal(tab.isDirty, true, 'the edits are still unsaved, and still flagged as such');
+		assert.equal(tab.rawContent, IN_BUFFER, 'the buffer is intact');
+	});
+
+	test('reading mode shows the buffer, not the file', async () => {
+		settings.autoSave = false;
+		const { tab, viewMode, fakes } = dirtyTab('edit');
+
+		await viewMode.toggleEdit();
+
+		// The whole point of the bug: with a disk read here, this is `ON_DISK`.
+		assert.equal(tab.content, rendered(IN_BUFFER));
+		assert.deepEqual(fakes.renderedFrom, [IN_BUFFER], 'the preview is rendered once, from the buffer');
+	});
+
+	test('an untitled buffer never reaches the Save dialog on a view toggle', async () => {
+		settings.autoSave = true;
+		tabManager.closeAll();
+		const fakes = freshFakes();
+		tabManager.addTab('');
+		const tab = tabManager.activeTab!;
+		tab.isEditing = true;
+		tabManager.updateTabRawContent(tab.id, '# untitled\n');
+
+		await buildViewMode(fakes).toggleEdit();
+
+		assert.deepEqual(fakes.saveCalls, [], 'saveContent would open the Save dialog for a pathless tab');
+		assert.equal(tab.isEditing, false);
+		assert.equal(tab.content, rendered('# untitled\n'));
+	});
+
+	test('auto-save still flushes on the way out, because the debounce is about to be dropped', async () => {
+		// The auto-save effect requires `isEditing || isSplit`, so this is the last
+		// chance to honour "save automatically" for these edits.
+		settings.autoSave = true;
+		const { tab, fakes, viewMode } = dirtyTab('edit');
+
+		await viewMode.toggleEdit();
+
+		assert.deepEqual(fakes.saveCalls, [tab.id]);
+		assert.equal(fakes.disk.get(tab.path), IN_BUFFER, 'the flush actually wrote the buffer');
+		assert.equal(tab.isDirty, false);
+		assert.equal(tab.isEditing, false);
+		assert.equal(tab.content, rendered(IN_BUFFER));
+	});
+
+	test('a file that cannot be written no longer traps the user in the editor', async () => {
+		// Read-only path, or a buffer the lossy-decode guard refuses: saveContent
+		// returns false forever, and the old code returned early on that, so
+		// reading mode was unreachable for the life of the tab.
+		settings.autoSave = true;
+		const { tab, fakes, viewMode } = dirtyTab('edit');
+		fakes.saveFails = true;
+
+		await viewMode.toggleEdit();
+
+		assert.deepEqual(fakes.saveCalls, [tab.id], 'the flush was attempted');
+		assert.ok(fakes.toasts.includes('toast.autoSaveFailed'), 'and the failure was reported');
+		assert.equal(tab.isEditing, false, 'but the view still switches');
+		assert.equal(tab.content, rendered(IN_BUFFER));
+		assert.equal(tab.isDirty, true, 'the buffer is still there to be rescued');
+	});
+
+	test('edits typed during the flush are shown, and reported as not yet on disk', async () => {
+		settings.autoSave = true;
+		const { tab, fakes, viewMode } = dirtyTab('edit');
+		fakes.typeDuringSave = 'typed while saving\n';
+
+		await viewMode.toggleEdit();
+
+		assert.equal(tab.isDirty, true);
+		assert.ok(fakes.toasts.includes('toast.savedNewerEdits'), 'the disk is one revision behind');
+		assert.equal(tab.isEditing, false, 'the TOCTOU case is no longer a reason to stay in the editor');
+		assert.equal(
+			tab.content,
+			rendered(IN_BUFFER + 'typed while saving\n'),
+			'the preview shows the newest text, which is exactly what is NOT on disk',
+		);
+	});
+
+	// --------------------------------------------------- closing the split view
+
+	test('closing split view on a dirty file neither asks nor writes', async () => {
+		settings.autoSave = false;
+		const { tab, fakes, viewMode } = dirtyTab('split');
+
+		await viewMode.toggleSplitView(tab.id);
+
+		assert.deepEqual(fakes.saveCalls, []);
+		assert.equal(fakes.disk.get(tab.path), ON_DISK, 'the file is untouched');
+		assert.equal(tab.isSplit, false);
+		assert.equal(tab.isDirty, true);
+		assert.equal(tab.content, rendered(IN_BUFFER), 'the surviving pane keeps showing the buffer');
+	});
+
+	test('closing split view honours auto-save the same way leaving edit mode does', async () => {
+		settings.autoSave = true;
+		const { tab, fakes, viewMode } = dirtyTab('split');
+
+		await viewMode.toggleSplitView(tab.id);
+
+		assert.deepEqual(fakes.saveCalls, [tab.id]);
+		assert.equal(tab.isSplit, false);
+		assert.equal(tab.content, rendered(IN_BUFFER));
+	});
+
+	test('the view toggles no longer re-read the file to leave an editable pane', async () => {
+		settings.autoSave = false;
+		const edit = dirtyTab('edit');
+		await edit.viewMode.toggleEdit();
+		assert.deepEqual(edit.fakes.readCalls, [], 'leaving the editor read the file');
+
+		const split = dirtyTab('split');
+		await split.viewMode.toggleSplitView(split.tab.id);
+		assert.deepEqual(split.fakes.readCalls, [], 'closing the split read the file');
+		assert.equal(split.tab.rawContent, IN_BUFFER);
+	});
+
+	// ------------------------------------------- entering an editable pane (#379)
+
+	test('entering the editor reads the fidelity and stores it', async () => {
+		// The buffer is about to be handed to the editor, which arms auto-save:
+		// the tab must carry the verdict of this read, not one a load left behind.
+		const tab = readingTab('# stale\n');
+		tabManager.setTabDecodedLossy(tab.id, false);
+		const fakes = freshFakes();
+		fakes.disk.set(tab.path, '# caf�\n');
+		fakes.lossy = true;
+		fakes.encoding = 'windows-1252';
+
+		await buildViewMode(fakes).toggleEdit();
+
+		assert.deepEqual(fakes.readCalls, [tab.path]);
+		assert.equal(tab.isEditing, true);
+		assert.equal(tab.hasReplacementChars, true, 'the lossy decode was not recorded on the tab');
+		assert.equal(tab.encoding, 'windows-1252');
+		assert.equal(tab.rawContent, '# caf�\n');
+	});
+
+	test('entering split view reads the fidelity and stores it', async () => {
+		// An empty buffer (a restored tab not read yet) is read before the split
+		// opens, and that read decides the flag too.
+		const tab = readingTab('');
+		tabManager.setTabDecodedLossy(tab.id, false);
+		const fakes = freshFakes();
+		fakes.disk.set(tab.path, '# caf�\n');
+		fakes.lossy = true;
+		fakes.encoding = 'windows-1252';
+
+		await buildViewMode(fakes).toggleSplitView(tab.id);
+
+		assert.deepEqual(fakes.readCalls, [tab.path]);
+		assert.equal(tab.isSplit, true);
+		assert.equal(tab.hasReplacementChars, true, 'the lossy decode was not recorded on the tab');
+		assert.equal(tab.encoding, 'windows-1252');
+		assert.equal(tab.rawContent, '# caf�\n');
+	});
+
+	test('entering split view completes a partial buffer instead of trusting it', async () => {
+		// The old guard was `!tab.rawContent`, which a partial buffer satisfies:
+		// split view opened on the truncated text, the first keystroke made it
+		// dirty, and auto-save wrote it back 1.5s later.
+		const partial = readingTab('# the first 50KB\n');
+		const fakes = freshFakes();
+		fakes.fullContent = false;
+
+		await buildViewMode(fakes).toggleSplitView(partial.id);
+
+		assert.equal(partial.isSplit, false, 'split view opened over a buffer that could not be completed');
+		assert.deepEqual(fakes.toasts, ['toast.partialDocument']);
+
+		// The empty-buffer read goes through the store, so a tab restored empty
+		// and flagged partial stops being flagged once the file is in.
+		const unread = readingTab('');
+		tabManager.markTabContentUnavailable(unread.id);
+		assert.equal(unread.isTruncated, true, 'precondition: an unread tab is partial');
+		const reads = freshFakes();
+		reads.disk.set(unread.path, '# whole file\n');
+
+		await buildViewMode(reads).toggleSplitView(unread.id);
+
+		assert.equal(unread.isSplit, true);
+		assert.equal(unread.rawContent, '# whole file\n');
+		assert.equal(unread.isTruncated, false, 'the read left the tab flagged partial');
+	});
+
+	// ------------------------------------------------ where the reader lands (#799)
+
+	test('Ctrl+E hands each pane the line the other one was showing', async () => {
+		settings.autoSave = false;
+		const { tab, fakes } = dirtyTab('edit');
+		const fromEditor = at(120, 0.4);
+		const fromPreview = at(300, 0.7);
+		const synced: unknown[] = [];
+		const restored: unknown[] = [];
+		const viewMode = buildViewMode(fakes, {
+			editorPane: {
+				scrollSyncPosition: () => fromEditor,
+				syncScrollToPosition: (position) => void synced.push(position),
+				setCursor: () => {},
+			},
+			markdownBody: document.createElement('article'),
+			getPreviewScrollSyncPosition: () => fromPreview,
+			scrollPreviewToSyncPosition: (position) => void restored.push(position),
+		});
+
+		await viewMode.toggleEdit();
+		await Promise.resolve();
+		assert.equal(tab.isEditing, false);
+		assert.deepEqual(restored, [fromEditor], 'the preview was not sent to the editor\'s line');
+
+		await viewMode.toggleEdit();
+		assert.equal(tab.isEditing, true);
+		assert.deepEqual(synced, [fromPreview], 'the editor was not sent to the preview\'s line');
+	});
+
+	test('Ctrl+E brings the cursor on screen only when the outline follows it', async () => {
+		// An outline marking the cursor's heading while the editor shows another
+		// one reads as wrong, so with 'cursor' the handoff moves a cursor left off
+		// screen. With 'scroll' the outline never looks at the cursor, and moving
+		// it would only lose the reader's place.
+		const asked: unknown[] = [];
+		try {
+			for (const follows of ['cursor', 'scroll'] as const) {
+				settings.tocFollows = follows;
+				const { tab, fakes } = dirtyTab('edit');
+				tab.isEditing = false;
+				await buildViewMode(fakes, {
+					editorPane: {
+						syncScrollToPosition: (_position, options) => void asked.push(options),
+						scrollSyncPosition: () => null,
+						setCursor: () => {},
+					},
+					markdownBody: document.createElement('article'),
+				}).toggleEdit();
+			}
+		} finally {
+			settings.tocFollows = 'scroll';
+		}
+		assert.deepEqual(asked, [{ cursorIntoView: true }, { cursorIntoView: false }]);
+	});
+
+	// Scroll sync is split view's. The tab keeps `isScrollSynced` after the split
+	// closes, and out of split the other pane is still mounted at zero width, so
+	// syncing through it dragged the visible pane off its line on every Ctrl+E.
+	test('scroll sync left on in split view stays off once the split closes', () => {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/note.md');
+		const tab = tabManager.activeTab!;
+		tabManager.setSplitEnabled(tab.id, true);
+		if (!tab.isScrollSynced) tabManager.toggleScrollSync(tab.id);
+		const toPreview: unknown[] = [];
+		const toEditor: unknown[] = [];
+		const viewMode = buildViewMode(freshFakes(), {
+			scrollPreviewToSyncPosition: (position) => void toPreview.push(position),
+			editorPane: {
+				syncScrollToPosition: (position) => void toEditor.push(position),
+				scrollSyncPosition: () => null,
+				setCursor: () => {},
+			},
+		});
+		const position = at(40);
+		const preview = document.createElement('article');
+
+		viewMode.handleEditorScrollSync(position);
+		viewMode.syncEditorToPreviewScroll(preview);
+		assert.equal(toPreview.length, 1, 'precondition: split view syncs the preview');
+		assert.equal(toEditor.length, 1, 'precondition: split view syncs the editor');
+
+		tabManager.setSplitEnabled(tab.id, false);
+		tab.isEditing = true;
+		assert.equal(tab.isScrollSynced, true, 'the tab still remembers the choice');
+
+		viewMode.handleEditorScrollSync(position);
+		viewMode.syncEditorToPreviewScroll(preview);
+		assert.equal(toPreview.length, 1, 'the hidden preview was scrolled from the editor');
+		assert.equal(toEditor.length, 1, 'the editor was scrolled from the hidden preview');
+		// Editor top line 40 is anchor line 42 in the buffer, 39 in the body.
+		assert.equal(viewMode.tocActiveLine, 39, 'the outline still follows the editor');
+	});
+
+	test('leaving the editor moves the outline to the line the preview lands on', async () => {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/note.md');
+		const tab = tabManager.activeTab!;
+		tab.isEditing = false;
+		const viewMode = buildViewMode(freshFakes(), {
+			markdownBody: document.createElement('article'),
+			getPreviewScrollAnchor: () => 57 as never,
+		});
+
+		await viewMode.restoreAfterLeavingEditor(tab.id, at(58));
+
+		assert.equal(tab.anchorLine, 57);
+		assert.equal(viewMode.tocActiveLine, 57, 'the outline kept the entry from before the switch');
+	});
+
+	test('the preview feeds the same state, off the line it already measures', () => {
+		// One measurement of the preview's top line is the tab's reading position
+		// and the outline's entry, so the two cannot disagree.
+		tabManager.closeAll();
+		tabManager.addTab('/notes/note.md');
+		const tab = tabManager.activeTab!;
+		tab.isEditing = false;
+		const measured: unknown[] = [];
+		const preview = document.createElement('article');
+		const viewMode = buildViewMode(freshFakes(), {
+			getPreviewScrollAnchor: (target) => (measured.push(target), 57 as never),
+		});
+
+		viewMode.followPreviewScroll(preview);
+
+		assert.deepEqual(measured, [preview], 'one measurement, of the scrolled preview');
+		assert.equal(tab.anchorLine, 57);
+		assert.equal(viewMode.tocActiveLine, 57);
+	});
+
+	// #799: "the table of contents should follow the cursor". An editor setting,
+	// because only the editor has one: the preview alone always follows the scroll.
+	describeOutlineSource('cursor', true, (v) => {
+		v.handleEditorCursor(20 as never, 1);
+		assert.equal(v.tocActiveLine, 17, 'the cursor line, in the outline\'s numbering');
+		v.handleEditorScrollSync(at(60));
+		assert.equal(v.tocActiveLine, 17, 'scrolling the editor left it on the cursor');
+		v.handleEditorCursor(30 as never, 1);
+		assert.equal(v.tocActiveLine, 27);
+	});
+
+	describeOutlineSource('cursor', false, async (v) => {
+		v.handleEditorCursor(20 as never, 1);
+		assert.equal(v.tocActiveLine, null, 'no editor on screen, so no cursor to follow');
+		await v.restoreAfterLeavingEditor(tabManager.activeTab!.id, at(58));
+		assert.equal(v.tocActiveLine, 57, 'the preview alone follows its scroll');
+	});
+
+	describeOutlineSource('scroll', true, (v) => {
+		v.handleEditorCursor(20 as never, 1);
+		assert.equal(v.tocActiveLine, null, 'the default ignores the cursor');
+		v.handleEditorScrollSync(at(60));
+		assert.equal(v.tocActiveLine, 59);
+		// The editor alone keeps the preview mounted at zero width, and its
+		// scroll events put the outline on a heading from that layout.
+		v.followToc('preview', 90 as never);
+		assert.equal(v.tocActiveLine, 59, 'the hidden preview moved the outline');
+	});
+
+	function describeOutlineSource(
+		follows: 'cursor' | 'scroll',
+		editorOnScreen: boolean,
+		run: (viewMode: ReturnType<typeof buildViewMode>) => void | Promise<void>,
+	) {
+		test(`the outline follows the ${follows} setting with the editor ${editorOnScreen ? 'on' : 'off'} screen`, async () => {
+			tabManager.closeAll();
+			tabManager.addTab('/notes/note.md');
+			tabManager.activeTab!.isEditing = editorOnScreen;
+			settings.tocFollows = follows;
+			try {
+				await run(buildViewMode(freshFakes(), {
+					markdownBody: document.createElement('article'),
+					getPreviewScrollAnchor: () => 57 as never,
+				}));
+			} finally {
+				settings.tocFollows = 'scroll';
+			}
+		});
+	}
+
+	test('the preview does not move the outline after Ctrl+E until it is placed', async () => {
+		// Its scroll events before that report the old position, and the outline
+		// flashed the first headings until the preview was placed.
+		settings.autoSave = false;
+		const { tab, fakes } = dirtyTab('edit');
+		let place!: () => void;
+		let ticks = 0;
+		const viewMode = buildViewMode(fakes, {
+			editorPane: {
+				scrollSyncPosition: () => at(58),
+				syncScrollToPosition: () => {},
+				setCursor: () => {},
+			},
+			markdownBody: document.createElement('article'),
+			getPreviewScrollAnchor: () => 57 as never,
+			// The restore waits for the render's flush; hold that one back.
+			tick: () => (++ticks === 1 ? new Promise<void>((resolve) => (place = resolve)) : Promise.resolve()),
+		});
+
+		viewMode.handleEditorScrollSync(at(40));
+		assert.equal(viewMode.tocActiveLine, 39);
+		await viewMode.toggleEdit();
+		assert.equal(tab.isEditing, false);
+		viewMode.followToc('preview', 2 as never);
+		assert.equal(viewMode.tocActiveLine, 39, 'an unplaced preview put the outline on its own line');
+
+		place();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(viewMode.tocActiveLine, 57, 'the placed preview decides');
+		viewMode.followToc('preview', 60 as never);
+		assert.equal(viewMode.tocActiveLine, 60, 'and keeps deciding once placed');
+	});
+
+	test('reading with a cursor placed, the outline stays on it only while the preview draws it', () => {
+		/** A reading tab whose editor left its cursor on buffer line 20. */
+		const withCursor = () => {
+			tabManager.closeAll();
+			tabManager.addTab('/notes/note.md');
+			const tab = tabManager.activeTab!;
+			tab.isEditing = true;
+			const viewMode = buildViewMode(freshFakes());
+			viewMode.handleEditorCursor(20 as never, 3);
+			tab.isEditing = false;
+			return viewMode;
+		};
+		settings.tocFollows = 'cursor';
+		try {
+			settings.previewCursor = true;
+			const drawn = withCursor();
+			drawn.followToc('cursor', 17 as never);
+			drawn.followToc('preview', 90 as never);
+			assert.equal(drawn.tocActiveLine, 17, 'the preview scroll moved the outline off the drawn cursor');
+
+			// Off, the editor's last cursor is still there for Ctrl+E, but the
+			// preview shows nothing, so an outline pinned to it would look stuck.
+			settings.previewCursor = false;
+			const hidden = withCursor();
+			hidden.followToc('cursor', 17 as never);
+			hidden.followToc('preview', 90 as never);
+			assert.equal(hidden.tocActiveLine, 90, 'the outline stayed on a cursor the preview does not show');
+
+			settings.previewCursor = true;
+			tabManager.closeAll();
+			tabManager.addTab('/notes/note.md');
+			const without = buildViewMode(freshFakes());
+			without.followToc('preview', 90 as never);
+			assert.equal(without.tocActiveLine, 90, 'with no cursor yet, the outline follows the scroll');
+		} finally {
+			settings.tocFollows = 'scroll';
+			settings.previewCursor = false;
+		}
+	});
+
+	test('a click in the preview places the cursor only with its setting on, whatever the outline follows', () => {
+		// #799: the shared cursor is an editing aid in its own right, so Ctrl+E
+		// lands on the clicked character in either outline mode. The drawn caret
+		// is visual noise to some readers, so the whole aid is off by default.
+		const root = document.createElement('div');
+		root.innerHTML = '<p data-sourcepos="2:1-2:11">hello world</p>';
+		const text = root.querySelector('p')!.firstChild!;
+		(document as any).caretRangeFromPoint = () => {
+			const range = document.createRange();
+			range.setStart(text, 6);
+			return range;
+		};
+		const click = () => {
+			tabManager.closeAll();
+			tabManager.addTab('/notes/note.md');
+			const viewMode = buildViewMode(freshFakes(), {
+				previewBlocks: root,
+				readRendererLine: (line) => (line === 2 ? 'hello world' : ''),
+			});
+			viewMode.placePreviewCursor({ detail: 1, clientX: 0, clientY: 0 } as MouseEvent);
+			return viewMode;
+		};
+		try {
+			settings.tocFollows = 'cursor';
+			const off = click();
+			assert.equal(off.activeCursor, null, 'off by default: the click leaves the cursor alone');
+			assert.equal(off.tocActiveLine, null);
+
+			settings.previewCursor = true;
+			for (const follows of ['scroll', 'cursor'] as const) {
+				settings.tocFollows = follows;
+				const viewMode = click();
+				// Body line 2 is buffer line 5 under three lines of front matter.
+				assert.deepEqual(viewMode.activeCursor, { line: 5, column: 7 }, `${follows}: the click placed the cursor on the "w"`);
+				assert.equal(viewMode.tocActiveLine, follows === 'cursor' ? 2 : null, `${follows}: the outline`);
+			}
+		} finally {
+			settings.tocFollows = 'scroll';
+			settings.previewCursor = false;
+			delete (document as any).caretRangeFromPoint;
+		}
+	});
+});
diff --git a/scripts/editing.checks.test.ts b/scripts/editing.checks.test.ts
index 80d50e86..9a7e89b8 100644
--- a/scripts/editing.checks.test.ts
+++ b/scripts/editing.checks.test.ts
@@ -1,340 +1,18 @@
 import assert from 'node:assert/strict';
 import { describe, test } from 'node:test';
 
-import { KeyCode } from 'monaco-editor/esm/vs/editor/common/standalone/standaloneEnums.js';
-import { KeyMod } from 'monaco-editor/esm/vs/editor/common/services/editorBaseApi.js';
-import ts from 'typescript';
-
-import { bareCommands, runEditorHandler } from './keymapHarness.js';
-import { functionSource, readRustBackend, readSource, sliceFrom } from './sourceTree.js';
-import { frontMatterFenceLines, frontMatterLineOffset } from '../src/lib/utils/frontMatter.js';
+import { readRustBackend, readSource, sliceFrom } from './sourceTree.js';
 import { hasMarkdownLinkExtension, MARKDOWN_LINK_EXTENSIONS } from '../src/lib/utils/markdownLinks.js';
 
 /*
- * Issue #604's second item: Enter on a list item continues the list, Tab
- * changes its level, and Enter on an empty item ends the list.
- *
- * WHAT IS RUN AND WHAT IS ONLY READ
- *
- * The decision — "given this line and this caret, what should the next line
- * say" — is a pure function in `src/lib/utils/listEditing.ts` and is CALLED
- * here, once per shape of list item and block quote the app claims to
- * understand.
- *
- * The two handlers in `Editor.svelte` are lifted out of the component and run
- * against a stub editor, the same trick `keymapHarness.ts` uses, so what is
- * asserted is the edit they really produce rather than the shape of the source
- * that produces it.
- *
- * What NO test here can establish is that Monaco delivers these two keys at
- * runtime: keybinding resolution, the `when` clauses and the vim adapter all
- * live in a browser. What is pinned instead is the condition the app DECLARES —
- * the `when` expression is evaluated out of the source and read back — because
- * an Enter binding that forgets `!suggestWidgetVisible` breaks the completion
- * popup silently, and that is the one mistake this feature invites.
+ * Issue #604: Enter, Tab and Shift+Tab on list items and tables. The handlers
+ * and the `when` clauses the app binds them behind run in editing.test.ts.
+ * What is left here is the installed Monaco's own Shift+Tab command.
  */
 describe('list keys in the editor', () => {
-	// ------------------------------------------------- the handlers, actually run
-	//
-	// The two handlers are lifted out of the component and run against a stub
-	// editor by `runEditorHandler` in ./keymapHarness.ts, the same trick the keymap
-	// harness uses on `registerLocalizedActions` — so what is asserted is the edit
-	// they really produce rather than the shape of the source that produces it. The
-	// list module in scope there is the REAL one.
-	//
-	// Tab needs its collaborators named because it dispatches through them: the
-	// table branch comes first, and a run without `stepTableCell` in scope would be
-	// checking a handler the app does not have.
-
-	const EDITOR = 'src/lib/components/Editor.svelte';
-
-	const TAB_HANDLER = ['soleCaret', 'applyLineEdit', 'stepTableCell', 'shiftListLevel', 'handleTabKey'];
-
-	const SHIFT_TAB_HANDLER = [
-		'soleCaret',
-		'applyLineEdit',
-		'stepTableCell',
-		'shiftListLevel',
-		'handleShiftTabKey',
-	];
-
-	const ENTER_HANDLER = ['soleCaret', 'applyLineEdit', 'continueListOnEnter'];
-
-	test('Enter on a list item inserts the line break and the next marker in one edit', () => {
-		const run = runEditorHandler(ENTER_HANDLER, { lines: ['- item'], selections: [[1, 7, 1, 7]] });
-
-		assert.deepEqual(run.triggers, [], 'the plain Enter must not fire as well');
-		assert.deepEqual(run.edits, [
-			{ range: [1, 7, 1, 7], text: '\n- ', cursor: [2, 3, 2, 3] },
-		]);
-		assert.equal(run.undoStops, 1, 'the continuation is its own undo step');
-	});
-
-	test('the line break is the document\'s, not a hard-coded \\n', () => {
-		// The CRLF class of defect this repo has been bitten by before (#148): a
-		// handler that writes '\n' into a CRLF document leaves one mixed line
-		// behind, and nothing downstream reports it.
-		const run = runEditorHandler(ENTER_HANDLER, {
-			lines: ['1. item'],
-			selections: [[1, 8, 1, 8]],
-			eol: '\r\n',
-		});
-		assert.deepEqual(run.edits.map((edit) => edit.text), ['\r\n2. ']);
-	});
-
-	test('Enter on an empty item replaces the line instead of breaking it', () => {
-		const run = runEditorHandler(ENTER_HANDLER, { lines: ['- ', 'x'], selections: [[1, 3, 1, 3]] });
-
-		assert.deepEqual(run.triggers, []);
-		assert.deepEqual(run.edits, [
-			// The whole line, marker and all, becomes nothing — and the caret stays
-			// on it. No line is added: this keystroke leaves the list, it does not
-			// extend it.
-			{ range: [1, 1, 1, 3], text: '', cursor: [1, 1, 1, 1] },
-		]);
-	});
-
-	test('Enter on an empty nested item gives up one level instead of ending the list', () => {
-		// #856: the list ends only from the margin. Below it, Enter is Shift+Tab —
-		// the same `shiftListItem` edit, renumbering included.
-		const bullet = runEditorHandler(ENTER_HANDLER, {
-			lines: ['- a', '  - b', '  - '],
-			selections: [[3, 5, 3, 5]],
-		});
-		assert.deepEqual(bullet.triggers, []);
-		assert.deepEqual(bullet.edits, [{ range: [3, 1, 3, 5], text: '- ', cursor: [3, 3, 3, 3] }]);
-		assert.equal(bullet.undoStops, 1);
-
-		const ordered = runEditorHandler(ENTER_HANDLER, {
-			lines: ['1. a', '   1. b', '   2. '],
-			selections: [[3, 7, 3, 7]],
-		});
-		assert.deepEqual(ordered.edits, [{ range: [3, 1, 3, 7], text: '2. ', cursor: [3, 4, 3, 4] }]);
-
-		const quoted = runEditorHandler(ENTER_HANDLER, {
-			lines: ['> - a', '>   - '],
-			selections: [[2, 7, 2, 7]],
-		});
-		assert.deepEqual(quoted.edits, [{ range: [2, 1, 2, 7], text: '> - ', cursor: [2, 5, 2, 5] }]);
-
-		// At the margin there is no level left, so the list ends as before.
-		const margin = runEditorHandler(ENTER_HANDLER, {
-			lines: ['- a', '- '],
-			selections: [[2, 3, 2, 3]],
-		});
-		assert.deepEqual(margin.edits, [{ range: [2, 1, 2, 3], text: '', cursor: [2, 1, 2, 1] }]);
-	});
-
-	test('Enter anywhere else is a plain Enter', () => {
-		for (const lines of [['plain text'], ['---'], ['']]) {
-			const run = runEditorHandler(ENTER_HANDLER, {
-				lines,
-				selections: [[1, lines[0].length + 1, 1, lines[0].length + 1]],
-			});
-			assert.deepEqual(run.edits, [], JSON.stringify(lines[0]));
-			assert.deepEqual(run.triggers, ['type:"\\n"'], JSON.stringify(lines[0]));
-		}
-	});
-
-	test('a quoted line continues in the editor too', () => {
-		const run = runEditorHandler(ENTER_HANDLER, { lines: ['> quoted'], selections: [[1, 9, 1, 9]] });
-		assert.deepEqual(run.triggers, []);
-		assert.deepEqual(run.edits, [{ range: [1, 9, 1, 9], text: '\n> ', cursor: [2, 3, 2, 3] }]);
-		assert.equal(run.undoStops, 1);
-
-		const leaving = runEditorHandler(ENTER_HANDLER, { lines: ['> ', 'x'], selections: [[1, 3, 1, 3]] });
-		assert.deepEqual(leaving.edits, [{ range: [1, 1, 1, 3], text: '', cursor: [1, 1, 1, 1] }]);
-	});
-
-	test('a selection, or a second caret, gets the plain Enter', () => {
-		// One edit at the primary selection would silently discard what the other
-		// carets were about to do.
-		const spanning = runEditorHandler(ENTER_HANDLER, {
-			lines: ['- item'],
-			selections: [[1, 3, 1, 7]],
-		});
-		assert.deepEqual(spanning.edits, []);
-		assert.deepEqual(spanning.triggers, ['type:"\\n"']);
-
-		const multi = runEditorHandler(ENTER_HANDLER, {
-			lines: ['- one', '- two'],
-			selections: [
-				[1, 6, 1, 6],
-				[2, 6, 2, 6],
-			],
-		});
-		assert.deepEqual(multi.edits, []);
-		assert.deepEqual(multi.triggers, ['type:"\\n"']);
-	});
-
-	test('Tab on a list item is the list module’s edit, and Tab anywhere else is a Tab', () => {
-		// The handler no longer sends `editor.action.indentLines`: that command moves
-		// the line by `tabSize`, which is not a nesting level, and leaves the number
-		// alone — both halves of #711. What it sends now is one `executeEdits` built
-		// from `shiftListItem`, and nothing else, because a trigger AND an edit would
-		// indent the line twice.
-		const run = runEditorHandler(TAB_HANDLER, {
-			lines: ['1. something', '2. ', '3. c'],
-			selections: [[2, 4, 2, 4]],
-		});
-		assert.deepEqual(run.triggers, [], 'a core command fired as well as the edit');
-		assert.deepEqual(run.edits, [{ range: [2, 1, 3, 5], text: '   1. \n2. c', cursor: [2, 7, 2, 7] }]);
-		assert.equal(run.undoStops, 1, 'one Ctrl+Z must give the level back');
-
-		// A LIST ITEM’S TAB NEVER FALLS THROUGH. The first item of a list has nothing
-		// to nest under, so the key does nothing — handing it to `indentLines` would
-		// indent a line that no longer nests anywhere, which is the state #711’s
-		// reporter was left in.
-		for (const line of ['- item', '  1. item', '> - [x] item', '- ']) {
-			const alone = runEditorHandler(TAB_HANDLER, { lines: [line], selections: [[1, 3, 1, 3]] });
-			assert.deepEqual(alone.triggers, [], line);
-			assert.deepEqual(alone.edits, [], line);
-		}
-
-		for (const line of ['plain text', '# heading', '']) {
-			const prose = runEditorHandler(TAB_HANDLER, { lines: [line], selections: [[1, 1, 1, 1]] });
-			assert.deepEqual(prose.triggers, ['tab'], JSON.stringify(line));
-		}
-
-		// A selection spans lines on purpose or by accident; Monaco's own Tab
-		// already indents every line of it.
-		const selected = runEditorHandler(TAB_HANDLER, {
-			lines: ['- one', '- two'],
-			selections: [[1, 1, 2, 6]],
-		});
-		assert.deepEqual(selected.triggers, ['tab']);
-	});
-
-	test('Shift+Tab on a list item is the list’s level, not Monaco’s outdent', () => {
-		const run = runEditorHandler(SHIFT_TAB_HANDLER, {
-			lines: ['1. a', '   1. b', '   2. c'],
-			selections: [[3, 10, 3, 10]],
-		});
-		assert.deepEqual(run.triggers, [], 'outdent fired as well as the edit');
-		// It rejoins the list it left, so it is that list’s second item and not `1.`.
-		assert.deepEqual(run.edits, [{ range: [3, 1, 3, 8], text: '2. c', cursor: [3, 7, 3, 7] }]);
-
-		// Prose still gets Monaco’s own outdent.
-		for (const line of ['plain text', '']) {
-			const fallback = runEditorHandler(SHIFT_TAB_HANDLER, { lines: [line], selections: [[1, 1, 1, 1]] });
-			assert.deepEqual(fallback.triggers, ['outdent'], JSON.stringify(line));
-			assert.deepEqual(fallback.edits, [], JSON.stringify(line));
-		}
-
-		// A list item at the margin has no level to give up, and — like Tab’s first
-		// item — does not fall through either. `outdent` on a line with no
-		// indentation does nothing anyway; what the swallow rules out is the day a
-		// list item carries indentation Monaco would happily eat a `tabSize` of,
-		// leaving the item nested under nothing.
-		const margin = runEditorHandler(SHIFT_TAB_HANDLER, { lines: ['1. a'], selections: [[1, 1, 1, 1]] });
-		assert.deepEqual(margin.triggers, []);
-		assert.deepEqual(margin.edits, []);
-	});
-
-	test('inside a fenced code block, Tab, Shift+Tab and Enter mean what they mean in code', () => {
-		// `1. a` and `|a|bb|` inside ``` are code someone is writing, not a list or a
-		// table; renumbering or re-aligning them rewrites the code.
-		const table = ['```', '|a|bb|', '|-|-|', '|1|2|', '```'];
-		const tab = runEditorHandler(TAB_HANDLER, { lines: table, selections: [[2, 2, 2, 2]] });
-		assert.deepEqual(tab.edits, []);
-		assert.deepEqual(tab.triggers, ['tab']);
-
-		const list = ['~~~', '1. a', '2. b', '3. c', '~~~'];
-		const nest = runEditorHandler(TAB_HANDLER, { lines: list, selections: [[3, 5, 3, 5]] });
-		assert.deepEqual(nest.edits, []);
-		assert.deepEqual(nest.triggers, ['tab']);
-		// The first item used to swallow the key: nothing to nest under.
-		const first = runEditorHandler(TAB_HANDLER, { lines: list, selections: [[2, 5, 2, 5]] });
-		assert.deepEqual(first.triggers, ['tab']);
-
-		const back = runEditorHandler(SHIFT_TAB_HANDLER, {
-			lines: ['```', '1. a', '   1. b', '```'],
-			selections: [[3, 8, 3, 8]],
-		});
-		assert.deepEqual(back.edits, []);
-		assert.deepEqual(back.triggers, ['outdent']);
-
-		const enter = runEditorHandler(ENTER_HANDLER, { lines: ['```', '- item', '```'], selections: [[2, 7, 2, 7]] });
-		assert.deepEqual(enter.edits, []);
-		assert.deepEqual(enter.triggers, ['type:"\\n"']);
-
-		// …and below the closing fence the list is a list again.
-		const after = runEditorHandler(ENTER_HANDLER, { lines: ['```', 'x', '```', '- item'], selections: [[4, 7, 4, 7]] });
-		assert.deepEqual(after.edits.map((edit) => edit.text), ['\n- ']);
-	});
-
-	// ------------------------------------------------------------- the when clauses
-
-	/** Guards that must stand in front of all three keys, and what owns the key without them. */
-	const SHARED_GUARDS: Record<string, string> = {
-		editorTextFocus: 'the find box and the rename input both take Enter, and neither is the text',
-		'!editorReadonly': 'reading mode types nothing',
-		'!suggestWidgetVisible':
-			'Enter accepts a completion and Tab accepts a completion; this app has two completion providers, so the popup is a live case',
-		'!inSnippetMode': 'Tab jumps to the next snippet placeholder, and so does Shift+Tab backwards',
-	};
-
-	test('the editing keys are registered, and behind every guard that owns them first', () => {
-		// `bareCommands()` in ./keymapHarness.ts EVALUATES each `addCommand`
-		// argument, so the keybinding numbers are Monaco's own and the `when` string
-		// is the one the component computes.
-		const calls = bareCommands();
-
-		const enter = calls.filter((call) => call.binding === KeyCode.Enter);
-		assert.equal(enter.length, 1, 'exactly one Enter binding');
-		assert.equal(enter[0].handler, 'continueListOnEnter');
-
-		const tab = calls.filter((call) => call.binding === KeyCode.Tab);
-		assert.equal(tab.length, 1, 'exactly one plain-Tab binding');
-		assert.equal(tab[0].handler, 'handleTabKey');
-
-		const shiftTab = calls.filter((call) => call.binding === (KeyMod.Shift | KeyCode.Tab));
-		assert.equal(shiftTab.length, 1, 'exactly one Shift+Tab binding');
-		assert.equal(shiftTab[0].handler, 'handleShiftTabKey');
-
-		for (const call of [enter[0], tab[0], shiftTab[0]]) {
-			for (const [guard, why] of Object.entries(SHARED_GUARDS)) {
-				assert.ok(
-					call.when.split('&&').some((clause) => clause.trim() === guard),
-					`${call.handler} is bound without ${guard}: ${why}. when = ${call.when}`,
-				);
-			}
-		}
-
-		// The extra guard both Tab keys need: the accessibility toggle exists so that
-		// Tab leaves the editor, and a binding at weight 1000 would take that away.
-		for (const call of [tab[0], shiftTab[0]]) {
-			assert.ok(
-				call.when.includes('!editorTabMovesFocus'),
-				`${call.handler} is bound without !editorTabMovesFocus: ${call.when}`,
-			);
-		}
-	});
-
-	test('Shift+Tab still means outdent everywhere except inside a table', () => {
-		// THE DECISION THIS TEST GUARDS, AND HOW IT CHANGED.
-		//
-		// When the list keys landed, Shift+Tab was deliberately left unbound: Monaco's
-		// `outdent` already had the chord and already did the right thing, so a
-		// wrapper in front of it would have been a second name for a key that was
-		// already right. This test then asserted that no Shift+Tab command existed,
-		// and said in its own failure message that one may only appear if it does more
-		// than outdent.
-		//
-		// Tables were the first "more": there is no core command for "previous cell".
-		// #711 is the second — a level is not a `tabSize`, and an item that leaves a
-		// sub-list has to take the number of the list it rejoins. So the binding
-		// exists now, and what is pinned instead is the SAME decision two branches in:
-		// the handler's LAST path re-sends `outdent` rather than reimplementing it, so
-		// a code block, a paragraph and an item already at the margin all still get
-		// exactly Monaco's own behaviour.
-		const handler = functionSource(readSource(EDITOR), 'handleShiftTabKey');
-		assert.match(
-			handler,
-			/trigger\([^)]*"outdent"/,
-			'the Shift+Tab handler no longer falls through to Monaco\'s outdent',
-		);
-
+	test("Monaco's outdent is still what Shift+Tab means outside the app's handler", () => {
+		// The Shift+Tab handler's last path re-sends `outdent` (run in
+		// editing.test.ts). This pins the installed Monaco half of that claim.
 		// …and the claim that rests on, pinned against the installed Monaco rather
 		// than assumed: `outdent` is the command Shift+Tab means, in the editor, when
 		// Tab is not moving focus. If Monaco ever renames or re-chords it, the
@@ -348,210 +26,6 @@ describe('list keys in the editor', () => {
 	});
 });
 
-/*
- * Issue #604's first item: add a row or a column at the edge of a table without
- * a context menu, and leave the pipes lined up afterwards.
- *
- * WHAT IS RUN AND WHAT IS ONLY READ
- *
- * Everything below the first heading is the REAL `src/lib/utils/tableEditing.ts`
- * being called: parsing, the alignment arithmetic, where the caret lands. None
- * of it is a source-shape assertion, because none of it needs a browser.
- *
- * The last section runs the two Tab handlers out of `Editor.svelte` against a
- * stub editor (`runEditorHandler` in ./keymapHarness.ts), so what is asserted is
- * the edit they really produce — including the one case where the right answer
- * is to move the caret and make no edit at all.
- *
- * NOT ESTABLISHED HERE: that Monaco delivers Tab and Shift+Tab at runtime. The
- * `when` clauses that decide it are pinned in `editing.test.ts`, which
- * owns the other half of the same two keys.
- */
-describe('table keys in the editor', () => {
-	/** The table Markpad's own Insert Table command writes, once. */
-	const INSERTED = [
-		'| Header | Header | Header |',
-		'| --- | --- | --- |',
-		'| Cell | Cell | Cell |',
-		'| Cell | Cell | Cell |',
-	];
-
-	// --------------------------------------------- the handlers, actually run
-
-	/**
-	 * The two dispatchers and everything they route through, entry point last.
-	 *
-	 * Naming the collaborators is what keeps this honest: a stub `stepTableCell`
-	 * would let a Tab handler that had stopped looking at tables pass.
-	 */
-	const TAB = ['soleCaret', 'applyLineEdit', 'stepTableCell', 'shiftListLevel', 'handleTabKey'];
-
-	const SHIFT_TAB = ['soleCaret', 'applyLineEdit', 'stepTableCell', 'shiftListLevel', 'handleShiftTabKey'];
-
-	const MOD_ENTER = ['soleCaret', 'applyLineEdit', 'editTable', 'handleModEnterKey'];
-
-	const MOD_SHIFT_ENTER = ['soleCaret', 'applyLineEdit', 'editTable', 'handleModShiftEnterKey'];
-
-	test('Tab in a table writes the re-aligned table in one edit, and no plain Tab', () => {
-		const run = runEditorHandler(TAB, { lines: [...INSERTED], selections: [[4, 26, 4, 26]] });
-
-		assert.deepEqual(run.triggers, [], 'the plain Tab must not fire as well');
-		assert.equal(run.undoStops, 1, 'growing the table is its own undo step');
-		assert.deepEqual(run.edits, [
-			{
-				// The whole table, replaced — because every column may have changed width.
-				range: [1, 1, 4, 23],
-				text: [
-					'| Header | Header | Header |',
-					'| ------ | ------ | ------ |',
-					'| Cell   | Cell   | Cell   |',
-					'| Cell   | Cell   | Cell   |',
-					'|        |        |        |',
-				].join('\n'),
-				cursor: [5, 3, 5, 3],
-			},
-		]);
-	});
-
-	test("the line break between rows is the document's, not a hard-coded \\n", () => {
-		// The CRLF class of defect this repo has been bitten by before (#148): a
-		// handler that writes '\n' into a CRLF document leaves mixed lines behind and
-		// nothing downstream reports it.
-		const run = runEditorHandler(TAB, {
-			lines: [...INSERTED],
-			selections: [[4, 26, 4, 26]],
-			eol: '\r\n',
-		});
-		assert.ok(run.edits[0].text.includes('\r\n'), run.edits[0].text);
-		assert.ok(!/[^\r]\n/.test(run.edits[0].text), 'a bare \\n slipped into a CRLF document');
-	});
-
-	test('Shift+Tab in the first cell moves the caret and writes nothing', () => {
-		// An ALREADY ALIGNED table, so the "edit" would be the same text it replaces.
-		// Executing it anyway would push an undo step that undoes nothing and mark the
-		// document dirty for a keystroke that changed no character.
-		const run = runEditorHandler(SHIFT_TAB, {
-			lines: ['| a   | b   |', '| --- | --- |', '| 1   | 2   |'],
-			selections: [[1, 3, 1, 3]],
-		});
-		assert.deepEqual(run.edits, []);
-		assert.deepEqual(run.triggers, [], 'and it must not fall through to outdent either');
-		assert.equal(run.undoStops, 0);
-		// It still MOVES: from the start of `a` to the end of it, which is where every
-		// landing in a cell now is.
-		assert.deepEqual(run.selections, [[1, 4, 1, 4]]);
-	});
-
-	test('Shift+Tab outside a table and outside a list is Monaco’s own outdent', () => {
-		for (const line of ['plain text', '']) {
-			const run = runEditorHandler(SHIFT_TAB, { lines: [line], selections: [[1, 1, 1, 1]] });
-			assert.deepEqual(run.triggers, ['outdent'], JSON.stringify(line));
-			assert.deepEqual(run.edits, [], JSON.stringify(line));
-		}
-
-		// A list item stopped falling through with #711: `outdent` moves the line by
-		// `tabSize`, which lands on a level only by coincidence, and it renumbers
-		// nothing. The middle branch owns it now — table, then list, then the key.
-		const item = runEditorHandler(SHIFT_TAB, {
-			lines: ['  - a nested list item'],
-			selections: [[1, 1, 1, 1]],
-		});
-		assert.deepEqual(item.triggers, []);
-		assert.deepEqual(item.edits, [{ range: [1, 1, 1, 23], text: '- a nested list item', cursor: [1, 1, 1, 1] }]);
-	});
-
-	test('Tab on a list item is still the list’s Tab, and Tab in prose is still a Tab', () => {
-		// The dispatch order this feature had to fit into: table, then list, then the
-		// key's own meaning. #636 owns the middle branch and must not have moved.
-		// #711 changed what the middle branch DOES — one `executeEdits` from
-		// `shiftListItem` instead of `editor.action.indentLines` — but not where it
-		// sits, which is what this file is about.
-		const list = runEditorHandler(TAB, { lines: ['- a', '- item'], selections: [[2, 3, 2, 3]] });
-		assert.deepEqual(list.triggers, []);
-		assert.deepEqual(list.edits, [{ range: [2, 1, 2, 7], text: '  - item', cursor: [2, 5, 2, 5] }]);
-
-		const prose = runEditorHandler(TAB, { lines: ['plain text'], selections: [[1, 1, 1, 1]] });
-		assert.deepEqual(prose.triggers, ['tab']);
-	});
-
-	/*
-	 * Mod+Enter and Mod+Shift+Enter: "insert a line below / above", one Markdown
-	 * rule further on.
-	 *
-	 * These are Monaco's own `editor.action.insertLineAfter` and
-	 * `insertLineBefore`, and the reason they are the right keys for a table row is
-	 * that they keep meaning exactly what they already meant — inside a table, the
-	 * line below IS the row below. The row verbs used to live on `Mod+K R`, which
-	 * the user's verdict was 太难按: a two-key chord for the commonest table edit.
-	 */
-
-	test('Mod+Enter in a table inserts a row below and does not also insert a line', () => {
-		const run = runEditorHandler(MOD_ENTER, { lines: [...INSERTED], selections: [[3, 3, 3, 3]] });
-
-		assert.deepEqual(run.triggers, [], "Monaco's own insertLineAfter must not fire as well");
-		assert.equal(run.undoStops, 1);
-		assert.deepEqual(run.edits, [
-			{
-				range: [1, 1, 4, 23],
-				text: [
-					'| Header | Header | Header |',
-					'| ------ | ------ | ------ |',
-					'| Cell   | Cell   | Cell   |',
-					'|        |        |        |',
-					'| Cell   | Cell   | Cell   |',
-				].join('\n'),
-				cursor: [4, 3, 4, 3],
-			},
-		]);
-	});
-
-	test('Mod+Shift+Enter in a table inserts a row above', () => {
-		// Same caret as the test above, so the two keys are told apart by WHERE the
-		// new row goes: above the first body row rather than below it.
-		const run = runEditorHandler(MOD_SHIFT_ENTER, { lines: [...INSERTED], selections: [[3, 3, 3, 3]] });
-		assert.deepEqual(run.triggers, []);
-		assert.deepEqual(run.edits[0].text.split('\n')[2], '|        |        |        |');
-		assert.deepEqual(run.edits[0].cursor, [3, 3, 3, 3]);
-	});
-
-	test('outside a table both keys are Monaco’s own, unchanged', () => {
-		// THE FALL-THROUGH IS THE POINT, the same as Shift+Tab's. These two chords
-		// already had a meaning; this feature specialises it inside a table and hands
-		// the key straight back everywhere else.
-		for (const line of ['plain text', '- a list item', '']) {
-			assert.deepEqual(
-				runEditorHandler(MOD_ENTER, { lines: [line], selections: [[1, 1, 1, 1]] }).triggers,
-				['editor.action.insertLineAfter'],
-				JSON.stringify(line),
-			);
-			assert.deepEqual(
-				runEditorHandler(MOD_SHIFT_ENTER, { lines: [line], selections: [[1, 1, 1, 1]] }).triggers,
-				['editor.action.insertLineBefore'],
-				JSON.stringify(line),
-			);
-		}
-	});
-
-	test('a selection, or a second caret, gets the ordinary key', () => {
-		// One edit at the primary selection would silently discard what the other
-		// carets were about to do — and Monaco's own Tab already indents every line
-		// of a multi-line selection.
-		const spanning = runEditorHandler(TAB, { lines: [...INSERTED], selections: [[3, 3, 3, 8]] });
-		assert.deepEqual(spanning.edits, []);
-		assert.deepEqual(spanning.triggers, ['tab']);
-
-		const multi = runEditorHandler(SHIFT_TAB, {
-			lines: [...INSERTED],
-			selections: [
-				[3, 3, 3, 3],
-				[4, 3, 4, 3],
-			],
-		});
-		assert.deepEqual(multi.edits, []);
-		assert.deepEqual(multi.triggers, ['outdent']);
-	});
-});
-
 /**
  * #200: "implement some function which slugify titles and purpose those as
  * #targets for URL of link".
@@ -570,83 +44,12 @@ describe('table keys in the editor', () => {
  * different text, which is the part that is easy to get backwards.
  */
 describe('heading link completion wiring', () => {
-	const editorSource = readSource(new URL('../src/lib/components/Editor.svelte', import.meta.url));
-
 	const rustSource = readRustBackend();
 
-	/* ---------------------------------------------------------------- wiring */
-
-	test('the heading context is asked before the path context, which shares its prefix', () => {
-		// `](#` also satisfies the embed test — `/!?\[.*\]\($/` matches everything
-		// up to the paren. Asking for files first would answer a `#` with a list of
-		// filenames.
-		const heading = editorSource.indexOf('const headingContext = headingLinkContext(prefix)');
-		const embed = editorSource.indexOf('const isEmbedContext =');
-		assert.ok(heading > 0 && embed > 0);
-		assert.ok(heading < embed);
-		// And `#` has to open the dropdown, or the reader types it and nothing
-		// happens until the next character.
-		assert.match(editorSource, /triggerCharacters: \["\(", "\/", "\\\\", '"', "#"\]/);
-	});
-
-	test('each context writes the text its own syntax resolves', () => {
-		assert.match(
-			editorSource,
-			/insertText:\s*\n?\s*headingContext === "slug" \? anchor\.slug : anchor\.text/,
-		);
-		// Labelled by the heading, so typing a word of it finds the entry whatever
-		// the slug turned that word into.
-		assert.match(editorSource, /label: anchor\.text/);
-		assert.match(editorSource, /detail: `#\$\{anchor\.slug\}`/);
-	});
-
-	test('the list is read from Rust, and re-read only when the buffer changes', () => {
-		// A second anchorizer written in TypeScript would drift from comrak's
-		// without anything failing — the links would simply stop landing.
-		assert.match(editorSource, /const markdown = model\.getValue\(\);\s*const outline = \(\s*invoke\("markdown_outline", \{\s*markdown,/);
+	test('the outline command Rust answers takes the markdown the editor sends', () => {
+		// The TypeScript half (`createDocumentOutline` sends `{ markdown, … }`)
+		// runs in editing.test.ts; this is the Rust half of the command contract.
 		assert.match(rustSource, /async fn markdown_outline\(\s*markdown: String,/);
-		// Completion fires per keystroke while the dropdown is open; the headings
-		// cannot have moved between two keystrokes of one edit. Keyed on the model
-		// too, because version ids are counted per model and each tab has its own.
-		assert.match(editorSource, /if \(outlineCache\?\.model === model && outlineCache\.version === version\) return outlineCache\.outline;/);
-	});
-
-	// The folding provider and the sticky-scroll symbols ask for the same version
-	// together, and each ask sends the whole buffer to Rust to be parsed.
-	test('two asks for one version share one Rust call', async () => {
-		const lift = (name: string) => {
-			try {
-				return functionSource(editorSource, name);
-			} catch {
-				return '';
-			}
-		};
-		const calls: string[] = [];
-		const invoke = async (cmd: string) => {
-			calls.push(cmd);
-			return cmd === 'markdown_outline' ? { anchors: [], folds: [] } : [];
-		};
-		const headingAnchors = new Function(
-			'invoke',
-			'frontMatterFenceLines',
-			ts.transpileModule(
-				`let anchorCache = null;\nlet outlineCache = null;\n${lift('documentOutline')}\n${lift('headingAnchors')}\nreturn headingAnchors;`,
-				{ compilerOptions: { target: ts.ScriptTarget.ES2022 } },
-			).outputText,
-		)(invoke, () => 0) as (model: unknown) => Promise<unknown>;
-		const model = { getVersionId: () => 1, getValue: () => '# A\n' };
-
-		await Promise.all([headingAnchors(model), headingAnchors(model)]);
-		assert.equal(calls.length, 1, `one version, ${calls.length} calls: ${calls.join(', ')}`);
-	});
-
-	test('the Rust side numbers repeated headings the way the renderer does', () => {
-		// One anchorizer for the document, not one per heading: a second
-		// "Objectives" is `objectives-1`, and offering the bare slug for it would
-		// link to the first section. `heading_anchor_id` stays fresh per lookup on
-		// purpose — that one answers a wikilink, which names a heading by text.
-		assert.match(rustSource, /let mut anchorizer = Anchorizer::new\(\);[\s\S]{0,900}?anchorizer\.anchorize\(&text\)/);
-		assert.match(rustSource, /fn heading_anchor_id\(target: &str\) -> String \{\s*\n\s*Anchorizer::new\(\)/);
 	});
 });
 
@@ -674,21 +77,13 @@ describe('copy reference wiring', () => {
 
 	/* ---------------------------------------------------------------- the wiring */
 
-	test('all three entries go through one helper, which reads the buffer', () => {
+	test('all three Copy Reference entries call the one helper', () => {
 		// The preview's heading menu, the outline's right-click, and the outline's
 		// context menu. All three built the string inline before, which is how they
-		// came to disagree about the filename in the first place.
+		// came to disagree about the filename in the first place. What the helper
+		// writes runs in editing.test.ts ("copy reference wiring"); this pins
+		// that there is no second builder.
 		assert.equal((viewerSource.match(/copyHeadingReference\(/g) ?? []).length, 4, 'one helper, three callers');
-		assert.match(viewerSource, /style: preferredReferenceStyle\(tab\?\.rawContent \?\? ''\)/);
-		// The id is taken off the rendered element rather than recomputed.
-		assert.match(viewerSource, /heading\.id \|\| heading\.querySelector\('a\.anchor'\)\?\.id/);
-	});
-});
-
-describe('find seed wiring', () => {
-	test('the seed is wired to the find bar', () => {
-		// One line the compiler cannot check: a pure function nothing calls is dead code.
-		assert.match(readSource('src/lib/MarkdownViewer.svelte'), /if \(seed\) findBar\?\.setQuery\(seed\);/);
 	});
 });
 
@@ -740,169 +135,6 @@ describe('find widget tooltip clip', () => {
 	});
 });
 
-// The front-matter panel keeps five per-field state tables side by side, and
-// every one of them has to be keyed by document *and* field. Four were;
-// `frontMatterEditErrors` was keyed by the bare field name, so a validation
-// error raised while editing `date` in one document was still on screen —
-// under the same field — after switching to another document, and stayed
-// there until that field was edited successfully in the second document.
-//
-// Nothing caught it. The four siblings established a convention, the fifth
-// quietly did not follow it, and a convention is not a seam: no type, no test
-// and no comment said the key had to carry the document.
-//
-// This is a source-shape assertion because the panel lives inside
-// MarkdownViewer.svelte, which the Node test runner cannot import. What it
-// pins is deliberately narrow — that this one table is never indexed by a bare
-// `field.key` — rather than the spelling of any particular line.
-describe('front matter field state scope', () => {
-	const VIEWER = 'src/lib/MarkdownViewer.svelte';
-
-	/** The scoped key helper the four correct tables already went through. */
-	const SCOPED_KEY = 'frontMatterFieldStateKey(field)';
-
-	test('the front-matter error table is never keyed by a bare field name', () => {
-		const viewer = readSource(VIEWER);
-
-		// Every read and write of the table, with whatever sits in the brackets.
-		const indexed = [...viewer.matchAll(/frontMatterEditErrors\[([^\]]+)\]/g)].map(
-			(match) => match[1],
-		);
-		assert.ok(
-			indexed.length > 0,
-			`${VIEWER} no longer indexes frontMatterEditErrors — has the panel moved?`,
-		);
-
-		const unscoped = indexed.filter((expression) => /\bfield\.key\b/.test(expression));
-		assert.deepEqual(
-			unscoped,
-			[],
-			`frontMatterEditErrors must be keyed by ${SCOPED_KEY}, not by the field name alone — ` +
-				'a bare field name carries one document\'s error into every other document',
-		);
-
-		// The assignment sites spread the old table and add one entry, so the key
-		// they mint has to carry the document too.
-		const minted = [...viewer.matchAll(/\n\t+\[([^\]]+)\]: String\(error\),/g)].map(
-			(match) => match[1],
-		);
-		assert.ok(minted.length > 0, 'no front-matter error is recorded any more — has the catch moved?');
-		assert.deepEqual(
-			minted,
-			minted.map(() => SCOPED_KEY),
-			`every front-matter error must be recorded under ${SCOPED_KEY}`,
-		);
-	});
-
-	test('all five per-field front-matter tables agree on their key', () => {
-		const viewer = readSource(VIEWER);
-
-		// The four that were already right, plus the one this test exists for. If a
-		// sixth table joins the cluster it has to be added here, which is the point:
-		// the list is the convention, written down where it can fail.
-		const TABLES = [
-			'frontMatterEditErrors',
-			'frontMatterTagDrafts',
-			'frontMatterTagEditIndexes',
-			'frontMatterTagEditDrafts',
-		];
-
-		for (const table of TABLES) {
-			const indexed = [...viewer.matchAll(new RegExp(`${table}\\[([^\\]]+)\\]`, 'g'))].map(
-				(match) => match[1],
-			);
-			assert.ok(indexed.length > 0, `${table} is no longer indexed — has it been removed?`);
-			for (const expression of indexed) {
-				assert.match(
-					expression,
-					/frontMatterFieldStateKey\(|^key$/,
-					`${table} is indexed by \`${expression}\`, which does not carry the document`,
-				);
-			}
-		}
-	});
-});
-
-describe('front matter in the editor', () => {
-	// Split view hands scroll positions across as "inside the front matter" or
-	// "this line of the body", so both panes have to agree on where the front
-	// matter ends. The preview's answer is parseFrontMatter's. The editor used to
-	// scan for any two `---` lines on its own, so a document opening with a
-	// thematic break told the preview it was inside a front matter panel the
-	// preview did not have, and the preview stayed at the top until the editor
-	// scrolled past the second rule.
-	test('the editor finds the end of the front matter through parseFrontMatter too', () => {
-		const leadingRule = `---\n\n${Array.from({ length: 40 }, (_, i) => `Paragraph ${i + 1}.`).join('\n\n')}\n\n---\n\n# Next\n`;
-		assert.equal(frontMatterLineOffset(leadingRule), 0);
-
-		const editor = readSource('src/lib/components/Editor.svelte');
-		const scrollEnd = functionSource(editor, 'getEditorFrontMatterScrollEnd');
-		assert.match(scrollEnd, /frontMatterLineOffset\(/);
-		assert.doesNotMatch(editor, /\.trim\(\) !== '---'/);
-	});
-
-	// Split view asks for it on every scroll event, and it costs a copy of the
-	// buffer plus a YAML parse: once per document version is enough.
-	test('the editor parses the front matter once per document version, not per scroll event', () => {
-		const scrollEnd = functionSource(readSource('src/lib/components/Editor.svelte'), 'getEditorFrontMatterScrollEnd');
-		const run = new Function(
-			'editor',
-			'frontMatterLineOffset',
-			'getEditorContentScrollMax',
-			ts.transpileModule(`let frontMatterOffsetCache = null;\n${scrollEnd}\nreturn getEditorFrontMatterScrollEnd;`, {
-				compilerOptions: { target: ts.ScriptTarget.ES2022 },
-			}).outputText,
-		);
-		let version = 1;
-		let reads = 0;
-		const model = {
-			getVersionId: () => version,
-			getValue: () => (reads++, '---\ntitle: x\n---\n\n# Body\n'),
-			getLineCount: () => 6,
-		};
-		const editor = {
-			getModel: () => model,
-			getTopForLineNumber: (line: number) => line * 10,
-		};
-		const scrollEndOf = run(editor, frontMatterLineOffset, () => 1000) as () => number;
-
-		assert.equal(scrollEndOf(), 50);
-		scrollEndOf();
-		assert.equal(reads, 1, 'the buffer was re-read and re-parsed at the same version');
-		version = 2;
-		scrollEndOf();
-		assert.equal(reads, 2, 'an edit must invalidate it');
-	});
-
-	// The editor's analyses (headings, folds, colours) run in Rust on the whole
-	// buffer and blank the front matter lines first, so the closing `---` does not
-	// underline the YAML into a heading. Rust used to find those lines itself, with
-	// any two leading `---` lines, and blanked a thematic break plus the prose
-	// under it that the preview renders. Now it is told, by the same rule.
-	test('the editor tells Rust how many lines the front matter spans, fence to fence', () => {
-		const leadingRule = '---\n\n# Title\n\nSome intro text.\n\n---\n\n## Part 2\n';
-		assert.equal(frontMatterFenceLines(leadingRule), 0);
-		assert.equal(frontMatterFenceLines('# Plain\n'), 0);
-		assert.equal(frontMatterFenceLines('---\ntitle: x\ntags: [a]\n---\n\n# Body\n'), 4);
-		assert.equal(frontMatterFenceLines('\uFEFF--- \r\ntitle: x\r\n  ---\r\n# Body\r\n'), 3);
-		assert.equal(frontMatterFenceLines('---\n---\n'), 2);
-		// No newline after the closing fence: it is still one of the lines.
-		assert.equal(frontMatterFenceLines('---\ntitle: x\n---'), 3);
-		// Malformed is still front matter: the preview strips it too.
-		assert.equal(frontMatterFenceLines('---\ntitle: [broken\n---\n'), 3);
-
-		const editor = readSource('src/lib/components/Editor.svelte');
-		const tokens = readSource('src/lib/utils/semanticTokens.ts');
-		for (const [source, command] of [
-			[editor, 'markdown_outline'],
-			[tokens, 'markdown_semantic_spans'],
-		]) {
-			const call = source.slice(source.indexOf(`invoke(${source === editor ? '"' : "'"}${command}`));
-			assert.match(call.slice(0, call.indexOf('}')), /frontMatterLines: frontMatterFenceLines\(/, command);
-		}
-	});
-});
-
 // `[[Notes#Setup]]` — the exact string the "Copy Reference" context-menu item
 // writes to the clipboard — used to render as literal text: the Rust
 // preprocessor only understood the same-document form `[[#Setup]]`. It now
@@ -922,8 +154,6 @@ describe('front matter in the editor', () => {
 describe('wikilink extension and reference contracts', () => {
 	const rustSource = readRustBackend();
 
-	const referenceSource = readSource(new URL('../src/lib/utils/headingReference.ts', import.meta.url));
-
 	test('the extension list the rewriter mirrors still matches markdownLinks.ts', () => {
 		// The last cross-language copy of this list. Every TypeScript reader — the
 		// sanitizer's URI pattern, the export's `.md` -> `.html` rewrite, the Open
@@ -944,37 +174,4 @@ describe('wikilink extension and reference contracts', () => {
 			assert.equal(hasMarkdownLinkExtension(`file.${extension}`), true, extension);
 		}
 	});
-
-	test('every wikilink Copy Reference builds carries the heading the rewriter needs', () => {
-		// The rewriter only rewrites heading-bearing forms; a bare `[[Notes]]` stays
-		// literal text (see the scope note above). So the contract is that *every*
-		// `[[...]]` the viewer writes to the clipboard contains a `#`.
-		//
-		// Asserted that way round rather than as "three call sites match
-		// `[[${fn}#${...}]]`". That form hard-coded the local variable names holding
-		// the basename — renaming `fn` broke it — and the count, so adding a fourth
-		// correct Copy Reference entry failed while replacing one of the three with a
-		// broken bare form still left three matches and passed.
-		// The string moved: all three entries build it through `headingReference`,
-		// which picks the spelling the document is already written in (see
-		// `editing.test.ts`). The contract this test exists for is
-		// unchanged — a wikilink Copy Reference writes always carries a `#`,
-		// because the rewriter leaves a bare `[[Notes]]` as literal text — so it
-		// is asserted where the string is now built.
-		// Code lines only: the doc comment above the function spells `[[…]]` out
-		// in prose, and prose is not something Copy Reference writes.
-		const code = referenceSource
-			.split('\n')
-			.filter((line) => !/^\s*(\*|\/\/)/.test(line))
-			.join('\n');
-		const emitted = [...code.matchAll(/`\[\[[^`]*\]\]`/g)].map((match) => match[0]);
-		assert.ok(emitted.length > 0, 'Copy Reference no longer builds a wikilink — has the format moved?');
-		for (const wikilink of emitted) {
-			assert.match(
-				wikilink,
-				/#/,
-				`${wikilink}: a wikilink without a heading is left as literal text by process_wikilinks()`,
-			);
-		}
-	});
 });
diff --git a/scripts/editing.spec.ts b/scripts/editing.spec.ts
index e3cde8b5..5dee0fa8 100644
--- a/scripts/editing.spec.ts
+++ b/scripts/editing.spec.ts
@@ -2,6 +2,8 @@ import assert from 'node:assert/strict';
 import { describe, test } from 'vitest';
 
 import { findMatches, markMatches } from '../src/lib/utils/findText.js';
+import { FrontMatterFieldState } from '../src/lib/utils/frontMatterFieldState.svelte.js';
+import type { FrontMatterField } from '../src/lib/utils/frontMatter.js';
 
 // #982: find in the preview matches the text as drawn, the way Chromium's own
 // find was measured to: across inline elements, never across a visible line
@@ -78,3 +80,49 @@ describe('find in preview text', () => {
 		assert.equal(run.truncated, true);
 	});
 });
+
+// The panel keeps its per-field state side by side, and every table has to be
+// keyed by document *and* field. The error table was once keyed by the bare
+// field name, so a `date` error raised in one document stayed on screen under
+// `date` after switching to another document.
+describe('front matter field state scope', () => {
+	const date: FrontMatterField = { key: 'date', value: '', kind: 'string', displayValue: '', editable: true };
+	const tags: FrontMatterField = { key: 'tags', value: [], kind: 'list', displayValue: '', editable: true };
+
+	function twoDocuments() {
+		let doc = '/a.md';
+		const state = new FrontMatterFieldState(() => doc);
+		return { state, open: (path: string) => (doc = path) };
+	}
+
+	test('the front-matter error table is never keyed by a bare field name', () => {
+		const { state, open } = twoDocuments();
+		state.setEditError(date, new Error('bad date'));
+		assert.equal(state.editError(date), 'Error: bad date');
+
+		open('/b.md');
+		assert.equal(state.editError(date), undefined, "one document's error must not show in another");
+		state.clearEditError(date);
+
+		open('/a.md');
+		assert.equal(state.editError(date), 'Error: bad date', "clearing it elsewhere must not clear this document's");
+	});
+
+	test('all five per-field front-matter tables agree on their key', () => {
+		const { state, open } = twoDocuments();
+		state.setTagDraft(tags, 'draft-a');
+		state.startTagEdit(tags, 2, 'edit-a');
+
+		open('/b.md');
+		assert.equal(state.tagDraft(tags), '');
+		assert.equal(state.tagEditIndex(tags), null);
+		assert.equal(state.tagEditDraft(tags, 'fallback'), 'fallback');
+		state.setTagDraft(tags, 'draft-b');
+		state.clearTagEdit(tags);
+
+		open('/a.md');
+		assert.equal(state.tagDraft(tags), 'draft-a');
+		assert.equal(state.tagEditIndex(tags), 2);
+		assert.equal(state.tagEditDraft(tags, 'fallback'), 'edit-a');
+	});
+});
diff --git a/scripts/editing.test.ts b/scripts/editing.test.ts
index db8ed69a..d190db3e 100644
--- a/scripts/editing.test.ts
+++ b/scripts/editing.test.ts
@@ -6,12 +6,19 @@ import type * as Monaco from 'monaco-editor';
 import { blockEnter, parseListItem, shiftListItem } from '../src/lib/utils/listEditing.js';
 import { displayWidth, formatTable, parseTableAt, type TableDocument, type TableEdit, tableOperation, type TableOperation, tableStep } from '../src/lib/utils/tableEditing.js';
 import { isInFencedCode } from '../src/lib/utils/codeFence.js';
+import { editorKeyHandlers, type KeyHandlerEditor } from '../src/lib/utils/editorKeyHandlers.js';
+import { KeyCode } from 'monaco-editor/esm/vs/editor/common/standalone/standaloneEnums.js';
+import { KeyMod } from 'monaco-editor/esm/vs/editor/common/services/editorBaseApi.js';
+import { bareCommands } from './keymapHarness.js';
 import { installShimDom, parseHtml } from './renderProtocolDom.ts';
 import { headingLinkContext, headingQueryStart } from '../src/lib/utils/headingCompletion.js';
+import { createDocumentOutline, MARKDOWN_COMPLETION_TRIGGERS, type MarkdownCompletionDeps, provideMarkdownCompletionItems } from '../src/lib/utils/markdownCompletion.js';
 import { headingFoldRanges, headingSymbols } from '../src/lib/utils/headingSymbols.js';
-import { DEFAULT_REFERENCE_STYLE, headingReference, preferredReferenceStyle } from '../src/lib/utils/headingReference.js';
-import { findSeedFromSelection } from '../src/lib/utils/findSeed.js';
-import { addFrontMatterListItems, getFrontMatterListItems, getMarkdownBodyWithoutFrontMatter, parseFrontMatter, removeFrontMatterListItem, updateFrontMatterField, updateFrontMatterListItem } from '../src/lib/utils/frontMatter.js';
+import { DEFAULT_REFERENCE_STYLE, headingReference, headingSlug, preferredReferenceStyle, referenceForTab } from '../src/lib/utils/headingReference.js';
+import { findSeedFromSelection, seedFindBar } from '../src/lib/utils/findSeed.js';
+import { editorFrontMatterScrollEnd } from '../src/lib/utils/editorFrontMatter.js';
+import { createMarkdownSemanticTokensProvider } from '../src/lib/utils/semanticTokens.js';
+import { addFrontMatterListItems, getFrontMatterListItems, frontMatterFenceLines, getMarkdownBodyWithoutFrontMatter, parseFrontMatter, removeFrontMatterListItem, updateFrontMatterField, updateFrontMatterListItem } from '../src/lib/utils/frontMatter.js';
 import { getMarkdownLinkTarget, hasMarkdownLinkExtension, resolveMarkdownTargetPath } from '../src/lib/utils/markdownLinks.js';
 
 /*
@@ -25,17 +32,7 @@ import { getMarkdownLinkTarget, hasMarkdownLinkExtension, resolveMarkdownTargetP
  * here, once per shape of list item and block quote the app claims to
  * understand.
  *
- * The two handlers in `Editor.svelte` are lifted out of the component and run
- * against a stub editor, the same trick `keymapHarness.ts` uses, so what is
- * asserted is the edit they really produce rather than the shape of the source
- * that produces it.
- *
- * What NO test here can establish is that Monaco delivers these two keys at
- * runtime: keybinding resolution, the `when` clauses and the vim adapter all
- * live in a browser. What is pinned instead is the condition the app DECLARES —
- * the `when` expression is evaluated out of the source and read back — because
- * an Enter binding that forgets `!suggestWidgetVisible` breaks the completion
- * popup silently, and that is the one mistake this feature invites.
+ * The key handlers themselves run in 'editing keys in the editor' below.
  */
 
 // ------------------------------------------------------------- the pure part
@@ -376,14 +373,7 @@ describe('list continuation and nesting', () => {
  * being called: parsing, the alignment arithmetic, where the caret lands. None
  * of it is a source-shape assertion, because none of it needs a browser.
  *
- * The last section runs the two Tab handlers out of `Editor.svelte` against a
- * stub editor (`runEditorHandler` in ./keymapHarness.ts), so what is asserted is
- * the edit they really produce — including the one case where the right answer
- * is to move the caret and make no edit at all.
- *
- * NOT ESTABLISHED HERE: that Monaco delivers Tab and Shift+Tab at runtime. The
- * `when` clauses that decide it are pinned in `editing.test.ts`, which
- * owns the other half of the same two keys.
+ * The table keys themselves run in 'editing keys in the editor' below.
  */
 describe('table editing', () => {
 	/** A document from its lines — the shape Monaco's model already has. */
@@ -915,6 +905,467 @@ describe('table editing', () => {
 	});
 });
 
+/*
+ * The editing keys themselves: `src/lib/utils/editorKeyHandlers.ts`, run
+ * against a stub editor whose model is a list of lines. The list, table and
+ * code-fence modules behind them are the real ones, so what is asserted is the
+ * edit the key really produces.
+ *
+ * NOT ESTABLISHED HERE: that Monaco delivers these keys at runtime, or the
+ * `when` clauses they are bound behind.
+ */
+describe('editing keys in the editor', () => {
+	type Recorded = {
+		triggers: string[];
+		edits: Array<{ range: number[]; text: string; cursor: number[] }>;
+		/** `setSelection` calls: a caret moved without an edit. */
+		selections: number[][];
+		undoStops: number;
+	};
+
+	class FakeRange {
+		constructor(
+			readonly startLineNumber: number,
+			readonly startColumn: number,
+			readonly endLineNumber: number,
+			readonly endColumn: number,
+		) {}
+		isEmpty() {
+			return this.startLineNumber === this.endLineNumber && this.startColumn === this.endColumn;
+		}
+		numbers() {
+			return [this.startLineNumber, this.startColumn, this.endLineNumber, this.endColumn];
+		}
+	}
+
+	type Key = Exclude<keyof ReturnType<typeof editorKeyHandlers>, 'editTable'>;
+
+	function runKey(key: Key, options: { lines: string[]; selections: number[][]; eol?: string }): Recorded {
+		const recorded: Recorded = { triggers: [], edits: [], selections: [], undoStops: 0 };
+		const { lines } = options;
+		const eol = options.eol ?? '\n';
+		const selections = options.selections.map((s) => new FakeRange(s[0], s[1], s[2], s[3]));
+		const model = {
+			getLineContent: (line: number) => lines[line - 1],
+			getLineCount: () => lines.length,
+			getLineMaxColumn: (line: number) => lines[line - 1].length + 1,
+			getEOL: () => eol,
+			getValueInRange: (range: FakeRange) => {
+				const span = lines.slice(range.startLineNumber - 1, range.endLineNumber);
+				span[span.length - 1] = span[span.length - 1].slice(0, range.endColumn - 1);
+				span[0] = span[0].slice(range.startColumn - 1);
+				return span.join(eol);
+			},
+		};
+		const editor = {
+			getModel: () => model,
+			getSelections: () => selections,
+			pushUndoStop: () => {
+				recorded.undoStops += 1;
+				return true;
+			},
+			setSelection: (selection: FakeRange) => {
+				recorded.selections.push(selection.numbers());
+			},
+			trigger: (_source: string, handlerId: string, payload: { text?: string } | null) => {
+				recorded.triggers.push(payload?.text ? `${handlerId}:${JSON.stringify(payload.text)}` : handlerId);
+			},
+			executeEdits: (_source: string, edits: Array<{ range: FakeRange; text: string }>, cursor?: FakeRange[]) => {
+				for (const [index, edit] of edits.entries()) {
+					recorded.edits.push({ range: edit.range.numbers(), text: edit.text, cursor: cursor?.[index]?.numbers() ?? [] });
+				}
+				return true;
+			},
+		};
+		const ranges = { Range: FakeRange, Selection: FakeRange } as unknown as Pick<typeof Monaco, 'Range' | 'Selection'>;
+		editorKeyHandlers(editor as unknown as KeyHandlerEditor, ranges)[key]();
+		return recorded;
+	}
+
+	/** The table Markpad's own Insert Table command writes, once. */
+	const INSERTED = [
+		'| Header | Header | Header |',
+		'| --- | --- | --- |',
+		'| Cell | Cell | Cell |',
+		'| Cell | Cell | Cell |',
+	];
+
+	test('Enter on a list item inserts the line break and the next marker in one edit', () => {
+		const run = runKey('continueListOnEnter', { lines: ['- item'], selections: [[1, 7, 1, 7]] });
+
+		assert.deepEqual(run.triggers, [], 'the plain Enter must not fire as well');
+		assert.deepEqual(run.edits, [
+			{ range: [1, 7, 1, 7], text: '\n- ', cursor: [2, 3, 2, 3] },
+		]);
+		assert.equal(run.undoStops, 1, 'the continuation is its own undo step');
+	});
+
+	test('the line break is the document\'s, not a hard-coded \\n', () => {
+		// The CRLF class of defect this repo has been bitten by before (#148): a
+		// handler that writes '\n' into a CRLF document leaves one mixed line
+		// behind, and nothing downstream reports it.
+		const run = runKey('continueListOnEnter', {
+			lines: ['1. item'],
+			selections: [[1, 8, 1, 8]],
+			eol: '\r\n',
+		});
+		assert.deepEqual(run.edits.map((edit) => edit.text), ['\r\n2. ']);
+	});
+
+	test('Enter on an empty item replaces the line instead of breaking it', () => {
+		const run = runKey('continueListOnEnter', { lines: ['- ', 'x'], selections: [[1, 3, 1, 3]] });
+
+		assert.deepEqual(run.triggers, []);
+		assert.deepEqual(run.edits, [
+			// The whole line, marker and all, becomes nothing — and the caret stays
+			// on it. No line is added: this keystroke leaves the list, it does not
+			// extend it.
+			{ range: [1, 1, 1, 3], text: '', cursor: [1, 1, 1, 1] },
+		]);
+	});
+
+	test('Enter on an empty nested item gives up one level instead of ending the list', () => {
+		// #856: the list ends only from the margin. Below it, Enter is Shift+Tab —
+		// the same `shiftListItem` edit, renumbering included.
+		const bullet = runKey('continueListOnEnter', {
+			lines: ['- a', '  - b', '  - '],
+			selections: [[3, 5, 3, 5]],
+		});
+		assert.deepEqual(bullet.triggers, []);
+		assert.deepEqual(bullet.edits, [{ range: [3, 1, 3, 5], text: '- ', cursor: [3, 3, 3, 3] }]);
+		assert.equal(bullet.undoStops, 1);
+
+		const ordered = runKey('continueListOnEnter', {
+			lines: ['1. a', '   1. b', '   2. '],
+			selections: [[3, 7, 3, 7]],
+		});
+		assert.deepEqual(ordered.edits, [{ range: [3, 1, 3, 7], text: '2. ', cursor: [3, 4, 3, 4] }]);
+
+		const quoted = runKey('continueListOnEnter', {
+			lines: ['> - a', '>   - '],
+			selections: [[2, 7, 2, 7]],
+		});
+		assert.deepEqual(quoted.edits, [{ range: [2, 1, 2, 7], text: '> - ', cursor: [2, 5, 2, 5] }]);
+
+		// At the margin there is no level left, so the list ends as before.
+		const margin = runKey('continueListOnEnter', {
+			lines: ['- a', '- '],
+			selections: [[2, 3, 2, 3]],
+		});
+		assert.deepEqual(margin.edits, [{ range: [2, 1, 2, 3], text: '', cursor: [2, 1, 2, 1] }]);
+	});
+
+	test('Enter anywhere else is a plain Enter', () => {
+		for (const lines of [['plain text'], ['---'], ['']]) {
+			const run = runKey('continueListOnEnter', {
+				lines,
+				selections: [[1, lines[0].length + 1, 1, lines[0].length + 1]],
+			});
+			assert.deepEqual(run.edits, [], JSON.stringify(lines[0]));
+			assert.deepEqual(run.triggers, ['type:"\\n"'], JSON.stringify(lines[0]));
+		}
+	});
+
+	test('a quoted line continues in the editor too', () => {
+		const run = runKey('continueListOnEnter', { lines: ['> quoted'], selections: [[1, 9, 1, 9]] });
+		assert.deepEqual(run.triggers, []);
+		assert.deepEqual(run.edits, [{ range: [1, 9, 1, 9], text: '\n> ', cursor: [2, 3, 2, 3] }]);
+		assert.equal(run.undoStops, 1);
+
+		const leaving = runKey('continueListOnEnter', { lines: ['> ', 'x'], selections: [[1, 3, 1, 3]] });
+		assert.deepEqual(leaving.edits, [{ range: [1, 1, 1, 3], text: '', cursor: [1, 1, 1, 1] }]);
+	});
+
+	test('a selection, or a second caret, gets the plain Enter', () => {
+		// One edit at the primary selection would silently discard what the other
+		// carets were about to do.
+		const spanning = runKey('continueListOnEnter', {
+			lines: ['- item'],
+			selections: [[1, 3, 1, 7]],
+		});
+		assert.deepEqual(spanning.edits, []);
+		assert.deepEqual(spanning.triggers, ['type:"\\n"']);
+
+		const multi = runKey('continueListOnEnter', {
+			lines: ['- one', '- two'],
+			selections: [
+				[1, 6, 1, 6],
+				[2, 6, 2, 6],
+			],
+		});
+		assert.deepEqual(multi.edits, []);
+		assert.deepEqual(multi.triggers, ['type:"\\n"']);
+	});
+
+	test('Tab on a list item is the list module’s edit, and Tab anywhere else is a Tab', () => {
+		// The handler no longer sends `editor.action.indentLines`: that command moves
+		// the line by `tabSize`, which is not a nesting level, and leaves the number
+		// alone — both halves of #711. What it sends now is one `executeEdits` built
+		// from `shiftListItem`, and nothing else, because a trigger AND an edit would
+		// indent the line twice.
+		const run = runKey('handleTabKey', {
+			lines: ['1. something', '2. ', '3. c'],
+			selections: [[2, 4, 2, 4]],
+		});
+		assert.deepEqual(run.triggers, [], 'a core command fired as well as the edit');
+		assert.deepEqual(run.edits, [{ range: [2, 1, 3, 5], text: '   1. \n2. c', cursor: [2, 7, 2, 7] }]);
+		assert.equal(run.undoStops, 1, 'one Ctrl+Z must give the level back');
+
+		// A LIST ITEM’S TAB NEVER FALLS THROUGH. The first item of a list has nothing
+		// to nest under, so the key does nothing — handing it to `indentLines` would
+		// indent a line that no longer nests anywhere, which is the state #711’s
+		// reporter was left in.
+		for (const line of ['- item', '  1. item', '> - [x] item', '- ']) {
+			const alone = runKey('handleTabKey', { lines: [line], selections: [[1, 3, 1, 3]] });
+			assert.deepEqual(alone.triggers, [], line);
+			assert.deepEqual(alone.edits, [], line);
+		}
+
+		for (const line of ['plain text', '# heading', '']) {
+			const prose = runKey('handleTabKey', { lines: [line], selections: [[1, 1, 1, 1]] });
+			assert.deepEqual(prose.triggers, ['tab'], JSON.stringify(line));
+		}
+
+		// A selection spans lines on purpose or by accident; Monaco's own Tab
+		// already indents every line of it.
+		const selected = runKey('handleTabKey', {
+			lines: ['- one', '- two'],
+			selections: [[1, 1, 2, 6]],
+		});
+		assert.deepEqual(selected.triggers, ['tab']);
+	});
+
+	test('Shift+Tab on a list item is the list’s level, not Monaco’s outdent', () => {
+		const run = runKey('handleShiftTabKey', {
+			lines: ['1. a', '   1. b', '   2. c'],
+			selections: [[3, 10, 3, 10]],
+		});
+		assert.deepEqual(run.triggers, [], 'outdent fired as well as the edit');
+		// It rejoins the list it left, so it is that list’s second item and not `1.`.
+		assert.deepEqual(run.edits, [{ range: [3, 1, 3, 8], text: '2. c', cursor: [3, 7, 3, 7] }]);
+
+		// Prose still gets Monaco’s own outdent.
+		for (const line of ['plain text', '']) {
+			const fallback = runKey('handleShiftTabKey', { lines: [line], selections: [[1, 1, 1, 1]] });
+			assert.deepEqual(fallback.triggers, ['outdent'], JSON.stringify(line));
+			assert.deepEqual(fallback.edits, [], JSON.stringify(line));
+		}
+
+		// A list item at the margin has no level to give up, and — like Tab’s first
+		// item — does not fall through either. `outdent` on a line with no
+		// indentation does nothing anyway; what the swallow rules out is the day a
+		// list item carries indentation Monaco would happily eat a `tabSize` of,
+		// leaving the item nested under nothing.
+		const margin = runKey('handleShiftTabKey', { lines: ['1. a'], selections: [[1, 1, 1, 1]] });
+		assert.deepEqual(margin.triggers, []);
+		assert.deepEqual(margin.edits, []);
+	});
+
+	test('inside a fenced code block, Tab, Shift+Tab and Enter mean what they mean in code', () => {
+		// `1. a` and `|a|bb|` inside ``` are code someone is writing, not a list or a
+		// table; renumbering or re-aligning them rewrites the code.
+		const table = ['```', '|a|bb|', '|-|-|', '|1|2|', '```'];
+		const tab = runKey('handleTabKey', { lines: table, selections: [[2, 2, 2, 2]] });
+		assert.deepEqual(tab.edits, []);
+		assert.deepEqual(tab.triggers, ['tab']);
+
+		const list = ['~~~', '1. a', '2. b', '3. c', '~~~'];
+		const nest = runKey('handleTabKey', { lines: list, selections: [[3, 5, 3, 5]] });
+		assert.deepEqual(nest.edits, []);
+		assert.deepEqual(nest.triggers, ['tab']);
+		// The first item used to swallow the key: nothing to nest under.
+		const first = runKey('handleTabKey', { lines: list, selections: [[2, 5, 2, 5]] });
+		assert.deepEqual(first.triggers, ['tab']);
+
+		const back = runKey('handleShiftTabKey', {
+			lines: ['```', '1. a', '   1. b', '```'],
+			selections: [[3, 8, 3, 8]],
+		});
+		assert.deepEqual(back.edits, []);
+		assert.deepEqual(back.triggers, ['outdent']);
+
+		const enter = runKey('continueListOnEnter', { lines: ['```', '- item', '```'], selections: [[2, 7, 2, 7]] });
+		assert.deepEqual(enter.edits, []);
+		assert.deepEqual(enter.triggers, ['type:"\\n"']);
+
+		// …and below the closing fence the list is a list again.
+		const after = runKey('continueListOnEnter', { lines: ['```', 'x', '```', '- item'], selections: [[4, 7, 4, 7]] });
+		assert.deepEqual(after.edits.map((edit) => edit.text), ['\n- ']);
+	});
+
+	test('Shift+Tab still means outdent everywhere except inside a table', () => {
+		// Shift+Tab used to be left unbound because Monaco's `outdent` already did
+		// the right thing. Tables (no core "previous cell") and #711 (a level is not
+		// a `tabSize`) gave it a handler, and the handler's LAST path re-sends
+		// `outdent` rather than reimplementing it, so a paragraph, a code block and
+		// a blank line all still get exactly Monaco's own behaviour.
+		for (const lines of [['plain text'], [''], ['```', '  code', '```']]) {
+			const run = runKey('handleShiftTabKey', { lines, selections: [[lines.length > 1 ? 2 : 1, 1, lines.length > 1 ? 2 : 1, 1]] });
+			assert.deepEqual(run.triggers, ['outdent'], JSON.stringify(lines));
+			assert.deepEqual(run.edits, [], JSON.stringify(lines));
+		}
+	});
+
+	test('Tab in a table writes the re-aligned table in one edit, and no plain Tab', () => {
+		const run = runKey('handleTabKey', { lines: [...INSERTED], selections: [[4, 26, 4, 26]] });
+
+		assert.deepEqual(run.triggers, [], 'the plain Tab must not fire as well');
+		assert.equal(run.undoStops, 1, 'growing the table is its own undo step');
+		assert.deepEqual(run.edits, [
+			{
+				// The whole table, replaced — because every column may have changed width.
+				range: [1, 1, 4, 23],
+				text: [
+					'| Header | Header | Header |',
+					'| ------ | ------ | ------ |',
+					'| Cell   | Cell   | Cell   |',
+					'| Cell   | Cell   | Cell   |',
+					'|        |        |        |',
+				].join('\n'),
+				cursor: [5, 3, 5, 3],
+			},
+		]);
+	});
+
+	test("the line break between rows is the document's, not a hard-coded \\n", () => {
+		// The CRLF class of defect this repo has been bitten by before (#148): a
+		// handler that writes '\n' into a CRLF document leaves mixed lines behind and
+		// nothing downstream reports it.
+		const run = runKey('handleTabKey', {
+			lines: [...INSERTED],
+			selections: [[4, 26, 4, 26]],
+			eol: '\r\n',
+		});
+		assert.ok(run.edits[0].text.includes('\r\n'), run.edits[0].text);
+		assert.ok(!/[^\r]\n/.test(run.edits[0].text), 'a bare \\n slipped into a CRLF document');
+	});
+
+	test('Shift+Tab in the first cell moves the caret and writes nothing', () => {
+		// An ALREADY ALIGNED table, so the "edit" would be the same text it replaces.
+		// Executing it anyway would push an undo step that undoes nothing and mark the
+		// document dirty for a keystroke that changed no character.
+		const run = runKey('handleShiftTabKey', {
+			lines: ['| a   | b   |', '| --- | --- |', '| 1   | 2   |'],
+			selections: [[1, 3, 1, 3]],
+		});
+		assert.deepEqual(run.edits, []);
+		assert.deepEqual(run.triggers, [], 'and it must not fall through to outdent either');
+		assert.equal(run.undoStops, 0);
+		// It still MOVES: from the start of `a` to the end of it, which is where every
+		// landing in a cell now is.
+		assert.deepEqual(run.selections, [[1, 4, 1, 4]]);
+	});
+
+	test('Shift+Tab outside a table and outside a list is Monaco’s own outdent', () => {
+		for (const line of ['plain text', '']) {
+			const run = runKey('handleShiftTabKey', { lines: [line], selections: [[1, 1, 1, 1]] });
+			assert.deepEqual(run.triggers, ['outdent'], JSON.stringify(line));
+			assert.deepEqual(run.edits, [], JSON.stringify(line));
+		}
+
+		// A list item stopped falling through with #711: `outdent` moves the line by
+		// `tabSize`, which lands on a level only by coincidence, and it renumbers
+		// nothing. The middle branch owns it now — table, then list, then the key.
+		const item = runKey('handleShiftTabKey', {
+			lines: ['  - a nested list item'],
+			selections: [[1, 1, 1, 1]],
+		});
+		assert.deepEqual(item.triggers, []);
+		assert.deepEqual(item.edits, [{ range: [1, 1, 1, 23], text: '- a nested list item', cursor: [1, 1, 1, 1] }]);
+	});
+
+	test('Tab on a list item is still the list’s Tab, and Tab in prose is still a Tab', () => {
+		// The dispatch order this feature had to fit into: table, then list, then the
+		// key's own meaning. #636 owns the middle branch and must not have moved.
+		// #711 changed what the middle branch DOES — one `executeEdits` from
+		// `shiftListItem` instead of `editor.action.indentLines` — but not where it
+		// sits, which is what this file is about.
+		const list = runKey('handleTabKey', { lines: ['- a', '- item'], selections: [[2, 3, 2, 3]] });
+		assert.deepEqual(list.triggers, []);
+		assert.deepEqual(list.edits, [{ range: [2, 1, 2, 7], text: '  - item', cursor: [2, 5, 2, 5] }]);
+
+		const prose = runKey('handleTabKey', { lines: ['plain text'], selections: [[1, 1, 1, 1]] });
+		assert.deepEqual(prose.triggers, ['tab']);
+	});
+
+	/*
+	 * Mod+Enter and Mod+Shift+Enter: "insert a line below / above", one Markdown
+	 * rule further on.
+	 *
+	 * These are Monaco's own `editor.action.insertLineAfter` and
+	 * `insertLineBefore`, and the reason they are the right keys for a table row is
+	 * that they keep meaning exactly what they already meant — inside a table, the
+	 * line below IS the row below. The row verbs used to live on `Mod+K R`, which
+	 * the user's verdict was 太难按: a two-key chord for the commonest table edit.
+	 */
+
+	test('Mod+Enter in a table inserts a row below and does not also insert a line', () => {
+		const run = runKey('handleModEnterKey', { lines: [...INSERTED], selections: [[3, 3, 3, 3]] });
+
+		assert.deepEqual(run.triggers, [], "Monaco's own insertLineAfter must not fire as well");
+		assert.equal(run.undoStops, 1);
+		assert.deepEqual(run.edits, [
+			{
+				range: [1, 1, 4, 23],
+				text: [
+					'| Header | Header | Header |',
+					'| ------ | ------ | ------ |',
+					'| Cell   | Cell   | Cell   |',
+					'|        |        |        |',
+					'| Cell   | Cell   | Cell   |',
+				].join('\n'),
+				cursor: [4, 3, 4, 3],
+			},
+		]);
+	});
+
+	test('Mod+Shift+Enter in a table inserts a row above', () => {
+		// Same caret as the test above, so the two keys are told apart by WHERE the
+		// new row goes: above the first body row rather than below it.
+		const run = runKey('handleModShiftEnterKey', { lines: [...INSERTED], selections: [[3, 3, 3, 3]] });
+		assert.deepEqual(run.triggers, []);
+		assert.deepEqual(run.edits[0].text.split('\n')[2], '|        |        |        |');
+		assert.deepEqual(run.edits[0].cursor, [3, 3, 3, 3]);
+	});
+
+	test('outside a table both keys are Monaco’s own, unchanged', () => {
+		// THE FALL-THROUGH IS THE POINT, the same as Shift+Tab's. These two chords
+		// already had a meaning; this feature specialises it inside a table and hands
+		// the key straight back everywhere else.
+		for (const line of ['plain text', '- a list item', '']) {
+			assert.deepEqual(
+				runKey('handleModEnterKey', { lines: [line], selections: [[1, 1, 1, 1]] }).triggers,
+				['editor.action.insertLineAfter'],
+				JSON.stringify(line),
+			);
+			assert.deepEqual(
+				runKey('handleModShiftEnterKey', { lines: [line], selections: [[1, 1, 1, 1]] }).triggers,
+				['editor.action.insertLineBefore'],
+				JSON.stringify(line),
+			);
+		}
+	});
+
+	test('a selection, or a second caret, gets the ordinary key', () => {
+		// One edit at the primary selection would silently discard what the other
+		// carets were about to do — and Monaco's own Tab already indents every line
+		// of a multi-line selection.
+		const spanning = runKey('handleTabKey', { lines: [...INSERTED], selections: [[3, 3, 3, 8]] });
+		assert.deepEqual(spanning.edits, []);
+		assert.deepEqual(spanning.triggers, ['tab']);
+
+		const multi = runKey('handleShiftTabKey', {
+			lines: [...INSERTED],
+			selections: [
+				[3, 3, 3, 3],
+				[4, 3, 4, 3],
+			],
+		});
+		assert.deepEqual(multi.edits, []);
+		assert.deepEqual(multi.triggers, ['outdent']);
+	});
+});
+
 describe('fenced code detection', () => {
 	/** Every line of `text`, 1-based, answered in order. */
 	function inside(text: string): boolean[] {
@@ -1088,6 +1539,111 @@ describe('heading link completion', () => {
 		assert.equal(headingQueryStart(prefix), prefix.indexOf('#') + 1);
 		assert.equal(prefix.slice(headingQueryStart(prefix)), 'mer');
 	});
+
+	// The provider the editor registers, run against a one-line model and an
+	// injected `invoke` standing in for Rust.
+	const ANCHORS = [
+		{ line: 1, level: 1, text: '11. Mermaid Diagrams', slug: '11-mermaid-diagrams' },
+		{ line: 3, level: 2, text: 'Setup', slug: 'setup' },
+	];
+
+	function complete(line: string, invoked: string[] = []) {
+		const model = {
+			getLineContent: () => line,
+			getWordUntilPosition: () => ({ word: '', startColumn: line.length + 1, endColumn: line.length + 1 }),
+		} as unknown as Monaco.editor.ITextModel;
+		const position = { lineNumber: 1, column: line.length + 1 } as Monaco.Position;
+		return provideMarkdownCompletionItems(model, position, {
+			monaco: {
+				Range: class {
+					constructor(...range: number[]) {
+						Object.assign(this, { range });
+					}
+				},
+				languages: { CompletionItemKind: { Reference: 17, File: 20, Folder: 23 } },
+			} as unknown as MarkdownCompletionDeps['monaco'],
+			headingAnchors: async () => ANCHORS,
+			invoke: async (command) => {
+				invoked.push(command);
+				return ['notes.md'];
+			},
+			activeTabPath: () => '/docs/readme.md',
+			imageDirectory: () => 'assets',
+		});
+	}
+
+	test('the heading context is asked before the path context, which shares its prefix', async () => {
+		// `](#` also satisfies the embed test — `/!?\[.*\]\($/` matches everything
+		// up to the paren. Asking for files first would answer a `#` with a list of
+		// filenames.
+		const invoked: string[] = [];
+		const { suggestions } = await complete('See [the diagrams](#', invoked);
+		assert.deepEqual(suggestions.map((s) => s.label), ['11. Mermaid Diagrams', 'Setup']);
+		assert.deepEqual(invoked, [], 'the path completion ran too');
+		// …while the bare paren is still the path completion.
+		assert.deepEqual((await complete('See [x](')).suggestions.map((s) => s.label), ['notes.md', 'assets/notes.md']);
+		// And `#` has to open the dropdown, or the reader types it and nothing
+		// happens until the next character.
+		assert.ok(MARKDOWN_COMPLETION_TRIGGERS.includes('#'));
+	});
+
+	test('each context writes the text its own syntax resolves', async () => {
+		const slug = (await complete('See [the diagrams](#')).suggestions;
+		assert.deepEqual(slug.map((s) => s.insertText), ['11-mermaid-diagrams', 'setup']);
+		const wikilink = (await complete('[[#')).suggestions;
+		assert.deepEqual(wikilink.map((s) => s.insertText), ['11. Mermaid Diagrams', 'Setup']);
+		// Labelled by the heading, so typing a word of it finds the entry whatever
+		// the slug turned that word into.
+		assert.deepEqual(wikilink.map((s) => [s.label, s.detail]), [
+			['11. Mermaid Diagrams', '#11-mermaid-diagrams'],
+			['Setup', '#setup'],
+		]);
+	});
+
+	function outlineModel(text: string) {
+		let version = 1;
+		return {
+			model: { getVersionId: () => version, getValue: () => text } as unknown as Monaco.editor.ITextModel,
+			edit: () => (version += 1),
+		};
+	}
+
+	test('the list is read from Rust, and re-read only when the buffer changes', async () => {
+		// A second anchorizer written in TypeScript would drift from comrak's
+		// without anything failing — the links would simply stop landing.
+		const calls: Array<[string, unknown]> = [];
+		const { headingAnchors } = createDocumentOutline(async (command, args) => {
+			calls.push([command, args]);
+			return { anchors: ANCHORS, folds: [] };
+		});
+		const one = outlineModel('# A\n');
+		assert.deepEqual(await headingAnchors(one.model), ANCHORS);
+		assert.deepEqual(calls, [['markdown_outline', { markdown: '# A\n', frontMatterLines: 0 }]]);
+		// Completion fires per keystroke while the dropdown is open; the headings
+		// cannot have moved between two keystrokes of one edit.
+		await headingAnchors(one.model);
+		assert.equal(calls.length, 1, 'the same version was parsed twice');
+		// Keyed on the model too, because version ids are counted per model and
+		// each tab has its own.
+		await headingAnchors(outlineModel('# B\n').model);
+		assert.equal(calls.length, 2, 'another tab at the same version got this tab\'s headings');
+		one.edit();
+		await headingAnchors(one.model);
+		assert.equal(calls.length, 3, 'an edit must invalidate it');
+	});
+
+	// The folding provider and the sticky-scroll symbols ask for the same version
+	// together, and each ask sends the whole buffer to Rust to be parsed.
+	test('two asks for one version share one Rust call', async () => {
+		const calls: string[] = [];
+		const { documentOutline, headingAnchors } = createDocumentOutline(async (command) => {
+			calls.push(command);
+			return { anchors: [], folds: [] };
+		});
+		const { model } = outlineModel('# A\n');
+		await Promise.all([headingAnchors(model), documentOutline(model)]);
+		assert.equal(calls.length, 1, `one version, ${calls.length} calls: ${calls.join(', ')}`);
+	});
 });
 
 describe('heading symbols and folds', () => {
@@ -1290,6 +1846,18 @@ describe('find seed', () => {
 		assert.equal(seed(null), '', 'no selection');
 		assert.equal(seed(selecting('x'), null), '', 'no preview on screen');
 	});
+
+	test('the seed is wired to the find bar', () => {
+		const queries: string[] = [];
+		const bar = { setQuery: (value: string) => void queries.push(value) };
+
+		seedFindBar(bar, selecting('deterministic'), preview);
+		// Nothing to seed leaves the previous query alone.
+		seedFindBar(bar, selecting('x', 'caret'), preview);
+		seedFindBar(null, selecting('no bar yet'), preview);
+
+		assert.deepEqual(queries, ['deterministic']);
+	});
 });
 
 describe('front matter parsing and editing', () => {
@@ -1485,6 +2053,90 @@ Body starts here.
 		assert.match(parsed.error ?? '', /alias/i);
 		assert.equal(parsed.body, '# Body\n');
 	});
+
+	/** An editor over `text`, as `editorFrontMatterScrollEnd` reads it: line N sits at N*10 px. */
+	function scrollEditor(text: string) {
+		const state = { version: 1, reads: 0 };
+		const model = {
+			getVersionId: () => state.version,
+			getValue: () => (state.reads++, text),
+			getLineCount: () => text.split('\n').length,
+		};
+		const editor = { getModel: () => model, getTopForLineNumber: (line: number) => line * 10 };
+		const scrollEnd = editorFrontMatterScrollEnd(() => editor as never, () => 100_000);
+		return { state, scrollEnd };
+	}
+
+	// Split view hands scroll positions across as "inside the front matter" or
+	// "this line of the body", so both panes have to agree on where the front
+	// matter ends. The editor used to scan for any two `---` lines on its own, so
+	// a document opening with a thematic break told the preview it was inside a
+	// front matter panel the preview did not have.
+	test('the editor finds the end of the front matter through parseFrontMatter too', () => {
+		const leadingRule = `---\n\n${Array.from({ length: 40 }, (_, i) => `Paragraph ${i + 1}.`).join('\n\n')}\n\n---\n\n# Next\n`;
+		assert.equal(scrollEditor(leadingRule).scrollEnd(), 0, 'a leading rule is body, not front matter');
+		assert.equal(scrollEditor('---\ntitle: x\n---\n\n# Body\n').scrollEnd(), 50);
+	});
+
+	// Split view asks for it on every scroll event, and it costs a copy of the
+	// buffer plus a YAML parse: once per document version is enough.
+	test('the editor parses the front matter once per document version, not per scroll event', () => {
+		const { state, scrollEnd } = scrollEditor('---\ntitle: x\n---\n\n# Body\n');
+		assert.equal(scrollEnd(), 50);
+		scrollEnd();
+		assert.equal(state.reads, 1, 'the buffer was re-read and re-parsed at the same version');
+		state.version = 2;
+		scrollEnd();
+		assert.equal(state.reads, 2, 'an edit must invalidate it');
+	});
+
+	// The editor's analyses (headings, folds, colours) run in Rust on the whole
+	// buffer and blank the front matter lines first, so the closing `---` does not
+	// underline the YAML into a heading. Rust used to find those lines itself, with
+	// any two leading `---` lines, and blanked a thematic break plus the prose
+	// under it that the preview renders. Now it is told, by the same rule.
+	test('the editor tells Rust how many lines the front matter spans, fence to fence', async () => {
+		assert.equal(frontMatterFenceLines('---\n\n# Title\n\nSome intro text.\n\n---\n\n## Part 2\n'), 0);
+		assert.equal(frontMatterFenceLines('# Plain\n'), 0);
+		assert.equal(frontMatterFenceLines('---\ntitle: x\ntags: [a]\n---\n\n# Body\n'), 4);
+		assert.equal(frontMatterFenceLines('\uFEFF--- \r\ntitle: x\r\n  ---\r\n# Body\r\n'), 3);
+		assert.equal(frontMatterFenceLines('---\n---\n'), 2);
+		// No newline after the closing fence: it is still one of the lines.
+		assert.equal(frontMatterFenceLines('---\ntitle: x\n---'), 3);
+		// Malformed is still front matter: the preview strips it too.
+		assert.equal(frontMatterFenceLines('---\ntitle: [broken\n---\n'), 3);
+
+		const text = '---\ntitle: x\ntags: [a]\n---\n\n# Body\n';
+		const model = { uri: 'file:///a.md', getVersionId: () => 1, getValue: () => text };
+		const sent: Array<[string, unknown]> = [];
+
+		const { documentOutline } = createDocumentOutline(async (command, args) => {
+			sent.push([command, args]);
+			return { anchors: [], folds: [] };
+		});
+		await documentOutline(model as never);
+
+		// The semantic-token provider calls Tauri's `invoke` itself, so the
+		// stand-in goes where Tauri's runtime puts it.
+		const scope = globalThis as { window?: unknown };
+		const previous = scope.window;
+		scope.window = {
+			__TAURI_INTERNALS__: {
+				invoke: async (command: string, args: unknown) => (sent.push([command, args]), []),
+			},
+		};
+		try {
+			const { provider } = createMarkdownSemanticTokensProvider({} as never);
+			await provider.provideDocumentSemanticTokens(model as never);
+		} finally {
+			scope.window = previous;
+		}
+
+		assert.deepEqual(sent, [
+			['markdown_outline', { markdown: text, frontMatterLines: 4 }],
+			['markdown_semantic_spans', { content: text, frontMatterLines: 4 }],
+		]);
+	});
 });
 
 // `[[Notes#Setup]]` — the exact string the "Copy Reference" context-menu item
@@ -1547,3 +2199,81 @@ describe('wikilink file targets', () => {
 		assert.equal(getMarkdownLinkTarget('diagram.svg#part'), null);
 	});
 });
+
+describe('copy reference wiring', () => {
+	test('every Copy Reference entry writes the spelling the buffer is written in', () => {
+		// The preview's heading menu, the outline's right-click and the outline's
+		// context menu all build the string here. They built it inline before,
+		// which is how they came to disagree about the filename.
+		const inline = { path: 'C:\\notes\\setup.md', rawContent: 'See [Install](other.md#install).\n' };
+		assert.equal(referenceForTab('Setup', 'setup', inline), '[Setup](setup.md#setup)');
+		// The buffer, not the file on disk: an unsaved edit already counts.
+		assert.equal(referenceForTab('Setup', 'setup', { ...inline, rawContent: 'See [[Other#Install]].\n' }), '[[setup#Setup]]');
+		assert.equal(referenceForTab('Setup', 'setup', { path: null, rawContent: '' }), '#Setup');
+		assert.equal(referenceForTab('Setup', 'setup', undefined), '#Setup');
+	});
+
+	test('the id is taken off the rendered element rather than recomputed', () => {
+		// comrak can put it on an anchor nested inside the heading.
+		const anchor = { id: 'setup-1' };
+		const heading = (id: string) =>
+			({ id, querySelector: (selector: string) => (selector === 'a.anchor' ? anchor : null) }) as unknown as Element;
+		assert.equal(headingSlug(heading('setup')), 'setup');
+		assert.equal(headingSlug(heading('')), 'setup-1');
+	});
+});
+
+/*
+ * Issue #604: the condition the app DECLARES for Enter, Tab and Shift+Tab — the
+ * `when` expression `editorKeyCommands` hands Monaco — because an Enter binding
+ * that forgets `!suggestWidgetVisible` breaks the completion popup silently.
+ */
+describe('list keys in the editor', () => {
+	// ------------------------------------------------------------- the when clauses
+
+	/** Guards that must stand in front of all three keys, and what owns the key without them. */
+	const SHARED_GUARDS: Record<string, string> = {
+		editorTextFocus: 'the find box and the rename input both take Enter, and neither is the text',
+		'!editorReadonly': 'reading mode types nothing',
+		'!suggestWidgetVisible':
+			'Enter accepts a completion and Tab accepts a completion; this app has two completion providers, so the popup is a live case',
+		'!inSnippetMode': 'Tab jumps to the next snippet placeholder, and so does Shift+Tab backwards',
+	};
+
+	test('the editing keys are registered, and behind every guard that owns them first', () => {
+		// `bareCommands()` in ./keymapHarness.ts EVALUATES each `addCommand`
+		// argument, so the keybinding numbers are Monaco's own and the `when` string
+		// is the one the component computes.
+		const calls = bareCommands();
+
+		const enter = calls.filter((call) => call.binding === KeyCode.Enter);
+		assert.equal(enter.length, 1, 'exactly one Enter binding');
+		assert.equal(enter[0].handler, 'continueListOnEnter');
+
+		const tab = calls.filter((call) => call.binding === KeyCode.Tab);
+		assert.equal(tab.length, 1, 'exactly one plain-Tab binding');
+		assert.equal(tab[0].handler, 'handleTabKey');
+
+		const shiftTab = calls.filter((call) => call.binding === (KeyMod.Shift | KeyCode.Tab));
+		assert.equal(shiftTab.length, 1, 'exactly one Shift+Tab binding');
+		assert.equal(shiftTab[0].handler, 'handleShiftTabKey');
+
+		for (const call of [enter[0], tab[0], shiftTab[0]]) {
+			for (const [guard, why] of Object.entries(SHARED_GUARDS)) {
+				assert.ok(
+					call.when.split('&&').some((clause) => clause.trim() === guard),
+					`${call.handler} is bound without ${guard}: ${why}. when = ${call.when}`,
+				);
+			}
+		}
+
+		// The extra guard both Tab keys need: the accessibility toggle exists so that
+		// Tab leaves the editor, and a binding at weight 1000 would take that away.
+		for (const call of [tab[0], shiftTab[0]]) {
+			assert.ok(
+				call.when.includes('!editorTabMovesFocus'),
+				`${call.handler} is bound without !editorTabMovesFocus: ${call.when}`,
+			);
+		}
+	});
+});
diff --git a/scripts/editor.actions.test.ts b/scripts/editor.actions.test.ts
new file mode 100644
index 00000000..04867d32
--- /dev/null
+++ b/scripts/editor.actions.test.ts
@@ -0,0 +1,160 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import { KeyCode } from 'monaco-editor/esm/vs/editor/common/standalone/standaloneEnums.js';
+import { KeyMod } from 'monaco-editor/esm/vs/editor/common/services/editorBaseApi.js';
+
+import { editorActions, type EditorActionDeps } from '../src/lib/utils/editorActions.js';
+import { getSupportedLanguages, type LanguageCode, t, type Translation } from '../src/lib/utils/i18n.js';
+import { translations } from './allTranslations.js';
+import { bareCommands, chordOf, editorKeymap, PLATFORMS, registeredActions } from './keymapHarness.js';
+
+// The editor's context-menu / command-palette actions, as `utils/editorActions.ts`
+// declares them: labels per UI language, ids, and what the toggles write.
+
+const supported = getSupportedLanguages().map((l) => l.code as LanguageCode);
+
+/** The actions labelled in `lang`, with every dependency a no-op. */
+function actionsIn(lang: LanguageCode) {
+	const deps = new Proxy({ monaco: { KeyMod, KeyCode }, isMac: false, settings: {} } as Record<string, unknown>, {
+		get: (target, key) => (typeof key === 'string' && key in target ? target[key] : () => undefined),
+	}) as unknown as EditorActionDeps;
+	return editorActions(deps, lang);
+}
+
+/**
+ * Does `lang`'s own dictionary define `key`, without the English fallback?
+ *
+ * `t()` falls back to English, so comparing against `t(key, lang)` alone cannot
+ * see a locale that lost its entry.
+ */
+function defines(lang: LanguageCode, key: string): boolean {
+	let node: string | Translation | undefined = translations[lang];
+	for (const part of key.split('.')) {
+		if (typeof node !== 'object' || node === null || !(part in node)) return false;
+		node = node[part];
+	}
+	return typeof node === 'string';
+}
+
+describe('context menu actions', () => {
+	// The markdown formatting entries that used to be English string literals.
+	const FORMATTING_ACTIONS: ReadonlyArray<[actionId: string, key: string]> = [
+		['fmt-strikethrough', 'menu.strikethrough'],
+		['fmt-inline-code', 'menu.inlineCode'],
+		['fmt-code-block', 'menu.codeBlock'],
+		['fmt-quote', 'menu.quote'],
+		['fmt-heading-1', 'menu.heading1'],
+		['fmt-heading-2', 'menu.heading2'],
+		['fmt-heading-3', 'menu.heading3'],
+		['fmt-bullet-list', 'menu.bulletList'],
+		['fmt-numbered-list', 'menu.numberedList'],
+		['fmt-checklist', 'menu.checklist'],
+		['fmt-link', 'menu.link'],
+	];
+
+	test('every context-menu label is translated, none is an English literal', () => {
+		for (const [actionId, key] of FORMATTING_ACTIONS) {
+			let differsFromEnglish = false;
+			for (const lang of supported) {
+				const label = actionsIn(lang).find((action) => action.id === actionId)?.label;
+				assert.equal(label, t(key, lang), `${actionId} in ${lang} takes its label from ${key}`);
+				if (label !== t(key, 'en')) differsFromEnglish = true;
+			}
+			// Not vacuous: some language reads it differently, so an English literal
+			// would fail the loop above.
+			assert.ok(differsFromEnglish, `${key} reads the same in every language, so this proves nothing`);
+		}
+	});
+
+	test('toggle-occurrences-highlight has its own label, not Show Whitespace', () => {
+		// The two actions shared `settings.showWhitespace`, so the context menu
+		// listed the same entry twice and one of them silently toggled the other
+		// setting.
+		for (const lang of supported) {
+			const actions = actionsIn(lang);
+			const occurrences = actions.find((action) => action.id === 'toggle-occurrences-highlight')?.label;
+			const whitespace = actions.find((action) => action.id === 'toggle-whitespace')?.label;
+			assert.ok(defines(lang, 'settings.occurrencesHighlight'), `translated for ${lang}`);
+			assert.ok(defines(lang, 'settings.showWhitespace'), `translated for ${lang}`);
+			assert.equal(occurrences, t('settings.occurrencesHighlight', lang));
+			assert.equal(whitespace, t('settings.showWhitespace', lang));
+			assert.notEqual(occurrences, whitespace, `the two context-menu entries are distinguishable in ${lang}`);
+		}
+
+		const settings = { showWhitespace: false, occurrencesHighlight: false };
+		const deps = new Proxy({ monaco: { KeyMod, KeyCode }, isMac: false, settings } as Record<string, unknown>, {
+			get: (target, key) => (typeof key === 'string' && key in target ? target[key] : () => undefined),
+		}) as unknown as EditorActionDeps;
+		const actions = editorActions(deps, 'en');
+		actions.find((action) => action.id === 'toggle-occurrences-highlight')?.run(null as never);
+		assert.deepEqual(settings, { showWhitespace: false, occurrencesHighlight: true }, 'Highlight Occurrences toggles its own setting');
+		actions.find((action) => action.id === 'toggle-whitespace')?.run(null as never);
+		assert.deepEqual(settings, { showWhitespace: true, occurrencesHighlight: true }, 'Show Whitespace toggles its own setting');
+	});
+
+	test('no two actions share a label within a language', () => {
+		// A duplicated label is indistinguishable from a duplicated menu entry from
+		// the user's side, which is exactly how ED-6 presented.
+		for (const lang of supported) {
+			const seen = new Map<string, string>();
+			const actions = actionsIn(lang);
+			assert.ok(actions.length > 30, 'the localized action set was found');
+			for (const { id, label } of actions) {
+				const previous = seen.get(label);
+				assert.equal(previous, undefined, `${lang}: "${label}" is used by both ${previous} and ${id}`);
+				seen.set(label, id);
+			}
+		}
+	});
+
+	test('no action id is registered more than once', () => {
+		const ids = actionsIn('en').map((action) => action.id);
+		assert.ok(ids.length > 30, 'the action set was found');
+		assert.equal(new Set(ids).size, ids.length, 'action ids are unique');
+	});
+});
+
+describe('AltGr guard', () => {
+	test('every Ctrl+Alt action refuses a keystroke that is really AltGr', () => {
+		// Windows sends AltGr as Ctrl+Alt, so on a Polish layout AltGr+Z (ż) is also
+		// Ctrl+Alt+Z, Zen mode's chord. The editor sets `altGraphChord` on its own
+		// keydown (in Editor.svelte, not tested: it needs the editor mounted); every
+		// Ctrl+Alt action has to check it.
+		const ctrlAlt = KeyMod.CtrlCmd | KeyMod.Alt;
+		const { actions } = registeredActions(false);
+		const guarded = actions.filter((action) =>
+			action.keybindings?.some((binding) => (binding & ctrlAlt) === ctrlAlt),
+		);
+		// Zen mode and Insert Table today. Empty would make the loop below vacuous.
+		assert.ok(guarded.length >= 2, `found ${guarded.length} Ctrl+Alt actions`);
+		for (const action of guarded) assert.equal(action.keybindingContext, '!altGraphChord', action.id);
+	});
+});
+
+describe('editor option wiring', () => {
+	test('tab cycling avoids Cmd+Tab, which macOS never delivers to the app', () => {
+		// Reference frame: VS Code binds Ctrl+Tab / Ctrl+Shift+Tab with
+		// KeyMod.WinCtrl on macOS precisely because Cmd+Tab belongs to the system
+		// application switcher.
+		for (const platform of PLATFORMS) {
+			const keymap = editorKeymap(platform.mac, platform.os);
+			assert.deepEqual(keymap.get('tab-next'), ['Ctrl+Tab'], `tab-next on ${platform.name}`);
+			assert.deepEqual(keymap.get('tab-prev'), ['Ctrl+Shift+Tab'], `tab-prev on ${platform.name}`);
+		}
+	});
+
+	test('Ctrl+S is registered exactly once, by the command-palette action', () => {
+		for (const platform of PLATFORMS) {
+			const save = platform.mac ? 'Meta+S' : 'Ctrl+S';
+			const owners = [
+				...[...editorKeymap(platform.mac, platform.os)].filter(([, chords]) => chords.includes(save)).map(([id]) => id),
+				...bareCommands().filter((command) => chordOf(command.binding, platform.os) === save).map((command) => command.handler),
+			];
+			assert.deepEqual(owners, ['file-save'], `${platform.name}: ${save} has one binding, the palette action`);
+		}
+		const { actions, calls } = registeredActions(false);
+		actions.find((action) => action.id === 'file-save')?.run();
+		assert.deepEqual(calls, ['oncommand("save")']);
+	});
+});
diff --git a/scripts/editor.checks.test.ts b/scripts/editor.checks.test.ts
index 5734c0bb..8bbc4f90 100644
--- a/scripts/editor.checks.test.ts
+++ b/scripts/editor.checks.test.ts
@@ -3,211 +3,15 @@ import { existsSync } from 'node:fs';
 import { dirname, relative, resolve } from 'node:path';
 import { describe, test } from 'node:test';
 
-import { EditorOptions, inUntrustedWorkspace, type UnicodeHighlightOptions } from 'monaco-editor/esm/vs/editor/common/config/editorOptions.js';
-import { type UnicodeHighlightResult, UnicodeTextModelHighlighter } from 'monaco-editor/esm/vs/editor/common/services/unicodeTextModelHighlighter.js';
-import ts from 'typescript';
 import { parseTokenTheme, TokenTheme } from 'monaco-editor/esm/vs/editor/common/languages/supports/tokenization.js';
 
-import { getSupportedLanguages, type LanguageCode, t, type Translation } from '../src/lib/utils/i18n.js';
-import { translations } from './allTranslations.js';
-import { callbackBodies, enclosingFunctionName, filesMatching, functionSource, offsetOf, readDictionarySource, readRustBackend, readSource, readSourceFiles, sliceBetween, walkSourceFiles } from './sourceTree.js';
-import { editorOptionsFromSettings } from '../src/lib/utils/editorOptions.js';
-import { markdownTokenRules, monacoThemeName } from '../src/lib/utils/editorTheme.js';
-import { runEditorHandler } from './keymapHarness.js';
+import { callbackBodies, enclosingFunctionName, filesMatching, functionSource, readDictionarySource, readRustBackend, readSource, readSourceFiles, sliceBetween, walkSourceFiles } from './sourceTree.js';
+import { markdownTokenRules } from '../src/lib/utils/editorTheme.js';
 import { MONACO_IME_PATCH, MONACO_TEXTAREA_FILE, patchMonacoTextAreaForIme } from './monacoImePatch.mjs';
 import { importedThemeRules, PREVIEW_KIND_VARS } from '../src/lib/utils/theme.js';
 import { TOKEN_TYPES } from '../src/lib/utils/semanticTokens.js';
 import { DEFAULT_IMAGE_DIRECTORY } from '../src/lib/utils/imageEmbed.js';
 
-// WHAT THIS FILE COVERS, AND WHAT IT DOES NOT
-//
-// Covered for real: the translation table. `t()` is imported and called, so the
-// key-exists / falls-back / distinct-label assertions are genuine behaviour.
-//
-// Not covered: Monaco's runtime. Editor.svelte is a Svelte component and cannot
-// be imported here, so "the context menu is rebuilt when the language changes"
-// and "no action id is registered twice" are pinned by reading the component's
-// source. Those assertions prove the code is *written* that way, not that
-// Monaco behaves that way when the effect re-runs — verifying that needs a
-// running editor.
-describe('context menu actions', () => {
-	const editor = readSource('src/lib/components/Editor.svelte');
-
-	const supported = getSupportedLanguages().map((l) => l.code);
-
-	function count(source: string, pattern: RegExp): number {
-		return source.match(pattern)?.length ?? 0;
-	}
-
-	/**
-	 * Does `lang`'s own dictionary define `key`, without the English fallback?
-	 *
-	 * `t()` falls back to English, so `assert.notEqual(t(key, lang), key)` can only
-	 * fail when ENGLISH lacks the key — which each caller below already asserts one
-	 * line earlier. The 26-language loop around it restated that 26 times and could
-	 * not see the regression it was written for: deleting the German
-	 * `menu.inlineCode` entry left the whole suite green while the German context
-	 * menu rendered the English label.
-	 *
-	 * These labels are held to a stricter bar than the dictionary at large.
-	 * settings.checks.test.ts reports per-locale gaps rather than failing on them,
-	 * because 19 locales are missing >100 keys and nobody should have to translate
-	 * a new English string 25 times before landing it. That trade does not apply
-	 * here: this is a fixed list of a dozen context-menu entries, all 26 languages
-	 * define all of them today, and adding an eleventh action means adding a row to
-	 * FORMATTING_ACTIONS by hand — so the cost is visible where it is incurred.
-	 */
-	function defines(lang: LanguageCode, key: string): boolean {
-		let node: string | Translation | undefined = translations[lang];
-		for (const part of key.split('.')) {
-			if (typeof node !== 'object' || node === null || !(part in node)) return false;
-			node = node[part];
-		}
-		return typeof node === 'string';
-	}
-
-	// The markdown formatting entries that used to be English string literals.
-	const FORMATTING_ACTIONS: ReadonlyArray<[actionId: string, key: string, englishLabel: string]> = [
-		['fmt-strikethrough', 'menu.strikethrough', 'Strikethrough'],
-		['fmt-inline-code', 'menu.inlineCode', 'Inline Code'],
-		['fmt-code-block', 'menu.codeBlock', 'Code Block'],
-		['fmt-quote', 'menu.quote', 'Quote'],
-		['fmt-heading-1', 'menu.heading1', 'Heading 1'],
-		['fmt-heading-2', 'menu.heading2', 'Heading 2'],
-		['fmt-heading-3', 'menu.heading3', 'Heading 3'],
-		['fmt-bullet-list', 'menu.bulletList', 'Bullet List'],
-		['fmt-numbered-list', 'menu.numberedList', 'Numbered List'],
-		['fmt-checklist', 'menu.checklist', 'Checklist'],
-		['fmt-link', 'menu.link', 'Link'],
-	];
-
-	test('every context-menu label is translated, none is an English literal', () => {
-		for (const [actionId, key, englishLabel] of FORMATTING_ACTIONS) {
-			assert.doesNotMatch(
-				editor,
-				new RegExp(`id: "${actionId}",\\s*\\n\\s*label: "${englishLabel}"`),
-				`${actionId} must not hard-code "${englishLabel}"`,
-			);
-			assert.match(
-				editor,
-				new RegExp(`id: "${actionId}",\\s*\\n\\s*label: t\\('${key.replace('.', '\\.')}', lang\\)`),
-				`${actionId} takes its label from ${key}`,
-			);
-		}
-
-		// No `addAction` anywhere in the component may carry a bare string label.
-		assert.equal(
-			count(editor, /addAction\(\{\s*\n\s*id: "[^"]+",\s*\n\s*label: "/g),
-			0,
-			'no action label is a raw string literal',
-		);
-	});
-
-	test('toggle-occurrences-highlight has its own label, not Show Whitespace', () => {
-		// The two actions shared `settings.showWhitespace`, so the context menu
-		// listed the same entry twice and one of them silently toggled the other
-		// setting.
-		assert.match(
-			editor,
-			/id: "toggle-occurrences-highlight",\s*\n\s*label: t\('settings\.occurrencesHighlight', lang\)/,
-		);
-		assert.match(
-			editor,
-			/id: "toggle-whitespace",\s*\n\s*label: t\('settings\.showWhitespace', lang\)/,
-		);
-		assert.equal(
-			count(editor, /label: t\('settings\.showWhitespace', lang\)/g),
-			1,
-			'settings.showWhitespace labels exactly one action',
-		);
-
-		for (const lang of supported) {
-			const occurrences = t('settings.occurrencesHighlight', lang as LanguageCode);
-			const whitespace = t('settings.showWhitespace', lang as LanguageCode);
-			// Same substitution as above: `occurrences !== 'settings.occurrencesHighlight'`
-			// only ever failed if English lacked the key, which the assertions at the
-			// top of this test already cover.
-			assert.ok(defines(lang as LanguageCode, 'settings.occurrencesHighlight'), `translated for ${lang}`);
-			assert.ok(defines(lang as LanguageCode, 'settings.showWhitespace'), `translated for ${lang}`);
-			assert.notEqual(
-				occurrences,
-				whitespace,
-				`the two context-menu entries are distinguishable in ${lang}`,
-			);
-		}
-	});
-
-	test('no two actions share a label within a language', () => {
-		// A duplicated label is indistinguishable from a duplicated menu entry from
-		// the user's side, which is exactly how ED-6 presented.
-		const labelKeys = [...editor.matchAll(/label: t\('([^']+)', lang\)/g)].map((m) => m[1]);
-		assert.ok(labelKeys.length > 30, 'the localized action set was found');
-		assert.equal(new Set(labelKeys).size, labelKeys.length, 'each action uses a distinct key');
-
-		for (const lang of supported) {
-			const labels = labelKeys.map((key) => t(key, lang as LanguageCode));
-			const seen = new Map<string, string>();
-			for (const [index, label] of labels.entries()) {
-				const previous = seen.get(label);
-				assert.equal(
-					previous,
-					undefined,
-					`${lang}: "${label}" is used by both ${previous} and ${labelKeys[index]}`,
-				);
-				seen.set(label, labelKeys[index]);
-			}
-		}
-	});
-
-	test('actions are re-registered when the UI language changes', () => {
-		// The labels used to be baked in at mount, so switching language left the
-		// editor's context menu in the previous one until the app restarted.
-		assert.match(
-			editor,
-			/function registerLocalizedActions\(lang: LanguageCode\)/,
-			'registration is a function of the language, not of mount time',
-		);
-		assert.match(
-			editor,
-			/\$effect\(\(\) => \{\s*\n\s*const lang = settings\.language;/,
-			'an effect tracks settings.language',
-		);
-		assert.match(
-			editor,
-			/registerLocalizedActions\(lang\);\s*\n\s*return disposeLocalizedActions;/,
-			'the effect cleanup disposes the previous registration',
-		);
-
-		// `addAction` returns an IDisposable; re-registering an id without disposing
-		// leaves a duplicate entry in the context menu.
-		assert.match(
-			editor,
-			/function disposeLocalizedActions\(\) \{[\s\S]*?for \(const action of localizedActions\) action\.dispose\(\);/,
-			'every disposable is released',
-		);
-		assert.match(
-			editor,
-			/function registerLocalizedActions\(lang: LanguageCode\) \{[\s\S]{0,400}?disposeLocalizedActions\(\);/,
-			'registration disposes before it rebuilds',
-		);
-		assert.match(editor, /onDestroy\(disposeLocalizedActions\)/, 'teardown releases them too');
-
-		// The old design read a `uiLanguage` snapshot captured inside onMount. The
-		// narrower "no label is still bound to the snapshot" count that used to
-		// follow this line is gone: it counted occurrences of a pattern containing
-		// `uiLanguage`, so the line above has to pass for it to be reached and,
-		// once it has, the count is zero by construction. There is no state of the
-		// component in which it, and not the line above, is the failure.
-		assert.doesNotMatch(editor, /uiLanguage/, 'no captured language snapshot remains');
-	});
-
-	test('no action id is registered more than once', () => {
-		const ids = [...editor.matchAll(/addAction\(\{\s*\n\s*id: "([^"]+)"/g)].map((m) => m[1]);
-		assert.ok(ids.length > 30, 'the action set was found');
-		assert.equal(new Set(ids).size, ids.length, 'action ids are unique');
-	});
-});
-
 // Editor.svelte translates the settings store into Monaco options and
 // keybindings. Every regression locked here came from that translation layer
 // being wired to the wrong shape: a string option read as a boolean, a
@@ -216,176 +20,18 @@ describe('context menu actions', () => {
 describe('editor option wiring', () => {
 	const editor = readSource('src/lib/components/Editor.svelte');
 
-	const settingsStore = readSource('src/lib/stores/settings.svelte.ts');
-
 	function count(source: string, pattern: RegExp): number {
 		return source.match(pattern)?.length ?? 0;
 	}
 
-	/** A settled settings store, so each test names only the field it is about. */
-	const SETTINGS = {
-		minimap: false,
-		stickyScroll: true,
-		wordWrap: 'on',
-		editorMaxWidth: 80,
-		lineNumbers: 'on',
-		renderLineHighlight: 'line',
-		occurrencesHighlight: false,
-		editorFontSize: 14,
-		editorFont: 'Menlo',
-		showWhitespace: false,
-		animateJumpScroll: true,
-		animateCursor: true,
-		typewriterMode: false,
-	};
-
-	test('an option a setting can change is one `updateOptions` re-applies', () => {
-		// `smoothScrolling` used to be a bare `true` in the creation literal, where
-		// options that are set once and never re-applied live. Left there, the
-		// toggle would have taken effect only on a newly created editor — the same
-		// shape as the `fontSize` divergence this file was written for.
-		assert.doesNotMatch(
-			editor,
-			/smoothScrolling/,
-			'smoothScrolling is spelled in the component again, outside the set the update effect re-applies',
-		);
-	});
-
-	test('renderLineHighlight is a Monaco string enum, not a boolean flag', () => {
-		// The store holds 'line' / 'none'. Any non-empty string is truthy, so a
-		// ternary on it can only ever produce "line" and silently defeats both the
-		// line-highlight toggle and Zen mode (which sets it to 'none').
-		assert.match(settingsStore, /renderLineHighlight = \$state\('line'\)/);
-		assert.match(settingsStore, /this\.renderLineHighlight = this\.renderLineHighlight === 'line' \? 'none' : 'line'/);
-		assert.match(settingsStore, /this\.renderLineHighlight = 'none'/, 'zen mode sets the string to none');
-
-		// Both stored values have to survive the trip. A ternary passes for 'line'
-		// and fails for 'none', which is why one evaluation cannot judge this.
-		for (const stored of ['line', 'none'] as const) {
-			assert.equal(
-				editorOptionsFromSettings({ ...SETTINGS, renderLineHighlight: stored }, 100).renderLineHighlight,
-				stored,
-				`the stored string ${stored} is forwarded unchanged`,
-			);
-			assert.equal(
-				(createdEditorOptions({ renderLineHighlight: stored }) as { renderLineHighlight?: string })
-					.renderLineHighlight,
-				stored,
-				`and reaches the created editor as ${stored}`,
-			);
-		}
-	});
-
 	test('editor options are applied by a single updateOptions effect', () => {
 		// Two competing effects (one nested in onMount, one top level) wrote the
 		// same Monaco options with different values — notably fontSize with and
 		// without the zoom factor — so the winner depended on effect ordering.
+		// What that one call applies is editor.test.ts "editor options are applied by a
+		// single updateOptions effect"; how many call sites there are is only in the
+		// component's source.
 		assert.equal(count(editor, /editor\.updateOptions\(/g), 1, 'exactly one updateOptions call site');
-
-		// What that one call applies, evaluated rather than read: every option the
-		// two effects used to fight over, and the zoom-aware font size that was the
-		// value they disagreed on.
-		const applied = editorOptionsFromSettings({ ...SETTINGS, editorFontSize: 20, editorMaxWidth: 90 }, 150);
-		assert.equal(applied.fontSize, 30, 'the surviving font size carries the zoom factor');
-		assert.equal(applied.wordWrapColumn, 90, 'wordWrapColumn survived the merge');
-		assert.deepEqual(
-			Object.keys(applied).sort(),
-			[
-				'cursorSmoothCaretAnimation',
-				'cursorSurroundingLines',
-				'cursorSurroundingLinesStyle',
-				'fontFamily',
-				'fontSize',
-				'lineDecorationsWidth',
-				'lineNumbers',
-				'minimap',
-				'occurrencesHighlight',
-				'renderLineHighlight',
-				'renderWhitespace',
-				'selectionHighlight',
-				'smoothScrolling',
-				'stickyScroll',
-				'wordWrap',
-				'wordWrapColumn',
-				'wrappingStrategy',
-			],
-			'and the set is exactly the options both call sites share',
-		);
-	});
-
-	test('the editor has its final layout before anything is placed in it', () => {
-		// #799: the view state, the anchor line and Ctrl+E's pending sync are all
-		// placed in `onMount`, before the update effect first runs. The editor was
-		// created at zoom 100 and with 'simple' wrapping, and the effect then
-		// changed the font size or the wrapping under a placed scroll offset.
-		// Monaco keeps the pixels, not the line, so every Ctrl+E landed further
-		// down (zoom below 100, or a proportional font) or further up (above 100).
-		const mount = sliceBetween(editor, 'monaco.editor.create(container', 'editorReady = true;');
-		assert.match(mount, /\.\.\.editorOptionsFromSettings\(settings, zoomLevel\)/, 'created at the real zoom');
-
-		const measured = mount.indexOf('if (!fontIsMonospace) applySettingsOptions();');
-		const restored = mount.indexOf('editor.restoreViewState(');
-		assert.ok(measured !== -1, 'the wrapping for a proportional font is applied in onMount');
-		assert.ok(measured < restored, 'and before the view state is restored');
-		assert.ok(
-			editor.indexOf('editorReady = true;') < editor.indexOf('if (pendingSync) {'),
-			'the pending sync is spent after both',
-		);
-	});
-
-	test('the editor mounts on the cursor the preview placed', () => {
-		// #799: a click in the preview moves the tab's shared cursor, and opening
-		// split view or Ctrl+E mounts the editor with its own saved view state.
-		// The shared cursor goes down over it before the editor reports where it
-		// is, or the report would carry the stale position back to the preview.
-		const mount = sliceBetween(editor, 'monaco.editor.create(container', 'editorReady = true;');
-		const placed = mount.indexOf('if (sharedCursor) editor.setPosition(');
-		assert.ok(placed !== -1, 'the shared cursor is put down on mount');
-		assert.ok(placed > mount.indexOf('editor.restoreViewState('), 'after the view state is restored');
-		assert.ok(placed < mount.indexOf('oncursor?.(asBufferLine(mounted'), 'and before the editor reports its cursor');
-	});
-
-	test('a proportional font wraps on measured widths, a monospace font keeps the fast path', () => {
-		// #758: 'simple' wrapped Times New Roman and Roboto lines well short of the
-		// window edge. Both values are asserted because 'advanced' everywhere would
-		// also fix the report, and would make every large file pay for it.
-		assert.equal(editorOptionsFromSettings(SETTINGS, 100, true).wrappingStrategy, 'simple');
-		assert.equal(editorOptionsFromSettings(SETTINGS, 100, false).wrappingStrategy, 'advanced');
-
-		// The measurement only helps if the update effect passes it: its stub is
-		// false, so a call that drops the argument falls back to 'simple' here.
-		assert.equal(optionsPassedTo('editor.updateOptions', SETTINGS).wrappingStrategy, 'advanced');
-	});
-
-	test('tab cycling avoids Cmd+Tab, which macOS never delivers to the app', () => {
-		// Reference frame: VS Code binds Ctrl+Tab / Ctrl+Shift+Tab with
-		// KeyMod.WinCtrl on macOS (mac override on
-		// workbench.action.quickOpenPreviousRecentlyUsedEditorInGroup) precisely
-		// because Cmd+Tab belongs to the system application switcher.
-		assert.doesNotMatch(
-			editor,
-			/monaco\.KeyMod\.CtrlCmd \| monaco\.KeyCode\.Tab/,
-			'no unconditional CtrlCmd+Tab binding',
-		);
-		assert.doesNotMatch(
-			editor,
-			/monaco\.KeyMod\.CtrlCmd \| monaco\.KeyMod\.Shift \| monaco\.KeyCode\.Tab/,
-			'no unconditional CtrlCmd+Shift+Tab binding',
-		);
-
-		// Back-reference rather than the literal `tabCycleModifier`: what has to hold
-		// is that the binding uses the same value the platform check produced, and
-		// the local holding it is free to be renamed.
-		assert.match(
-			editor,
-			/const (\w+) = isMacPlatform\(\)\s*\?\s*monaco\.KeyMod\.WinCtrl\s*:\s*monaco\.KeyMod\.CtrlCmd[\s\S]*?keybindings: \[\1 \| monaco\.KeyCode\.Tab\]/,
-			'modifier is chosen per platform (real Ctrl on macOS, CtrlCmd elsewhere) and tab-next uses it',
-		);
-		assert.match(
-			editor,
-			/tabCycleModifier \| monaco\.KeyMod\.Shift \| monaco\.KeyCode\.Tab/,
-			'tab-prev uses the platform modifier',
-		);
 	});
 
 	test('platform detection reads settings.osType and never writes it', () => {
@@ -399,398 +45,29 @@ describe('editor option wiring', () => {
 		assert.doesNotMatch(editor, /settings\.osType\s*=[^=]/, 'Editor.svelte must not write to the settings store');
 	});
 
-	test('Ctrl+S is registered exactly once, by the command-palette action', () => {
-		assert.equal(count(editor, /monaco\.KeyCode\.KeyS/g), 1, 'a single Ctrl+S binding');
-		assert.match(
-			editor,
-			/id: "file-save",[\s\S]*?keybindings: \[monaco\.KeyMod\.CtrlCmd \| monaco\.KeyCode\.KeyS\]/,
-			'the surviving binding is the addAction, which also lists in the command palette',
-		);
-		assert.doesNotMatch(
-			editor,
-			/addCommand\(monaco\.KeyMod\.CtrlCmd \| monaco\.KeyCode\.KeyS/,
-			'the bare addCommand duplicate is gone',
-		);
-	});
-
-	test('custom copy keeps Monaco\'s whole-line copy on an empty selection', () => {
-		// Reference frame: Monaco ships `emptySelectionClipboard` (documented as
-		// "Copying without a selection copies the current line") on by default, and
-		// its viewmodel builds that text as getLineContent(line) + EOL. VS Code
-		// (editor.emptySelectionClipboard) and Sublime Text behave the same. Since
-		// custom-copy overrides the native copy action, bailing out on an empty
-		// selection deleted the behaviour outright.
-		// The rule moved out of the copy action when cut, copy and the context
-		// menu were collapsed onto one implementation (#207): all of them need it,
-		// and a cut has to remove exactly what a copy would have taken.
-		const forSelection = functionSource(editor, 'clipboardTextForSelection');
-
-		assert.doesNotMatch(
-			forSelection,
-			/if \(!selection \|\| selection\.isEmpty\(\)\) return/,
-			'an empty selection is no longer an early return',
-		);
-		assert.match(
-			forSelection,
-			/model\.getLineContent\(line\) \+ model\.getEOL\(\)/,
-			'empty selection takes the current line plus its line ending',
-		);
-		assert.match(
-			forSelection,
-			/model\.getValueInRange\(selection\)/,
-			'a real selection takes just the selection',
-		);
-
-		// One writer, so cut and copy cannot drift apart, and the whole-line rule
-		// above cannot be implemented twice with two different answers. The third
-		// call is Vim's `"+` register (#775): it writes the text monaco-vim already
-		// chose, so it never derives text from a selection and cannot disagree.
+	test('cut, copy and the Vim clipboard register are the only clipboard writers', () => {
+		// The whole-line rule itself is editor.test.ts "custom copy keeps Monaco's
+		// whole-line copy on an empty selection". This keeps it single: one writer
+		// each, so cut and copy cannot drift apart, and the rule cannot be
+		// implemented twice with two different answers. Vim's `"+` register (#775)
+		// writes the text monaco-vim already chose, so it never derives text from a
+		// selection and cannot disagree.
+		// The handlers live in utils/editorClipboard.ts since the paste/drop/cut move.
+		const clipboard = readSource('src/lib/utils/editorClipboard.ts');
 		assert.equal(
-			count(editor, /invoke\('clipboard_write_text'/g),
-			3,
-			'clipboard_write_text is called from copyToClipboard, cutToClipboard and the Vim clipboard register, nowhere else',
+			count(editor + clipboard, /invoke\('clipboard_write_text'/g),
+			2,
+			'clipboard_write_text is called from copyToClipboard and cutToClipboard, nowhere else in the editor',
 		);
 		assert.match(
-			editor,
+			readSource('src/lib/utils/vimAttach.ts'),
 			/installVimClipboardRegisters\(VimMode, \(text\) => \{\s*invoke\('clipboard_write_text', \{ text \}\)/,
-			'the third call is the Vim register writer',
-		);
-		assert.match(functionSource(editor, 'copyToClipboard'), /clipboardTextForSelection\(\)/);
-		assert.match(functionSource(editor, 'cutToClipboard'), /clipboardTextForSelection\(\)/);
-	});
-
-	test('Show Whitespace renders every whitespace run, not just trailing', () => {
-		// The setting is labelled without qualification ("Show Whitespace" /
-		// "显示空白字符"), so "trailing" left interior spaces unmarked.
-		assert.doesNotMatch(editor, /renderWhitespace: settings\.showWhitespace \? "trailing"/);
-		assert.doesNotMatch(editor, /"trailing"/, 'no trailing-only whitespace rendering remains');
-		assert.equal(editorOptionsFromSettings({ ...SETTINGS, showWhitespace: true }, 100).renderWhitespace, 'all');
-		assert.equal(editorOptionsFromSettings({ ...SETTINGS, showWhitespace: false }, 100).renderWhitespace, 'none');
-		// Both call sites read the same function now, so agreeing is structural
-		// rather than something a count has to police.
-		assert.equal(
-			(createdEditorOptions({ showWhitespace: true }) as { renderWhitespace?: string }).renderWhitespace,
-			'all',
+			'the third writer is the Vim register',
 		);
+		assert.match(functionSource(clipboard, 'copyToClipboard'), /clipboardTextForSelection\(editor, monaco\)/);
+		assert.match(functionSource(clipboard, 'cutToClipboard'), /clipboardTextForSelection\(editor, monaco\)/);
 	});
 
-	// ----------------------------------------------------------------- executed
-	//
-	// Everything above matches Editor.svelte as text, because a keybinding and a
-	// settings-driven enum cannot be exercised without a DOM. `unicodeHighlight`
-	// can do better, and the weak form would be particularly bad here: asserting
-	// that the string "ambiguousCharacters" occurs in the file says nothing about
-	// which characters Monaco ends up outlining, which is the entire contract.
-	//
-	// So the option literal is lifted out of the real `monaco.editor.create` call,
-	// evaluated, and pushed through the same two pieces of Monaco the running
-	// editor uses — `EditorOptions.unicodeHighlight.applyUpdate` to merge it over
-	// the shipped defaults, and `UnicodeTextModelHighlighter` to decide what gets a
-	// box. A regression has to survive Monaco's own code to reach the assertions.
-
-	/**
-	 * The one option literal Editor.svelte passes to `callee`, evaluated against a
-	 * given settings store.
-	 *
-	 * `settings` is a plain object rather than a fixture of the real store: an
-	 * absent key reads as `undefined`, which is what a falsy setting does to every
-	 * ternary in these literals anyway, so naming only the keys a test cares about
-	 * keeps that test readable. It is a parameter at all because a settings-driven
-	 * option cannot be judged from one evaluation — wiring that is right for one
-	 * value of a setting and wrong for the other is the defect shape this whole
-	 * file exists for.
-	 */
-	function optionsPassedTo(callee: string, settings: Record<string, unknown> = {}): Record<string, unknown> {
-		const script = sliceBetween(editor, '<script lang="ts">', '</script>');
-		const source = ts.createSourceFile('Editor.ts', script, ts.ScriptTarget.Latest, true);
-
-		const literals: ts.Expression[] = [];
-		const visit = (node: ts.Node): void => {
-			if (ts.isCallExpression(node) && node.expression.getText(source) === callee) {
-				assert.equal(
-					node.arguments.length,
-					callee === 'monaco.editor.create' ? 2 : 1,
-					`${callee} takes the options object last`,
-				);
-				literals.push(node.arguments[node.arguments.length - 1]);
-			}
-			ts.forEachChild(node, visit);
-		};
-		visit(source);
-
-		// Also the check that this file is looking at the only editor in the app: a
-		// second `create` call would need the same options and would not be covered
-		// by anything below. The same holds for a second `updateOptions`, which is
-		// the effect race #369 removed.
-		assert.equal(literals.length, 1, `exactly one ${callee} call site in Editor.svelte`);
-
-		// Bound to a name, not returned as an expression: TypeScript 6 prefixes the
-		// output with "use strict", and `return ${js}` would return that string.
-		const js = ts.transpileModule(`const options = (${literals[0].getText(source)});`, {
-			compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-		}).outputText;
-
-		// The literals close over eight locals and one import, stubbed rather than
-		// reconstructed — except the import, which is the real function: the
-		// settings-derived options live there now, and stubbing them would leave
-		// the evaluated object missing exactly what these tests read.
-		// `documentOptions` is the spread that hands the editor the active tab's
-		// model (or `value`/`language` when there is no tab); an empty object is the
-		// right stub because nothing it can contain is an option this file asserts
-		// on. `zoomLevel` is 100, the neutral factor, for the same reason.
-		// `fontIsMonospace` is false, the opposite of the parameter's default, so a
-		// literal that forgets to pass it is visible. `readOnly` is false, the
-		// editor on a whole buffer.
-		return new Function(
-			'settings',
-			'value',
-			'language',
-			'getTheme',
-			'documentOptions',
-			'zoomLevel',
-			'fontIsMonospace',
-			'editorOptionsFromSettings',
-			'readOnly',
-			`${js}\nreturn options;`,
-		)(settings, '', 'markdown', () => 'app-theme-dark', {}, 100, false, editorOptionsFromSettings, false) as Record<
-			string,
-			unknown
-		>;
-	}
-
-	/** The options object Editor.svelte hands to `monaco.editor.create`, evaluated. */
-	function createdEditorOptions(settings: Record<string, unknown> = {}): Record<string, unknown> {
-		return optionsPassedTo('monaco.editor.create', { ...SETTINGS, ...settings });
-	}
-
-	/**
-	 * Monaco's shipped defaults with the component's option merged over them.
-	 *
-	 * `?? {}` models the real absence case rather than guarding: a component that
-	 * passes no `unicodeHighlight` gets Monaco's defaults, which is the state this
-	 * whole section exists to move away from. Without it, deleting the option from
-	 * Editor.svelte fails the tests below with a TypeError raised inside Monaco
-	 * instead of the assertion naming the characters that came back.
-	 */
-	function effectiveUnicodeHighlight(passed: unknown): UnicodeHighlightOptions {
-		const option = EditorOptions.unicodeHighlight;
-		return option.applyUpdate(option.defaultValue, passed ?? {}).newValue;
-	}
-
-	/**
-	 * What Monaco would outline in `lines`, given an effective option set.
-	 *
-	 * Mirrors `resolveOptions()` in unicodeHighlighter.ts, which is not exported.
-	 * `trusted` is true because that is what standalone Monaco reports —
-	 * `StandaloneWorkspaceTrustManagementService.isWorkspaceTrusted()` returns true
-	 * unconditionally. That is why `nonBasicASCII`, whose default is the
-	 * `inUntrustedWorkspace` sentinel, is already off and needs no setting in
-	 * Editor.svelte: it resolves through `!trusted`.
-	 */
-	function outlined(lines: string[], effective: UnicodeHighlightOptions): UnicodeHighlightResult {
-		const trusted = true;
-		const through = (value: boolean | 'inUntrustedWorkspace') =>
-			value === inUntrustedWorkspace ? !trusted : value;
-		return UnicodeTextModelHighlighter.computeUnicodeHighlights(
-			{ getLineCount: () => lines.length, getLineContent: (n: number) => lines[n - 1] },
-			{
-				nonBasicASCII: through(effective.nonBasicASCII),
-				ambiguousCharacters: effective.ambiguousCharacters,
-				invisibleCharacters: effective.invisibleCharacters,
-				includeComments: through(effective.includeComments),
-				includeStrings: through(effective.includeStrings),
-				allowedCodePoints: Object.keys(effective.allowedCharacters).map((c) => c.codePointAt(0)),
-				// The real value is derived from the OS locale and Monaco's UI
-				// language. It is pinned here because it makes no difference: the
-				// fullwidth forms are confusable in every locale Monaco ships, zh-CN
-				// and ja-JP included, which is why the reporters saw boxes on
-				// CJK systems in the first place.
-				allowedLocales: ['en'],
-			},
-		);
-	}
-
-	// Prose a CJK author actually types. The boxes need a basic-ASCII character in
-	// the same word as the fullwidth punctuation — `shouldHighlightNonBasicASCII`
-	// suppresses the highlight when the surrounding word is entirely non-ASCII —
-	// so a Latin technical term or a Markdown emphasis marker is what triggers it.
-	const CJK_PROSE = [
-		'使用 Monaco，然后保存。',
-		'安装依赖（npm ci），再运行测试。',
-		'这是 Markdown，不是 HTML。',
-		'打开 Settings：Editor，字体大小。',
-		'**粗体**，*斜体*，`代码`。',
-		'标题（English Title）说明',
-		'你好，世界。（测试）！？',
-	];
-
-	test('the editor narrows the Unicode highlighter without switching it off', () => {
-		// Reports #186 and #94 are both Monaco outlining fullwidth punctuation.
-		// Narrowness is the assertion: `unicodeHighlight: false`, or turning
-		// `invisibleCharacters` off, would also make the boxes go away and would
-		// take the NBSP warning with it. Two overrides are allowed, and only two:
-		// the confusable rule off, and one character exempted from the invisible
-		// rule (#393 — U+3000 is the space bar under a CJK IME).
-		const options = createdEditorOptions();
-		assert.deepEqual(
-			Object.keys(options.unicodeHighlight as object).sort(),
-			['allowedCharacters', 'ambiguousCharacters'],
-			'no third sub-option, and invisibleCharacters is not among them',
-		);
-		assert.equal((options.unicodeHighlight as UnicodeHighlightOptions).ambiguousCharacters, false);
-		assert.deepEqual(
-			(options.unicodeHighlight as { allowedCharacters: Record<string, true> }).allowedCharacters,
-			{ '　': true },
-			'exactly one character is exempted',
-		);
-	});
-
-	test('no box is drawn on fullwidth CJK punctuation', () => {
-		const effective = effectiveUnicodeHighlight(createdEditorOptions().unicodeHighlight);
-		const found = outlined(CJK_PROSE, effective);
-		assert.equal(
-			found.ranges.length,
-			0,
-			`nothing outlined in CJK prose, got ${JSON.stringify(
-				found.ranges.map((r) => CJK_PROSE[r.startLineNumber - 1].slice(r.startColumn - 1, r.endColumn - 1)),
-			)}`,
-		);
-		assert.equal(found.ambiguousCharacterCount, 0);
-	});
-
-	test('the invisible-character warning survives the fix', () => {
-		// A stray NBSP or zero-width space is a real hazard in Markdown — an NBSP
-		// after `-` stops a list from parsing — and unlike the punctuation it is
-		// never something the author typed on purpose. Turning the whole feature
-		// off would have taken it with it.
-		const effective = effectiveUnicodeHighlight(createdEditorOptions().unicodeHighlight);
-		assert.equal(effective.invisibleCharacters, true, 'left at the Monaco default');
-
-		const found = outlined(['a b', 'x​z'], effective);
-		assert.equal(found.invisibleCharacterCount, 2, 'NBSP and zero-width space are still flagged');
-	});
-
-	// U+3000 IDEOGRAPHIC SPACE is what a CJK IME puts on the page when the author
-	// presses the space bar, and it is in Monaco's invisible set — so #462 took the
-	// boxes off the punctuation and left them on the space. `allowedLocales` cannot
-	// help: `strings.js` getData() flattens every locale bucket into one 465-entry
-	// set, so U+3000 is in it unconditionally. Only `allowedCharacters` reaches it.
-	//
-	// Note the fixtures above are Latin. Measured while fixing #393, a zero-width
-	// space inside CJK text is not flagged at all — shouldHighlightNonBasicASCII()
-	// suppresses it when the surrounding word holds no basic ASCII. So the hazard
-	// this option guards is real, but not everywhere the comment above implies.
-	const CJK_IDEOGRAPHIC_SPACE = [
-		'\u4eca\u5929\u3000\u5929\u6c14\u5f88\u597d\u3002',
-		'\u3000\u6bb5\u843d\u9996\u884c\u7f29\u8fdb\u4e24\u683c\u3002',
-		'\u5b89\u88c5\u4f9d\u8d56\u3000\u7136\u540e\u8fd0\u884c\u6d4b\u8bd5\u3002',
-	];
-
-	test('the space bar under a CJK IME is not outlined', () => {
-		const effective = effectiveUnicodeHighlight(createdEditorOptions().unicodeHighlight);
-		const found = outlined(CJK_IDEOGRAPHIC_SPACE, effective);
-		assert.equal(
-			found.ranges.length,
-			0,
-			`nothing outlined around U+3000, got ${JSON.stringify(
-				found.ranges.map((r) => CJK_IDEOGRAPHIC_SPACE[r.startLineNumber - 1]),
-			)}`,
-		);
-	});
-
-	test('exempting U+3000 does not exempt the NBSP that breaks a list', () => {
-		// The narrow exemption has to stay narrow: an NBSP after `-` stops the list
-		// from parsing, and that is why invisibleCharacters is still on.
-		const effective = effectiveUnicodeHighlight(createdEditorOptions().unicodeHighlight);
-		const found = outlined(['-\u00a0item', '\u4eca\u5929\u3000\u5929\u6c14'], effective);
-		assert.equal(found.invisibleCharacterCount, 1, 'the NBSP is flagged, the U+3000 is not');
-		assert.equal(found.ranges[0].startLineNumber, 1, 'and it is the NBSP line');
-	});
-
-	// ------------------------------------------------- the defaults left in force
-	//
-	// Everything above is an option Editor.svelte was passing wrongly. The two
-	// below are options it was not passing at all, so `monaco.editor.create`'s
-	// default was deciding — and deciding against something the app states
-	// elsewhere.
-	//
-	// Both are read through the option's own `validate`, the function the real
-	// `create` runs over what it is handed. That is not ceremony: `validate`
-	// silently returns the option's *default* for anything outside its accepted
-	// set, so `"Off"`, `0`, or an enum member renamed in a Monaco upgrade would
-	// leave the editor exactly as it is today while an `assert.equal` on the
-	// literal stayed green.
-
-	/**
-	 * What both occurrence-highlighting options resolve to, for one value of the
-	 * one setting that is supposed to drive them.
-	 */
-	function occurrenceHighlighting(
-		callee: string,
-		occurrencesHighlight: boolean,
-	): { occurrencesHighlight: string; selectionHighlight: boolean } {
-		// The full fixture, not the one setting under test: `editorOptionsFromSettings`
-		// reads the chosen font family now, and a stub missing it is a `string` field
-		// that is `undefined` — a shape the type forbids and production cannot hand it.
-		const options = optionsPassedTo(callee, { ...SETTINGS, occurrencesHighlight });
-		return {
-			occurrencesHighlight: EditorOptions.occurrencesHighlight.validate(options.occurrencesHighlight),
-			selectionHighlight: EditorOptions.selectionHighlight.validate(options.selectionHighlight),
-		};
-	}
-
-	test('"Highlight Occurrences" off leaves nothing highlighting occurrences', () => {
-		// The setting (`settings.occurrencesHighlight`, default false, labelled
-		// "Highlight Occurrences" / 高亮匹配项 / 一致箇所の強調) drove Monaco's
-		// `occurrencesHighlight` alone. Monaco splits the feature in two:
-		// `SelectionHighlighter` gates itself on `selectionHighlight` and consults
-		// `occurrencesHighlight` only to choose which decoration style to draw with.
-		// So at the setting's own default, selecting a word still highlighted every
-		// other copy of it — the promise the label makes was kept by half the
-		// editor.
-		//
-		// Both call sites, because they can disagree: two effects writing one option
-		// with different values is what #369 found in `fontSize`, and an option set
-		// only at construction stops tracking the setting the moment a user toggles
-		// it.
-		for (const callee of ['monaco.editor.create', 'editor.updateOptions']) {
-			assert.deepEqual(
-				occurrenceHighlighting(callee, false),
-				{ occurrencesHighlight: 'off', selectionHighlight: false },
-				`${callee}: with the setting off both occurrence highlighters must be off — ` +
-					'selectionHighlight is the one SelectionHighlighter actually gates on',
-			);
-			assert.deepEqual(
-				occurrenceHighlighting(callee, true),
-				{ occurrencesHighlight: 'singleFile', selectionHighlight: true },
-				`${callee}: with the setting on the same one switch must turn both on`,
-			);
-		}
-	});
-
-	test('the editor does not offer to rewrite a document containing U+2028', () => {
-		// `unusualLineTerminators` defaults to 'prompt'. On 'prompt',
-		// UnusualLineTerminatorsDetector calls IDialogService.confirm, which in a
-		// standalone build is StandaloneDialogService — `mainWindow.confirm(...)`,
-		// an unstyled browser dialog carrying Monaco's English string, inside an app
-		// whose own UI ships 26 locales, offering to delete characters out of the
-		// user's file. The guard exists to protect JavaScript string literals, which
-		// U+2028 and U+2029 terminate; Markdown has no such hazard.
-		//
-		// 'auto' is not the alternative: it makes the same edit with no dialog.
-		assert.equal(
-			EditorOptions.unusualLineTerminators.validate(createdEditorOptions().unusualLineTerminators),
-			'off',
-			'the detector must return early instead of reaching the dialog',
-		);
-
-		// The default this moves away from, and the reason the assertion above is
-		// not spelled against the literal: anything Monaco does not recognise
-		// resolves straight back to the dialog.
-		assert.equal(EditorOptions.unusualLineTerminators.validate(undefined), 'prompt');
-		assert.equal(EditorOptions.unusualLineTerminators.validate('never'), 'prompt');
-		assert.equal(EditorOptions.unusualLineTerminators.validate('Off'), 'prompt');
-	});
 });
 
 // The editor's Markdown colours. Two things can make a rule here do nothing at
@@ -798,16 +75,8 @@ describe('editor option wiring', () => {
 // (#676's defect, one layer over), and a colour that has drifted from the one
 // the rest of the app resolves through `--color-*`.
 describe('editor theme contracts', () => {
-	const grammar = readSource('node_modules/monaco-editor/esm/vs/basic-languages/markdown/markdown.js');
-
 	const styles = readSource('src/styles.css');
 
-	/** Every token name this Monaco build's Markdown tokenizer can emit. */
-	const emittedTokens = (() => {
-		const tokenizer = grammar.slice(grammar.indexOf('tokenizer:'));
-		return new Set([...tokenizer.matchAll(/"([a-z][\w.]*)"/g)].map((match) => match[1]));
-	})();
-
 	/** A `--color-*` value, read out of the block that defines the given appearance. */
 	function paletteColor(appearance: 'light' | 'dark', name: string): string {
 		const block = appearance === 'dark'
@@ -818,23 +87,6 @@ describe('editor theme contracts', () => {
 		return match[1].slice(1).toLowerCase();
 	}
 
-	test('both themes get rules, and every rule is a real token', () => {
-		for (const appearance of ['light', 'dark'] as const) {
-			const rules = markdownTokenRules(appearance);
-			assert.ok(rules.length > 0, `${appearance} must not fall back to Monaco's source-code colours`);
-
-			for (const rule of rules) {
-				// The grammar spells its tokens without the postfix it later appends.
-				const bare = rule.token.slice(0, -'.md'.length);
-				const emitted = emittedTokens.has(bare);
-				assert.ok(emitted, `no Markdown token is called \`${rule.token}\` — the rule would be inert`);
-				// Monaco's own parser reads these as `#rrggbb` once it prepends the
-				// hash; a `#` here, or a short form, resolves to no colour.
-				assert.match(rule.foreground, /^[0-9a-f]{6}$/, `${rule.token} must be a bare six-digit hex`);
-			}
-		}
-	});
-
 	test('the colours are the app palette, not a second one', () => {
 		// One-way duplication: `defineTheme` takes hex strings and never sees the
 		// stylesheet, so the literals in editorTheme.ts have to be checked against
@@ -867,6 +119,8 @@ describe('editor theme contracts', () => {
 			// The widget's owner: it defines `app-theme-*` and it is the only thing
 			// on screen a Monaco theme can be seen on.
 			'src/lib/components/Editor.svelte',
+			// The same pane's mount, which follows the system colour scheme.
+			'src/lib/utils/mountEditor.ts',
 			// `vscode-custom` does not exist as a theme until this file has read the
 			// JSON and called `defineTheme`, so the set has to happen where the
 			// define does — `Editor.svelte`'s change effect abstains for `vscode:`.
@@ -874,21 +128,6 @@ describe('editor theme contracts', () => {
 		]);
 	});
 
-	test('every name the seam returns is a theme somebody defines', () => {
-		const defined = [
-			readSource('src/lib/components/Editor.svelte'),
-			readSource('src/lib/utils/theme.ts'),
-		]
-			.flatMap((text) => [...text.matchAll(/\.editor\.defineTheme\(\s*["']([\w-]+)["']/g)])
-			.map((match) => match[1]);
-		const asked = ['system', 'light', 'dark', 'vscode:whatever'].map((theme) => [
-			monacoThemeName(theme, false),
-			monacoThemeName(theme, true),
-		]);
-		for (const name of new Set(asked.flat())) {
-			assert.ok(defined.includes(name), `nothing defines ${name}; Monaco would fall back to vs`);
-		}
-	});
 });
 
 /*
@@ -907,27 +146,22 @@ describe('editor theme contracts', () => {
 describe('editor undo stops', () => {
 	const EDITOR = 'src/lib/components/Editor.svelte';
 
-	test('the format tools each push an undo stop before they edit', () => {
-		for (const name of ['insertTextAtCursor', 'wrapAsCodeBlock', 'insertLink']) {
-			const run = runEditorHandler([name], { lines: ['hello'], selections: [[1, 1, 1, 6]] });
-			assert.equal(run.edits.length, 1, name);
-			assert.equal(run.undoStops, 1, `${name} edits inside the undo step typing left open`);
-		}
-	});
-
 	test('no executeEdits in the editor runs without an undo stop ahead of it in its function', () => {
 		// Paste, cut and the drop handler read the clipboard or the disk through
 		// Tauri first, so they cannot be run here; what is pinned for them, and for
 		// every site added later, is that the stop comes before the edit.
-		const source = readSource(EDITOR);
 		const missing: string[] = [];
-		let at = -1;
-		while ((at = source.indexOf('editor.executeEdits(', at + 1)) !== -1) {
-			const name = enclosingFunctionName(source, at);
-			assert.ok(name, `an executeEdits outside any named function at offset ${at}`);
-			const start = source.lastIndexOf(name, at);
-			if (!source.slice(start, at).includes('editor.pushUndoStop()')) {
-				missing.push(`${name} (line ${source.slice(0, at).split('\n').length})`);
+		// Paste, cut and drop moved to utils/editorClipboard.ts and keep the rule there.
+		for (const file of [EDITOR, 'src/lib/utils/editorClipboard.ts']) {
+			const source = readSource(file);
+			let at = -1;
+			while ((at = source.indexOf('editor.executeEdits(', at + 1)) !== -1) {
+				const name = enclosingFunctionName(source, at);
+				assert.ok(name, `an executeEdits outside any named function at offset ${at}`);
+				const start = source.lastIndexOf(name, at);
+				if (!source.slice(start, at).includes('editor.pushUndoStop()')) {
+					missing.push(`${file}: ${name} (line ${source.slice(0, at).split('\n').length})`);
+				}
 			}
 		}
 		assert.deepEqual(missing, []);
@@ -1162,7 +396,8 @@ describe('Monaco startup graph', () => {
 		// returned function as the unmount cleanup, so an `async` callback would
 		// hand it a promise and leak the editor and its listeners.
 		assert.doesNotMatch(editor, /onMount\(async/, 'onMount is not async');
-		assert.match(editor, /cancelled = true;/, 'an in-flight import is cancellable on unmount');
+		// Cancellation on unmount: editor.test.ts "unmounting while Monaco is still
+		// loading creates no editor".
 	});
 
 	test('every effect that drives the editor waits for editorReady', () => {
@@ -1273,110 +508,6 @@ describe('Monaco startup graph', () => {
 	});
 });
 
-/*
- * Vim's scroll-cursor family — `zz`, `zt`, `zb`, `z.`, `z-`, `z<CR>` — does
- * nothing in monaco-vim 0.4.4 (#104, #393), and `zb`/`z-` are additionally
- * swapped with respect to `:help scroll-cursor`. `utils/vimScrollCommands.ts`
- * repairs both through the package's own `Vim.defineAction`/`Vim.mapCommand`.
- *
- * WHAT RUNS HERE. The keys are *pressed*. Every test below drives real
- * keystrokes into `Vim.handleKey` on a real `CMAdapter` built from the real
- * `monaco-vim` package — the same `dist/index.mjs` Vite hands the app — and
- * then asks the editor which reveal it was told to perform. Nothing in this
- * file asserts that a source file contains a string; the closest it comes is
- * lifting Editor.svelte's own `import("monaco-vim").then` callback out of the
- * component and *running* it.
- *
- * Only `monaco-editor` is faked, and only because it cannot be imported under
- * Node: it is 4 MB of code that reaches for `document` at module scope.
- * monaco-vim imports it as two ordinary externals (`Range`, `Selection`,
- * `KeyCode`, …) rather than bundling it, so a module hook can answer those two
- * specifiers with the handful of value classes the adapter actually constructs.
- * Everything downstream of that — the keymap, the command dispatcher, the
- * action registry, `CMAdapter` itself — is upstream's own shipped code.
- *
- * WHAT IT DOES NOT ESTABLISH: that Monaco's `revealRangeInCenter` puts the line
- * where a human would call the centre, that focus and key routing reach Vim
- * mode in the running app, or anything about rendering. It establishes which
- * reveal each key sequence asks the editor for, and where the cursor ends up.
- */
-describe('vim scroll commands install', () => {
-	test('Editor.svelte installs the commands on the module it just imported', async () => {
-		// The component's own callback, lifted and run — not read. It has to install
-		// before `initVimMode` attaches the adapter, and it has to install even on
-		// the disposed path, because the tables it writes to are the package's and
-		// outlive this editor.
-		const source = readSource('src/lib/components/Editor.svelte');
-		const bodies = callbackBodies(source, 'import("monaco-vim").then');
-		assert.equal(bodies.length, 1, `expected exactly one monaco-vim import callback, found ${bodies.length}`);
-
-		const run = new Function(
-			'installVimScrollCommands',
-			'installVimClipboardRegisters',
-			'invoke',
-			'initVimMode',
-			'VimMode',
-			'currentEditor',
-			'currentStatusNode',
-			'disposed',
-			`let vim = null; ${bodies[0]} return vim;`,
-		) as (...args: unknown[]) => unknown;
-
-		const calls: string[] = [];
-		const VimMode = { marker: 'the module export' };
-		const install = (mode: unknown) => {
-			assert.equal(mode, VimMode, 'the VimMode from the same import must be the one patched');
-			calls.push('install');
-			return true;
-		};
-		const initVimMode = () => {
-			calls.push('initVimMode');
-			return { dispose() {} };
-		};
-
-		const written: unknown[] = [];
-		const installClipboard = (mode: unknown, write: (text: string) => void) => {
-			assert.equal(mode, VimMode, 'the clipboard registers go on the same module');
-			calls.push('clipboard');
-			write('yanked');
-			return true;
-		};
-		const invoke = (command: string, args: unknown) => {
-			written.push([command, args]);
-			return Promise.resolve();
-		};
-
-		const vim = run(install, installClipboard, invoke, initVimMode, VimMode, {}, {}, false);
-		assert.deepEqual(calls, ['install', 'clipboard', 'initVimMode'], 'the commands must be in place before the adapter attaches');
-		assert.ok(vim, 'the adapter is still handed back for disposal');
-		assert.deepEqual(written, [['clipboard_write_text', { text: 'yanked' }]], '"+ writes through the Rust clipboard');
-
-		calls.length = 0;
-		assert.ok(!run(install, installClipboard, invoke, initVimMode, VimMode, {}, {}, true), 'a disposed effect attaches nothing');
-		assert.deepEqual(calls, ['install', 'clipboard'], 'a disposed effect still patches the package');
-	});
-});
-
-describe('status bar height', () => {
-	// The status bar sits directly above the editor, and Monaco cancels an
-	// in-progress drag-selection whenever the editor's height changes
-	// (`MouseHandler.onConfigurationChanged` -> `stopMonitoring`). So anything that
-	// lets this bar's height follow its content ends a drag the user is still
-	// making: in a narrow window the items wrapped their text the moment a
-	// selection added the "N selected" item, and the selection froze two lines in
-	// (#762). A rule about a height nothing computes is not a type; this is the
-	// only thing that fails when someone drops `nowrap` again.
-	const statusBar = sliceBetween(readSource('src/lib/components/Editor.svelte'), '\t.status-bar {', '\t}');
-
-	test('the status bar keeps its items on one line', () => {
-		assert.match(statusBar, /white-space:\s*nowrap;/);
-	});
-
-	test('the status bar clips what does not fit rather than growing', () => {
-		assert.match(statusBar, /overflow:\s*hidden;/);
-	});
-});
-
 // The layer that colours from the renderer's answer instead of the grammar's
 // guess. Three seams, each invisible to the compiler: the kinds Rust emits
 // against the legend the encoder indexes, the legend against the theme rules
@@ -1398,14 +529,6 @@ describe('semantic token contracts', () => {
 		}
 	});
 
-	test('the editor turns the layer on, because the default is off', () => {
-		// `StandaloneTheme.semanticHighlighting` is hard-coded false, so
-		// `'configuredByTheme'` cannot reach it and the provider is never asked.
-		const editor = readSource('src/lib/components/Editor.svelte');
-		assert.match(editor, /'semanticHighlighting\.enabled': true/);
-		assert.match(editor, /registerDocumentSemanticTokensProvider\(/);
-	});
-
 	test('no kind falls through to an imported theme that has nothing to say', () => {
 		// The failure this guards is silent and total. A semantic token whose type
 		// the theme does not name resolves to the theme's *root* rule, whose
@@ -1485,7 +608,8 @@ describe('image embed wiring', () => {
 		// escape had to be fixed in both. release.checks.test.ts
 		// keeps the embed string itself single; this keeps the pre-fix escape from
 		// coming back next to it.
-		const source = readSource('src/lib/components/Editor.svelte');
+		// Paste and drop live in utils/editorClipboard.ts; the completion stays in the component.
+		const source = readSource('src/lib/components/Editor.svelte') + readSource('src/lib/utils/editorClipboard.ts');
 		assert.equal(source.includes('%20'), false, 'a hand-rolled space escape is back');
 		assert.match(source, /imageEmbed\(relPath\)/);
 		assert.equal(source.includes(`|| "${DEFAULT_IMAGE_DIRECTORY}"`), false);
@@ -1501,48 +625,6 @@ describe('image embed wiring', () => {
 	});
 });
 
-// WHAT THIS FILE COVERS, AND WHAT IT DOES NOT
-//
-// Covered for real: every classification below runs Monaco's *actual* markdown
-// Monarch grammar — the same `language` definition monaco-editor ships and the
-// same `MonarchTokenizer` that `monaco.editor.tokenize()` drives — over real
-// markdown, and asserts on the decision `pasteContext.ts` reaches. So the token
-// types, the fence state machine, and the caret lookup are genuinely exercised,
-// not mocked.
-//
-// Not covered: that Editor.svelte calls this code on the Ctrl+V path with the
-// right arguments. Editor.svelte is a Svelte component and cannot be imported
-// here, so that wiring is pinned by a source-text assertion at the bottom of
-// the file, which proves only that the code reads a certain way.
-//
-// Also not covered: Monaco's async tokenizer bootstrap. In the app,
-// `monaco.editor.tokenize()` falls back to null tokens if the language has not
-// finished loading; that degrades to "no code token found", i.e. to the old
-// linkify-everything behaviour, and is not reproduced here.
-describe('paste URL guard wiring', () => {
-	test('the paste path consults the context guard before building a link', () => {
-		// Source-text only: this proves Editor.svelte reads this way, not that it
-		// behaves this way at runtime.
-		const editor = readSource('src/lib/components/Editor.svelte');
-
-		assert.match(
-			editor,
-			/if \(!isUrl \|\| isMultiLine \|\| !isLinkifyPasteTarget\(model, selections\[0\]\)\) \{/,
-			'the raw-text paste branch is taken when the caret is not in prose',
-		);
-		assert.match(
-			editor,
-			/tokenize: \(text\) => monaco\.editor\.tokenize\(text, MARKDOWN_LANGUAGE_ID\)/,
-			'classification runs Monaco\'s own tokenizer, not a hand-rolled scan',
-		);
-		assert.match(
-			editor,
-			/linesUpToCaret: model\.getLinesContent\(\)\.slice\(0, selection\.startLineNumber\)/,
-			'only the lines above the caret are tokenized',
-		);
-	});
-});
-
 describe('X11 clipboard ownership', () => {
 	// #729: on Debian XFCE, everything copied out of Markpad reached an empty
 	// clipboard, while pasting into it worked. X11 has no clipboard store — the
@@ -1562,78 +644,11 @@ describe('X11 clipboard ownership', () => {
 		);
 		assert.match(body, /retain_clipboard_ownership\(\)/);
 	});
-
-	test('the retained handle is never dropped', () => {
-		// `retain_clipboard_ownership` holding a `Clipboard` in a local would be a
-		// no-op: the point is that the handle outlives the call, so the invisible
-		// window arboard serves selection requests from is never destroyed.
-		const helper = sliceBetween(
-			readSource('src-tauri/src/commands.rs'),
-			'fn retain_clipboard_ownership',
-			'\n}',
-		);
-		assert.match(helper, /std::mem::forget\(/);
-	});
 });
 
 describe('editor context menu (#261)', () => {
 	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 
-	test('a right-click in the editor gets the editor menu, before any other rule claims it', () => {
-		// #261/#266 was the document menu swallowing this event: it called
-		// `preventDefault()` before checking where the click was, and its
-		// full-viewport overlay then covered Monaco's menu, so Paste hit the
-		// overlay. The fix then was to hand the event to Monaco.
-		//
-		// Markpad draws this menu itself now (#207), because Monaco's Paste reads
-		// the clipboard through the webview and cannot work here. So the invariant
-		// is no longer "Monaco gets the event first" — it is that the editor's own
-		// branch runs before every other rule in the handler.
-		//
-		// The ordering matters for a reason that is easy to miss: Monaco takes
-		// input through a hidden `<textarea>`, so the carve-out that leaves real
-		// text fields their native menu would claim every right-click in the
-		// editor if it came first.
-		const handler = sliceBetween(viewer, 'function handleContextMenu(e: MouseEvent)', '\n\tfunction handleMouseOver');
-		const editorBranch = offsetOf(handler, "closest('.editor-container')");
-		const textFieldCarveOut = offsetOf(handler, "closest('input, textarea,");
-		const documentMenu = offsetOf(handler, 'e.preventDefault();');
-
-		assert.ok(editorBranch < textFieldCarveOut, "the hidden textarea must not claim the editor's right-click");
-		assert.ok(editorBranch < documentMenu, 'the editor branch runs before the document menu');
-		assert.match(handler, /showEditorContextMenu\(e\);\s*\n\s*return;/, 'and it shows a menu rather than bailing out');
-	});
-
-	test('the editor menu runs the same three functions the keyboard runs', () => {
-		// One implementation per operation is the whole point: six entry points
-		// (three keys, three menu items) and three functions. A menu item wired to
-		// its own inline implementation would drift from the shortcut silently.
-		const menu = functionSource(viewer, 'showEditorContextMenu');
-
-		for (const fn of ['cutToClipboard', 'copyToClipboard', 'pasteFromClipboard']) {
-			assert.match(menu, new RegExp(`editorPane\\?\\.${fn}\\(\\)`), `${fn} is what the menu item runs`);
-		}
-	});
-
-	test('the two Monaco entries this app can use survive drawing our own menu', () => {
-		// Drawing the menu ourselves means every item Monaco used to contribute is
-		// gone unless it is put back, and two of them work without a language
-		// provider — so they were there, and vanished, and were noticed only
-		// because someone went looking for them.
-		//
-		// The rest (Go to Symbol, Quick Fix, Refactor, Format, Rename) are gated on
-		// providers Markdown has none of and never appeared in this app.
-		const menu = functionSource(viewer, 'showEditorContextMenu');
-
-		assert.match(menu, /editor\.action\.quickCommand/, 'Command Palette');
-		assert.match(menu, /editor\.action\.changeAll/, 'Change All Occurrences');
-
-		// Through the app's own translations, which is a gain rather than parity:
-		// Monaco's menu is English whatever language the app is in.
-		assert.match(menu, /t\('menu\.commandPalette', settings\.language\)/);
-		assert.match(menu, /t\('menu\.changeAllOccurrences', settings\.language\)/);
-	});
-
 	test('every label the editor menu asks for exists in every language', () => {
 		// A missing key does not throw — `t()` falls back to English and then to
 		// the key itself, so a forgotten locale ships the string
@@ -1642,8 +657,8 @@ describe('editor context menu (#261)', () => {
 		const locales = (i18n.match(/\n\s+menu: \{/g) ?? []).length;
 		assert.ok(locales >= 6, `expected at least six locales, found ${locales}`);
 
-		const menu = functionSource(viewer, 'showEditorContextMenu');
-		for (const key of [...menu.matchAll(/t\('menu\.(\w+)', settings\.language\)/g)].map((m) => m[1])) {
+		const menu = functionSource(readSource('src/lib/utils/viewerContextMenu.ts'), 'editorContextMenuItems');
+		for (const key of [...menu.matchAll(/t\('menu\.(\w+)', language\)/g)].map((m) => m[1])) {
 			assert.equal(
 				(i18n.match(new RegExp(`\\b${key}:`, 'g')) ?? []).length >= locales,
 				true,
diff --git a/scripts/editor.checks.spec.ts b/scripts/editor.chords.spec.ts
similarity index 90%
rename from scripts/editor.checks.spec.ts
rename to scripts/editor.chords.spec.ts
index bc6cf52a..90247241 100644
--- a/scripts/editor.checks.spec.ts
+++ b/scripts/editor.chords.spec.ts
@@ -1,45 +1,9 @@
 import assert from 'node:assert/strict';
 
 import { decodeKeybinding, type KeyCodeChord } from 'monaco-editor/esm/vs/base/common/keybindings.js';
-import { KeyCode } from 'monaco-editor/esm/vs/editor/common/standalone/standaloneEnums.js';
-import { KeyMod } from 'monaco-editor/esm/vs/editor/common/services/editorBaseApi.js';
 import { describe, test, beforeAll, expect, vi } from 'vitest';
 
-import { readSource } from './sourceTree.js';
-import { type Chord, editorKeymap, label, PLATFORMS } from './keymapHarness.js';
-
-/*
- * AltGr inside the editor.
- *
- * Windows sends AltGr as Ctrl+Alt with the AltGraph modifier on, so on a
- * Polish layout AltGr+Z (ż) is also Ctrl+Alt+Z, the editor's Zen mode chord.
- * Monaco's standalone keybinding service resolves a keystroke from
- * ctrl/shift/alt/meta and the key code alone (`resolveKeyboardEvent` in
- * standaloneServices.js); it reads `altGraphKey` into its event and never
- * looks at it again. The first test shows that against the installed Monaco;
- * the rest hold Editor.svelte to the guard the second test shows works.
- *
- * What jsdom cannot say is whether WebView2 reports AltGraph for AltGr. The
- * events here set it by hand.
- */
-describe('AltGr guard in Editor.svelte', () => {
-	const EDITOR = readSource('src/lib/components/Editor.svelte');
-
-	test('Editor.svelte tracks AltGr and every Ctrl+Alt action checks it', () => {
-		assert.match(EDITOR, /editor\.createContextKey<boolean>\("altGraphChord", false\)/);
-		assert.match(EDITOR, /editor\.onKeyDown\(\(e\) => altGraphChord\.set\(isAltGraphChord\(e\.browserEvent\)\)\)/);
-
-		const ctrlAltActions = EDITOR.split('editor.addAction({')
-			.slice(1)
-			.map((chunk) => chunk.slice(0, chunk.indexOf('run:')))
-			.filter((head) => /KeyMod\.CtrlCmd \| monaco\.KeyMod\.Alt \|/.test(head));
-		// Zen mode and Insert Table today. Empty would make the loop below vacuous.
-		assert.ok(ctrlAltActions.length >= 2, `found ${ctrlAltActions.length} Ctrl+Alt actions`);
-		for (const head of ctrlAltActions) {
-			assert.match(head, /keybindingContext: "!altGraphChord"/, head.slice(0, 80));
-		}
-	});
-});
+import { bareCommands, type Chord, editorKeymap, label, PLATFORMS } from './keymapHarness.js';
 
 /*
  * WHO OWNS A CHORD: the app, or Monaco?
@@ -171,14 +135,12 @@ describe('Monaco chord ownership', () => {
 	/**
 	 * Every chord the app registers on the editor, and what registers it.
 	 *
-	 * `editorKeymap` covers the `addAction` list. The bare `addCommand` calls live
-	 * in `createEditor`, 500 lines of Monaco setup the action harness cannot run,
-	 * so their keybinding EXPRESSIONS are lifted out of the source and evaluated
-	 * against the real `KeyMod`/`KeyCode` — the numbers are Monaco's, not a
-	 * transcription. Both kinds outrank Monaco's defaults, so leaving the commands
-	 * out would have left a hole exactly where Enter and Tab are bound. A command
-	 * carries no id, so it is named after the function it runs, which is the name a
-	 * reader of the failure wants anyway.
+	 * `editorKeymap` covers the `addAction` list and `bareCommands` the nameless
+	 * `addCommand` keys, both read from `utils/editorActions.ts` with Monaco's real
+	 * `KeyMod`/`KeyCode`. Both kinds outrank Monaco's defaults, so leaving the
+	 * commands out would have left a hole exactly where Enter and Tab are bound. A
+	 * command carries no id, so it is named after the function it runs, which is
+	 * the name a reader of the failure wants anyway.
 	 */
 	function appEditorChords(mac: boolean, os: 1 | 2 | 3): Map<Chord, string[]> {
 		const chords = new Map<Chord, string[]>();
@@ -189,13 +151,7 @@ describe('Monaco chord ownership', () => {
 			for (const chord of list) claim(chord, id);
 		}
 
-		const source = readSource('src/lib/components/Editor.svelte');
-		const commands = [...source.matchAll(/\beditor\.addCommand\(\s*([^,]+),\s*(\w+)\s*[,)]/g)];
-		assert.ok(commands.length >= 2, `found ${commands.length} addCommand calls; the extraction stopped matching`);
-		for (const [, expression, fn] of commands) {
-			const binding = new Function('monaco', `return ${expression}`)({ KeyMod, KeyCode }) as number;
-			claim(chordOf(binding, os), `addCommand(${fn})`);
-		}
+		for (const command of bareCommands()) claim(chordOf(command.binding, os), `addCommand(${command.handler})`);
 
 		return chords;
 	}
diff --git a/scripts/editor.imageUndo.checks.spec.ts b/scripts/editor.imageUndo.spec.ts
similarity index 68%
rename from scripts/editor.imageUndo.checks.spec.ts
rename to scripts/editor.imageUndo.spec.ts
index 5af27984..2c5275a6 100644
--- a/scripts/editor.imageUndo.checks.spec.ts
+++ b/scripts/editor.imageUndo.spec.ts
@@ -2,10 +2,6 @@ import assert from 'node:assert/strict';
 
 import { test } from 'vitest';
 
-import ts from 'typescript';
-
-import { callbackBodies, functionSource, readSource } from './sourceTree.js';
-
 /*
  * Undoing an image insert used to delete the copied file from disk (#368).
  * `delete_file` is `fs::remove_file` — no Trash, no Recycle Bin — and the file
@@ -19,88 +15,39 @@ import { callbackBodies, functionSource, readSource } from './sourceTree.js';
  * rather than corrected. These tests hold that: an undo may move text and
  * nothing else.
  *
- * They RUN the code rather than reading it. A `.svelte` file cannot be
- * imported by the Node test runner, so — following windows.tagEditor.checks.test.ts
- * and windows.checks.spec.ts — the Ctrl+V command callback, the exported
- * `handleDroppedFile`, and EVERY `onDidChangeModelContent` listener the
- * component registers are lifted out of the parsed component and evaluated
- * over one shared scope, one fake Monaco document with a real undo stack, and
- * the real `TabManager`. Nothing below asserts how any of it is spelled.
- *
- * "Every listener" is the load-bearing part. The check is not "the file no
- * longer contains `delete_file`" — that is the assertion shape this suite has
- * been burned by twice — it is "dispatch an undo at whatever the component
- * listens with, and see what reaches the backend". A deletion re-added in any
- * listener, under any command name, is caught.
+ * They run the editor's real paste, drop and cut handlers
+ * (`utils/editorClipboard.ts`) and the real content listener
+ * (`EditorDocument.contentChanged`, the one listener Editor.svelte registers)
+ * over one fake Monaco document with a real undo stack and the real
+ * `TabManager`. The Tauri bridge is a recording double: "dispatch an undo and
+ * see what reaches the backend" catches a deletion re-added under any command
+ * name.
  *
  * Each undo test also asserts that the undo *arrived* — the buffer reverted
  * and the tab's raw content followed it. Without that, "no backend call" would
  * also be satisfied by a harness that dispatched into thin air.
  *
- * Falsified before landing, both ways round: with the original handler put
- * back, and with a bare `invoke("delete_file")` on `e.isUndoing`. All three
- * regression tests go red ("an undo after a pasted image reached the backend:
- * delete_file") and all three fences stay green.
- *
  * What this does not establish: that Monaco groups an image insert into one
  * undo step, or anything about the real clipboard. It establishes what the
- * component's own handlers do when an undo reaches them.
+ * editor's own handlers do when an undo reaches them.
  */
 
 // ---------------------------------------------------------------- environment
-// Svelte runes and the Tauri bridge, faked as homeSentinelSnapshot.ts does, so
-// `tabs.svelte.ts` imports under plain node.
-
 // The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
 // Svelte plugin, so the store and the session run under real reactivity, and jsdom
-// supplies `window` and `localStorage`. Only the Tauri backend is stubbed.
+// supplies `window` and `localStorage`. Only the Tauri backend is stubbed, and
+// a module that imports `invoke` itself reaches the same recording backend the
+// handlers are handed, so a deletion re-added anywhere on the undo path is seen.
+let backendInUse: Backend | null = null;
 (window as any).__TAURI_INTERNALS__ = {
 	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+	invoke: (cmd: string, args?: Record<string, any>) =>
+		cmd === 'get_os_type' ? Promise.resolve('macos') : backendInUse ? backendInUse.invoke(cmd, args) : Promise.resolve(null),
 };
 
 const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
-const { lineEndingLabel } = await import('../src/lib/utils/tabModels.js');
-const { countWords } = await import('../src/lib/utils/wordCount.js');
-// The real module, not a stub: the embed these tests match against is the one
-// it writes, and its escaping is pinned separately in editor.test.ts.
-const { documentParentDir, imageEmbed, resolveImageDirectory } = await import(
-	'../src/lib/utils/imageEmbed.js'
-);
-const { routeDroppedFile } = await import('../src/lib/utils/fileDrop.js');
-
-// ------------------------------------------------- the component, as written
-
-const EDITOR = 'src/lib/components/Editor.svelte';
-const source = readSource(EDITOR);
-
-/**
- * Everything a paste does — including the branch that reads a clipboard image.
- *
- * It was the body of the one `editor.addCommand` for ⌘V until the editor's
- * context menu started running it too (#207), at which point it was named. The
- * lookup is by name now, and the second assertion is what keeps that from
- * being a downgrade: no inline paste may appear beside it, because two paste
- * implementations would drift and only one of them would be tested here.
- */
-const pasteCommandBody = (() => {
-	const body = functionSource(source, 'pasteFromClipboard');
-	assert.ok(body.includes('clipboard_read_image'), 'pasteFromClipboard no longer reads the clipboard image');
-	assert.equal(
-		callbackBodies(source, 'editor.addCommand').filter((b) => b.includes('clipboard_read_image')).length,
-		0,
-		'a second, inline paste implementation has appeared beside the named one',
-	);
-	return body;
-})();
-
-/**
- * Every model-content listener the component installs.
- *
- * Deliberately not "the one that handles undo": the component is free to have
- * none, one, or five, and the claim under test is about all of them together.
- */
-const contentChangeBodies = callbackBodies(source, 'editor.onDidChangeModelContent');
+const { EditorDocument } = await import('../src/lib/utils/editorDocument.svelte.js');
+const clipboard = await import('../src/lib/utils/editorClipboard.js');
 
 // ------------------------------------------------------------------ the fakes
 
@@ -255,109 +202,27 @@ type Component = {
 	contentChange: ((e: ChangeEvent) => void)[];
 };
 
-/**
- * The lifted code is TypeScript — `handleDroppedFile(path: string, …)`, `as
- * string | null`, `(editor as any)` — and `new Function` only takes JavaScript,
- * so it goes through `tsc` first, as layout.spec.ts and
- * documents.checks.spec.ts already do. Types are erased, nothing else:
- * the statements that run are the component's own.
- */
-const factorySource = ts.transpileModule(
-	`const __component = (invoke, settings, tabManager, monaco, editor, lineEndingLabel, countWords, resolveImageDirectory, documentParentDir, imageEmbed, routeDroppedFile) => {
-		let wordCount = 0;
-		let wordCountTimer;
-		let emittedText = null;
-		let currentLanguage = 'markdown';
-		let lineEnding = 'LF';
-
-		// The status-bar refresh the content-change listener calls. Lifted from
-		// the component rather than stubbed, so the listener under test runs
-		// exactly the statements it runs in the app; nothing here asserts on
-		// what it writes.
-		${functionSource(source, 'syncStatusFromModel')}
-
-		// Reached only by the text-paste path, which no test here exercises.
-		const insertTextAtCursor = () => { throw new Error('text paste path not modelled'); };
-		const isLinkifyPasteTarget = () => false;
-
-		${functionSource(source, 'handleDroppedFile')}
-		${pasteCommandBody}
-		${functionSource(source, 'clipboardTextForSelection')}
-		${functionSource(source, 'cutToClipboard')}
-
-		return {
-			paste: pasteFromClipboard,
-			drop: handleDroppedFile,
-			cut: cutToClipboard,
-			contentChange: [${contentChangeBodies.map((body) => `(e) => ${body}`).join(', ')}],
-		};
-	};`,
-	{ compilerOptions: { target: ts.ScriptTarget.ES2022 } },
-).outputText;
-
-/**
- * Anything the lifted code reads that is neither declared above nor a global
- * lands here — component-level state this harness does not model.
- *
- * Without it, re-adding the undo deletion would fail these tests with
- * `managedImages is not defined` and blame the harness. The whole reason such
- * state existed was to decide which file to delete, so the error says so.
- *
- * It sits in a `with` scope wrapped around the factory, which is *outside* the
- * lifted functions — so their own parameters and `let`s still shadow it, and
- * only genuinely unresolved names reach the proxy.
- */
-const unmodelledScope = new Proxy(Object.create(null), {
-	has: (_target, key) => typeof key === 'string' && !(key in globalThis),
-	get: (_target, key) => {
-		// The `value` prop, modelled as what Svelte compiles a dynamic prop to:
-		// a getter over the parent's expression, which is
-		// `value={tabManager.activeTab.rawContent}`. A local copy would be a
-		// second buffer with its own staleness — the very thing the component
-		// stopped keeping when `bind:value` went — and the listener's
-		// `value !== newValue` guard would then mean "changed since this copy
-		// was last assigned" instead of "the editor changed the document".
-		if (key === 'value') return tabManager.activeTab?.rawContent ?? '';
-		if (typeof key !== 'string') return undefined;
-		throw new Error(
-			`the editor reads component state \`${String(key)}\` that this harness does not model. ` +
-				'If it is per-image bookkeeping: undo must not track which file to delete (#368) — ' +
-				'the copy stays on disk, where the user can see and remove it.',
-		);
-	},
-});
-
 function createComponent(backend: Backend, editor: unknown): Component {
-	const factory = new Function(
-		'__scope',
-		`with (__scope) { ${factorySource}\nreturn __component; }`,
-	)(unmodelledScope) as (
-		invoke: unknown,
-		settings: unknown,
-		tabManager: unknown,
-		monaco: unknown,
-		editor: unknown,
-		lineEndingLabel: unknown,
-		countWords: unknown,
-		resolveImageDir: unknown,
-		parentDir: unknown,
-		embed: unknown,
-		routeDroppedFile: unknown,
-	) => Component;
-
-	return factory(
-		backend.invoke,
-		{ imageDirectory: 'img', macosImageScaling: false },
-		tabManager,
-		monacoStub,
-		editor,
-		lineEndingLabel,
-		countWords,
-		resolveImageDirectory,
-		documentParentDir,
-		imageEmbed,
-		routeDroppedFile,
-	);
+	const deps = {
+		editor: () => editor as any,
+		monaco: () => monacoStub as any,
+		invoke: backend.invoke,
+		tabs: tabManager,
+		settings: { imageDirectory: 'img', macosImageScaling: false },
+	};
+	const doc = new EditorDocument({
+		monaco: () => monacoStub as any,
+		editor: () => editor as any,
+		tabs: tabManager,
+		value: () => tabManager.activeTab?.rawContent ?? '',
+		showWordCount: () => true,
+	});
+	return {
+		paste: () => clipboard.pasteFromClipboard(deps),
+		drop: (path, x, y) => clipboard.handleDroppedFile(deps, path, x, y),
+		cut: () => clipboard.cutToClipboard(deps),
+		contentChange: [() => doc.contentChanged()],
+	};
 }
 
 const PASTED_IMAGE = 'iVBORw0KGgo=';
@@ -367,6 +232,7 @@ function setup(
 ) {
 	tabManager.closeAll();
 	const backend = createBackend(options.clipboardImage ?? null, options.clipboardFiles ?? null);
+	backendInUse = backend;
 	const doc = createDocument(options.initial ?? '');
 	const component = createComponent(backend, doc.editor);
 	doc.listeners.push(...component.contentChange);
diff --git a/scripts/editor.localizedActions.spec.ts b/scripts/editor.localizedActions.spec.ts
new file mode 100644
index 00000000..7091158c
--- /dev/null
+++ b/scripts/editor.localizedActions.spec.ts
@@ -0,0 +1,74 @@
+import assert from 'node:assert/strict';
+import { flushSync } from 'svelte';
+import { afterEach, describe, test } from 'vitest';
+
+import type { LanguageCode } from '../src/lib/utils/i18n.js';
+import { localizedEditorActions } from '../src/lib/utils/editorLocalizedActions.svelte.js';
+import { runeEffect } from './runeEffect.svelte.js';
+import { runeProps } from './runeProps.svelte.js';
+
+/*
+ * The editor's labelled actions (context menu, command palette) used to be
+ * built once at mount, so switching the UI language left the context menu in
+ * the previous one until the app restarted. The registration now follows the
+ * language, and a re-registration releases the old actions first: Monaco keeps
+ * a duplicate context-menu entry for an id registered twice.
+ */
+
+/** A Monaco editor reduced to `addAction`: which actions are live, by label. */
+function fakeEditor() {
+	const live = new Set<string>();
+	return {
+		live,
+		addAction: (descriptor: { id: string; label: string }) => {
+			const entry = `${descriptor.id}:${descriptor.label}`;
+			live.add(entry);
+			return { dispose: () => void live.delete(entry) };
+		},
+	};
+}
+
+let dispose: (() => void) | undefined;
+afterEach(() => {
+	dispose?.();
+	dispose = undefined;
+});
+
+function harness() {
+	const state = runeProps({ language: 'en' as LanguageCode, ready: false });
+	const editor = fakeEditor();
+	let release!: () => void;
+	dispose = runeEffect(() => {
+		release = localizedEditorActions({
+			language: () => state.language,
+			ready: () => state.ready,
+			editor: () => editor as never,
+			descriptors: (lang) =>
+				['bold', 'italic'].map((id) => ({ id, label: `${id} in ${lang}`, run: () => {} })),
+		});
+	});
+	flushSync();
+	return { state, editor, release: () => release() };
+}
+
+describe('context menu actions', () => {
+	test('actions are re-registered when the UI language changes', () => {
+		const run = harness();
+		assert.deepEqual([...run.editor.live], [], 'nothing is registered before the editor exists');
+
+		run.state.ready = true;
+		flushSync();
+		assert.deepEqual([...run.editor.live].sort(), ['bold:bold in en', 'italic:italic in en']);
+
+		run.state.language = 'ja';
+		flushSync();
+		assert.deepEqual(
+			[...run.editor.live].sort(),
+			['bold:bold in ja', 'italic:italic in ja'],
+			'the menu follows the language, and no id is left registered twice',
+		);
+
+		run.release();
+		assert.deepEqual([...run.editor.live], [], 'teardown releases them too');
+	});
+});
diff --git a/scripts/editor.mount.spec.ts b/scripts/editor.mount.spec.ts
new file mode 100644
index 00000000..4703d767
--- /dev/null
+++ b/scripts/editor.mount.spec.ts
@@ -0,0 +1,260 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, test, vi } from 'vitest';
+
+vi.mock('@tauri-apps/api/core', () => ({ invoke: async () => undefined }));
+vi.mock('@tauri-apps/plugin-opener', () => ({ openUrl: async () => undefined }));
+
+import type * as Monaco from 'monaco-editor';
+import { settings } from '../src/lib/stores/settings.svelte.js';
+import { updatedEditorOptions } from '../src/lib/utils/editorOptions.js';
+import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
+import { mountEditor, type MountEditorDeps } from '../src/lib/utils/mountEditor.js';
+import { TOKEN_TYPES } from '../src/lib/utils/semanticTokens.js';
+
+/*
+ * #799: the editor is created, then placed (view state, anchor line, the
+ * preview's cursor, a pending Ctrl+E sync), then reports where it is. Monaco
+ * keeps a placed scroll offset in pixels, so a font size or wrapping changed
+ * after the placement moves every placed line; and a cursor put down before
+ * the view state is restored, or after the editor has reported, carries the
+ * stale position back to the preview.
+ *
+ * The Monaco double below keeps the options it was given and records the
+ * layout in force whenever something is placed.
+ */
+
+type Layout = { fontSize: unknown; wrappingStrategy: unknown };
+type Position = { lineNumber: number; column: number };
+
+const FONT_INFO = 50;
+
+function fakeMonaco(fontIsMonospace: boolean) {
+	const placed: { what: string; layout: Layout }[] = [];
+	const semanticProviders: { languageId: string; provider: Monaco.languages.DocumentSemanticTokensProvider; disposed: boolean }[] = [];
+	let options: Record<string, unknown> = {};
+	let position: Position = { lineNumber: 1, column: 1 };
+	const layout = (): Layout => ({ fontSize: options.fontSize, wrappingStrategy: options.wrappingStrategy });
+	const place = (what: string) => placed.push({ what, layout: layout() });
+	const disposable = { dispose() {} };
+	const keyDown: ((e: { browserEvent: KeyboardEvent }) => void)[] = [];
+	const contextKeys = new Map<string, unknown>();
+
+	const editor = {
+		updateOptions: (next: Record<string, unknown>) => void (options = { ...options, ...next }),
+		getOption: (id: number) => {
+			assert.equal(id, FONT_INFO);
+			return { isMonospace: fontIsMonospace };
+		},
+		restoreViewState: (state: { position: Position }) => {
+			place('view state');
+			position = state.position;
+		},
+		revealLineNearTop: () => place('anchor line'),
+		getScrollHeight: () => 1000,
+		getLayoutInfo: () => ({ height: 500 }),
+		setScrollTop: () => place('scroll percentage'),
+		setPosition: (next: Position) => void (position = next),
+		getPosition: () => position,
+		focus() {},
+		onDidChangeModelContent: () => disposable,
+		onDidChangeCursorPosition: () => disposable,
+		onDidChangeCursorSelection: () => disposable,
+		onDidChangeConfiguration: () => disposable,
+		onKeyDown: (listener: (e: { browserEvent: KeyboardEvent }) => void) => {
+			keyDown.push(listener);
+			return disposable;
+		},
+		addCommand() {},
+		createContextKey: (name: string, initial: unknown) => {
+			contextKeys.set(name, initial);
+			return { set: (value: unknown) => void contextKeys.set(name, value) };
+		},
+		getModel: () => null,
+		dispose() {},
+	};
+
+	const register = () => disposable;
+	const monaco = {
+		editor: {
+			create: (_container: HTMLElement, created: Record<string, unknown>) => {
+				options = { ...created };
+				return editor;
+			},
+			defineTheme() {},
+			setTheme() {},
+			EditorOption: { fontInfo: FONT_INFO },
+			ScrollType: { Immediate: 1 },
+		},
+		languages: {
+			registerDocumentSemanticTokensProvider: (
+				languageId: string,
+				provider: Monaco.languages.DocumentSemanticTokensProvider,
+			) => {
+				const entry = { languageId, provider, disposed: false };
+				semanticProviders.push(entry);
+				return { dispose: () => void (entry.disposed = true) };
+			},
+			registerDocumentSymbolProvider: register,
+			registerFoldingRangeProvider: register,
+			registerCompletionItemProvider: register,
+			SymbolKind: { String: 14 },
+		},
+		KeyMod: { CtrlCmd: 2048, Shift: 1024 },
+		KeyCode: { Enter: 3, Tab: 2, KeyV: 52, KeyX: 54 },
+	};
+	const pressKey = (init: KeyboardEventInit) => {
+		const browserEvent = new KeyboardEvent('keydown', init);
+		for (const listener of keyDown) listener({ browserEvent });
+	};
+	return { monaco, editor, placed, semanticProviders, layout, contextKeys, pressKey, position: () => position };
+}
+
+type Tab = NonNullable<MountEditorDeps['tabs']['activeTab']>;
+
+let teardown: (() => void) | undefined;
+afterEach(() => {
+	teardown?.();
+	teardown = undefined;
+});
+
+function mount({
+	tab,
+	fontIsMonospace = true,
+	zoomLevel = 100,
+	sharedCursor = null,
+}: {
+	tab: Partial<Tab>;
+	fontIsMonospace?: boolean;
+	zoomLevel?: number;
+	sharedCursor?: { line: number; column: number } | null;
+}) {
+	const fake = fakeMonaco(fontIsMonospace);
+	const reports: string[] = [];
+	const events: string[] = [];
+	let editor!: Monaco.editor.IStandaloneCodeEditor;
+	let monospace = true;
+	let ready = false;
+	window.matchMedia = (() => ({ matches: false, addEventListener() {}, removeEventListener() {} })) as never;
+
+	teardown = mountEditor({
+		monaco: fake.monaco as never,
+		container: document.createElement('div'),
+		doc: {
+			currentTabId: null,
+			acquireTabModel: () => ({}),
+			contentChanged() {},
+			syncStatus() {},
+			cancelPendingWordCount() {},
+			writePosition() {},
+		} as never,
+		jumps: {
+			spendPending: () => {
+				events.push(`pending sync spent, ready=${ready}`);
+				fake.placed.push({ what: 'pending sync', layout: fake.layout() });
+			},
+		},
+		tabs: {
+			activeTabId: 'tab',
+			activeTab: { editorViewState: null, anchorLine: asRendererLine(0), scrollPercentage: 0, ...tab } as Tab,
+		},
+		settings,
+		value: Array.from({ length: 100 }, (_, i) => `line ${i + 1}`).join('\n'),
+		language: 'markdown',
+		theme: () => 'light',
+		zoomLevel,
+		readOnly: false,
+		sharedCursor,
+		oncursor: (line, column) => reports.push(`${line}:${column}`),
+		keyHandlers: {
+			cutToClipboard() {},
+			pasteFromClipboard() {},
+			continueListOnEnter() {},
+			handleTabKey() {},
+			handleShiftTabKey() {},
+			handleModEnterKey() {},
+			handleModShiftEnterKey() {},
+		},
+		// Editor.svelte's `applySettingsOptions`, over the state the setters write.
+		applySettingsOptions: () => editor.updateOptions(updatedEditorOptions(settings, zoomLevel, monospace, false)),
+		setEditor: (created) => (editor = created),
+		setFontIsMonospace: (value) => (monospace = value),
+		setCursorPosition() {},
+		setSelectionCount() {},
+		setCursorCount() {},
+		setEditorReady: (value) => {
+			ready = value;
+			events.push(`ready=${value}`);
+		},
+	});
+
+	// The layout the settings effect settles on once `editorReady` flips.
+	const settled = updatedEditorOptions(settings, zoomLevel, monospace, false);
+	return { ...fake, reports, events, final: { fontSize: settled.fontSize, wrappingStrategy: settled.wrappingStrategy } };
+}
+
+describe('editor mount', () => {
+	test('the editor has its final layout before anything is placed in it', () => {
+		// Zoomed, and in either kind of font: the zoom and the wrapping are the
+		// two ways the created editor used to differ from the one the update
+		// effect left behind.
+		const tabs = [
+			{ editorViewState: { position: { lineNumber: 40, column: 1 } } },
+			{ anchorLine: asRendererLine(30) },
+			{ scrollPercentage: 0.5 },
+		];
+		const cases = [true, false].flatMap((fontIsMonospace) => tabs.map((tab) => ({ tab, fontIsMonospace })));
+		for (const { tab, fontIsMonospace } of cases) {
+			const run = mount({ tab, fontIsMonospace, zoomLevel: 150 });
+			assert.equal(run.placed.length, 2, `placed: ${run.placed.map((p) => p.what).join(', ')}`);
+			for (const { what, layout } of run.placed) {
+				assert.deepEqual(layout, run.final, `the ${what} is placed under the final layout`);
+			}
+			assert.deepEqual(
+				run.events,
+				['ready=true', 'pending sync spent, ready=true'],
+				'the pending sync is spent once the editor is ready',
+			);
+			teardown?.();
+			teardown = undefined;
+		}
+	});
+
+	test('the editor mounts on the cursor the preview placed', () => {
+		const run = mount({
+			tab: { editorViewState: { position: { lineNumber: 40, column: 1 } } },
+			sharedCursor: { line: 7, column: 3 },
+		});
+		assert.deepEqual(run.position(), { lineNumber: 7, column: 3 }, 'the shared cursor beats the view state');
+		assert.deepEqual(run.reports, ['7:3'], 'and is what the editor reports on mount');
+	});
+
+	test('the editor registers the semantic tokens provider', () => {
+		// The switch half is editor.test.ts "the editor turns the semantic layer
+		// on, because the default is off".
+		const run = mount({ tab: {} });
+		assert.equal(run.semanticProviders.length, 1);
+		const [entry] = run.semanticProviders;
+		assert.equal(entry.languageId, 'markdown');
+		assert.deepEqual(entry.provider.getLegend().tokenTypes, [...TOKEN_TYPES]);
+
+		teardown?.();
+		teardown = undefined;
+		assert.ok(entry.disposed, 'and releases it on unmount');
+	});
+
+	test('AltGr+Z sets the AltGr context key, so the Ctrl+Alt actions refuse it', () => {
+		// Windows sends AltGr as Ctrl+Alt with AltGraph on, so Polish AltGr+Z (ż)
+		// is also Ctrl+Alt+Z, Zen mode. Monaco ignores AltGraph when it resolves
+		// a keystroke; the editor's own keydown sets `altGraphChord`, which every
+		// Ctrl+Alt action's `keybindingContext` refuses (editor.actions.test.ts).
+		// jsdom cannot say whether WebView2 reports AltGraph; the event sets it.
+		const run = mount({ tab: {} });
+		assert.equal(run.contextKeys.get('altGraphChord'), false, 'off until a key is pressed');
+
+		run.pressKey({ key: 'ż', code: 'KeyZ', ctrlKey: true, altKey: true, modifierAltGraph: true });
+		assert.equal(run.contextKeys.get('altGraphChord'), true, 'AltGr+Z is an AltGr chord');
+
+		run.pressKey({ key: 'z', code: 'KeyZ', ctrlKey: true, altKey: true });
+		assert.equal(run.contextKeys.get('altGraphChord'), false, 'a real Ctrl+Alt+Z clears it, so Zen mode still works');
+	});
+});
diff --git a/scripts/editor.spec.ts b/scripts/editor.spec.ts
index ae5b65d8..83e97f53 100644
--- a/scripts/editor.spec.ts
+++ b/scripts/editor.spec.ts
@@ -3,6 +3,8 @@ import { afterAll, describe, test } from 'vitest';
 
 import { countWords } from '../src/lib/utils/wordCount.js';
 import { isAltGraphChord } from '../src/lib/utils/viewerKeymap.js';
+import { contextMenuFor, editorContextMenuItems, type EditorMenuPane } from '../src/lib/utils/viewerContextMenu.js';
+import { loadLocale, t } from '../src/lib/utils/i18n.js';
 
 /*
  * The status bar counted `text.match(/\S+/g)` and then kept only the tokens
@@ -89,7 +91,7 @@ describe('AltGr in Monaco', () => {
 	});
 
 	async function loadMonaco() {
-		// The web branch, on Windows, as `editor.checks.spec.ts` explains.
+		// The web branch, on Windows, as `editor.chords.spec.ts` explains.
 		(document as unknown as { queryCommandSupported: () => boolean }).queryCommandSupported = () => true;
 		Object.defineProperty(navigator, 'userAgent', {
 			value: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
@@ -182,3 +184,76 @@ describe('AltGr in Monaco', () => {
 		host.remove();
 	});
 });
+
+describe('editor context menu (#261)', () => {
+	test('a right-click in the editor gets the editor menu, before any other rule claims it', () => {
+		// Monaco takes input through a hidden `<textarea>`, so the carve-out that
+		// leaves real text fields their native menu would claim every right-click
+		// in the editor if it came first (#261/#266, then #207).
+		const root = document.createElement('div');
+		root.innerHTML = '<div class="editor-container"><div class="view-lines"><span>text</span></div><textarea class="inputarea"></textarea></div>';
+		for (const target of root.querySelectorAll('span, textarea')) {
+			assert.equal(contextMenuFor(target, { modalOpen: false, inApp: true }), 'editor', target.tagName);
+		}
+	});
+
+	/** A pane that records which of its functions ran. */
+	function recordingPane(): { pane: EditorMenuPane; calls: string[] } {
+		const calls: string[] = [];
+		const record = (name: string) => () => void calls.push(name);
+		return {
+			calls,
+			pane: {
+				undo: record('undo'),
+				redo: record('redo'),
+				cutToClipboard: record('cutToClipboard'),
+				copyToClipboard: record('copyToClipboard'),
+				pasteFromClipboard: record('pasteFromClipboard'),
+				selectAll: record('selectAll'),
+				runEditorAction: (id) => void calls.push(`runEditorAction:${id}`),
+			},
+		};
+	}
+
+	const click = (items: ReturnType<typeof editorContextMenuItems>, label: string) => {
+		const item = items.find((entry) => entry.label === label);
+		assert.ok(item?.onClick, `no "${label}" item`);
+		item.onClick();
+	};
+
+	test('the editor menu runs the same three functions the keyboard runs', () => {
+		// One implementation per operation is the whole point: six entry points
+		// (three keys, three menu items) and three functions. A menu item wired to
+		// its own inline implementation would drift from the shortcut silently.
+		const { pane, calls } = recordingPane();
+		const items = editorContextMenuItems(() => pane, 'en', 'macos');
+
+		click(items, 'Cut');
+		click(items, 'Copy');
+		click(items, 'Paste');
+
+		assert.deepEqual(calls, ['cutToClipboard', 'copyToClipboard', 'pasteFromClipboard']);
+	});
+
+	test('the two Monaco entries this app can use survive drawing our own menu', async () => {
+		// Drawing the menu ourselves means every item Monaco used to contribute is
+		// gone unless it is put back, and two of them work without a language
+		// provider — so they were there, and vanished, and were noticed only
+		// because someone went looking for them.
+		//
+		// The rest (Go to Symbol, Quick Fix, Refactor, Format, Rename) are gated on
+		// providers Markdown has none of and never appeared in this app.
+		//
+		// Through the app's own translations, which is a gain rather than parity:
+		// Monaco's menu is English whatever language the app is in.
+		await loadLocale('zh-TW');
+		const { pane, calls } = recordingPane();
+		const items = editorContextMenuItems(() => pane, 'zh-TW', 'windows');
+
+		click(items, t('menu.commandPalette', 'zh-TW'));
+		click(items, t('menu.changeAllOccurrences', 'zh-TW'));
+
+		assert.notEqual(t('menu.commandPalette', 'zh-TW'), 'Command Palette');
+		assert.deepEqual(calls, ['runEditorAction:editor.action.quickCommand', 'runEditorAction:editor.action.changeAll']);
+	});
+});
diff --git a/scripts/editor.test.ts b/scripts/editor.test.ts
index 74390bbb..c0f72ca5 100644
--- a/scripts/editor.test.ts
+++ b/scripts/editor.test.ts
@@ -17,14 +17,17 @@ import { getSupportedLanguages, type LanguageCode, t, type Translation } from '.
 import { translations } from './allTranslations.js';
 import { editorLanguageFor } from '../src/lib/utils/editorLanguage.js';
 import { MARKDOWN_LINK_EXTENSIONS } from '../src/lib/utils/markdownLinks.js';
-import { editorOptionsFromSettings } from '../src/lib/utils/editorOptions.js';
+import { createdEditorOptions, editorOptionsFromSettings, editorReadOnly, updatedEditorOptions } from '../src/lib/utils/editorOptions.js';
 import { markdownTokenRules, monacoThemeName, semanticTokenRules } from '../src/lib/utils/editorTheme.js';
 import { importedThemeRules, MARKDOWN_SCOPE_ALIASES, markdownKindColors, monacoTokenRules } from '../src/lib/utils/theme.js';
 import { encodeSemanticTokens, TOKEN_MODIFIERS, TOKEN_TYPES } from '../src/lib/utils/semanticTokens.js';
 import { resolveExportImagePath } from '../src/lib/utils/exportHtml.js';
 import { DEFAULT_IMAGE_DIRECTORY, documentParentDir, encodeImageDestination, imageEmbed, resolveImageDirectory } from '../src/lib/utils/imageEmbed.js';
 import { resolveDocumentRelativePath } from '../src/lib/utils/markdown.js';
-import { buildPasteProbe, findTokenAtOffset, getFrontMatterLineCount, isCodeToken, isInFrontMatter, type PasteContextToken, shouldLinkifyPastedUrl } from '../src/lib/utils/pasteContext.js';
+import { buildPasteProbe, findTokenAtOffset, getFrontMatterLineCount, isCodeToken, isInFrontMatter, isLinkifyPasteTarget, type PasteContextToken, shouldLinkifyPastedUrl } from '../src/lib/utils/pasteContext.js';
+import { clipboardTextForSelection, type EditingEditor, insertLink, insertTextAtCursor, wrapAsCodeBlock } from '../src/lib/utils/editorEdits.js';
+import { mountAfterLoad } from '../src/lib/utils/editorMount.js';
+import { pasteFromClipboard } from '../src/lib/utils/editorClipboard.js';
 import { paragraphAround } from '../src/lib/utils/focusParagraph.js';
 
 // WHAT THIS FILE COVERS, AND WHAT IT DOES NOT
@@ -190,7 +193,9 @@ describe('editor options', () => {
 	 */
 	function effectiveUnicodeHighlight(passed: unknown): UnicodeHighlightOptions {
 		const option = EditorOptions.unicodeHighlight;
-		return option.applyUpdate(option.defaultValue, passed ?? {}).newValue;
+		// A copy: Monaco's `applyUpdate` merges in place unless the update carries
+		// `allowedCharacters`, and the shipped defaults are one shared object.
+		return option.applyUpdate(structuredClone(option.defaultValue), passed ?? {}).newValue;
 	}
 
 	/**
@@ -424,6 +429,166 @@ describe('editor options', () => {
 		assert.ok(on.cursorSurroundingLines! > 1000, 'more lines than any screen, which Monaco caps at half the viewport');
 		assert.equal(on.cursorSurroundingLinesStyle, 'all');
 	});
+
+	/** What `monaco.editor.create` gets for a settings store, on a whole buffer. */
+	function created(settings: Partial<typeof SETTINGS> = {}) {
+		return createdEditorOptions({ ...SETTINGS, ...settings }, 100, false);
+	}
+
+	test('an option a setting can change is one `updateOptions` re-applies', () => {
+		// `smoothScrolling` used to be a bare `true` in the creation literal, where
+		// options that are set once and never re-applied live. Left there, the
+		// toggle would have taken effect only on a newly created editor — the same
+		// shape as the `fontSize` divergence #369 removed. So: change each setting,
+		// and every option that moves at creation has to move the same way in what
+		// the update effect re-applies to the open editor.
+		const OTHER: Record<string, string> = { wordWrap: 'off', lineNumbers: 'off', renderLineHighlight: 'none', editorFont: 'Georgia' };
+		for (const [field, value] of Object.entries(SETTINGS)) {
+			const changed = { ...SETTINGS, [field]: typeof value === 'boolean' ? !value : typeof value === 'number' ? value + 6 : OTHER[field] };
+			const before = created();
+			const after = created(changed);
+			const reapplied = updatedEditorOptions(changed, 100, true, false) as Record<string, unknown>;
+			const moved = Object.keys(after).filter((key) => JSON.stringify(Reflect.get(after, key)) !== JSON.stringify(Reflect.get(before, key)));
+			assert.ok(moved.length > 0, `${field} changes some option`);
+			for (const key of moved) {
+				assert.deepEqual(reapplied[key], Reflect.get(after, key), `changing ${field} re-applies ${key} to an open editor`);
+			}
+		}
+	});
+
+	test('renderLineHighlight is a Monaco string enum, not a boolean flag', () => {
+		// Any non-empty string is truthy, so a ternary on the stored 'line' / 'none'
+		// can only ever produce "line" — which defeats both the line-highlight
+		// toggle and Zen mode. Both stored values have to survive the trip, at
+		// creation and on update; a ternary passes for 'line' and fails for 'none'.
+		for (const stored of ['line', 'none'] as const) {
+			assert.equal(created({ renderLineHighlight: stored }).renderLineHighlight, stored);
+			assert.equal(updatedEditorOptions({ ...SETTINGS, renderLineHighlight: stored }, 100, true, false).renderLineHighlight, stored);
+		}
+	});
+
+	test('editor options are applied by a single updateOptions effect', () => {
+		// Two competing effects wrote the same Monaco options with different
+		// values — notably fontSize with and without the zoom factor. What the one
+		// update applies: every option the two effects used to fight over, and the
+		// zoom-aware font size that was the value they disagreed on.
+		const applied = updatedEditorOptions({ ...SETTINGS, editorFontSize: 20, editorMaxWidth: 90 }, 150, true, false);
+		assert.equal(applied.fontSize, 30, 'the surviving font size carries the zoom factor');
+		assert.equal(applied.wordWrapColumn, 90, 'wordWrapColumn survived the merge');
+		assert.equal(created({ editorFontSize: 20 }).fontSize, 20, 'and creation derives it the same way');
+	});
+
+	test('a proportional font wraps on measured widths, a monospace font keeps the fast path', () => {
+		// #758: 'simple' wrapped Times New Roman and Roboto lines well short of the
+		// window edge. Both values are asserted because 'advanced' everywhere would
+		// also fix the report, and would make every large file pay for it.
+		assert.equal(updatedEditorOptions(SETTINGS, 100, true, false).wrappingStrategy, 'simple');
+		assert.equal(updatedEditorOptions(SETTINGS, 100, false, false).wrappingStrategy, 'advanced');
+	});
+
+	test('Show Whitespace renders every whitespace run, not just trailing', () => {
+		// The setting is labelled without qualification ("Show Whitespace" /
+		// "显示空白字符"), so "trailing" left interior spaces unmarked.
+		assert.equal(created({ showWhitespace: true }).renderWhitespace, 'all');
+		assert.equal(created({ showWhitespace: false }).renderWhitespace, 'none');
+		assert.equal(updatedEditorOptions({ ...SETTINGS, showWhitespace: true }, 100, true, false).renderWhitespace, 'all');
+	});
+
+	test('the editor narrows the Unicode highlighter without switching it off', () => {
+		// Reports #186 and #94 are both Monaco outlining fullwidth punctuation.
+		// Narrowness is the assertion: `unicodeHighlight: false`, or turning
+		// `invisibleCharacters` off, would also make the boxes go away and would
+		// take the NBSP warning with it. Two overrides, and only two: the
+		// confusable rule off, and U+3000 exempted from the invisible rule (#393).
+		const passed = created().unicodeHighlight as object;
+		assert.deepEqual(Object.keys(passed).sort(), ['allowedCharacters', 'ambiguousCharacters'], 'no third sub-option');
+		const effective = effectiveUnicodeHighlight(passed);
+		assert.equal(effective.ambiguousCharacters, false);
+		assert.deepEqual(effective.allowedCharacters, { '　': true }, 'exactly one character is exempted');
+	});
+
+	test('no box is drawn on fullwidth CJK punctuation', () => {
+		const found = outlined(CJK_PROSE, effectiveUnicodeHighlight(created().unicodeHighlight));
+		assert.equal(
+			found.ranges.length,
+			0,
+			`nothing outlined in CJK prose, got ${JSON.stringify(
+				found.ranges.map((r) => CJK_PROSE[r.startLineNumber - 1].slice(r.startColumn - 1, r.endColumn - 1)),
+			)}`,
+		);
+		assert.equal(found.ambiguousCharacterCount, 0);
+	});
+
+	test('the invisible-character warning survives the fix', () => {
+		// A stray NBSP or zero-width space is a real hazard in Markdown — an NBSP
+		// after `-` stops a list from parsing.
+		const effective = effectiveUnicodeHighlight(created().unicodeHighlight);
+		assert.equal(effective.invisibleCharacters, true, 'left at the Monaco default');
+		const found = outlined(['a b', 'x​z'], effective);
+		assert.equal(found.invisibleCharacterCount, 2, 'NBSP and zero-width space are still flagged');
+	});
+
+	test('the space bar under a CJK IME is not outlined', () => {
+		const found = outlined(CJK_IDEOGRAPHIC_SPACE, effectiveUnicodeHighlight(created().unicodeHighlight));
+		assert.equal(
+			found.ranges.length,
+			0,
+			`nothing outlined around U+3000, got ${JSON.stringify(found.ranges.map((r) => CJK_IDEOGRAPHIC_SPACE[r.startLineNumber - 1]))}`,
+		);
+	});
+
+	test('exempting U+3000 does not exempt the NBSP that breaks a list', () => {
+		const found = outlined(['- item', '今天　天气'], effectiveUnicodeHighlight(created().unicodeHighlight));
+		assert.equal(found.invisibleCharacterCount, 1, 'the NBSP is flagged, the U+3000 is not');
+		assert.equal(found.ranges[0].startLineNumber, 1, 'and it is the NBSP line');
+	});
+
+	test('"Highlight Occurrences" off leaves nothing highlighting occurrences', () => {
+		// Monaco splits the feature in two: `SelectionHighlighter` gates itself on
+		// `selectionHighlight` and consults `occurrencesHighlight` only to choose a
+		// decoration style. So at the setting's own default, selecting a word still
+		// highlighted every other copy of it. Read through each option's own
+		// `validate`, at creation and on update, for both values of the setting.
+		for (const occurrencesHighlight of [false, true]) {
+			for (const options of [created({ occurrencesHighlight }), updatedEditorOptions({ ...SETTINGS, occurrencesHighlight }, 100, true, false)]) {
+				assert.deepEqual(
+					{
+						occurrencesHighlight: EditorOptions.occurrencesHighlight.validate(options.occurrencesHighlight),
+						selectionHighlight: EditorOptions.selectionHighlight.validate(options.selectionHighlight),
+					},
+					occurrencesHighlight
+						? { occurrencesHighlight: 'singleFile', selectionHighlight: true }
+						: { occurrencesHighlight: 'off', selectionHighlight: false },
+				);
+			}
+		}
+	});
+
+	test('the editor does not offer to rewrite a document containing U+2028', () => {
+		// `unusualLineTerminators` defaults to 'prompt', which in standalone Monaco
+		// is a bare `mainWindow.confirm()` offering to delete characters out of the
+		// user's file. 'auto' makes the same edit with no dialog. Read through
+		// `validate`, because anything it does not recognise resolves back to the
+		// dialog.
+		assert.equal(EditorOptions.unusualLineTerminators.validate(created().unusualLineTerminators), 'off');
+	});
+
+	test('the editor turns the semantic layer on, because the default is off', () => {
+		// `StandaloneTheme.semanticHighlighting` is hard-coded false, so
+		// `'configuredByTheme'` cannot reach it and the provider is never asked.
+		assert.equal(Reflect.get(created(), 'semanticHighlighting.enabled'), true);
+	});
+
+	test('an editor on a buffer that is not the whole file refuses typing', () => {
+		// An unread or unreadable tab in edit mode shows an empty buffer that no
+		// save will ever accept. Read-only at the keyboard, not a toast at the save.
+		assert.equal(editorReadOnly({ isTruncated: true }), true);
+		assert.equal(editorReadOnly({ isTruncated: false }), false);
+		assert.equal(editorReadOnly({}), false);
+		assert.equal(createdEditorOptions(SETTINGS, 100, true).readOnly, true, 'at creation');
+		assert.equal(updatedEditorOptions(SETTINGS, 100, true, true).readOnly, true, 'and when a tab is read later');
+		assert.equal(updatedEditorOptions(SETTINGS, 100, true, false).readOnly, false, 'and typing is back once it is whole');
+	});
 });
 
 // The editor's Markdown colours. Two things can make a rule here do nothing at
@@ -478,6 +643,30 @@ describe('editor theme', () => {
 		}
 	});
 
+	test('both themes get rules, and every rule is a real token', () => {
+		// Every construct the palette colours, run through Monaco's own grammar. A
+		// rule naming a token this never emits would be inert.
+		const sample = [
+			'# Heading', '', '> quoted', '', '* * *', '',
+			'- item **bold** and *it* `code` \\* [a](http://x "t") <http://auto>', '',
+			'| H1 | H2 |', '|----|----|', '| a  | b  |', '',
+			'```', 'fenced', '```', '',
+			'<div class="c" id=\'x\'>html &amp; text</div>', '<!-- note -->',
+		].join('\n');
+		const emitted = new Set(createMarkdownTokenizer()(sample).flat().map((token) => token.type));
+
+		for (const appearance of ['light', 'dark'] as const) {
+			const rules = markdownTokenRules(appearance);
+			assert.ok(rules.length > 0, `${appearance} must not fall back to Monaco's source-code colours`);
+			for (const rule of rules) {
+				assert.ok(emitted.has(rule.token), `no Markdown token is called \`${rule.token}\` — the rule would be inert`);
+				// Monaco's own parser reads these as `#rrggbb` once it prepends the
+				// hash; a `#` here, or a short form, resolves to no colour.
+				assert.match(rule.foreground, /^[0-9a-f]{6}$/, `${rule.token} must be a bare six-digit hex`);
+			}
+		}
+	});
+
 	test('light and dark are actually different themes', () => {
 		const light = markdownTokenRules('light');
 		const dark = markdownTokenRules('dark');
@@ -971,59 +1160,57 @@ describe('image embed', () => {
 // types, the fence state machine, and the caret lookup are genuinely exercised,
 // not mocked.
 //
-// Not covered: that Editor.svelte calls this code on the Ctrl+V path with the
-// right arguments. Editor.svelte is a Svelte component and cannot be imported
-// here, so that wiring is pinned by a source-text assertion at the bottom of
-// the file, which proves only that the code reads a certain way.
+// The paste handler itself (utils/editorClipboard.ts) runs too: "the paste path
+// consults the context guard before building a link" below.
 //
 // Also not covered: Monaco's async tokenizer bootstrap. In the app,
 // `monaco.editor.tokenize()` falls back to null tokens if the language has not
 // finished loading; that degrades to "no code token found", i.e. to the old
 // linkify-everything behaviour, and is not reproduced here.
-describe('paste URL context', () => {
-	// `monaco.editor.tokenize()` needs a browser-backed editor to exist, so the
-	// tokenizer is driven directly. Only the handful of services Monarch actually
-	// touches during plain (non-encoded) tokenization are stubbed.
-	function createMarkdownTokenizer() {
-		const lexer = compile('markdown', markdownLanguage);
-		const languageService = {
-			languageIdCodec: { encodeLanguageId: () => 1, decodeLanguageId: () => 'markdown' },
-			isRegisteredLanguageId: () => true,
-			// ```lang fences: Monarch asks for the embedded language and stamps its
-			// tokens with the resulting id, which is the signal pasteContext keys on.
-			getLanguageIdByLanguageName: (name: string) => name,
-			requestBasicLanguageFeatures: () => {},
-			requestRichLanguageFeatures: () => {},
-			onDidRequestBasicLanguageFeatures: () => ({ dispose() {} }),
-			onDidRequestRichLanguageFeatures: () => ({ dispose() {} }),
-		};
-		const themeService = {
-			getColorTheme: () => ({ tokenTheme: { match: () => 0 } }),
-			onDidColorThemeChange: () => ({ dispose() {} }),
-		};
-		const configurationService = {
-			getValue: () => undefined,
-			onDidChangeConfiguration: () => ({ dispose() {} }),
-		};
-
-		const tokenizer = new MonarchTokenizer(
-			languageService,
-			themeService,
-			'markdown',
-			lexer,
-			configurationService,
-		);
+// `monaco.editor.tokenize()` needs a browser-backed editor to exist, so the
+// tokenizer is driven directly. Only the handful of services Monarch actually
+// touches during plain (non-encoded) tokenization are stubbed.
+function createMarkdownTokenizer() {
+	const lexer = compile('markdown', markdownLanguage);
+	const languageService = {
+		languageIdCodec: { encodeLanguageId: () => 1, decodeLanguageId: () => 'markdown' },
+		isRegisteredLanguageId: () => true,
+		// ```lang fences: Monarch asks for the embedded language and stamps its
+		// tokens with the resulting id, which is the signal pasteContext keys on.
+		getLanguageIdByLanguageName: (name: string) => name,
+		requestBasicLanguageFeatures: () => {},
+		requestRichLanguageFeatures: () => {},
+		onDidRequestBasicLanguageFeatures: () => ({ dispose() {} }),
+		onDidRequestRichLanguageFeatures: () => ({ dispose() {} }),
+	};
+	const themeService = {
+		getColorTheme: () => ({ tokenTheme: { match: () => 0 } }),
+		onDidColorThemeChange: () => ({ dispose() {} }),
+	};
+	const configurationService = {
+		getValue: () => undefined,
+		onDidChangeConfiguration: () => ({ dispose() {} }),
+	};
 
-		return (text: string): PasteContextToken[][] => {
-			let state = tokenizer.getInitialState();
-			return text.split('\n').map((line: string) => {
-				const result = tokenizer.tokenize(line, true, state);
-				state = result.endState;
-				return result.tokens as PasteContextToken[];
-			});
-		};
-	}
+	const tokenizer = new MonarchTokenizer(
+		languageService,
+		themeService,
+		'markdown',
+		lexer,
+		configurationService,
+	);
+
+	return (text: string): PasteContextToken[][] => {
+		let state = tokenizer.getInitialState();
+		return text.split('\n').map((line: string) => {
+			const result = tokenizer.tokenize(line, true, state);
+			state = result.endState;
+			return result.tokens as PasteContextToken[];
+		});
+	};
+}
 
+describe('paste URL context', () => {
 	const tokenize = createMarkdownTokenizer();
 
 	/**
@@ -1048,6 +1235,79 @@ describe('paste URL context', () => {
 		});
 	}
 
+	test('the paste path consults the context guard before building a link', () => {
+		// The guard the paste path calls, over a model and the primary selection:
+		// the lines above the caret go through Monaco's tokenizer for markdown.
+		const languages: string[] = [];
+		const model = (lines: string[]) => ({
+			getLanguageId: () => 'markdown',
+			getValue: () => lines.join('\n'),
+			getLinesContent: () => lines,
+		});
+		const monacoEditor = {
+			tokenize: (text: string, languageId: string) => {
+				languages.push(languageId);
+				return tokenize(text);
+			},
+		};
+		const fenced = ['```', 'const a = ', '```'];
+		assert.equal(isLinkifyPasteTarget(model(fenced), { startLineNumber: 2, startColumn: 11 }, monacoEditor), false, 'a URL pasted in code stays bare');
+		assert.equal(isLinkifyPasteTarget(model(['```', 'code', '```', 'prose ']), { startLineNumber: 4, startColumn: 7 }, monacoEditor), true);
+		// Only the lines up to the caret count: a fence opened below it is not one the caret is in.
+		assert.equal(isLinkifyPasteTarget(model(['prose ', '```', 'code']), { startLineNumber: 1, startColumn: 7 }, monacoEditor), true);
+		assert.ok(languages.length > 0 && languages.every((id) => id === 'markdown'), `tokenized as ${languages}`);
+	});
+
+	test('the paste path consults the context guard before building a link', async () => {
+		// The editor's own paste handler, with the clipboard holding a URL and the
+		// caret in a fence, then in prose: the guard decides between the bare URL
+		// and `[label](url)`.
+		const url = 'https://example.com/a';
+		const pasteInto = async (lines: string[], line: number, column: number) => {
+			const edits: { source: string; text: string }[] = [];
+			const selection = {
+				startLineNumber: line,
+				startColumn: column,
+				endLineNumber: line,
+				endColumn: column,
+				isEmpty: () => true,
+			};
+			const editor = {
+				focus: () => {},
+				getModel: () => ({
+					getLanguageId: () => 'markdown',
+					getValue: () => lines.join('\n'),
+					getLinesContent: () => lines,
+				}),
+				getSelections: () => [selection],
+				pushUndoStop: () => true,
+				executeEdits: (source: string, ops: { text: string }[]) => {
+					for (const op of ops) edits.push({ source, text: op.text });
+					return true;
+				},
+				setSelections: () => {},
+			};
+			await pasteFromClipboard({
+				editor: () => editor as never,
+				monaco: () =>
+					({
+						editor: { tokenize: (text: string) => tokenize(text) },
+						Selection: class {},
+					}) as never,
+				invoke: async (cmd) => (cmd === 'clipboard_read_text' ? url : null),
+				// No document path: the image branch is skipped, as for an untitled tab.
+				tabs: { activeTab: { path: undefined } },
+				settings: { imageDirectory: 'img', macosImageScaling: false },
+			});
+			return edits;
+		};
+
+		assert.deepEqual(await pasteInto(['```', 'const a = ', '```'], 2, 11), [{ source: 'paste-text', text: url }], 'a URL pasted in code stays bare');
+		assert.deepEqual(await pasteInto(['```', 'code', '```', 'prose '], 4, 7), [
+			{ source: 'paste-link', text: `[example.com/a](${url})` },
+		]);
+	});
+
 	test('a URL pasted into prose still becomes a markdown link', () => {
 		assert.equal(linkifiesAt('some prose |here'), true);
 		assert.equal(linkifiesAt('# A heading |'), true);
@@ -1171,3 +1431,127 @@ describe('focus paragraph', () => {
 		assert.deepEqual(paragraphAround(read, LINES.length, 2), { start: 2, end: 2 }, 'a blank line is its own');
 	});
 });
+
+describe('editor clipboard and format tools', () => {
+	class FakeRange {
+		constructor(
+			readonly startLineNumber: number,
+			readonly startColumn: number,
+			readonly endLineNumber: number,
+			readonly endColumn: number,
+		) {}
+		isEmpty() {
+			return this.startLineNumber === this.endLineNumber && this.startColumn === this.endColumn;
+		}
+	}
+
+	/** An editor over `lines` with one selection, recording the calls the tools make. */
+	function fakeEditor(lines: string[], selection: number[], eol = '\n') {
+		const calls: string[] = [];
+		const edits: Array<{ text: string }> = [];
+		const model = {
+			getLineContent: (line: number) => lines[line - 1],
+			getLineCount: () => lines.length,
+			getLineMaxColumn: (line: number) => lines[line - 1].length + 1,
+			getEOL: () => eol,
+			getValueInRange: (r: FakeRange) => {
+				const span = lines.slice(r.startLineNumber - 1, r.endLineNumber);
+				span[span.length - 1] = span[span.length - 1].slice(0, r.endColumn - 1);
+				span[0] = span[0].slice(r.startColumn - 1);
+				return span.join(eol);
+			},
+		};
+		const editor = {
+			getModel: () => model,
+			getSelection: () => new FakeRange(selection[0], selection[1], selection[2], selection[3]),
+			pushUndoStop: () => {
+				calls.push('pushUndoStop');
+				return true;
+			},
+			executeEdits: (_source: string, ops: Array<{ text: string }>) => {
+				calls.push('executeEdits');
+				edits.push(...ops);
+				return true;
+			},
+		};
+		return { editor: editor as unknown as EditingEditor, calls, edits };
+	}
+
+	const monaco = { Range: FakeRange } as unknown as Parameters<typeof clipboardTextForSelection>[1];
+	const numbers = (r: unknown) => {
+		const range = r as FakeRange;
+		return [range.startLineNumber, range.startColumn, range.endLineNumber, range.endColumn];
+	};
+
+	test("custom copy keeps Monaco's whole-line copy on an empty selection", () => {
+		// Monaco's `emptySelectionClipboard` default, VS Code's and Sublime Text's:
+		// nothing selected copies the caret's line with its line ending.
+		const { editor } = fakeEditor(['first', 'second', 'last'], [2, 3, 2, 3], '\r\n');
+		const line = clipboardTextForSelection(editor, monaco);
+		assert.equal(line.text, 'second\r\n');
+		assert.deepEqual(numbers(line.range), [2, 1, 3, 1], 'a cut takes the line ending with the line');
+
+		const last = clipboardTextForSelection(fakeEditor(['first', 'last'], [2, 1, 2, 1]).editor, monaco);
+		assert.equal(last.text, 'last\n');
+		assert.deepEqual(numbers(last.range), [2, 1, 2, 5], 'the last line has no next line to run to');
+
+		const selected = clipboardTextForSelection(fakeEditor(['hello world'], [1, 1, 1, 6]).editor, monaco);
+		assert.equal(selected.text, 'hello', 'a real selection takes just the selection');
+		assert.deepEqual(numbers(selected.range), [1, 1, 1, 6]);
+
+		assert.deepEqual(clipboardTextForSelection(undefined, monaco), { text: '', range: null }, 'no editor yet, nothing to copy');
+	});
+
+	test('the format tools each push an undo stop before they edit', () => {
+		const tools: Record<string, (editor: EditingEditor) => void> = {
+			insertTextAtCursor: (editor) => insertTextAtCursor(editor, 'x'),
+			wrapAsCodeBlock,
+			insertLink,
+		};
+		for (const [name, run] of Object.entries(tools)) {
+			const { editor, calls, edits } = fakeEditor(['hello'], [1, 1, 1, 6]);
+			run(editor);
+			assert.equal(edits.length, 1, name);
+			assert.deepEqual(calls, ['pushUndoStop', 'executeEdits'], `${name} edits inside the undo step typing left open`);
+		}
+	});
+});
+
+describe('editor mount', () => {
+	/** A load the test resolves by hand. */
+	function deferred() {
+		let resolve!: () => void;
+		const promise = new Promise<void>((r) => (resolve = r));
+		return { promise, resolve };
+	}
+	const settle = () => new Promise((r) => setImmediate(r));
+
+	test('unmounting while Monaco is still loading creates no editor', async () => {
+		const load = deferred();
+		const events: string[] = [];
+		const cleanup = mountAfterLoad(() => load.promise, () => {
+			events.push('create');
+			return () => events.push('teardown');
+		});
+		assert.equal(typeof cleanup, 'function', 'the cleanup is returned synchronously, not as a promise');
+		cleanup();
+		load.resolve();
+		await settle();
+		assert.deepEqual(events, []);
+	});
+
+	test('the editor is created once Monaco lands, and torn down on unmount', async () => {
+		const load = deferred();
+		const events: string[] = [];
+		const cleanup = mountAfterLoad(() => load.promise, () => {
+			events.push('create');
+			return () => events.push('teardown');
+		});
+		assert.deepEqual(events, [], 'nothing is created before the module arrives');
+		load.resolve();
+		await settle();
+		assert.deepEqual(events, ['create']);
+		cleanup();
+		assert.deepEqual(events, ['create', 'teardown']);
+	});
+});
diff --git a/scripts/editor.theme.spec.ts b/scripts/editor.theme.spec.ts
new file mode 100644
index 00000000..ac4af888
--- /dev/null
+++ b/scripts/editor.theme.spec.ts
@@ -0,0 +1,29 @@
+import { describe, expect, test, vi } from 'vitest';
+
+import { defineAppThemes, monacoThemeName } from '../src/lib/utils/editorTheme.js';
+import { loadVscodeTheme } from '../src/lib/utils/theme.js';
+
+// Module-level on purpose: vitest hoists `vi.mock` and `vi.hoisted` to the top of the file.
+const defined = vi.hoisted(() => new Set<string>());
+
+vi.mock('monaco-editor', () => ({
+	editor: { setTheme: () => {}, defineTheme: (name: string) => void defined.add(name) },
+}));
+
+describe('editor theme names', () => {
+	test('every name the seam returns is a theme somebody defines', async () => {
+		// `setTheme` on a name Monaco has never been given silently falls back to
+		// `vs`. The app defines two themes when the editor mounts, and an imported
+		// VS Code theme is defined when it loads.
+		defineAppThemes({ editor: { defineTheme: (name: string) => void defined.add(name) } } as never);
+		const theme = JSON.stringify({ type: 'dark', colors: { 'editor.background': '#101010' } });
+		expect(await loadVscodeTheme('Dark Thing', async () => theme)).toBe(true);
+
+		for (const setting of ['system', 'light', 'dark', 'vscode:whatever']) {
+			for (const prefersDark of [false, true]) {
+				const name = monacoThemeName(setting, prefersDark);
+				expect(defined, `nothing defines ${name}; Monaco would fall back to vs`).toContain(name);
+			}
+		}
+	});
+});
diff --git a/scripts/editor.vim.test.ts b/scripts/editor.vim.test.ts
index e096ffaa..ca10923d 100644
--- a/scripts/editor.vim.test.ts
+++ b/scripts/editor.vim.test.ts
@@ -121,6 +121,45 @@ describe('vim clipboard registers', () => {
 		assert.equal(installVimClipboardRegisters({ Vim: {} }, () => {}), false);
 		assert.equal(installVimClipboardRegisters({ Vim: { defineRegister() {}, getRegisterController: () => undefined } }, () => {}), false);
 	});
+
+	test('Editor.svelte installs the commands on the module it just imported', async () => {
+		// `attachVimMode` is what the editor's `import("monaco-vim").then` runs. It
+		// has to install before `initVimMode` attaches the adapter, and it has to
+		// install even on the disposed path, because the tables it writes to are
+		// the package's and outlive this editor.
+		const { attachVimMode } = await import('../src/lib/utils/vimAttach.js');
+		for (const disposed of [false, true]) {
+			const { VimMode, controller } = await freshVim();
+			const events: string[] = [];
+			const realMapCommand = VimMode.Vim.mapCommand;
+			VimMode.Vim.mapCommand = function (this: unknown, ...args: unknown[]) {
+				events.push(`map ${String(args[0])}`);
+				return realMapCommand.apply(this, args);
+			};
+			const written: unknown[] = [];
+			const invoke = (command: string, args: unknown) => {
+				written.push([command, args]);
+				return Promise.resolve();
+			};
+			const adapter = { dispose() {} };
+			const initVimMode = () => {
+				events.push(controller.isValidRegister('+') ? 'attach with "+' : 'attach without "+');
+				return adapter;
+			};
+
+			const vim = attachVimMode({ initVimMode, VimMode }, {}, {}, invoke, () => disposed);
+			if (disposed) {
+				assert.equal(vim, null, 'a disposed effect attaches nothing');
+				assert.deepEqual(events, ['map zb', 'map z-'], 'a disposed effect still patches the package');
+				assert.equal(controller.isValidRegister('+'), true);
+			} else {
+				assert.equal(vim, adapter, 'the adapter is handed back for disposal');
+				assert.deepEqual(events, ['map zb', 'map z-', 'attach with "+'], 'the commands must be in place before the adapter attaches');
+			}
+			controller.pushText('+', 'yank', 'yanked', false);
+			assert.deepEqual(written, [['clipboard_write_text', { text: 'yanked' }]], '"+ writes through the Rust clipboard');
+		}
+	});
 });
 
 /*
diff --git a/scripts/export.checks.test.ts b/scripts/export.checks.test.ts
index f3fdf673..cc64200d 100644
--- a/scripts/export.checks.test.ts
+++ b/scripts/export.checks.test.ts
@@ -3,9 +3,8 @@ import assert from 'node:assert/strict';
 import { buildExportDocument, exportThemeAttribute } from '../src/lib/utils/export.ts';
 import { DEFAULT_PREVIEW_MAX_WIDTH, MIN_PREVIEW_MAX_WIDTH } from '../src/lib/utils/previewWidth.js';
 import { plainAppearance } from './exportFixtures.ts';
-import { functionSource, offsetOf, readRustBackend, readSource, sliceBetween, sliceFrom } from './sourceTree.js';
+import { offsetOf, readRustBackend, readSource, sliceBetween, sliceFrom } from './sourceTree.js';
 import { collectUsedKatexFamilies, katexFontUrlsToEmbed } from '../src/lib/utils/exportFonts.ts';
-import { ALLOWED_MARKDOWN_URI_REGEXP, MARKDOWN_SANITIZE_CONFIG } from '../src/lib/utils/sanitize.js';
 import { useShimDom } from './preview.domShim.ts';
 
 /**
@@ -31,8 +30,6 @@ describe('exported content width', () => {
 
 	const appStyles = readSource(new URL('../src/styles.css', import.meta.url));
 
-	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-
 	type Rule = { selectors: string[]; declarations: string; media: 'screen' | 'print' };
 
 	type Declaration = { value: string; important: boolean };
@@ -162,30 +159,11 @@ describe('exported content width', () => {
 			appearance: plainAppearance,
 		});
 	}
-
-	test('the exporter is handed the preview\'s own derived width', () => {
-		// The one link in the chain that cannot be executed here: `exportAsHtml`
-		// lives in a `.svelte` component, which the Node test runner cannot import
-		// (see sourceTree.ts). So the field is checked in the source of that one
-		// function — `functionSource` rather than a whole-file match, so a
-		// `contentWidth:` appearing anywhere else in a 3700-line component cannot
-		// satisfy it.
-		const exportCall = functionSource(viewerSource, 'exportAsHtml');
-		assert.match(exportCall, /contentWidth: previewContentWidth,/);
-
-		// And `previewContentWidth` is the same derived value the live preview
-		// renders with, which is what makes "one source of truth" true rather than
-		// merely intended. (preview.test.ts holds the other end of this.)
-		assert.match(viewerSource, /previewContentWidth = \$derived\(getPreviewContentWidth\(settings\.previewMaxWidth, settings\.previewFullWidth\)\)/);
-		assert.match(viewerSource, /--preview-max-width: \{previewContentWidth === null \? '100%' : `\$\{previewContentWidth\}px`\}/);
-	});
 });
 
 describe('folds in print and export', () => {
 	const styles = readSource('src/styles.css');
 
-	const exportSource = readSource('src/lib/utils/export.ts');
-
 	// Both export routes have to agree on what is in the file. The HTML route
 	// decides in TypeScript (it renders every fold open); the print/PDF route
 	// decides in CSS, because it prints the live DOM with its folds still
@@ -526,14 +504,6 @@ describe('folds in print and export', () => {
 		assert.equal(screenValue(nestedCallout, 'transform'), undefined);
 	});
 
-	test('the HTML export renders every heading fold open', () => {
-		// The HTML route never sees the live DOM, it re-renders from source, and
-		// the Set it passes is the fold state that render is given. An empty one is
-		// what makes every section expanded.
-		assert.match(exportSource, /processMarkdownHtml\(safeHtml, ctx\.tabPath, new Set\(\)\)/);
-		assert.doesNotMatch(exportSource, /processMarkdownHtml\([^)]*foldOverrides/);
-	});
-
 	test('a callout collapsed in the source is still readable in an exported file', () => {
 		// The empty Set only governs heading folds. `> [!note]-` puts `is-collapsed`
 		// in the markup itself, so it survives the re-render — and an exported file
@@ -625,104 +595,9 @@ describe('rich content in the HTML export', () => {
 	});
 });
 
-describe('export sanitizing', () => {
-	const exportSource = readSource('src/lib/utils/export.ts');
-
-	const sanitizeSource = readSource('src/lib/utils/sanitize.ts');
-
-	// DOMPurify itself needs a real DOM, which the Node test runner does not have,
-	// so these tests exercise the two halves of the policy that are checkable here:
-	// the URI decision (a pure regexp, applied exactly the way DOMPurify applies it,
-	// see purify.es.mjs line ~1041) and the configuration that decides what the
-	// filter may keep. The behavioural half was verified against the real DOMPurify
-	// build in Chrome: `sanitizeMarkdownHtml(POC)` returns `<img src="x">` — the
-	// event handler, and with it the whole payload, is gone.
-	const ATTR_WHITESPACE = /[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g;
-
-	function uriIsAllowed(value: string): boolean {
-		return ALLOWED_MARKDOWN_URI_REGEXP.test(value.replace(ATTR_WHITESPACE, ''));
-	}
-
-	test('the export sanitizes the rendered document before it touches it', () => {
-		// The regression this pins: `render_markdown` output going into
-		// `processMarkdownHtml` — and from there into the file — without passing
-		// through the shared filter first. Order matters as much as presence: the
-		// sanitizer has to see the untrusted document, not our own generated markup.
-		const sanitizeCall = exportSource.indexOf('const safeHtml = sanitizeMarkdownHtml(rendered);');
-		const processCall = exportSource.indexOf('processMarkdownHtml(safeHtml, ctx.tabPath, new Set())');
-
-		assert.ok(sanitizeCall !== -1, 'export must sanitize the raw render_markdown output');
-		assert.ok(processCall !== -1, 'export must feed the sanitized HTML into processMarkdownHtml');
-		assert.ok(sanitizeCall < processCall, 'sanitization must happen before any Markpad-owned processing');
-
-		// The raw renderer output must not reach any other consumer unfiltered.
-		assert.doesNotMatch(exportSource, /processMarkdownHtml\(\s*rendered\b/);
-		assert.match(exportSource, /import \{ sanitizeMarkdownHtml \} from '\.\/sanitize\.js'/);
-	});
-
-	test('the proof-of-concept payload cannot reach an exported file', () => {
-		// The payload's danger is the handler, not the URI: `x` is an ordinary
-		// relative path and is meant to stay allowed. So nothing about the URI
-		// policy stops this one — two other things do, and both are asserted here,
-		// because on the unfixed export path neither was in the way.
-		//
-		// (`assert.match(POC, /onerror=/)` used to sit here. POC is a template
-		// literal three lines above, so the assertion restated the fixture back to
-		// itself and no change to `src/` could reach it.)
-		assert.equal(uriIsAllowed('x'), true);
-
-		// 1. The renderer output carrying the payload goes through the shared
-		//    filter before anything else touches it, and DOMPurify drops `on*`
-		//    handlers unless the config hands them back. Nothing in the shared
-		//    config does: a future `ADD_ATTR: ['onerror']`, `ALLOWED_ATTR`,
-		//    `ADD_TAGS`, `ALLOW_UNKNOWN_PROTOCOLS` or `SANITIZE_DOM: false` would
-		//    fail the key assertion below.
-		assert.match(exportSource, /const safeHtml = sanitizeMarkdownHtml\(rendered\);/);
-		assert.deepEqual(Object.keys(MARKDOWN_SANITIZE_CONFIG).sort(), ['ALLOWED_URI_REGEXP', 'FORBID_TAGS']);
-		assert.deepEqual(MARKDOWN_SANITIZE_CONFIG.FORBID_TAGS, ['style']);
-		assert.equal(MARKDOWN_SANITIZE_CONFIG.ALLOWED_URI_REGEXP, ALLOWED_MARKDOWN_URI_REGEXP);
-
-		// 2. Even if the filter ever lets something through, the exported document
-		//    itself refuses to run it.
-		assert.match(exportSource, /<meta http-equiv="Content-Security-Policy"/);
-		assert.match(exportSource, /"default-src 'none'"/);
-	});
-
-	test('exported files carry a policy that cannot run script', () => {
-		// Second line of defence: verified in Chrome, an exported page with this
-		// meta tag runs neither an inline `<script>` nor an `onerror` handler even
-		// when the body is left unsanitized, while the copied stylesheet, inline
-		// style attributes, embedded data-URI images and remote https images all
-		// still work.
-		assert.match(exportSource, /<meta http-equiv="Content-Security-Policy" content="\$\{EXPORT_CSP\}">/);
-		assert.match(exportSource, /"default-src 'none'"/);
-		assert.match(exportSource, /"style-src 'unsafe-inline'"/);
-		assert.match(exportSource, /'img-src data: https: http:'/);
-		assert.match(exportSource, /'media-src data: https: http:'/);
-		// Script execution must never be granted back.
-		assert.doesNotMatch(exportSource, /script-src/);
-		assert.doesNotMatch(exportSource, /unsafe-eval/);
-	});
-
-	test('the shared policy forbids author stylesheets', () => {
-		// `<style>` is on DOMPurify's default allowlist and its CSS is not filtered.
-		// In the preview the sanitized HTML is injected into the app's own document,
-		// so a document author's stylesheet is not scoped to the article: it can
-		// hide app chrome or beacon out through `background: url(https://…)`.
-		// Verified in Chrome: with the tag forbidden, an author `<style>` block no
-		// longer applies, and nothing Markpad renders depends on it.
-		assert.ok(MARKDOWN_SANITIZE_CONFIG.FORBID_TAGS.includes('style'));
-		// Inline `style` attributes stay allowed on purpose — documents use them
-		// and `processMarkdownHtml` sets one on media elements.
-		assert.doesNotMatch(sanitizeSource, /FORBID_ATTR/);
-	});
-});
-
 describe('exported theme', () => {
 	const styles = readSource('src/styles.css');
 
-	const exportSource = readSource('src/lib/utils/export.ts');
-
 	/** The opening `<html …>` tag of a built export. */
 	function htmlTag(document: string): string {
 		const match = document.match(/<html[^>]*>/);
@@ -776,10 +651,6 @@ describe('exported theme', () => {
 		assert.match(styles, /@media \(prefers-color-scheme: dark\)/);
 	});
 
-	test('the export reads the theme off the same element the app themes', () => {
-		assert.match(exportSource, /theme: document\.documentElement\.dataset\.theme/);
-	});
-
 	test('a ticked task dims its content once, not once per nesting level', () => {
 		// `opacity` composites rather than inherits, so a rule matching every
 		// descendant multiplies itself down the tree. Words survive that at one or two
@@ -910,21 +781,6 @@ describe('native PDF printing', () => {
 	});
 });
 
-describe('mermaid print theme', () => {
-	test('the PDF export draws the document with the print theme', () => {
-		// Paper is white whatever the screen is wearing, and Mermaid bakes the
-		// theme into the SVG it emits, so the article the print route builds is
-		// rendered with the print theme rather than the app's current one.
-		const exporter = readSource('src/lib/utils/export.ts');
-		const pdf = sliceBetween(exporter, 'export async function exportAsPdf', '\nasync function waitForImages');
-		assert.match(pdf, /mermaidTheme: MERMAID_PRINT_THEME/);
-		assert.match(exporter, /import \{ MERMAID_PRINT_THEME \} from '\.\/mermaidPrint\.js';/);
-		// And the HTML export keeps carrying the author's appearance instead.
-		const html = sliceBetween(exporter, 'export async function exportAsHtml', 'export async function exportAsPdf');
-		assert.doesNotMatch(html, /MERMAID_PRINT_THEME/);
-	});
-});
-
 describe('oversized media in print', () => {
 	const styles = readSource('src/styles.css');
 
@@ -1027,10 +883,6 @@ describe('oversized media in print', () => {
 describe('PDF prints the export article', () => {
 	const styles = readSource('src/styles.css');
 
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	const exporter = readSource('src/lib/utils/export.ts');
-
 	/** The `@media print` block only — not everything that follows it in the file. */
 	function extractPrintBlock(source: string): string {
 		const start = offsetOf(source, '@media print {');
@@ -1047,40 +899,6 @@ describe('PDF prints the export article', () => {
 
 	const printBlock = extractPrintBlock(styles);
 
-	const pdfExport = sliceBetween(exporter, 'export async function exportAsPdf', '\nasync function waitForImages');
-
-	test('a PDF is rendered from the document, not from the window', () => {
-		// `window.print()` over the live window made the paper whatever was on
-		// screen, and every new part of the interface had to be subtracted back out
-		// in the print sheet. Fifteen issues over five months were that list missing
-		// an entry (#668). The article is built the way the HTML export builds it.
-		assert.match(pdfExport, /await buildExportArticle\(/);
-		assert.match(pdfExport, /ctx\.printRoot\.replaceChildren\(\.\.\.Array\.from\(article\.root\.childNodes\)\)/);
-	});
-
-	test('the article is taken down when printing ends, not when the command returns', () => {
-		// `print_pdf` opens the platform print sheet and returns while it is still
-		// up. Clearing the article at that point races the sheet for the page it is
-		// about to render, and losing that race prints nothing at all.
-		assert.match(pdfExport, /addEventListener\('afterprint', \(\) => ctx\.printRoot\.replaceChildren\(\), \{ once: true \}\)/);
-		assert.doesNotMatch(pdfExport, /\} finally \{/);
-		// A platform that never sends the event leaves it mounted, so the next
-		// export has to start from empty rather than print the last document.
-		const reset = offsetOf(pdfExport, 'ctx.printRoot.replaceChildren();');
-		assert.ok(reset < offsetOf(pdfExport, 'await buildExportArticle('), 'the reset happens before the new article is built');
-	});
-
-	test('the document is on the page before the print command runs', () => {
-		// An image that has not decoded prints as an empty box, which is the
-		// failure that looks most like a successful export.
-		const wait = offsetOf(pdfExport, 'waitForImages(ctx.printRoot)');
-		assert.ok(wait < offsetOf(pdfExport, "invoke('print_pdf')"), 'images decode before the native print');
-		assert.ok(wait < offsetOf(pdfExport, "invoke('export_pdf_windows'"), 'and before the Windows PDF writer');
-		// An unreachable image must not hold the export open for ever.
-		const waitHelper = sliceBetween(exporter, 'async function waitForImages', '\n}');
-		assert.match(waitHelper, /setTimeout\(resolve, IMAGE_LOAD_TIMEOUT_MS\)/);
-	});
-
 	test('the print sheet reveals the article and hides everything else', () => {
 		// `#app` is `display: contents`, so the app's markup and the print article
 		// are siblings. Hiding by structure rather than by name is what keeps a
@@ -1117,14 +935,4 @@ describe('PDF prints the export article', () => {
 			);
 		}
 	});
-
-	test('the viewer hands over an article rather than its own preview', () => {
-		assert.match(viewer, /<article id="print-root" class="markdown-body" bind:this=\{printRootEl\}><\/article>/);
-		const pdf = sliceBetween(viewer, 'async function exportAsPdf', '\n	}');
-		assert.match(pdf, /printRoot: printRootEl/);
-		// The preview's own DOM, its fold state and its theme have nothing to do
-		// with what prints now, so nothing refreshes or re-themes it for an export.
-		assert.doesNotMatch(viewer, /syncPreviewForPrint/);
-		assert.doesNotMatch(viewer, /renderDiagramsForPrint/);
-	});
 });
diff --git a/scripts/export.test.ts b/scripts/export.test.ts
index df39e6a6..ff1577bc 100644
--- a/scripts/export.test.ts
+++ b/scripts/export.test.ts
@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { buildExportDocument, exportAsHtml, exportAsPdf, exportContentMaxWidth, exportThemeAttribute } from '../src/lib/utils/export.ts';
 import { DEFAULT_PREVIEW_MAX_WIDTH, getPreviewContentWidth, MAX_PREVIEW_MAX_WIDTH, MIN_PREVIEW_MAX_WIDTH } from '../src/lib/utils/previewWidth.js';
 import { plainAppearance } from './exportFixtures.ts';
+import { exportContextFrom, previewLayout } from '../src/lib/utils/previewLayout.ts';
 import { parseFrontMatter } from '../src/lib/utils/frontMatter.js';
 import { isAssetUrl, normalizeAssetPath, renderStaticFrontMatterPanel, resolveExportImagePath, rewriteMarkdownHrefForExport } from '../src/lib/utils/exportHtml.js';
 import { hasMarkdownLinkExtension, MARKDOWN_LINK_EXTENSIONS, resolveMarkdownTargetPath } from '../src/lib/utils/markdownLinks.js';
@@ -10,9 +11,11 @@ import { askToOpenExportedFile } from '../src/lib/utils/openExportedFile.js';
 import { fontFamilyValue } from '../src/lib/utils/fontFamily.js';
 import { absolutizeKatexFontUrls, collectUsedKatexFamilies, findKatexFontFaces, inlineKatexFontFaces, katexFontUrlsToEmbed } from '../src/lib/utils/exportFonts.ts';
 import { renderRichContent } from '../src/lib/utils/richContent.ts';
+import { resetRichContentCache } from '../src/lib/utils/richContentCache.ts';
 import { ALLOWED_MARKDOWN_URI_REGEXP } from '../src/lib/utils/sanitize.js';
-import { readDiagramSource, rememberDiagramSource, resolveMermaidTheme } from '../src/lib/utils/mermaidPrint.js';
+import { MERMAID_PRINT_THEME, readDiagramSource, rememberDiagramSource, resolveMermaidTheme } from '../src/lib/utils/mermaidPrint.js';
 import { useShimDom } from './preview.domShim.ts';
+import DOMPurify from 'dompurify';
 
 /**
  * #467: "Is there a way how to change the width of exported HTML?" — there was
@@ -737,6 +740,9 @@ describe('rich content in the HTML export', () => {
 	async function runExport(
 		options: { css?: string; theme?: string; mermaidTheme?: string; newlineBreaks?: boolean; rendered?: string } = {},
 	): Promise<ExportRun> {
+		// The KaTeX and highlight memo is module-level: without this, a formula an
+		// earlier test rendered never reaches this run's KaTeX.
+		resetRichContentCache();
 		const record = { mermaidThemes: [] as string[], mathCalls: [] as string[] };
 		const fetched: string[] = [];
 		let saved: { path: string; content: string } | null = null;
@@ -885,6 +891,60 @@ describe('rich content in the HTML export', () => {
 		assert.match(run.document, /<h1 class="foldable-header"[^>]*>.*Notes<\/h1>/);
 	});
 
+	test('the HTML export renders every heading fold open', async () => {
+		// The HTML route never sees the live DOM, it re-renders from source, and
+		// the fold state that render is given is what the file ships with. A
+		// reader of the file has no app to open a collapsed section with.
+		const run = await runExport({ rendered: '<h2 id="a">A</h2>\n<p>first</p>\n<h2 id="b">B</h2>\n<p>second</p>' });
+
+		const article = run.document.slice(run.document.indexOf('<article'));
+		assert.match(article, /class="foldable-content-wrapper"/, 'precondition: the headings were wrapped as folds');
+		assert.doesNotMatch(article, /is-collapsed/);
+	});
+
+	/** DOMPurify as a recorder that drops `on*` handlers, as the real filter does. */
+	function recordingSanitize(seen: string[]) {
+		(DOMPurify as unknown as { sanitize: (html: string) => string }).sanitize = (html: string) => {
+			seen.push(html);
+			return html.replace(/\son\w+="[^"]*"/g, '');
+		};
+	}
+
+	test('the export sanitizes the rendered document before it touches it', async (t) => {
+		// The regression this pins: `render_markdown` output going into
+		// `processMarkdownHtml` — and from there into the file — without passing
+		// through the shared filter first. Order matters as much as presence: the
+		// sanitizer has to see the untrusted document, not our own generated markup.
+		const identity = (DOMPurify as unknown as { sanitize: unknown }).sanitize;
+		t.after(() => {
+			(DOMPurify as unknown as { sanitize: unknown }).sanitize = identity;
+		});
+		const seen: string[] = [];
+		recordingSanitize(seen);
+
+		await runExport();
+
+		assert.equal(seen[0], RENDERED, 'the filter sees the raw render_markdown output first');
+		assert.doesNotMatch(seen[0], /foldable-header/, 'not markup Markpad generated from it');
+	});
+
+	test('the proof-of-concept payload cannot reach an exported file', async (t) => {
+		// The payload's danger is the handler, not the URI: `x` is an ordinary
+		// relative path and is meant to stay allowed. What stops it is that the
+		// renderer output carrying it goes through the shared filter before
+		// anything else, so nothing downstream writes the handler back.
+		const identity = (DOMPurify as unknown as { sanitize: unknown }).sanitize;
+		t.after(() => {
+			(DOMPurify as unknown as { sanitize: unknown }).sanitize = identity;
+		});
+		recordingSanitize([]);
+
+		const run = await runExport({ rendered: '<p>text</p>\n<p><img src="https://example.com/x.png" onerror="alert(1)"></p>' });
+
+		assert.match(run.document, /<img src="https:\/\/example\.com\/x\.png"/, 'precondition: the image itself is exported');
+		assert.doesNotMatch(run.document, /onerror/);
+	});
+
 	test('a document with math carries only the KaTeX fonts it uses', async () => {
 		const run = await runExport();
 
@@ -1146,6 +1206,36 @@ describe('exported theme', () => {
 		assert.match(build('dark', { title: '' }), /<title>Export<\/title>/);
 	});
 
+	test('exported files carry a policy that cannot run script', () => {
+		// Second line of defence behind the sanitizer: verified in Chrome, an
+		// exported page with this policy runs neither an inline `<script>` nor an
+		// `onerror` handler even when the body is left unsanitized, while the
+		// copied stylesheet, inline style attributes, embedded data-URI images and
+		// remote images all still work.
+		const meta = build('dark').match(/<meta http-equiv="Content-Security-Policy" content="([^"]*)">/);
+		assert.ok(meta, 'the export carries a CSP meta tag');
+		const policy = new Map(
+			meta[1].split(';').map((directive) => {
+				const [name, ...values] = directive.trim().split(/\s+/);
+				return [name, values] as const;
+			}),
+		);
+
+		// Script falls back to default-src, so `'none'` there with no script-src
+		// of its own is what keeps every script and handler dead.
+		assert.deepEqual(policy.get('default-src'), ["'none'"]);
+		assert.equal(policy.get('script-src'), undefined);
+		assert.equal(policy.get('script-src-elem'), undefined);
+		assert.equal(policy.get('script-src-attr'), undefined);
+		for (const [name, values] of policy) {
+			assert.ok(!values.includes("'unsafe-eval'"), `${name} must not grant eval`);
+			if (name !== 'style-src') assert.ok(!values.includes("'unsafe-inline'"), `${name} must not grant inline`);
+		}
+		assert.deepEqual(policy.get('style-src'), ["'unsafe-inline'"]);
+		assert.deepEqual(policy.get('img-src'), ['data:', 'https:', 'http:']);
+		assert.deepEqual(policy.get('media-src'), ['data:', 'https:', 'http:']);
+	});
+
 	test('the copied stylesheet and the article still land in the document', () => {
 		const doc = build('dark', { styles: '.sentinel { color: red; }', articleHtml: '<p id="sentinel">hello</p>' });
 		assert.match(doc, /<style>[\s\S]*\.sentinel \{ color: red; \}/);
@@ -1273,3 +1363,174 @@ describe('PDF export result', () => {
 		);
 	});
 });
+
+describe('PDF prints the export article', () => {
+	useShimDom({ window: globalThis, location: { href: 'http://tauri.localhost/' } }, { identitySanitize: true });
+
+	/** A not-yet-decoded image in the print root, loaded when the test says so. */
+	function pendingImage() {
+		const listeners = new Map<string, () => void>();
+		return {
+			complete: false,
+			addEventListener: (type: string, listener: () => void) => listeners.set(type, listener),
+			load: () => listeners.get('load')?.(),
+		};
+	}
+
+	/** Lets every await the export can make without a timer run. */
+	async function settle() {
+		for (let i = 0; i < 20; i += 1) await new Promise((resolve) => setImmediate(resolve));
+	}
+
+	// Drawn diagrams are cached per source and theme, so each print draws a new one.
+	let prints = 0;
+
+	function printPdf(osType: 'windows' | 'macos', images: unknown[] = []) {
+		prints += 1;
+		const log: string[] = [];
+		const mermaidThemes: string[] = [];
+		const afterprint: Array<() => void> = [];
+		(globalThis as any).addEventListener = (type: string, listener: () => void) => {
+			if (type === 'afterprint') afterprint.push(listener);
+		};
+		(globalThis as any).window.__TAURI_INTERNALS__ = {
+			invoke: async (command: string) => {
+				log.push(command);
+				if (command === 'plugin:dialog|save') return 'C:/Docs/notes.pdf';
+				if (command === 'render_markdown') return `<p>body</p>\n<pre><code class="language-mermaid">graph TD; Paper${prints}--&gt;Print;</code></pre>`;
+				if (command === 'print_pdf' || command === 'export_pdf_windows') return null;
+				throw new Error(`unexpected command ${command}`);
+			},
+		};
+		const printRoot = {
+			nodes: [{ textContent: 'the last document' }] as Array<{ textContent: string | null }>,
+			style: { setProperty() {} },
+			replaceChildren(...nodes: Array<{ textContent: string | null }>) {
+				log.push(`printRoot holds ${nodes.length}`);
+				this.nodes = nodes;
+			},
+			querySelectorAll: (selector: string) => (selector === 'img' ? images : []),
+		};
+		const result = exportAsPdf({
+			rawContent: 'body\n',
+			tabTitle: 'Notes',
+			tabPath: 'C:/Docs/notes.md',
+			// What the screen is wearing; paper must not get it.
+			mermaidTheme: 'dark',
+			newlineBreaks: true,
+			libraries: {
+				hljs: { getLanguage: () => null },
+				katex: { renderToString: () => '' },
+				renderMathInElement() {},
+				mermaid: {
+					initialize(config: { theme: string }) {
+						mermaidThemes.push(config.theme);
+					},
+					async render(id: string) {
+						return { svg: `<svg id="${id}"></svg>` };
+					},
+				},
+			} as any,
+			contentWidth: null,
+			appearance: plainAppearance,
+			osType,
+			printRoot: printRoot as any,
+		});
+		const text = () => printRoot.nodes.map((node) => node.textContent ?? '').join('');
+		return { result, log, mermaidThemes, afterprint, text };
+	}
+
+	test('a PDF is rendered from the document, not from the window', async () => {
+		// `window.print()` over the live window made the paper whatever was on
+		// screen (#668). The article is built from the document's source, the way
+		// the HTML export builds it, and is what the print root holds when the
+		// print command runs.
+		const run = printPdf('macos');
+		await run.result;
+		assert.ok(run.log.includes('render_markdown'));
+		assert.match(run.text(), /body/);
+		assert.doesNotMatch(run.text(), /the last document/);
+	});
+
+	test('the PDF export draws the document with the print theme', async () => {
+		// Paper is white whatever the screen is wearing, and Mermaid bakes the
+		// theme into the SVG it emits. (The HTML export keeps the window's theme:
+		// "an exported file contains drawn diagrams, not mermaid source".)
+		const run = printPdf('macos');
+		await run.result;
+		assert.deepEqual(run.mermaidThemes, [MERMAID_PRINT_THEME]);
+	});
+
+	test('the article is taken down when printing ends, not when the command returns', async () => {
+		// `print_pdf` opens the platform print sheet and returns while it is still
+		// up. Clearing the article at that point races the sheet for the page it is
+		// about to render, and losing that race prints nothing at all.
+		const run = printPdf('macos');
+		await run.result;
+		assert.match(run.text(), /body/, 'still mounted after print_pdf returned');
+		assert.equal(run.afterprint.length, 1);
+		run.afterprint[0]();
+		assert.equal(run.text(), '');
+
+		// A platform that never sends the event leaves it mounted, so the next
+		// export starts from empty before it renders anything.
+		assert.ok(run.log.indexOf('printRoot holds 0') < run.log.indexOf('render_markdown'));
+	});
+
+	for (const [osType, command] of [['macos', 'print_pdf'], ['windows', 'export_pdf_windows']] as const) {
+		test(`the document is on the page before ${command} runs`, async () => {
+			// An image that has not decoded prints as an empty box, which is the
+			// failure that looks most like a successful export.
+			const image = pendingImage();
+			const run = printPdf(osType, [image]);
+			await settle();
+			assert.ok(!run.log.includes(command), 'the print waits for the image');
+
+			image.load();
+			await run.result;
+			assert.ok(run.log.includes(command));
+		});
+	}
+
+	test('an image that never loads does not hold the print open', { timeout: 2000 }, async (t) => {
+		t.mock.timers.enable({ apis: ['setTimeout'] });
+		const run = printPdf('macos', [pendingImage()]);
+		await settle();
+		assert.ok(!run.log.includes('print_pdf'));
+
+		t.mock.timers.tick(3000);
+		await run.result;
+		assert.ok(run.log.includes('print_pdf'));
+	});
+});
+
+describe('export context', () => {
+	const doc = { rawContent: '# x', tabTitle: 'x', tabPath: '/x.md', mermaidTheme: 'default' };
+	const appearance = { previewFont: 'Lato', previewFontSize: 16, codeFont: 'Menlo', codeFontSize: 14, highlightColor: 'yellow' };
+	const reading = { isEditing: false, isSplit: false, viewerWidth: 1400 };
+
+	test("the exporter is handed the preview's own derived width", () => {
+		for (const [previewMaxWidth, previewFullWidth] of [
+			[1240, false],
+			[1240, true],
+			['corrupted', false],
+			[99999, false],
+		] as const) {
+			const settings = {
+				...appearance,
+				previewMaxWidth,
+				previewFullWidth,
+				tocSide: 'left' as const,
+				splitEditorSide: 'left' as const,
+				tocWidth: 240,
+				previewNewlineBreaks: true,
+				language: 'en' as const,
+			};
+			const preview = previewLayout(settings, reading);
+			const exported = exportContextFrom(settings, doc).contentWidth;
+			assert.equal(exported, preview.contentWidth, `${previewMaxWidth}/${previewFullWidth}`);
+			// And that is the value the live preview wears as `--preview-max-width`.
+			assert.equal(preview.maxWidthCss, exported === null ? '100%' : `${exported}px`);
+		}
+	});
+});
diff --git a/scripts/keymapHarness.ts b/scripts/keymapHarness.ts
index 48e57cfa..243660d2 100644
--- a/scripts/keymapHarness.ts
+++ b/scripts/keymapHarness.ts
@@ -4,13 +4,10 @@ import { decodeKeybinding, type KeyCodeChord } from 'monaco-editor/esm/vs/base/c
 import { KeyCodeUtils } from 'monaco-editor/esm/vs/base/common/keyCodes.js';
 import { KeyCode } from 'monaco-editor/esm/vs/editor/common/standalone/standaloneEnums.js';
 import { KeyMod } from 'monaco-editor/esm/vs/editor/common/services/editorBaseApi.js';
-import ts from 'typescript';
 
-import { isInFencedCode } from '../src/lib/utils/codeFence.js';
-import { blockEnter, parseListItem, shiftListItem } from '../src/lib/utils/listEditing.js';
-import { tableOperation, tableStep } from '../src/lib/utils/tableEditing.js';
 import { viewerCommandFor, type KeyContext, type ViewerCommand } from '../src/lib/utils/viewerKeymap.js';
-import { readSource, functionSource } from './sourceTree.js';
+import { viewerCommandTable, type ViewerCommandHost } from '../src/lib/utils/viewerCommands.js';
+import { editorActions, editorKeyCommands, type EditorActionDeps, type EditorKeyCommand } from '../src/lib/utils/editorActions.js';
 
 /*
  * RUNNING the app's two keyboard layers, so tests can ask what a chord DOES.
@@ -21,13 +18,12 @@ import { readSource, functionSource } from './sourceTree.js';
  * same extraction, so there is no way for one of them to be checked against a
  * more forgiving model of the app than the other.
  *
- * `registerLocalizedActions` is lifted out of Editor.svelte and RUN; the
- * document-level dispatcher is simply imported, having been moved to
- * `src/lib/utils/viewerKeymap.ts` for that reason. Keybinding numbers come from
- * Monaco's real `KeyMod` and `KeyCode` and are turned back into chords by
- * Monaco's real `decodeKeybinding`, once per operating system. Nothing here
- * matches the components as text, so renaming a local, reordering the actions or
- * rewriting the branch structure changes nothing; changing a KEY does.
+ * Both layers are imported and run: the editor's keymap from
+ * `src/lib/utils/editorActions.ts`, the document-level dispatcher from
+ * `src/lib/utils/viewerKeymap.ts`. Keybinding numbers come from Monaco's real
+ * `KeyMod` and `KeyCode` and are turned back into chords by Monaco's real
+ * `decodeKeybinding`, once per operating system. Changing a KEY changes the
+ * answer; renaming a local does not.
  *
  * WHAT IT DOES NOT ESTABLISH
  *
@@ -89,78 +85,36 @@ type ActionDescriptor = {
 	id: string;
 	label: string;
 	keybindings?: number[];
+	keybindingContext?: string;
 	run: (ed?: unknown) => unknown;
 };
 
 /**
- * Every action `registerLocalizedActions` registers, for one platform.
+ * Every action `editorActions` (utils/editorActions.ts) declares, for one
+ * platform, labelled in English.
  *
- * The function is extracted by name (not by a `sliceBetween` anchor pair, which
- * widens as neighbours are added) and evaluated inside a `with` block whose
- * scope object answers for EVERY free identifier. A dependency the function
- * grows later resolves to a recording stub instead of a ReferenceError, so this
- * harness does not have to be edited every time the component gains a callback
- * — and a stub cannot fake a keybinding, because the keybinding numbers come
- * from the real `KeyMod`/`KeyCode` handed in below.
+ * The keybinding numbers come from Monaco's real `KeyMod`/`KeyCode`. Everything
+ * an action's `run` reaches — the component's editing primitives, `oncommand`,
+ * the settings store — is a recording stub, so `calls` says what running an
+ * action did: `oncommand("new-file")`, `toggleLineMarkerTool("fmt-quote")`,
+ * `settings.toggleWordWrap`.
  */
 export function registeredActions(mac: boolean): { actions: ActionDescriptor[]; calls: string[] } {
-	const source = functionSource(readSource('src/lib/components/Editor.svelte'), 'registerLocalizedActions');
-	const js = ts.transpileModule(source, {
-		compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-	}).outputText;
-
-	const actions: ActionDescriptor[] = [];
 	const calls: string[] = [];
 	const record = (name: string) =>
 		(...args: unknown[]) => {
 			calls.push(args.length ? `${name}(${args.map((a) => JSON.stringify(a)).join(',')})` : name);
 			return undefined;
 		};
+	const recorder = (prefix: string) =>
+		new Proxy({}, { get: (_target, key) => record(`${prefix}${String(key)}`) });
 
-	const known: Record<string, unknown> = {
-		monaco: { KeyMod, KeyCode },
-		editor: {
-			addAction(descriptor: ActionDescriptor) {
-				actions.push(descriptor);
-				return { dispose() {} };
-			},
-			getSelection: () => null,
-			executeEdits: record('executeEdits'),
-			trigger: record('trigger'),
-		},
-		isMacPlatform: () => mac,
-		// `t` is not the real translator on purpose: this file is about keys, and
-		// editor.checks.test.ts already asserts that every one of these
-		// labels comes from the dictionary.
-		t: (key: string) => key,
-		localizedActions: [],
-		disposeLocalizedActions: () => {},
-	};
-
-	const scope = new Proxy(known, {
-		has: () => true,
-		get: (target, property) => {
-			if (typeof property !== 'string') return undefined;
-			if (property in target) return target[property];
-			const stub = record(property);
-			// Callbacks are read as `oncommand?.(…)` and settings as
-			// `settings.toggleWordWrap()`, so the stub has to be callable AND
-			// indexable.
-			return new Proxy(stub, {
-				get: (fn, key) => (key in fn ? (fn as never)[key] : record(`${property}.${String(key)}`)),
-			});
-		},
-	});
+	const deps = new Proxy(
+		{ monaco: { KeyMod, KeyCode }, isMac: mac, settings: recorder('settings.') } as Record<string, unknown>,
+		{ get: (target, key) => (typeof key === 'string' && key in target ? target[key] : record(String(key))) },
+	) as unknown as EditorActionDeps;
 
-	const build = new Function('scope', `with (scope) { ${js}\nreturn registerLocalizedActions; }`) as (
-		s: unknown,
-	) => (lang: string) => void;
-	build(scope)('en');
-
-	assert.ok(
-		actions.length > 20,
-		`registerLocalizedActions registered ${actions.length} actions; the harness is not running the real function`,
-	);
+	const actions = editorActions(deps, 'en') as unknown as ActionDescriptor[];
 	return { actions, calls };
 }
 
@@ -284,240 +238,66 @@ export function documentKeymap(osType: string): Map<Chord, ViewerCommand> {
 }
 
 /**
- * The component's command table: each `ViewerCommand`, and the code
- * `MarkdownViewer.svelte` runs for it.
+ * What each `ViewerCommand` reaching the keyboard does, as the names of the
+ * host members it touched: `'appExit'` for a call, `'settings.previewMaxWidth'`
+ * for a read, `'settings.showTabs='` for a write.
  *
- * THE ONE THING THE SEAM COULD NOT MOVE, and the only text-matching in this
- * file. Deciding WHICH command a chord means is now a pure function that tests
- * import; deciding what `'new-file'` DOES is a switch over the component's own
- * closures — `handleNewFile`, `saveContent`, `getCurrentWindow().close()` — and
- * a closure over component state is the thing that cannot leave a component.
- *
- * The alternative was to pass those eleven functions in as a host object, so
- * that a test could hand over eleven spies. That is the shape #644 rejected for
- * three members and it does not improve at eleven: every caller has to build
- * one, and the test that builds one is describing the component rather than
- * running it. So the seam stops at the command name, and this reads the last
- * inch as text — deliberately, and in one place instead of thirty.
- *
- * What it is NOT is the old `handleKeyDown` extraction. There is no
- * `transpileModule`, no `with`, no scope proxy and therefore no stub that can
- * answer a question nobody asked: the parse yields case labels and body text,
- * every command the dispatcher can reach must have exactly one case, and a
- * command that lost its case is a missing key rather than a silent no-op.
+ * Runs the real `viewerCommandTable` (`viewerCommands.ts`) against a recording
+ * host: any member the table asks for exists and is logged, so a command that
+ * reached for something the host type never had (`addHomeTab`) shows up by
+ * name. The active tab is `'tab-1'`, so split view has a tab to toggle.
  */
-export function viewerCommandTable(): Record<ViewerCommand, string> {
-	const source = functionSource(readSource('src/lib/MarkdownViewer.svelte'), 'runViewerCommand');
-	const table: Record<string, string> = {};
-
-	// `case 'a':` runs of one or more labels, then everything up to the next
-	// `case` or the end of the switch. Stacked labels fall through to one body —
-	// that is how `preview-width-narrower` and `preview-width-wider` share theirs
-	// — so a label with nothing of its own is given the next label's, walking
-	// backwards. Without that the first of a pair maps to the empty string, which
-	// any `doesNotMatch` would pass against.
-	const labels = [...source.matchAll(/\n\t*case '([a-z-]+)':/g)];
-	let shared = '';
-	for (let index = labels.length - 1; index >= 0; index--) {
-		const match = labels[index];
-		const body = source.slice(match.index + match[0].length, labels[index + 1]?.index ?? source.length);
-		shared = body.trim() ? body : shared;
-		table[match[1]] = shared;
-	}
+export function viewerCommandCalls(): Record<ViewerCommand, string[]> {
+	let calls: string[] = [];
+	const recording = (prefix: string, fields: Record<string, unknown>) =>
+		new Proxy(fields, {
+			get(target, prop) {
+				const name = prefix + String(prop);
+				calls.push(name);
+				if (prop in target) return target[prop as string];
+				return () => {
+					calls.push(`${name}()`);
+					return Promise.resolve();
+				};
+			},
+			set(target, prop, value) {
+				calls.push(`${prefix}${String(prop)}=`);
+				target[prop as string] = value;
+				return true;
+			},
+		});
+	const host = recording('', {
+		settings: recording('settings.', { previewFullWidth: true, previewMaxWidth: 880, showTabs: true }),
+		tabManager: recording('tabManager.', { activeTabId: 'tab-1' }),
+	}) as unknown as ViewerCommandHost;
+	const table = viewerCommandTable(host);
 
 	const reachable = new Set<ViewerCommand>();
 	for (const platform of PLATFORMS) for (const command of documentKeymap(platform.osType).values()) reachable.add(command);
+	const result = {} as Record<ViewerCommand, string[]>;
 	for (const command of reachable) {
-		assert.ok(command in table, `runViewerCommand has no case for ${command}, which the keyboard reaches`);
+		calls = [];
+		table[command]();
+		// A call shows up twice, as the read and then the call; keep the call.
+		result[command] = calls.filter((name) => !calls.includes(`${name}()`)).map((name) => name.replace(/\(\)$/, ''));
 	}
-	assert.equal(
-		Object.keys(table).length,
-		reachable.size,
-		`runViewerCommand handles ${Object.keys(table).length} commands, ${reachable.size} are reachable`,
-	);
-	return table as Record<ViewerCommand, string>;
+	return result;
 }
 
 // ------------------------------------- the nameless commands, and their handlers
 
-const EDITOR = 'src/lib/components/Editor.svelte';
 
 /** One `editor.addCommand(binding, handler, when)` call, as Monaco is handed it. */
-export type BareCommand = { binding: number; handler: string; when: string };
+export type BareCommand = EditorKeyCommand;
 
 /**
- * Every bare `addCommand` the editor registers: a keybinding number, the name of
- * the handler, and the `when` clause.
+ * Every bare `addCommand` the editor registers (`editorKeyCommands`): a
+ * keybinding number from Monaco's real `KeyMod`/`KeyCode`, the name of the
+ * handler, and the `when` clause.
  *
  * These are the keys with no action id — Enter, Tab, Shift+Tab, the clipboard
- * chords — so `registeredActions` above cannot see them at all, and neither can
- * anything built on it. Two files need them for different reasons
- * (`editing.test.ts` checks the guards, `shortcuts.test.ts`
- * checks the panel's claims), which is why the extraction lives here rather than
- * in either of them.
- *
- * The arguments are EVALUATED, not matched as text: the keybinding numbers come
- * from Monaco's real `KeyMod`/`KeyCode` and the `when` expression is the string
- * the component computes, template literal and shared constant included. So
- * renaming the constant or reflowing the call changes nothing; changing a key or
- * dropping a guard changes everything.
+ * chords — so `registeredActions` above cannot see them.
  */
 export function bareCommands(): BareCommand[] {
-	const text = readSource(EDITOR);
-	const script = text.slice(text.indexOf('>', text.indexOf('<script')) + 1, text.indexOf('</script>'));
-	const file = ts.createSourceFile('editor.ts', script, ts.ScriptTarget.ES2022, true);
-
-	const constants: Record<string, string> = {};
-	const calls: BareCommand[] = [];
-
-	const evaluate = (expression: string): unknown =>
-		new Function('monaco', 'constants', `with (constants) { return (${expression}); }`)(
-			{ KeyMod, KeyCode },
-			constants,
-		);
-
-	const visit = (node: ts.Node) => {
-		if (
-			ts.isVariableDeclaration(node) &&
-			ts.isIdentifier(node.name) &&
-			node.initializer &&
-			(ts.isStringLiteral(node.initializer) || ts.isTemplateExpression(node.initializer))
-		) {
-			// Best effort: the component is full of template literals built from
-			// component state (`${label}px`), and none of them is a `when` clause.
-			// One that fails to evaluate here is simply not a constant the calls
-			// below can be reading, and an argument that turns out to need it fails
-			// loudly at its own `evaluate`.
-			try {
-				constants[node.name.text] = String(evaluate(node.initializer.getText()));
-			} catch {
-				/* not a constant */
-			}
-		}
-
-		if (
-			ts.isCallExpression(node) &&
-			node.expression.getText() === 'editor.addCommand' &&
-			node.arguments.length === 3
-		) {
-			calls.push({
-				binding: evaluate(node.arguments[0].getText()) as number,
-				handler: node.arguments[1].getText(),
-				when: String(evaluate(node.arguments[2].getText())),
-			});
-		}
-
-		ts.forEachChild(node, visit);
-	};
-	visit(file);
-
-	assert.ok(calls.length >= 5, `found ${calls.length} addCommand calls; the extraction is not running`);
-	return calls;
-}
-
-/** What a handler did to the stub editor it was handed. */
-export type RecordedEdits = {
-	triggers: string[];
-	edits: Array<{ range: number[]; text: string; cursor: number[] }>;
-	/** `setSelection` calls: a caret moved without an edit. */
-	selections: number[][];
-	undoStops: number;
-};
-
-class FakeRange {
-	constructor(
-		readonly startLineNumber: number,
-		readonly startColumn: number,
-		readonly endLineNumber: number,
-		readonly endColumn: number,
-	) {}
-	isEmpty() {
-		return this.startLineNumber === this.endLineNumber && this.startColumn === this.endColumn;
-	}
-	numbers() {
-		return [this.startLineNumber, this.startColumn, this.endLineNumber, this.endColumn];
-	}
-}
-
-/**
- * Component handlers, extracted by name and evaluated against a stub editor.
- *
- * `names` is every function the run needs, entry point LAST — a handler that
- * dispatches through helpers needs the helpers in scope, and naming them makes
- * the dependency visible instead of resolving it with a stub that would happily
- * pass.
- *
- * The list and table modules in scope are the REAL ones, so a handler that
- * stopped calling them — or called them with the wrong column — fails here
- * rather than passing against a second, more agreeable copy.
- */
-export function runEditorHandler(
-	names: string[],
-	options: { lines: string[]; selections: number[][]; eol?: string },
-): RecordedEdits {
-	const recorded: RecordedEdits = { triggers: [], edits: [], selections: [], undoStops: 0 };
-	const eol = options.eol ?? '\n';
-	const selections = options.selections.map((s) => new FakeRange(s[0], s[1], s[2], s[3]));
-
-	const model = {
-		getLineContent: (line: number) => options.lines[line - 1],
-		getLineCount: () => options.lines.length,
-		getLineMaxColumn: (line: number) => options.lines[line - 1].length + 1,
-		getEOL: () => eol,
-		getValueInRange: (range: FakeRange) => {
-			const span = options.lines.slice(range.startLineNumber - 1, range.endLineNumber);
-			span[span.length - 1] = span[span.length - 1].slice(0, range.endColumn - 1);
-			span[0] = span[0].slice(range.startColumn - 1);
-			return span.join(eol);
-		},
-	};
-
-	const scope: Record<string, unknown> = {
-		blockEnter,
-		isInFencedCode,
-		parseListItem,
-		shiftListItem,
-		tableStep,
-		tableOperation,
-		monaco: { Range: FakeRange, Selection: FakeRange },
-		editor: {
-			getModel: () => model,
-			getSelection: () => selections[0],
-			getSelections: () => selections,
-			pushUndoStop: () => {
-				recorded.undoStops += 1;
-			},
-			setSelection: (selection: FakeRange) => {
-				recorded.selections.push(selection.numbers());
-			},
-			trigger: (_source: string, handlerId: string, payload: { text?: string } | null) => {
-				recorded.triggers.push(payload?.text ? `${handlerId}:${JSON.stringify(payload.text)}` : handlerId);
-			},
-			executeEdits: (
-				_source: string,
-				edits: Array<{ range: FakeRange; text: string }>,
-				cursor?: FakeRange[],
-			) => {
-				for (const [index, edit] of edits.entries()) {
-					recorded.edits.push({
-						range: edit.range.numbers(),
-						text: edit.text,
-						cursor: cursor?.[index]?.numbers() ?? [],
-					});
-				}
-			},
-		},
-	};
-
-	const source = readSource(EDITOR);
-	const declarations = names.map((name) => `const ${name} = ${functionSource(source, name)};`).join('\n');
-	const js = ts.transpileModule(declarations, {
-		compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-	}).outputText;
-	const build = new Function('scope', `with (scope) { ${js}\nreturn ${names[names.length - 1]}; }`) as (
-		s: unknown,
-	) => () => void;
-	build(new Proxy(scope, { has: () => true }))();
-
-	return recorded;
+	return editorKeyCommands({ KeyMod, KeyCode } as never);
 }
diff --git a/scripts/layout.checks.spec.ts b/scripts/layout.checks.spec.ts
index 54e925c4..e5122482 100644
--- a/scripts/layout.checks.spec.ts
+++ b/scripts/layout.checks.spec.ts
@@ -1,33 +1,14 @@
-import assert from 'node:assert/strict';
-
 import { describe, expect, test } from 'vitest';
 
 import Toc from '../src/lib/components/Toc.svelte';
 import { readSource } from './sourceTree.js';
 
-describe('split scroll-sync preference', () => {
-	test('the tab store keeps no localStorage of its own', () => {
-		// Both halves: the bare `setItem` the convention rule now forbids outright,
-		// and the constructor's `getItem`, which is the load path that has to move
-		// with it or the two would drift.
-		const tabsSource = readSource('src/lib/stores/tabs.svelte.ts');
-		assert.doesNotMatch(tabsSource, /localStorage\.(?:get|set)Item\s*\(/);
-	});
-});
-
 describe('outline render signal', () => {
-	test('the revision is published by the patch, not by the render', () => {
-		// The guard on the fix: a signal derived from the rendered string rather
-		// than from the write to the DOM is the bug, spelled differently.
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		const patchEffect = viewer.slice(viewer.indexOf('patchPreview(host, '));
-		const bump = patchEffect.indexOf('previewRevision = ++previewPatches;');
-		expect(bump).toBeGreaterThan(-1);
-		expect(bump).toBeLessThan(patchEffect.indexOf('\n\t});'));
-
-		// And the outline no longer receives the document string it never read.
+	test('the outline takes no document string', () => {
+		// The revision itself is layout.spec.ts "the revision is published by the
+		// patch, not by the render". This is the absence of the old signal.
 		const toc = readSource('src/lib/components/Toc.svelte');
 		expect(/htmlContent/.test(toc.split('It used to be')[0])).toBe(false);
 	});
+
 });
diff --git a/scripts/layout.checks.test.ts b/scripts/layout.checks.test.ts
index d51b424a..741473d5 100644
--- a/scripts/layout.checks.test.ts
+++ b/scripts/layout.checks.test.ts
@@ -1,67 +1,29 @@
 import assert from 'node:assert/strict';
 import { describe, test } from 'node:test';
 
-import { asBufferLine, tabAnchorForEditorTopLine } from '../src/lib/utils/lineCoordinates.js';
-import { splitRatioAfterMove } from '../src/lib/utils/splitPanes.ts';
-import { sourceLineOf } from '../src/lib/utils/tocFollow.js';
-import { callbackBodies, functionSource, readSource, sliceBetween } from './sourceTree.js';
-
-describe('scroll sync input', () => {
-	// The effect is identified by what it does — it is the one that reads
-	// `onscrollsync` — not by where its text starts and stops.
-	//
-	// It used to be sliced between `'&& onscrollsync)'` and `'\n\t$effect(() => {'`,
-	// and both halves of that were the same kind of fragile. The start anchor had
-	// already drifted once, silently: the original marker spelled the whole guard
-	// condition, the effect gained an `editorReady &&` term when Monaco moved behind
-	// a dynamic import, and the slice became empty rather than failing — which is
-	// what the shortened anchor and its `notEqual(-1)` were added for. The end
-	// anchor never got that guard, and it depends on the *next* effect being
-	// tab-indented and spelled `$effect(() => {`; write it any other way and this
-	// file silently starts asserting about the rest of the component.
-	const editor = readSource('src/lib/components/Editor.svelte');
-	const syncEffects = callbackBodies(editor, '$effect').filter((body) => body.includes('onscrollsync'));
-	assert.equal(syncEffects.length, 1, `expected exactly one $effect reading onscrollsync (got ${syncEffects.length})`);
-	const syncEffect = syncEffects[0];
-
-	test('typing does not initiate split scroll synchronization', () => {
-		assert.match(syncEffect, /editor\.onDidScrollChange/);
-		assert.doesNotMatch(syncEffect, /onDidChangeCursorPosition/);
-	});
-});
+import { FOLD_TRANSITION_MS } from '../src/lib/utils/foldLayout.js';
+import { readSource } from './sourceTree.js';
 
 describe('split pane ratio', () => {
 	test('the bounds are not re-stated here', () => {
 		// `TabManager.setSplitRatio` clamps. A second copy of 0.1/0.9 in this
-		// module would be the shape where the two answers drift apart.
-		assert.equal(splitRatioAfterMove(0.9, 0.5, 'left'), 1.4);
-		assert.equal(splitRatioAfterMove(0.1, -0.5, 'left'), -0.4);
-
+		// module would be the shape where the two answers drift apart. The drag
+		// against the store's bounds is run in layout.spec.ts; an identical copy is
+		// only visible in the text (lint-candidate).
 		const source = readSource(new URL('../src/lib/utils/splitPanes.ts', import.meta.url));
 		assert.equal(/Math\.(min|max)/.test(source), false);
 	});
 
-	test('both splitter routes take the direction from the same place', () => {
-		// The failure this guards is a splitter that follows the pointer one way
-		// and the arrow keys the other — invisible until someone swaps the panes.
+	test('no splitter route spells the direction itself', () => {
+		// The routes' agreement is layout.test.ts "both splitter routes take the
+		// direction from the same place". This is the absence of a third copy.
 		const viewer = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-
-		const calls = viewer.match(/splitRatioAfterMove\(/g) ?? [];
-		assert.equal(calls.length, 2, 'expected the drag and the arrow keys, and nothing else');
-
-		// No route may reintroduce the sign itself.
 		assert.equal(/splitEditorSide === 'left' \? /.test(viewer), false);
 	});
+
 });
 
 describe('fold layout', () => {
-	test('fold layout observes rendered content and publishes its measured height', () => {
-		const source = readSource('src/lib/utils/foldLayout.ts');
-
-		assert.match(source, /new ResizeObserver/);
-		assert.match(source, /--fold-content-height/);
-		assert.match(source, /requestAnimationFrame/);
-	});
 
 	test('fold wrapper animates an explicit measured height instead of a fractional grid track', () => {
 		const styles = readSource('src/styles.css');
@@ -77,29 +39,18 @@ describe('fold layout', () => {
 	// lands on a target that is still moving — a defect that only shows up as "find
 	// sometimes scrolls to the wrong place".
 	test('the find-bar fold re-aim delay outlasts the CSS fold transition', () => {
-		const findBar = readSource('src/lib/components/FindBar.svelte');
 		const styles = readSource('src/styles.css');
 
-		const declared = findBar.match(/const FOLD_TRANSITION_MS = (\d+);/);
-		assert.ok(declared, 'FindBar.svelte must declare the delay it waits for the fold to settle');
-
 		const expandedRule = styles.match(/\.foldable-content-wrapper\s*\{([^}]*)\}/)?.[1] || '';
 		const transition = expandedRule.match(/transition:[^;]*?height\s+([\d.]+)s/);
 		assert.ok(transition, 'styles.css must animate the fold wrapper height');
 
 		assert.ok(
-			Number(declared[1]) >= Number(transition[1]) * 1000,
-			`FOLD_TRANSITION_MS (${declared[1]}ms) must outlast the ${transition[1]}s height transition`,
+			FOLD_TRANSITION_MS >= Number(transition[1]) * 1000,
+			`FOLD_TRANSITION_MS (${FOLD_TRANSITION_MS}ms) must outlast the ${transition[1]}s height transition`,
 		);
 	});
 
-	test('preview lifecycle starts and cleans up fold observation', () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		assert.match(viewer, /const host = previewBlocks;[\s\S]*?observeFoldLayout\(host\)/);
-		assert.match(viewer, /observation\.stop\(\)/);
-	});
-
 	// The direction the previous spelling could not state. `observeFoldLayout` used
 	// to be handed `markdownBody`, and that was right while the article held one
 	// document; it now holds one `.markdown-blocks` host per open tab, all but one
@@ -121,46 +72,10 @@ describe('fold layout', () => {
 
 		assert.doesNotMatch(
 			viewer,
-			/observeFoldLayout\(\s*markdownBody/,
+			/(?:observeFoldLayout\(|followFoldLayout\(\s*\w+\s*,\s*\(\)\s*=>)\s*markdownBody/,
 			'observing the article would measure every hidden tab and write zero heights into it',
 		);
 	});
-
-	test('fold measurement pauses while the preview pane is hidden by edit mode', () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		assert.match(viewer, /if \(!host \|\| !hasPreviewPane\) return;/);
-		assert.match(viewer, /let hasPreviewPane = \$derived\(!isEditing \|\| isSplit\);/);
-	});
-
-	// The observation used to be torn down and rebuilt on every render, which is
-	// how a document's every fold came to re-measure once per character:
-	// `ResizeObserver.observe` re-registers a target it is already watching, and a
-	// registration delivers an initial observation. What replaced it is a live
-	// observation plus `observe` calls for the blocks the patch inserted, so the
-	// two halves of that have to stay coupled — a viewer that re-observes the whole
-	// host, or a `foldLayout.ts` that only observes from a root, puts the cost back
-	// without changing a single assertion above.
-	test('only newly patched blocks are handed to the fold observer', () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		const foldLayout = readSource('src/lib/utils/foldLayout.ts');
-
-		assert.match(
-			viewer,
-			/for \(const \w+ of patch\.inserted\) foldLayout\?\.observe\(\w+\)/,
-			'the viewer must observe the patched blocks, not the whole preview',
-		);
-		assert.doesNotMatch(
-			viewer,
-			/foldLayout\?\.observe\(host\)/,
-			're-observing the host re-registers every fold in the document',
-		);
-		assert.match(
-			foldLayout,
-			/observe\(scope: Element\)/,
-			'observeFoldLayout must accept a scope smaller than the article',
-		);
-	});
 });
 
 /**
@@ -182,108 +97,9 @@ describe('fold layout', () => {
  * settle and flicker the highlight between two entries.
  */
 describe('outline follows the editor', () => {
-	const tocSource = readSource(new URL('../src/lib/components/Toc.svelte', import.meta.url));
-	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 	const settingsSource = readSource(new URL('../src/lib/stores/settings.svelte.ts', import.meta.url));
 	const settingsComponentSource = readSource(new URL('../src/lib/components/Settings.svelte', import.meta.url));
 
-	/* --------------------------------------------------------------- wiring */
-
-	test('the outline carries a source line for every entry it builds', () => {
-		// Both kinds — headings and block anchors — or the mapping above is asked
-		// about entries it cannot place.
-		assert.match(tocSource, /isBlock: false, line: sourceLineOf\(h\.dataset\.sourcepos\)/);
-		assert.match(tocSource, /isBlock: true, line: sourceLineOf\(el\.dataset\.sourcepos\)/);
-		// The fingerprint decides whether a re-render replaces the items. An edit
-		// that only moves a heading changes nothing else about it, so without the
-		// line in there the outline would keep answering with the old positions.
-		assert.match(tocSource, /newFingerprint = result\.map\(i => `\$\{i\.id\}-\$\{i\.text\}-\$\{i\.level\}-\$\{i\.line\}`\)/);
-	});
-
-	test('a click still wins over the editor, as it does over the preview', () => {
-		// `clickLock` holds the entry the user picked until the jump's smooth scroll
-		// settles. The preview's handler returns early on it; so must this one, or
-		// clicking an entry would highlight it and then lose it to the scroll the
-		// click itself caused.
-		assert.match(tocSource, /const line = activeLine;\s*\n\s*if \(line === null \|\| clickLock\) return;/);
-	});
-
-	test('the editor position reaches the outline whether or not scroll sync is on', () => {
-		// The line is recorded before the sync check, not inside it: following the
-		// editor is not the same feature as moving the preview, and #169 asks for it
-		// in editor-only mode, where there is no preview to move.
-		//
-		// The line is converted on the way in: `position` is in the editor's
-		// numbering and the outline is built from `data-sourcepos`, which counts
-		// from the body. See navigation.checks.test.ts for that boundary.
-		// It goes through `tabAnchorForEditorTopLine`, the crossing the tab's own
-		// reading position takes, so the outline follows the line the reader is
-		// on rather than the one the viewport cuts in half (#744).
-		const handler = functionSource(viewerSource, 'handleEditorScrollSync');
-		const record = handler.indexOf("followToc('editor'");
-		const syncCheck = handler.indexOf('splitScrollSyncOn()');
-
-		assert.ok(record !== -1 && syncCheck !== -1, 'both statements must still be here');
-		assert.ok(record < syncCheck, 'the outline is fed before the sync check, not inside it');
-		assert.match(handler, /followToc\('editor', tabAnchorForEditorTopLine\(lineCoords, asBufferLine\(position\.line\)\)\)/);
-	});
-
-	test('the preview feeds the same state, off the line it already measures', () => {
-		// `getPreviewScrollAnchor` is computed on every preview scroll for the
-		// tab's reading position. Taking the outline's answer from it is what makes
-		// this one rule rather than two — and it costs nothing, because the descent
-		// it does was already happening on that event.
-		const handler = sliceBetween(viewerSource, 'function handleScroll(e: Event)', '\n\tfunction ');
-		assert.match(handler, /const anchorLine = getPreviewScrollAnchor\(target\);/);
-		assert.match(handler, /followToc\('preview', anchorLine\);/);
-		// One input. Which pane feeds it is `followToc`'s call.
-		assert.match(viewerSource, /activeLine=\{tocActiveLine\}/);
-	});
-
-	test('the outline no longer measures the preview to decide', () => {
-		// The loop this replaces did a `querySelector` and a `getBoundingClientRect`
-		// per visible entry on every scroll event, and could only ever answer for
-		// one of the two panes.
-		const handler = sliceBetween(tocSource, 'function handleScroll()', '\n\tfunction ');
-		assert.doesNotMatch(handler, /getBoundingClientRect/);
-		assert.doesNotMatch(handler, /querySelector/);
-		// What it still does: a click leaves a highlight on its target, and the
-		// next scroll takes it off.
-		assert.match(handler, /clearTargetHighlight\(\)/);
-	});
-
-	test('the jump highlight ends on anything that means the reader moved on', () => {
-		// It is a temporary emphasis. Hanging it off scrolling alone made it
-		// permanent whenever that one event did not arrive: the jump's own smooth
-		// scroll is swallowed by `clickLock`, and nothing else scrolls the preview
-		// unless the reader does. A click or a keystroke has to end it too.
-		const clear = sliceBetween(tocSource, 'function clearTargetHighlight()', '\n\tfunction ');
-		assert.match(clear, /classList\.remove\('toc-target-active'\)/, 'one place removes the class');
-		assert.match(clear, /activeTargetEl = null/);
-
-		// And the reader's own actions must not go through the lock, which exists
-		// only to ignore scrolling the app itself caused.
-		const reader = sliceBetween(tocSource, 'function handleReaderAction()', '\n\t}');
-		assert.doesNotMatch(reader, /clickLock/, 'a deliberate action is never locked out');
-		assert.match(reader, /clearTargetHighlight\(\)/);
-
-		for (const [target, event] of [
-			['el', 'pointerdown'],
-			['window', 'keydown'],
-		] as const) {
-			assert.match(
-				tocSource,
-				new RegExp(`${target}\\.addEventListener\\('${event}', handleReaderAction`),
-				`${event} clears it`,
-			);
-			assert.match(
-				tocSource,
-				new RegExp(`${target}\\.removeEventListener\\('${event}', handleReaderAction\\)`),
-				`${event} is detached again`,
-			);
-		}
-	});
-
 	test('there is no preference for it, because the preview never had one', () => {
 		// The outline has always followed the preview unconditionally. This is the
 		// same feature answering for the other pane, so a switch would have made
@@ -291,58 +107,4 @@ describe('outline follows the editor', () => {
 		assert.doesNotMatch(settingsSource, /tocFollowsEditor/);
 		assert.doesNotMatch(settingsComponentSource, /tocFollowsEditor/);
 	});
-
-	test('the current entry is centred in the outline, not merely kept on screen', () => {
-		// `block: 'nearest'` scrolls the least it can: the highlight walked down to
-		// the last visible row and stayed pinned there, and what came next was
-		// never shown. Both callers share this one function, so the preview gets it
-		// too.
-		assert.match(tocSource, /scrollIntoView\(\{ block: 'center', behavior: 'smooth' \}\)/);
-		assert.doesNotMatch(tocSource, /scrollIntoView\(\{ block: 'nearest'/);
-	});
-});
-
-describe('outline jump motion', () => {
-	test('an outline click is a jump, so it asks the same preference', () => {
-		// #199 was reported against the table of contents, and `Toc.svelte` was the
-		// one jump the preference never reached: its `scrollTo` kept a literal
-		// `'smooth'`. `.svelte` files cannot run under `node --test`, so the anchor
-		// is the jump function's text: no second copy of the answer in it.
-		const jumpTo = functionSource(readSource('src/lib/components/Toc.svelte'), 'jumpTo');
-		assert.doesNotMatch(jumpTo, /'smooth'/);
-		assert.match(jumpTo, /jumpScrollBehavior\(/);
-	});
-});
-
-describe('outline overlay placement', () => {
-	test('the outline collapses itself only when it is in the way', () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		// Both auto-collapse paths are gated on the same predicate, so a window wide
-		// enough to hold the outline beside the text keeps the old behaviour.
-		assert.match(viewer, /isOverhanging && !settings\.pinnedToc/);
-		// Click-outside must not fight the toggle button, which owns its own click.
-		assert.match(viewer, /tocToggleEl\?\.contains\(target\)/);
-	});
-
-	test('the outline\'s toggle drops the editor toolbar\'s offset once it is over the outline', () => {
-		// Collapsed, the button floats over the editor pane and `--pane-top-chrome`
-		// is what keeps it clear of the toolbar. Expanded it floats over the OUTLINE,
-		// which has no toolbar — and the offset pushed it onto the outline's first
-		// entry instead. This is an absence, and an absence in CSS is not reachable
-		// from a runtime test in this suite: jsdom applies no stylesheet.
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		const base = viewer.match(/\.toc-toggle-floating \{([^}]*)\}/);
-		assert.ok(base, 'the floating toggle rule moved or was renamed');
-		assert.match(base[1], /top:\s*calc\([^)]*--pane-top-chrome/);
-
-		const expanded = viewer.match(/\.toc-toggle-floating\.expanded \{([^}]*)\}/);
-		assert.ok(expanded, 'the expanded rule moved or was renamed');
-		assert.match(expanded[1], /top:\s*\d+px/);
-		assert.equal(
-			/--pane-top-chrome/.test(expanded[1]),
-			false,
-			'the expanded toggle is over the outline, which has no editor toolbar to clear',
-		);
-	});
 });
diff --git a/scripts/layout.spec.ts b/scripts/layout.spec.ts
index c4396197..774766bd 100644
--- a/scripts/layout.spec.ts
+++ b/scripts/layout.spec.ts
@@ -1,11 +1,21 @@
 import assert from 'node:assert/strict';
 
 import { flushSync, mount, unmount } from 'svelte';
-import { afterAll, afterEach, beforeAll, describe, expect, test } from 'vitest';
+import { afterAll, afterEach, beforeAll, describe, expect, onTestFinished, test, vi } from 'vitest';
 
 import Toc from '../src/lib/components/Toc.svelte';
 import { collapsedFoldsAround, type FoldHost, revealFold, toggleFold, toggleFoldFromClick } from '../src/lib/utils/foldState.js';
 import { runeProps } from './runeProps.svelte.js';
+import { observeFoldLayout, type FoldLayoutObservation } from '../src/lib/utils/foldLayout.js';
+import { splitRatioAfterMove } from '../src/lib/utils/splitPanes.js';
+import { previewLayout } from '../src/lib/utils/previewLayout.js';
+import { dismissesToc, tocAutoCollapses } from '../src/lib/utils/tocOverlay.js';
+import { followFoldLayout, previewPaneShown } from '../src/lib/utils/foldLayoutEffect.svelte.js';
+import { runeEffect } from './runeEffect.svelte.js';
+import { patchHost } from '../src/lib/utils/previewPatch.js';
+import { followPreviewPatch } from '../src/lib/utils/previewPatchEffect.svelte.js';
+import { refreshesPreviewCache } from '../src/lib/utils/previewRefresh.js';
+import { showsHomeScreen } from '../src/lib/utils/homeTab.js';
 
 describe('split scroll-sync preference', async () => {
 	/*
@@ -116,6 +126,23 @@ describe('split scroll-sync preference', async () => {
 		tabManager.setSplitEnabled(id, false);
 		assert.equal(tabManager.splitScrollSyncPreference, true);
 	});
+
+	test('a splitter dragged past the end stops at the store bounds', () => {
+		// The move is unclamped and the store holds 0.1-0.9, so the two cannot
+		// disagree about where the bar stops.
+		reset();
+		const { id, tab } = splitTab('/notes/dragged.md');
+
+		assert.equal(splitRatioAfterMove(0.9, 0.5, 'left'), 1.4);
+		tabManager.setSplitRatio(id, splitRatioAfterMove(0.9, 0.5, 'left'));
+		assert.equal(tab().splitRatio, 0.9);
+
+		assert.equal(splitRatioAfterMove(0.1, -0.5, 'left'), -0.4);
+		tabManager.setSplitRatio(id, splitRatioAfterMove(0.1, -0.5, 'right'));
+		assert.equal(tab().splitRatio, 0.6);
+		tabManager.setSplitRatio(id, splitRatioAfterMove(0.1, -0.5, 'left'));
+		assert.equal(tab().splitRatio, 0.1);
+	});
 });
 
 /**
@@ -972,6 +999,66 @@ describe('outline document passes', () => {
 	});
 });
 
+/*
+ * The viewer's effects call these helpers. Each skips a reactive read the way
+ * the inline condition it replaced did, so the effect does not subscribe to a
+ * value that cannot change its outcome.
+ */
+describe('viewer effect helpers read only what decides them', () => {
+	/** Runs `read` in an effect; returns how many times it has run. */
+	function runs(read: () => void) {
+		let count = 0;
+		const stop = runeEffect(() => {
+			count++;
+			read();
+		});
+		onTestFinished(stop);
+		flushSync();
+		assert.equal(count, 1, 'the effect ran');
+		return () => count;
+	}
+
+	test('split view does not read the outline toggle', () => {
+		const s = runeProps({ isSplit: true, isEditing: true, showToc: false, rawContent: 'x' });
+		const count = runs(() => refreshesPreviewCache(s, () => s.isEditing, () => s.showToc));
+		s.showToc = true;
+		flushSync();
+		assert.equal(count(), 1);
+		s.isSplit = false;
+		flushSync();
+		s.showToc = false;
+		flushSync();
+		assert.equal(count(), 3, 'out of split view the toggle is read');
+	});
+
+	test('the Home overlay does not read the active tab', () => {
+		const s = runeProps({ showHome: true, tab: { path: '/a.md' } as { path: string } | undefined });
+		const count = runs(() => showsHomeScreen(() => s.tab, s.showHome));
+		s.tab = { path: '/b.md' };
+		flushSync();
+		assert.equal(count(), 1);
+	});
+
+	test('a pinned outline does not read the overhang', () => {
+		const s = runeProps({ pinned: true, overhanging: false });
+		const count = runs(() => tocAutoCollapses(() => s.overhanging, s.pinned));
+		s.overhanging = true;
+		flushSync();
+		assert.equal(count(), 1);
+	});
+
+	test('the preview patch does not subscribe to what it reads', () => {
+		const host = document.createElement('div');
+		const s = runeProps({ folds: new Set<string>() });
+		let html = '<p data-sourcepos="1:1-1:1">a</p>';
+		const count = runs(() => patchHost(host, html, () => ({ filePath: '/a.md', foldOverrides: s.folds }), () => {}));
+		html = '<p data-sourcepos="1:1-1:1">b</p>';
+		s.folds = new Set(['x']);
+		flushSync();
+		assert.equal(count(), 1);
+	});
+});
+
 describe('outline render signal', () => {
 	/**
 	 * The outline reads the preview's DOM, so it has to be told when that DOM holds
@@ -1022,3 +1109,222 @@ describe('outline render signal', () => {
 		toc.stop();
 	});
 });
+
+describe('fold layout', () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+		document.body.innerHTML = '';
+	});
+
+	test('fold layout observes rendered content and publishes its measured height', () => {
+		// The wrapper animates `height: var(--fold-content-height)`, so it opens to
+		// the height its content measures, and re-measures when that content
+		// changes size (an image loading, a diagram drawing, the window narrowing).
+		const frames: FrameRequestCallback[] = [];
+		const observers: ResizeObserverCallback[] = [];
+		vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => frames.push(callback));
+		vi.stubGlobal('cancelAnimationFrame', () => {});
+		vi.stubGlobal(
+			'ResizeObserver',
+			class {
+				constructor(callback: ResizeObserverCallback) {
+					observers.push(callback);
+				}
+				observe() {}
+				disconnect() {}
+			},
+		);
+		const runFrames = () => frames.splice(0).forEach((frame) => frame(0));
+
+		document.body.innerHTML =
+			'<div class="markdown-body"><div class="foldable-content-wrapper"><div class="content-inner"><p>x</p></div></div></div>';
+		const root = document.querySelector<HTMLElement>('.markdown-body')!;
+		const wrapper = root.querySelector<HTMLElement>('.foldable-content-wrapper')!;
+		let height = 120;
+		root.querySelector<HTMLElement>('.content-inner')!.getBoundingClientRect = () => ({ height }) as DOMRect;
+
+		const layout = observeFoldLayout(root);
+		runFrames();
+		assert.equal(wrapper.style.getPropertyValue('--fold-content-height'), '120px');
+
+		height = 200;
+		for (const callback of observers) callback([], {} as ResizeObserver);
+		runFrames();
+		assert.equal(wrapper.style.getPropertyValue('--fold-content-height'), '200px');
+		layout.stop();
+	});
+});
+
+describe('fold layout observation', () => {
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	// The fold layout used to be re-measured from the whole article on every
+	// patch, and `ResizeObserver.observe` on a target it already watches
+	// re-registers it and delivers a fresh observation. So a keystroke must hand
+	// the observer only what the patch inserted.
+	test('only newly patched blocks are handed to the fold observer', () => {
+		const observed: Element[] = [];
+		vi.stubGlobal('requestAnimationFrame', () => 0);
+		vi.stubGlobal(
+			'ResizeObserver',
+			class {
+				observe(target: Element) {
+					observed.push(target);
+				}
+				disconnect() {}
+			},
+		);
+		const host = document.createElement('div');
+		document.body.replaceChildren(host);
+		const doc = (last: string) =>
+			[
+				'<h2 data-sourcepos="1:1-1:4">A</h2>',
+				'<p data-sourcepos="3:1-3:1">a</p>',
+				'<h2 data-sourcepos="5:1-5:4">B</h2>',
+				`<p data-sourcepos="7:1-7:1">${last}</p>`,
+			].join('\0\n');
+		const tab = () => ({ filePath: '/docs/a.md', foldOverrides: new Set<string>() });
+		const layout = observeFoldLayout(host);
+
+		patchHost(host, doc('b'), tab, (scope) => layout.observe(scope));
+		const folds = [...host.querySelectorAll('.foldable-content-wrapper > .content-inner')];
+		assert.equal(folds.length, 2);
+		assert.deepEqual(new Set(observed.splice(0)), new Set(folds), 'a first render observes every fold');
+
+		patchHost(host, doc('b, edited'), tab, (scope) => layout.observe(scope));
+		const edited = [...host.querySelectorAll('p')].find((p) => p.textContent === 'b, edited')!;
+		assert.ok(observed.every((target) => edited.contains(target)), 'only the edited block is observed');
+		layout.stop();
+	});
+
+	/** A host with one fold, a recording ResizeObserver, and the effect following it. */
+	function follow(initial: { host: 'a' | 'b' | null; shown: boolean }) {
+		const observed: Element[] = [];
+		let disconnects = 0;
+		vi.stubGlobal('requestAnimationFrame', () => 0);
+		vi.stubGlobal(
+			'ResizeObserver',
+			class {
+				observe(target: Element) {
+					observed.push(target);
+				}
+				disconnect() {
+					disconnects++;
+				}
+			},
+		);
+		const article = document.createElement('article');
+		const fold = '<div class="foldable-content-wrapper"><div class="content-inner"><p>x</p></div></div>';
+		article.innerHTML = `<div id="a">${fold}</div><div id="b" style="display: none">${fold}</div>`;
+		document.body.replaceChildren(article);
+		const hosts = { a: article.querySelector<HTMLElement>('#a')!, b: article.querySelector<HTMLElement>('#b')! };
+		const state = runeProps(initial);
+		const holder: { current: FoldLayoutObservation | null } = { current: null };
+		const dispose = runeEffect(() =>
+			followFoldLayout(holder, () => (state.host ? hosts[state.host] : null), () => state.shown),
+		);
+		flushSync();
+		return { state, holder, hosts, observed, disconnects: () => disconnects, dispose };
+	}
+
+	test('preview lifecycle starts and cleans up fold observation', () => {
+		const run = follow({ host: 'a', shown: true });
+		assert.ok(run.holder.current, 'the observation is published for the patch');
+		assert.deepEqual(run.observed, [run.hosts.a.querySelector('.content-inner')]);
+
+		// Switching tabs moves the observation to the newly visible host.
+		run.state.host = 'b';
+		flushSync();
+		assert.equal(run.disconnects(), 1);
+		assert.equal(run.observed.at(-1), run.hosts.b.querySelector('.content-inner'));
+
+		run.dispose();
+		assert.equal(run.disconnects(), 2);
+		assert.equal(run.holder.current, null);
+	});
+
+	test('fold measurement pauses while the preview pane is hidden by edit mode', () => {
+		assert.equal(previewPaneShown(true, false), false, 'edit mode hides the preview');
+		assert.equal(previewPaneShown(true, true), true, 'split keeps it');
+		assert.equal(previewPaneShown(false, false), true);
+
+		const run = follow({ host: 'a', shown: false });
+		assert.equal(run.holder.current, null);
+		assert.deepEqual(run.observed, []);
+
+		run.state.shown = true;
+		flushSync();
+		assert.ok(run.holder.current);
+		run.state.shown = false;
+		flushSync();
+		assert.equal(run.holder.current, null);
+		assert.equal(run.disconnects(), 1);
+		run.dispose();
+	});
+});
+
+describe('outline overlay placement', () => {
+	test('the outline collapses itself only when it is in the way', () => {
+		const settings = { previewMaxWidth: 880, previewFullWidth: false, tocSide: 'left' as const, splitEditorSide: 'left' as const, tocWidth: 240 };
+		const wide = previewLayout(settings, { isEditing: false, isSplit: false, viewerWidth: 1400 });
+		const narrow = previewLayout(settings, { isEditing: false, isSplit: false, viewerWidth: 1000 });
+		// A window wide enough to hold the outline beside the text keeps it open.
+		assert.equal(tocAutoCollapses(() => wide.isOverhanging, false), false);
+		assert.equal(tocAutoCollapses(() => narrow.isOverhanging, false), true);
+		// Pinned, it is a sidebar and stays.
+		assert.equal(tocAutoCollapses(() => narrow.isOverhanging, true), false);
+
+		// Click-outside must not fight the toggle button, which owns its own click.
+		const panel = document.createElement('nav');
+		const handle = panel.appendChild(document.createElement('div'));
+		const toggle = document.createElement('button');
+		const icon = toggle.appendChild(document.createElement('span'));
+		const text = document.createElement('p');
+		assert.equal(dismissesToc(icon, panel, toggle), false);
+		assert.equal(dismissesToc(handle, panel, toggle), false);
+		assert.equal(dismissesToc(text, panel, toggle), true);
+		assert.equal(dismissesToc(null, panel, toggle), false);
+	});
+});
+
+describe('outline render signal', () => {
+	test('the revision is published by the patch, not by the render', () => {
+		// A signal derived from the rendered string rather than from the write to
+		// the DOM is the bug: on a mount the outline scanned an article the patch
+		// had not filled yet, and the string never changed again to make it look.
+		const state = runeProps({ host: null as HTMLElement | null, html: '<h1>One</h1>' });
+		let published: { readonly revision: number } | null = null;
+		const seen: string[] = [];
+		const dispose = runeEffect(() => {
+			published = followPreviewPatch(
+				() => state.host,
+				() => state.html,
+				(host, html) => (host.innerHTML = html),
+			);
+		});
+		flushSync();
+		const revision = () => published!.revision;
+		const watch = runeEffect(() => {
+			void revision();
+			seen.push(state.host?.textContent ?? '');
+		});
+		flushSync();
+		onTestFinished(() => (watch(), dispose()));
+
+		state.html = '<h1>Two</h1>';
+		flushSync();
+		assert.equal(revision(), 0, 'a render with nowhere to patch it publishes nothing');
+
+		state.host = document.createElement('article');
+		flushSync();
+		assert.equal(revision(), 1);
+		assert.equal(seen.at(-1), 'Two', 'once published, the article already holds the document');
+
+		state.html = '<h1>Three</h1>';
+		flushSync();
+		assert.equal(revision(), 2);
+		assert.equal(seen.at(-1), 'Three');
+	});
+});
diff --git a/scripts/layout.test.ts b/scripts/layout.test.ts
index 75bb9fbc..f7b9d8ef 100644
--- a/scripts/layout.test.ts
+++ b/scripts/layout.test.ts
@@ -4,9 +4,10 @@ import { describe, test } from 'node:test';
 import { asBufferLine, asRendererLine, lineCoordinates, tabAnchorForEditorTopLine } from '../src/lib/utils/lineCoordinates.js';
 import { outwardSign, planPaneSlide } from '../src/lib/utils/paneSlide.js';
 import { getScrollSyncPositionFromPixels, getScrollTopForSyncPosition, type ScrollSyncPosition } from '../src/lib/utils/scrollSync.js';
-import { splitRatioAfterMove } from '../src/lib/utils/splitPanes.ts';
+import { splitRatioAfterDrag, splitRatioAfterKey, splitRatioAfterMove } from '../src/lib/utils/splitPanes.ts';
 import { activeTocIdForLine, sourceLineOf, type TocLineEntry } from '../src/lib/utils/tocFollow.js';
 import { isTocOverhanging, isTocOverPreview } from '../src/lib/utils/tocOverlay.ts';
+import { bindScrollSync } from '../src/lib/utils/editorJumps.js';
 
 describe('scroll sync section mapping', () => {
 	// These tests import and run the mapping. The previous scroll-sync tests read
@@ -218,6 +219,19 @@ describe('split pane ratio', () => {
 		assert.equal(splitRatioAfterMove(0.5, 0.1, 'right'), 0.4);
 		assert.equal(splitRatioAfterMove(0.5, -0.1, 'right'), 0.6);
 	});
+
+	test('both splitter routes take the direction from the same place', () => {
+		// A splitter that follows the pointer one way and the arrow keys the other
+		// is invisible until someone swaps the panes.
+		for (const side of ['left', 'right'] as const) {
+			const dragged = splitRatioAfterDrag(0.5, 400, 450, 1000, side);
+			const keyed = splitRatioAfterKey(0.5, 'ArrowRight', side)!;
+			assert.equal(Math.sign(dragged - 0.5), Math.sign(keyed - 0.5), side);
+			assert.equal(Math.sign(keyed - 0.5), side === 'left' ? 1 : -1, side);
+			assert.equal(Math.sign(splitRatioAfterKey(0.5, 'ArrowLeft', side)! - 0.5), -Math.sign(keyed - 0.5), side);
+		}
+		assert.equal(splitRatioAfterKey(0.5, 'Enter', 'left'), null);
+	});
 });
 
 describe('pane slide on view mode switch', () => {
@@ -706,3 +720,28 @@ describe('outline overlay placement', () => {
 		);
 	});
 });
+
+describe('scroll sync input', () => {
+	test('typing does not initiate split scroll synchronization', () => {
+		// The editor-to-preview sync listens to scrolling. A caret move by itself,
+		// which every keystroke is, must not drag the other pane along.
+		const listeners: Record<string, ((e: unknown) => void)[]> = { scroll: [], cursor: [] };
+		const on = (kind: string) => (listener: (e: unknown) => void) => {
+			listeners[kind].push(listener);
+			return { dispose: () => listeners[kind].splice(listeners[kind].indexOf(listener), 1) };
+		};
+		const editor = { onDidScrollChange: on('scroll'), onDidChangeCursorPosition: on('cursor') };
+		let synced = 0;
+		const binding = bindScrollSync(editor as never, () => synced++);
+
+		for (const listener of listeners.cursor) listener({ position: { lineNumber: 2, column: 4 } });
+		for (const listener of listeners.scroll) listener({ scrollTopChanged: false, scrollLeftChanged: true });
+		assert.equal(synced, 0);
+
+		for (const listener of listeners.scroll) listener({ scrollTopChanged: true });
+		assert.equal(synced, 1);
+
+		binding.dispose();
+		assert.deepEqual(listeners, { scroll: [], cursor: [] });
+	});
+});
diff --git a/scripts/layout.toc.spec.ts b/scripts/layout.toc.spec.ts
new file mode 100644
index 00000000..60addd97
--- /dev/null
+++ b/scripts/layout.toc.spec.ts
@@ -0,0 +1,157 @@
+import assert from 'node:assert/strict';
+
+import { afterEach, describe, onTestFinished, test, vi } from 'vitest';
+
+import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
+import { buildTocEntries, tocFingerprint } from '../src/lib/utils/tocEntries.js';
+
+describe('outline follows the editor', async () => {
+	(window as any).__TAURI_INTERNALS__ = { invoke: async (cmd: string) => (cmd === 'get_os_type' ? 'macos' : null) };
+	const { settings } = await import('../src/lib/stores/settings.svelte.js');
+	const { CLICK_LOCK_MS, TocNavigator } = await import('../src/lib/stores/tocNavigator.svelte.js');
+
+	const DOC =
+		'<h1 id="intro" data-sourcepos="1:1-1:7">Intro</h1>' +
+		'<p data-sourcepos="3:1-3:4">text</p>' +
+		'<span id="^note" class="block-id-anchor" data-label="note" data-sourcepos="5:1-5:4"></span>' +
+		'<h2 data-sourcepos="7:1-7:8"><a class="anchor" id="details"></a>Details</h2>';
+
+	function preview(html = DOC) {
+		const markdownBody = document.createElement('article');
+		markdownBody.innerHTML = html;
+		markdownBody.scrollTo = vi.fn() as any;
+		document.body.replaceChildren(markdownBody);
+		return markdownBody;
+	}
+
+	/** The outline's own list, one button per entry, as Toc.svelte renders it. */
+	function outlineList(ids: string[]) {
+		const container = document.createElement('div');
+		const scrolled: { id: string; options: unknown }[] = [];
+		for (const id of ids) {
+			const button = document.createElement('button');
+			button.dataset.id = id;
+			button.scrollIntoView = ((options: unknown) => scrolled.push({ id, options })) as any;
+			container.append(button);
+		}
+		return { container, scrolled };
+	}
+
+	function setup() {
+		const markdownBody = preview();
+		const items = buildTocEntries(markdownBody);
+		const list = outlineList(items.map((item) => item.id));
+		const outline = new TocNavigator(() => list.container);
+		const stop = outline.listen(markdownBody);
+		onTestFinished(stop);
+		const jump = (id: string) => outline.jumpTo(id, { contentRoot: markdownBody, markdownBody, items });
+		return { markdownBody, items, list, outline, jump };
+	}
+
+	afterEach(() => {
+		vi.useRealTimers();
+	});
+
+	test('the outline carries a source line for every entry it builds', () => {
+		// Both kinds — headings and block anchors — or the mapping above is asked
+		// about entries it cannot place.
+		const entries = buildTocEntries(preview());
+		assert.deepEqual(
+			entries.map((entry) => [entry.id, entry.isBlock, entry.line]),
+			[
+				['intro', false, 1],
+				['^note', true, 5],
+				['details', false, 7],
+			],
+		);
+		// The fingerprint decides whether a re-render replaces the items. An edit
+		// that only moves a heading changes nothing else about it, so without the
+		// line in there the outline would keep answering with the old positions.
+		const moved = buildTocEntries(preview(DOC.replace('7:1-7:8', '9:1-9:8')));
+		assert.notEqual(tocFingerprint(moved), tocFingerprint(entries));
+	});
+
+	test('a click still wins over the editor, as it does over the preview', () => {
+		// `clickLock` holds the entry the user picked until the jump's smooth scroll
+		// settles. Without it, clicking an entry would highlight it and then lose it
+		// to the scroll the click itself caused.
+		vi.useFakeTimers();
+		const { items, outline, jump } = setup();
+		jump('details');
+		outline.follow(asRendererLine(1), () => items);
+		assert.equal(outline.activeId, 'details');
+
+		vi.advanceTimersByTime(CLICK_LOCK_MS);
+		outline.follow(asRendererLine(1), () => items);
+		assert.equal(outline.activeId, 'intro');
+	});
+
+	test('the outline no longer measures the preview to decide', () => {
+		// The loop this replaces did a `querySelector` and a `getBoundingClientRect`
+		// per visible entry on every scroll event.
+		vi.useFakeTimers();
+		const { markdownBody, jump } = setup();
+		jump('intro');
+		vi.advanceTimersByTime(CLICK_LOCK_MS);
+		const target = markdownBody.querySelector('#intro')!;
+		assert.ok(target.classList.contains('toc-target-active'));
+
+		const rect = vi.spyOn(Element.prototype, 'getBoundingClientRect');
+		const query = vi.spyOn(Element.prototype, 'querySelector');
+		try {
+			markdownBody.dispatchEvent(new Event('scroll'));
+			assert.equal(rect.mock.calls.length, 0);
+			assert.equal(query.mock.calls.length, 0);
+		} finally {
+			rect.mockRestore();
+			query.mockRestore();
+		}
+		// What it still does: a click leaves a highlight on its target, and the
+		// next scroll takes it off.
+		assert.ok(!target.classList.contains('toc-target-active'));
+	});
+
+	test('the jump highlight ends on anything that means the reader moved on', () => {
+		// The jump's own smooth scroll is swallowed by the lock, so scrolling alone
+		// would leave it on whenever the reader does not scroll. A pointerdown in the
+		// preview or a keystroke anywhere ends it, and the lock does not apply.
+		vi.useFakeTimers();
+		const { markdownBody, jump } = setup();
+		const target = markdownBody.querySelector('#details')!;
+
+		jump('details');
+		markdownBody.dispatchEvent(new Event('scroll'));
+		assert.ok(target.classList.contains('toc-target-active'), 'the jump’s own scroll keeps it');
+		markdownBody.dispatchEvent(new Event('pointerdown'));
+		assert.ok(!target.classList.contains('toc-target-active'), 'pointerdown clears it');
+
+		jump('details');
+		window.dispatchEvent(new KeyboardEvent('keydown', { key: 'a' }));
+		assert.ok(!target.classList.contains('toc-target-active'), 'keydown clears it');
+	});
+
+	test('the current entry is centred in the outline, not merely kept on screen', () => {
+		// `block: 'nearest'` scrolls the least it can: the highlight walked down to
+		// the last visible row and stayed pinned there.
+		const { items, list, outline } = setup();
+		outline.follow(asRendererLine(7), () => items);
+		assert.equal(outline.activeId, 'details');
+		assert.deepEqual(list.scrolled, [{ id: 'details', options: { block: 'center', behavior: 'smooth' } }]);
+	});
+
+	test('an outline click is a jump, so it asks the same preference', () => {
+		// #199: the outline was the one jump the preference never reached.
+		const original = settings.animateJumpScroll;
+		try {
+			for (const animate of [false, true]) {
+				settings.animateJumpScroll = animate;
+				const { markdownBody, jump } = setup();
+				jump('details');
+				const [[options]] = (markdownBody.scrollTo as any).mock.calls;
+				assert.equal(options.behavior, animate ? 'smooth' : 'auto');
+			}
+		} finally {
+			settings.animateJumpScroll = original;
+		}
+	});
+});
diff --git a/scripts/navigation.checks.test.ts b/scripts/navigation.checks.test.ts
index 0945c798..a098a627 100644
--- a/scripts/navigation.checks.test.ts
+++ b/scripts/navigation.checks.test.ts
@@ -1,30 +1,10 @@
 import assert from 'node:assert/strict';
 import { describe, test } from 'node:test';
 
-import { readSource, functionSource, sliceFrom } from './sourceTree.js';
-import { viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
-import { viewerCommandTable } from './keymapHarness.js';
+import { readSource } from './sourceTree.js';
 
 const { frontMatterLineOffset } = await import('../src/lib/utils/frontMatter.js');
 
-describe('file history', () => {
-	// History is a list of PATHS. `createFileHistory` used to take the tab's
-	// initial content as an ignored second parameter, and all three callers passed
-	// one — which is how `addNewTab` came to seed a history with a content string
-	// in it. A source assertion because that is the whole of what the parameter
-	// was: nothing reads it, so no behaviour can fail when it comes back, and
-	// `Function.length` cannot see an optional one either.
-	test('no caller hands a file history anything but a path', () => {
-		const declaration = readSource('src/lib/utils/tabHistory.ts').match(/export function createFileHistory\([^)]*\)/);
-		assert.ok(declaration);
-		assert.equal(declaration[0], 'export function createFileHistory(path: string)');
-
-		for (const call of readSource('src/lib/stores/tabs.svelte.ts').matchAll(/createFileHistory\([^)]*\)/g)) {
-			assert.doesNotMatch(call[0], /,/, `${call[0]} passes something that is not a path`);
-		}
-	});
-});
-
 describe('preview anchor restore wiring', () => {
 	/**
 	 * The assertions below are source assertions, not behavior assertions: the
@@ -63,138 +43,15 @@ describe('preview anchor restore wiring', () => {
 		assert.doesNotMatch(viewer, /tab\.scrollPercentage/);
 		assert.doesNotMatch(viewer, /Array\.from\(body\.children\)/);
 	});
-
-	/**
-	 * The cold start: the rich-content libraries arrive after the document is
-	 * already in the preview and after the position has been restored against it.
-	 *
-	 * Measured in Chromium — the numbers and the method are in the patch effect's
-	 * comment in `MarkdownViewer.svelte` — the anchored text moves down by up to
-	 * 812px when the enrichment lands, and re-running this cascade afterwards
-	 * brings it back to within 0.8px. jsdom has no layout, so that magnitude cannot
-	 * be asserted here and this is a source assertion like the one above: what it
-	 * pins is that the second restore is wired up at all, and that nothing has
-	 * quietly gone back to the arrangement that had no owner for this case.
-	 */
-	test('a cold start restores again once its enrichment has landed', async () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		// The patch effect is the owner: a host's first enrichment is the one that
-		// imports the libraries its document needs, so it lands after the restore.
-		assert.match(
-			viewer,
-			/const cold = patch\.inserted\.length > 0 && !enrichedHosts\.has\(host\)/,
-			'the patch effect must recognise the first enrichment of a host',
-		);
-		assert.match(
-			viewer,
-			/if \(cold\) restoreAfterColdEnrichment\(/,
-			'and only that run may re-restore, or every no-op patch would move the reader',
-		);
-
-		// The restore itself goes through the shared cascade, waits for the
-		// enrichment, and speaks only for the tab still on screen.
-		const helper = viewer.match(
-			/async function restoreAfterColdEnrichment\([\s\S]*?\n\t\}/,
-		)?.[0];
-		assert.ok(helper, 'restoreAfterColdEnrichment must exist');
-		assert.match(helper, /await enrichment;/);
-		assert.match(helper, /tabManager\.activeTabId !== tabId/);
-		assert.match(helper, /restorePreviewReadingPosition\(body, tab,/);
-
-		// And the accident that used to stand in for it must not come back. The
-		// theme effect's `renderRichContent()` reads reactive state before its
-		// first await, so without `untrack` that effect re-runs on unrelated
-		// changes — re-enriching every open tab's host on top of the pass above.
-		//
-		// Matched on the `untrack`, not on the guard beside it: the guard was
-		// `markdownBody && !isEditing` when this was written and is `markdownBody`
-		// alone now (scripts/preview.spec.ts owns that question). What
-		// this test is for is the tracking.
-		assert.match(
-			viewer,
-			/untrack\(\(\) => \{? ?if \(markdownBody\) renderRichContent\(\);/,
-			'the theme effect must depend on the theme, not on the libraries arriving',
-		);
-	});
 });
 
 describe('jump to the selected fragment wiring', () => {
-	const editorSource = readSource(new URL('../src/lib/components/Editor.svelte', import.meta.url));
 	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 
-	/* ------------------------------------------------------------------ */
-	/* the jump itself                                                     */
-	/* ------------------------------------------------------------------ */
-
-	test('the outline and the context menu share one line-to-editor jump', () => {
-		// `revealHeader` used to reveal and select the line itself. Leaving that
-		// copy in place while #90 grew a second one is the drift
-		// release.checks.test.ts exists to catch: the two would
-		// scroll differently, focus differently, and only one of them would clamp.
-		const revealHeader = functionSource(editorSource, 'revealHeader');
-		assert.match(revealHeader, /revealSourceRange\(lineNumber, lineNumber, 'top'\)/);
-		assert.doesNotMatch(revealHeader, /setSelection\(\{[\s\S]*?startColumn: 1/);
-	});
-
-	test('the jump clamps to the buffer before asking Monaco for a column', () => {
-		// `getLineMaxColumn` throws past the end of the model, and the preview can
-		// hand over a stale line: its HTML is the render of a buffer that may have
-		// been replaced by a shorter one since.
-		const reveal = functionSource(editorSource, 'revealSourceRange');
-		assert.match(reveal, /lastLine = model\.getLineCount\(\)/);
-		assert.match(reveal, /end = Math\.min\([^\n]*lastLine\)/);
-		assert.doesNotMatch(reveal, /getLineMaxColumn\((?!end\))/);
-	});
-
-	test('a jump asked for before Monaco has loaded is queued, not dropped', () => {
-		// `monaco-editor` is imported dynamically, so the editor exists several
-		// frames after the component does — and the preview calls in immediately
-		// after flipping into edit mode.
-		const reveal = functionSource(editorSource, 'revealSourceRange');
-		assert.match(reveal, /if \(!editorReady \|\| !editor\) \{\s*\n\s*pendingReveal = \{ startLine, endLine, placement \};/);
-
-		// Spent after the view-state / anchor-line restore, so an explicit "edit
-		// this fragment" wins over the position the tab was left at.
-		const afterReady = sliceFrom(editorSource, 'editorReady = true;');
-		assert.ok(
-			afterReady.indexOf('pendingReveal') < afterReady.indexOf('return () => {'),
-			'the queued jump must be spent inside onMount, before the teardown closure',
-		);
-	});
-
 	/* ------------------------------------------------------------------ */
 	/* the context menu wiring                                             */
 	/* ------------------------------------------------------------------ */
 
-	test('the Edit entry resolves its target while the selection still exists', () => {
-		// Resolving inside the `onClick` would read the selection AFTER the reader
-		// clicked a menu item, and a click is how a selection goes away.
-		const handler = functionSource(viewerSource, 'handleContextMenu');
-		assert.match(handler, /const editSourceTarget = getContextMenuSourceRange\(e\);/);
-		assert.match(handler, /t\('menu\.edit', settings\.language\), onClick: \(\) => editSourceRange\(editSourceTarget\)/);
-		assert.doesNotMatch(handler, /onClick: \(\) => toggleEdit\(\)/);
-	});
-
-	test('Edit with a target never leaves edit mode', () => {
-		// In split view the editor is already on screen, and "edit this fragment"
-		// is the one thing that cannot mean "close the editor".
-		const edit = functionSource(viewerSource, 'editSourceRange');
-		assert.match(edit, /if \(!isEditing\) await toggleEdit\(\)/, 'entered only when not already editing');
-		// And a read that failed leaves the tab in reading mode — arming the jump
-		// anyway would fire it at whatever document is edited next.
-		assert.match(edit, /tabManager\.activeTab\?\.isEditing/);
-	});
-
-	test('the target is a source range and never a column', () => {
-		// `parseSourceposLineRange` is the only reader of the attribute, and it
-		// keeps line numbers only. Nothing in the preview may take the `:col` half
-		// and aim Monaco with it — see the header of this file for why.
-		const resolve = functionSource(viewerSource, 'getContextMenuSourceRange');
-		assert.match(resolve, /findSourceLineRange\(/);
-		assert.doesNotMatch(resolve, /startColumn|endColumn/);
-	});
-
 	test('the real stress document shifts by its front matter', () => {
 		// The fixture the reporter of the offset was reading: 10 lines of front
 		// matter plus the blank line after it, heading on buffer line 12.
@@ -203,55 +60,6 @@ describe('jump to the selected fragment wiring', () => {
 		assert.equal(raw.split('\n')[11], '# Markdown Reader Stress Test');
 	});
 
-	test('every renderer line reaching the editor goes through the shift', () => {
-		// Two consumers hand a `data-sourcepos` number to the editor, and both have
-		// to shift it. `toggleEditView` is not a third: it resolves the range and
-		// passes it to `editSourceRange`, which is where the shift happens.
-		const edit = functionSource(viewerSource, 'editSourceRange');
-		assert.match(edit, /pendingEditReveal = lineCoords\.toBufferRange\(range\)/, 'the context menu and ⌘E shift');
-
-		// The outline is wired inline in the markup rather than in a function.
-		assert.match(
-			viewerSource,
-			/editorPane\.revealHeader\(\s*sourceLine === null \? null : lineCoords\.toBufferLine\(/,
-			'the outline shifts',
-		);
-	});
-
-	// Scroll sync crosses the same boundary in BOTH directions, and it was the
-	// consumer this file forgot: `ScrollSyncPosition.line` is a buffer line,
-	// because the editor is the only pane that can produce one, while everything
-	// the preview answers with counts from the body. On a document with front
-	// matter the panes drifted apart by exactly that many lines — a constant
-	// offset, unaffected by how precise the block mapping underneath got.
-
-	test('scroll sync converts in both directions', () => {
-		const capture = functionSource(viewerSource, 'getPreviewScrollSyncPosition');
-		assert.match(
-			capture,
-			/lineCoords\.bufferLineAtPreviewOffset\(/,
-			'a line read off the preview is shifted before the editor sees it',
-		);
-
-		const apply = functionSource(viewerSource, 'scrollPreviewToSyncPosition');
-		assert.match(
-			apply,
-			/lineCoords\.previewOffsetForBufferLine\(/,
-			'a line coming from the editor is shifted back before the preview seeks',
-		);
-	});
-
-	test('the outline is fed body lines from both panes', () => {
-		// `tocActiveLine` has two writers. The preview's already answers in body
-		// lines (`getPreviewScrollAnchor`); the editor's has to be converted, or the
-		// highlighted heading changes depending on which pane you scrolled.
-		const fromEditor = functionSource(viewerSource, 'handleEditorScrollSync');
-		assert.match(fromEditor, /followToc\('editor', tabAnchorForEditorTopLine\(lineCoords, asBufferLine\(position\.line\)\)\)/);
-
-		const fromPreview = functionSource(viewerSource, 'getPreviewScrollAnchor');
-		assert.doesNotMatch(fromPreview, /toBufferLine|toRendererLine/, 'already a body line');
-	});
-
 	test('the shift reads the buffer, not the rendered body', () => {
 		// `lineCoordinates(rawContent)` — measuring the render would answer 0
 		// forever, since the render is what the front matter was stripped out of.
@@ -260,62 +68,4 @@ describe('jump to the selected fragment wiring', () => {
 		assert.match(viewerSource, /let lineCoords = \$derived\(lineCoordinates\(rawContent\)\)/);
 		assert.equal(viewerSource.match(/lineCoordinates\(/g)?.length, 1);
 	});
-
-	// The menu is opened BY right-clicking a selection, and two of its items act
-	// on that selection (Copy, Edit). Anything that moves focus off the document
-	// stops the selection being painted, so the highlight disappears under the
-	// menu that exists to act on it.
-
-	test('the context menu does not take focus away from the selection', () => {
-		const menuSource = readSource('src/lib/components/ContextMenu.svelte');
-		assert.doesNotMatch(menuSource, /\.focus\(\)/, 'focusing the menu unpaints the selection');
-
-		// Escape still closes it — from the window, since the menu never has focus.
-		assert.match(menuSource, /window\.addEventListener\('keydown'/);
-		assert.match(menuSource, /e\.key === 'Escape'/);
-	});
-
-	test('the selection is read before anything switches mode', () => {
-		// `toggleEdit` and `editSourceRange` both flip `isEditing`, and a selection
-		// read after that would answer for the editor rather than for the preview
-		// the reader was looking at.
-		const view = functionSource(viewerSource, 'toggleEditView');
-		assert.match(view, /const selected = getSelectionSourceRange\(\);/);
-		assert.ok(
-			view.indexOf('const selected') < view.indexOf('toggleEdit()'),
-			'resolved first, then the mode changes',
-		);
-	});
-
-	test('one function owns what ⌘E means, and every entry point uses it', () => {
-		// The hotkey, the toolbar, the title bar and Monaco's own command all route
-		// here, so the chord cannot mean one thing with the caret in the editor and
-		// another with it in the preview — which is what
-		// `shortcuts.checks.test.ts` pins from the other side.
-		// The chord is a call now, not a pattern: the branch structure moved to
-		// `viewerKeymap.ts` and #647 had already shown what the old spelling cost —
-		// five assertions of this shape went red for a renamed local.
-		assert.equal(
-			viewerCommandFor(
-				{ key: 'e', code: 'KeyE', ctrlKey: true, metaKey: false, shiftKey: false, altKey: false },
-				{ mode: 'app', osType: 'windows', isSplit: false, overlayOpen: false, dialogOpen: false, isEditing: false, editorHasFocus: false },
-			),
-			'toggle-edit-view',
-		);
-		assert.match(viewerCommandTable()['toggle-edit-view'], /toggleEditView\(\)/);
-		// The editor entry point hands Monaco's ⌘E to the same switch.
-		assert.match(viewerSource, /oncommand=\{runViewerCommand\}/, 'the editor entry point');
-		// The title bar's Edit button, now one of three mode buttons (#806).
-		assert.match(functionSource(viewerSource, 'setViewMode'), /target === 'edit' \? toggleEditView\(\)/);
-	});
-
-	test('split view with nothing selected is deliberately inert', () => {
-		// The editor is already on screen, so the ability ⌘E asks for is already
-		// granted; with no selection there is nothing to travel to either. Closing
-		// the preview would be a layout change nobody asked for, and a mistyped ⌘E
-		// would cost the reader the pane.
-		const view = functionSource(viewerSource, 'toggleEditView');
-		assert.match(view, /if \(isSplit && !selected\) \{[\s\S]*?return;/);
-		assert.doesNotMatch(view, /setSplitEnabled/, 'the chord never changes the layout');
-	});
 });
diff --git a/scripts/navigation.spec.ts b/scripts/navigation.spec.ts
index 3d4dc78f..c2357631 100644
--- a/scripts/navigation.spec.ts
+++ b/scripts/navigation.spec.ts
@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { flushSync, mount, unmount } from 'svelte';
 import { afterAll, beforeAll, describe, test } from 'vitest';
 
 import { anchorScrollTop, previewZoomFactor, PREVIEW_ANCHOR_OFFSET } from '../src/lib/utils/previewAnchor.js';
@@ -30,6 +31,7 @@ const {
 	tabAnchorForEditorTopLine,
 	EDITOR_ANCHOR_LINE_OFFSET,
 } = await import('../src/lib/utils/lineCoordinates.js');
+const { default: ContextMenu } = await import('../src/lib/components/ContextMenu.svelte');
 
 describe('anchor jump under zoom', () => {
 	/*
@@ -1440,3 +1442,39 @@ describe('tab anchor across panes', () => {
 		tabManager.updateTabAnchorLine(tab.id, 812);
 	});
 });
+
+describe('the preview context menu', () => {
+	// The menu is opened BY right-clicking a selection, and two of its items act
+	// on that selection (Copy, Edit). Anything that moves focus off the document
+	// stops the selection being painted, so the highlight disappears under the
+	// menu that exists to act on it.
+	test('the context menu does not take focus away from the selection', () => {
+		const selected = document.createElement('textarea');
+		selected.value = 'some selected text';
+		document.body.append(selected);
+		selected.focus();
+		selected.setSelectionRange(5, 13);
+
+		let hidden = 0;
+		const target = document.createElement('div');
+		document.body.append(target);
+		const menu = mount(ContextMenu, {
+			target,
+			props: { show: true, x: 10, y: 10, items: [{ label: 'Copy', onClick: () => {} }], onhide: () => hidden++ },
+		});
+		flushSync();
+		try {
+			assert.ok(target.querySelector('.context-menu'), 'the menu is open');
+			assert.equal(document.activeElement, selected, 'focusing the menu unpaints the selection');
+			assert.deepEqual([selected.selectionStart, selected.selectionEnd], [5, 13]);
+
+			// Escape still closes it — from the window, since the menu never has focus.
+			selected.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+			assert.equal(hidden, 1, 'Escape closes the menu without it having focus');
+		} finally {
+			unmount(menu);
+			target.remove();
+			selected.remove();
+		}
+	});
+});
diff --git a/scripts/navigation.test.ts b/scripts/navigation.test.ts
index f613566c..ad50484c 100644
--- a/scripts/navigation.test.ts
+++ b/scripts/navigation.test.ts
@@ -12,6 +12,10 @@ import {
 } from '../src/lib/utils/tabHistory.js';
 import { getMarkdownLinkTarget, isOpenInNewTabMarkdownTarget, resolveMarkdownTargetPath } from '../src/lib/utils/markdownLinks.js';
 import { jumpScrollBehavior } from '../src/lib/utils/motion.js';
+import { EditorJumps, type JumpEditor } from '../src/lib/utils/editorJumps.js';
+import { asBufferLine } from '../src/lib/utils/lineCoordinates.js';
+import { viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
+import { viewerCommandCalls } from './keymapHarness.js';
 
 describe('file history and markdown link targets', () => {
 	test('new file tabs start history with their path', () => {
@@ -21,6 +25,16 @@ describe('file history and markdown link targets', () => {
 		});
 	});
 
+	// History is a list of PATHS. `createFileHistory` used to take the tab's
+	// initial content as an ignored second parameter, which is how `addNewTab`
+	// came to seed a history with a content string in it. Nothing reads such a
+	// parameter, so only the type checker can refuse it: with it back, this
+	// directive is unused and `npm run check` fails.
+	test('no caller hands a file history anything but a path', () => {
+		// @ts-expect-error a history is built from a path alone
+		assert.deepEqual(createFileHistory('/notes/a.md', '# a'), { history: ['/notes/a.md'], historyIndex: 0 });
+	});
+
 	// Entries exist to be re-opened, and an untitled buffer cannot be. See the
 	// behaviour this protects in scripts/navigation.spec.ts.
 	test('an untitled tab starts with no history entry at all', () => {
@@ -151,3 +165,161 @@ describe('jump scroll motion', () => {
 		assert.equal(jumpScrollBehavior(false), 'auto');
 	});
 });
+
+describe('jump to the selected fragment', () => {
+	/** A Monaco editor over `lines`, recording what a jump does to it. */
+	function fakeEditor(lines: string[]) {
+		const log: unknown[] = [];
+		const model = {
+			getLineCount: () => lines.length,
+			getLineMaxColumn: (line: number) => {
+				// Monaco throws here too, for a line past the end of the model.
+				if (line < 1 || line > lines.length) throw new Error(`Illegal value for lineNumber: ${line}`);
+				return lines[line - 1].length + 1;
+			},
+			findNextMatch: () => null,
+		};
+		const editor = {
+			getModel: () => model,
+			revealLineNearTop: (line: number) => log.push(['top', line]),
+			revealLineInCenterIfOutsideViewport: (line: number) => log.push(['center', line]),
+			setSelection: (selection: unknown) => log.push(['select', selection]),
+			focus: () => log.push(['focus']),
+		} as unknown as JumpEditor;
+		return { editor, log };
+	}
+
+	function jumps(editor: JumpEditor, state = { ready: true }) {
+		return new EditorJumps({
+			monaco: () => ({ editor: { ScrollType: { Smooth: 0, Immediate: 1 } } }) as never,
+			editor: () => editor,
+			ready: () => state.ready,
+			scrollTo: () => {},
+		});
+	}
+
+	const lines = ['# One', 'text', '## Two'];
+
+	test('the outline and the context menu share one line-to-editor jump', () => {
+		// `revealHeader` used to reveal and select the line itself. A second copy
+		// next to #90's would scroll differently, focus differently, and only one
+		// of them would clamp.
+		for (const line of [3, 40]) {
+			const outline = fakeEditor(lines);
+			const contextMenu = fakeEditor(lines);
+			jumps(outline.editor).revealHeader(asBufferLine(line), 'Two');
+			jumps(contextMenu.editor).revealSourceRange(line, line, 'top');
+			assert.deepEqual(outline.log, contextMenu.log, `line ${line}`);
+		}
+	});
+
+	test('the jump clamps to the buffer before asking Monaco for a column', () => {
+		// The preview can hand over a stale line: its HTML is the render of a
+		// buffer that may have been replaced by a shorter one since.
+		const { editor, log } = fakeEditor(lines);
+		jumps(editor).revealSourceRange(50, 60);
+		assert.deepEqual(log, [
+			['center', 3],
+			['select', { startLineNumber: 3, startColumn: 1, endLineNumber: 3, endColumn: 7 }],
+			['focus'],
+		]);
+	});
+
+	test('a jump asked for before Monaco has loaded is queued, not dropped', () => {
+		// `monaco-editor` is imported dynamically, so the editor is ready several
+		// frames after the component exists, and the preview calls in right after
+		// flipping into edit mode.
+		const { editor, log } = fakeEditor(lines);
+		const state = { ready: false };
+		const pane = jumps(editor, state);
+		pane.revealSourceRange(2, 2);
+		assert.deepEqual(log, []);
+
+		state.ready = true;
+		pane.spendPending();
+		assert.deepEqual(log, [
+			['center', 2],
+			['select', { startLineNumber: 2, startColumn: 1, endLineNumber: 2, endColumn: 5 }],
+			['focus'],
+		]);
+
+		pane.spendPending();
+		assert.equal(log.length, 3, 'a queued jump is spent once');
+	});
+});
+
+describe('preview scroll sync across the front matter', async () => {
+	const { asBufferLine, lineCoordinates } = await import('../src/lib/utils/lineCoordinates.js');
+	const { getPreviewScrollAnchor, getPreviewScrollSyncPosition, getPreviewScrollTopForSyncPosition } = await import(
+		'../src/lib/utils/previewScrollSync.js'
+	);
+	const { PREVIEW_ANCHOR_OFFSET } = await import('../src/lib/utils/previewAnchor.js');
+	type PreviewScroller = import('../src/lib/utils/previewScrollSync.js').PreviewScroller;
+
+	// Scroll sync crosses the line boundary in BOTH directions:
+	// `ScrollSyncPosition.line` is a buffer line, because the editor is the only
+	// pane that can produce one, while everything the preview answers with
+	// counts from the body. On a document with front matter the panes drifted
+	// apart by exactly that many lines.
+	const FRONT_MATTER = 3;
+	const coords = lineCoordinates('---\na: 1\n---\n# body\n');
+
+	type FakeBlock = { nodeType: 1; tagName: string; childNodes: FakeBlock[]; getAttribute: (n: string) => string | null; top: number; height: number };
+	const block = (line: number, top: number, height: number): FakeBlock => ({
+		nodeType: 1,
+		tagName: 'P',
+		childNodes: [],
+		getAttribute: (name) => (name === 'data-sourcepos' ? `${line}:1-${line}:10` : null),
+		top,
+		height,
+	});
+	/** Body lines 1, 5 and 9, and no front matter panel. */
+	const SCROLL_MAX = 800;
+	function preview(scrollTop: number) {
+		return {
+			nodeType: 1,
+			tagName: 'DIV',
+			childNodes: [block(1, 100, 40), block(5, 300, 40), block(9, 500, 60)],
+			getAttribute: () => null,
+			scrollTop,
+			querySelector: () => null,
+		} as unknown as PreviewScroller;
+	}
+	const measure = (node: unknown) => ({ top: (node as FakeBlock).top, height: (node as FakeBlock).height });
+
+	test('scroll sync converts in both directions', () => {
+		// The preview at body line 5 tells the editor buffer line 8.
+		const captured = getPreviewScrollSyncPosition(preview(300), SCROLL_MAX, coords, measure);
+		assert.equal(captured.section, 'body');
+		assert.equal(captured.line, 5 + FRONT_MATTER, 'a line read off the preview is shifted before the editor sees it');
+
+		// And the editor at buffer line 8 puts the preview on body line 5.
+		const target = getPreviewScrollTopForSyncPosition(preview(0), SCROLL_MAX, { section: 'body', ratio: 0, line: asBufferLine(5 + FRONT_MATTER) }, coords, measure);
+		assert.equal(target, 300, 'a line coming from the editor is shifted back before the preview seeks');
+	});
+
+	test("the preview's reading position is already a body line", () => {
+		// The outline and the tab's anchor both count from the body, so the
+		// preview's answer is not shifted.
+		assert.equal(getPreviewScrollAnchor(preview(300 - PREVIEW_ANCHOR_OFFSET), measure), 5);
+	});
+});
+
+describe('edit view toggle', () => {
+	test('one function owns what ⌘E means, and every entry point uses it', () => {
+		// The hotkey, the toolbar, the title bar and Monaco's own command all route
+		// to `toggleEditView`, so the chord cannot mean one thing with the caret in
+		// the editor and another with it in the preview. The title bar's Edit button
+		// runs in navigation.viewMode.spec.ts. The viewer passing `runViewerCommand`
+		// as the editor's `oncommand` prop is not tested: it needs MarkdownViewer
+		// mounted.
+		assert.equal(
+			viewerCommandFor(
+				{ key: 'e', code: 'KeyE', ctrlKey: true, metaKey: false, shiftKey: false, altKey: false },
+				{ mode: 'app', osType: 'windows', isSplit: false, overlayOpen: false, dialogOpen: false, isEditing: false, editorHasFocus: false },
+			),
+			'toggle-edit-view',
+		);
+		assert.deepEqual(viewerCommandCalls()['toggle-edit-view'], ['toggleEditView']);
+	});
+});
diff --git a/scripts/navigation.viewMode.spec.ts b/scripts/navigation.viewMode.spec.ts
new file mode 100644
index 00000000..e2d0d274
--- /dev/null
+++ b/scripts/navigation.viewMode.spec.ts
@@ -0,0 +1,296 @@
+import assert from 'node:assert/strict';
+
+import { afterEach, beforeAll, describe, test } from 'vitest';
+
+// Importing the store boots the settings singleton, which asks for the OS type.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { createViewMode } = await import('../src/lib/sessions/viewMode.svelte.js');
+const { createColdEnrichmentRestore } = await import('../src/lib/sessions/coldEnrichmentRestore.js');
+const { asBufferLine, EDITOR_ANCHOR_LINE_OFFSET, lineCoordinates } = await import('../src/lib/utils/lineCoordinates.js');
+
+type Tab = NonNullable<typeof tabManager.activeTab>;
+type ViewModeOptions = Parameters<typeof createViewMode>[0];
+
+beforeAll(() => {
+	(window as any).__TAURI_INTERNALS__ = {
+		metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+		invoke: () => Promise.reject(new Error('no invoke expected in these tests')),
+	};
+});
+
+afterEach(() => {
+	window.getSelection()?.removeAllRanges();
+	document.body.innerHTML = '';
+});
+
+/** Three lines of front matter: renderer line N is buffer line N + 3. */
+const FRONT_MATTER = 3;
+const coords = lineCoordinates('---\na: 1\n---\n# body\n');
+
+/*
+ * "Edit this fragment": the context menu's Edit, ⌘E and the title bar's Edit
+ * button, run through `sessions/viewMode` against the real tab store and a
+ * real jsdom selection. The doubles are the file read and the render.
+ */
+describe('jump to the selected fragment', () => {
+	type Fakes = { readCalls: string[]; readFails: boolean; duringRead: () => void };
+
+	function build(fakes: Fakes) {
+		return createViewMode({
+			tabManager,
+			settings,
+			documentSession: { ensureFullContent: async () => true },
+			flushBeforeLeavingEditableMode: async () => {},
+			readFile: async (path: string) => {
+				fakes.readCalls.push(path);
+				fakes.duringRead();
+				if (fakes.readFails) throw new Error('No such file or directory (os error 2)');
+				return ['---\na: 1\n---\n# body\n', false, 'UTF-8'];
+			},
+			renderTabPreviewFromRaw: async () => {},
+			tick: async () => {},
+			addToast: () => {},
+			t: (key: string) => key,
+			editorPane: undefined,
+			markdownBody: undefined,
+			previewBlocks: undefined,
+			lineCoords: coords,
+			readRendererLine: () => '',
+			getPreviewScrollSyncPosition: () => ({ section: 'body', ratio: 0 }),
+			scrollPreviewToSyncPosition: () => {},
+			getPreviewScrollAnchor: () => null,
+		} as ViewModeOptions);
+	}
+
+	/** A saved, clean file in the given mode, and a preview with two blocks. */
+	function setup(mode: 'read' | 'edit' | 'split' | 'edit+split') {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/note.md');
+		const tab = tabManager.activeTab!;
+		tabManager.setTabRawContent(tab.id, '---\na: 1\n---\n# body\n');
+		tab.isEditing = mode === 'edit' || mode === 'edit+split';
+		tabManager.setSplitEnabled(tab.id, mode === 'split' || mode === 'edit+split');
+		document.body.innerHTML =
+			'<article><p id="first" data-sourcepos="1:1-1:9">first block</p>' +
+			'<p id="picked" data-sourcepos="7:4-9:3">the <em>picked</em> fragment</p></article>';
+		const fakes: Fakes = { readCalls: [], readFails: false, duringRead: () => {} };
+		return { tab, fakes, viewMode: build(fakes) };
+	}
+
+	const select = (id: string) => window.getSelection()!.selectAllChildren(document.getElementById(id)!);
+	const rightClickOn = (id: string) => ({ target: document.getElementById(id)!.firstChild }) as unknown as MouseEvent;
+
+	/** `picked` is renderer lines 7–9, so buffer lines 10–12. */
+	const PICKED = { startLine: 7 + FRONT_MATTER, endLine: 9 + FRONT_MATTER };
+
+	test('the Edit entry resolves its target while the selection still exists', async () => {
+		const { tab, viewMode } = setup('read');
+		select('picked');
+
+		// The menu opens on the right-click; the reader then clicks "Edit", and
+		// that click is what clears the selection.
+		const edit = viewMode.editSourceRangeAt(rightClickOn('first'));
+		window.getSelection()!.removeAllRanges();
+		await edit();
+
+		assert.equal(tab.isEditing, true);
+		assert.deepEqual(viewMode.pendingEditReveal, PICKED, 'the editor opens on the selection, not on what is under the pointer');
+	});
+
+	test('Edit with a target never leaves edit mode', async () => {
+		// In split view the editor is already on screen, and "edit this
+		// fragment" is the one thing that cannot mean "close the editor".
+		const { tab, fakes, viewMode } = setup('edit+split');
+
+		await viewMode.editSourceRange({ startLine: 7, endLine: 9 } as never);
+
+		assert.equal(tab.isEditing, true, 'still editing');
+		assert.equal(tab.isSplit, true, 'and the layout is unchanged');
+		assert.deepEqual(fakes.readCalls, [], 'no mode change, so no read');
+		assert.deepEqual(viewMode.pendingEditReveal, PICKED);
+	});
+
+	test('a jump whose read failed is not armed for the next document', async () => {
+		const { tab, fakes, viewMode } = setup('read');
+		fakes.readFails = true;
+
+		await viewMode.editSourceRange({ startLine: 7, endLine: 9 } as never);
+
+		assert.equal(tab.isEditing, false, 'the failed read leaves the tab in reading mode');
+		assert.equal(viewMode.pendingEditReveal, null, 'and nothing waits to fire at whatever is edited next');
+	});
+
+	test('the target is a source range and never a column', async () => {
+		// `data-sourcepos="7:4-9:3"` carries columns; the jump selects whole
+		// lines, and the editor is never aimed with the `:col` half.
+		const { viewMode } = setup('read');
+
+		assert.deepEqual(viewMode.getContextMenuSourceRange(rightClickOn('picked')), { startLine: 7, endLine: 9 });
+		await viewMode.editSourceRangeAt(rightClickOn('picked'))();
+
+		assert.deepEqual(viewMode.pendingEditReveal, PICKED);
+		assert.deepEqual(Object.keys(viewMode.pendingEditReveal!).sort(), ['endLine', 'startLine']);
+	});
+
+	test('every renderer line reaching the editor goes through the shift', async () => {
+		// The context menu's target, ⌘E's selection: both are renderer lines off
+		// `data-sourcepos`, and the editor counts the front matter too.
+		const viaMenu = setup('read');
+		await viaMenu.viewMode.editSourceRangeAt(rightClickOn('first'))();
+		assert.deepEqual(viaMenu.viewMode.pendingEditReveal, { startLine: 1 + FRONT_MATTER, endLine: 1 + FRONT_MATTER });
+
+		const viaChord = setup('read');
+		select('picked');
+		await viaChord.viewMode.toggleEditView();
+		assert.deepEqual(viaChord.viewMode.pendingEditReveal, PICKED);
+	});
+
+	test('the selection is read before anything switches mode', async () => {
+		// Entering the editor takes the reader's focus, and with it the
+		// preview's selection. Read after that, ⌘E would answer for nothing.
+		const { tab, fakes, viewMode } = setup('read');
+		select('picked');
+		fakes.duringRead = () => window.getSelection()!.removeAllRanges();
+
+		await viewMode.toggleEditView();
+
+		assert.equal(tab.isEditing, true);
+		assert.deepEqual(viewMode.pendingEditReveal, PICKED);
+	});
+
+	test("the title bar's Edit button means what ⌘E means", async () => {
+		// From reading mode, Edit with a selection opens the editor on it, the
+		// same as the chord and the context menu.
+		const { tab, viewMode } = setup('read');
+		select('picked');
+
+		await viewMode.setViewMode('edit');
+
+		assert.equal(tab.isEditing, true);
+		assert.deepEqual(viewMode.pendingEditReveal, PICKED);
+	});
+
+	test('split view with nothing selected is deliberately inert', async () => {
+		// The editor is already on screen, so the ability ⌘E asks for is already
+		// granted; with no selection there is nothing to travel to either.
+		const { tab, fakes, viewMode } = setup('split');
+
+		await viewMode.toggleEditView();
+
+		assert.equal(tab.isSplit, true, 'the chord never changes the layout');
+		assert.equal(tab.isEditing, false);
+		assert.deepEqual(fakes.readCalls, []);
+		assert.equal(viewMode.pendingEditReveal, null);
+	});
+});
+
+describe('the outline is fed body lines from both panes', () => {
+	test("the editor's scroll moves the outline in body lines", () => {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/note.md');
+		const tab = tabManager.activeTab!;
+		tab.isEditing = true;
+		const before = settings.tocFollows;
+		settings.tocFollows = 'scroll';
+		try {
+			const viewMode = createViewMode({
+				tabManager,
+				settings,
+				lineCoords: coords,
+				scrollPreviewToSyncPosition: () => {},
+			} as unknown as ViewModeOptions);
+
+			// Monaco's top line is buffer line 20; the tab would record the line
+			// `EDITOR_ANCHOR_LINE_OFFSET` below it, counted from the body.
+			viewMode.handleEditorScrollSync({ section: 'body', ratio: 0.5, line: asBufferLine(20) });
+
+			assert.equal(viewMode.tocActiveLine, 20 + EDITOR_ANCHOR_LINE_OFFSET - FRONT_MATTER);
+		} finally {
+			settings.tocFollows = before;
+		}
+	});
+});
+
+/*
+ * The cold start: the rich-content libraries arrive after the document is
+ * already in the preview and after the position has been restored against it,
+ * and the enrichment moves the text by up to 812px (measured in Chromium; see
+ * the patch effect in MarkdownViewer.svelte). The second restore runs once per
+ * host, after the enrichment, for the tab still on screen.
+ */
+describe('a cold start restores again once its enrichment has landed', () => {
+	function deferred() {
+		let resolve!: () => void;
+		const promise = new Promise<void>((r) => (resolve = r));
+		return { promise, resolve };
+	}
+	const settle = async () => {
+		for (let i = 0; i < 5; i++) await Promise.resolve();
+	};
+
+	function setup() {
+		tabManager.closeAll();
+		tabManager.addTab('/notes/a.md');
+		tabManager.addTab('/notes/b.md');
+		const body = document.createElement('article');
+		const restored: string[] = [];
+		const coldRestore = createColdEnrichmentRestore({
+			tabManager,
+			tick: async () => {},
+			markdownBody: body,
+			restore: (_body: HTMLElement, tab: Tab) => void restored.push(tab.path),
+		});
+		return { body, restored, coldRestore };
+	}
+
+	test("a host's first enrichment restores after it lands", async () => {
+		const { body, restored, coldRestore } = setup();
+		const enrichment = deferred();
+
+		coldRestore.afterEnrichment(body, 3, enrichment.promise);
+		await settle();
+		assert.deepEqual(restored, [], 'not before the layout has changed');
+
+		enrichment.resolve();
+		await settle();
+		assert.deepEqual(restored, [tabManager.activeTab!.path]);
+	});
+
+	test('later patches of the same host do not move the reader', async () => {
+		const { body, restored, coldRestore } = setup();
+
+		coldRestore.afterEnrichment(body, 3, Promise.resolve());
+		await settle();
+		coldRestore.afterEnrichment(body, 2, Promise.resolve());
+		await settle();
+
+		assert.equal(restored.length, 1, 'only the first enrichment of a host restores');
+	});
+
+	test('a patch that inserted nothing is not a cold start', async () => {
+		const { body, restored, coldRestore } = setup();
+
+		coldRestore.afterEnrichment(body, 0, Promise.resolve());
+		await settle();
+
+		assert.deepEqual(restored, []);
+	});
+
+	test('a tab switch during the enrichment cancels the restore', async () => {
+		const { body, restored, coldRestore } = setup();
+		const enrichment = deferred();
+
+		coldRestore.afterEnrichment(body, 3, enrichment.promise);
+		tabManager.setActive(tabManager.tabs[0].id);
+		enrichment.resolve();
+		await settle();
+
+		assert.deepEqual(restored, [], "another tab's position is never restored into the article");
+	});
+});
diff --git a/scripts/preview.checks.spec.ts b/scripts/preview.checks.spec.ts
deleted file mode 100644
index 07b05ffc..00000000
--- a/scripts/preview.checks.spec.ts
+++ /dev/null
@@ -1,426 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from 'vitest';
-import assert from 'node:assert/strict';
-import { readSource } from './sourceTree.js';
-import { parse } from 'svelte/compiler';
-import ts from 'typescript';
-import { hasExportableDocument } from '../src/lib/utils/tabFileActions.js';
-
-/**
- * Switching theme has to re-draw the diagrams, and until this file existed it
- * did not — in any mode, for any theme.
- *
- * Mermaid bakes fills, strokes and label colours into the SVG as attributes, so
- * a stylesheet cannot retarget them; `mermaidPrint.ts` says why at length, and
- * re-rendering is the answer it already reaches for on the way to a PDF. The
- * preview's own theme change was supposed to do the same thing through
- * `renderRichContent`, and could not: that function finds diagrams by
- * `pre code`, and a diagram that has been drawn once has no `<pre>` any more —
- * it was replaced by the `.mermaid-diagram` container holding the SVG.
- *
- * That was invisible while the preview was `{@html sanitizedHtml}`, because
- * every render put the whole document back as source. the block patch (#632)
- * keeps enriched nodes across renders instead, and from then on a theme change
- * reached no diagram at all. The `<pre>` is gone, `patch.inserted` is empty on
- * a re-render of the same document, and typing does not help either: the
- * diagram's markup is unchanged, so the patch keeps the node.
- *
- * The libraries are stood in for at the same boundary `exportRichContent` and
- * `richContentIdempotence` use. What is under test is Markpad's bookkeeping:
- * which containers it decides are stale, and what it does to them.
- */
-describe('diagram theme refresh', () => {
-	/**
-	 * The wiring, which the tests above cannot reach: `renderRichContent` now knows
-	 * how to re-draw a stale diagram, but the theme effect still has to call it, in
-	 * every mode and once per theme change.
-	 *
-	 * A source assertion, because the caller is a Svelte effect that cannot be
-	 * imported. It pins today's spelling of an internal call, so a rename breaks it
-	 * without breaking anything real; what it is here for is the guard, which was
-	 * `markdownBody && !isEditing`. That made the whole effect — the `dataset`
-	 * writes, `monaco.editor.setTheme`, and for a `vscode:` theme an
-	 * `invoke('read_vscode_theme')` and a re-parse — re-run on every mode toggle
-	 * and on every tab switch that changed the mode, with nothing about the theme
-	 * having moved. And it excluded from the re-colour every tab in edit mode,
-	 * including a split tab entered from edit mode, whose preview is on screen.
-	 */
-	test('the theme effect re-colours in every mode, and does not re-run on a mode change', async () => {
-		const { readSource } = await import('./sourceTree.js');
-		const viewer: string = readSource('src/lib/MarkdownViewer.svelte');
-
-		const effect = viewer.match(
-			/\t\$effect\(\(\) => \{\n\t\t\/\/ Persistence and cross-window sync[\s\S]*?\n\t\}\);/,
-		)?.[0];
-		expect(effect, 'the theme effect must still be recognisable').toBeTruthy();
-
-		// The mode is not a reason to re-apply a theme, and this is the only read
-		// that ever made it one.
-		expect(effect).not.toMatch(/isEditing/);
-		expect(effect).toMatch(
-			/const recolourDiagrams = \(\) => untrack\(\(\) => \{ if \(markdownBody\) renderRichContent\(\); \}\);/,
-		);
-
-		// Once per branch: the `vscode:` branch does not know its own appearance
-		// until `parseAndApplyVscodeTheme` has published `dataset.themeType`, which
-		// is what `currentMermaidTheme` reads.
-		expect(effect!.match(/recolourDiagrams\(\);/g)).toHaveLength(2);
-		expect(effect).toMatch(/loadVscodeTheme\([\s\S]*?recolourDiagrams\(\);/);
-	});
-});
-
-describe('line samples cache', () => {
-	test('a tab switch that skips the patch still drops the table', () => {
-		// The hosts' `display` is what changed, and `isAnchorable` reads it.
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		expect(viewer).toMatch(/if \(unchanged\) invalidateAnchorMemos\(\);/);
-	});
-});
-
-describe('rendered HTML field', () => {
-	// ---------------------------------------------------------------- environment
-	// The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
-	// Svelte plugin, so the store and the session run under real reactivity, and jsdom
-	// supplies `window` and `localStorage`. Only the Tauri backend is stubbed, and it
-	// has to be in place before the stores are imported, so both happen in beforeAll.
-	let tabManager: (typeof import('../src/lib/stores/tabs.svelte.js'))['tabManager'];
-	let settings: (typeof import('../src/lib/stores/settings.svelte.js'))['settings'];
-
-	beforeAll(async () => {
-		(window as any).__TAURI_INTERNALS__ = {
-			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-			invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
-		};
-		({ tabManager } = await import('../src/lib/stores/tabs.svelte.js'));
-		({ settings } = await import('../src/lib/stores/settings.svelte.js'));
-	});
-
-	afterAll(() => {
-		delete (window as any).__TAURI_INTERNALS__;
-	});
-
-	// ------------------------------------------------------------------ AST walk
-
-	type Node = Record<string, any>;
-
-	function collect(node: unknown, hit: (node: Node) => void): void {
-		if (!node || typeof node !== 'object') return;
-		if (Array.isArray(node)) {
-			for (const child of node) collect(child, hit);
-			return;
-		}
-		hit(node as Node);
-		for (const key of Object.keys(node as Node)) {
-			if (key === 'parent') continue;
-			collect((node as Node)[key], hit);
-		}
-	}
-
-	/** Free identifiers of an expression — property names and object keys excluded. */
-	function freeIdentifiers(expression: Node): string[] {
-		const skip = new Set<unknown>();
-		collect(expression, (node) => {
-			if (node.type === 'MemberExpression' && !node.computed) skip.add(node.property);
-			if (node.type === 'Property' && !node.computed) skip.add(node.key);
-		});
-		const names = new Set<string>();
-		collect(expression, (node) => {
-			if (node.type === 'Identifier' && !skip.has(node)) names.add(node.name);
-		});
-		return [...names].sort();
-	}
-
-	/**
-	 * Turn a source expression into a predicate over the names it happens to
-	 * reference, so a rewrite that reaches for a different helper fails with "the
-	 * gate references X" rather than a bare ReferenceError out of `new Function`.
-	 */
-	function compileGate(source: string, expression: Node, available: Record<string, () => unknown>, where: string) {
-		const names = freeIdentifiers(expression).filter((name) => name !== 'undefined');
-		for (const name of names) {
-			assert.ok(
-				name in available,
-				`${where} references \`${name}\`, which these tests cannot supply — add it to \`available\` ` +
-					'in scripts/renderedHtmlField.test.ts so the gate can still be evaluated',
-			);
-		}
-		const text = source.slice(expression.start, expression.end);
-		const fn = new Function(...names, `return Boolean(${text});`) as (...args: unknown[]) => boolean;
-		return { text, run: () => fn(...names.map((name) => available[name]())) };
-	}
-
-	// ------------------------------------------- 1. the export gate, as written
-
-	const TITLE_BAR = 'src/lib/components/TitleBar.svelte';
-
-	const titleBarSource = readSource(TITLE_BAR);
-
-	const exportMenuGate = (() => {
-		const ast = parse(titleBarSource, { modern: true, filename: TITLE_BAR });
-
-		const candidates: Node[] = [];
-		collect(ast.fragment, (node) => {
-			if (node.type !== 'IfBlock') return;
-			const text = titleBarSource.slice(node.start, node.end);
-			if (text.includes('onexportHtml?.()') && text.includes('onexportPdf?.()')) candidates.push(node);
-		});
-		// Innermost only: every ancestor `{#if}` contains the buttons too.
-		const innermost = candidates.filter(
-			(gate) => !candidates.some((other) => other !== gate && other.start >= gate.start && other.end <= gate.end),
-		);
-
-		assert.equal(
-			innermost.length,
-			1,
-			`expected exactly one {#if} in ${TITLE_BAR} wrapping both export buttons, found ${innermost.length} — ` +
-				'if the export entries moved, move these tests with them',
-		);
-		return innermost[0];
-	})();
-
-	const exportsOffered = compileGate(
-		titleBarSource,
-		exportMenuGate.test,
-		{
-			tabManager: () => tabManager,
-			// The gate moved into a helper when the Export as PDF chord needed the
-			// same condition (#673). Supplied as the real function, so what these
-			// tests evaluate is still the shipped decision rather than a stand-in.
-			hasExportableDocument: () => hasExportableDocument,
-		},
-		'the export menu gate',
-	);
-
-	// ------------------------------- 2. the condition that refreshes tab.content
-
-	const VIEWER = 'src/lib/MarkdownViewer.svelte';
-
-	const viewerSource = readSource(VIEWER);
-
-	const previewCacheRefreshes = (() => {
-		const ast = parse(viewerSource, { modern: true, filename: VIEWER });
-		const matches: Node[] = [];
-		collect(ast.instance, (node) => {
-			if (node.type !== 'IfStatement') return;
-			const test = viewerSource.slice(node.test.start, node.test.end);
-			const body = viewerSource.slice(node.consequent.start, node.consequent.end);
-			if (test.includes('settings.showToc') && body.includes('updateTabContent')) matches.push(node);
-		});
-		assert.equal(
-			matches.length,
-			1,
-			`expected exactly one condition in ${VIEWER} guarding the preview-cache render, found ${matches.length}`,
-		);
-
-		return compileGate(
-			viewerSource,
-			matches[0].test,
-			{
-				tab: () => tabManager.activeTab,
-				settings: () => settings,
-				// MarkdownViewer.svelte passes the active tab's own flag down as
-				// the `isEditing` prop.
-				isEditing: () => tabManager.activeTab?.isEditing ?? false,
-			},
-			'the preview-cache refresh condition',
-		);
-	})();
-
-	// ------------------------------------- 3. exportAsHtml's own precondition
-
-	const EXPORT = 'src/lib/utils/export.ts';
-
-	const exportSource = readSource(EXPORT);
-
-	/** `if (!ctx.rawContent) return null;` — evaluated, not matched. */
-	const exportWouldRun = (() => {
-		const file = ts.createSourceFile(EXPORT, exportSource, ts.ScriptTarget.ES2022, true);
-		let guard: ts.Expression | null = null;
-		const visit = (node: ts.Node) => {
-			if (ts.isFunctionDeclaration(node) && node.name?.text === 'exportAsHtml' && node.body) {
-				const first = node.body.statements.find(ts.isIfStatement);
-				assert.ok(first, 'exportAsHtml no longer opens with a precondition');
-				guard = first.expression;
-				return;
-			}
-			ts.forEachChild(node, visit);
-		};
-		visit(file);
-		assert.ok(guard, `expected ${EXPORT} to declare exportAsHtml`);
-
-		const text = exportSource.slice((guard as ts.Expression).getStart(file), (guard as ts.Expression).getEnd());
-		const bails = new Function('ctx', 'hasExportableDocument', `return Boolean(${text});`) as (
-			ctx: unknown,
-			gate: typeof hasExportableDocument,
-		) => boolean;
-		// The context MarkdownViewer.svelte builds for the active tab.
-		return () => {
-			const tab = tabManager.activeTab;
-			if (!tab) return false;
-			return !bails({ rawContent: tab.rawContent, tabPath: tab.path, tabTitle: tab.title }, hasExportableDocument);
-		};
-	})();
-
-	// ----------------------------------------------------------------- fixtures
-
-	function reset() {
-		tabManager.closeAll();
-		localStorage.clear();
-		settings.showToc = false;
-		settings.newFileDefaultMode = true;
-	}
-
-	/**
-	 * Ctrl+T, then type — an untitled buffer being edited, TOC closed, not split.
-	 * `content` is left at whatever `addNewTab` produced precisely because the
-	 * refresh condition asserted below never runs for this state.
-	 */
-	function untitledBufferBeingEdited(text = '# notes\n\nsomething worth exporting\n') {
-		reset();
-		tabManager.addNewTab();
-		const tab = tabManager.activeTab!;
-		tab.isEditing = true;
-		tabManager.updateTabRawContent(tab.id, text);
-		return tab;
-	}
-
-	// --------------------------------------------------------------- the regression
-
-	test('the preview HTML cache is not refreshed while editing with the TOC closed', () => {
-		// The premise of the bug, taken from the shipping condition rather than
-		// asserted by hand. Without this, the repro below would be a test fixture
-		// choosing its own outcome.
-		const tab = untitledBufferBeingEdited();
-
-		assert.equal(tab.isEditing, true);
-		assert.equal(tab.isSplit, false);
-		assert.equal(settings.showToc, false);
-		assert.equal(
-			previewCacheRefreshes.run(),
-			false,
-			`nothing re-renders tab.content in this state. Condition: ${previewCacheRefreshes.text}`,
-		);
-		assert.equal(tab.content, '', 'so the rendered-HTML cache is still empty');
-		assert.notEqual(tab.rawContent, '', 'while the document itself is not');
-	});
-
-	test('an untitled buffer being edited is offered the export commands', () => {
-		untitledBufferBeingEdited();
-
-		assert.equal(exportWouldRun(), true, 'precondition: exportAsHtml would produce a file for this buffer');
-		assert.equal(
-			exportsOffered.run(),
-			true,
-			'the Home menu hid Export as HTML / Export as PDF for a document that exports fine — ' +
-				`it read the rendered-HTML cache instead of the buffer. Gate: ${exportsOffered.text}`,
-		);
-	});
-
-	/**
-	 * Bring `tab.content` to what the running app would hold in this state.
-	 *
-	 * Editable panes: only the condition lifted above refreshes it. Reading mode:
-	 * `renderTabPreviewFromRaw` drew the pane the user is looking at, so it is
-	 * current by construction. This is what makes the matrix below a statement
-	 * about the app rather than about fixtures the test wrote by hand.
-	 */
-	function settleRenderedCache() {
-		const tab = tabManager.activeTab;
-		if (!tab) return;
-		const editablePane = tab.isEditing || tab.isSplit;
-		if (!editablePane || previewCacheRefreshes.run()) {
-			tabManager.updateTabContent(tab.id, tab.rawContent ? `<h1>rendered</h1>` : '');
-		}
-	}
-
-	test('the menu is never stricter than the export it fronts', () => {
-		// The invariant behind the fix, over the states a tab can be in. Being
-		// STRICTER is the defect this test is for; being looser is pinned by the
-		// saved-empty-file test below.
-		const states: Array<[string, () => void]> = [
-			['untitled, edited, TOC closed', () => void untitledBufferBeingEdited()],
-			[
-				'untitled, edited, TOC open',
-				() => {
-					untitledBufferBeingEdited();
-					settings.showToc = true;
-				},
-			],
-			[
-				'untitled, split view',
-				() => {
-					const tab = untitledBufferBeingEdited();
-					tabManager.setSplitEnabled(tab.id, true);
-				},
-			],
-			[
-				'untitled, reading mode',
-				() => {
-					const tab = untitledBufferBeingEdited();
-					tab.isEditing = false;
-				},
-			],
-			[
-				'saved file, edited, TOC closed',
-				() => {
-					reset();
-					tabManager.addTab('/notes/a.md');
-					const tab = tabManager.activeTab!;
-					tabManager.setTabRawContent(tab.id, '# a\n');
-					tab.isEditing = true;
-				},
-			],
-		];
-
-		// Collected rather than asserted one at a time, so a failure names every
-		// state the menu is wrong in instead of only the first.
-		const hidden: string[] = [];
-		for (const [name, arrange] of states) {
-			arrange();
-			settleRenderedCache();
-			if (exportWouldRun() && !exportsOffered.run()) hidden.push(name);
-		}
-
-		assert.deepEqual(hidden, [], 'the export is possible in these states and the menu hides it');
-	});
-
-	// ------------------------------------------------------------------ the fence
-	//
-	// A gate that simply always returned true would pass everything above.
-
-	test('an empty untitled buffer is offered nothing to export', () => {
-		reset();
-		tabManager.addNewTab();
-		tabManager.activeTab!.isEditing = true;
-
-		assert.equal(exportWouldRun(), false, 'precondition: exportAsHtml returns null for an empty buffer');
-		assert.equal(exportsOffered.run(), false, 'so the menu must not offer it either');
-	});
-
-	test('a window with no tab at all offers no export', () => {
-		reset();
-
-		assert.equal(exportsOffered.run(), false);
-	});
-
-	test('a saved file is offered the export commands', () => {
-		reset();
-		tabManager.addTab('/notes/a.md');
-		tabManager.setTabRawContent(tabManager.activeTab!.id, '# a\n');
-
-		assert.equal(exportsOffered.run(), true);
-	});
-
-	test('a saved file with an empty buffer is offered nothing to export', () => {
-		// A saved empty file, or a tab whose read has not landed yet: a path and an
-		// empty buffer. The menu used to list the exports on the path alone, so
-		// Export as HTML then did nothing and Export as PDF printed a blank page.
-		// The menu, the PDF chord and the HTML export now ask one predicate.
-		reset();
-		tabManager.addTab('/notes/a.md');
-
-		assert.equal(tabManager.activeTab!.rawContent, '', 'precondition: the buffer is empty');
-		assert.equal(exportWouldRun(), false, 'precondition: exportAsHtml returns null for an empty buffer');
-		assert.equal(exportsOffered.run(), false, 'so the menu must not offer it either');
-		assert.equal(hasExportableDocument(tabManager.activeTab!.rawContent), false, 'nor the PDF chord');
-	});
-});
diff --git a/scripts/preview.checks.test.ts b/scripts/preview.checks.test.ts
index 3021f1f5..7d7c825c 100644
--- a/scripts/preview.checks.test.ts
+++ b/scripts/preview.checks.test.ts
@@ -1,9 +1,6 @@
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { callSiteOffsets, enclosingFunctionName, filesMatching, functionSource, offsetOf, readSource, readSourceFiles, SANITIZER_FILES, sliceBetween } from './sourceTree.js';
-import ts from 'typescript';
-import { getMarkdownLinkTarget, resolveMarkdownTargetPath } from '../src/lib/utils/markdownLinks.js';
-import { isSameFilePath } from '../src/lib/utils/pathIdentity.js';
+import { callSiteOffsets, enclosingFunctionName, filesMatching, readSource, readSourceFiles, SANITIZER_FILES, sliceBetween } from './sourceTree.js';
 import { ALLOWED_MARKDOWN_URI_REGEXP, MARKDOWN_SANITIZE_CONFIG } from '../src/lib/utils/sanitize.js';
 import { getStoredPreviewFullWidth } from '../src/lib/utils/previewWidth.js';
 
@@ -14,8 +11,6 @@ describe('inline code in headings', () => {
 
 	const styles = readSource('src/styles.css');
 
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
 	test('a heading lays its content out as one line of text', () => {
 		// A flex heading makes every text run, `<em>`, `<code>` and image its own
 		// flex item: #681 floated inline code above the words, #791 ate the spaces
@@ -25,22 +20,6 @@ describe('inline code in headings', () => {
 		assert.ok(rule, 'styles.css must still define .foldable-header');
 		assert.doesNotMatch(rule[0], /display:\s*(inline-)?(flex|grid)/);
 	});
-
-	test('inline code in a heading scales with the heading', () => {
-		// The Code Font Size setting is an absolute px — right for code in prose,
-		// wrong for code in a heading, where 14px inside a 24px `##` reads as a
-		// footnote. GitHub sizes inline code relative to what contains it.
-		assert.match(
-			viewer,
-			/:global\(\.markdown-body :is\(h1, h2, h3, h4, h5, h6\) code\) \{\s*\n\s*font-size: 0\.85em !important;/,
-		);
-	});
-
-	test('the setting still governs code everywhere else', () => {
-		// The fix is scoped to headings; body text and code blocks keep answering to
-		// `--code-font-size`, which is what the setting promises.
-		assert.match(viewer, /:global\(\.markdown-body code\) \{[\s\S]*?font-size: var\(--code-font-size, 14px\) !important;/);
-	});
 });
 
 /**
@@ -60,112 +39,7 @@ describe('KaTeX contrib flavour', () => {
 	});
 });
 
-describe('link hover preview', () => {
-	/*
-	 * The box that names a link while the cursor is on it had two faults, both
-	 * reported from a build.
-	 *
-	 * It said `tauri://localhost/3.md` for `[3.md](./3.md)`. That is the DOM
-	 * resolving `href` against the webview's own origin — the same resolution
-	 * `resolveLocalFileLinkPath` exists to undo on the click side, and the same
-	 * origin `preview.test.ts` documents. `handleMouseOver` had already
-	 * read `getAttribute('href')` into `rawHref` for its other two branches; the
-	 * one that prints the address was the one that did not use it.
-	 *
-	 * And it stayed on screen after the click. `mouseout` is the only thing that
-	 * takes it down, and a click that replaces the document removes the anchor
-	 * while the cursor is still on it — removing a node dispatches no `mouseout`,
-	 * so nothing ever fired.
-	 *
-	 * Neither half has a seam a Node test can reach: both are branches inside a
-	 * 4,700-line component, and what they do is set component state. So these
-	 * assert against the source, and what they establish is narrow — that the
-	 * resolved href is not read where the address is printed, and that the click
-	 * handler drops the box before it does anything else. Whether the box is then
-	 * painted or not is checked by hand.
-	 */
-
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	test('the hover preview never prints the webview origin', () => {
-		const hover = functionSource(viewer, 'handleMouseOver');
-
-		// Stated as the thing that must not come back rather than as today's
-		// spelling of what replaced it: the resolved property is what put a
-		// `tauri://` URL in front of the user, so this function may not read it.
-		//
-		// The whole function, comments included — deliberately. The first version of
-		// this test went red on the comment explaining the fix, and that is the rule
-		// working: a comment naming the property is how the next person is talked
-		// into writing it again. Describe it, do not spell it.
-		assert.doesNotMatch(
-			hover,
-			/anchor\.href/,
-			'the hover preview reads the resolved href, which is the webview origin plus a path that is not the file',
-		);
-		assert.match(hover, /getAttribute\('href'\)/);
-	});
-
-	test('a click takes the hover preview down before it does anything else', () => {
-		const click = functionSource(viewer, 'handleLinkClick');
-
-		// Before the branches, because every one of them can be the one that
-		// replaces the document — a fold, an anchor, a relative link, a new tab.
-		const hide = offsetOf(click, 'tooltip.show = false');
-		const firstBranch = offsetOf(click, 'toggleFoldFromClick');
-
-		assert.ok(hide >= 0, 'the click handler never drops the hover preview');
-		assert.ok(
-			hide < firstBranch,
-			'the hover preview is dropped after a branch that can already have replaced the document',
-		);
-	});
-});
-
 describe('local file links', () => {
-	// --- wiring ------------------------------------------------------------------
-
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	// Extracted by name rather than by an anchor pair: the closing anchor used to be
-	// `'let zoomLevel'`, the next declaration in the file, and it vanished the day
-	// zoom moved into the settings store — an anchor whose only qualification is
-	// being the next thing down is an anchor that moves for unrelated reasons.
-	const handler = functionSource(viewer, 'handleDocumentClick');
-
-	// The OS half of a local-file click, shared with the folder sidebar so a file
-	// opened from either place gets the same launchable-target guard.
-	const opener = functionSource(viewer, 'openWithSystem');
-
-	test('markdown targets are still claimed before the local-file branch', () => {
-		const markdown = offsetOf(handler, 'getRelativeMarkdownTarget(rawHref)');
-		const local = offsetOf(handler, 'resolveLocalFileLinkPath(rawHref, currentFile)');
-		assert.ok(markdown < local, '`./other.md` must open in a tab, not in an external editor');
-	});
-
-	test('a local file is handed to the OS as a path, not as a URL', () => {
-		assert.match(handler, /await openWithSystem\(localFilePath\)/);
-		assert.match(opener, /await openPath\(path\)/);
-		// The raw attribute, not `anchor.href`: the latter is the origin-resolved
-		// URL that caused the bug.
-		assert.match(handler, /resolveLocalFileLinkPath\(rawHref, currentFile\)/);
-		const local = offsetOf(handler, 'resolveLocalFileLinkPath');
-		const url = offsetOf(handler, 'await openUrl(anchor.href)');
-		assert.ok(local < url, 'a local file must be caught before the URL fallback');
-	});
-
-	test('a launchable target is revealed, not opened', () => {
-		// `openPath` hands the file to the OS default handler, and for
-		// `./setup.command`, `Calculator.app` or `x.exe` that handler runs it. The
-		// capability scope stays `**` because a link may point anywhere; this
-		// check, answered in Rust where the file's metadata is, is the guard.
-		const check = offsetOf(opener, "invoke<boolean>('is_launchable_path', { path })");
-		const reveal = offsetOf(opener, "invoke('open_file_folder', { path })");
-		const open = offsetOf(opener, 'await openPath(path)');
-		assert.ok(check < reveal && reveal < open, 'the check must decide between reveal and open');
-		assert.match(opener, /t\('toast\.launchableLinkRevealed'/);
-	});
-
 	test('the capability still grants the command this depends on', () => {
 		// `open_path` needs both the command grant and a path scope. Granting the
 		// command alone leaves the plugin resolving
@@ -178,145 +52,6 @@ describe('local file links', () => {
 		const capability = readSource('src-tauri/capabilities/default.json');
 		assert.match(capability, /opener:allow-open-path/);
 	});
-
-	test('neither OS call can leave an unhandled rejection behind', () => {
-		// `openUrl` rejects for anything outside the opener scope. Unawaited-in-
-		// try/catch, that rejection was the whole visible symptom on macOS: nothing
-		// happened, and nothing said why.
-		for (const [source, call] of [
-			[opener, 'await openPath(path)'],
-			[handler, 'await openUrl(anchor.href)'],
-		] as const) {
-			const at = offsetOf(source, call);
-			const before = source.slice(0, at);
-			const tryAt = before.lastIndexOf('try {');
-			assert.notEqual(tryAt, -1, `${call} must be inside a try block`);
-			offsetOf(source, '} catch (error) {', at); // must have a catch after it
-			assert.ok(before.slice(tryAt).split('} catch').length === 1, `${call} must be inside the nearest try`);
-		}
-		assert.equal(opener.match(/t\('toast\.openFailed'/g)?.length, 1, 'a failed file open is reported');
-		assert.equal(handler.match(/t\('toast\.openFailed'/g)?.length, 1, 'a failed URL open is reported');
-	});
-
-	// --- the preview claims the click before the router does ----------------------
-
-	/*
-	 * #772: `[PDF_1](Files/PDF_1.pdf)` opened the file AND left the app on a 404
-	 * page that could only be closed from Task Manager.
-	 *
-	 * Both, from one click, because three listeners see it in this order:
-	 *
-	 *   <article>            handleLinkClick      — declined a non-markdown link
-	 *   document.documentElement   SvelteKit's router  — `if (event.defaultPrevented) return`
-	 *   document             handleDocumentClick  — resolves the path, calls openPath
-	 *
-	 * The router claimed the undecided click and navigated client-side to a route
-	 * an SPA does not have, so its 404 page replaced the app — the title bar with
-	 * it, which on Windows (`decorations(false)`) is the only way to close the
-	 * window. `handleDocumentClick` then ran and opened the PDF, its own
-	 * `preventDefault()` two listeners too late.
-	 *
-	 * A markdown link never had the bug because its branch calls
-	 * `stopPropagation()`, so the event never reaches the router at all.
-	 */
-
-	const linkClick = ts.transpileModule(functionSource(viewer, 'handleLinkClick'), {
-		compilerOptions: { target: ts.ScriptTarget.ES2022 },
-	}).outputText;
-
-	const handleLinkClick = new Function(
-		'deps',
-		`"use strict";
-	const {
-		tooltip, foldHost, toggleFoldFromClick, getRelativeMarkdownTarget, opensInNewTab,
-		settings, openMarkdownTargetInNewTab, openRelativeMarkdownTarget, scrollToAnchorWhenReady,
-	} = deps;
-	let zoomData;
-	${linkClick}
-	return handleLinkClick;`,
-	)({
-		tooltip: { show: true },
-		foldHost: null,
-		toggleFoldFromClick: () => false,
-		getRelativeMarkdownTarget: getMarkdownLinkTarget,
-		opensInNewTab: () => false,
-		settings: { osType: 'macos', linksOpenInNewTab: false },
-		openMarkdownTargetInNewTab: async () => {},
-		openRelativeMarkdownTarget: async () => {},
-		scrollToAnchorWhenReady: async () => {},
-	}) as (e: unknown) => Promise<void>;
-
-	async function clickLink(href: string) {
-		const anchor = { getAttribute: () => href };
-		const result = { defaultPrevented: false, propagationStopped: false };
-		await handleLinkClick({
-			detail: 1,
-			target: { closest: (selector: string) => (selector === 'a' ? anchor : null) },
-			preventDefault: () => { result.defaultPrevented = true; },
-			stopPropagation: () => { result.propagationStopped = true; },
-		});
-		return result;
-	}
-
-	test('a link the document handler opens leaves the preview already claimed', async () => {
-		for (const href of ['Files/PDF_1.pdf', './Files/MP4_1.mp4', '/srv/data.csv', 'https://example.com']) {
-			const { defaultPrevented, propagationStopped } = await clickLink(href);
-			assert.equal(defaultPrevented, true, `${href} must not reach the router undecided`);
-			// Claimed, not swallowed: `handleDocumentClick` is one listener further
-			// up and is the thing that opens it.
-			assert.equal(propagationStopped, false, `${href} must still reach the document handler`);
-		}
-	});
-
-	test('a markdown link is handled here and goes no further', async () => {
-		const { defaultPrevented, propagationStopped } = await clickLink('./other.md');
-		assert.equal(defaultPrevented, true);
-		assert.equal(propagationStopped, true);
-	});
-
-	// "Is this link the file I am reading?" is a question about the FILE. On
-	// macOS `[x](readme.md#a)` inside `Readme.md` names the open document, and
-	// comparing spellings answered no: the click asked to save or discard the
-	// unsaved edits and reloaded the file instead of scrolling to `#a`.
-	const openRelative = ts.transpileModule(functionSource(viewer, 'openRelativeMarkdownTarget'), {
-		compilerOptions: { target: ts.ScriptTarget.ES2022 },
-	}).outputText;
-
-	async function followLink(currentFile: string, path: string) {
-		const calls: string[] = [];
-		const run = new Function(
-			'deps',
-			`"use strict";
-		const {
-			currentFile, resolveMarkdownTargetPath, canonicalizePath, isSameFilePath,
-			scrollToAnchorWhenReady, markdownBody, pushScrollHistory, tabManager, canCloseTab, loadMarkdown,
-		} = deps;
-		${openRelative}
-		return openRelativeMarkdownTarget;`,
-		)({
-			currentFile,
-			resolveMarkdownTargetPath,
-			// A case-insensitive volume whose directory holds `Readme.md`.
-			canonicalizePath: async (p: string) => (p.toLowerCase() === '/notes/readme.md' ? '/notes/Readme.md' : p),
-			isSameFilePath,
-			scrollToAnchorWhenReady: async () => void calls.push('scroll'),
-			markdownBody: null,
-			pushScrollHistory: () => {},
-			tabManager: { activeTabId: 'tab' },
-			canCloseTab: async () => {
-				calls.push('ask to close');
-				return true;
-			},
-			loadMarkdown: async () => void calls.push('load'),
-		}) as (target: { path: string; hash: string }) => Promise<void>;
-		await run({ path, hash: 'a' });
-		return calls;
-	}
-
-	test('a link to the open file under another spelling scrolls instead of reloading', async () => {
-		assert.deepEqual(await followLink('/notes/Readme.md', 'readme.md'), ['scroll']);
-		assert.deepEqual(await followLink('/notes/Readme.md', 'other.md'), ['ask to close', 'load', 'scroll']);
-	});
 });
 
 describe('preview copy handler', () => {
@@ -341,40 +76,6 @@ describe('preview copy handler', () => {
 
 	const viewer = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 
-	const handler = functionSource(viewer, 'handleCopy');
-
-	test('the document-level copy handler is attached', () => {
-		// Document level rather than the preview's `<article>`: `styles.css` puts
-		// `user-select: none` on the app root, so the only selectable surfaces are
-		// the preview and the update dialog's release notes (#532) — and both take
-		// the same native path.
-		const svelteDocument = sliceBetween(viewer, '<svelte:document', '/>');
-		assert.match(svelteDocument, /oncopy=\{handleCopy\}/);
-	});
-
-	test('the copy handler writes plain text and cancels the native copy', () => {
-		assert.match(handler, /setData\(\s*'text\/plain'/);
-		// Without this the native copy still runs and still builds the archive.
-		assert.match(handler, /preventDefault\(\)/);
-	});
-
-	test('the rich flavour is the one this handler builds, and the only one', () => {
-		// `text/html` is built here, from a fragment the app has already pruned,
-		// rather than left to WebKit — which is what keeps the WebArchive out of
-		// shipped builds while the paste keeps its formatting.
-		assert.match(handler, /setData\(\s*'text\/html',\s*html\)/);
-		// RTF is WebKit's own flavour and nothing here can produce a good one: it
-		// would be the scheme deciding again, which is the defect #549 fixed.
-		assert.doesNotMatch(handler, /text\/rtf/i);
-	});
-
-	test('both flavours come from one decision', () => {
-		// Not two calls: the plain text depends on what the HTML pass found — a
-		// selection containing math takes its text from the formula sources — and
-		// splitting them is how the two come to describe different selections.
-		assert.match(handler, /const \{ text, html \} = copyableFlavours\(selection, currentFile\)/);
-	});
-
 	test('nothing else installs a copy handler', () => {
 		// `katex/contrib/copy-tex` did, firing only for selections with math and
 		// rewriting both flavours from its own fragment — so it silently undid this
@@ -388,26 +89,6 @@ describe('preview copy handler', () => {
 		assert.doesNotMatch(richContent, /import\('katex\/dist\/contrib\/copy-tex/);
 		assert.deepEqual(filesMatching(files, /addEventListener\(\s*'copy'/), []);
 	});
-
-	test('a selection inside a form control is left to the platform', () => {
-		// Mirrors WebKit's own carve-out in `Editor::performCutOrCopy`: such a
-		// selection already gets plain text and no archive, and `getSelection()`
-		// cannot read it — cancelling here would copy an empty string. Monaco takes
-		// input through a hidden textarea and is covered by the same test, which is
-		// what keeps the editor on its own Rust path (#548).
-		assert.match(handler, /document\.activeElement/);
-		assert.match(handler, /HTMLInputElement/);
-		assert.match(handler, /HTMLTextAreaElement/);
-		const carveOut = handler.indexOf('HTMLTextAreaElement');
-		const write = handler.indexOf('setData');
-		assert.ok(carveOut !== -1 && write !== -1 && carveOut < write, 'the carve-out must return before the write');
-	});
-
-	test('a collapsed selection is not copied', () => {
-		// Edit ▸ Copy is enabled with nothing selected; writing '' would clear the
-		// clipboard instead of leaving it alone.
-		assert.match(handler, /isCollapsed/);
-	});
 });
 
 describe('preview sanitizing', () => {
@@ -444,19 +125,11 @@ describe('preview sanitizing', () => {
 
 	const viewerSource = readSource('src/lib/MarkdownViewer.svelte');
 
-	const sanitizeSource = readSource('src/lib/utils/sanitize.ts');
-
 	const richContentSource = readSource('src/lib/utils/richContent.ts');
 
 	const previewPatchSource = readSource('src/lib/utils/previewPatch.ts');
 
-	test('the preview sanitizes through the shared policy, not a local config', () => {
-		assert.match(
-			previewPatchSource,
-			/import\s*\{[^}]*\bsanitizeMarkdownFragment\b[^}]*\}\s*from\s*'[^']*\/sanitize\.js'/,
-			'the preview patch must import the shared sanitizer',
-		);
-
+	test('the viewer injects markup only through patchPreview and the footnote tooltip', () => {
 		// The sinks: every `{@html …}` in the viewer, whatever the expression looks
 		// like. Stated over *all* of them rather than over one known-good spelling,
 		// so adding an injection point of the raw document is a failure instead of
@@ -496,51 +169,19 @@ describe('preview sanitizing', () => {
 		);
 
 		// The document sink, in the form it takes now: one call, handed the
-		// renderer's output. `patchPreview` is the only way into the preview's
-		// article, so what it does with that string is the whole path.
+		// renderer's output. `patchHost` (which calls `patchPreview`) is the only
+		// way into the preview's article, so what it does with that string is the
+		// whole path.
 		assert.equal(
-			[...viewerSource.matchAll(/\bpatchPreview\(\s*host\s*,\s*htmlContent\s*,/g)].length,
+			[...viewerSource.matchAll(/\bpatchHost\(\s*host\s*,\s*htmlContent\s*,/g)].length,
 			1,
-			'the preview must reach the article through patchPreview, once',
+			'the preview must reach the article through patchHost, once',
 		);
 
-		// Inside it: the one place markup is parsed is a block of the renderer's
-		// output, into a detached document of its own, before the filter — and what
-		// a block puts into the article is the filter's own nodes. Nothing is
-		// parsed after `sanitizeMarkdownFragment`, and no markup is assembled.
-		const parses = [...previewPatchSource.matchAll(/(\w+)\.(?:innerHTML|outerHTML|insertAdjacentHTML)\s*=\s*([^;]+);/g)].map(
-			(m) => `${m[1]} = ${m[2].trim()}`,
-		);
-		assert.deepEqual(parses, ['box = markup'], 'previewPatch.ts parses only the renderer output, before the filter');
-		assert.match(previewPatchSource, /const box = scratch\.createElement\('div'\);/, 'into the detached scratch document');
-		const processAndSanitize = sliceBetween(previewPatchSource, 'function processAndSanitize(', '\n}\n');
-		assert.match(processAndSanitize, /return sanitizeMarkdownFragment\(box\.innerHTML\);$/, 'and the filter has the last word');
-		// What a block is inserted as is always the filter's own nodes.
-		const renderBlocks = sliceBetween(previewPatchSource, 'function renderBlocks(', '\n}\n');
-		assert.deepEqual(
-			[...renderBlocks.matchAll(/Array\.from\((\w+)\.children\)/g)].map((m) => m[1]),
-			['clean', 'lone', 'mark'],
-		);
-		assert.match(renderBlocks, /const clean = processAndSanitize\(/);
-		assert.match(renderBlocks, /const lone = processAndSanitize\(/);
-		assert.match(renderBlocks, /const marks = Array\.from\(clean\.children\);/);
-		assert.match(renderBlocks, /return marks\.map\(\(mark\) =>/);
-		assert.doesNotMatch(previewPatchSource, /insertAdjacentHTML|outerHTML|createContextualFragment/);
-
-		// Why the footnote sink is allowed, pinned as a direction rather than as a
-		// spelling: the tooltip body is read out of the rendered document, never
-		// built from a string the sanitizer has not seen.
-		//
-		// `previewBlocks` and not `markdownBody`, and the difference is the whole
-		// point of the assertion rather than a rename. The article now holds one
-		// host per open tab, and `previewBlocks` is the one `patchPreview` was
-		// handed above — so this pins the tooltip to the exact element the sanitized
-		// string was parsed into, where the previous spelling only reached the box
-		// containing it.
-		const footnote = sliceBetween(viewerSource, "anchor.hasAttribute('data-footnote-ref')", 'isFootnote: true');
-		assert.match(footnote, /previewBlocks\?\.querySelector/, 'the footnote body is found in the rendered document');
-		assert.match(footnote, /\.innerHTML/, 'and taken from the DOM the shared sanitizer already filtered');
-		assert.doesNotMatch(footnote, /rawContent/, 'never from the unrendered buffer');
+		// What patchPreview does with that string, and where the footnote tooltip's
+		// body comes from, are run in preview.spec.ts ("the preview path patches in
+		// the filtered nodes, with the same policy", "a footnote tooltip is read back
+		// out of the rendered preview"). What stays here is the set of sinks.
 
 		// The regression itself — a DOMPurify call with a config assembled at the
 		// call site — is caught for the whole tree by the call-site allowlist below;
@@ -554,25 +195,6 @@ describe('preview sanitizing', () => {
 		);
 	});
 
-	test('the shared policy the preview now gets is the one that forbids author stylesheets', () => {
-		// Read as one chain: the preview patch calls sanitizeMarkdownFragment (test
-		// above), which passes MARKDOWN_SANITIZE_CONFIG and only asks for nodes
-		// back, as the export's sanitizeMarkdownHtml passes it, and that config
-		// forbids the tag the payload needs.
-		assert.match(sanitizeSource, /return DOMPurify\.sanitize\(html, MARKDOWN_SANITIZE_CONFIG\)/);
-		assert.match(
-			sanitizeSource,
-			/return DOMPurify\.sanitize\(html, \{ \.\.\.MARKDOWN_SANITIZE_CONFIG, RETURN_DOM_FRAGMENT: true \}\)/,
-		);
-		assert.deepEqual(Object.keys(MARKDOWN_SANITIZE_CONFIG).sort(), ['ALLOWED_URI_REGEXP', 'FORBID_TAGS']);
-		assert.deepEqual(MARKDOWN_SANITIZE_CONFIG.FORBID_TAGS, ['style']);
-		// Identity, not equality: the regression this file exists for is a *copy* of
-		// the URI pattern, and a copy that happens to be spelled the same today is
-		// the thing that drifts tomorrow. Measured — rebuilding the config's regexp
-		// from the exported one's source and flags fails here.
-		assert.equal(MARKDOWN_SANITIZE_CONFIG.ALLOWED_URI_REGEXP, ALLOWED_MARKDOWN_URI_REGEXP);
-	});
-
 	// Every `DOMPurify.sanitize` in `src/` is a decision about what a piece of
 	// untrusted input is allowed to be, and the compiler cannot tell that a new one
 	// silently reintroduces a private policy — this file exists because that is
@@ -661,43 +283,13 @@ describe('preview width', () => {
 
 	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 
-	const settingsComponentSource = readSource(new URL('../src/lib/components/Settings.svelte', import.meta.url));
-
-	const tocOverlaySource = readSource(new URL('../src/lib/utils/tocOverlay.ts', import.meta.url));
-
-	test('settings load, persist, and reset the preview width through one normalizer', () => {
-		assert.match(settingsSource, /previewMaxWidth = \$state\(DEFAULT_PREVIEW_MAX_WIDTH\)/);
-		// Persistence moved from one all-fields effect to one entry per localStorage
-		// key (so that a change in one window stops rewriting every other key from a
-		// stale snapshot). The preview width still round-trips under the same key and
-		// through the same normalizer; only the plumbing that reads and writes it is
-		// now shared. See scripts/settings.spec.ts.
-		assert.match(settingsSource, /key: 'preview\.maxWidth'/);
-		assert.match(settingsSource, /read: \(s\) => String\(s\.previewMaxWidth\)/);
-		assert.match(settingsSource, /normalizePreviewMaxWidth\(savedPreviewMaxWidth\)/);
-		assert.match(settingsSource, /resetPreviewMaxWidth\(\)[\s\S]*this\.previewMaxWidth = DEFAULT_PREVIEW_MAX_WIDTH/);
-	});
-
-	test('preview layout derives width and ToC geometry from the same preference', () => {
-		assert.match(viewerSource, /getPreviewContentWidth\(settings\.previewMaxWidth, settings\.previewFullWidth\)/);
-		// The gutter arithmetic moved to `tocOverlay.ts` with #176, which added the
-		// question the inline expression could not answer: whether the pane under
-		// the outline is the preview at all. Both halves still feed on this same
-		// preference — see scripts/layout.test.ts for the geometry itself.
-		assert.match(viewerSource, /isTocOverhanging\(\{[\s\S]*?previewContentWidth,[\s\S]*?\}\)/);
-		assert.match(tocOverlaySource, /input\.viewerWidth - input\.previewContentWidth/);
-		assert.match(viewerSource, /--preview-max-width:/);
+	test('the stylesheet reads the width the markup writes', () => {
+		// Contract between the inline style and the component's <style>: the
+		// width itself is previewLayout's (preview.test.ts "preview layout").
+		assert.match(viewerSource, /--preview-max-width: \{layout\.maxWidthCss\}/);
 		assert.match(viewerSource, /--measure: min\(100cqi, var\(--preview-max-width, 880px\)\)/);
 	});
 
-	test('Settings exposes a bounded preview-width input and reset action', () => {
-		assert.match(settingsComponentSource, /id="preview-max-width"/);
-		assert.match(settingsComponentSource, /min=\{MIN_PREVIEW_MAX_WIDTH\}/);
-		assert.match(settingsComponentSource, /max=\{MAX_PREVIEW_MAX_WIDTH\}/);
-		assert.match(settingsComponentSource, /bind:value=\{settings\.previewMaxWidth\}/);
-		assert.match(settingsComponentSource, /settings\.resetPreviewMaxWidth\(\)/);
-	});
-
 	test('preview full-width state migrates from the legacy localStorage key', () => {
 		// The pair the migration is made of, asserted on the function rather than on
 		// its call site: `??` is what makes the new key win once it exists.
@@ -758,64 +350,9 @@ describe('render pipeline convention', () => {
 });
 
 describe('save image as', () => {
-	/*
-	 * "Save image as" could never save a remote image, and on Windows it could not
-	 * save a LOCAL one either.
-	 *
-	 * The branch it took was `src.startsWith('http')` -> `fetch(src)`. Two things
-	 * are wrong with that:
-	 *
-	 * - The app's CSP is `connect-src 'self'`, so a cross-origin `fetch` from the
-	 *   webview is refused before a request is made. (`img-src ... https:` is a
-	 *   different directive: it governs what an `<img>` may DISPLAY.) The remote
-	 *   case was therefore unreachable on every platform.
-	 * - `convertFileSrc` spells a local file's asset URL
-	 *   `http://asset.localhost/<encoded path>` on Windows and
-	 *   `asset://localhost/<encoded path>` everywhere else. The `asset:` test
-	 *   above it only recognised the second, so on Windows every local image fell
-	 *   into that unreachable remote branch.
-	 *
-	 * The shape-recognition half is `normalizeAssetPath` (#363), which already had
-	 * tests for both spellings and for lookalike hosts. This file asserts that the
-	 * viewer now uses it — reuse is the fix, so the assertions are about the call
-	 * site — plus the two properties the reuse buys, run against the real function.
-	 */
-
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	const body = sliceBetween(viewer, 'async function saveImageAs', 'async function saveDiagramAs');
-
-	test('the viewer recognises an asset URL with the shared helper', () => {
-		assert.match(body, /normalizeAssetPath\(src\)/);
-		// The two hand-rolled tests this replaces. Either one coming back means the
-		// Windows spelling is unhandled again.
-		assert.doesNotMatch(body, /startsWith\('asset:'\)/);
-		assert.doesNotMatch(body, /startsWith\('http'\)/);
-	});
-
-	test('nothing tries to fetch image bytes from the webview any more', () => {
-		// Dead code that reads like a working feature: it opened no dialog, wrote
-		// no file, and reported a network failure that never happened.
-		assert.doesNotMatch(body, /fetch\(/);
-		assert.doesNotMatch(body, /arrayBuffer\(/);
-		assert.doesNotMatch(body, /save_file_binary/);
-	});
-
-	test('a local image is copied on the Rust side', () => {
-		assert.match(body, /invoke\('copy_file', \{ src: realPath, dest \}\)/);
-		// And the save dialog is only offered for a file that can actually be
-		// written; the remote case bails out before it.
-		const bail = offsetOf(body, "t('toast.remoteImageNotSupported'");
-		const dialog = offsetOf(body, 'await save(');
-		assert.ok(bail < dialog, 'do not ask for a destination that cannot be written');
-	});
-
-	test('the preview offers Save Image As only for a local image', () => {
-		// A remote or data: image cannot be saved, so the item is not shown for one
-		// rather than shown and answered with an error toast.
-		const menu = sliceBetween(viewer, "const img = (e.target as HTMLElement).closest('img');", "t('menu.saveImageAs'");
-		assert.match(menu, /if \(img && normalizeAssetPath\(img\.src\)\)/);
-	});
+	// `saveImageAs` refuses a remote image instead of fetching it because the
+	// CSP's `connect-src 'self'` refuses a cross-origin fetch from the webview.
+	// The function itself runs in preview.spec.ts ("save image as").
 
 	test('the CSP that makes the remote case impossible is still the one described', () => {
 		// If `connect-src` is ever widened, the comment above stops being true and
@@ -827,8 +364,6 @@ describe('save image as', () => {
 });
 
 describe('YouTube external fallback', () => {
-	const markdownViewer = readSource('src/lib/MarkdownViewer.svelte');
-
 	const tauriConfig = readSource('src-tauri/tauri.conf.json');
 
 	// --- the halves that are not this module's output ---
@@ -839,22 +374,4 @@ describe('YouTube external fallback', () => {
 		// outlived the iframe is permission granted for no feature.
 		assert.doesNotMatch(tauriConfig, /frame-src/);
 	});
-
-	test('linked YouTube thumbnails are not intercepted by image zoom', () => {
-		// Source-shape on purpose: the handler is in a Svelte component this
-		// runner cannot import. The claim is an ordering between two branches —
-		// the anchor must claim the click first, or clicking the poster opens the
-		// zoom overlay instead of the browser — so it is asserted as an ordering
-		// rather than by matching the body's shape.
-		const linkHandler = sliceBetween(
-			markdownViewer,
-			'async function handleLinkClick(e: MouseEvent)',
-			'\n\tasync function toggleTaskCheckbox',
-		);
-		const anchorGuard = offsetOf(linkHandler, "const a = target.closest('a');");
-		const imageZoom = offsetOf(linkHandler, "const img = target.closest('img');");
-
-		assert.ok(anchorGuard < imageZoom, 'the anchor branch claims the click before image zoom sees it');
-		assert.match(linkHandler, /if \(a\) \{[\s\S]*?\n\t\t\treturn;\n\t\t\}/, 'and the anchor branch returns rather than falling through');
-	});
 });
diff --git a/scripts/preview.renderedHtml.spec.ts b/scripts/preview.renderedHtml.spec.ts
index 52f18262..aae78100 100644
--- a/scripts/preview.renderedHtml.spec.ts
+++ b/scripts/preview.renderedHtml.spec.ts
@@ -1,6 +1,9 @@
 import { afterAll, beforeAll, describe, test } from 'vitest';
 import assert from 'node:assert/strict';
 import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
+import { exportAsHtml } from '../src/lib/utils/export.js';
+import { canExportTab } from '../src/lib/utils/tabFileActions.js';
+import { refreshesPreviewCache } from '../src/lib/utils/previewRefresh.js';
 
 describe('rendered HTML field', () => {
 	// ---------------------------------------------------------------- environment
@@ -10,11 +13,16 @@ describe('rendered HTML field', () => {
 	// has to be in place before the stores are imported, so both happen in beforeAll.
 	let tabManager: (typeof import('../src/lib/stores/tabs.svelte.js'))['tabManager'];
 	let settings: (typeof import('../src/lib/stores/settings.svelte.js'))['settings'];
+	const commands: string[] = [];
 
 	beforeAll(async () => {
 		(window as any).__TAURI_INTERNALS__ = {
 			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-			invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+			invoke: (cmd: string) => {
+				commands.push(cmd);
+				// The save dialog answers "cancelled": asking it is all exportWouldRun reads.
+				return Promise.resolve(cmd === 'get_os_type' ? 'macos' : null);
+			},
 		};
 		({ tabManager } = await import('../src/lib/stores/tabs.svelte.js'));
 		({ settings } = await import('../src/lib/stores/settings.svelte.js'));
@@ -33,6 +41,23 @@ describe('rendered HTML field', () => {
 		settings.newFileDefaultMode = true;
 	}
 
+	test('the preview HTML cache is not refreshed while editing with the TOC closed', () => {
+		// Ctrl+T, then type: an untitled buffer being edited, TOC closed, not split.
+		// The premise of the bug, taken from the shipping condition rather than
+		// asserted by hand. Without this, a repro would be a test fixture choosing
+		// its own outcome.
+		reset();
+		tabManager.addNewTab();
+		const tab = tabManager.activeTab!;
+		tab.isEditing = true;
+		tabManager.updateTabRawContent(tab.id, '# notes\n\nsomething worth exporting\n');
+
+		assert.equal(tab.isSplit, false);
+		assert.equal(refreshesPreviewCache(tab, () => tab.isEditing, () => settings.showToc), false, 'nothing re-renders tab.content in this state');
+		assert.equal(tab.content, '', 'so the rendered-HTML cache is still empty');
+		assert.notEqual(tab.rawContent, '', 'while the document itself is not');
+	});
+
 	// ------------------------------------------------- addTab's Markdown argument
 	//
 	// The same three fields, confused in the other direction. `addTab(path,
@@ -91,4 +116,105 @@ describe('rendered HTML field', () => {
 			assert.equal(tab.content, '', `${tab.path || tab.title} was constructed with a non-empty content field`);
 		}
 	});
+
+	// ------------------------------------------------------- the Home menu's export
+	//
+	// The menu used to gate on `content`, the rendered-preview HTML, which is
+	// still empty for a new file edited with the TOC closed: it hid an export
+	// that would have produced a file. It now asks the buffer, as the exports do.
+
+	test('an untitled buffer being edited is offered the export commands', () => {
+		reset();
+		tabManager.addNewTab();
+		const tab = tabManager.activeTab!;
+		tab.isEditing = true;
+		tabManager.updateTabRawContent(tab.id, '# notes\n\nsomething worth exporting\n');
+		assert.equal(tab.content, '', 'precondition: nothing has rendered this buffer');
+
+		assert.equal(canExportTab(tabManager.activeTab), true, 'the Home menu hid the exports for a document that exports fine');
+	});
+
+	test('a window with no tab at all offers no export', () => {
+		reset();
+
+		assert.equal(canExportTab(tabManager.activeTab), false);
+	});
+
+	test('a saved file is offered the export commands', () => {
+		reset();
+		tabManager.addTab('/notes/a.md');
+		tabManager.setTabRawContent(tabManager.activeTab!.id, '# a\n');
+
+		assert.equal(canExportTab(tabManager.activeTab), true);
+	});
+
+	test('a saved file with an empty buffer is offered nothing to export', () => {
+		// A saved empty file, or a tab whose read has not landed yet. The menu used
+		// to list the exports on the path alone, so Export as HTML then did nothing
+		// and Export as PDF printed a blank page.
+		reset();
+		tabManager.addTab('/notes/a.md');
+		tabManager.updateTabContent(tabManager.activeTab!.id, '<p>a stale render</p>');
+		assert.equal(tabManager.activeTab!.rawContent, '', 'precondition: the buffer is empty');
+
+		assert.equal(canExportTab(tabManager.activeTab), false);
+	});
+
+	/** Whether Export as HTML, given the active tab, would go as far as asking where to save. */
+	async function exportWouldRun(): Promise<boolean> {
+		const tab = tabManager.activeTab;
+		if (!tab) return false;
+		commands.length = 0;
+		await exportAsHtml({ rawContent: tab.rawContent, tabPath: tab.path, tabTitle: tab.title } as Parameters<typeof exportAsHtml>[0]);
+		return commands.includes('plugin:dialog|save');
+	}
+
+	function untitledBufferBeingEdited(text = '# notes\n\nsomething worth exporting\n') {
+		reset();
+		tabManager.addNewTab();
+		const tab = tabManager.activeTab!;
+		tab.isEditing = true;
+		tabManager.updateTabRawContent(tab.id, text);
+		return tab;
+	}
+
+	test('the menu is never stricter than the export it fronts', async () => {
+		// The invariant behind the fix, over the states a tab can be in. Being
+		// STRICTER is the defect this test is for; being looser is pinned by the
+		// empty-buffer tests.
+		const states: Array<[string, () => void]> = [
+			['untitled, edited, TOC closed', () => void untitledBufferBeingEdited()],
+			['untitled, edited, TOC open', () => { untitledBufferBeingEdited(); settings.showToc = true; }],
+			['untitled, split view', () => tabManager.setSplitEnabled(untitledBufferBeingEdited().id, true)],
+			['untitled, reading mode', () => { untitledBufferBeingEdited().isEditing = false; }],
+			[
+				'saved file, edited, TOC closed',
+				() => {
+					reset();
+					tabManager.addTab('/notes/a.md');
+					const tab = tabManager.activeTab!;
+					tabManager.setTabRawContent(tab.id, '# a\n');
+					tab.isEditing = true;
+				},
+			],
+		];
+
+		const hidden: string[] = [];
+		for (const [name, arrange] of states) {
+			arrange();
+			const offered = canExportTab(tabManager.activeTab);
+			if ((await exportWouldRun()) && !offered) hidden.push(name);
+		}
+		assert.deepEqual(hidden, [], 'the export is possible in these states and the menu hides it');
+	});
+
+	test('an empty untitled buffer is offered nothing to export', async () => {
+		// A gate that simply always returned true would pass the test above.
+		reset();
+		tabManager.addNewTab();
+		tabManager.activeTab!.isEditing = true;
+
+		assert.equal(await exportWouldRun(), false, 'precondition: exportAsHtml returns null for an empty buffer');
+		assert.equal(canExportTab(tabManager.activeTab), false, 'so the menu must not offer it either');
+	});
 });
diff --git a/scripts/preview.spec.ts b/scripts/preview.spec.ts
index b11c8d45..adf9224f 100644
--- a/scripts/preview.spec.ts
+++ b/scripts/preview.spec.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 import assert from 'node:assert/strict';
 import { flashCopiedLabel, renderRichContent, replacedBy, type RichContentLibraries } from '../src/lib/utils/richContent.js';
-import { patchPreview } from '../src/lib/utils/previewPatch.js';
+import { patchHost, patchPreview } from '../src/lib/utils/previewPatch.js';
 import { readDiagramSource } from '../src/lib/utils/mermaidPrint.js';
 import { resetDiagramCache } from '../src/lib/utils/diagramCache.js';
 import { toggleFold } from '../src/lib/utils/foldState.js';
@@ -9,7 +9,10 @@ import { type AnchorBox, type AnchorNode, findAnchorElement, getPreviewOffsetFor
 import { processMarkdownHtml } from '../src/lib/utils/markdown.js';
 import { type Annotation, annotationOf, hitAt, occurrenceRanges, overlapping, rangeOf } from '../src/lib/utils/previewAnnotations.js';
 import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
-import { copyableFlavours, copyableHtml } from '../src/lib/utils/previewCopy.js';
+import { copyableFlavours, copyableHtml, handleCopy } from '../src/lib/utils/previewCopy.js';
+import { linkTooltipFor } from '../src/lib/utils/previewLinks.js';
+import { imageMenuItems, saveImageAs, type SaveImageDeps } from '../src/lib/utils/viewerContextMenu.js';
+import { loadLocale } from '../src/lib/utils/i18n.js';
 import { type DomPoint, pointAtSource, sourceAtPoint, type SourcePoint } from '../src/lib/utils/previewCursor.js';
 import { ALLOWED_MARKDOWN_URI_REGEXP, sanitizeMarkdownFragment, sanitizeMarkdownHtml } from '../src/lib/utils/sanitize.js';
 import blocks from './fixtures/markdown-syntax.blocks.json';
@@ -274,6 +277,26 @@ describe('line samples cache', () => {
 		expect(root.querySelector('pre')).toBeNull();
 		expect(lineAt(250)).toBe(20);
 	});
+
+	test('a tab switch that skips the patch still drops the table', () => {
+		// Re-activating a tab hands its host the document it already holds, so the
+		// patch is skipped — but the hosts' `display` is what changed, and
+		// `isAnchorable` reads it.
+		const host = document.createElement('div');
+		document.body.replaceChildren(host);
+		const html = '<p data-sourcepos="1:1-1:1">x</p>\0\n<p data-sourcepos="10:1-10:1">y</p>';
+		const tab = () => ({ filePath: '/docs/a.md', foldOverrides: new Set<string>() });
+		patchHost(host, html, tab, () => {});
+		const measure = (node: AnchorNode) => ({ top: (node as unknown as Element).textContent === 'y' ? 100 : 0, height: 0 });
+		getSourceLineAtPreviewOffset(host, 50, measure);
+
+		const walk = vi.spyOn(Node.prototype, 'childNodes', 'get');
+		const patch = patchHost(host, html, tab, () => {});
+		expect(patch.inserted).toHaveLength(0);
+		getSourceLineAtPreviewOffset(host, 50, measure);
+		expect(walk).toHaveBeenCalled();
+		walk.mockRestore();
+	});
 });
 
 describe('NBSP blank lines', () => {
@@ -1322,3 +1345,228 @@ describe('rich content idempotence', () => {
 		});
 	});
 });
+
+describe('link hover preview', () => {
+	test('the hover preview never prints the webview origin', () => {
+		// `[3.md](./3.md)` showed `tauri://localhost/3.md`: the DOM resolves
+		// `href` against the webview's own origin. The box names the link as the
+		// document wrote it.
+		const anchor = document.createElement('a');
+		anchor.setAttribute('href', './3.md');
+		assert.notEqual(anchor.href, './3.md', 'jsdom resolves the property, as the webview does');
+		assert.deepEqual(linkTooltipFor(anchor, { findAnchorTarget: () => null, footnoteRoot: null }), {
+			text: './3.md',
+			html: '',
+			isFootnote: false,
+		});
+	});
+
+	test('a footnote tooltip is read back out of the rendered preview', () => {
+		// `{@html tooltip.html}` is the one sink besides the patched article, and it
+		// is allowed because its body is a clone of what the sanitized article
+		// already holds — never markup built from the unrendered buffer.
+		const preview = document.createElement('div');
+		preview.innerHTML = '<ol><li id="fn-1"><p>The <em>note</em> <a href="#fnref-1" class="footnote-backref">↩</a></p></li></ol>';
+		const ref = document.createElement('a');
+		ref.setAttribute('href', 'fn-1');
+		ref.setAttribute('data-footnote-ref', '');
+		const label = linkTooltipFor(ref, { findAnchorTarget: () => null, footnoteRoot: preview });
+		assert.equal(label?.isFootnote, true);
+		assert.equal(label?.html, '<p>The <em>note</em> </p>');
+		assert.equal(preview.querySelector('.footnote-backref')?.textContent, '↩', 'the preview keeps its own back-link');
+	});
+});
+
+describe('preview copy handler', () => {
+	// #549 put both DOM-selection copy routes — ⌘C in the preview, and Edit ▸ Copy
+	// in the menu bar — on one handler that writes the clipboard itself, because
+	// WebKit's own copy writes a WebArchive beside the text. #674 added exactly one
+	// more flavour, `text/html`, built here rather than by the scheme.
+
+	afterEach(() => {
+		window.getSelection()?.removeAllRanges();
+		document.body.innerHTML = '';
+	});
+
+	function copyEvent() {
+		const written: Record<string, string> = {};
+		let prevented = false;
+		const event = {
+			clipboardData: { setData: (type: string, value: string) => { written[type] = value; } },
+			preventDefault: () => { prevented = true; },
+		} as unknown as ClipboardEvent;
+		return { event, written, prevented: () => prevented };
+	}
+
+	function select(html: string) {
+		document.body.innerHTML = `<article>${html}</article>`;
+		const range = document.createRange();
+		range.selectNodeContents(document.querySelector('article')!);
+		const selection = window.getSelection()!;
+		selection.removeAllRanges();
+		selection.addRange(range);
+		return selection;
+	}
+
+	const DOC = '/Users/me/notes/report.md';
+
+	test('the copy handler writes plain text and cancels the native copy', () => {
+		select('<p>hello <strong>world</strong></p>');
+		const copy = copyEvent();
+		handleCopy(copy.event, DOC);
+		assert.equal(copy.written['text/plain'], 'hello world');
+		// Without this the native copy still runs and still builds the archive.
+		assert.equal(copy.prevented(), true);
+	});
+
+	test('the rich flavour is the one this handler builds, and the only one', () => {
+		// RTF is WebKit's own flavour; writing it would be the scheme deciding again.
+		const selection = select('<p>hello <strong>world</strong></p>');
+		const expected = copyableFlavours(selection, DOC).html;
+		const copy = copyEvent();
+		handleCopy(copy.event, DOC);
+		assert.deepEqual(Object.keys(copy.written).sort(), ['text/html', 'text/plain']);
+		assert.equal(copy.written['text/html'], expected);
+		assert.match(copy.written['text/html'], /<strong>world<\/strong>/);
+	});
+
+	test('both flavours come from one decision', () => {
+		// A selection containing math takes its plain text from the formula
+		// source, which only the HTML pass knows about.
+		select(
+			'<p>Energy <span class="katex">' +
+				'<span class="katex-mathml"><math><semantics><mrow><mi>E</mi></mrow><annotation encoding="application/x-tex">E=mc^2</annotation></semantics></math></span>' +
+				'<span class="katex-html" aria-hidden="true"><span class="base">E=mc2</span></span>' +
+				'</span></p>',
+		);
+		const copy = copyEvent();
+		handleCopy(copy.event, DOC);
+		assert.equal(copy.written['text/plain'], 'Energy $E=mc^2$');
+		assert.doesNotMatch(copy.written['text/html'], /katex-mathml/);
+	});
+
+	test('a selection inside a form control is left to the platform', () => {
+		// `getSelection()` cannot read a selection inside a field, so cancelling
+		// here would copy an empty string. Monaco takes input through a hidden
+		// textarea, which keeps the editor on its own copy path (#548).
+		const field = document.createElement('textarea');
+		document.body.append(field);
+		field.focus();
+		const article = document.createElement('article');
+		article.innerHTML = '<p>preview text</p>';
+		document.body.append(article);
+		const range = document.createRange();
+		range.selectNodeContents(article);
+		window.getSelection()!.removeAllRanges();
+		window.getSelection()!.addRange(range);
+		assert.equal(document.activeElement, field);
+		assert.equal(window.getSelection()!.isCollapsed, false);
+		const copy = copyEvent();
+		handleCopy(copy.event, DOC);
+		assert.deepEqual(copy.written, {});
+		assert.equal(copy.prevented(), false);
+	});
+
+	test('a collapsed selection is not copied', () => {
+		// Edit ▸ Copy is enabled with nothing selected; writing '' would clear the
+		// clipboard instead of leaving it alone.
+		select('<p>preview text</p>');
+		window.getSelection()!.collapseToStart();
+		const copy = copyEvent();
+		handleCopy(copy.event, DOC);
+		assert.deepEqual(copy.written, {});
+		assert.equal(copy.prevented(), false);
+	});
+});
+
+/*
+ * "Save image as" could never save a remote image, and on Windows it could not
+ * save a LOCAL one either. It took `src.startsWith('http')` -> `fetch(src)`:
+ * the app's CSP is `connect-src 'self'`, so that fetch is refused before a
+ * request is made, and `convertFileSrc` spells a local file
+ * `http://asset.localhost/…` on Windows, so every Windows image fell into that
+ * unreachable branch. `normalizeAssetPath` (#363) recognises both spellings.
+ */
+describe('save image as', () => {
+	function recordingDeps(dest: string | null = '/out/saved.png') {
+		const calls: string[] = [];
+		const deps: SaveImageDeps = {
+			save: async (options) => {
+				calls.push(`save:${options.defaultPath}`);
+				return dest;
+			},
+			copyFile: async (src, to) => void calls.push(`copy:${src}->${to}`),
+			toast: (message, type = 'info') => void calls.push(`toast:${type}:${message}`),
+			language: () => 'en',
+		};
+		return { deps, calls };
+	}
+
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	test('the viewer recognises an asset URL with the shared helper', async () => {
+		// Both spellings convertFileSrc emits, Windows first.
+		for (const [src, path] of [
+			['http://asset.localhost/C%3A%2FUsers%2FDaniel%2Fimg%2Fdiagram.png', 'C:/Users/Daniel/img/diagram.png'],
+			['asset://localhost/%2Fhome%2Fdaniel%2Fdiagram.png', '/home/daniel/diagram.png'],
+		]) {
+			const { deps, calls } = recordingDeps();
+			await saveImageAs(src, deps);
+			assert.equal(calls[1], `copy:${path}->/out/saved.png`, src);
+		}
+	});
+
+	test('nothing tries to fetch image bytes from the webview any more', async () => {
+		// Dead code that reads like a working feature: it opened no dialog, wrote
+		// no file, and reported a network failure that never happened.
+		const fetch = vi.fn(async () => new Response(new Uint8Array([1])));
+		vi.stubGlobal('fetch', fetch);
+		for (const src of ['https://example.test/a.png', 'http://asset.localhost/C%3A%2Fa.png', 'data:image/png;base64,AA==']) {
+			await saveImageAs(src, recordingDeps().deps);
+		}
+		assert.equal(fetch.mock.calls.length, 0);
+	});
+
+	test('a local image is copied on the Rust side', async () => {
+		const local = recordingDeps();
+		await saveImageAs('asset://localhost/%2Fpics%2Fcat.jpg', local.deps);
+		assert.deepEqual(local.calls, ['save:image.jpg', 'copy:/pics/cat.jpg->/out/saved.png', 'toast:info:Image saved successfully']);
+
+		// And the save dialog is only offered for a file that can actually be
+		// written; the remote case bails out before it.
+		const remote = recordingDeps();
+		await saveImageAs('https://example.test/a.png', remote.deps);
+		assert.equal(remote.calls.length, 1);
+		assert.match(remote.calls[0], /^toast:error:/);
+	});
+
+	test('the saved toast uses the language chosen while the dialog was open', async () => {
+		await loadLocale('de');
+		let language: 'en' | 'de' = 'en';
+		const { deps, calls } = recordingDeps();
+		const save = deps.save;
+		deps.save = async (options) => {
+			language = 'de';
+			return save(options);
+		};
+		deps.language = () => language;
+		await saveImageAs('asset://localhost/%2Fpics%2Fcat.jpg', deps);
+		assert.equal(calls.at(-1), 'toast:info:Bild erfolgreich gespeichert');
+	});
+
+	test('the preview offers Save Image As only for a local image', () => {
+		// A remote or data: image cannot be saved, so the item is not shown for one
+		// rather than shown and answered with an error toast.
+		const itemsFor = (src: string) => {
+			const img = document.createElement('img');
+			img.src = src;
+			return imageMenuItems(img, 'en', () => {}).map((item) => item.label ?? '-');
+		};
+		assert.deepEqual(itemsFor('asset://localhost/%2Fpics%2Fcat.jpg'), ['Save Image As...', '-']);
+		assert.deepEqual(itemsFor('http://asset.localhost/C%3A%2Fcat.jpg'), ['Save Image As...', '-']);
+		assert.deepEqual(itemsFor('https://example.test/cat.jpg'), []);
+		assert.deepEqual(itemsFor('data:image/png;base64,AA=='), []);
+	});
+});
diff --git a/scripts/preview.test.ts b/scripts/preview.test.ts
index baf4ae02..f8790604 100644
--- a/scripts/preview.test.ts
+++ b/scripts/preview.test.ts
@@ -4,10 +4,12 @@ import { anchorIdCandidates, getMarkdownLinkTarget, resolveMarkdownTargetPath }
 import { asBufferLine, asRendererLine, type BufferLine, lineCoordinates } from '../src/lib/utils/lineCoordinates.ts';
 import { opensInNewTab } from '../src/lib/utils/shortcuts.js';
 import { resolveLocalFileLinkPath } from '../src/lib/utils/localFileLinks.js';
+import { followDocumentLink, handlePreviewClick, openRelativeMarkdownTarget, openWithSystem, type PreviewClickDeps } from '../src/lib/utils/previewLinks.js';
 import { type KeyContext, viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
-import { viewerCommandTable } from './keymapHarness.js';
+import { viewerCommandTable, type ViewerCommandHost } from '../src/lib/utils/viewerCommands.js';
 import { adjustPreviewMaxWidth, DEFAULT_PREVIEW_MAX_WIDTH, getPreviewContentWidth, getStoredPreviewFullWidth, MAX_PREVIEW_MAX_WIDTH, MIN_PREVIEW_MAX_WIDTH, normalizePreviewMaxWidth } from '../src/lib/utils/previewWidth.js';
 import { normalizeAssetPath } from '../src/lib/utils/exportHtml.js';
+import { previewLayout } from '../src/lib/utils/previewLayout.ts';
 import { processMarkdownHtml } from '../src/lib/utils/markdown.ts';
 import { parseHtml, type ShimElement } from './renderProtocolDom.ts';
 import { useShimDom } from './preview.domShim.ts';
@@ -473,14 +475,17 @@ describe('preview width', () => {
 		// The text-field carve-out needs a real DOM and a real selector match, so it
 		// is asserted in `shortcuts.spec.ts` under jsdom rather than faked here.
 
-		// What the command DOES stays in the component — the seam ends at the name.
-		// See the note on `viewerCommandTable` in `keymapHarness.ts`.
-		const narrower = viewerCommandTable()['preview-width-narrower'];
-		assert.match(narrower, /settings\.previewFullWidth = false/);
-		assert.match(
-			narrower,
-			/settings\.previewMaxWidth = adjustPreviewMaxWidth\(\s*settings\.previewMaxWidth,\s*command === 'preview-width-narrower' \? -40 : 40,?\s*\)/,
-		);
+		// What the command does: leave full width, then step the cap by 40px.
+		const settings = { previewFullWidth: true, previewMaxWidth: 880, showTabs: true } as ViewerCommandHost['settings'];
+		const commands = viewerCommandTable({ settings } as ViewerCommandHost);
+		commands['preview-width-narrower']();
+		assert.deepEqual([settings.previewFullWidth, settings.previewMaxWidth], [false, 840]);
+		commands['preview-width-wider']();
+		commands['preview-width-wider']();
+		assert.equal(settings.previewMaxWidth, 920);
+		settings.previewMaxWidth = MAX_PREVIEW_MAX_WIDTH;
+		commands['preview-width-wider']();
+		assert.equal(settings.previewMaxWidth, MAX_PREVIEW_MAX_WIDTH);
 	});
 });
 
@@ -693,3 +698,237 @@ describe('YouTube external fallback', () => {
 		assert.equal(root.querySelectorAll('img').length, 0);
 	});
 });
+
+describe('preview link clicks', () => {
+	/*
+	 * Three listeners see a click on a document link, in this order:
+	 *
+	 *   <article>                  handlePreviewClick  — folds, anchors, markdown links, zoom
+	 *   document.documentElement   SvelteKit's router  — `if (event.defaultPrevented) return`
+	 *   document                   followDocumentLink  — local files and URLs
+	 *
+	 * #772: `[PDF_1](Files/PDF_1.pdf)` opened the file AND left the app on a 404
+	 * page, because the preview declined the click without claiming it and the
+	 * router navigated to a route an SPA does not have.
+	 */
+
+	type Calls = string[];
+
+	/** The parts of a DOM element these handlers read. */
+	function element(tag: string, attrs: Record<string, string> = {}, parent: FakeElement | null = null): FakeElement {
+		return {
+			tag,
+			src: attrs.src ?? '',
+			href: attrs.resolvedHref ?? '',
+			getAttribute: (name: string) => attrs[name] ?? null,
+			closest(selector: string) {
+				for (let el: FakeElement | null = this; el; el = el.parent) if (el.tag === selector) return el;
+				return null;
+			},
+			parent,
+		};
+	}
+	interface FakeElement {
+		tag: string;
+		src: string;
+		href: string;
+		parent: FakeElement | null;
+		getAttribute(name: string): string | null;
+		closest(selector: string): FakeElement | null;
+	}
+
+	function click(target: FakeElement) {
+		const result = { defaultPrevented: false, propagationStopped: false };
+		const event = {
+			detail: 1,
+			target,
+			preventDefault: () => { result.defaultPrevented = true; },
+			stopPropagation: () => { result.propagationStopped = true; },
+		} as unknown as MouseEvent;
+		return { event, result };
+	}
+
+	function previewDeps(calls: Calls, overrides: Partial<PreviewClickDeps> = {}): PreviewClickDeps {
+		return {
+			hideTooltip: () => void calls.push('hide tooltip'),
+			toggleFold: () => false,
+			scrollToAnchor: async (id) => void calls.push(`scroll ${id}`),
+			opensInNewTab: () => false,
+			openInNewTab: async (t) => void calls.push(`new tab ${t.path}`),
+			openHere: async (t) => void calls.push(`open ${t.path}`),
+			zoom: (data) => void calls.push(`zoom ${data.src ?? data.html}`),
+			placeCursor: () => void calls.push('place cursor'),
+			...overrides,
+		};
+	}
+
+	async function clickLink(href: string) {
+		const { event, result } = click(element('a', { href }));
+		await handlePreviewClick(event, previewDeps([]));
+		return result;
+	}
+
+	test('a link the document handler opens leaves the preview already claimed', async () => {
+		for (const href of ['Files/PDF_1.pdf', './Files/MP4_1.mp4', '/srv/data.csv', 'https://example.com']) {
+			const { defaultPrevented, propagationStopped } = await clickLink(href);
+			assert.equal(defaultPrevented, true, `${href} must not reach the router undecided`);
+			// Claimed, not swallowed: the document handler is one listener further
+			// up and is the thing that opens it.
+			assert.equal(propagationStopped, false, `${href} must still reach the document handler`);
+		}
+	});
+
+	test('a markdown link is handled here and goes no further', async () => {
+		const { defaultPrevented, propagationStopped } = await clickLink('./other.md');
+		assert.equal(defaultPrevented, true);
+		assert.equal(propagationStopped, true);
+	});
+
+	test('a click takes the hover preview down before it does anything else', async () => {
+		// Every branch can be the one that replaces the document — a fold, an
+		// anchor, a relative link — and removing the hovered anchor dispatches
+		// no `mouseout`, so the box would stay on screen.
+		const cases: [FakeElement, Partial<PreviewClickDeps>][] = [
+			[element('span'), { toggleFold: () => true }],
+			[element('a', { href: '#intro' }), {}],
+			[element('a', { href: './other.md' }), {}],
+			[element('img', { src: 'asset://localhost/a.png' }), {}],
+		];
+		for (const [target, overrides] of cases) {
+			const calls: Calls = [];
+			await handlePreviewClick(click(target).event, previewDeps(calls, overrides));
+			assert.equal(calls[0], 'hide tooltip', `${target.tag}: ${calls.join(', ')}`);
+		}
+	});
+
+	test('linked YouTube thumbnails are not intercepted by image zoom', async () => {
+		// The poster is an <img> inside the link: the anchor must claim the click,
+		// or clicking it opens the zoom overlay instead of the browser.
+		const link = element('a', { href: 'https://www.youtube.com/watch?v=abc' });
+		const poster = element('img', { src: 'https://img.youtube.com/vi/abc/hqdefault.jpg' }, link);
+		const calls: Calls = [];
+		const { event, result } = click(poster);
+		await handlePreviewClick(event, previewDeps(calls));
+		assert.deepEqual(calls, ['hide tooltip']);
+		assert.equal(result.defaultPrevented, true, 'left for the document handler to open');
+	});
+
+	const DOC = '/notes/report.md';
+
+	function documentDeps(calls: Calls, openUrl: (url: string) => Promise<void> = async (url) => void calls.push(`url ${url}`)) {
+		return {
+			currentFile: DOC,
+			openHere: async (t: { path: string }) => void calls.push(`open ${t.path}`),
+			openWithSystem: async (path: string) => void calls.push(`system ${path}`),
+			openUrl,
+			openFailed: (rawHref: string) => void calls.push(`failed ${rawHref}`),
+		};
+	}
+
+	async function followLink(href: string, resolvedHref: string, openUrl?: (url: string) => Promise<void>) {
+		const calls: Calls = [];
+		const anchor = element('a', { href, resolvedHref }) as unknown as HTMLAnchorElement;
+		const { event, result } = click(anchor as unknown as FakeElement);
+		await followDocumentLink(event, anchor, documentDeps(calls, openUrl));
+		return { calls, defaultPrevented: result.defaultPrevented };
+	}
+
+	test('markdown targets are still claimed before the local-file branch', async () => {
+		// `./other.md` must open in a tab, not in an external editor.
+		const { calls } = await followLink('./other.md', 'tauri://localhost/other.md');
+		assert.deepEqual(calls, ['open ./other.md']);
+	});
+
+	test('a local file is handed to the OS as a path, not as a URL', async () => {
+		// The DOM resolves the href against the webview origin; the OS gets the
+		// disk path the document means.
+		const { calls, defaultPrevented } = await followLink('Files/data.csv', 'tauri://localhost/Files/data.csv');
+		assert.deepEqual(calls, ['system /notes/Files/data.csv']);
+		assert.equal(defaultPrevented, true);
+		assert.deepEqual((await followLink('https://example.com/a', 'https://example.com/a')).calls, ['url https://example.com/a']);
+	});
+
+	function systemDeps(calls: Calls, launchable: boolean, openPath = async (path: string) => void calls.push(`open ${path}`)) {
+		return {
+			isLaunchable: async () => launchable,
+			reveal: async (path: string) => void calls.push(`reveal ${path}`),
+			openPath,
+			revealed: (path: string) => void calls.push(`toast revealed ${path}`),
+			openFailed: (path: string) => void calls.push(`toast failed ${path}`),
+		};
+	}
+
+	test('a launchable target is revealed, not opened', async () => {
+		// `openPath` hands the file to the OS default handler, and for
+		// `./setup.command`, `Calculator.app` or `x.exe` that handler runs it.
+		const launchable: Calls = [];
+		await openWithSystem('/notes/setup.command', systemDeps(launchable, true));
+		assert.deepEqual(launchable, ['reveal /notes/setup.command', 'toast revealed /notes/setup.command']);
+
+		const document: Calls = [];
+		await openWithSystem('/notes/data.csv', systemDeps(document, false));
+		assert.deepEqual(document, ['open /notes/data.csv']);
+	});
+
+	test('neither OS call can leave an unhandled rejection behind', async () => {
+		// `openUrl` rejects for anything outside the opener scope. Unhandled, that
+		// rejection was the whole visible symptom on macOS: nothing happened, and
+		// nothing said why.
+		const refused = async () => { throw new Error('ForbiddenPath'); };
+		const originalError = console.error;
+		console.error = () => {};
+		try {
+			const file: Calls = [];
+			await openWithSystem('/notes/data.csv', systemDeps(file, false, refused));
+			assert.deepEqual(file, ['toast failed /notes/data.csv']);
+
+			const { calls } = await followLink('tel:123', 'tel:123', refused);
+			assert.deepEqual(calls, ['failed tel:123']);
+		} finally {
+			console.error = originalError;
+		}
+	});
+
+	// "Is this link the file I am reading?" is a question about the FILE. On
+	// macOS `[x](readme.md#a)` inside `Readme.md` names the open document, and
+	// comparing spellings answered no: the click asked to save or discard the
+	// unsaved edits and reloaded the file instead of scrolling to `#a`.
+	async function openRelative(currentFile: string, path: string) {
+		const calls: Calls = [];
+		await openRelativeMarkdownTarget({ path, hash: 'a' }, {
+			currentFile,
+			// A case-insensitive volume whose directory holds `Readme.md`.
+			canonicalizePath: async (p) => (p.toLowerCase() === '/notes/readme.md' ? '/notes/Readme.md' : p),
+			scrollToAnchorWhenReady: async () => void calls.push('scroll'),
+			scrollToTop: () => void calls.push('top'),
+			activeTabId: 'tab',
+			canCloseTab: async () => {
+				calls.push('ask to close');
+				return true;
+			},
+			loadMarkdown: async () => void calls.push('load'),
+		});
+		return calls;
+	}
+
+	test('a link to the open file under another spelling scrolls instead of reloading', async () => {
+		assert.deepEqual(await openRelative('/notes/Readme.md', 'readme.md'), ['scroll']);
+		assert.deepEqual(await openRelative('/notes/Readme.md', 'other.md'), ['ask to close', 'load', 'scroll']);
+	});
+});
+
+describe('preview layout', () => {
+	test('preview layout derives width and ToC geometry from the same preference', () => {
+		// A 1400px pane and a 240px outline: at 880px the text leaves a 260px
+		// gutter the outline fits in; widened to 1240px the gutter is 80px and the
+		// outline covers the text. One preference moves both answers.
+		const reading = { isEditing: false, isSplit: false, viewerWidth: 1400 };
+		const base = { previewMaxWidth: 880, previewFullWidth: false, tocSide: 'left' as const, splitEditorSide: 'left' as const, tocWidth: 240 };
+		const narrow = previewLayout(base, reading);
+		assert.deepEqual([narrow.maxWidthCss, narrow.isOverhanging], ['880px', false]);
+		const wide = previewLayout({ ...base, previewMaxWidth: 1240 }, reading);
+		assert.deepEqual([wide.maxWidthCss, wide.isOverhanging], ['1240px', true]);
+		const full = previewLayout({ ...base, previewFullWidth: true }, reading);
+		assert.deepEqual([full.maxWidthCss, full.isOverhanging], ['100%', true]);
+	});
+});
diff --git a/scripts/release.checks.test.ts b/scripts/release.checks.test.ts
index be64215d..59c9c9b1 100644
--- a/scripts/release.checks.test.ts
+++ b/scripts/release.checks.test.ts
@@ -674,14 +674,7 @@ describe('one version across the manifests', () => {
 		const pkg = JSON.parse(readSource('package.json'));
 		assert.equal(pkg.scripts.release, 'node scripts/release.mjs');
 
-		// It has to touch all three, or it is a bump that reintroduces the skew.
-		const script = readSource('scripts/release.mjs');
-		for (const file of ['package.json', 'src-tauri/Cargo.toml', 'Cargo.lock']) {
-			assert.ok(script.includes(file), `scripts/release.mjs never mentions ${file}`);
-		}
-		// The lock is cargo's format; a hand-rolled rewrite of it is the bug, not the
-		// fix.
-		assert.match(script, /cargo['"],\s*\['update'/);
+		// That it writes all three is run in release.test.ts.
 
 		// And the runbook points at the command rather than at the two files.
 		assert.match(readSource('RELEASING.md'), /npm run release X\.Y\.Z/);
@@ -935,25 +928,9 @@ describe('NSIS installer hooks', () => {
 
 describe('a package-managed install is not offered an update', () => {
 	const store = readSource('src/lib/stores/update.svelte.ts');
-	const dialog = readSource('src/lib/components/UpdateDialog.svelte');
 	const rust = readRustBackend();
 	const i18n = readDictionarySource();
 
-	test('the updater asks whether it can install before it checks', () => {
-		// The whole defect is a sequence: check first, discover the impossibility
-		// second. Asserting that both calls exist would pass on the broken order,
-		// so the assertion is where they sit relative to each other.
-		const runCheck = sliceBetween(store, 'async runCheck()', 'async startDownload(');
-		const gate = runCheck.indexOf("invoke<boolean>('self_update_supported')");
-		const checkCall = runCheck.indexOf('await check()');
-		assert.ok(gate !== -1, 'runCheck must ask self_update_supported');
-		assert.ok(checkCall !== -1, 'runCheck must still call check() when self-update is possible');
-		assert.ok(
-			gate < checkCall,
-			'self_update_supported must be consulted before check(), or the user is offered an update that cannot be installed',
-		);
-	});
-
 	test('the command exists on the Rust side and is reachable', () => {
 		// A Tauri command is addressed by a string, so nothing in the type system
 		// connects the two halves: an unregistered command fails at runtime, and
@@ -963,29 +940,16 @@ describe('a package-managed install is not offered an update', () => {
 		assert.match(handler, /self_update_supported/);
 	});
 
-	test('only Linux is gated', () => {
-		// Windows runs the downloaded NSIS installer rather than overwriting
-		// anything in place, and macOS is the one platform where bundle_type()
-		// answers without the build-time patch. Gating either would break a working
-		// updater for 95% of downloads.
+	test('the AppImage is detected through tauri\'s Env, not a raw variable', () => {
+		// Which platforms are gated is `only_linux_gates_self_update` in
+		// commands.rs. What stays here is the convention that the AppImage is
+		// read through tauri's Env, which also verifies the executable is under
+		// $TMPDIR/.mount_. `std::env::var("APPIMAGE")` alone is settable by hand.
 		const command = sliceBetween(rust, 'fn self_update_supported', '\npub fn get_os_type');
-		assert.match(command, /#\[cfg\(target_os = "linux"\)\]/);
 		assert.match(command, /appimage\.is_some\(\)/);
-		assert.match(command, /#\[cfg\(not\(target_os = "linux"\)\)\]/);
-		// Read through tauri's Env, which also verifies the executable is under
-		// $TMPDIR/.mount_. `std::env::var("APPIMAGE")` alone is settable by hand.
 		assert.doesNotMatch(command, /env::var/);
 	});
 
-	test('the dialog can render the phase, and can be dismissed from it', () => {
-		// A phase the store can enter but the dialog cannot draw is a blank modal
-		// with no way out — the footer branch matters as much as the body one.
-		assert.match(dialog, /packageManagedHeader/);
-		assert.match(dialog, /packageManagedBody/);
-		const footer = sliceBetween(dialog, '<div class="update-footer">', '</div>\n\t\t</div>');
-		assert.match(footer, /phase === 'package-managed'/);
-	});
-
 	test('the new strings are translated wherever the rest of this dialog is', () => {
 		// The update dialog is only translated into four of the app's 26 languages;
 		// the other 22 fall back to English for all of it. Matching that set exactly
@@ -1003,30 +967,6 @@ describe('a package-managed install is not offered an update', () => {
 	});
 });
 
-describe('the update dialog', () => {
-	const dialog = readSource('src/lib/components/UpdateDialog.svelte');
-	const globalStyles = readSource('src/styles.css');
-
-	test('release notes can be selected even though the app disables selection', () => {
-		// The app root sets `user-select: none` on purpose. Anything that holds text
-		// a user has to copy out has to say so for itself — nothing else in this
-		// component does, so a rule that quietly went missing here would look like
-		// no rule at all, which is what #532 reported.
-		assert.match(globalStyles, /user-select: none/);
-
-		const notesRule = /\.notes pre \{[^}]*\}/.exec(dialog)?.[0];
-		assert.ok(notesRule, 'the release-notes block must still have its own style rule');
-		assert.match(notesRule, /user-select: text/);
-		assert.match(notesRule, /-webkit-user-select: text/);
-	});
-
-	test('the dialog promises reopened tabs only when restore is on', () => {
-		// With "Restore windows on launch" off nothing writes the snapshot, so the
-		// relaunched app opens empty and must not have been told otherwise.
-		assert.match(dialog, /\{#if settings\.restoreStateOnReopen\}<p>\{tk\('reopensTabs'\)\}<\/p>\{\/if\}/);
-	});
-});
-
 describe('the asset protocol scope', () => {
 	// `![](.res/pic.jpg)` rendered blank on Linux and macOS (#981). Tauri's fs
 	// scope defaults `requireLiteralLeadingDot` to true on Unix, so `**` does not
@@ -1208,7 +1148,7 @@ describe('single implementations', () => {
 		{
 			name: 'the list-marker grammar has one implementation in src',
 			why:
-				"\"What a list item's marker looks like\" had three spellings: the Rust renderer's TASK_SOURCE_RE, the preview's checkbox rewrite in documentSession.svelte.ts, and the toolbar's line-marker toggles. The first two agreed; the toolbar's copy accepted neither an indented item nor the `1)` delimiter, so a click on a nested bullet answered `-     - sub` and a click on `1) item` answered `- 1) item` — issue #451 verbatim, one delimiter over. utils/listSyntax.ts holds the vocabulary now. What each site wraps around it — the anchors, the separator, and whether the leading indentation is consumed or preserved — stays at the call site on purpose: the renderer throws that prefix away, the toolbar has to put it back, and sharing *that* would flatten every nested list item on the first click. The Rust copy is pinned against this one by taskToggleLineEndings.test.ts, because no import crosses that boundary.",
+				"\"What a list item's marker looks like\" had three spellings: the Rust renderer's TASK_SOURCE_RE, the preview's checkbox rewrite in documentSession.svelte.ts, and the toolbar's line-marker toggles. The first two agreed; the toolbar's copy accepted neither an indented item nor the `1)` delimiter, so a click on a nested bullet answered `-     - sub` and a click on `1) item` answered `- 1) item` — issue #451 verbatim, one delimiter over. utils/listSyntax.ts holds the vocabulary now. What each site wraps around it — the anchors, the separator, and whether the leading indentation is consumed or preserved — stays at the call site on purpose: the renderer throws that prefix away, the toolbar has to put it back, and sharing *that* would flatten every nested list item on the first click. The Rust copy is pinned against this one by documents.checks.test.ts \"task toggle line endings\", because no import crosses that boundary.",
 			// The two fragments distinctive enough that prose cannot match them: the
 			// task box's character class and the ordered delimiter pair.
 			marker: /\[ xX\]|\\d\+\[\.\)\]/g,
diff --git a/scripts/release.spec.ts b/scripts/release.spec.ts
index e6413f8f..c6a41e24 100644
--- a/scripts/release.spec.ts
+++ b/scripts/release.spec.ts
@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 
+import { flushSync, mount, unmount } from 'svelte';
 import { describe, test, vi } from 'vitest';
 
 // Its own file: the `vi.mock` calls below replace the Tauri modules for every
@@ -9,15 +10,23 @@ import { describe, test, vi } from 'vitest';
 // updater exits inside `downloadAndInstall`, `relaunch()` requests an exit
 // elsewhere — so CloseRequested never fires and nothing reviews unsaved tabs or
 // writes the restore snapshot unless the store asks for it first.
-const { log, windows } = vi.hoisted(() => ({ log: [] as string[], windows: [{ label: 'main' }] }));
+const { log, windows, updater } = vi.hoisted(() => ({
+	log: [] as string[],
+	windows: [{ label: 'main' }],
+	updater: { selfUpdateSupported: true, checks: 0 },
+}));
 
 vi.mock('@tauri-apps/api/core', () => ({
-	invoke: async (cmd: string) => (cmd === 'list_viewer_windows' ? windows : true),
+	invoke: async (cmd: string) =>
+		cmd === 'list_viewer_windows' ? windows : cmd === 'self_update_supported' ? updater.selfUpdateSupported : true,
 }));
 vi.mock('@tauri-apps/api/window', () => ({ getCurrentWindow: () => ({ label: 'main' }) }));
 vi.mock('@tauri-apps/api/app', () => ({ getVersion: async () => '2.7.6' }));
 vi.mock('@tauri-apps/plugin-updater', () => ({
-	check: async () => ({ version: '2.7.7', body: '', downloadAndInstall: async () => void log.push('install') }),
+	check: async () => {
+		updater.checks += 1;
+		return { version: '2.7.7', body: '', downloadAndInstall: async () => void log.push('install') };
+	},
 }));
 vi.mock('@tauri-apps/plugin-process', () => ({
 	relaunch: async () => {
@@ -29,6 +38,9 @@ vi.mock('@tauri-apps/plugin-process', () => ({
 }));
 
 const { updateStore } = await import('../src/lib/stores/update.svelte.js');
+const { default: UpdateDialog } = await import('../src/lib/components/UpdateDialog.svelte');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { t } = await import('../src/lib/utils/i18n.js');
 
 describe('an update settles the window before it installs', () => {
 	async function offered() {
@@ -87,3 +99,91 @@ describe('an update settles the window before it installs', () => {
 		assert.equal(updateStore.otherWindows.length, 0);
 	});
 });
+
+describe('package-managed installs', () => {
+	test('the updater asks whether it can install before it checks', async () => {
+		// #570. A `.deb`, `.rpm` or snap install passes the check and then fails at
+		// install time. The question is asked first, so such an install is never
+		// offered an update, and the check is not even made.
+		updateStore.close();
+		updater.checks = 0;
+		updater.selfUpdateSupported = false;
+		try {
+			await updateStore.runCheck();
+			assert.equal(updateStore.phase, 'package-managed');
+			assert.equal(updater.checks, 0);
+		} finally {
+			updater.selfUpdateSupported = true;
+			updateStore.close();
+		}
+
+		await updateStore.runCheck();
+		assert.equal(updateStore.phase, 'available', 'a self-updating install still checks');
+		assert.equal(updater.checks, 1);
+	});
+});
+
+describe('the update dialog', () => {
+	// jsdom has no Web Animations, and the dialog's out transition calls
+	// `element.animate`. An animation that never finishes is enough here: the
+	// assertions read the store and the DOM, not the fade.
+	Element.prototype.animate ??= function () {
+		return { cancel() {}, playState: 'finished', effect: null, onfinish: null } as unknown as Animation;
+	};
+	const tk = (key: string) => t(`update.${key}`, settings.language);
+
+	function mountDialog() {
+		const target = document.createElement('div');
+		document.body.append(target);
+		const dialog = mount(UpdateDialog, { target, props: { settleForExit: async () => true }, intro: false });
+		flushSync();
+		return {
+			target,
+			[Symbol.dispose]() {
+				unmount(dialog);
+				target.remove();
+				updateStore.close();
+			},
+		};
+	}
+
+	test('the dialog can render the phase, and can be dismissed from it', () => {
+		// A phase the store can enter but the dialog cannot draw is a blank modal
+		// with no way out — the footer branch matters as much as the body one.
+		updateStore.close();
+		updateStore.show = true;
+		updateStore.phase = 'package-managed';
+		using view = mountDialog();
+		const { target } = view;
+
+		assert.equal(target.querySelector('#update-title')?.textContent?.trim(), tk('packageManagedHeader'));
+		assert.equal(target.querySelector('#update-body')?.textContent?.trim(), tk('packageManagedBody'));
+		const buttons = [...target.querySelectorAll<HTMLButtonElement>('.update-footer button')];
+		assert.deepEqual(buttons.map((b) => b.textContent?.trim()), [tk('ok')]);
+
+		buttons[0].click();
+		flushSync();
+		assert.equal(updateStore.show, false, 'OK dismisses the dialog');
+	});
+
+	test('the dialog promises reopened tabs only when restore is on', () => {
+		// With "Restore windows on launch" off nothing writes the snapshot, so the
+		// relaunched app opens empty and must not have been told otherwise.
+		const restore = settings.restoreStateOnReopen;
+		try {
+			for (const on of [true, false]) {
+				settings.restoreStateOnReopen = on;
+				updateStore.close();
+				updateStore.show = true;
+				updateStore.phase = 'available';
+				updateStore.otherWindows = [{ label: 'window-abc' } as any];
+				using view = mountDialog();
+				const alert = view.target.querySelector('.other-windows')?.textContent ?? '';
+				assert.ok(alert.includes(tk('closeOtherWindows')), 'the other windows are named either way');
+				assert.equal(alert.includes(tk('reopensTabs')), on, `restore ${on ? 'on' : 'off'}`);
+			}
+		} finally {
+			settings.restoreStateOnReopen = restore;
+		}
+	});
+});
diff --git a/scripts/release.test.ts b/scripts/release.test.ts
index 6b370b39..e13ccc52 100644
--- a/scripts/release.test.ts
+++ b/scripts/release.test.ts
@@ -1,7 +1,11 @@
 import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
 import { describe, test } from 'node:test';
 
-import { callbackBodies, enclosingFunctionName, functionSource, offsetOf, sliceBetween, sliceFrom } from './sourceTree.js';
+import { callbackBodies, enclosingFunctionName, functionSource, offsetOf, readSource, sliceBetween, sliceFrom } from './sourceTree.js';
 
 // scripts/sourceTree.ts is the plumbing four convention tests state their claims
 // through, so a hole in it is a hole in all of them at once, and it is invisible
@@ -161,3 +165,61 @@ describe('the sourceTree helpers', () => {
 		assert.throws(() => sliceBetween('xabc', 'b', 'x'), /expected to find "x" after "b"/);
 	});
 });
+
+describe('release version bump', () => {
+	// The stand-in cargo is a shell script.
+	const posix = { skip: process.platform === 'win32' && 'needs a POSIX shell' };
+
+	test('one command writes the version into all three files', posix, () => {
+		// RELEASING.md used to name two of the three, so the third was skipped by
+		// following the instructions correctly. The script runs here against a
+		// copy of the three manifests, with a stand-in `cargo` that records what
+		// it was asked and rewrites the lock entry the way `cargo update` does.
+		const root = realpathSync(mkdtempSync(join(tmpdir(), 'markpad-release-')));
+		try {
+			mkdirSync(join(root, 'src-tauri'));
+			mkdirSync(join(root, 'bin'));
+			writeFileSync(join(root, 'package.json'), '{\n  "name": "markpad",\n  "version": "1.0.0"\n}\n');
+			writeFileSync(
+				join(root, 'src-tauri/Cargo.toml'),
+				// A dependency's `version` ahead of ours, as a reordered manifest has.
+				'[dependencies]\nserde = { version = "1.0.0" }\n\n[package]\nname = "Markpad"\nversion = "1.0.0"\n',
+			);
+			writeFileSync(
+				join(root, 'src-tauri/Cargo.lock'),
+				'[[package]]\nname = "Markpad"\nversion = "1.0.0"\n\n[[package]]\nname = "serde"\nversion = "1.0.0"\n',
+			);
+			const cargo = join(root, 'bin/cargo');
+			writeFileSync(
+				cargo,
+				[
+					'#!/bin/sh',
+					'echo "$PWD $*" > ../cargo-call',
+					'[ "$1 $2 $3" = "update -p Markpad" ] || exit 9',
+					'sed -i.bak "/^name = \\"Markpad\\"$/{n;s/^version = .*/version = \\"$5\\"/;}" Cargo.lock',
+				].join('\n'),
+			);
+			chmodSync(cargo, 0o755);
+
+			const run = spawnSync(process.execPath, [resolve('scripts/release.mjs'), '2.3.4'], {
+				cwd: root,
+				env: { ...process.env, PATH: `${join(root, 'bin')}:${process.env.PATH}` },
+				encoding: 'utf8',
+			});
+			assert.equal(run.status, 0, run.stderr);
+
+			assert.equal(JSON.parse(readSource(join(root, 'package.json'))).version, '2.3.4');
+			const toml = readSource(join(root, 'src-tauri/Cargo.toml'));
+			assert.match(toml, /\[package\]\nname = "Markpad"\nversion = "2.3.4"/);
+			assert.match(toml, /serde = \{ version = "1.0.0" \}/, 'a dependency version is not ours');
+			assert.match(readSource(join(root, 'src-tauri/Cargo.lock')), /name = "Markpad"\nversion = "2.3.4"/);
+			// The lock is cargo's format; it is handed to cargo, not rewritten.
+			assert.equal(
+				readSource(join(root, 'cargo-call')).trim(),
+				`${join(root, 'src-tauri')} update -p Markpad --precise 2.3.4`,
+			);
+		} finally {
+			rmSync(root, { recursive: true, force: true });
+		}
+	});
+});
diff --git a/scripts/settings.checks.spec.ts b/scripts/settings.checks.spec.ts
index eb3ad273..d2ac38c7 100644
--- a/scripts/settings.checks.spec.ts
+++ b/scripts/settings.checks.spec.ts
@@ -1,9 +1,8 @@
 import assert from 'node:assert/strict';
 
-import { parse } from 'svelte/compiler';
 import { describe, test } from 'vitest';
 
-import { callbackBodies, readSource, sliceBetween } from './sourceTree.js';
+import { readSource } from './sourceTree.js';
 
 // Plain TypeScript, no runes: safe to import statically, unlike the store below.
 describe('settings persistence', async () => {
@@ -55,31 +54,6 @@ describe('settings persistence', async () => {
 		writeStoredSetting,
 	} = settingsModule;
 
-	// Cwd-relative, not `import.meta.url`: see the note on `readSource`.
-	const storeSource = readSource('src/lib/stores/settings.svelte.ts');
-	const componentSource = readSource('src/lib/components/Settings.svelte');
-
-	test('the settings UI renders its bounds from the shared range constants', () => {
-		for (const range of ['EDITOR_FONT_SIZE_RANGE', 'PREVIEW_FONT_SIZE_RANGE', 'CODE_FONT_SIZE_RANGE', 'EDITOR_MAX_WIDTH_RANGE']) {
-			assert.match(componentSource, new RegExp(`min=\\{${range}\\.min\\}`), `${range} min not wired to the UI`);
-			assert.match(componentSource, new RegExp(`max=\\{${range}\\.max\\}`), `${range} max not wired to the UI`);
-		}
-		assert.doesNotMatch(componentSource, /max="48"/, 'hard-coded UI bound left behind');
-	});
-
-	test('numeric setting inputs are one-way bound and commit through the clamp', () => {
-		const numericInputIds = ['editor-font-size', 'editor-max-width', 'preview-font-size', 'code-font-size'];
-		for (const id of numericInputIds) {
-			const input = sliceBetween(componentSource, `id="${id}"`, '/>');
-			assert.doesNotMatch(input, /bind:value/, `${id} still uses a two-way number binding`);
-			assert.match(input, /oninput=\{\(e\) => handleNumberInput\(/, `${id} does not validate input`);
-			assert.match(input, /onchange=\{\(e\) => commitNumberInput\(/, `${id} does not clamp on change`);
-			assert.match(input, /onblur=\{\(e\) => commitNumberInput\(/, `${id} does not clamp on blur`);
-			assert.match(input, /onkeydown=\{\(e\) => handleNumberKeydown\(/, `${id} does not clamp on Enter`);
-		}
-		assert.match(componentSource, /function commitNumberInput[\s\S]{0,400}input\.value = String\(next\)/);
-	});
-
 	test('the persisted theme key is the one app.html paints from', () => {
 		// The first-paint script in src/app.html reads `theme` before the bundle
 		// loads and picks the background from it; renaming the key (to
@@ -91,64 +65,26 @@ describe('settings persistence', async () => {
 		assert.match(appHtml, /localStorage\.getItem\('theme'\)/);
 	});
 
-	test('the startup background is told the appearance, not the theme name', () => {
-		// The fourth reader of this one setting, and the one that cannot see
-		// localStorage at all: `app.rs` paints a window's background before the
-		// webview exists, reading `theme.txt`. Its vocabulary is "dark", "light" and
-		// "anything else means ask the OS" — so every `vscode:` name fell into that
-		// last arm, and a dark VS Code theme on a light desktop flashed white on
-		// every launch. Whether such a theme is dark is inside its own JSON, which
-		// only the frontend parses, so the resolved answer is what gets sent.
+	test('the startup background command and its vocabulary match app.rs', () => {
+		// What the frontend sends runs in settings.themeEffect.spec.ts ("the startup
+		// background is told the appearance, not the theme name"). What stays here
+		// is the contract: the command name, and the two words, are literals in
+		// two languages with no compiler between them.
 		const viewerSource = readSource('src/lib/MarkdownViewer.svelte');
-		assert.match(viewerSource, /function saveStartupAppearance\(appearance: 'system' \| 'light' \| 'dark'\)/);
 		assert.match(viewerSource, /invoke\('save_theme', \{ theme: appearance \}\)/);
 		assert.equal(
 			(viewerSource.match(/invoke\('save_theme'/g) ?? []).length,
 			1,
 			'save_theme has one caller, so nothing can send it a raw theme name',
 		);
-		// The VS Code branch answers only after the parse, because that is when the
-		// appearance becomes knowable.
-		assert.match(
-			viewerSource,
-			/loadVscodeTheme\(name, [\s\S]{0,400}?saveStartupAppearance\(document\.documentElement\.dataset\.themeType === 'dark' \? 'dark' : 'light'\)/,
-		);
 		// The viewer keeps no theme of its own beside the store's.
 		assert.doesNotMatch(viewerSource, /let theme = \$state/);
 
-		// Both words are literals in two languages with no compiler between them.
 		const appRs = readSource('src-tauri/src/app.rs');
 		assert.match(appRs, /"dark" => Some\(tauri::window::Color/);
 		assert.match(appRs, /"light" => Some\(tauri::window::Color/);
 	});
 
-	/*
-	 * ---------------------------------------------------------------------------
-	 * Task 5 — the settings dialog restores focus to whatever opened it.
-	 * ---------------------------------------------------------------------------
-	 */
-
-	test('the open effect neither reads the app version nor re-enters itself', () => {
-		// The open effect is identified by what it reads, not by its indentation and
-		// closing brace: the previous anchors were `'$effect(() => {\n\t\tif (show) {'`
-		// and `'\n\t});'`, so reformatting the component silently moved this
-		// assertion onto a different span of source.
-		const openEffects = callbackBodies(componentSource, '$effect').filter((body) => /\bshow\b/.test(body));
-		assert.equal(openEffects.length, 1, `expected exactly one $effect gated on show (got ${openEffects.length})`);
-		const effectBody = openEffects[0];
-
-		// Reading a state it also writes is what made the effect re-run and
-		// re-capture the focus target from inside the dialog.
-		assert.doesNotMatch(effectBody, /appVersion/, 'open effect still depends on appVersion');
-		assert.match(componentSource, /function ensureAppVersion\(\)/);
-		assert.match(componentSource, /let versionRequested = false;/);
-
-		// `loaded` and `previousActiveElement` are read and written by this effect,
-		// so they must not be reactive.
-		assert.match(componentSource, /\n\tlet loaded = false;/);
-		assert.match(componentSource, /\n\tlet previousActiveElement: HTMLElement \| null = null;/);
-	});
-
 	/*
 	 * ---------------------------------------------------------------------------
 	 * Structural guards on the store itself.
@@ -162,198 +98,4 @@ describe('settings persistence', async () => {
 	// effect's disposer with `() => {}` reddens `a disposed store stops writing and
 	// stops listening`. The text match added a way to fail that a rename of the
 	// private `onStorage` handler would trigger on its own.
-
-	test('the store has no single effect that writes every key', () => {
-		const setItemCalls = storeSource.match(/localStorage\.setItem\(/g) ?? [];
-		assert.equal(setItemCalls.length, 1, 'localStorage writes must funnel through writeStoredSetting');
-		assert.match(storeSource, /function writeStoredSetting[\s\S]{0,600}if \(current === value\) return false;/);
-	});
-
-	/*
-	 * ---------------------------------------------------------------------------
-	 * Structural guards on the settings rows themselves.
-	 * ---------------------------------------------------------------------------
-	 *
-	 * `.setting-item` is a two-column flex row: a leading <label> that occupies
-	 * `--settings-label-column`, then the controls. Each control class carries its
-	 * own sizing rule — `.select-wrapper` is 220px wide, `.slider-container` is
-	 * `flex: 0 0 auto`, and so on — and every one of those rules assumes the
-	 * element it names is a DIRECT child of the row, i.e. a flex item of it.
-	 *
-	 * The Appearance pane's theme row broke that assumption and nothing noticed.
-	 * It wrapped its `.select-wrapper` in an unclassed `<div>` (to stack a
-	 * "delete selected theme" link under the dropdown) and made that div a COLUMN
-	 * flex container. Two consequences, both invisible to the compiler, to
-	 * `npm run check`, and to every other test here:
-	 *
-	 *   * the flex item of the row was the unclassed div, which no rule sizes, so
-	 *     nothing gave it the control column's width;
-	 *   * `.select-wrapper`'s `flex: 0 1 220px` was read down the COLUMN axis, so
-	 *     220px became a HEIGHT. The dropdown rendered 79px too narrow and sat
-	 *     191px below its own label, in a row 272px tall next to 50px siblings.
-	 *
-	 * So the row shape is pinned here. A control wrapped one level deeper, or a
-	 * flex item with no rule to size it, fails before it can reach a screenshot.
-	 * Composite rows that are not label-and-control rows say so with
-	 * `.setting-block`, which owns the border and the rhythm and nothing else.
-	 */
-
-	const settingsStyle = componentSource.slice(
-		componentSource.lastIndexOf('<style>'),
-		componentSource.lastIndexOf('</style>'),
-	);
-
-	/** Every class the component's own stylesheet writes a rule for. */
-	const styledClasses = new Set(
-		[...settingsStyle.matchAll(/\.(-?[_a-zA-Z][\w-]*)/g)].map((match) => match[1]),
-	);
-
-	/**
-	 * The control classes `.setting-item`'s row layout sizes. Each is sized on the
-	 * assumption that it is a flex item of the row, so each must be a direct child
-	 * of one.
-	 */
-	const ROW_SIZED_CONTROLS = ['select-wrapper', 'slider-container', 'toggle', 'custom-dropdown-wrapper'];
-
-	type Row = { children: { tag: string; classes: string[] }[]; nested: string[]; label: string };
-
-	/** Every `.setting-item` in Settings.svelte, with its direct children. */
-	function settingRows(): Row[] {
-		const ast = parseComponent(componentSource, 'src/lib/components/Settings.svelte');
-		const rows: Row[] = [];
-
-		const classesOf = (node: Record<string, any>): string[] => {
-			const out: string[] = [];
-			for (const attribute of node.attributes ?? []) {
-				if (attribute.type === 'ClassDirective') out.push(attribute.name);
-				if (attribute.type !== 'Attribute' || attribute.name !== 'class') continue;
-				const parts = Array.isArray(attribute.value) ? attribute.value : [attribute.value];
-				for (const part of parts) if (part.type === 'Text') out.push(...String(part.data).split(/\s+/).filter(Boolean));
-			}
-			return out;
-		};
-
-		/** Elements below `node`, skipping `{#if}`/`{#each}` wrappers, to `depth`. */
-		const elementsUnder = (node: unknown, depth: number, out: { node: Record<string, any>; depth: number }[] = []) => {
-			if (Array.isArray(node)) {
-				for (const child of node) elementsUnder(child, depth, out);
-				return out;
-			}
-			if (!node || typeof node !== 'object') return out;
-			const current = node as Record<string, any>;
-			if (current.type === 'RegularElement') {
-				out.push({ node: current, depth });
-				elementsUnder(current.fragment, depth + 1, out);
-				return out;
-			}
-			// Control-flow blocks do not add a DOM level.
-			for (const key of ['fragment', 'nodes', 'consequent', 'alternate', 'body']) {
-				if (current[key]) elementsUnder(current[key], depth, out);
-			}
-			return out;
-		};
-
-		const walk = (node: unknown): void => {
-			if (Array.isArray(node)) {
-				for (const child of node) walk(child);
-				return;
-			}
-			if (!node || typeof node !== 'object') return;
-			const current = node as Record<string, any>;
-
-			if (current.type === 'RegularElement' && classesOf(current).includes('setting-item')) {
-				const descendants = elementsUnder(current.fragment, 1);
-				const direct = descendants.filter((entry) => entry.depth === 1);
-				rows.push({
-					label: direct[0] ? textOf(direct[0].node) : '(empty row)',
-					children: direct.map((entry) => ({ tag: entry.node.name, classes: classesOf(entry.node) })),
-					nested: descendants
-						.filter(
-							(entry) =>
-								entry.depth > 1 &&
-								classesOf(entry.node).some((name) => ROW_SIZED_CONTROLS.includes(name)) &&
-								// `.number-input-wrapper` legitimately lives inside
-								// `.slider-container`, which is itself a direct child.
-								!parentIsSizedControl(descendants, entry),
-						)
-						.map((entry) => `${entry.node.name}.${classesOf(entry.node).join('.')}`),
-				});
-			}
-
-			for (const [key, value] of Object.entries(current)) {
-				if (key === 'parent' || key === 'metadata') continue;
-				walk(value);
-			}
-		};
-
-		walk((ast as Record<string, any>).fragment);
-		return rows;
-	}
-
-	function parseComponent(text: string, filename: string): unknown {
-		return parse(text, { modern: true, filename });
-	}
-
-	function textOf(node: Record<string, any>): string {
-		const first = (node.fragment?.nodes ?? []).find((child: any) => child.type === 'ExpressionTag' || child.type === 'Text');
-		if (!first) return node.name;
-		return componentSource.slice(first.start, first.end).trim().slice(0, 48);
-	}
-
-	/** True when `entry`'s nearest element ancestor is itself a sized control. */
-	function parentIsSizedControl(
-		all: { node: Record<string, any>; depth: number }[],
-		entry: { node: Record<string, any>; depth: number },
-	): boolean {
-		const index = all.indexOf(entry);
-		for (let i = index - 1; i >= 0; i--) {
-			if (all[i].depth !== entry.depth - 1) continue;
-			const classes = (all[i].node.attributes ?? [])
-				.filter((a: any) => a.type === 'Attribute' && a.name === 'class' && Array.isArray(a.value))
-				.flatMap((a: any) => a.value.filter((v: any) => v.type === 'Text').flatMap((v: any) => String(v.data).split(/\s+/)));
-			return classes.some((name: string) => ROW_SIZED_CONTROLS.includes(name));
-		}
-		return false;
-	}
-
-	const rows = settingRows();
-
-	test('every settings row was found', () => {
-		// Vacuous-pass guard: the two assertions below say nothing if the walk
-		// stopped finding rows.
-		assert.ok(rows.length > 25, `found ${rows.length} .setting-item rows`);
-		assert.ok(styledClasses.has('setting-item') && styledClasses.has('select-wrapper'));
-	});
-
-	test('a settings row leads with the label that names its control', () => {
-		const wrong = rows
-			.filter((row) => row.children[0]?.tag !== 'label')
-			.map((row) => `${row.label} leads with <${row.children[0]?.tag}>`);
-		assert.deepEqual(wrong, [], 'a row whose first child is not the <label> loses the label column');
-	});
-
-	test('every control in a settings row is a flex item the stylesheet sizes', () => {
-		// The unclassed <div> that broke the theme row would appear here.
-		const unstyled = rows.flatMap((row) =>
-			row.children
-				.slice(1)
-				.filter((child) => !child.classes.some((name) => styledClasses.has(name)))
-				.map((child) => `${row.label}: <${child.tag}${child.classes.length ? ` class="${child.classes.join(' ')}"` : ''}> has no rule`),
-		);
-		assert.deepEqual(unstyled, [], 'a direct child of .setting-item that no rule sizes gets no column');
-	});
-
-	test('no settings row buries a sized control below its own flex level', () => {
-		// `.select-wrapper` one level deeper is the theme-row defect: its sizing
-		// stops meaning "width" as soon as some other element becomes the flex item.
-		const buried = rows.flatMap((row) => row.nested.map((found) => `${row.label}: ${found}`));
-		assert.deepEqual(buried, [], 'a sized control must be a direct child of its .setting-item');
-	});
-
-	test('the tab position select offers exactly the values the store accepts', () => {
-		const select = sliceBetween(componentSource, 'id="appearance-tab-position"', '</select>');
-		const offered = [...select.matchAll(/<option value="([^"]+)"/g)].map((m) => m[1]);
-		assert.deepEqual(offered, ['top', 'left', 'right']);
-		for (const value of offered) assert.ok(settingsModule.isTabPosition(value), value);
-	});
 });
diff --git a/scripts/settings.checks.test.ts b/scripts/settings.checks.test.ts
index 35374205..883c359a 100644
--- a/scripts/settings.checks.test.ts
+++ b/scripts/settings.checks.test.ts
@@ -1,13 +1,10 @@
 import assert from 'node:assert/strict';
 import { describe, test } from 'node:test';
 
-import { parse } from 'svelte/compiler';
-
 import { fontFamilyValue } from '../src/lib/utils/fontFamily.js';
 import { getSupportedLanguages, type LanguageCode, t, type Translation } from '../src/lib/utils/i18n.js';
-import { isSafeCssColor, sanitizeThemeColors } from '../src/lib/utils/theme.js';
 import { translations } from './allTranslations.js';
-import { functionSource, readSource, walkSourceFiles } from './sourceTree.js';
+import { readSource, walkSourceFiles } from './sourceTree.js';
 
 /**
  * Settings whose label did not describe what the code did.
@@ -35,13 +32,11 @@ import { functionSource, readSource, walkSourceFiles } from './sourceTree.js';
  *
  * The first is a behaviour change and is tested as one. The other two are the
  * UI admitting a dependency that was always there, so what is pinned is the
- * gate, plus the layout rule that the prerequisite is the row above.
+ * gate, plus the layout rule that the prerequisite is the row above. Both run
+ * on the pane data: settings.spec.ts "settings panes".
  */
 describe('merged auto-save preference', () => {
 	const settingsSource = readSource(new URL('../src/lib/stores/settings.svelte.ts', import.meta.url));
-	const settingsComponentSource = readSource(new URL('../src/lib/components/Settings.svelte', import.meta.url));
-	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-	const sessionSource = readSource(new URL('../src/lib/sessions/documentSession.svelte.ts', import.meta.url));
 
 	test('the merged preference is stored under its own key, and the old ones are read-only', () => {
 		assert.match(settingsSource, /key: 'editor\.autoSaveEdits'/);
@@ -51,75 +46,16 @@ describe('merged auto-save preference', () => {
 		assert.doesNotMatch(settingsSource, /key: 'editor\.autoSave'/);
 		assert.doesNotMatch(settingsSource, /key: 'editor\.confirmBeforeSave'/);
 	});
-
-	test('nothing evaluates the pair any more', () => {
-		// Four sites read `autoSave && !confirmBeforeSave`; a survivor would be a
-		// path that still consults a preference no UI can set.
-		for (const source of [viewerSource, sessionSource, settingsComponentSource, settingsSource]) {
-			assert.doesNotMatch(source, /settings\.confirmBeforeSave/);
-		}
-		// And the four decisions are still there, now reading the one switch.
-		assert.match(viewerSource, /if \(!settings\.autoSave\) return;/); // leaving an editable pane
-		assert.match(viewerSource, /if \(!settings\.autoSave\) \{/); // the debounce
-		assert.match(viewerSource, /if \(settings\.autoSave\) \{/); // the close-window walk
-		// Closing a tab. The condition grew a third term — a file that changed
-		// under the buffer is a question for the user, not something auto-save may
-		// answer by writing — but it is still this one switch that decides whether
-		// the silent save happens at all.
-		assert.match(sessionSource, /if \(settings\.autoSave && tab\.path !== '' && !diskMoved\)/);
-	});
-
-	/* ---------------------------------------------- B & C: visible dependency */
-
-	test('the wrap column sits under the wrap mode, and is inert without it', () => {
-		const wrapMode = settingsComponentSource.indexOf('<label for="editor-word-wrap">');
-		const wrapColumn = settingsComponentSource.indexOf('<label for="editor-max-width">');
-		assert.ok(wrapMode > 0 && wrapColumn > 0);
-		assert.ok(wrapMode < wrapColumn, 'the prerequisite must be the row above the setting it gates');
-
-		// Monaco reads `wordWrapColumn` only in this mode — `Editor.svelte` passes
-		// the value unconditionally, and Monaco ignores it in the other two.
-		const gate = /settings\.wordWrap !== 'wordWrapColumn'/g;
-		assert.equal((settingsComponentSource.match(gate) ?? []).length, 4, 'the row, its input and both steppers');
-	});
-
-	test('the word count is greyed out when there is no status bar to show it in', () => {
-		assert.match(settingsComponentSource, /class:inactive=\{!settings\.statusBar\}/);
-		assert.match(
-			settingsComponentSource,
-			/id="editor-word-count"[^>]*disabled=\{!settings\.statusBar\}/,
-		);
-		const statusBar = settingsComponentSource.indexOf('<label for="editor-status-bar">');
-		const wordCount = settingsComponentSource.indexOf('<label for="editor-word-count">');
-		assert.ok(statusBar > 0 && statusBar < wordCount, 'same rule: the prerequisite is the row above');
-	});
-
-	test('an inactive row is dimmed rather than hidden', () => {
-		// Hiding it would answer "where did that setting go?" with nothing.
-		assert.match(settingsComponentSource, /\.setting-item\.inactive[\s\S]{0,200}?opacity: 0\.45/);
-	});
-
-
-	/* ------------------------------------------------ D: last tab (#829) */
-
-	test('closing the last tab leaves the window on Home when the setting is off', () => {
-		const body = functionSource(viewerSource, 'closeTabAndWindowIfLast');
-		assert.match(body, /if \(settings\.closeWindowWithLastTab\) await destroyWindowAfterTabsClosed\(\);/);
-		assert.equal(body.match(/destroyWindowAfterTabsClosed\(/g)?.length, 1, 'no ungated destroy');
-	});
 });
 
 describe('font family values', () => {
 	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
 	const editorOptionsSource = readSource(new URL('../src/lib/utils/editorOptions.ts', import.meta.url));
 
-	test('every place a chosen family reaches CSS goes through the one helper', () => {
-		assert.match(viewerSource, /fontFamily: fontFamilyValue\(settings\.previewFont, 'sans-serif'\),/);
-		assert.match(viewerSource, /codeFontFamily: fontFamilyValue\(settings\.codeFont, 'monospace'\),/);
-		assert.match(editorOptionsSource, /fontFamily: fontFamilyValue\(settings\.editorFont, "monospace"\),/);
-		// The absence claim is the point of this one: a second bare interpolation of
-		// a font preference is the defect returning, and it cannot be observed by
-		// running the helper that does exist.
+	test('no font preference reaches CSS bare', () => {
+		// The values are settings.test.ts "a chosen family reaches the preview, its
+		// code and the editor quoted". This is the absence claim: a second bare
+		// interpolation of a font preference is the defect returning.
 		assert.doesNotMatch(viewerSource, /font-family: \{settings\./);
 		assert.doesNotMatch(viewerSource, /--code-font: \{settings\./);
 		assert.doesNotMatch(editorOptionsSource, /fontFamily: settings\./);
@@ -127,15 +63,11 @@ describe('font family values', () => {
 });
 
 describe('theme CSS validation', () => {
-	test('[P1-C-3] the injected style tag is built only from validated values', () => {
+	// The validation itself is run in settings.themeLoad.spec.ts. What stays here is
+	// the convention that the tag is never assigned as markup (lint-candidate).
+	test('the theme style tag is filled as text, never as markup', () => {
 		const source = readSource('src/lib/utils/theme.ts');
 
-		assert.match(source, /const colors = sanitizeThemeColors\(theme\.colors\)/);
-		assert.match(
-			source,
-			/\.filter\(\(\[, v\]\) => isSafeCssColor\(v\)\)/,
-			'the final interpolation must re-check each value',
-		);
 		assert.doesNotMatch(
 			source,
 			/styleTag\.innerHTML\s*=/,
@@ -385,6 +317,14 @@ describe('translation coverage', () => {
 		'src/lib/components/Settings.svelte: t(action.labelKey)',
 		'src/lib/components/Settings.svelte: t(entry.hintKey)',
 		'src/lib/components/Settings.svelte: t(entry.labelKey)',
+		// The pane rows and their select options (src/lib/utils/settingsPanes.ts).
+		// `labelKey`/`hintKey` are harvested above; settings.spec.ts "every key a
+		// settings row renders exists in English" checks all of them, titles included.
+		'src/lib/components/Settings.svelte: t(option.labelKey)',
+		'src/lib/components/Settings.svelte: t(row.hintKey)',
+		'src/lib/components/Settings.svelte: t(row.inactiveTitleKey)',
+		'src/lib/components/Settings.svelte: t(row.labelKey)',
+		'src/lib/components/Settings.svelte: t(row.titleKey)',
 		'src/lib/components/Settings.svelte: t(section.labelKey)',
 		'src/lib/components/Settings.svelte: t(tool.labelKey)',
 		'src/lib/components/Tab.svelte: t(action.labelKey)',
@@ -511,135 +451,4 @@ describe('translation coverage', () => {
 			);
 		}
 	});
-
-	// ------------------------------------------- one label per control, per pane
-	//
-	// The preview pane shipped four controls under two labels. `preview-font` and
-	// `code-font` both read `t('settings.font')`, `preview-font-size` and
-	// `code-font-size` both read `t('settings.fontSize')`, so the pane rendered
-	//
-	//     Font       [ Helvetica Neue (Default) ]
-	//     Font Size  [− 16 +]
-	//     Font       [ Menlo (Default) ]
-	//     Font Size  [− 14 +]
-	//
-	// and nothing on screen said which pair was the prose font and which the code
-	// font. The `id` attributes knew; the user could not.
-	//
-	// Nothing in the suite could see it. Every rule above is about a key existing
-	// and resolving — two controls pointed at the SAME existing, correctly
-	// resolving key satisfies all of them. So this reads the controls out of the
-	// component and compares what a user would actually see, in each language:
-	// two controls in one pane may not render the same words. Spelling the check
-	// against `t()` output rather than against the key names is the point — a
-	// future locale that translates two distinct keys to one string is the same
-	// defect and fails here too.
-
-	const SETTINGS = 'src/lib/components/Settings.svelte';
-
-	type LabelledControl = { pane: string; id: string; key: string };
-
-	/**
-	 * Every `<label for="…">{t('…')}</label>` in Settings.svelte, tagged with the
-	 * `{#if activeCategory === '…'}` branch it renders in.
-	 *
-	 * Read from the parsed component rather than by matching text: the panes are a
-	 * `{:else if}` chain, so "which pane is this row in" is a question about tree
-	 * position that no regex over the file can answer.
-	 */
-	function labelledControls(): LabelledControl[] {
-		const source = readSource(SETTINGS);
-		const ast = parse(source, { modern: true, filename: SETTINGS }) as Record<string, any>;
-		const found: LabelledControl[] = [];
-
-		const visit = (node: unknown, pane: string | null): void => {
-			if (Array.isArray(node)) {
-				for (const child of node) visit(child, pane);
-				return;
-			}
-			if (!node || typeof node !== 'object') return;
-			const current = node as Record<string, any>;
-
-			if (current.type === 'IfBlock' && current.test) {
-				const category = source
-					.slice(current.test.start, current.test.end)
-					.match(/activeCategory === '([a-z]+)'/);
-				if (category) {
-					// The consequent is that pane; the `{:else if}` chain in the
-					// alternate names its own.
-					visit(current.consequent, category[1]);
-					visit(current.alternate, pane);
-					return;
-				}
-			}
-
-			if (current.type === 'RegularElement' && current.name === 'label') {
-				const forAttribute = (current.attributes ?? []).find(
-					(attribute: Record<string, any>) => attribute.type === 'Attribute' && attribute.name === 'for',
-				);
-				const id = forAttribute?.value?.[0]?.type === 'Text' ? String(forAttribute.value[0].data) : null;
-				for (const child of current.fragment?.nodes ?? []) {
-					const call = child.type === 'ExpressionTag' ? child.expression : null;
-					if (call?.type !== 'CallExpression' || call.callee?.name !== 't') continue;
-					const key = call.arguments?.[0];
-					if (key?.type !== 'Literal' || typeof key.value !== 'string') continue;
-					assert.ok(id, `a t() label in ${SETTINGS} has no "for" attribute to name its control`);
-					assert.ok(pane, `${id} is labelled outside any activeCategory branch`);
-					found.push({ pane: pane!, id: id!, key: key.value });
-				}
-			}
-
-			for (const [name, value] of Object.entries(current)) {
-				if (name === 'parent' || name === 'metadata') continue;
-				visit(value, pane);
-			}
-		};
-
-		visit(ast.fragment, null);
-		return found;
-	}
-
-	const settingsControls = labelledControls();
-
-	test('the settings panes were actually read', () => {
-		// Every assertion below is vacuous if the walk found nothing, and the one
-		// that matters is vacuous if it stopped finding the preview pane.
-		const panes = new Set(settingsControls.map((control) => control.pane));
-		assert.deepEqual([...panes].sort(), ['appearance', 'editor', 'files', 'preview']);
-		assert.ok(settingsControls.length > 25, `found ${settingsControls.length} labelled controls`);
-
-		const preview = settingsControls.filter((control) => control.pane === 'preview').map((c) => c.id);
-		assert.deepEqual(preview.sort(), [
-			'code-font',
-			'code-font-size',
-			'preview-annotations',
-			'preview-cursor',
-			'preview-font',
-			'preview-font-size',
-			'preview-max-width',
-			'preview-newline-breaks',
-			'preview-occurrences',
-			'preview-table-breakout',
-			'preview-table-scroll',
-		]);
-	});
-
-	test('no two controls in one settings pane carry the same label, in any language', () => {
-		const collisions: string[] = [];
-
-		for (const pane of new Set(settingsControls.map((control) => control.pane))) {
-			const controls = settingsControls.filter((control) => control.pane === pane);
-			for (const lang of languages) {
-				const seen = new Map<string, string>();
-				for (const { id, key } of controls) {
-					const label = t(key, lang);
-					const owner = seen.get(label);
-					if (owner) collisions.push(`${lang} ${pane}: ${owner} and ${id} both read "${label}"`);
-					else seen.set(label, id);
-				}
-			}
-		}
-
-		assert.deepEqual(collisions, []);
-	});
 });
diff --git a/scripts/settings.dialogOpen.spec.ts b/scripts/settings.dialogOpen.spec.ts
new file mode 100644
index 00000000..72194cf2
--- /dev/null
+++ b/scripts/settings.dialogOpen.spec.ts
@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+
+import { flushSync } from 'svelte';
+import { afterEach, describe, onTestFinished, test, vi } from 'vitest';
+
+import { createSettingsOpen } from '../src/lib/utils/settingsOpen.svelte.js';
+import { runeEffect } from './runeEffect.svelte.js';
+import { runeProps } from './runeProps.svelte.js';
+
+/*
+ * Task 5: the settings dialog restores focus to whatever opened it.
+ *
+ * Two versions of the open effect re-entered themselves. One read `appVersion`
+ * (`if (!appVersion)`) and the version promise wrote it; the other kept the
+ * fonts' `loaded` flag as `$state`, read before the await and written after it.
+ * Either way the effect re-ran once the promise settled and re-captured
+ * `previousActiveElement`, which by then was a control inside the dialog, so
+ * closing Settings left focus in the dialog instead of on its opener.
+ *
+ * Own file: it replaces the Tauri bridge with one whose answers the test settles.
+ */
+describe('settings dialog open', () => {
+	afterEach(() => {
+		vi.useRealTimers();
+		document.body.replaceChildren();
+	});
+
+	function bridge() {
+		const calls: string[] = [];
+		const pending = new Map<string, (value: unknown) => void>();
+		(window as any).__TAURI_INTERNALS__ = {
+			invoke: (cmd: string) => {
+				calls.push(cmd);
+				return new Promise((resolve) => pending.set(cmd, resolve));
+			},
+			transformCallback: () => 0,
+		};
+		return {
+			calls,
+			async settle(cmd: string, value: unknown) {
+				pending.get(cmd)?.(value);
+				for (let i = 0; i < 5; i++) await Promise.resolve();
+				flushSync();
+			},
+		};
+	}
+
+	test('the open effect neither reads the app version nor re-enters itself', async () => {
+		vi.useFakeTimers();
+		const tauri = bridge();
+		const opener = document.body.appendChild(document.createElement('button'));
+		const modal = document.body.appendChild(document.createElement('div'));
+		const inside = modal.appendChild(document.createElement('button'));
+		const props = runeProps({ open: false });
+		let opened = 0;
+		let dialog!: ReturnType<typeof createSettingsOpen>;
+		onTestFinished(
+			runeEffect(() => {
+				dialog = createSettingsOpen({ isOpen: () => props.open, modal: () => modal, onOpen: () => opened++ });
+			}),
+		);
+
+		opener.focus();
+		props.open = true;
+		flushSync();
+		vi.advanceTimersByTime(50);
+		assert.equal(document.activeElement, inside, 'opening moves focus into the dialog');
+
+		await tauri.settle('get_system_fonts', ['Menlo']);
+		await tauri.settle('plugin:app|version', '9.9.9');
+		assert.deepEqual(dialog.systemFonts, ['Menlo']);
+		assert.equal(dialog.appVersion, '9.9.9');
+		assert.equal(opened, 1, 'the effect ran again once the fonts or the version arrived');
+
+		props.open = false;
+		flushSync();
+		assert.equal(document.activeElement, opener, 'closing returns focus to the control that opened Settings');
+
+		props.open = true;
+		flushSync();
+		assert.equal(opened, 2);
+		assert.deepEqual(
+			tauri.calls.filter((cmd) => cmd !== 'get_saved_vscode_themes'),
+			['get_system_fonts', 'plugin:app|version'],
+			'a second open fetches neither the fonts nor the version again',
+		);
+	});
+});
diff --git a/scripts/settings.spec.ts b/scripts/settings.spec.ts
index f93d6db1..eb825278 100644
--- a/scripts/settings.spec.ts
+++ b/scripts/settings.spec.ts
@@ -5,6 +5,7 @@ import { afterAll, describe, onTestFinished, test } from 'vitest';
 
 import { getSupportedLanguages } from '../src/lib/utils/i18n.js';
 import { translations } from './allTranslations.js';
+import { updatedEditorOptions } from '../src/lib/utils/editorOptions.js';
 
 // Plain TypeScript, no runes: safe to import statically, unlike the store below.
 describe('settings persistence', async () => {
@@ -250,6 +251,25 @@ describe('settings persistence', async () => {
 		assert.equal(restarted.language, 'ja');
 	});
 
+	test('the store has no single effect that writes every key', () => {
+		// The same two windows as above, but through the store's own effects. One
+		// effect reading every field would rewrite font size from B's stale copy the
+		// moment B touched anything. (A same-document write fires no storage event,
+		// so B really is unaware here.)
+		resetStorage();
+		const windowA = createStore();
+		const windowB = createStore();
+		flushSync();
+
+		windowA.editorFontSize = 30;
+		flushSync();
+		windowB.minimap = !windowB.minimap;
+		flushSync();
+
+		assert.equal(localStorage.getItem('editor.fontSize'), '30');
+		assert.equal(localStorage.getItem('editor.minimap'), String(windowB.minimap));
+	});
+
 	test('storage events fold another window changes into this instance', () => {
 		resetStorage();
 		const store = createStore();
@@ -576,6 +596,25 @@ describe('settings persistence', async () => {
 		assert.equal(store.previewFullWidth, false);
 	});
 
+	test('settings load, persist, and reset the preview width through one normalizer', () => {
+		resetStorage({ 'preview.maxWidth': 'banana' });
+		assert.equal(createStore().previewMaxWidth, 880, 'garbage loads as the default');
+
+		resetStorage({ 'preview.maxWidth': '99999' });
+		const store = createStore();
+		assert.equal(store.previewMaxWidth, 1600, 'an out-of-range width loads clamped');
+
+		store.previewMaxWidth = 1200;
+		flushSync();
+		assert.equal(localStorage.getItem('preview.maxWidth'), '1200');
+		assert.equal(createStore().previewMaxWidth, 1200, 'a restart keeps it');
+
+		store.resetPreviewMaxWidth();
+		flushSync();
+		assert.equal(store.previewMaxWidth, 880);
+		assert.equal(localStorage.getItem('preview.maxWidth'), '880');
+	});
+
 	test('the legacy full-width key is honoured once and then superseded', () => {
 		resetStorage({ isFullWidth: 'true' });
 		assert.equal(createStore().previewFullWidth, true, 'an install upgrading from the old key keeps its setting');
@@ -810,6 +849,23 @@ describe('settings persistence', async () => {
 		assert.equal(restarted.preZenState, null, 'the snapshot is spent once it has been restored');
 	});
 
+	test('the line-highlight toggle and zen mode reach the editor as Monaco\'s string enum', () => {
+		// A ternary on the stored 'line' / 'none' can only produce "line": any
+		// non-empty string is truthy. So the store is driven the way the menu and
+		// zen mode drive it, and what reaches an open editor is read back.
+		resetStorage();
+		const store = createStore();
+		const reaching = () => updatedEditorOptions(store, 100, true, false).renderLineHighlight;
+		assert.equal(reaching(), 'line', 'the default draws the line');
+		store.toggleLineHighlight();
+		assert.equal(reaching(), 'none', 'the toggle turns it off');
+		store.toggleLineHighlight();
+		store.toggleZenMode();
+		assert.equal(reaching(), 'none', 'zen mode turns it off');
+		store.toggleZenMode();
+		assert.equal(reaching(), 'line', 'and leaving zen mode brings it back');
+	});
+
 	test('the zen fallback is each setting own default', () => {
 		// DEFAULT_PRE_ZEN_STATE spells out six values the store already declares in
 		// its field initializers. This is what stops the two copies drifting.
@@ -878,6 +934,26 @@ describe('settings persistence', async () => {
 		fallback.setSidebarSplit(1);
 		assert.equal(fallback.sidebarSplit, SIDEBAR_SPLIT_RANGE.min);
 	});
+
+	test('the tab position select offers exactly the values the store accepts', () => {
+		const offered = settingsModule.TAB_POSITION_OPTIONS.map((option) => option.value);
+		assert.deepEqual(offered, ['top', 'left', 'right']);
+		for (const value of offered) {
+			resetStorage({ 'editor.tabPosition': value });
+			assert.equal(createStore().tabPosition, value, `${value} is offered but not kept`);
+		}
+	});
+
+	test('the setting is one control, defaulting to preview', async () => {
+		const { OPEN_FILE_MODE_OPTIONS, isOpenFileMode } = await import('../src/lib/utils/openFileMode.js');
+		resetStorage();
+		assert.equal(createStore().openFileMode, 'preview');
+		// One select with the three answers the store accepts, each under its own label.
+		assert.deepEqual(OPEN_FILE_MODE_OPTIONS.map((option) => option.value), ['preview', 'editor', 'split']);
+		assert.ok(OPEN_FILE_MODE_OPTIONS.every((option) => isOpenFileMode(option.value)));
+		const labels = OPEN_FILE_MODE_OPTIONS.map((option) => option.labelKey);
+		assert.equal(new Set(labels).size, labels.length);
+	});
 });
 
 describe('settings file export and import', async () => {
@@ -991,3 +1067,297 @@ describe('settings file export and import', async () => {
 		);
 	});
 });
+
+describe('settings panes', async () => {
+	// Settings.svelte renders each pane by walking SETTINGS_PANES[pane].rows, so
+	// what a pane shows — which rows, in which order, under which labels, with
+	// which bounds and gates — is this data.
+	const { SettingsStore, CODE_FONT_SIZE_RANGE, EDITOR_FONT_SIZE_RANGE, EDITOR_MAX_WIDTH_RANGE, PREVIEW_FONT_SIZE_RANGE } =
+		await import('../src/lib/stores/settings.svelte.js');
+	const { SETTINGS_PANES, numberInputHandlers, setNumberSetting } = await import('../src/lib/utils/settingsPanes.js');
+	const { t } = await import('../src/lib/utils/i18n.js');
+	const { DEFAULT_PREVIEW_MAX_WIDTH, MAX_PREVIEW_MAX_WIDTH, MIN_PREVIEW_MAX_WIDTH } = await import('../src/lib/utils/previewWidth.js');
+	type Row = (typeof SETTINGS_PANES)['editor']['rows'][number];
+
+	const languages = getSupportedLanguages().map((language) => language.code);
+	const allRows = Object.values(SETTINGS_PANES).flatMap((pane) => pane.rows);
+
+	function row(id: string): Row {
+		const found = allRows.find((candidate) => candidate.id === id);
+		assert.ok(found, `no settings row ${id}`);
+		return found;
+	}
+
+	function ids(pane: keyof typeof SETTINGS_PANES): string[] {
+		return SETTINGS_PANES[pane].rows.map((candidate) => candidate.id);
+	}
+
+	function store() {
+		const created = new SettingsStore();
+		onTestFinished(() => created.dispose());
+		return created;
+	}
+
+	test('the settings panes were actually read', () => {
+		// Every assertion below is vacuous if the panes were empty, and the label
+		// one matters most for the preview pane.
+		assert.deepEqual(Object.keys(SETTINGS_PANES).sort(), ['appearance', 'editor', 'files', 'preview']);
+		assert.ok(allRows.length > 25, `found ${allRows.length} rows`);
+		assert.deepEqual(ids('preview'), [
+			'preview-max-width',
+			'preview-font',
+			'preview-font-size',
+			'code-font',
+			'code-font-size',
+			'preview-cursor',
+			'preview-occurrences',
+			'preview-annotations',
+			'preview-table-breakout',
+			'preview-table-scroll',
+			'preview-newline-breaks',
+		]);
+	});
+
+	test('no two controls in one settings pane carry the same label, in any language', () => {
+		// The preview pane shipped `preview-font` and `code-font` both under
+		// `settings.font`, and both sizes under `settings.fontSize`: four controls,
+		// two labels, nothing on screen saying which pair was the prose font. The
+		// rule is stated over what `t()` renders, so two distinct keys a locale
+		// translates the same are the same defect.
+		const collisions: string[] = [];
+		for (const [pane, { rows }] of Object.entries(SETTINGS_PANES)) {
+			for (const lang of languages) {
+				const seen = new Map<string, string>();
+				for (const { id, labelKey } of rows) {
+					const label = t(labelKey, lang);
+					const owner = seen.get(label);
+					if (owner) collisions.push(`${lang} ${pane}: ${owner} and ${id} both read "${label}"`);
+					else seen.set(label, id);
+				}
+			}
+		}
+		assert.deepEqual(collisions, []);
+	});
+
+	test('every key a settings row renders exists in English', () => {
+		// The component reaches these through `t(row.labelKey)` and friends, which
+		// the translation-coverage scanner cannot resolve on its own.
+		const keys = allRows.flatMap((candidate) => [
+			candidate.labelKey,
+			candidate.hintKey,
+			candidate.titleKey,
+			candidate.inactiveTitleKey,
+			...(candidate.kind === 'select' ? candidate.options.map((option) => option.labelKey) : []),
+		]);
+		const missing = keys.filter((key): key is string => key !== undefined && t(key, 'en') === key);
+		assert.deepEqual(missing, []);
+	});
+
+	test('the settings UI renders its bounds from the shared range constants', () => {
+		const ranges = Object.fromEntries(
+			allRows.flatMap((candidate) => (candidate.kind === 'number' ? [[candidate.id, candidate.range]] : [])),
+		);
+		assert.deepEqual(ranges, {
+			'editor-font-size': EDITOR_FONT_SIZE_RANGE,
+			'editor-max-width': EDITOR_MAX_WIDTH_RANGE,
+			'preview-font-size': PREVIEW_FONT_SIZE_RANGE,
+			'code-font-size': CODE_FONT_SIZE_RANGE,
+		});
+		// The same objects, not copies that agree today: persistence clamps against these.
+		assert.equal(ranges['editor-font-size'], EDITOR_FONT_SIZE_RANGE);
+		assert.equal(ranges['editor-max-width'], EDITOR_MAX_WIDTH_RANGE);
+		assert.equal(ranges['preview-font-size'], PREVIEW_FONT_SIZE_RANGE);
+		assert.equal(ranges['code-font-size'], CODE_FONT_SIZE_RANGE);
+	});
+
+	test('numeric setting inputs commit through the clamp, and not while typing', () => {
+		for (const id of ['editor-font-size', 'editor-max-width', 'preview-font-size', 'code-font-size']) {
+			const numberRow = row(id);
+			assert.equal(numberRow.kind, 'number');
+			if (numberRow.kind !== 'number') continue;
+			const { range } = numberRow;
+			const settingsStore = store();
+			const handlers = numberInputHandlers(range, (value) => setNumberSetting(settingsStore, numberRow, value));
+			const input = document.createElement('input');
+			input.type = 'number';
+			input.addEventListener('input', handlers.oninput);
+			input.addEventListener('change', handlers.onchange);
+			input.addEventListener('blur', handlers.onblur);
+			input.addEventListener('keydown', handlers.onkeydown);
+			const read = () => settingsStore[numberRow.key];
+			const type = (text: string, event: Event) => {
+				input.value = text;
+				input.dispatchEvent(event);
+			};
+
+			// Half-typed numbers are left alone: the "1" of "18" is not clamped up to the minimum.
+			const before = read();
+			type('1', new Event('input'));
+			assert.equal(read(), before, `${id}: a keystroke below the range was committed`);
+			assert.equal(input.value, '1', `${id}: the field was rewritten mid-keystroke`);
+			type('', new Event('input'));
+			assert.equal(read(), before, `${id}: an empty field reached the store`);
+			type(String(range.min + range.step), new Event('input'));
+			assert.equal(read(), range.min + range.step, `${id}: an in-range value is applied as it is typed`);
+
+			// Each commit path clamps and writes the clamped value back into the field.
+			type(String(range.max + 1000), new KeyboardEvent('keydown', { key: 'Enter' }));
+			assert.equal(read(), range.max, `${id}: Enter`);
+			assert.equal(input.value, String(range.max));
+			type(String(range.min - 1000), new Event('blur'));
+			assert.equal(read(), range.min, `${id}: blur`);
+			assert.equal(input.value, String(range.min));
+			type('', new Event('change'));
+			assert.equal(read(), range.default, `${id}: change on an empty field falls back to the default`);
+			assert.equal(input.value, String(range.default));
+			type(String(range.max + 1), new KeyboardEvent('keydown', { key: 'a' }));
+			assert.equal(read(), range.default, `${id}: a key other than Enter committed`);
+		}
+	});
+
+	test('the wrap column sits under the wrap mode, and is inert without it', () => {
+		// Monaco reads `wordWrapColumn` only in that wrap mode; the prerequisite is the row above.
+		const editor = ids('editor');
+		assert.equal(editor.indexOf('editor-max-width'), editor.indexOf('editor-word-wrap') + 1);
+		const wrapColumn = row('editor-max-width');
+		const settingsStore = store();
+		for (const mode of ['off', 'on']) {
+			settingsStore.wordWrap = mode;
+			assert.equal(wrapColumn.inactive?.(settingsStore), true, `the wrap column is live with word wrap ${mode}`);
+		}
+		settingsStore.wordWrap = 'wordWrapColumn';
+		assert.equal(wrapColumn.inactive?.(settingsStore), false);
+	});
+
+	test('the word count is greyed out when there is no status bar to show it in', () => {
+		const editor = ids('editor');
+		assert.equal(editor.indexOf('editor-word-count'), editor.indexOf('editor-status-bar') + 1);
+		const wordCount = row('editor-word-count');
+		const settingsStore = store();
+		settingsStore.statusBar = false;
+		assert.equal(wordCount.inactive?.(settingsStore), true);
+		settingsStore.statusBar = true;
+		assert.equal(wordCount.inactive?.(settingsStore), false);
+	});
+
+	test('Settings exposes a bounded preview-width input and reset action', () => {
+		const width = row('preview-max-width');
+		assert.equal(width.kind, 'previewWidth');
+		if (width.kind !== 'previewWidth') return;
+		assert.equal(width.range.min, MIN_PREVIEW_MAX_WIDTH);
+		assert.equal(width.range.max, MAX_PREVIEW_MAX_WIDTH);
+
+		const settingsStore = store();
+		settingsStore.previewMaxWidth = MAX_PREVIEW_MAX_WIDTH;
+		settingsStore.codeFontSize = CODE_FONT_SIZE_RANGE.max;
+		SETTINGS_PANES.preview.reset?.(settingsStore);
+		assert.equal(settingsStore.previewMaxWidth, DEFAULT_PREVIEW_MAX_WIDTH);
+		assert.equal(settingsStore.codeFontSize, CODE_FONT_SIZE_RANGE.default);
+	});
+});
+
+describe('settings row layout', async () => {
+	/*
+	 * `.setting-item` is a two-column flex row: a leading <label> that occupies
+	 * `--settings-label-column`, then the controls. Each control class carries its
+	 * own sizing rule — `.select-wrapper` is 220px wide, `.slider-container` is
+	 * `flex: 0 0 auto`, and so on — and every one of those rules assumes the
+	 * element it names is a DIRECT child of the row, i.e. a flex item of it.
+	 *
+	 * The Appearance pane's theme row broke that assumption and nothing noticed.
+	 * It wrapped its `.select-wrapper` in an unclassed `<div>` (to stack a
+	 * "delete selected theme" link under the dropdown) and made that div a COLUMN
+	 * flex container. The flex item of the row was then the unclassed div, which
+	 * no rule sizes, and `.select-wrapper`'s `flex: 0 1 220px` was read down the
+	 * column axis, so 220px became a HEIGHT: the dropdown rendered 79px too narrow
+	 * and sat 191px below its own label.
+	 *
+	 * jsdom does no layout, so the rows are checked by shape on the mounted panes.
+	 * "A rule sizes it" is read off the element itself: Svelte puts the
+	 * component's scoping class only on elements one of its own selectors matches.
+	 */
+	const { mount, unmount } = await import('svelte');
+	const { default: Settings } = await import('../src/lib/components/Settings.svelte');
+
+	/** The control classes `.setting-item`'s row layout sizes as flex items of the row. */
+	const ROW_SIZED_CONTROLS = ['select-wrapper', 'slider-container', 'toggle', 'custom-dropdown-wrapper'];
+
+	const describeEl = (el: Element) => `<${el.tagName.toLowerCase()}${el.className ? ` class="${el.className.replace(/ ?svelte-\w+/g, '')}"` : ''}>`;
+
+	async function renderedRows() {
+		const previous = (window as any).__TAURI_INTERNALS__;
+		(window as any).__TAURI_INTERNALS__ = {
+			invoke: async (cmd: string) => {
+				if (cmd === 'get_system_fonts') return ['Menlo', 'Arial'];
+				if (cmd === 'get_saved_vscode_themes') return ['Nord'];
+				if (cmd === 'plugin:app|version') return '9.9.9';
+				return 'macos';
+			},
+			transformCallback: () => 0,
+		};
+		onTestFinished(() => ((window as any).__TAURI_INTERNALS__ = previous));
+		const target = document.createElement('div');
+		document.body.append(target);
+		const app = mount(Settings, { target, props: { show: true, theme: 'vscode:Nord', onclose() {} }, intro: false });
+		onTestFinished(() => {
+			unmount(app);
+			target.remove();
+		});
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		flushSync();
+
+		const rows: { pane: string; row: HTMLElement; label: string }[] = [];
+		const panes = [...target.querySelectorAll<HTMLButtonElement>('.nav-item')];
+		for (const pane of panes) {
+			pane.click();
+			flushSync();
+			for (const row of target.querySelectorAll<HTMLElement>('.settings-panel .setting-item')) {
+				const label = row.firstElementChild?.textContent?.replace(/\s+/g, ' ').trim() ?? '(empty row)';
+				rows.push({ pane: pane.textContent!.trim(), row, label });
+			}
+		}
+		return rows;
+	}
+
+	test('every settings row was found', async () => {
+		// Vacuous-pass guard: the row assertions below say nothing if no row rendered.
+		const rows = await renderedRows();
+		const panes = new Set(rows.map((entry) => entry.pane));
+		assert.ok(rows.length > 25, `found ${rows.length} .setting-item rows`);
+		assert.ok(panes.size >= 4, `rows in ${[...panes].join(', ')}`);
+	});
+
+	test('a settings row leads with the label that names its control', async () => {
+		const wrong = (await renderedRows())
+			.filter(({ row }) => row.firstElementChild?.tagName !== 'LABEL')
+			.map(({ pane, label, row }) => `${pane} / ${label} leads with ${row.firstElementChild ? describeEl(row.firstElementChild) : 'nothing'}`);
+		assert.deepEqual(wrong, [], 'a row whose first child is not the <label> loses the label column');
+	});
+
+	test('every control in a settings row is a flex item the stylesheet sizes', async () => {
+		// The unclassed <div> that broke the theme row would appear here.
+		const unstyled = (await renderedRows()).flatMap(({ pane, label, row }) => {
+			const scope = [...row.classList].find((name) => name.startsWith('svelte-'));
+			assert.ok(scope, `${label}: the row itself is styled`);
+			return [...row.children]
+				.slice(1)
+				.filter((child) => !child.classList.contains(scope))
+				.map((child) => `${pane} / ${label}: ${describeEl(child)} has no rule`);
+		});
+		assert.deepEqual(unstyled, [], 'a direct child of .setting-item that no rule sizes gets no column');
+	});
+
+	test('no settings row buries a sized control below its own flex level', async () => {
+		// `.select-wrapper` one level deeper is the theme-row defect: its sizing
+		// stops meaning "width" as soon as some other element becomes the flex item.
+		// `.number-input-wrapper` legitimately lives inside `.slider-container`,
+		// which is itself a direct child, so a sized parent is allowed.
+		const sized = (el: Element | null) => !!el && ROW_SIZED_CONTROLS.some((name) => el.classList.contains(name));
+		const buried = (await renderedRows()).flatMap(({ pane, label, row }) =>
+			[...row.querySelectorAll(ROW_SIZED_CONTROLS.map((name) => `.${name}`).join(','))]
+				.filter((control) => control.parentElement !== row && !sized(control.parentElement))
+				.map((control) => `${pane} / ${label}: ${describeEl(control)}`),
+		);
+		assert.deepEqual(buried, [], 'a sized control must be a direct child of its .setting-item');
+	});
+});
diff --git a/scripts/settings.test.ts b/scripts/settings.test.ts
index 77984e43..938b2c6e 100644
--- a/scripts/settings.test.ts
+++ b/scripts/settings.test.ts
@@ -3,6 +3,8 @@ import { describe, test } from 'node:test';
 
 import { DEFAULT_AUTO_SAVE, resolveAutoSave } from '../src/lib/utils/autoSaveSetting.js';
 import { fontFamilyValue } from '../src/lib/utils/fontFamily.js';
+import { editorOptionsFromSettings } from '../src/lib/utils/editorOptions.js';
+import { previewAppearanceFrom } from '../src/lib/utils/previewLayout.js';
 import { getSupportedLanguages, type LanguageCode, t, type Translation } from '../src/lib/utils/i18n.js';
 import { isHexColor, isSafeCssColor, sanitizeThemeColors } from '../src/lib/utils/theme.js';
 import { translations } from './allTranslations.js';
@@ -124,6 +126,40 @@ describe('font family values', () => {
 		assert.equal(fontFamilyValue('   ', 'monospace'), 'monospace');
 		assert.equal(fontFamilyValue('  Lato  ', 'sans-serif'), '"Lato", sans-serif');
 	});
+
+	test('a chosen family reaches the preview, its code and the editor quoted', () => {
+		const hostile = 'x"; color: red; font-family: "y';
+		const quoted = '"x\\"; color: red; font-family: \\"y"';
+		const appearance = previewAppearanceFrom({
+			previewFont: hostile,
+			previewFontSize: 16,
+			codeFont: 'Gill Sans (Body)',
+			codeFontSize: 14,
+			highlightColor: 'yellow',
+		});
+		assert.equal(appearance.fontFamily, `${quoted}, sans-serif`);
+		assert.equal(appearance.codeFontFamily, '"Gill Sans (Body)", monospace');
+
+		const editor = editorOptionsFromSettings(
+			{
+				minimap: false,
+				stickyScroll: true,
+				wordWrap: 'on',
+				editorMaxWidth: 80,
+				lineNumbers: 'on',
+				renderLineHighlight: 'line',
+				occurrencesHighlight: false,
+				editorFontSize: 14,
+				editorFont: 'M+ 1c',
+				animateJumpScroll: false,
+				animateCursor: false,
+				showWhitespace: false,
+				typewriterMode: false,
+			},
+			100,
+		);
+		assert.equal(editor.fontFamily, '"M+ 1c", monospace');
+	});
 });
 
 describe('theme CSS validation', () => {
diff --git a/scripts/settings.themeEffect.spec.ts b/scripts/settings.themeEffect.spec.ts
new file mode 100644
index 00000000..6e70ac77
--- /dev/null
+++ b/scripts/settings.themeEffect.spec.ts
@@ -0,0 +1,99 @@
+import assert from 'node:assert/strict';
+import { flushSync } from 'svelte';
+import { afterEach, describe, test, vi } from 'vitest';
+
+import { followTheme } from '../src/lib/utils/themeEffect.svelte.js';
+import { runeEffect } from './runeEffect.svelte.js';
+import { runeProps } from './runeProps.svelte.js';
+
+// The VS Code branch parses the theme through Monaco; only its two calls are needed.
+vi.mock('monaco-editor', () => ({ editor: { setTheme: vi.fn(), defineTheme: vi.fn() } }));
+
+/** The theme effect, driven by a real `$state` and real effects. */
+function harness(theme: string) {
+	const state = runeProps({ theme, mode: 'view' });
+	const calls: string[] = [];
+	let loaded!: () => void;
+	const settled = new Promise<void>((resolve) => (loaded = resolve));
+	const dispose = runeEffect(() =>
+		followTheme(() => state.theme, {
+			saveStartupAppearance: (appearance) => {
+				calls.push(`startup:${appearance}`);
+				if (state.theme.startsWith('vscode:')) loaded();
+			},
+			readVscodeTheme: async (name) => JSON.stringify({ type: name.includes('Light') ? 'light' : 'dark', colors: {} }),
+			// Reads reactive state the way `renderRichContent` does before its first await.
+			recolourDiagrams: () => void calls.push(`recolour:${state.mode}`),
+			onLoadFailed: (e) => void calls.push(`failed:${e}`),
+		}),
+	);
+	flushSync();
+	return { state, calls, settled, dispose };
+}
+
+let dispose: (() => void) | undefined;
+afterEach(() => {
+	dispose?.();
+	dispose = undefined;
+});
+
+/**
+ * Switching theme has to re-draw the diagrams: Mermaid bakes its colours into
+ * the SVG. The guard used to be `markdownBody && !isEditing`, which made the
+ * whole effect re-run on every mode toggle, with nothing about the theme having
+ * moved, and skipped the re-colour for a tab in edit mode whose split preview
+ * is on screen.
+ */
+describe('diagram theme refresh', () => {
+	test('the theme effect re-colours in every mode, and does not re-run on a mode change', async () => {
+		const run = harness('light');
+		dispose = run.dispose;
+		assert.deepEqual(run.calls, ['startup:light', 'recolour:view']);
+
+		run.state.mode = 'edit';
+		flushSync();
+		assert.equal(run.calls.length, 2, 'a mode change is not a theme change');
+
+		run.state.theme = 'dark';
+		flushSync();
+		assert.deepEqual(run.calls.slice(2), ['startup:dark', 'recolour:edit']);
+
+		// The `vscode:` branch re-colours too, once its appearance is known.
+		run.state.theme = 'vscode:Night Owl';
+		flushSync();
+		await run.settled;
+		await Promise.resolve();
+		assert.deepEqual(run.calls.slice(4), ['startup:dark', 'recolour:edit']);
+	});
+});
+
+/**
+ * `app.rs` paints a window's background before the webview exists, reading
+ * `theme.txt`. Its vocabulary is "dark", "light" and "anything else means ask
+ * the OS" — so every `vscode:` name fell into that last arm, and a dark VS Code
+ * theme on a light desktop flashed white on every launch. Whether such a theme
+ * is dark is inside its own JSON, which only the frontend parses, so the
+ * resolved answer is what gets sent.
+ */
+describe('startup appearance', () => {
+	test('the startup background is told the appearance, not the theme name', async () => {
+		for (const theme of ['system', 'light', 'dark']) {
+			const run = harness(theme);
+			assert.equal(run.calls[0], `startup:${theme}`);
+			run.dispose();
+		}
+
+		for (const [theme, appearance] of [
+			['vscode:Night Owl', 'dark'],
+			['vscode:Quiet Light', 'light'],
+		]) {
+			const run = harness(theme);
+			// Nothing is sent before the parse, because that is when the appearance
+			// becomes knowable.
+			assert.deepEqual(run.calls, []);
+			await run.settled;
+			assert.equal(run.calls[0], `startup:${appearance}`);
+			run.dispose();
+		}
+	});
+});
diff --git a/scripts/settings.themeLoad.spec.ts b/scripts/settings.themeLoad.spec.ts
index a524791d..8e1cb545 100644
--- a/scripts/settings.themeLoad.spec.ts
+++ b/scripts/settings.themeLoad.spec.ts
@@ -3,16 +3,26 @@ import { beforeEach, describe, expect, test, vi } from 'vitest';
 import { clearVscodeTheme, loadVscodeTheme } from '../src/lib/utils/theme.js';
 
 // Module-level on purpose: vitest hoists `vi.mock` and `vi.hoisted` to the top of the file.
+// `hold()` starts a new pending import; `release()` lets the current one finish.
 const monaco = vi.hoisted(() => {
-	let release!: () => void;
-	const loaded = new Promise<void>((resolve) => (release = resolve));
-	return { loaded, release, setTheme: vi.fn(), defineTheme: vi.fn() };
+	const m = {
+		loaded: Promise.resolve(),
+		release: () => {},
+		hold() {
+			m.loaded = new Promise<void>((resolve) => (m.release = resolve));
+		},
+		setTheme: vi.fn(),
+		defineTheme: vi.fn(),
+		async factory() {
+			await m.loaded;
+			return { editor: { setTheme: m.setTheme, defineTheme: m.defineTheme } };
+		},
+	};
+	m.hold();
+	return m;
 });
 
-vi.mock('monaco-editor', async () => {
-	await monaco.loaded;
-	return { editor: { setTheme: monaco.setTheme, defineTheme: monaco.defineTheme } };
-});
+vi.mock('monaco-editor', () => monaco.factory());
 
 /**
  * Choosing a VS Code theme and then another theme before the first finished
@@ -27,10 +37,10 @@ describe('stale theme load', () => {
 	const THEME = JSON.stringify({ type: 'dark', colors: { 'editor.background': '#101010' } });
 
 	/** What the `light` branch of the viewer's theme effect does. */
-	function chooseLight() {
+	function chooseLight(clear = clearVscodeTheme) {
 		document.documentElement.dataset.theme = 'light';
 		document.documentElement.dataset.themeType = 'light';
-		clearVscodeTheme();
+		clear();
 	}
 
 	function deferred<T>() {
@@ -76,18 +86,50 @@ describe('stale theme load', () => {
 	});
 
 	test('Monaco loading for the first time does not repaint the editor after a newer choice', async () => {
-		const load = loadVscodeTheme('Dark Thing', async () => THEME);
+		// Another test may already have loaded Monaco. A fresh module registry, a
+		// re-registered mock and a held import make this load the first one again.
+		monaco.hold();
+		monaco.setTheme.mockClear();
+		vi.resetModules();
+		vi.doMock('monaco-editor', () => monaco.factory());
+		const theme = await import('../src/lib/utils/theme.js');
+
+		const load = theme.loadVscodeTheme('Dark Thing', async () => THEME);
 		// Let the read land and the parse reach `import('monaco-editor')`.
 		await vi.waitFor(() => expect(document.documentElement.dataset.theme).toBe('vscode'));
 
-		chooseLight();
+		chooseLight(theme.clearVscodeTheme);
 		monaco.release();
 
 		expect(await load).toBe(false);
 		expect(monaco.setTheme).not.toHaveBeenCalled();
 
 		// And a load nobody replaced still reaches the editor.
-		expect(await loadVscodeTheme('Dark Thing', async () => THEME)).toBe(true);
+		expect(await theme.loadVscodeTheme('Dark Thing', async () => THEME)).toBe(true);
 		expect(monaco.setTheme).toHaveBeenCalledWith('vscode-custom');
 	});
 });
+
+describe('theme CSS validation', () => {
+	test('[P1-C-3] the injected style tag is built only from validated values', async () => {
+		monaco.release();
+		const hostile = JSON.stringify({
+			type: 'dark',
+			colors: {
+				'editor.background': 'red; } body { display: none } :root {',
+				'editor.foreground': '#abcdef</style><img src=x onerror=alert(1)>',
+				'textLink.foreground': '#123456',
+			},
+		});
+
+		expect(await loadVscodeTheme('Hostile', async () => hostile)).toBe(true);
+
+		const style = document.getElementById('vscode-theme-style')!;
+		expect(style.children.length).toBe(0);
+		expect(style.textContent).not.toMatch(/display: none|onerror|<img|<\/style>/);
+		// A rejected value is a missing one: the default stands in for it.
+		expect(style.textContent).toContain('--color-canvas-default: #1e1e1e;');
+		expect(style.textContent).toContain('--color-fg-default: #d4d4d4;');
+		expect(style.textContent).toContain('--color-accent-fg: #123456;');
+	});
+});
diff --git a/scripts/shortcuts.checks.spec.ts b/scripts/shortcuts.checks.spec.ts
deleted file mode 100644
index 176334e7..00000000
--- a/scripts/shortcuts.checks.spec.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-import assert from 'node:assert/strict';
-
-import { describe, test } from 'vitest';
-
-import { type KeyContext, type KeyStroke, type ViewerCommand, viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
-import { PLATFORMS, viewerCommandTable } from './keymapHarness.js';
-import { readSource } from './sourceTree.js';
-
-describe('viewer keymap', () => {
-	/*
-	 * The document-level dispatcher, called rather than read.
-	 *
-	 * `shortcuts.test.ts` and `shortcuts.checks.test.ts` already sweep
-	 * the whole keymap chord by chord and hold it against the shortcuts panel; what
-	 * is here is the handful of claims that a sweep cannot make — the ones about
-	 * the CONTEXT rather than the chord, which the sweep fires with one fixed
-	 * context, and the two that need a real DOM.
-	 *
-	 * A `.spec.ts` for the DOM: `canUsePreviewWidthShortcut` matches a selector
-	 * against a real element, and a hand-made object with a `closest` method would
-	 * be asserting against the test's own idea of the selector rather than the
-	 * browser's. See AGENTS.md on which runner a test belongs to.
-	 */
-
-	const READING: KeyContext = {
-		mode: 'app',
-		osType: 'windows',
-		isSplit: false,
-		overlayOpen: false,
-		dialogOpen: false,
-		isEditing: false,
-		editorHasFocus: false,
-	};
-
-	const chord = (key: string, code: string, mods: Partial<KeyStroke> = {}): KeyStroke => ({
-		key,
-		code,
-		ctrlKey: false,
-		metaKey: false,
-		shiftKey: false,
-		altKey: false,
-		...mods,
-	});
-
-	test('Ctrl+Q quits the way the menu’s Exit does, not by closing one window', () => {
-		// The menu prints Ctrl+Q beside Exit, and Exit runs `appExit`, which closes
-		// every window. The chord used to run `getCurrentWindow().close()`, so with
-		// two windows open it closed one and left the app running.
-		assert.match(viewerCommandTable()['app-exit'], /\bappExit\(\)/);
-	});
-
-	test('every command the dispatcher can name is one the component can run', () => {
-		// The seam's own contract, and the reason `runViewerCommand` is a switch over
-		// a union rather than a lookup in a map: the compiler rejects a case for a
-		// command that does not exist, and this rejects a command with no case.
-		const table = viewerCommandTable();
-		const reachable = new Set<ViewerCommand>();
-		for (const platform of PLATFORMS) {
-			for (const key of 'abcdefghijklmnopqrstuvwxyz0123456789'.split('')) {
-				for (const ctrlKey of [false, true]) {
-					for (const shiftKey of [false, true]) {
-						const command = viewerCommandFor(chord(key, `Key${key.toUpperCase()}`, { ctrlKey, shiftKey }), {
-							...READING,
-							osType: platform.osType as KeyContext['osType'],
-						});
-						if (command) reachable.add(command);
-					}
-				}
-			}
-		}
-		assert.ok(reachable.size >= 10, `only ${reachable.size} commands were reached; the sweep is not running`);
-		for (const command of reachable) assert.ok(table[command], `runViewerCommand has no case for ${command}`);
-	});
-});
-
-describe('platform source', async () => {
-	/*
-	 * "What platform is this?" had two answers.
-	 *
-	 * `TitleBar.svelte` sniffed `navigator.userAgent` for "Macintosh"; every other
-	 * consumer — the shortcut panel, the editor toolbar, the tab tooltips, the
-	 * document context menu, Monaco's keybindings — read `settings.osType`, which
-	 * the Rust `get_os_type` command fills in. Nothing compared the two, so nothing
-	 * could notice them disagreeing.
-	 *
-	 * They disagree at exactly one moment, and it is the moment the title bar is
-	 * first painted. `SettingsStore` sets `osType` from an `await invoke(…)` in its
-	 * constructor, so the field holds its initial `'unknown'` for as long as that
-	 * round trip takes — the first test below pins that window open. During it the
-	 * user agent already says "Macintosh" while `settings.osType` still says
-	 * `'unknown'`, which is why the title bar could draw Mac chrome above tab
-	 * tooltips printing the Ctrl chords.
-	 *
-	 * That window is also why the obvious fix is wrong. Repointing the title bar at
-	 * `settings.osType` alone would make a Mac render the `windows` class, the
-	 * Windows minimise/maximise/close buttons and no `native-mac` chrome for those
-	 * frames, and then rearrange itself — a visible regression, traded for an
-	 * invisible one. `platformOf` consults `settings.osType` first and falls back to
-	 * the synchronous browser hint only while it is unresolved, so there is one
-	 * source and no flash. The rest of this file is that claim, in both directions.
-	 */
-
-	const { platformOf } = await import('../src/lib/utils/platform.js');
-
-	// ------------------------------------------- the title bar reads that source
-
-	test('TitleBar decides the platform from settings.osType, not from the user agent', () => {
-		// Structural, and red against master: the component held
-		// `navigator.userAgent.includes('Macintosh')` and derived its chrome, its
-		// `native-mac` class and its menu modifier from it. What has to hold is that
-		// the platform enters this component through `platformOf(settings.osType)` and
-		// that every consumer inside it comes off that one value — spell the locals
-		// however you like.
-		const titleBar = readSource('src/lib/components/TitleBar.svelte');
-
-		const source = titleBar.match(/let (\w+) = \$derived\([^\n]*platformOf\(settings\.osType\)\)/);
-		assert.ok(source, 'the platform is derived from platformOf(settings.osType)');
-
-		assert.match(
-			titleBar,
-			new RegExp(`let (\\w+) = \\\$derived\\(${source![1]} === 'macos'\\)`),
-			'the mac test reads that value rather than asking the browser again',
-		);
-		assert.match(
-			titleBar,
-			new RegExp(`let (\\w+) = \\\$derived\\(modifierFor\\(${source![1]}\\)\\)`),
-			'the menu modifier comes from the same value, through modifierFor',
-		);
-
-		// `$derived` and not a plain const: `settings.osType` changes once, after
-		// mount. At a const the title bar would keep the fallback's verdict forever.
-		assert.doesNotMatch(titleBar, /const \w+ = platformOf\(/, 'the platform must stay reactive');
-	});
-});
diff --git a/scripts/shortcuts.checks.test.ts b/scripts/shortcuts.checks.test.ts
index a13ad3a6..3e8e0d2b 100644
--- a/scripts/shortcuts.checks.test.ts
+++ b/scripts/shortcuts.checks.test.ts
@@ -1,16 +1,8 @@
 import assert from 'node:assert/strict';
 import { describe, test } from 'node:test';
 
-import ts from 'typescript';
-
 import { getEditorToolbarTools } from '../src/lib/utils/editorToolbar.js';
-import { isHomePath } from '../src/lib/utils/homeTab.js';
-import { t } from '../src/lib/utils/i18n.js';
-import { formatChord, modifierFor, shortcutLabel, SHORTCUTS } from '../src/lib/utils/shortcuts.js';
-import { getTabFileActions, hasRealFilePath } from '../src/lib/utils/tabFileActions.js';
-import type { ViewerCommand } from '../src/lib/utils/viewerKeymap.js';
-import { bareCommands, type Chord, chordOf, documentKeymap, editorKeymap, OperatingSystem, PLATFORMS, registeredActions, viewerCommandTable } from './keymapHarness.js';
-import { functionSource, readSource, readSourceFiles, sliceBetween } from './sourceTree.js';
+import { readSource, readSourceFiles } from './sourceTree.js';
 
 describe('shortcut registry', () => {
 	/*
@@ -34,130 +26,6 @@ describe('shortcut registry', () => {
 	 * the vim adapter all live in a browser.
 	 */
 
-	// ------------------------------------------------ registry chord -> Monaco label
-
-	/**
-	 * The key names Monaco's `KeyCodeUtils.toString` prints, where they differ from
-	 * the way the registry spells the key for a human.
-	 */
-	const MONACO_KEY_NAMES: Record<string, string> = {
-		Left: 'LeftArrow',
-		Right: 'RightArrow',
-	};
-
-	/**
-	 * A registry chord as the harness spells the same chord.
-	 *
-	 * The registry is written for a reader (`Mod+Shift+E`); Monaco's decoder emits
-	 * `Shift+Meta+E` on macOS and `Ctrl+Shift+E` elsewhere, in its own modifier
-	 * order. Translating in this direction — registry into harness — rather than
-	 * the other way keeps the registry human-facing, and a mistake here makes
-	 * assertions FAIL rather than pass, because the comparison is against chords
-	 * the real code produced.
-	 */
-	function toMonacoLabel(chord: string, mac: boolean): Chord {
-		return chord
-			.split(' ') // a chord SEQUENCE ("Mod+K T") is two chords
-			.map((single) => {
-				const parts = single.split('+');
-				const key = parts.pop()!;
-				const mods = new Set(parts);
-				const ctrl = mods.has('Ctrl') || (mods.has('Mod') && !mac);
-				// A literal `Meta` stays Meta on every platform, the same way a literal
-				// `Ctrl` does. The registry has no such row — the chords that need this
-				// spelling are the unadvertised ones named in
-				// DOCUMENT_CHORDS_NOT_ADVERTISED, which are written in registry syntax so
-				// the exemption list and the registry read alike.
-				const meta = mods.has('Meta') || (mods.has('Mod') && mac);
-				return [
-					ctrl && 'Ctrl',
-					mods.has('Shift') && 'Shift',
-					mods.has('Alt') && 'Alt',
-					meta && 'Meta',
-					MONACO_KEY_NAMES[key] ?? key,
-				]
-					.filter(Boolean)
-					.join('+');
-			})
-			.join(' ');
-	}
-
-	test('the chord translator agrees with the harness on chords both already know', () => {
-		// If `toMonacoLabel` were broken every assertion below would fail, not pass —
-		// but a silent disagreement about ONE key name would look like a real bug in
-		// the app, so it is pinned against chords the editor layer independently
-		// produces.
-		const mac = editorKeymap(true, OperatingSystem.Macintosh);
-		const win = editorKeymap(false, OperatingSystem.Windows);
-
-		assert.equal(toMonacoLabel('Mod+Shift+E', true), 'Shift+Meta+E');
-		assert.equal(toMonacoLabel('Mod+Shift+E', false), 'Ctrl+Shift+E');
-		assert.equal(toMonacoLabel('Mod+K T', false), 'Ctrl+K T');
-		assert.equal(toMonacoLabel('Ctrl+Tab', true), 'Ctrl+Tab', 'a literal Ctrl stays Ctrl on macOS');
-		assert.equal(toMonacoLabel('Meta+Alt+Left', false), 'Alt+Meta+LeftArrow', 'a literal Meta stays Meta off macOS');
-		assert.equal(toMonacoLabel('Alt+Left', false), 'Alt+LeftArrow');
-
-		assert.deepEqual(mac.get('fmt-inline-code'), ['Shift+Meta+E']);
-		// `Mod+K T` above is still translated correctly; nothing BINDS a sequence any
-		// more, which is the rule asserted further down. Insert Table is the action
-		// that used to hold the two-part chord and is the single stroke `Mod+Alt+T`
-		// now, so this is the row that would have to change if the sequence came back.
-		assert.deepEqual(win.get('insert-table-simple'), ['Ctrl+Alt+T']);
-	});
-
-	// ------------------------------------------------------ the contract itself
-
-	test('every chord the registry advertises is the chord the editor really registers', () => {
-		let checked = 0;
-		for (const platform of PLATFORMS) {
-			const keymap = editorKeymap(platform.mac, platform.os);
-			for (const entry of SHORTCUTS) {
-				if (!entry.editorAction) continue;
-				const registered = keymap.get(entry.id);
-				assert.ok(
-					registered,
-					`${platform.name}: the registry says ${entry.id} has a shortcut, but Editor.svelte registers no keybinding for that action id`,
-				);
-				for (const chord of entry.chords) {
-					const want = toMonacoLabel(chord, platform.mac);
-					assert.ok(
-						registered.includes(want),
-						`${platform.name}: the panel would show ${formatChord(chord, platform.mac ? 'Cmd' : 'Ctrl')} for ${entry.id}, but the editor binds it to ${registered.join(', ')}`,
-					);
-					checked++;
-				}
-			}
-		}
-		assert.ok(checked > 50, `only ${checked} editor chords were checked`);
-	});
-
-	test('a chord with both halves runs the same command in the editor as outside it', () => {
-		// Mod+S inside Monaco called `saveContent` straight, past the clean-file
-		// check `runViewerCommand('save')` makes, so it rewrote a saved file the
-		// menu and the preview left alone. The editor half now hands the command
-		// name to the same switch, so it cannot carry its own copy of a guard.
-		const { actions, calls } = registeredActions(false);
-		let checked = 0;
-		for (const entry of SHORTCUTS) {
-			if (!entry.editorAction || !entry.documentCommands) continue;
-			const action = actions.find((candidate) => candidate.id === entry.id);
-			assert.ok(action, `${entry.id} is registered in the editor`);
-			const before = calls.length;
-			action.run();
-			assert.deepEqual(calls.slice(before), [`oncommand(${JSON.stringify(entry.documentCommands[0])})`], entry.id);
-			checked++;
-		}
-		assert.ok(checked > 10, `only ${checked} editor commands were checked`);
-	});
-
-	test('the editor command palette names the commands the way the panel does', () => {
-		const editor = readSource('src/lib/components/Editor.svelte');
-		for (const id of ['file-reveal', 'view-toggle-edit', 'view-toggle-live']) {
-			const label = new RegExp(`id: "${id}",\\s*label: t\\('([^']+)'`).exec(editor)?.[1];
-			assert.equal(label, SHORTCUTS.find((entry) => entry.id === id)?.labelKey, `${id} in the palette`);
-		}
-	});
-
 	// ------------------------------------------------------ the display layers
 
 	test('the editor toolbar declares no chord of its own', () => {
@@ -283,372 +151,6 @@ describe('shortcut registry', () => {
 		}
 	});
 
-	// ------------------------------------------- the context menus, actually run
-
-	/*
-	 * `ContextMenu.svelte` prints `item.shortcut` into the SAME
-	 * `<span class="menu-shortcut">` the app menu uses, so a chord handed to it sits
-	 * in the same visual slot as a chord the app menu derived from the registry —
-	 * and the tab menus handed it `'Ctrl+T'`, `'Ctrl+Shift+T'` and `'Ctrl+W'` as
-	 * literals. On macOS that printed "New File · Ctrl+T" one keystroke away from
-	 * the File menu's "Cmd+T", and Ctrl+T is not bound there at all: `Editor.svelte`
-	 * binds `monaco.KeyMod.CtrlCmd`, which is ⌘ on a Mac.
-	 *
-	 * The guard above could not see it. It reads the `<span>` bodies of
-	 * `TitleBar.svelte`, and these were `shortcut:` object properties in two other
-	 * components — a different shape in a different file. Same for the two `title=`
-	 * tooltips on the `+` button and the tab close button.
-	 *
-	 * So the menus are RUN here rather than read: the builder function is lifted out
-	 * of its component (the same trick `keymapHarness.ts` uses on `handleKeyDown`)
-	 * and evaluated with a `settings` store that says macOS, then one that says
-	 * Windows. What comes back is the array `ContextMenu` would render, so the
-	 * assertion is about the string the user sees rather than about the shape of the
-	 * source that produced it.
-	 */
-
-	type MenuItem = { label?: string; shortcut?: string; separator?: true };
-
-	/** The items `fn` in `file` builds, on `osType`. */
-	async function contextMenuItems(file: string, fn: string, osType: string): Promise<MenuItem[]> {
-		const js = ts.transpileModule(functionSource(readSource(file), fn), {
-			compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-		}).outputText;
-
-		let menu: { items?: MenuItem[] } | undefined;
-		const known: Record<string, unknown> = {
-			// The real store field the component has to consult, and the real
-			// translator and registry functions — a stub for any of these would let a
-			// component that asked the wrong question still look right.
-			settings: { osType, language: 'en' },
-			t,
-			shortcutLabel,
-			modifierFor,
-			getTabFileActions,
-			hasRealFilePath,
-			isHomePath,
-			tab: { id: 'tab-1', path: '/notes/a.md', title: 'a.md' },
-			tabManager: { tabs: [{ id: 'tab-1' }, { id: 'tab-2' }] },
-			getCurrentWindow: () => ({ label: 'main' }),
-			emitTo: () => {},
-			// The only other window is this one, so the "move to window" section is
-			// empty and the shortcut-bearing rows are undisturbed.
-			invoke: async () => [],
-			console,
-		};
-
-		const scope = new Proxy(known, {
-			has: () => true,
-			get: (target, property) =>
-				typeof property === 'string' && property in target ? target[property] : () => undefined,
-			set: (target, property, value) => {
-				const items = (value as { items?: unknown })?.items;
-				if (Array.isArray(items)) menu = value as { items: MenuItem[] };
-				target[property as string] = value;
-				return true;
-			},
-		});
-
-		const build = new Function('scope', `with (scope) { ${js}\nreturn ${fn}; }`) as (
-			s: unknown,
-		) => (e: unknown) => unknown;
-
-		// `handleContainerContextMenu` returns early unless the event landed on the
-		// container itself, so target and currentTarget are the same object.
-		const el = { classList: { contains: () => false } };
-		await build(scope)({ preventDefault() {}, stopPropagation() {}, clientX: 10, clientY: 20, target: el, currentTarget: el });
-
-		assert.ok(menu?.items?.length, `${fn} in ${file} produced no menu at all; the harness is not running the real function`);
-		return menu!.items!;
-	}
-
-	/** file -> builder, and the labelled chords it must show on each platform. */
-	const TAB_MENUS: Array<{ file: string; fn: string; macos: Array<[string, string]> }> = [
-		{
-			file: 'src/lib/components/Tab.svelte',
-			fn: 'handleContextMenu',
-			macos: [
-				['menu.newFile', 'Cmd+T'],
-				['menu.undoCloseTab', 'Cmd+Shift+T'],
-				['menu.closeFile', 'Cmd+W'],
-			],
-		},
-		{
-			file: 'src/lib/components/TabList.svelte',
-			fn: 'handleContainerContextMenu',
-			macos: [
-				['menu.newFile', 'Cmd+T'],
-				['menu.undoCloseTab', 'Cmd+Shift+T'],
-			],
-		},
-	];
-
-	test('the tab context menus print the modifier the user is on, not a hard-coded Ctrl', async () => {
-		for (const { file, fn, macos } of TAB_MENUS) {
-			for (const platform of ['macos', 'windows'] as const) {
-				const shown = (await contextMenuItems(file, fn, platform))
-					.filter((item) => item.shortcut)
-					.map((item) => [item.label, item.shortcut]);
-
-				const want = macos.map(([labelKey, chord]) => [
-					t(labelKey, 'en'),
-					platform === 'macos' ? chord : chord.replaceAll('Cmd', 'Ctrl'),
-				]);
-
-				assert.deepEqual(
-					shown,
-					want,
-					`${file}: the ${platform} tab context menu shows ${JSON.stringify(shown)}; ` +
-						'every chord in it must come from shortcutLabel() so it agrees with the app menu',
-				);
-			}
-		}
-	});
-
-	// -------------------------------------------------- editor bindings vs panel
-
-	/**
-	 * Editor actions that carry a keybinding and are deliberately NOT advertised.
-	 *
-	 * Without this list the registry could quietly fall behind: someone binds a new
-	 * chord, the panel never mentions it, and no test notices. Each exclusion is a
-	 * decision with a reason, in the shape this repo already uses for
-	 * `KNOWN_LAYER_DIVERGENCES`.
-	 */
-	const NOT_ADVERTISED: Record<string, string> = {
-		'custom-copy':
-			'the OS clipboard convention, not an app shortcut; its Ctrl+V twin is a bare addCommand with no id, so listing one without the other is the more confusing half-answer',
-	};
-
-	test('every keybinding the editor registers is either advertised or consciously not', () => {
-		const advertised = new Set(SHORTCUTS.filter((entry) => entry.editorAction).map((entry) => entry.id));
-		const bound = [...editorKeymap(false, OperatingSystem.Windows).keys()];
-		assert.ok(bound.length > 20, `the editor binds ${bound.length} actions`);
-
-		const unexplained = bound.filter((id) => !advertised.has(id) && !(id in NOT_ADVERTISED));
-		assert.deepEqual(
-			unexplained,
-			[],
-			'these editor actions have a keybinding that the shortcuts panel never mentions; ' +
-				'add a row to SHORTCUTS or a reason to NOT_ADVERTISED',
-		);
-
-		// The exclusion list must not rot: a binding that went away has to leave it.
-		for (const id of Object.keys(NOT_ADVERTISED)) {
-			assert.ok(bound.includes(id), `${id} no longer has a keybinding — drop it from NOT_ADVERTISED`);
-		}
-	});
-
-	// ------------------------------------------- every chord is one keystroke
-	//
-	// The rule that replaced the `Mod+K` namespace. Insert Table and Insert Column
-	// used to be `Mod+K T` and `Mod+K C`, and Insert Table had to be registered
-	// TWICE — once released, once with the modifier still held — because "Cmd+K T"
-	// reads as one gesture and `Cmd+K` then `Cmd+T` otherwise fell through to
-	// `file-new`: asking for a table opened a tab. That was the cheaper half of the
-	// problem. The expensive half was that people found the two-key gesture awkward
-	// enough to stop using it, which is what this whole rework came out of.
-	//
-	// So there is no namespace to keep consistent any more, and the invariant worth
-	// holding is the stronger one: nothing the app binds is a sequence at all.
-
-	test('the app binds no chord sequence anywhere, in either keyboard layer', () => {
-		// `Mod+K` is Insert Link now, so a sequence beginning with it could not be
-		// typed even if something declared one — the first key would fire the link.
-		// This is the rule that would catch a new sequence being introduced on some
-		// other prefix, which is the shape the ergonomics complaint was about rather
-		// than anything specific to K.
-		let checked = 0;
-		for (const platform of PLATFORMS) {
-			for (const [id, chords] of editorKeymap(platform.mac, platform.os)) {
-				for (const chord of chords) {
-					assert.ok(
-						!chord.includes(' '),
-						`${platform.name}: ${id} is bound to the sequence ${chord}; every binding here is one keystroke`,
-					);
-					checked++;
-				}
-			}
-			for (const command of bareCommands()) {
-				const chord = chordOf(command.binding, platform.os);
-				assert.ok(!chord.includes(' '), `${platform.name}: ${command.handler} is bound to the sequence ${chord}`);
-				checked++;
-			}
-		}
-		assert.ok(checked > 90, `only ${checked} bindings were checked`);
-
-		// And the registry says the same thing, which is the half a user sees: the
-		// panel cannot advertise a gesture the editor no longer answers.
-		for (const entry of SHORTCUTS) {
-			for (const chord of entry.chords) {
-				assert.ok(!chord.includes(' '), `${entry.id} advertises the sequence ${chord}`);
-			}
-		}
-	});
-
-	test('Mod+K belongs to Insert Link, on every platform', () => {
-		// The decision itself, asserted where a reader will look for it. Typora, Bear,
-		// iA Writer and GitHub all document this chord for Insert Link — four
-		// independent sources agreeing exactly, which no other command in the survey
-		// managed — and the link button carried no shortcut at all before this.
-		for (const platform of PLATFORMS) {
-			const chord = platform.mac ? 'Meta+K' : 'Ctrl+K';
-			assert.deepEqual(editorKeymap(platform.mac, platform.os).get('fmt-link'), [chord], platform.name);
-			assert.equal(
-				SHORTCUTS.find((entry) => entry.id === 'fmt-link')?.chords[0],
-				'Mod+K',
-				'the panel advertises it too',
-			);
-		}
-	});
-
-	/**
-	 * Table verbs that are commands with no key, and the reason each one lost it.
-	 *
-	 * Dropping a CHORD is not dropping a command: `addAction` without `keybindings`
-	 * still puts the verb in the command palette (`Mod+P`, which runs Monaco's
-	 * `editor.action.quickCommand`).
-	 *
-	 * WHAT DECIDES IT IS HOW HARD THE EDIT IS BY HAND, not whether it destroys
-	 * anything. This table used to say the opposite — that destructive table verbs
-	 * get no keys because a mis-fire costs too much — and that rule is gone rather
-	 * than sitting here next to the one the code follows: Delete Column destroys
-	 * more than Delete Row does and has a chord (`Mod+Shift+Backspace`), so the old
-	 * rationale could not have been what was being applied. The hazard it named is
-	 * also gone in fact: the `Mod+K` namespace no longer exists, so no table verb
-	 * sits one slip from Monaco's delete-line (`Mod+Shift+K`) any more.
-	 *
-	 * The four verbs, and what each one is worth a key for:
-	 *
-	 *   Insert Row      Mod+Enter / Mod+Shift+Enter, and Tab at the last cell
-	 *                   — the frequent one, so it gets the cheapest keys there are
-	 *   Insert Column   Mod+Shift+C — mid-frequency, and fiddly by hand
-	 *   Delete Column   Mod+Shift+Backspace — NO manual fallback: it means editing
-	 *                   the pipes on every row without slipping once
-	 *   Delete Row      palette only — trivial by hand. Put the caret on the line,
-	 *                   select it, delete. A chord buys nothing the keyboard does
-	 *                   not already do, and an unearned chord is one more key to
-	 *                   mis-fire.
-	 *
-	 * So the test of a new row here is not "is it dangerous" but "can the user
-	 * already do this without us".
-	 */
-	const TABLE_VERBS_WITHOUT_A_CHORD: Record<string, string> = {
-		'table-insert-row':
-			'Mod+Enter owns it now — inside a table, "insert a line below" already means "insert a row below"',
-		'table-delete-row':
-			'trivial by hand — put the caret on the line, select it, delete — so a chord buys nothing the ' +
-			'keyboard already does. This is the only one of the four with a manual fallback that good, ' +
-			'which is why it is the only one left without a key',
-	};
-
-	test('the table verbs with no chord are still commands, and advertise nothing', () => {
-		const actions = new Map(registeredActions(false).actions.map((action) => [action.id, action]));
-		for (const [id, why] of Object.entries(TABLE_VERBS_WITHOUT_A_CHORD)) {
-			const action = actions.get(id);
-			assert.ok(action, `${id} must stay registered — the key went away, not the command (${why})`);
-			assert.deepEqual(action.keybindings ?? [], [], `${id} has a keybinding again; it was dropped because ${why}`);
-			assert.equal(
-				SHORTCUTS.find((entry) => entry.id === id),
-				undefined,
-				`${id} has no chord, so the panel must not claim one`,
-			);
-		}
-	});
-
-	// ------------------------------------- the contextual keys (the `keys` group)
-	//
-	// Enter, Tab and Shift+Tab are bound with a bare `editor.addCommand`: no action
-	// id, no label, no menu entry. That is right — they are not commands a user
-	// invokes, they are what those keys already mean one Markdown rule further on —
-	// but it also made them INVISIBLE. #636 shipped Enter continuing a list and
-	// nothing in the app said so anywhere; the `keys` group in the registry is that
-	// omission being fixed, and this section is what keeps the fix honest.
-	//
-	// `editorAction` cannot carry these rows, because `editorKeymap` is built from
-	// `addAction` descriptors and a nameless command has none. So the row names the
-	// HANDLER instead, and the handler is looked up in the component's real
-	// `addCommand` calls with the keybinding evaluated by Monaco's own `KeyMod`.
-
-	/**
-	 * Nameless commands the editor binds that are deliberately not advertised.
-	 *
-	 * The two clipboard chords, for the reason `NOT_ADVERTISED` already gives for
-	 * their `custom-copy` twin: they are OS conventions rather than app shortcuts.
-	 * Everything else the editor binds without a name has to be in the panel.
-	 */
-	const BARE_NOT_ADVERTISED: Record<string, string> = {
-		cutToClipboard:
-			'the OS clipboard convention, not an app shortcut; bound only because Monaco leaves cut/paste unbound in a browser',
-		pasteFromClipboard: 'the same, one key over',
-	};
-
-	test('every contextual key the registry advertises is bound to the handler it names', () => {
-		const advertised = SHORTCUTS.filter((entry) => entry.editorCommand);
-		assert.ok(advertised.length >= 3, `${advertised.length} rows name a bare command`);
-
-		for (const platform of PLATFORMS) {
-			const bound = new Map(bareCommands().map((call) => [chordOf(call.binding, platform.os), call.handler]));
-			for (const entry of advertised) {
-				for (const chord of entry.chords) {
-					const want = toMonacoLabel(chord, platform.mac);
-					assert.equal(
-						bound.get(want),
-						entry.editorCommand,
-						`${platform.name}: the panel would show ${formatChord(chord, platform.mac ? 'Cmd' : 'Ctrl')} ` +
-							`for ${entry.id} (${entry.editorCommand}), but that chord is bound to ${bound.get(want) ?? 'nothing'}`,
-					);
-				}
-			}
-		}
-	});
-
-	test('every nameless command the editor binds is advertised, or consciously not', () => {
-		// The completeness direction, which is the one that would have caught #636
-		// shipping unannounced: a new bare binding has to be shown or explained.
-		const advertised = new Set(SHORTCUTS.map((entry) => entry.editorCommand).filter(Boolean));
-		const bound = bareCommands().map((call) => call.handler);
-
-		const unexplained = bound.filter((handler) => !advertised.has(handler) && !(handler in BARE_NOT_ADVERTISED));
-		assert.deepEqual(
-			unexplained,
-			[],
-			'these keys do something extra in the editor and the shortcuts panel never mentions it; ' +
-				'add a row to SHORTCUTS (group `keys`) or a reason to BARE_NOT_ADVERTISED',
-		);
-
-		for (const handler of Object.keys(BARE_NOT_ADVERTISED)) {
-			assert.ok(bound.includes(handler), `${handler} is no longer bound — drop it from BARE_NOT_ADVERTISED`);
-		}
-	});
-
-	test('the panel’s groups are visibly separated, not run together', () => {
-		// The five sections stacked with nothing between them, so each heading sat
-		// flush against the last row of the group above and read as belonging to it —
-		// the whole pane looked like one undifferentiated list.
-		//
-		// A source-shape assertion, because the subject is CSS and there is no DOM
-		// here. What it pins is the part that can silently regress: that consecutive
-		// groups get a rule and space at all, and that the rule's colour is a theme
-		// token rather than a literal, so it survives the light/dark switch.
-		const text = readSource('src/lib/components/Settings.svelte');
-		assert.match(
-			text,
-			/class="settings-group shortcut-group"/,
-			'the shortcut sections need a class of their own: `.settings-group` is shared with every other pane',
-		);
-
-		const rule = /\.shortcut-group\s*\+\s*\.shortcut-group\s*\{([^}]*)\}/.exec(text);
-		assert.ok(rule, 'nothing separates one shortcut group from the next');
-		assert.match(
-			rule[1],
-			/border-top:[^;]*var\(--color-border-[a-z]+\)/,
-			'the separator must take its colour from a theme variable, so both themes get it',
-		);
-		assert.match(rule[1], /padding-top:\s*\d/, 'a rule with no space under it still reads as part of the row above');
-		assert.match(rule[1], /margin-top:\s*\d/, 'and no space above it still reads as part of the row above');
-	});
-
 	/**
 	 * Chords the document handler answers that the panel deliberately never shows,
 	 * written in registry syntax so this list and the registry read alike.
@@ -688,216 +190,7 @@ describe('shortcut registry', () => {
 });
 
 describe('formatting shortcuts keymap', () => {
-	/*
-	 * Issues #121 (six formatting commands with no shortcut) and #392 (Ctrl+T means
-	 * two things). Both needed the same thing first — the whole keymap — so they are
-	 * held by one file.
-	 *
-	 * The machinery that RUNS the two keyboard layers now lives in
-	 * `./keymapHarness.ts`, because the shortcut-registry contract needs the same
-	 * two functions and must not be checked against a second, more forgiving model
-	 * of the app. What each harness does and does not establish is documented there.
-	 */
-
-	// ------------------------------------------------------------------ item #121
-
-	/**
-	 * The six bindings this change adds, and the chord each must resolve to.
-	 *
-	 * `CtrlCmd` resolves to Meta on macOS and Ctrl everywhere else, so each row is
-	 * checked against Monaco's decoder once per platform rather than assumed.
-	 */
-	const NEW_BINDINGS: ReadonlyArray<[actionId: string, mac: Chord, other: Chord, toolbarLabel: string]> = [
-		['fmt-heading-1', 'Meta+1', 'Ctrl+1', '+1'],
-		['fmt-heading-2', 'Meta+2', 'Ctrl+2', '+2'],
-		['fmt-heading-3', 'Meta+3', 'Ctrl+3', '+3'],
-		['fmt-inline-code', 'Shift+Meta+E', 'Ctrl+Shift+E', '+Shift+E'],
-		['fmt-code-block', 'Shift+Meta+F', 'Ctrl+Shift+F', '+Shift+F'],
-		['fmt-quote', 'Shift+Meta+.', 'Ctrl+Shift+.', '+Shift+.'],
-	];
-
-	test('each formatting action asked for in #121 now carries its shortcut', () => {
-		for (const platform of PLATFORMS) {
-			const keymap = editorKeymap(platform.mac, platform.os);
-			for (const [id, mac, other] of NEW_BINDINGS) {
-				assert.deepEqual(
-					keymap.get(id),
-					[platform.mac ? mac : other],
-					`${id} on ${platform.name}`,
-				);
-			}
-		}
-	});
-
-	test('each new shortcut runs the command it is labelled with', () => {
-		// The binding and the body are two separate fields of one object literal,
-		// and nothing in the type system stops `fmt-heading-2` from carrying
-		// heading 3's `run`. Each action is invoked and the call it makes recorded.
-		const expected: Record<string, string> = {
-			'fmt-heading-1': 'toggleLineMarkerTool("fmt-heading-1")',
-			'fmt-heading-2': 'toggleLineMarkerTool("fmt-heading-2")',
-			'fmt-heading-3': 'toggleLineMarkerTool("fmt-heading-3")',
-			'fmt-quote': 'toggleLineMarkerTool("fmt-quote")',
-			'fmt-inline-code': 'toggleInlineWrapTool("fmt-inline-code")',
-			'fmt-code-block': 'wrapAsCodeBlock',
-		};
-
-		const { actions, calls } = registeredActions(false);
-		for (const [id, want] of Object.entries(expected)) {
-			const action = actions.find((a) => a.id === id);
-			assert.ok(action, `${id} is registered`);
-			const before = calls.length;
-			action.run();
-			assert.deepEqual(calls.slice(before), [want], `${id} runs ${want}`);
-		}
-	});
-
-	test('the toolbar tooltip prints the shortcut the editor actually registered', () => {
-		// Two copies of one fact: Editor.svelte binds the key, editorToolbar.ts
-		// renders the hint on the button. Bold, Italic and Underline already had
-		// both and nothing held them together.
-		const byId = new Map(getEditorToolbarTools(null).map((tool) => [tool.id, tool]));
-		const bound = editorKeymap(false, OperatingSystem.Windows);
-
-		for (const [id, tool] of byId) {
-			const chords = bound.get(id);
-			if (!chords) {
-				assert.equal(tool.shortcut, undefined, `${id} has no keybinding, so the toolbar must not advertise one`);
-				continue;
-			}
-			assert.ok(tool.shortcut, `${id} is bound to ${chords.join(' ')} but the toolbar shows nothing`);
-			// "Ctrl+Shift+E" -> "Ctrl+Shift+E"; a chord sequence "Ctrl+K T" -> "Ctrl+K T".
-			assert.equal(
-				tool.shortcut('Ctrl'),
-				chords[0].replace(/\bMeta\b/g, 'Ctrl'),
-				`${id}: toolbar hint and registered keybinding disagree`,
-			);
-			// Both renderings come from the same registry row through `formatChord`, so
-			// they name the same key and the same number of modifiers — but NOT the same
-			// WORDS: `Alt` is `Opt` on macOS (#651). Asserting a string substitution here
-			// would be a second copy of that word map, which is the defect #651 removed;
-			// `shortcuts.test.ts` owns the per-platform naming and this only has to
-			// prove the two renderings are still the same chord.
-			const asCmd = tool.shortcut('Cmd').split('+');
-			const asCtrl = tool.shortcut('Ctrl').split('+');
-			assert.equal(asCmd.length, asCtrl.length, `${id}: the two renderings are not the same chord`);
-			assert.equal(asCmd.at(-1), asCtrl.at(-1), `${id}: the two renderings end on different keys`);
-		}
-
-		// The rows this change adds, spelled out, so that deleting one of them from
-		// editorToolbar.ts fails here rather than passing the loop above vacuously.
-		for (const [id, , , suffix] of NEW_BINDINGS) {
-			assert.equal(byId.get(id)?.shortcut?.('Cmd'), `Cmd${suffix}`, `${id} toolbar hint`);
-		}
-	});
-
-	// ------------------------------------------------------------------ item #392
-
-	const NEW_FILE_CHORDS = { mac: ['Meta+N', 'Meta+T'], other: ['Ctrl+N', 'Ctrl+T'] };
-
-	test('Ctrl/Cmd+T means new file in the editor, on every platform', () => {
-		for (const platform of PLATFORMS) {
-			const chords = editorKeymap(platform.mac, platform.os).get('file-new');
-			assert.deepEqual(
-				chords,
-				platform.mac ? NEW_FILE_CHORDS.mac : NEW_FILE_CHORDS.other,
-				`file-new on ${platform.name}`,
-			);
-		}
-
-		// `oncommand` is bound to `runViewerCommand`, the switch the document-level
-		// branch reaches too, so both halves run the same `new-file`.
-		const probe = registeredActions(false);
-		const fileNew = probe.actions.find((action) => action.id === 'file-new');
-		assert.ok(fileNew, 'file-new is registered');
-		const before = probe.calls.length;
-		fileNew.run();
-		assert.deepEqual(probe.calls.slice(before), ['oncommand("new-file")'], 'file-new runs the new-file command');
-
-		assert.match(
-			readSource('src/lib/MarkdownViewer.svelte'),
-			/oncommand=\{runViewerCommand\}/,
-			'the editor prop is wired to runViewerCommand',
-		);
-	});
-
-	test('no path anywhere still opens a Home tab from a keystroke', () => {
-		// The #392 defect in its original spelling: the document branch for Ctrl+T
-		// called `tabManager.addHomeTab`. There is no `ViewerCommand` for that any
-		// more, so the checkable end is the other one — the component's command table
-		// has no route to `addHomeTab`, from any chord. `viewerCommandTable()` reads
-		// that table out of the component; see its note in `keymapHarness.ts`.
-		const routes = Object.entries(viewerCommandTable()).filter(([, body]) => body.includes('addHomeTab'));
-		assert.deepEqual(routes.map(([command]) => command), [], 'a keyboard command still reaches addHomeTab');
-	});
-
-	// ---------------------------------------------------------- the whole keymap
-
-	test('no two editor actions claim the same chord', () => {
-		for (const platform of PLATFORMS) {
-			const owners = new Map<Chord, string[]>();
-			for (const [id, chords] of editorKeymap(platform.mac, platform.os)) {
-				for (const chord of chords) owners.set(chord, [...(owners.get(chord) ?? []), id]);
-			}
-			for (const [chord, ids] of owners) {
-				assert.equal(ids.length, 1, `${platform.name}: ${chord} is claimed by ${ids.join(' and ')}`);
-			}
-		}
-	});
-
-	/**
-	 * Chords the two layers answer differently, on purpose or not.
-	 *
-	 * A chord that both Monaco and the document handler answer must mean the same
-	 * thing in both, or it means two things depending on focus — which is exactly
-	 * what #392 reported. Everything left here is a divergence that predates this
-	 * change; each is named so that a NEW one fails instead of joining a silent
-	 * pile.
-	 */
-	const KNOWN_LAYER_DIVERGENCES: Record<Chord, string> = {
-		// Monaco binds real Ctrl+Tab on macOS because Cmd+Tab is the system app
-		// switcher (see editor.checks.test.ts); the document handler accepts
-		// either modifier. Same action, different chord — not a meaning conflict.
-		'Ctrl+Tab': 'tab cycling: Monaco uses WinCtrl on macOS, the window handler accepts Ctrl or Cmd',
-		'Ctrl+Shift+Tab': 'tab cycling, as above',
-		'Meta+Tab': 'tab cycling, as above',
-		'Shift+Meta+Tab': 'tab cycling, as above',
-	};
-
-	test('a chord that both layers answer means the same thing in both', () => {
-		// The pairs the app deliberately mirrors: the editor action and the
-		// window-level branch that stands in for it when the caret is elsewhere.
-		const MIRROR: Record<string, ViewerCommand> = {
-			'file-new': 'new-file',
-			'file-open': 'open-file',
-			'file-save': 'save',
-			'file-close': 'close-file',
-			'view-toggle-edit': 'toggle-edit-view',
-			'view-toggle-split': 'toggle-split-view',
-			'tab-undo-close': 'undo-close-tab',
-		};
-
-		for (const platform of PLATFORMS) {
-			const editorSide = editorKeymap(platform.mac, platform.os);
-			const documentSide = documentKeymap(platform.osType);
-
-			for (const [id, expectedCommand] of Object.entries(MIRROR)) {
-				const chords = editorSide.get(id);
-				assert.ok(chords?.length, `${id} is bound in the editor on ${platform.name}`);
-				for (const chord of chords) {
-					if (chord in KNOWN_LAYER_DIVERGENCES) continue;
-					assert.ok(documentSide.has(chord), `${platform.name}: ${chord} runs ${id} in the editor but nothing outside it`);
-					assert.equal(
-						documentSide.get(chord),
-						expectedCommand,
-						`${platform.name}: ${chord} runs ${id} in the editor but ${documentSide.get(chord)} outside it`,
-					);
-				}
-			}
-		}
-	});
-
-	// Monaco's own default chords are checked in `editor.checks.spec.ts`.
+	// Monaco's own default chords are checked in `editor.chords.spec.ts`.
 
 	// ------------------------------------- a core Monaco binding, left alone
 
@@ -905,7 +198,7 @@ describe('formatting shortcuts keymap', () => {
 		// #652 took this key off as a guard against `Mod+K Shift+R` (Delete Row),
 		// one slip away. That chord and the whole `Mod+K` namespace are gone, so the
 		// guard protected nothing and cost users a key they asked for back (#821).
-		// Nothing of ours may claim the chord either; `editor.checks.spec.ts`
+		// Nothing of ours may claim the chord either; `editor.chords.spec.ts`
 		// holds that side.
 		assert.doesNotMatch(
 			readSource('src/lib/components/Editor.svelte'),
@@ -914,135 +207,3 @@ describe('formatting shortcuts keymap', () => {
 		);
 	});
 });
-
-describe('menu and modal guards', () => {
-	const viewer = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-	const titleBar = readSource(new URL('../src/lib/components/TitleBar.svelte', import.meta.url));
-	const modal = readSource(new URL('../src/lib/components/Modal.svelte', import.meta.url));
-
-	// Three of the four assertions below used to spell `\n\t\t` and `\n\t\t\t` into
-	// the pattern, so they pinned the indentation of the code as much as its order.
-	// A single `prettier` run — or wrapping one condition across two lines — turned
-	// all three red without changing a thing the user can see. What actually has to
-	// hold is which function the statement lives in and what it comes BEFORE, so
-	// that is what is asserted now: the scope comes from `functionSource`, and the
-	// ordering from offsets within that scope.
-
-	/** The document-level right-click handler, braces included. */
-	const contextMenuHandler = functionSource(viewer, 'handleContextMenu');
-
-	/** Where `needle` sits inside `scope`, asserted to be present at all. */
-	function offsetIn(scope: string, needle: string, what: string): number {
-		const at = scope.indexOf(needle);
-		assert.notEqual(at, -1, `${what} is gone from the handler`);
-		return at;
-	}
-
-	test('document context menus do not open while a modal is active', () => {
-		// First statement, not merely present: every branch below it either opens a
-		// menu or returns, so a modal guard placed after any of them is not a guard.
-		assert.match(contextMenuHandler, /^function handleContextMenu\([^)]*\)\s*\{\s*if \(modalState\.show\)\s*return;/);
-	});
-
-	test('titlebar menus close before a document context menu opens', () => {
-		assert.match(titleBar, /window\.addEventListener\('contextmenu', handleGlobalDismiss\)/);
-		assert.match(titleBar, /window\.addEventListener\('blur', handleGlobalDismiss\)/);
-	});
-
-	test('modal backdrop consumes context-menu events outside text fields', () => {
-		// Scoped to the backdrop's own `oncontextmenu`, so a `preventDefault` that
-		// belongs to some other handler in this component cannot satisfy it.
-		const backdrop = sliceBetween(modal, 'oncontextmenu={', 'role="presentation"');
-		const carveOut = offsetIn(backdrop, "closest('input, textarea')", 'the text-field carve-out');
-		const prevent = offsetIn(backdrop, 'e.preventDefault();', 'the native-menu suppression');
-		const stop = offsetIn(backdrop, 'e.stopPropagation();', 'the propagation guard');
-
-		// The carve-out returns, so anything that suppresses the native menu has to
-		// come after it or the prompt input loses Cut/Copy/Paste.
-		assert.ok(prevent > carveOut && stop > carveOut, 'the backdrop suppresses the menu before letting text fields out');
-	});
-
-	test('text fields keep the webview edit menu so paste stays reachable', () => {
-		const carveOut = offsetIn(
-			contextMenuHandler,
-			'closest(\'input, textarea, [contenteditable="true"]\')',
-			'the text-field carve-out',
-		);
-		const prevent = offsetIn(contextMenuHandler, 'e.preventDefault();', 'the native-menu suppression');
-
-		assert.ok(prevent > carveOut, 'preventDefault runs before the text-field carve-out, so paste is unreachable');
-	});
-
-	test('a second dialog settles the first instead of orphaning it', async () => {
-		// One `modalState`, one `resolve`. A second `askCustom` used to overwrite the
-		// first caller's resolver, so that caller awaited forever — when it was the
-		// close walk, the window could not be closed again. The component's own
-		// functions run here over a stand-in `modalState`; types erased, nothing else.
-		const lifted = ['askCustom', 'handleModalConfirm'].map((name) => functionSource(viewer, name)).join('\n');
-		const js = ts.transpileModule(
-			`const __component = () => {
-			let modalState = { show: false, resolve: null };
-			${lifted}
-			return { askCustom, handleModalConfirm };
-		};`,
-			{ compilerOptions: { target: ts.ScriptTarget.ES2022 } },
-		).outputText;
-		const component = new Function(`${js}\nreturn __component();`)() as {
-			askCustom: (message: string, options: { title: string; kind: 'warning' }) => Promise<string>;
-			handleModalConfirm: () => void;
-		};
-
-		const first = component.askCustom('first', { title: 'Unsaved', kind: 'warning' });
-		const second = component.askCustom('second', { title: 'Unsaved', kind: 'warning' });
-		component.handleModalConfirm();
-
-		assert.equal(await Promise.race([first, Promise.resolve('never settled')]), 'cancel');
-		assert.equal(await second, 'discard');
-	});
-});
-
-/**
- * #153: "While in Preview Mode - Ctrl+O doesn't work on windows."
- *
- * It works now — the branch is in the document-level dispatcher, which is
- * attached to `<svelte:document>` rather than to the editor, and it carries no
- * editing condition. What it never had is anything holding it there. The comment on
- * the fix cited a test file that does not exist, and grepping the suite for
- * `selectFile` returned nothing, so the report's own scenario was resting on
- * the absence of a guard nobody had written down.
- *
- * That is the failure mode this file exists for: a shortcut that lives in two
- * layers. `Ctrl+T` already went wrong that way (#392) — Monaco answered it
- * inside the editor and the document handler answered it outside, and the two
- * meant different things. Ctrl+O is answered by both layers as well; what
- * makes it correct rather than a second #392 is that both call the same
- * function, and that is what the second test holds.
- *
- * `documentKeymap` fires real chords at the real imported dispatcher with
- * `isEditing: false` — the reporter's preview mode — and reports what each one
- * means.
- */
-describe('open shortcut in preview', () => {
-	const editorSource = readSource(new URL('../src/lib/components/Editor.svelte', import.meta.url));
-	const viewerSource = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-
-	test('the editor claims it too, and both layers do the same thing', () => {
-		// Monaco calls `stopPropagation()` on a keystroke it consumes, so inside
-		// the editor its own `file-open` answers and the document handler never
-		// runs. That is fine — and is the shape #392 got WRONG — only because the
-		// two answers are the same command: `file-open` hands `open-file` to
-		// `oncommand`, and the viewer passes `runViewerCommand` to it, which is
-		// what the document branch calls.
-		for (const platform of PLATFORMS) {
-			const chord = platform.mac ? 'Meta+O' : 'Ctrl+O';
-			const claimed = [...editorKeymap(platform.mac, platform.os)]
-				.filter(([, chords]) => chords.includes(chord))
-				.map(([actionId]) => actionId);
-
-			assert.deepEqual(claimed, ['file-open'], `${platform.name}: ${chord}`);
-		}
-
-		assert.match(editorSource, /id: "file-open",[\s\S]{0,200}?run: \(\) => oncommand\?\.\("open-file"\)/);
-		assert.match(viewerSource, /oncommand=\{runViewerCommand\}/);
-	});
-});
diff --git a/scripts/shortcuts.editor.test.ts b/scripts/shortcuts.editor.test.ts
new file mode 100644
index 00000000..4bb05d30
--- /dev/null
+++ b/scripts/shortcuts.editor.test.ts
@@ -0,0 +1,615 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import { getEditorToolbarTools } from '../src/lib/utils/editorToolbar.js';
+import { t } from '../src/lib/utils/i18n.js';
+import { formatChord, SHORTCUTS } from '../src/lib/utils/shortcuts.js';
+import type { ViewerCommand } from '../src/lib/utils/viewerKeymap.js';
+import { bareCommands, type Chord, chordOf, documentKeymap, editorKeymap, OperatingSystem, PLATFORMS, registeredActions } from './keymapHarness.js';
+
+// The editor half of the shortcut contract: the keymap `utils/editorActions.ts`
+// declares (actions and nameless key commands), run through `keymapHarness.ts`,
+// against the registry the shortcuts panel prints.
+
+describe('shortcut registry', () => {
+	/*
+	 * THE CONTRACT: every chord the shortcuts panel shows is a chord that actually
+	 * fires, and it fires the command the panel says it does.
+	 *
+	 * A test that compared the registry against the panel would be worthless —
+	 * they are the same copy. So every row of `src/lib/utils/shortcuts.ts` is
+	 * checked against the code that implements it, using the same harness
+	 * `shortcuts.checks.test.ts` uses (`./keymapHarness.ts`): the editor's
+	 * actions are registered by really running `registerLocalizedActions`, and the
+	 * document-level chords are discovered by firing synthetic keystrokes at the
+	 * real `handleKeyDown`. Neither is a description of the handlers; both are the
+	 * handlers.
+	 *
+	 * The registry is a CLAIM about behaviour. This file is what stops the claim
+	 * drifting away from the behaviour.
+	 *
+	 * NOT ESTABLISHED HERE: that a running WebView delivers these chords. See the
+	 * note at the top of `keymapHarness.ts` — resolution order, `when` clauses and
+	 * the vim adapter all live in a browser.
+	 */
+	// ------------------------------------------------ registry chord -> Monaco label
+
+	/**
+	 * The key names Monaco's `KeyCodeUtils.toString` prints, where they differ from
+	 * the way the registry spells the key for a human.
+	 */
+	const MONACO_KEY_NAMES: Record<string, string> = {
+		Left: 'LeftArrow',
+		Right: 'RightArrow',
+	};
+
+	/**
+	 * A registry chord as the harness spells the same chord.
+	 *
+	 * The registry is written for a reader (`Mod+Shift+E`); Monaco's decoder emits
+	 * `Shift+Meta+E` on macOS and `Ctrl+Shift+E` elsewhere, in its own modifier
+	 * order. Translating in this direction — registry into harness — rather than
+	 * the other way keeps the registry human-facing, and a mistake here makes
+	 * assertions FAIL rather than pass, because the comparison is against chords
+	 * the real code produced.
+	 */
+	function toMonacoLabel(chord: string, mac: boolean): Chord {
+		return chord
+			.split(' ') // a chord SEQUENCE ("Mod+K T") is two chords
+			.map((single) => {
+				const parts = single.split('+');
+				const key = parts.pop()!;
+				const mods = new Set(parts);
+				const ctrl = mods.has('Ctrl') || (mods.has('Mod') && !mac);
+				// A literal `Meta` stays Meta on every platform, the same way a literal
+				// `Ctrl` does. The registry has no such row — the chords that need this
+				// spelling are the unadvertised ones named in
+				// DOCUMENT_CHORDS_NOT_ADVERTISED, which are written in registry syntax so
+				// the exemption list and the registry read alike.
+				const meta = mods.has('Meta') || (mods.has('Mod') && mac);
+				return [
+					ctrl && 'Ctrl',
+					mods.has('Shift') && 'Shift',
+					mods.has('Alt') && 'Alt',
+					meta && 'Meta',
+					MONACO_KEY_NAMES[key] ?? key,
+				]
+					.filter(Boolean)
+					.join('+');
+			})
+			.join(' ');
+	}
+
+	test('the chord translator agrees with the harness on chords both already know', () => {
+		// If `toMonacoLabel` were broken every assertion below would fail, not pass —
+		// but a silent disagreement about ONE key name would look like a real bug in
+		// the app, so it is pinned against chords the editor layer independently
+		// produces.
+		const mac = editorKeymap(true, OperatingSystem.Macintosh);
+		const win = editorKeymap(false, OperatingSystem.Windows);
+
+		assert.equal(toMonacoLabel('Mod+Shift+E', true), 'Shift+Meta+E');
+		assert.equal(toMonacoLabel('Mod+Shift+E', false), 'Ctrl+Shift+E');
+		assert.equal(toMonacoLabel('Mod+K T', false), 'Ctrl+K T');
+		assert.equal(toMonacoLabel('Ctrl+Tab', true), 'Ctrl+Tab', 'a literal Ctrl stays Ctrl on macOS');
+		assert.equal(toMonacoLabel('Meta+Alt+Left', false), 'Alt+Meta+LeftArrow', 'a literal Meta stays Meta off macOS');
+		assert.equal(toMonacoLabel('Alt+Left', false), 'Alt+LeftArrow');
+
+		assert.deepEqual(mac.get('fmt-inline-code'), ['Shift+Meta+E']);
+		// `Mod+K T` above is still translated correctly; nothing BINDS a sequence any
+		// more, which is the rule asserted further down. Insert Table is the action
+		// that used to hold the two-part chord and is the single stroke `Mod+Alt+T`
+		// now, so this is the row that would have to change if the sequence came back.
+		assert.deepEqual(win.get('insert-table-simple'), ['Ctrl+Alt+T']);
+	});
+
+	// ------------------------------------------------------ the contract itself
+
+	test('every chord the registry advertises is the chord the editor really registers', () => {
+		let checked = 0;
+		for (const platform of PLATFORMS) {
+			const keymap = editorKeymap(platform.mac, platform.os);
+			for (const entry of SHORTCUTS) {
+				if (!entry.editorAction) continue;
+				const registered = keymap.get(entry.id);
+				assert.ok(
+					registered,
+					`${platform.name}: the registry says ${entry.id} has a shortcut, but Editor.svelte registers no keybinding for that action id`,
+				);
+				for (const chord of entry.chords) {
+					const want = toMonacoLabel(chord, platform.mac);
+					assert.ok(
+						registered.includes(want),
+						`${platform.name}: the panel would show ${formatChord(chord, platform.mac ? 'Cmd' : 'Ctrl')} for ${entry.id}, but the editor binds it to ${registered.join(', ')}`,
+					);
+					checked++;
+				}
+			}
+		}
+		assert.ok(checked > 50, `only ${checked} editor chords were checked`);
+	});
+
+	test('a chord with both halves runs the same command in the editor as outside it', () => {
+		// Mod+S inside Monaco called `saveContent` straight, past the clean-file
+		// check `runViewerCommand('save')` makes, so it rewrote a saved file the
+		// menu and the preview left alone. The editor half now hands the command
+		// name to the same switch, so it cannot carry its own copy of a guard.
+		const { actions, calls } = registeredActions(false);
+		let checked = 0;
+		for (const entry of SHORTCUTS) {
+			if (!entry.editorAction || !entry.documentCommands) continue;
+			const action = actions.find((candidate) => candidate.id === entry.id);
+			assert.ok(action, `${entry.id} is registered in the editor`);
+			const before = calls.length;
+			action.run();
+			assert.deepEqual(calls.slice(before), [`oncommand(${JSON.stringify(entry.documentCommands[0])})`], entry.id);
+			checked++;
+		}
+		assert.ok(checked > 10, `only ${checked} editor commands were checked`);
+	});
+
+	test('the editor command palette names the commands the way the panel does', () => {
+		const { actions } = registeredActions(false);
+		for (const id of ['file-reveal', 'view-toggle-edit', 'view-toggle-live']) {
+			const labelKey = SHORTCUTS.find((entry) => entry.id === id)?.labelKey;
+			assert.ok(labelKey, `${id} is in the registry`);
+			assert.equal(actions.find((action) => action.id === id)?.label, t(labelKey, 'en'), `${id} in the palette`);
+		}
+	});
+
+	// -------------------------------------------------- editor bindings vs panel
+
+	/**
+	 * Editor actions that carry a keybinding and are deliberately NOT advertised.
+	 *
+	 * Without this list the registry could quietly fall behind: someone binds a new
+	 * chord, the panel never mentions it, and no test notices. Each exclusion is a
+	 * decision with a reason, in the shape this repo already uses for
+	 * `KNOWN_LAYER_DIVERGENCES`.
+	 */
+	const NOT_ADVERTISED: Record<string, string> = {
+		'custom-copy':
+			'the OS clipboard convention, not an app shortcut; its Ctrl+V twin is a bare addCommand with no id, so listing one without the other is the more confusing half-answer',
+	};
+
+	test('every keybinding the editor registers is either advertised or consciously not', () => {
+		const advertised = new Set(SHORTCUTS.filter((entry) => entry.editorAction).map((entry) => entry.id));
+		const bound = [...editorKeymap(false, OperatingSystem.Windows).keys()];
+		assert.ok(bound.length > 20, `the editor binds ${bound.length} actions`);
+
+		const unexplained = bound.filter((id) => !advertised.has(id) && !(id in NOT_ADVERTISED));
+		assert.deepEqual(
+			unexplained,
+			[],
+			'these editor actions have a keybinding that the shortcuts panel never mentions; ' +
+				'add a row to SHORTCUTS or a reason to NOT_ADVERTISED',
+		);
+
+		// The exclusion list must not rot: a binding that went away has to leave it.
+		for (const id of Object.keys(NOT_ADVERTISED)) {
+			assert.ok(bound.includes(id), `${id} no longer has a keybinding — drop it from NOT_ADVERTISED`);
+		}
+	});
+
+	// ------------------------------------------- every chord is one keystroke
+	//
+	// The rule that replaced the `Mod+K` namespace. Insert Table and Insert Column
+	// used to be `Mod+K T` and `Mod+K C`, and Insert Table had to be registered
+	// TWICE — once released, once with the modifier still held — because "Cmd+K T"
+	// reads as one gesture and `Cmd+K` then `Cmd+T` otherwise fell through to
+	// `file-new`: asking for a table opened a tab. That was the cheaper half of the
+	// problem. The expensive half was that people found the two-key gesture awkward
+	// enough to stop using it, which is what this whole rework came out of.
+	//
+	// So there is no namespace to keep consistent any more, and the invariant worth
+	// holding is the stronger one: nothing the app binds is a sequence at all.
+
+	test('the app binds no chord sequence anywhere, in either keyboard layer', () => {
+		// `Mod+K` is Insert Link now, so a sequence beginning with it could not be
+		// typed even if something declared one — the first key would fire the link.
+		// This is the rule that would catch a new sequence being introduced on some
+		// other prefix, which is the shape the ergonomics complaint was about rather
+		// than anything specific to K.
+		let checked = 0;
+		for (const platform of PLATFORMS) {
+			for (const [id, chords] of editorKeymap(platform.mac, platform.os)) {
+				for (const chord of chords) {
+					assert.ok(
+						!chord.includes(' '),
+						`${platform.name}: ${id} is bound to the sequence ${chord}; every binding here is one keystroke`,
+					);
+					checked++;
+				}
+			}
+			for (const command of bareCommands()) {
+				const chord = chordOf(command.binding, platform.os);
+				assert.ok(!chord.includes(' '), `${platform.name}: ${command.handler} is bound to the sequence ${chord}`);
+				checked++;
+			}
+		}
+		assert.ok(checked > 90, `only ${checked} bindings were checked`);
+
+		// And the registry says the same thing, which is the half a user sees: the
+		// panel cannot advertise a gesture the editor no longer answers.
+		for (const entry of SHORTCUTS) {
+			for (const chord of entry.chords) {
+				assert.ok(!chord.includes(' '), `${entry.id} advertises the sequence ${chord}`);
+			}
+		}
+	});
+
+	test('Mod+K belongs to Insert Link, on every platform', () => {
+		// The decision itself, asserted where a reader will look for it. Typora, Bear,
+		// iA Writer and GitHub all document this chord for Insert Link — four
+		// independent sources agreeing exactly, which no other command in the survey
+		// managed — and the link button carried no shortcut at all before this.
+		for (const platform of PLATFORMS) {
+			const chord = platform.mac ? 'Meta+K' : 'Ctrl+K';
+			assert.deepEqual(editorKeymap(platform.mac, platform.os).get('fmt-link'), [chord], platform.name);
+			assert.equal(
+				SHORTCUTS.find((entry) => entry.id === 'fmt-link')?.chords[0],
+				'Mod+K',
+				'the panel advertises it too',
+			);
+		}
+	});
+
+	/**
+	 * Table verbs that are commands with no key, and the reason each one lost it.
+	 *
+	 * Dropping a CHORD is not dropping a command: `addAction` without `keybindings`
+	 * still puts the verb in the command palette (`Mod+P`, which runs Monaco's
+	 * `editor.action.quickCommand`).
+	 *
+	 * WHAT DECIDES IT IS HOW HARD THE EDIT IS BY HAND, not whether it destroys
+	 * anything. This table used to say the opposite — that destructive table verbs
+	 * get no keys because a mis-fire costs too much — and that rule is gone rather
+	 * than sitting here next to the one the code follows: Delete Column destroys
+	 * more than Delete Row does and has a chord (`Mod+Shift+Backspace`), so the old
+	 * rationale could not have been what was being applied. The hazard it named is
+	 * also gone in fact: the `Mod+K` namespace no longer exists, so no table verb
+	 * sits one slip from Monaco's delete-line (`Mod+Shift+K`) any more.
+	 *
+	 * The four verbs, and what each one is worth a key for:
+	 *
+	 *   Insert Row      Mod+Enter / Mod+Shift+Enter, and Tab at the last cell
+	 *                   — the frequent one, so it gets the cheapest keys there are
+	 *   Insert Column   Mod+Shift+C — mid-frequency, and fiddly by hand
+	 *   Delete Column   Mod+Shift+Backspace — NO manual fallback: it means editing
+	 *                   the pipes on every row without slipping once
+	 *   Delete Row      palette only — trivial by hand. Put the caret on the line,
+	 *                   select it, delete. A chord buys nothing the keyboard does
+	 *                   not already do, and an unearned chord is one more key to
+	 *                   mis-fire.
+	 *
+	 * So the test of a new row here is not "is it dangerous" but "can the user
+	 * already do this without us".
+	 */
+	const TABLE_VERBS_WITHOUT_A_CHORD: Record<string, string> = {
+		'table-insert-row':
+			'Mod+Enter owns it now — inside a table, "insert a line below" already means "insert a row below"',
+		'table-delete-row':
+			'trivial by hand — put the caret on the line, select it, delete — so a chord buys nothing the ' +
+			'keyboard already does. This is the only one of the four with a manual fallback that good, ' +
+			'which is why it is the only one left without a key',
+	};
+
+	test('the table verbs with no chord are still commands, and advertise nothing', () => {
+		const actions = new Map(registeredActions(false).actions.map((action) => [action.id, action]));
+		for (const [id, why] of Object.entries(TABLE_VERBS_WITHOUT_A_CHORD)) {
+			const action = actions.get(id);
+			assert.ok(action, `${id} must stay registered — the key went away, not the command (${why})`);
+			assert.deepEqual(action.keybindings ?? [], [], `${id} has a keybinding again; it was dropped because ${why}`);
+			assert.equal(
+				SHORTCUTS.find((entry) => entry.id === id),
+				undefined,
+				`${id} has no chord, so the panel must not claim one`,
+			);
+		}
+	});
+
+	// ------------------------------------- the contextual keys (the `keys` group)
+	//
+	// Enter, Tab and Shift+Tab are bound with a bare `editor.addCommand`: no action
+	// id, no label, no menu entry. That is right — they are not commands a user
+	// invokes, they are what those keys already mean one Markdown rule further on —
+	// but it also made them INVISIBLE. #636 shipped Enter continuing a list and
+	// nothing in the app said so anywhere; the `keys` group in the registry is that
+	// omission being fixed, and this section is what keeps the fix honest.
+	//
+	// `editorAction` cannot carry these rows, because `editorKeymap` is built from
+	// `addAction` descriptors and a nameless command has none. So the row names the
+	// HANDLER instead, and the handler is looked up in the component's real
+	// `addCommand` calls with the keybinding evaluated by Monaco's own `KeyMod`.
+
+	/**
+	 * Nameless commands the editor binds that are deliberately not advertised.
+	 *
+	 * The two clipboard chords, for the reason `NOT_ADVERTISED` already gives for
+	 * their `custom-copy` twin: they are OS conventions rather than app shortcuts.
+	 * Everything else the editor binds without a name has to be in the panel.
+	 */
+	const BARE_NOT_ADVERTISED: Record<string, string> = {
+		cutToClipboard:
+			'the OS clipboard convention, not an app shortcut; bound only because Monaco leaves cut/paste unbound in a browser',
+		pasteFromClipboard: 'the same, one key over',
+	};
+
+	test('every contextual key the registry advertises is bound to the handler it names', () => {
+		const advertised = SHORTCUTS.filter((entry) => entry.editorCommand);
+		assert.ok(advertised.length >= 3, `${advertised.length} rows name a bare command`);
+
+		for (const platform of PLATFORMS) {
+			const bound = new Map(bareCommands().map((call) => [chordOf(call.binding, platform.os), call.handler]));
+			for (const entry of advertised) {
+				for (const chord of entry.chords) {
+					const want = toMonacoLabel(chord, platform.mac);
+					assert.equal(
+						bound.get(want),
+						entry.editorCommand,
+						`${platform.name}: the panel would show ${formatChord(chord, platform.mac ? 'Cmd' : 'Ctrl')} ` +
+							`for ${entry.id} (${entry.editorCommand}), but that chord is bound to ${bound.get(want) ?? 'nothing'}`,
+					);
+				}
+			}
+		}
+	});
+
+	test('every nameless command the editor binds is advertised, or consciously not', () => {
+		// The completeness direction, which is the one that would have caught #636
+		// shipping unannounced: a new bare binding has to be shown or explained.
+		const advertised = new Set(SHORTCUTS.map((entry) => entry.editorCommand).filter(Boolean));
+		const bound: string[] = bareCommands().map((call) => call.handler);
+
+		const unexplained = bound.filter((handler) => !advertised.has(handler) && !(handler in BARE_NOT_ADVERTISED));
+		assert.deepEqual(
+			unexplained,
+			[],
+			'these keys do something extra in the editor and the shortcuts panel never mentions it; ' +
+				'add a row to SHORTCUTS (group `keys`) or a reason to BARE_NOT_ADVERTISED',
+		);
+
+		for (const handler of Object.keys(BARE_NOT_ADVERTISED)) {
+			assert.ok(bound.includes(handler), `${handler} is no longer bound — drop it from BARE_NOT_ADVERTISED`);
+		}
+	});
+});
+
+describe('formatting shortcuts keymap', () => {
+	/*
+	 * Issues #121 (six formatting commands with no shortcut) and #392 (Ctrl+T means
+	 * two things). Both needed the same thing first — the whole keymap — so they are
+	 * held by one file.
+	 *
+	 * The machinery that RUNS the two keyboard layers now lives in
+	 * `./keymapHarness.ts`, because the shortcut-registry contract needs the same
+	 * two functions and must not be checked against a second, more forgiving model
+	 * of the app. What each harness does and does not establish is documented there.
+	 */
+
+	// ------------------------------------------------------------------ item #121
+
+	/**
+	 * The six bindings this change adds, and the chord each must resolve to.
+	 *
+	 * `CtrlCmd` resolves to Meta on macOS and Ctrl everywhere else, so each row is
+	 * checked against Monaco's decoder once per platform rather than assumed.
+	 */
+	const NEW_BINDINGS: ReadonlyArray<[actionId: string, mac: Chord, other: Chord, toolbarLabel: string]> = [
+		['fmt-heading-1', 'Meta+1', 'Ctrl+1', '+1'],
+		['fmt-heading-2', 'Meta+2', 'Ctrl+2', '+2'],
+		['fmt-heading-3', 'Meta+3', 'Ctrl+3', '+3'],
+		['fmt-inline-code', 'Shift+Meta+E', 'Ctrl+Shift+E', '+Shift+E'],
+		['fmt-code-block', 'Shift+Meta+F', 'Ctrl+Shift+F', '+Shift+F'],
+		['fmt-quote', 'Shift+Meta+.', 'Ctrl+Shift+.', '+Shift+.'],
+	];
+
+	test('each formatting action asked for in #121 now carries its shortcut', () => {
+		for (const platform of PLATFORMS) {
+			const keymap = editorKeymap(platform.mac, platform.os);
+			for (const [id, mac, other] of NEW_BINDINGS) {
+				assert.deepEqual(
+					keymap.get(id),
+					[platform.mac ? mac : other],
+					`${id} on ${platform.name}`,
+				);
+			}
+		}
+	});
+
+	test('each new shortcut runs the command it is labelled with', () => {
+		// The binding and the body are two separate fields of one object literal,
+		// and nothing in the type system stops `fmt-heading-2` from carrying
+		// heading 3's `run`. Each action is invoked and the call it makes recorded.
+		const expected: Record<string, string> = {
+			'fmt-heading-1': 'toggleLineMarkerTool("fmt-heading-1")',
+			'fmt-heading-2': 'toggleLineMarkerTool("fmt-heading-2")',
+			'fmt-heading-3': 'toggleLineMarkerTool("fmt-heading-3")',
+			'fmt-quote': 'toggleLineMarkerTool("fmt-quote")',
+			'fmt-inline-code': 'toggleInlineWrapTool("fmt-inline-code")',
+			'fmt-code-block': 'wrapAsCodeBlock',
+		};
+
+		const { actions, calls } = registeredActions(false);
+		for (const [id, want] of Object.entries(expected)) {
+			const action = actions.find((a) => a.id === id);
+			assert.ok(action, `${id} is registered`);
+			const before = calls.length;
+			action.run();
+			assert.deepEqual(calls.slice(before), [want], `${id} runs ${want}`);
+		}
+	});
+
+	test('the toolbar tooltip prints the shortcut the editor actually registered', () => {
+		// Two copies of one fact: Editor.svelte binds the key, editorToolbar.ts
+		// renders the hint on the button. Bold, Italic and Underline already had
+		// both and nothing held them together.
+		const byId = new Map(getEditorToolbarTools(null).map((tool) => [tool.id, tool]));
+		const bound = editorKeymap(false, OperatingSystem.Windows);
+
+		for (const [id, tool] of byId) {
+			const chords = bound.get(id);
+			if (!chords) {
+				assert.equal(tool.shortcut, undefined, `${id} has no keybinding, so the toolbar must not advertise one`);
+				continue;
+			}
+			assert.ok(tool.shortcut, `${id} is bound to ${chords.join(' ')} but the toolbar shows nothing`);
+			// "Ctrl+Shift+E" -> "Ctrl+Shift+E"; a chord sequence "Ctrl+K T" -> "Ctrl+K T".
+			assert.equal(
+				tool.shortcut('Ctrl'),
+				chords[0].replace(/\bMeta\b/g, 'Ctrl'),
+				`${id}: toolbar hint and registered keybinding disagree`,
+			);
+			// Both renderings come from the same registry row through `formatChord`, so
+			// they name the same key and the same number of modifiers — but NOT the same
+			// WORDS: `Alt` is `Opt` on macOS (#651). Asserting a string substitution here
+			// would be a second copy of that word map, which is the defect #651 removed;
+			// `shortcuts.test.ts` owns the per-platform naming and this only has to
+			// prove the two renderings are still the same chord.
+			const asCmd = tool.shortcut('Cmd').split('+');
+			const asCtrl = tool.shortcut('Ctrl').split('+');
+			assert.equal(asCmd.length, asCtrl.length, `${id}: the two renderings are not the same chord`);
+			assert.equal(asCmd.at(-1), asCtrl.at(-1), `${id}: the two renderings end on different keys`);
+		}
+
+		// The rows this change adds, spelled out, so that deleting one of them from
+		// editorToolbar.ts fails here rather than passing the loop above vacuously.
+		for (const [id, , , suffix] of NEW_BINDINGS) {
+			assert.equal(byId.get(id)?.shortcut?.('Cmd'), `Cmd${suffix}`, `${id} toolbar hint`);
+		}
+	});
+
+	// ------------------------------------------------------------------ item #392
+
+	const NEW_FILE_CHORDS = { mac: ['Meta+N', 'Meta+T'], other: ['Ctrl+N', 'Ctrl+T'] };
+
+	test('Ctrl/Cmd+T means new file in the editor, on every platform', () => {
+		for (const platform of PLATFORMS) {
+			const chords = editorKeymap(platform.mac, platform.os).get('file-new');
+			assert.deepEqual(
+				chords,
+				platform.mac ? NEW_FILE_CHORDS.mac : NEW_FILE_CHORDS.other,
+				`file-new on ${platform.name}`,
+			);
+		}
+
+		// `oncommand` is bound to `runViewerCommand`, the switch the document-level
+		// branch reaches too, so both halves run the same `new-file`.
+		const probe = registeredActions(false);
+		const fileNew = probe.actions.find((action) => action.id === 'file-new');
+		assert.ok(fileNew, 'file-new is registered');
+		const before = probe.calls.length;
+		fileNew.run();
+		assert.deepEqual(probe.calls.slice(before), ['oncommand("new-file")'], 'file-new runs the new-file command');
+	});
+
+	// ---------------------------------------------------------- the whole keymap
+
+	test('no two editor actions claim the same chord', () => {
+		for (const platform of PLATFORMS) {
+			const owners = new Map<Chord, string[]>();
+			for (const [id, chords] of editorKeymap(platform.mac, platform.os)) {
+				for (const chord of chords) owners.set(chord, [...(owners.get(chord) ?? []), id]);
+			}
+			for (const [chord, ids] of owners) {
+				assert.equal(ids.length, 1, `${platform.name}: ${chord} is claimed by ${ids.join(' and ')}`);
+			}
+		}
+	});
+
+	/**
+	 * Chords the two layers answer differently, on purpose or not.
+	 *
+	 * A chord that both Monaco and the document handler answer must mean the same
+	 * thing in both, or it means two things depending on focus — which is exactly
+	 * what #392 reported. Everything left here is a divergence that predates this
+	 * change; each is named so that a NEW one fails instead of joining a silent
+	 * pile.
+	 */
+	const KNOWN_LAYER_DIVERGENCES: Record<Chord, string> = {
+		// Monaco binds real Ctrl+Tab on macOS because Cmd+Tab is the system app
+		// switcher (see editor.checks.test.ts); the document handler accepts
+		// either modifier. Same action, different chord — not a meaning conflict.
+		'Ctrl+Tab': 'tab cycling: Monaco uses WinCtrl on macOS, the window handler accepts Ctrl or Cmd',
+		'Ctrl+Shift+Tab': 'tab cycling, as above',
+		'Meta+Tab': 'tab cycling, as above',
+		'Shift+Meta+Tab': 'tab cycling, as above',
+	};
+
+	test('a chord that both layers answer means the same thing in both', () => {
+		// The pairs the app deliberately mirrors: the editor action and the
+		// window-level branch that stands in for it when the caret is elsewhere.
+		const MIRROR: Record<string, ViewerCommand> = {
+			'file-new': 'new-file',
+			'file-open': 'open-file',
+			'file-save': 'save',
+			'file-close': 'close-file',
+			'view-toggle-edit': 'toggle-edit-view',
+			'view-toggle-split': 'toggle-split-view',
+			'tab-undo-close': 'undo-close-tab',
+		};
+
+		for (const platform of PLATFORMS) {
+			const editorSide = editorKeymap(platform.mac, platform.os);
+			const documentSide = documentKeymap(platform.osType);
+
+			for (const [id, expectedCommand] of Object.entries(MIRROR)) {
+				const chords = editorSide.get(id);
+				assert.ok(chords?.length, `${id} is bound in the editor on ${platform.name}`);
+				for (const chord of chords) {
+					if (chord in KNOWN_LAYER_DIVERGENCES) continue;
+					assert.ok(documentSide.has(chord), `${platform.name}: ${chord} runs ${id} in the editor but nothing outside it`);
+					assert.equal(
+						documentSide.get(chord),
+						expectedCommand,
+						`${platform.name}: ${chord} runs ${id} in the editor but ${documentSide.get(chord)} outside it`,
+					);
+				}
+			}
+		}
+	});
+});
+
+/**
+ * #153: "While in Preview Mode - Ctrl+O doesn't work on windows."
+ *
+ * It works now — the branch is in the document-level dispatcher, which is
+ * attached to `<svelte:document>` rather than to the editor, and it carries no
+ * editing condition. What it never had is anything holding it there. The comment on
+ * the fix cited a test file that does not exist, and grepping the suite for
+ * `selectFile` returned nothing, so the report's own scenario was resting on
+ * the absence of a guard nobody had written down.
+ *
+ * That is the failure mode this file exists for: a shortcut that lives in two
+ * layers. `Ctrl+T` already went wrong that way (#392) — Monaco answered it
+ * inside the editor and the document handler answered it outside, and the two
+ * meant different things. Ctrl+O is answered by both layers as well; what
+ * makes it correct rather than a second #392 is that both call the same
+ * function, and that is what the second test holds.
+ *
+ * `documentKeymap` fires real chords at the real imported dispatcher with
+ * `isEditing: false` — the reporter's preview mode — and reports what each one
+ * means.
+ */
+describe('open shortcut in preview', () => {
+	test('the editor claims it too, and both layers do the same thing', () => {
+		// Monaco calls `stopPropagation()` on a keystroke it consumes, so inside
+		// the editor its own `file-open` answers and the document handler never
+		// runs. That is fine — and is the shape #392 got WRONG — only because the
+		// two answers are the same command: `file-open` hands `open-file` to
+		// `oncommand`, and the viewer passes `runViewerCommand` to it, which is
+		// what the document branch calls.
+		for (const platform of PLATFORMS) {
+			const chord = platform.mac ? 'Meta+O' : 'Ctrl+O';
+			const claimed = [...editorKeymap(platform.mac, platform.os)]
+				.filter(([, chords]) => chords.includes(chord))
+				.map(([actionId]) => actionId);
+
+			assert.deepEqual(claimed, ['file-open'], `${platform.name}: ${chord}`);
+		}
+
+		const { actions, calls } = registeredActions(false);
+		actions.find((action) => action.id === 'file-open')?.run();
+		assert.deepEqual(calls, ['oncommand("open-file")'], 'file-open hands open-file to oncommand');
+	});
+});
diff --git a/scripts/shortcuts.spec.ts b/scripts/shortcuts.spec.ts
index a52d0fa2..40307fac 100644
--- a/scripts/shortcuts.spec.ts
+++ b/scripts/shortcuts.spec.ts
@@ -3,8 +3,11 @@ import assert from 'node:assert/strict';
 import { flushSync } from 'svelte';
 import { beforeAll, describe, onTestFinished, test } from 'vitest';
 
+import { handleModalBackdropContextMenu } from '../src/lib/utils/modalContextMenu.js';
 import { canUsePreviewWidthShortcut, type KeyContext, type KeyStroke, type ViewerCommand, viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
 import { PLATFORMS } from './keymapHarness.js';
+import { ChoiceDialog } from '../src/lib/utils/choiceDialog.svelte.js';
+import { contextMenuFor } from '../src/lib/utils/viewerContextMenu.js';
 
 describe('viewer keymap', () => {
 	/*
@@ -435,3 +438,73 @@ describe('os type fallback', async () => {
 		assert.equal(store.editorFont, DEFAULT_FONTS.macos.editorFont);
 	});
 });
+
+describe('modal backdrop', () => {
+	test('modal backdrop consumes context-menu events outside text fields', () => {
+		const backdrop = document.createElement('div');
+		backdrop.innerHTML = '<div class="modal-content"><p>Rename</p><input /><textarea></textarea></div>';
+		document.body.append(backdrop);
+		onTestFinished(() => backdrop.remove());
+		backdrop.addEventListener('contextmenu', handleModalBackdropContextMenu);
+		let reachedDocument = 0;
+		const count = () => reachedDocument++;
+		document.addEventListener('contextmenu', count);
+		onTestFinished(() => document.removeEventListener('contextmenu', count));
+
+		const rightClick = (target: Element) => {
+			const event = new MouseEvent('contextmenu', { bubbles: true, cancelable: true });
+			target.dispatchEvent(event);
+			return event.defaultPrevented;
+		};
+
+		// No native menu over the dialog, and the app's own menus never hear it.
+		assert.equal(rightClick(backdrop.querySelector('p')!), true);
+		assert.equal(rightClick(backdrop), true);
+		assert.equal(reachedDocument, 0);
+
+		// The prompt input keeps the webview's Cut/Copy/Paste.
+		assert.equal(rightClick(backdrop.querySelector('input')!), false);
+		assert.equal(rightClick(backdrop.querySelector('textarea')!), false);
+		assert.equal(reachedDocument, 2);
+	});
+});
+
+describe('choice dialog', () => {
+	test('a second dialog settles the first instead of orphaning it', async () => {
+		// One dialog, one resolver. A second question used to overwrite the first
+		// caller's resolver, so that caller awaited forever — when it was the close
+		// walk, the window could not be closed again.
+		const dialog = new ChoiceDialog();
+		const first = dialog.ask('first', { title: 'Unsaved', kind: 'warning' });
+		const second = dialog.ask('second', { title: 'Unsaved', kind: 'warning' });
+		assert.equal(dialog.message, 'second');
+		dialog.close('discard');
+
+		assert.equal(await Promise.race([first, Promise.resolve('never settled')]), 'cancel');
+		assert.equal(await second, 'discard');
+		assert.equal(dialog.show, false);
+	});
+});
+
+describe('document context menu routing', () => {
+	function inside(html: string, selector: string) {
+		const root = document.createElement('div');
+		root.innerHTML = html;
+		return root.querySelector(selector)!;
+	}
+
+	test('document context menus do not open while a modal is active', () => {
+		// Every case answers 'none' with a dialog up, the editor's included.
+		for (const target of [inside('<p>text</p>', 'p'), inside('<div class="editor-container"><textarea></textarea></div>', 'textarea')]) {
+			assert.equal(contextMenuFor(target, { modalOpen: true, inApp: true }), 'none');
+		}
+		assert.equal(contextMenuFor(inside('<p>text</p>', 'p'), { modalOpen: false, inApp: true }), 'document');
+	});
+
+	test('text fields keep the webview edit menu so paste stays reachable', () => {
+		for (const html of ['<input>', '<textarea></textarea>', '<div contenteditable="true"><span>x</span></div>']) {
+			const target = inside(html, 'input, textarea, span');
+			assert.equal(contextMenuFor(target, { modalOpen: false, inApp: true }), 'native', html);
+		}
+	});
+});
diff --git a/scripts/shortcuts.test.ts b/scripts/shortcuts.test.ts
index 8a374031..dc9d74a6 100644
--- a/scripts/shortcuts.test.ts
+++ b/scripts/shortcuts.test.ts
@@ -8,8 +8,9 @@ import { getSupportedLanguages, type LanguageCode, t, type Translation } from '.
 import { formatChord, modifierFor, SHORTCUT_GROUPS, type ShortcutEntry, shortcutLabel, SHORTCUTS, shortcutSections } from '../src/lib/utils/shortcuts.js';
 import type { ViewMode } from '../src/lib/utils/titlebarToolbar.js';
 import type { ViewerCommand } from '../src/lib/utils/viewerKeymap.js';
+import { tabListMenuItems, tabMenuItems } from '../src/lib/utils/tabContextMenu.js';
 import { translations } from './allTranslations.js';
-import { type Chord, documentKeymap, PLATFORMS } from './keymapHarness.js';
+import { type Chord, documentKeymap, PLATFORMS, viewerCommandCalls } from './keymapHarness.js';
 
 describe('shortcut registry', () => {
 	/*
@@ -922,3 +923,67 @@ describe('open shortcut in preview', () => {
 		}
 	});
 });
+
+describe('tab context menus', () => {
+	test('the tab context menus print the modifier the user is on, not a hard-coded Ctrl', () => {
+		const emit = () => {};
+		const menus = (osType: string) => ({
+			tab: tabMenuItems({
+				tab: { id: 'tab-1', path: '/notes/a.md' },
+				language: 'en',
+				osType,
+				tabCount: 2,
+				fileActionItems: [],
+				moveToWindowItems: [],
+				emit,
+			}),
+			strip: tabListMenuItems('en', osType, emit),
+		});
+		const shown = (items: { label?: string; shortcut?: string }[]) =>
+			items.filter((item) => item.shortcut).map((item) => [item.label, item.shortcut]);
+
+		for (const [osType, mod] of [['macos', 'Cmd'], ['windows', 'Ctrl'], ['linux', 'Ctrl']] as const) {
+			const { tab, strip } = menus(osType);
+			// Every chord comes from shortcutLabel(), so it agrees with the app menu.
+			assert.deepEqual(shown(tab), [
+				[t('menu.newFile', 'en'), `${mod}+T`],
+				[t('menu.undoCloseTab', 'en'), `${mod}+Shift+T`],
+				[t('menu.closeFile', 'en'), `${mod}+W`],
+			]);
+			assert.deepEqual(shown(strip), [
+				[t('menu.newFile', 'en'), `${mod}+T`],
+				[t('menu.undoCloseTab', 'en'), `${mod}+Shift+T`],
+			]);
+		}
+	});
+});
+
+describe('viewer command table', () => {
+	// `viewerCommandCalls` runs the real table against a recording host; see its
+	// note in `keymapHarness.ts`.
+	const calls = viewerCommandCalls();
+
+	test('Ctrl+Q quits the way the menu’s Exit does, not by closing one window', () => {
+		// The menu prints Ctrl+Q beside Exit, and Exit runs `appExit`, which closes
+		// every window. The chord used to run `getCurrentWindow().close()`, so with
+		// two windows open it closed one and left the app running.
+		assert.deepEqual(calls['app-exit'], ['appExit']);
+	});
+
+	test('every command the dispatcher can name is one the component can run', () => {
+		// The table is a `Record` over the union, so the compiler rejects a missing
+		// entry; this rejects an entry that does nothing.
+		const commands = Object.keys(calls) as ViewerCommand[];
+		assert.ok(commands.length >= 10, `only ${commands.length} commands were reached; the sweep is not running`);
+		for (const command of commands) assert.notDeepEqual(calls[command], [], `${command} does nothing`);
+	});
+
+	test('no path anywhere still opens a Home tab from a keystroke', () => {
+		// The #392 defect in its original spelling: the document branch for Ctrl+T
+		// called `tabManager.addHomeTab`. There is no `ViewerCommand` for that any
+		// more, so the checkable end is the other one: no command the keyboard
+		// reaches touches `addHomeTab`.
+		const routes = Object.entries(calls).filter(([, names]) => names.some((name) => name.endsWith('addHomeTab')));
+		assert.deepEqual(routes.map(([command]) => command), [], 'a keyboard command still reaches addHomeTab');
+	});
+});
diff --git a/scripts/shortcuts.titleBarMenus.spec.ts b/scripts/shortcuts.titleBarMenus.spec.ts
new file mode 100644
index 00000000..cff5e9c3
--- /dev/null
+++ b/scripts/shortcuts.titleBarMenus.spec.ts
@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+
+import { flushSync } from 'svelte';
+import { onTestFinished, test } from 'vitest';
+
+// The popover module imports the stores, so the Tauri bridge is stubbed first.
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+	transformCallback: (fn: unknown) => fn,
+};
+
+const { TitleBarPopovers } = await import('../src/lib/stores/titleBarPopovers.svelte.js');
+const { runeEffect } = await import('./runeEffect.svelte.js');
+
+test('titlebar menus close before a document context menu opens', () => {
+	// A right-click in the document, or the window losing focus, must not leave a
+	// Home, theme or kebab menu drawn over the context menu that opens next.
+	for (const type of ['contextmenu', 'blur']) {
+		const target = new EventTarget();
+		const bar = new TitleBarPopovers();
+		onTestFinished(runeEffect(() => bar.listenForDismiss(target)));
+		for (const menu of ['homeMenuOpen', 'themeMenuOpen', 'kebabMenuOpen'] as const) {
+			bar[menu] = true;
+			flushSync();
+
+			target.dispatchEvent(new Event(type));
+			flushSync();
+
+			assert.equal(bar[menu], false, `\`${type}\` left the ${menu.replace('Open', '')} open`);
+		}
+	}
+});
+
+test('TitleBar decides the platform from settings.osType, not from the user agent', async () => {
+	// The component used to hold `navigator.userAgent.includes('Macintosh')` and
+	// derive its chrome, its `native-mac` class and its menu modifier from it.
+	const { settings } = await import('../src/lib/stores/settings.svelte.js');
+	const { TitleBarPlatform } = await import('../src/lib/stores/titleBarPlatform.svelte.js');
+	const navigatorPlatform = Object.getOwnPropertyDescriptor(Navigator.prototype, 'platform');
+	const osType = settings.osType;
+	Object.defineProperty(navigator, 'platform', { value: 'MacIntel', configurable: true });
+	onTestFinished(() => {
+		delete (navigator as any).platform;
+		if (navigatorPlatform) Object.defineProperty(Navigator.prototype, 'platform', navigatorPlatform);
+		settings.osType = osType;
+	});
+
+	const chrome = new TitleBarPlatform();
+	// The browser says Mac; the backend's answer wins once it is in.
+	settings.osType = 'windows';
+	assert.equal(chrome.isMac, false);
+	assert.equal(chrome.modifier, 'Ctrl');
+
+	// And it stays reactive: `osType` resolves once, after mount.
+	settings.osType = 'macos';
+	assert.equal(chrome.isMac, true);
+	assert.equal(chrome.modifier, 'Cmd');
+
+	// Before the backend answers, the browser hint covers the gap.
+	settings.osType = 'unknown';
+	assert.equal(chrome.isMac, true);
+});
diff --git a/scripts/sourceTree.ts b/scripts/sourceTree.ts
index cc61b635..15acce7f 100644
--- a/scripts/sourceTree.ts
+++ b/scripts/sourceTree.ts
@@ -194,9 +194,9 @@ export const SANITIZER_FILES = ['src/lib/utils/richContent.ts', 'src/lib/utils/s
 //
 // The three helpers below answer questions about *scope* — "which function is
 // this offset inside", "what is the body of this callback" — from the real AST.
-// `svelte/compiler` is already a dependency and `windows.checks.spec.ts` already
-// parses a component with it, and a function node is a function node whatever
-// the spelling. The cost is ~170ms for the largest component, paid once per
+// `svelte/compiler` is already a dependency, it parses a component's script as
+// well as a plain module, and a function node is a function node whatever the
+// spelling. The cost is ~170ms for the largest component, paid once per
 // file thanks to the cache below.
 
 type FunctionScope = { start: number; end: number; name: string | null };
diff --git a/scripts/tabs.checks.test.ts b/scripts/tabs.checks.test.ts
index e13d2f14..62c550ec 100644
--- a/scripts/tabs.checks.test.ts
+++ b/scripts/tabs.checks.test.ts
@@ -4,35 +4,9 @@ import { describe, test } from 'node:test';
 import {
 	readSource,
 	sliceBetween,
-	sliceFrom,
-	offsetOf,
 } from './sourceTree.js';
 
 describe('cross-window tab transfer wiring', () => {
-	// insertTransferredTab lives in the Svelte store ($state rune, not loadable
-	// in node), so — like windows.checks.test.ts — the thin store wrapper is
-	// checked statically; all decision logic above is exercised directly.
-	test('insertTransferredTab is a thin wrapper: build, push, activate, return the id', () => {
-		const tabs = readSource('src/lib/stores/tabs.svelte.ts');
-		const fn = sliceBetween(tabs, 'insertTransferredTab(', 'closeTab(');
-
-		assert.match(fn, /buildTransferredTab\(/);
-		// untitled re-numbering uses this window's titles and localized base
-		assert.match(fn, /this\.tabs\.map\(\(tab\) => tab\.title\)/);
-		assert.match(fn, /t\('tabs\.untitled', settings\.language\)/);
-		// the new tab is pushed, activated, and its id returned
-		assert.match(fn, /this\.tabs\.push\(tab\);/);
-		assert.match(fn, /this\.activeTabId = tab\.id;/);
-		assert.match(fn, /return tab\.id;/);
-	});
-
-	test('serializeState still persists window shape only (untouched by transfer)', () => {
-		const tabs = readSource('src/lib/stores/tabs.svelte.ts');
-		const fn = sliceBetween(tabs, 'serializeState(extra', 'restoreState(');
-		assert.doesNotMatch(fn, /rawContent/);
-		assert.doesNotMatch(fn, /TransferableTab/);
-	});
-
 	test('source removal waits for destination completion', () => {
 		const broker = readSource('src-tauri/src/tab_transfer.rs');
 		const session = readSource('src/lib/sessions/windowSession.svelte.ts');
@@ -44,134 +18,26 @@ describe('cross-window tab transfer wiring', () => {
 	});
 });
 
-describe('tab transfer handoff', () => {
-	const session = readSource(new URL('../src/lib/sessions/windowSession.svelte.ts', import.meta.url));
-	const viewer = readSource(new URL('../src/lib/MarkdownViewer.svelte', import.meta.url));
-	const broker = readSource(new URL('../src-tauri/src/tab_transfer.rs', import.meta.url));
-
-	// A tab transfer is only ever allowed to end in one of two states: the source
-	// still has the tab, or the destination does. Every defect below produced the
-	// third state -- present in both windows, each with its own auto-save timer
-	// writing over the other.
-
-	test('the source keeps waiting when the destination has already claimed', () => {
-		// The 15s timeout is a guess about a window that may simply be slow to
-		// render. Cancelling regardless is what stranded a copy on each side.
-		const cancel = sliceFrom(session, 'const cancel = async ()');
-		assert.match(cancel, /outcome\.cancelled/);
-		assert.match(cancel, /outcome\.claimed/);
-		assert.match(cancel, /if \(!outcome\.cancelled && outcome\.claimed\) \{\s*\n\s*setTimeout\(cancel, 15_000\);\s*\n\s*return;/);
-	});
-
-	test('the destination releases its claim when it cannot finish', () => {
-		// Because a claimed transfer is immune to the source's timeout, the
-		// destination is the only party that can end a claim it cannot complete.
-		assert.match(session, /async function releaseClaim\(token: string\)/);
-		const accept = sliceBetween(session, 'async function acceptOfferedTransfer', 'async function claimTransferredTab');
-		// Invalid payload, a refusing destination, and a thrown render all release.
-		assert.equal((accept.match(/releaseClaim\(token\)/g) ?? []).length, 3);
-		assert.match(accept, /if \(claimed\) await releaseClaim\(token\);/);
-	});
-
-	test('a claim is distinguished from "no such token"', () => {
-		// Releasing a token that was never claimed would be a no-op at best and a
-		// cancel of someone else's transfer at worst.
-		const accept = sliceBetween(session, 'async function acceptOfferedTransfer', 'async function claimTransferredTab');
-		assert.match(accept, /if \(payload === null\)/);
-		assert.match(accept, /claimed = true;/);
-	});
-
-	test('a failed render undoes the inserted tab', () => {
-		// The tab must exist before it can be rendered, so the destination owns a
-		// document the source still shows until the render succeeds.
-		const accept = sliceBetween(viewer, 'acceptTransferredTab: async (snapshot)', 'onError: (message, error)');
-		assert.match(accept, /\} catch \(error\) \{\s*\n\s*tabManager\.closeTab\(id\);\s*\n\s*throw error;/);
-		assert.match(accept, /if \(isDisposed\) \{\s*\n\s*tabManager\.closeTab\(id\);/);
-	});
-
-	test('the arriving tab is put back where its reader was, after its document lands', () => {
-		// The position travels in the payload (tabTransfer.ts) and nothing put it
-		// back. `insertTransferredTab` activates the tab synchronously, while its
-		// rendered `content` is still `''`, so the preview's restore effect runs on
-		// that activation against a host holding no document: no block owns the
-		// anchor line, there is no scroll range for the percentage, and the pixel
-		// offset has nowhere to go. The document arrives afterwards, at the top.
-		//
-		// The effect cannot cover this by depending on the render. It also runs
-		// while the reader is typing — split view and edit-with-outline re-render on
-		// a debounce — and a per-render dependency would drag the preview back to
-		// the saved position on every pause in typing. So the arrival asks again
-		// itself, once `renderTabPreviewFromRaw` has awaited the patch.
-		//
-		// Ordering is the whole assertion, which is why it is a source assertion:
-		// what goes wrong is WHEN the restore is called, and the two moments are one
-		// `await` apart inside a Svelte component.
-		const accept = sliceBetween(viewer, 'acceptTransferredTab: async (snapshot)', 'onError: (message, error)');
-		const rendered = accept.indexOf('await renderTabPreviewFromRaw(transferred);');
-		const restored = accept.indexOf('restorePreviewReadingPosition(');
-		assert.ok(rendered !== -1, 'the arrival must render the document it was handed');
-		assert.ok(restored > rendered, 'the restore must run after the render, not before it');
-		// Only the active tab's host is displayed, and they all share one scrolling
-		// article: restoring for a tab the user has since switched away from would
-		// move whichever document is on screen instead.
-		assert.match(accept, /tabManager\.activeTabId === id/);
-	});
-
-	test('a second transfer of the same tab is refused while one is in flight', () => {
-		// The menu entry becomes clickable again long before the transfer
-		// resolves; two payloads for one tab means two windows each build it.
-		assert.match(session, /const transfersInFlight = new Set<string>\(\);/);
-		assert.match(session, /if \(transfersInFlight\.has\(tabId\)\) return false;/);
-		assert.match(session, /\} finally \{\s*\n\s*transfersInFlight\.delete\(tabId\);/);
-	});
-
-	test('the broker binds every operation to the window that may perform it', () => {
-		// Tokens used to be t1..t16, and any webview could read or destroy any
-		// staged transfer -- including the document text of a drag in progress.
-		assert.match(broker, /fn is_destination_label/);
-		assert.match(broker, /enum CancelAuthority/);
-		assert.doesNotMatch(broker, /format!\("t\{\}"/);
-	});
-
-	test('eviction never drops a transfer that is mid-handoff', () => {
-		assert.match(broker, /fn eviction_victim/);
-		assert.match(broker, /claimed_at/);
-	});
-});
-
 describe('tab switch is not a render', () => {
 	/**
 	 * The switch-time transition suppression is a contract between two files, and
 	 * both halves fail silently on their own.
 	 *
-	 * The viewer adds a class to `.layout-container`, forces a style recalculation
-	 * so the new pane geometry commits while transitions are off, and removes it —
-	 * in one statement, before the first paint of the switch. The rule that makes
-	 * the class mean anything lives in `styles.css`.
+	 * The viewer calls `commitWithoutTransitions` (utils/motion.ts), which adds a
+	 * class to `.layout-container`, forces a style recalculation and removes it;
+	 * `tabs.test.ts` runs that half. The rule that makes the class mean anything
+	 * lives in `styles.css`, and jsdom has no style recalculation to observe it in.
 	 *
-	 * Neither half can be a behaviour test: the ordering being asserted is
-	 * "the class is on the element during the browser's style recalculation", and
-	 * jsdom has no style recalculation to be inside of.
-	 *
-	 * The interesting failure is the third assertion. Svelte deletes scoped
+	 * The interesting failure is the last assertion. Svelte deletes scoped
 	 * selectors it cannot see applied in the markup, and this class is applied
 	 * through `classList` — so moving these rules into the component's `<style>`
 	 * block, which is where they look like they belong, compiles them away and
 	 * restores every animation with nothing going red.
 	 */
-	test('a tab switch commits the new pane geometry with transitions off', () => {
+	test('styles.css switches transitions off under .tab-switching', () => {
 		const viewer = readSource('src/lib/MarkdownViewer.svelte');
 		const styles = readSource('src/styles.css');
 
-		// The viewer's half: add, force the recalculation, remove. The forced read
-		// between the two is the mechanism, not a formality — without it the class
-		// is added and removed within one style computation and suppresses nothing.
-		assert.match(
-			viewer,
-			/classList\.add\('tab-switching'\);\s*void [\w.]+\.offsetHeight;\s*[\w.]+\.classList\.remove\('tab-switching'\);/,
-			'the viewer must add the class, force a style recalculation, and remove it in one statement',
-		);
-
 		// The stylesheet's half, and that it reaches the outline wrapper, whose
 		// shadow follows the tab's mode.
 		const rule = styles.match(/([^}]*\.layout-container\.tab-switching[^{]*)\{([^}]*)\}/);
@@ -188,134 +54,18 @@ describe('tab switch is not a render', () => {
 			'the rule must stay in styles.css: a scoped selector for an imperatively added class is compiled away',
 		);
 	});
-
-	/**
-	 * The preview DOM belongs to the tab, not to the viewer.
-	 *
-	 * A single `.markdown-blocks` for every tab is what made a switch the worst
-	 * case `blockPatch.ts` has: two documents share no block keys, so the diff
-	 * replaced essentially every node, `renderRichContent` ran over the whole
-	 * document again, every fold re-measured, and the reading position was then
-	 * restored against a layout that was still settling.
-	 *
-	 * `tabs.spec.ts` runs the mechanism that makes the switch
-	 * free — re-patching a host that already holds that document changes nothing —
-	 * but it supplies its own two hosts, so it stays green against a viewer that
-	 * has gone back to sharing one. This is the half that does not: the host must
-	 * be minted inside a keyed `{#each}` over the tabs, which is also what makes
-	 * Svelte destroy it with its tab and keeps the set of hosts from drifting from
-	 * the set of tabs the way a hand-kept registry can.
-	 */
-	test('the preview holds one document host per tab, not one for all of them', () => {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-		const each = viewer.match(
-			/\{#each tabManager\.tabs as tab \(tab\.id\)\}([\s\S]*?)\{\/each\}/g,
-		);
-		assert.ok(each, 'the viewer must render per-tab preview hosts from a keyed each over the tabs');
-
-		const hostBlock = each.find((block) => block.includes('markdown-blocks'));
-		assert.ok(
-			hostBlock,
-			'.markdown-blocks must be minted per tab — one shared host makes every switch a full rebuild',
-		);
-		assert.match(
-			hostBlock,
-			/style:display=\{tab\.id === tabManager\.activeTabId \? null : 'none'\}/,
-			'only the active tab\'s host may be displayed, and the hidden ones must cost no layout',
-		);
-
-		// And that nothing kept a single binding beside it. The whole property is
-		// that there is no element the viewer can write two documents into.
-		assert.doesNotMatch(
-			viewer,
-			/bind:this=\{previewBlocks\}/,
-			'previewBlocks is the derived pointer at the active tab\'s host, never a binding of its own',
-		);
-	});
-});
-
-describe('numbered untitled titles', () => {
-	test('new tabs are created with numbered untitled titles', () => {
-		const tabs = readSource('src/lib/stores/tabs.svelte.ts');
-		assert.match(tabs, /nextUntitledTitle\(/);
-		// both creation paths go through the helper
-		const addNewTab = sliceBetween(tabs, 'addNewTab()', 'addHomeTab()');
-		assert.match(addNewTab, /nextUntitledTitle\(/);
-	});
-});
-
-describe('background edit-only tab position', () => {
-	test('a percentage is not invented to go with the anchor', () => {
-		// The view state carries `scrollTop` but neither height, so no fraction of
-		// the scrollable range can be computed from it. `anchorLine` is the first
-		// entry of both restore cascades, so recovering it is what decides where the
-		// tab opens; writing a percentage nobody can justify is not.
-		const source = readSource('src/lib/utils/editorPosition.ts');
-		const derivation = sliceFrom(source, 'export function outgoingTabAnchorLine');
-		assert.doesNotMatch(derivation, /scrollPercentage/);
-	});
-
-	test('both gates that drop the view state ask for the anchor first', () => {
-		// The two moments a tab's position leaves memory. Neither carries
-		// `editorViewState`: `serializeState` omits it and `restoreState` seeds
-		// null, and `tabTransfer.ts` excludes it as a live Monaco object.
-		const store = readSource('src/lib/stores/tabs.svelte.ts');
-		const serialize = sliceFrom(store, 'serializeState(extra: Record<string, unknown> = {}): string {');
-		assert.match(serialize, /anchorLine: outgoingTabAnchorLine\(t, this\.activeTabId\)/);
-
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		const payload = sliceFrom(viewer, 'transferPayload: (tabId) => {');
-		assert.match(payload, /anchorLine: outgoingTabAnchorLine\(tab, tabManager\.activeTabId\)/);
-		// After the spread, or the snapshot's own field would win.
-		assert.ok(offsetOf(payload, '...snapshotTab(tab)') < offsetOf(payload, 'outgoingTabAnchorLine'));
-	});
 });
 
 describe('editor reading position flush', () => {
 	const editor = readSource('src/lib/components/Editor.svelte');
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 
 	test('the editor derives the anchor in exactly one place', () => {
 		// The teardown used to build it inline. A flush that built its own would be
 		// a second crossing of the same two numberings, which is the defect shape
 		// `lineCoordinates.ts` exists to prevent.
-		assert.doesNotMatch(editor, /tabAnchorForEditorTopLine/);
-		assert.equal((editor.match(/editorReadingPosition\(/g) ?? []).length, 1);
-	});
-
-	test('the flush refuses a tab the editor is not holding', () => {
-		// One Editor per window, swapping models between tabs: an unguarded flush
-		// would copy the active tab's position onto the record the caller named.
-		const flush = sliceFrom(editor, 'export function flushPositionTo');
-		assert.match(flush, /if \(!editorReady \|\| !editor \|\| currentTabId !== tabId\) return;/);
-	});
-
-	test('the transfer payload flushes before it snapshots the tab', () => {
-		// `snapshotTab` is synchronous and runs with the editor still mounted, so
-		// without this the tab travels at the position of the last teardown.
-		const flushAt = offsetOf(viewer, 'editorPane?.flushPositionTo(tabId);');
-		const snapshotAt = offsetOf(viewer, 'snapshotTab(tab)');
-		assert.ok(flushAt < snapshotAt);
-	});
-
-	test('the window-state snapshot flushes too', () => {
-		// Same staleness at window close: `serializeState` persists the same three
-		// fields and the editor has not come down yet.
-		const serialize = sliceFrom(viewer, 'serializeState: () => {');
-		const flushAt = offsetOf(serialize, 'flushPositionTo(tabManager.activeTabId)');
-		const stateAt = offsetOf(serialize, 'return windowStateJson();');
-		assert.ok(flushAt < stateAt);
-	});
-
-	test('a sync asked for while Monaco is loading is kept, and spent after the restore', () => {
-		// #799: Ctrl+E from the preview asks before the editor exists. Dropping the
-		// request left the editor wherever its old view state put it.
-		const sync = sliceFrom(editor, 'export function syncScrollToPosition');
-		assert.match(sync, /if \(!editorReady \|\| !editor\) \{\s*pendingSync = position;/);
-		const readyAt = offsetOf(editor, 'editorReady = true;');
-		const spendAt = offsetOf(editor, 'if (pendingSync) {');
-		const revealAt = offsetOf(editor, 'if (pendingReveal) {');
-		assert.ok(readyAt < spendAt && spendAt < revealAt);
+		// The editor's position code is Editor.svelte plus editorDocument.svelte.ts.
+		const editorCode = editor + readSource('src/lib/utils/editorDocument.svelte.ts');
+		assert.doesNotMatch(editorCode, /tabAnchorForEditorTopLine/);
+		assert.equal((editorCode.match(/editorReadingPosition\(/g) ?? []).length, 1);
 	});
 });
diff --git a/scripts/tabs.checks.spec.ts b/scripts/tabs.models.spec.ts
similarity index 79%
rename from scripts/tabs.checks.spec.ts
rename to scripts/tabs.models.spec.ts
index 238f38f2..1c30e481 100644
--- a/scripts/tabs.checks.spec.ts
+++ b/scripts/tabs.models.spec.ts
@@ -1,27 +1,19 @@
 import assert from 'node:assert/strict';
 import { beforeAll, describe, test, vi } from 'vitest';
 
-import ts from 'typescript';
 import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
-import { callbackBodies, functionSource, readSource } from './sourceTree.js';
 
 // Importing the store boots the settings singleton, which asks for the OS type,
-// so a backend answering it has to be in place before the imports below. Each
-// describe installs its own backend in `beforeAll`.
+// so a backend answering it has to be in place before the imports below.
 (window as any).__TAURI_INTERNALS__ = {
 	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
 	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
 };
 
 const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
-const {
-	getTabModel,
-	lineEndingLabel,
-	tabModelUri,
-	trackedTabModelIds,
-} = await import('../src/lib/utils/tabModels.js');
+const { tabModelUri, trackedTabModelIds } = await import('../src/lib/utils/tabModels.js');
 const { buildTransferredTab } = await import('../src/lib/utils/tabTransfer.js');
-const { countWords } = await import('../src/lib/utils/wordCount.js');
+const { EditorDocument } = await import('../src/lib/utils/editorDocument.svelte.js');
 
 /*
  * Undo history has to survive a tab switch (#391), and every model that is
@@ -41,78 +33,21 @@ const { countWords } = await import('../src/lib/utils/wordCount.js');
  * registered, so a model whose tab is gone leaks its buffer, its tokenization
  * state and its worker-side copy for the life of the window.
  *
- * WHAT RUNS HERE. The component's own tab-activation `$effect`, its
- * `acquireTabModel`, its `onDidChangeModelContent` listener and its exported
- * `undo` are lifted out of Editor.svelte and evaluated over one scope, against
- * the REAL `TabManager` and the REAL model registry (`utils/tabModels.ts`).
- * Only Monaco itself is a fake — a `.svelte` file cannot be imported by the Node
- * test runner and Monaco needs a DOM — and the fake reproduces the two
- * semantics the whole question turns on, both read out of the bundled 0.55.1
- * source and cited at `FakeModel` below: `setValue` clears the undo stack,
- * `setModel` does not.
- *
- * WHAT IT DOES NOT ESTABLISH: rendering, focus, Svelte's scheduling, or that
- * Monaco's real undo stack behaves as its source says. It establishes what the
- * component does when its handlers run.
+ * WHAT RUNS HERE. The editor's `EditorDocument` (tab activation, the per-tab
+ * model, the content listener, the status readings) against the REAL
+ * `TabManager` and the REAL model registry (`utils/tabModels.ts`). Only Monaco
+ * is a fake, and the fake reproduces the two semantics the whole question turns
+ * on, both read out of the bundled 0.55.1 source and cited at `FakeModel`
+ * below: `setValue` clears the undo stack, `setModel` does not.
  */
 
-// ---------------------------------------------------------------- environment
-// Svelte runes and the Tauri bridge, faked as windowTagEditor.ts does, so
-// `tabs.svelte.ts` imports under plain node.
 describe('undo history per tab', () => {
 	beforeAll(() => {
-		// The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
-		// Svelte plugin, so the store and the session run under real reactivity, and jsdom
-		// supplies `window` and `localStorage`. Only the Tauri backend is stubbed.
 		(window as any).__TAURI_INTERNALS__ = {
 			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
 			invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
 		};
 	});
-
-	// ------------------------------------------------- the component, as written
-
-	const EDITOR = 'src/lib/components/Editor.svelte';
-	const source = readSource(EDITOR);
-
-	/**
-	 * The tab-activation effect — the one that files a view state under the tab it
-	 * is leaving. Identified by what it does rather than by its position in the
-	 * file, and pinned to exactly one so a split or a merge fails here loudly
-	 * instead of quietly running half the code.
-	 */
-	const activationEffectBody = (() => {
-		const bodies = callbackBodies(source, '$effect').filter((body) => body.includes('updateTabEditorState'));
-		assert.equal(bodies.length, 1, `expected exactly one tab-activation $effect in ${EDITOR}, found ${bodies.length}`);
-		return bodies[0];
-	})();
-
-	const contentChangeBody = (() => {
-		const bodies = callbackBodies(source, 'editor.onDidChangeModelContent');
-		assert.equal(bodies.length, 1, `expected exactly one model-content listener in ${EDITOR}, found ${bodies.length}`);
-		return bodies[0];
-	})();
-
-	/**
-	 * The one function bound to `name`, or `fallback` when the component has no
-	 * such function.
-	 *
-	 * The fallback exists for the falsification run, and it is what makes that run
-	 * worth anything. Reverting the fix deletes `acquireTabModel`; asserting on its
-	 * presence here would turn every test in this file red with the same structural
-	 * message, and none of them would then be evidence about undo. A component that
-	 * never acquires a per-tab model behaves exactly like one whose acquire does
-	 * nothing — so that is what it is given, and each test fails on its own claim.
-	 * Same reasoning as `runnable` in windowTagEditor.ts.
-	 */
-	function lifted(name: string, fallback: string): string {
-		try {
-			return functionSource(source, name);
-		} catch {
-			return fallback;
-		}
-	}
-
 	// ------------------------------------------------------------------ the fakes
 
 	/**
@@ -307,98 +242,40 @@ describe('undo history per tab', () => {
 
 	type Editor = ReturnType<typeof createEditorStub>;
 
+
 	type Component = {
-		/** The tab-activation effect, run the way Svelte would run it. */
+		/** The tab-activation effect, run the way the component's effect runs it. */
 		activate: () => void;
-		/** The `onDidChangeModelContent` listener. */
-		contentChanged: () => void;
-		/** The component's exported undo. */
+		/** Cmd+Z, as the component's exported undo sends it. */
 		undo: () => void;
-		acquireTabModel: (tabId: string, seed: string, language: string) => FakeModel | null;
 		setLanguage: (language: string) => void;
-		currentTabId: () => string | null;
 		currentLanguage: () => string;
 		wordCount: () => number;
 		settings: { wordCount: boolean };
 	};
 
-	/**
-	 * The lifted code is TypeScript (`function acquireTabModel(tabId: string, …)`)
-	 * and `new Function` only parses JavaScript, so it goes through `tsc` first —
-	 * as editor.imageUndo.checks.spec.ts and layout.spec.ts already do.
-	 * Types are erased, nothing else: the statements that run are the component's.
-	 */
-	const factorySource = ts.transpileModule(
-		`const __component = (tabManager, monaco, editor, getTabModel, tabModelUri, lineEndingLabel, countWords) => {
-		let currentTabId = null;
+	function createComponent(editor: Editor): Component {
 		let language = 'markdown';
-		let currentLanguage = 'markdown';
-		let wordCount = 0;
-		let wordCountTimer;
-		let emittedText = null;
 		const settings = { wordCount: true };
-		let lineEnding = 'LF';
-		const editorReady = true;
-
-		${lifted('syncStatusFromModel', 'function syncStatusFromModel() {}')}
-		${lifted('acquireTabModel', 'function acquireTabModel() { return null; }')}
-		// The component binds undo to an arrow function, so what comes back is
-		// the expression rather than a declaration: it needs its own binding.
-		const undo = ${lifted('undo', '() => {}')};
+		// `value` is the prop `value={tabManager.activeTab.rawContent}`: read, never copied.
+		const value = () => tabManager.activeTab?.rawContent ?? '';
+		const doc = new EditorDocument({
+			monaco: () => monacoStub as any,
+			editor: () => editor as any,
+			tabs: tabManager,
+			value,
+			showWordCount: () => settings.wordCount,
+		});
+		editor.onContentChange(() => doc.contentChanged());
 
 		return {
-			activate: () => ${activationEffectBody},
-			contentChanged: () => ${contentChangeBody},
-			undo,
-			acquireTabModel,
-			setLanguage: (next) => { language = next; },
-			currentTabId: () => currentTabId,
-			currentLanguage: () => currentLanguage,
-			wordCount: () => wordCount,
+			activate: () => doc.activate(tabManager.activeTabId, value(), language),
+			undo: () => editor.trigger('keyboard', 'undo'),
+			setLanguage: (next) => void (language = next),
+			currentLanguage: () => doc.language,
+			wordCount: () => doc.wordCount,
 			settings,
 		};
-	};`,
-		{ compilerOptions: { target: ts.ScriptTarget.ES2022 } },
-	).outputText;
-
-	/**
-	 * The `value` prop, modelled as what Svelte compiles a dynamic prop to: a
-	 * getter over the parent's expression, which is
-	 * `value={tabManager.activeTab.rawContent}`. It used to be `bind:value`, and
-	 * this harness used to mirror it with a local the tests re-synced by hand —
-	 * which is the same second copy of the buffer, and the same chance for the two
-	 * to disagree, that the component itself no longer keeps.
-	 *
-	 * A null-prototype object so `with` captures this one name and not
-	 * `toString`, `constructor` and the rest of Object.prototype.
-	 */
-	const propsScope = Object.defineProperty(Object.create(null), 'value', {
-		get: () => tabManager.activeTab?.rawContent ?? '',
-	});
-
-	function createComponent(editor: Editor): Component {
-		const factory = new Function(
-			'__props',
-			`with (__props) { ${factorySource}\nreturn __component; }`,
-		)(propsScope) as (
-			tabManager: unknown,
-			monaco: unknown,
-			editor: unknown,
-			getTabModel: unknown,
-			tabModelUri: unknown,
-			lineEndingLabel: unknown,
-			countWords: unknown,
-		) => Component;
-
-		return factory(
-			tabManager,
-			monacoStub,
-			editor,
-			getTabModel,
-			tabModelUri,
-			lineEndingLabel,
-			countWords,
-		);
 	}
 
 	type Harness = {
@@ -422,7 +299,6 @@ describe('undo history per tab', () => {
 
 		const editor = createEditorStub();
 		const component = createComponent(editor);
-		editor.onContentChange(component.contentChanged);
 
 		const show = (tabId: string) => {
 			tabManager.setActive(tabId);
@@ -867,3 +743,47 @@ describe('undo history per tab', () => {
 		assert.ok(uris.every((uri) => typeof uri === 'string'), 'a tab was shown without acquiring a model');
 	});
 });
+
+describe('editor reading position flush', () => {
+	test('the flush refuses a tab the editor is not holding', () => {
+		// One Editor per window, swapping models between tabs: an unguarded flush
+		// would copy the active tab's position onto the record the caller named.
+		tabManager.closeAll();
+		tabManager.addTab('/docs/held.md', 'one\ntwo\nthree');
+		const held = tabManager.activeTabId!;
+		tabManager.addTab('/docs/other.md', 'other');
+		const other = tabManager.activeTabId!;
+		tabManager.setActive(held);
+
+		const model = { getValue: () => 'one\ntwo\nthree' };
+		const editor = {
+			getModel: () => model,
+			saveViewState: () => ({ marker: 'held' }),
+			getVisibleRanges: () => [{ startLineNumber: 2 }],
+			getScrollTop: () => 100,
+			getScrollHeight: () => 400,
+			getLayoutInfo: () => ({ height: 200 }),
+		};
+		const doc = new EditorDocument({
+			monaco: () => {
+				throw new Error('no model is built here');
+			},
+			editor: () => editor as any,
+			tabs: tabManager,
+			value: () => tabManager.activeTab?.rawContent ?? '',
+			showWordCount: () => false,
+		});
+		const record = (id: string) => {
+			const tab = tabManager.tabs.find((t) => t.id === id)!;
+			return { view: tab.editorViewState, scroll: tab.scrollPercentage, anchor: tab.anchorLine };
+		};
+		const before = record(other);
+
+		doc.flushPositionTo(other);
+		assert.deepEqual(record(other), before, "the flush wrote the held tab's position onto another tab");
+
+		doc.flushPositionTo(held);
+		assert.deepEqual(record(held).view, { marker: 'held' }, 'precondition: the held tab is flushed');
+		assert.equal(record(held).scroll, 0.5);
+	});
+});
diff --git a/scripts/tabs.spec.ts b/scripts/tabs.spec.ts
index db5d7049..cda18139 100644
--- a/scripts/tabs.spec.ts
+++ b/scripts/tabs.spec.ts
@@ -17,6 +17,11 @@ const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
 const { createDocumentSession, claimTabForRead } = await import('../src/lib/sessions/documentSession.svelte.js');
 const { createWindowSession } = await import('../src/lib/sessions/windowSession.svelte.js');
 const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { loadLocale } = await import('../src/lib/utils/i18n.js');
+const { createTabMovers, createTransferOptions } = await import('../src/lib/sessions/windowTransfer.js');
+const { snapshotTab } = await import('../src/lib/utils/tabTransfer.js');
+const { outgoingTabAnchorLine } = await import('../src/lib/utils/editorPosition.js');
+type Tab = import('../src/lib/stores/tabs.svelte.js').Tab;
 
 describe('a preview host per tab', () => {
 	function patchPreviewBlocks(host: HTMLElement, html: string) {
@@ -513,6 +518,40 @@ describe('path identity on a case-folding volume', () => {
 		assert.equal(tabManager.tabs.length, 2);
 	});
 
+	// A link opened in a new tab takes the ordinary open path, which resolves the
+	// file's identity before picking a tab. Putting the path on a tab first and
+	// loading with `skipTabManagement` compared spellings, so `C:/n/b.md` from a
+	// link opened a second tab beside the `C:\n\b.md` the user already had open.
+	test('every file the OS hands the launch window opens, in order', async () => {
+		reset();
+		const session = makeSession();
+		disk.set('/notes/a.md', { body: 'a', lossy: false });
+		disk.set('/notes/b.md', { body: 'b', lossy: false });
+		disk.set('/notes/c.md', { body: 'c', lossy: false });
+
+		await session.openFiles(['/notes/a.md', '/notes/b.md', '/notes/c.md']);
+
+		assert.deepEqual(
+			tabManager.tabs.map((tab) => tab.path),
+			['/notes/a.md', '/notes/b.md', '/notes/c.md'],
+		);
+	});
+
+	test('a link opened in a new tab goes through the ordinary open path', async () => {
+		reset();
+		const session = makeSession();
+		disk.set('/notes/A.md', { body: 'a', lossy: false });
+		disk.set('/notes/b.md', { body: 'b', lossy: false });
+
+		await session.loadMarkdown('/notes/A.md');
+		const first = tabManager.activeTabId!;
+		await session.loadMarkdown('/notes/b.md');
+		await session.openInNewTab('/notes/a.md');
+
+		assert.equal(tabManager.tabs.length, 2, 'a link to an open file opened a second tab');
+		assert.equal(tabManager.activeTabId, first);
+	});
+
 	// Back/forward and a tab arriving from another window put a path on a tab
 	// before anything has resolved it, so their claim compares spellings. The
 	// identity arrives a moment later, and the claim has to be made again then.
@@ -1297,4 +1336,336 @@ describe('tab transfer races', () => {
 		await settle();
 		assert.equal(calls.filter((call) => call.cmd === 'stage_detached_tab').length, 2);
 	});
+
+	const ARRIVING = JSON.stringify({
+		path: '/notes/a.md',
+		title: 'a.md',
+		rawContent: 'old',
+		originalContent: 'old',
+		isDirty: false,
+		isEditing: false,
+		isSplit: false,
+		isScrollSynced: false,
+		hasReplacementChars: false,
+		encoding: 'UTF-8',
+		splitRatio: 0.5,
+		scrollTop: 0,
+		scrollPercentage: 0,
+		anchorLine: 0,
+		historyIndex: 0,
+		history: [],
+	});
+
+	test('the source keeps waiting when the destination has already claimed', async () => {
+		// The 15s timeout is a guess about a window that may simply be slow to
+		// render. Cancelling regardless is what stranded a copy on each side.
+		vi.useFakeTimers();
+		respond = (cmd) =>
+			cmd === 'stage_detached_tab' ? TOKEN : cmd === 'cancel_detached_tab' ? { cancelled: false, claimed: true } : null;
+		const tabId = openTab('doc');
+		const { session } = makeSession();
+
+		let result: boolean | undefined;
+		void session.transfer(tabId, async () => {}).then((moved) => (result = moved));
+		for (let i = 0; i < 3; i++) {
+			await vi.advanceTimersByTimeAsync(15_000);
+			await settle();
+		}
+		assert.ok(calls.some((call) => call.cmd === 'cancel_detached_tab'), 'the timeout asked the broker');
+		assert.equal(result, undefined, 'a claimed transfer was given up on while the destination rendered');
+
+		emit('tab-transfer-claimed', TOKEN);
+		await settle();
+		assert.equal(result, true);
+		assert.equal(tabManager.tabs.length, 0);
+	});
+
+	test('the destination releases its claim when it cannot finish', async () => {
+		// Because a claimed transfer is immune to the source's timeout, the
+		// destination is the only party that can end a claim it cannot complete.
+		const cases: Array<[string, string, () => Promise<string | null>]> = [
+			['an invalid payload', '{"not":"a tab"}', async () => 'never'],
+			['a refusing destination', ARRIVING, async () => null],
+			['a thrown render', ARRIVING, async () => { throw new Error('render failed'); }],
+		];
+		for (const [why, payload, accept] of cases) {
+			calls = [];
+			respond = (cmd) => (cmd === 'claim_detached_tab' ? payload : null);
+			const { session } = makeSession(accept);
+
+			assert.equal(await session.acceptOfferedTransfer(TOKEN), false, why);
+			assert.deepEqual(
+				calls.filter((call) => call.cmd === 'cancel_detached_tab').map((call) => call.args),
+				[{ token: TOKEN }],
+				`${why} must hand the claim back exactly once`,
+			);
+		}
+	});
+
+	test('a claim is distinguished from "no such token"', async () => {
+		// Releasing a token that was never claimed would be a no-op at best and a
+		// cancel of someone else's transfer at worst.
+		respond = () => null;
+		const { session } = makeSession(async () => 'never');
+
+		assert.equal(await session.acceptOfferedTransfer(TOKEN), false);
+		assert.deepEqual(calls.map((call) => call.cmd), ['claim_detached_tab']);
+	});
+
+	test('a second transfer of the same tab is refused while one is in flight', async () => {
+		// The menu entry becomes clickable again long before the transfer
+		// resolves; two payloads for one tab means two windows each build it.
+		respond = (cmd) => (cmd === 'stage_detached_tab' ? TOKEN : null);
+		const tabId = openTab('doc');
+		const { session } = makeSession();
+
+		const first = session.transfer(tabId, async () => {});
+		await settle();
+		const second = session.transfer(tabId, async () => {});
+		await settle();
+		assert.equal(calls.filter((call) => call.cmd === 'stage_detached_tab').length, 1, 'a second payload was staged');
+
+		emit('tab-transfer-claimed', TOKEN);
+		assert.equal(await first, true);
+		assert.equal(await second, false);
+	});
+
+	// --- the viewer's side: what this window sends and how it takes a tab in ---
+
+	function makeTransfer(overrides: Partial<Parameters<typeof createTransferOptions>[0]> = {}) {
+		return createTransferOptions({
+			editorPane: () => null,
+			windowStateJson: () => tabManager.serializeState(),
+			isCloseWalkActive: () => false,
+			isDisposed: () => false,
+			renderPreview: async () => {},
+			restoreReadingPosition: () => {},
+			...overrides,
+		});
+	}
+
+	/** A payload as another window would send it, with this store left empty. */
+	function arrivingSnapshot() {
+		const tabId = openTab('# arriving');
+		const snapshot = snapshotTab(tabManager.tabs.find((tab) => tab.id === tabId)!);
+		tabManager.closeAll();
+		return snapshot;
+	}
+
+	test('a failed render undoes the inserted tab', async () => {
+		// The tab must exist before it can be rendered, so the destination owns a
+		// document the source still shows until the render succeeds.
+		const snapshot = arrivingSnapshot();
+		const failing = makeTransfer({ renderPreview: () => Promise.reject(new Error('render failed')) });
+		await assert.rejects(failing.acceptTransferredTab(snapshot), /render failed/);
+		assert.equal(tabManager.tabs.length, 0);
+
+		let disposed = false;
+		const closing = makeTransfer({ isDisposed: () => disposed, renderPreview: async () => void (disposed = true) });
+		assert.equal(await closing.acceptTransferredTab(snapshot), null);
+		assert.equal(tabManager.tabs.length, 0, 'a window torn down mid-render keeps no half-arrived tab');
+	});
+
+	test('the arriving tab is put back where its reader was, after its document lands', async () => {
+		// `insertTransferredTab` activates the tab while its preview is still
+		// empty, so a restore before the render has nothing to scroll.
+		const snapshot = arrivingSnapshot();
+		const log: string[] = [];
+		const transfer = makeTransfer({
+			renderPreview: async () => {
+				await Promise.resolve();
+				log.push('rendered');
+			},
+			restoreReadingPosition: (tab) => log.push(`restored ${tab.path}`),
+		});
+		const id = await transfer.acceptTransferredTab(snapshot);
+		assert.equal(id, tabManager.activeTabId);
+		assert.deepEqual(log, ['rendered', 'restored /notes/a.md']);
+
+		// Only the active tab's host is displayed: a reader who switched away
+		// during the render must not have the document on screen moved.
+		tabManager.closeAll();
+		log.length = 0;
+		const switching = makeTransfer({
+			renderPreview: async () => void tabManager.addTab('/notes/other.md', 'other'),
+			restoreReadingPosition: () => log.push('restored'),
+		});
+		await switching.acceptTransferredTab(snapshot);
+		assert.deepEqual(log, []);
+	});
+
+	test('both gates that drop the view state ask for the anchor first', () => {
+		// The two moments a tab's position leaves memory. Neither carries
+		// `editorViewState`, so a background edit-only tab would leave at the
+		// anchor of its last preview scroll.
+		const lines = Array.from({ length: 80 }, (_, index) => `line ${index + 1}`).join('\n');
+		const backgroundId = openTab(lines);
+		tabManager.addTab('/notes/active.md', 'active');
+		const background = tabManager.tabs.find((tab) => tab.id === backgroundId)!;
+		background.isEditing = true;
+		background.anchorLine = 3 as typeof background.anchorLine;
+		background.editorViewState = { viewState: { firstPosition: { lineNumber: 40, column: 1 } } };
+		const expected = outgoingTabAnchorLine(background, tabManager.activeTabId);
+		assert.notEqual(expected, 3);
+
+		const transfer = makeTransfer();
+		assert.equal(JSON.parse(transfer.transferPayload(backgroundId)).anchorLine, expected);
+		const saved = JSON.parse(transfer.serializeState()).tabs.find((tab: { path: string; anchorLine: number }) => tab.anchorLine === expected);
+		assert.ok(saved, 'the window snapshot records the editor position too');
+	});
+
+	test('the transfer payload flushes before it snapshots the tab', () => {
+		// The editor holds the live position; without the flush the tab travels
+		// at the position of the last teardown.
+		const tabId = openTab('doc');
+		const editorPane = {
+			flushPositionTo: (id: string) => {
+				tabManager.tabs.find((tab) => tab.id === id)!.anchorLine = 12 as Tab['anchorLine'];
+			},
+		};
+		const transfer = makeTransfer({ editorPane: () => editorPane });
+		assert.equal(JSON.parse(transfer.transferPayload(tabId)).anchorLine, 12);
+	});
+
+	test('the window-state snapshot flushes too', () => {
+		// Same staleness at window close: the editor has not come down yet.
+		openTab('doc');
+		const flushed: string[] = [];
+		const editorPane = {
+			flushPositionTo: (id: string) => {
+				flushed.push(id);
+				tabManager.tabs.find((tab) => tab.id === id)!.anchorLine = 12 as Tab['anchorLine'];
+			},
+		};
+		const transfer = makeTransfer({ editorPane: () => editorPane });
+		assert.equal(JSON.parse(transfer.serializeState()).tabs[0].anchorLine, 12);
+		assert.deepEqual(flushed, [tabManager.activeTabId]);
+	});
+
+	test('a partial buffer cannot be handed to another window', async () => {
+		// The destination rebuilds the tab from the payload alone and cannot know
+		// the text is incomplete, so its auto-save would truncate the file.
+		const tabId = openTab('first 50KB');
+		tabManager.addTab('/notes/another.md', 'another');
+		const transfer = makeTransfer();
+		assert.equal(transfer.canTransfer(tabId), true);
+		assert.equal(transfer.canDetach(tabId), true);
+		tabManager.tabs.find((tab) => tab.id === tabId)!.isTruncated = true;
+		assert.equal(transfer.canTransfer(tabId), false);
+		assert.equal(transfer.canDetach(tabId), false);
+
+		// The movers complete the buffer first, and stop when they cannot.
+		const asked: string[] = [];
+		let partial = 0;
+		const movers = createTabMovers({
+			ensureFullContent: async () => false,
+			onPartialDocument: () => partial++,
+			session: {
+				detach: async (id) => (asked.push(`detach ${id}`), true),
+				transfer: async (id) => (asked.push(`transfer ${id}`), true),
+			},
+		});
+		assert.equal(await movers.handleDetach(tabId), false);
+		assert.equal(await movers.moveTabToWindow(tabId, 'w2'), false);
+		assert.deepEqual(asked, []);
+		assert.equal(partial, 2);
+	});
+
+	test('moving to an existing window uses the acknowledged transfer protocol', async () => {
+		respond = (cmd) => (cmd === 'stage_detached_tab' ? TOKEN : null);
+		const tabId = openTab('doc');
+		const { session } = makeSession();
+		const movers = createTabMovers({ ensureFullContent: async () => true, onPartialDocument: () => {}, session });
+
+		const moving = movers.moveTabToWindow(tabId, 'w2', true);
+		await settle();
+		const offer = calls.find((call) => call.cmd === 'offer_tab_to_window');
+		assert.deepEqual(offer?.args, { targetLabel: 'w2', token: TOKEN });
+		assert.equal(tabManager.tabs.length, 1, 'the source keeps the tab until the target acknowledges');
+
+		emit('tab-transfer-claimed', TOKEN);
+		assert.equal(await moving, true);
+		assert.equal(tabManager.tabs.length, 0);
+		assert.deepEqual(calls.find((call) => call.cmd === 'focus_window')?.args, { label: 'w2' });
+	});
+});
+
+describe('tabs the store builds', () => {
+	beforeAll(() => {
+		(window as any).__TAURI_INTERNALS__ = {
+			metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+			invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
+		};
+	});
+
+	let language: typeof settings.language;
+	beforeEach(() => {
+		language = settings.language;
+		tabManager.closeAll();
+	});
+	afterEach(() => {
+		settings.language = language;
+		tabManager.closeAll();
+	});
+
+	test('new tabs are created with numbered untitled titles', () => {
+		tabManager.addNewTab();
+		tabManager.addNewTab();
+		assert.deepEqual(tabManager.tabs.map((tab) => tab.title), ['Untitled 1', 'Untitled 2']);
+	});
+
+	test('a tab arriving from another window gets a free localized untitled title, becomes active, and its id is returned', async () => {
+		await loadLocale('de');
+		settings.language = 'de';
+		tabManager.addNewTab();
+		const resident = tabManager.activeTabId;
+
+		const id = tabManager.insertTransferredTab({
+			// Numbered in the source window, where it was the first untitled tab.
+			path: '',
+			title: 'Unbenannt 1',
+			rawContent: 'draft',
+			originalContent: '',
+			isDirty: true,
+			isEditing: true,
+			scrollTop: 0,
+			scrollPercentage: 0,
+			anchorLine: asRendererLine(0),
+			isSplit: false,
+			splitRatio: 0.5,
+			isScrollSynced: false,
+			hasReplacementChars: false,
+			encoding: 'UTF-8',
+			history: [],
+			historyIndex: 0,
+		});
+
+		assert.notEqual(id, resident);
+		assert.equal(tabManager.activeTabId, id);
+		assert.equal(tabManager.tabs.find((tab) => tab.id === id)?.rawContent, 'draft');
+		assert.deepEqual(tabManager.tabs.map((tab) => tab.title), ['Unbenannt 1', 'Unbenannt 2']);
+	});
+
+	test('a percentage is not invented to go with the anchor', () => {
+		// The view state carries `scrollTop` but neither height, so no fraction of
+		// the scrollable range can be computed from it. `anchorLine` is the first
+		// entry of both restore cascades, so recovering it is what decides where the
+		// tab opens; writing a percentage nobody can justify is not.
+		tabManager.addTab('/notes/a.md', 'body\n'.repeat(200));
+		const background = tabManager.activeTab!;
+		background.isEditing = true;
+		background.scrollPercentage = 0.25;
+		background.editorViewState = {
+			viewState: { firstPosition: { lineNumber: 40, column: 1 }, firstPositionDeltaTop: 0, scrollTop: 900 },
+		};
+		tabManager.addTab('/notes/b.md', 'other');
+
+		const first = JSON.parse(tabManager.serializeState());
+		const second = JSON.parse(tabManager.serializeState());
+
+		assert.notEqual(first.tabs[0].anchorLine, 0, 'the anchor is recovered from the view state');
+		assert.equal(first.tabs[0].scrollPercentage, 0.25);
+		assert.equal(second.tabs[0].scrollPercentage, 0.25);
+		assert.equal(background.scrollPercentage, 0.25);
+	});
 });
diff --git a/scripts/tabs.test.ts b/scripts/tabs.test.ts
index 114e0191..539c616e 100644
--- a/scripts/tabs.test.ts
+++ b/scripts/tabs.test.ts
@@ -6,7 +6,7 @@ import { HOME_TAB_PATH } from '../src/lib/utils/homeTab.js';
 import { getTabFileActions, hasRealFilePath } from '../src/lib/utils/tabFileActions.js';
 import { closestSlotIndex, dragDistance } from '../src/lib/utils/tabReorder.js';
 import type { Tab } from '../src/lib/stores/tabs.svelte.js';
-import { asRendererLine, EDITOR_ANCHOR_LINE_OFFSET } from '../src/lib/utils/lineCoordinates.js';
+import { asBufferLine, asRendererLine, EDITOR_ANCHOR_LINE_OFFSET } from '../src/lib/utils/lineCoordinates.js';
 import {
 	buildTransferredTab,
 	snapshotTab,
@@ -14,8 +14,11 @@ import {
 	validateTransferPayload,
 	type TransferableTab,
 } from '../src/lib/utils/tabTransfer.js';
+import { commitWithoutTransitions } from '../src/lib/utils/motion.js';
 import { nextUntitledTitle } from '../src/lib/utils/untitledTitle.js';
 import { outgoingTabAnchorLine, type StoredTabPosition, editorReadingPosition } from '../src/lib/utils/editorPosition.js';
+import { EditorJumps, type JumpEditor } from '../src/lib/utils/editorJumps.js';
+import type { ScrollSyncPosition } from '../src/lib/utils/scrollSync.js';
 
 describe('duplicate tab names', () => {
 	function suffixes(...paths: string[]): (string | undefined)[] {
@@ -503,4 +506,67 @@ describe('editor reading position flush', () => {
 		});
 		assert.equal(anchorLine, null);
 	});
+
+	test('a sync asked for while Monaco is loading is kept, and spent after the restore', () => {
+		// #799: Ctrl+E from the preview asks before the editor exists. Dropping the
+		// request left the editor wherever its old view state put it. The editor
+		// spends it after its view-state restore, and before a queued "edit this
+		// fragment", which has to win over both.
+		const log: unknown[] = [];
+		const model = { getLineCount: () => 3, getLineMaxColumn: () => 5 };
+		const editor = {
+			getModel: () => model,
+			revealLineNearTop: () => {},
+			revealLineInCenterIfOutsideViewport: (line: number) => log.push(['reveal', line]),
+			setSelection: () => {},
+			focus: () => {},
+		} as unknown as JumpEditor;
+		const state = { ready: false };
+		const jumps = new EditorJumps({
+			monaco: () => ({ editor: { ScrollType: { Smooth: 0, Immediate: 1 } } }) as never,
+			editor: () => editor,
+			ready: () => state.ready,
+			scrollTo: (position, options) => log.push(['scroll', position, options]),
+		});
+		const position: ScrollSyncPosition = { section: 'body', ratio: 0.4, line: asBufferLine(12) };
+
+		jumps.syncScrollToPosition(position, { cursorIntoView: true });
+		jumps.revealSourceRange(2, 2);
+		assert.deepEqual(log, []);
+
+		state.ready = true;
+		jumps.spendPending();
+		assert.deepEqual(log, [
+			['scroll', position, { cursorIntoView: true }],
+			['reveal', 2],
+		]);
+
+		jumps.syncScrollToPosition(position);
+		assert.deepEqual(log.at(-1), ['scroll', position, { cursorIntoView: false }], 'once ready, a sync is not queued');
+	});
+});
+
+describe('tab switch is not a render', () => {
+	// A tab switch must not animate: the class that turns transitions off has to
+	// be on the element during a forced style recalculation, or it is added and
+	// removed within one style computation and suppresses nothing.
+	test('a tab switch commits the new pane geometry with transitions off', () => {
+		const log: string[] = [];
+		const classes = new Set<string>();
+		const el = {
+			classList: {
+				add: (name: string) => (classes.add(name), log.push(`add ${name}`)),
+				remove: (name: string) => (classes.delete(name), log.push(`remove ${name}`)),
+			},
+			get offsetHeight() {
+				log.push(`recalc with ${[...classes].join(',') || 'nothing'}`);
+				return 0;
+			},
+		} as unknown as HTMLElement;
+
+		commitWithoutTransitions(el);
+
+		assert.deepEqual(log, ['add tab-switching', 'recalc with tab-switching', 'remove tab-switching']);
+		assert.equal(classes.size, 0, 'the class does not stay on');
+	});
 });
diff --git a/scripts/windowTagEditor.ts b/scripts/windowTagEditor.ts
deleted file mode 100644
index c17775cd..00000000
--- a/scripts/windowTagEditor.ts
+++ /dev/null
@@ -1,507 +0,0 @@
-import assert from 'node:assert/strict';
-
-import { parse } from 'svelte/compiler';
-
-import { callbackBodies, functionSource, readSource } from './sourceTree.js';
-
-/*
- * A running window-tag control, lifted out of TitleBar.svelte.
- *
- * A `.svelte` file cannot be imported by the Node test runner, so — following
- * windows.checks.spec.ts — the component's own function declarations, the
- * handlers its markup is actually wired to, and the body of the `$effect` that
- * installs the window-level dismissal listeners are read out of the parsed
- * component and evaluated over one shared set of component variables and the
- * REAL `TabManager`. Everything a test below drives is the code that ships.
- *
- * It is shared because several test files need the same running control: the
- * scope line and the context menu read the same `tabManager.windowTag` the
- * popover writes, and a second copy of the lifting would be free to drift from
- * the first.
- *
- * What it does not model: focus, layout, CSS, or Svelte's scheduling. It
- * establishes what the handlers do when they run.
- */
-
-// ---------------------------------------------------------------- environment
-// Svelte runes and the Tauri bridge, faked as homeSentinelSnapshot.ts does, so
-// `tabs.svelte.ts` imports under plain node.
-
-const g = globalThis as any;
-const runeEffect = (fn: () => void) => {
-	void fn;
-};
-runeEffect.root = (fn: () => unknown) => fn();
-g.$state = (value: unknown) => value;
-g.$state.raw = (value: unknown) => value;
-g.$state.snapshot = (value: unknown) => value;
-g.$derived = (value: unknown) => value;
-g.$derived.by = (fn: () => unknown) => fn();
-g.$effect = runeEffect;
-g.window = g.window ?? {};
-
-const localStore = new Map<string, string>();
-g.localStorage = {
-	getItem: (key: string) => (localStore.has(key) ? localStore.get(key)! : null),
-	setItem: (key: string, value: string) => void localStore.set(key, String(value)),
-	removeItem: (key: string) => void localStore.delete(key),
-	clear: () => localStore.clear(),
-};
-g.window.__TAURI_INTERNALS__ = {
-	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
-};
-
-const store = await import('../src/lib/stores/tabs.svelte.js');
-const { hasRealFilePath } = await import('../src/lib/utils/tabFileActions.js');
-const { t } = await import('../src/lib/utils/i18n.js');
-
-export const tabManager = store.tabManager;
-
-// ------------------------------------------------- the component, as written
-
-const TITLE_BAR = 'src/lib/components/TitleBar.svelte';
-export const source = readSource(TITLE_BAR);
-
-type Node = Record<string, any>;
-
-function collect(node: unknown, hit: (node: Node) => void): void {
-	if (!node || typeof node !== 'object') return;
-	if (Array.isArray(node)) {
-		for (const child of node) collect(child, hit);
-		return;
-	}
-	hit(node as Node);
-	for (const key of Object.keys(node as Node)) {
-		if (key === 'parent' || key === 'metadata') continue;
-		collect((node as Node)[key], hit);
-	}
-}
-
-const parsed = parse(source, { modern: true, filename: TITLE_BAR });
-const fragment = parsed.fragment;
-
-/**
- * The same code with its TypeScript annotations blanked out.
- *
- * `new Function` is a JavaScript parser, and the component is written in
- * TypeScript: `async function tagNameTakenElsewhere(name: string):
- * Promise<boolean>` is a syntax error in it. Blanking rather than deleting
- * keeps every remaining character at its original offset, so a stack trace out
- * of the lifted code still points where the reader expects.
- *
- * Done from the AST rather than with a pattern, for the reason `sourceTree`
- * gives for parsing in general: the annotation forms in `src/` are parameter
- * and return types today, and the next contributor is free to write `as
- * const`, a generic call or a non-null assertion. Every node the parser labels
- * `TS…` is a type; the two that also carry a value keep their expression.
- */
-function stripTypes(snippet: string): string {
-	const prefix = '<script lang="ts">\n';
-	const suffix = '\n</script>';
-	const wrapped = `${prefix}${snippet}${suffix}`;
-	const blanks: Array<[number, number]> = [];
-	collect(parse(wrapped, { modern: true }).instance, (node) => {
-		if (typeof node.type !== 'string' || !node.type.startsWith('TS')) return;
-		if (typeof node.start !== 'number' || typeof node.end !== 'number') return;
-		// `x as T`, `x!`: the expression is a value and has to survive.
-		if (node.expression && typeof node.expression.start === 'number') {
-			blanks.push([node.start, node.expression.start], [node.expression.end, node.end]);
-			return;
-		}
-		blanks.push([node.start, node.end]);
-	});
-	const characters = [...wrapped];
-	for (const [start, end] of blanks) {
-		for (let i = start; i < end; i++) if (characters[i] !== '\n') characters[i] = ' ';
-	}
-	return characters.join('').slice(prefix.length, wrapped.length - suffix.length);
-}
-
-/**
- * The one function bound to `name`, ready for `new Function` — or a stub, if
- * the component has no such function.
- *
- * Same reasoning as `handlerSourceIn` below: a function that is not there does
- * nothing when it is called, and a stub models exactly that. Asserting instead
- * would turn one deleted function into an identical structural failure in every
- * test in the file, including the fences whose whole job is to stay green, and
- * none of them would then be evidence about behaviour.
- */
-function runnable(name: string): string {
-	try {
-		return stripTypes(functionSource(source, name));
-	} catch {
-		return `function ${name}() {}`;
-	}
-}
-
-/** The one element in `text` carrying exactly `class="<name>"`. */
-function elementIn(text: string, root: unknown, className: string): Node {
-	const found: Node[] = [];
-	collect(root, (node) => {
-		if (node.type !== 'RegularElement') return;
-		const attribute = node.attributes?.find((a: Node) => a.type === 'Attribute' && a.name === 'class');
-		const value = attribute?.value;
-		if (!Array.isArray(value) || value.length !== 1 || value[0].type !== 'Text') return;
-		if (value[0].data === className) found.push(node);
-	});
-	assert.equal(found.length, 1, `expected exactly one <… class="${className}"> element, found ${found.length}`);
-	return found[0];
-}
-
-export function element(className: string): Node {
-	return elementIn(source, fragment, className);
-}
-
-/**
- * The single `{…}` behind an attribute or directive value, if there is one.
- *
- * Svelte spells that value two ways depending on the node — a bare
- * `ExpressionTag` for `onclick={…}`, a one-element array of parts for
- * `style:--x={…}` — and both mean the same thing here.
- */
-function soleExpression(text: string, value: unknown): string | null {
-	const parts = Array.isArray(value) ? value : [value];
-	if (parts.length !== 1) return null;
-	const part = parts[0] as Node | null;
-	if (!part || part.type !== 'ExpressionTag') return null;
-	return stripTypes(text.slice(part.expression.start, part.expression.end));
-}
-
-/**
- * The source of a DOM handler on that element, e.g. `onkeydown`.
- *
- * An absent handler is a no-op rather than an assertion failure, deliberately.
- * Asserting here builds the whole harness on the presence of an attribute, so
- * deleting one turns every test in the file red with the same structural
- * message — including the fences, whose entire job is to stay green — and none
- * of them would then be evidence about behaviour. A handler that is not there
- * does nothing when the user's event arrives, which is exactly what a no-op
- * models, and each test fails on its own claim: "Escape left the popover open".
- */
-function handlerSourceIn(text: string, node: Node, name: string): string {
-	const attribute = node.attributes?.find((a: Node) => a.type === 'Attribute' && a.name === name);
-	return soleExpression(text, attribute?.value) ?? '(() => {})';
-}
-
-function handlerSource(node: Node, name: string): string {
-	return handlerSourceIn(source, node, name);
-}
-
-/**
- * The expression of a `class:`/`style:` directive, or a literal that stands for
- * "the directive is not there" — `false` for a class, `undefined` for a style.
- *
- * Same reasoning as `handlerSource`: an absent directive is modelled as the
- * value the element would really have without it, so the test that cares fails
- * on its own claim ("the strip carried no scope line while a tag was set")
- * rather than on a missing attribute name.
- */
-function directiveSource(node: Node, type: 'ClassDirective' | 'StyleDirective', name: string): string {
-	const directive = node.attributes?.find((a: Node) => a.type === type && a.name === name);
-	if (!directive) return type === 'ClassDirective' ? 'false' : 'undefined';
-	if (type === 'ClassDirective') return stripTypes(source.slice(directive.expression.start, directive.expression.end));
-	const expression = soleExpression(source, directive.value);
-	if (expression) return expression;
-	// A static `style:x="literal"` — the text as written, quoted.
-	const parts: Node[] = Array.isArray(directive.value) ? directive.value : [directive.value];
-	return JSON.stringify(parts.map((part) => part?.data ?? '').join(''));
-}
-
-/** The one `<name>` element under `root`. */
-function elementByTag(root: Node, name: string): Node {
-	const found: Node[] = [];
-	collect(root, (node) => {
-		if (node.type === 'RegularElement' && node.name === name) found.push(node);
-	});
-	assert.equal(found.length, 1, `expected exactly one <${name}> under the subtree, found ${found.length}`);
-	return found[0];
-}
-
-/**
- * The one element under `root` whose `onclick` source contains `marker`, or an
- * empty stand-in when there is none — a control that is not rendered does
- * nothing when it is clicked and renders under no condition, which is what the
- * stand-in models. Same reasoning as `handlerSourceIn`.
- */
-function elementByHandler(root: Node, marker: string): Node {
-	const found: Node[] = [];
-	collect(root, (node) => {
-		if (node.type !== 'RegularElement' || node === root) return;
-		if (handlerSource(node, 'onclick').includes(marker)) found.push(node);
-	});
-	assert.ok(found.length <= 1, `expected at most one element under the subtree whose onclick contains ${JSON.stringify(marker)}, found ${found.length}`);
-	return found[0] ?? { type: 'RegularElement', attributes: [] };
-}
-
-/**
- * The test of the innermost `{#if}` wrapping `node` — what has to hold for the
- * element to be on screen at all — or `false` for an element that is not in the
- * markup.
- */
-function enclosingIfTest(node: Node): string {
-	if (typeof node.start !== 'number') return 'false';
-	let innermost: Node | null = null;
-	collect(fragment, (candidate) => {
-		if (candidate.type !== 'IfBlock') return;
-		if (candidate.start > node.start || candidate.end < node.end) return;
-		if (!innermost || candidate.start > innermost.start) innermost = candidate;
-	});
-	const block = innermost as Node | null;
-	return block ? stripTypes(source.slice(block.test.start, block.test.end)) : 'true';
-}
-
-/** The one `{…}` an element renders as its whole content, if that is all it has. */
-function textExpression(node: Node): string {
-	const tags = (node.fragment?.nodes ?? []).filter((child: Node) => child.type === 'ExpressionTag');
-	if (tags.length !== 1) return "''";
-	return stripTypes(source.slice(tags[0].expression.start, tags[0].expression.end));
-}
-
-/** The initialiser of a top-level `const`, evaluated. */
-function constantValue(name: string): unknown {
-	const found: Node[] = [];
-	collect(parse(source, { modern: true, filename: TITLE_BAR }).instance, (node) => {
-		if (node.type === 'VariableDeclarator' && node.id?.type === 'Identifier' && node.id.name === name && node.init) {
-			found.push(node.init);
-		}
-	});
-	assert.equal(found.length, 1, `expected exactly one \`${name}\` declaration in ${TITLE_BAR}`);
-	return new Function(`return (${source.slice(found[0].start, found[0].end)});`)();
-}
-
-/** Every declaration of the one rule whose selector list is exactly `selector`. */
-export function styleRule(file: string, selector: string): Map<string, string> {
-	const text = readSource(file);
-	const css = parse(text, { modern: true, filename: file }).css as Node | null;
-	const rules = (css?.children ?? []).filter(
-		(child: Node) => child.type === 'Rule' && text.slice(child.prelude.start, child.prelude.end).trim() === selector,
-	);
-	assert.ok(rules.length <= 1, `expected at most one \`${selector}\` rule in ${file}, found ${rules.length}`);
-	const declarations = new Map<string, string>();
-	for (const child of rules[0]?.block?.children ?? []) {
-		if (child.type === 'Declaration') declarations.set(child.property, child.value);
-	}
-	return declarations;
-}
-
-/** The `$effect` that installs the window-level dismissal listeners. */
-const dismissEffectBody = (() => {
-	const bodies = callbackBodies(source, '$effect').filter((body) => body.includes('handleGlobalDismiss'));
-	assert.equal(bodies.length, 1, `expected exactly one $effect wiring handleGlobalDismiss, found ${bodies.length}`);
-	return bodies[0];
-})();
-
-// ------------------------------------------------------------------- harness
-
-type WindowStub = {
-	listeners: Map<string, () => void>;
-	addEventListener: (type: string, fn: () => void) => void;
-	removeEventListener: (type: string, fn: () => void) => void;
-};
-
-type ClickHandler = (event: { stopPropagation: () => void }) => void;
-
-type MouseEventStub = {
-	preventDefault: () => void;
-	stopPropagation: () => void;
-};
-
-type InvokeCall = { cmd: string; args: any };
-
-export type TitleBar = {
-	state: () => {
-		tagEditorOpen: boolean;
-		tagDraftName: string;
-		tagDraftColor: string;
-		tagError: string;
-		homeMenuOpen: boolean;
-	};
-	setDraft: (name: string, color: string) => void;
-	typeName: (name: string) => void;
-	openHomeMenu: () => void;
-	openTagEditor: () => void;
-	applyTag: () => Promise<void>;
-	chipClick: ClickHandler;
-	chipContextMenu: (event: MouseEventStub) => void;
-	pinClick: ClickHandler;
-	pinLabel: () => unknown;
-	pinRendered: () => unknown;
-	removeClick: ClickHandler;
-	removeRendered: () => unknown;
-	closeRendered: () => unknown;
-	editorClick: ClickHandler;
-	editorKeydown: (event: { key: string }) => void;
-	homeMenuTagItemClick: ClickHandler;
-	homeMenuClick: ClickHandler;
-	tabAreaTagged: () => unknown;
-	tabAreaTagColor: () => unknown;
-	dismissEffect: () => (() => void) | undefined;
-};
-
-function createTitleBar(windowStub: WindowStub, invoke: (cmd: string, args: any) => Promise<unknown>): TitleBar {
-	const tabArea = element('tab-area');
-	const editor = element('tag-editor');
-	const pin = elementByHandler(editor, 'togglePinnedTag');
-	const remove = elementByHandler(editor, 'clearTag');
-	const close = elementByHandler(editor, 'onclosetag');
-	const factory = new Function(
-		'tabManager',
-		'tagColors',
-		'invoke',
-		'window',
-		'hasRealFilePath',
-		't',
-		'currentLanguage',
-		`
-		let tagEditorOpen = false;
-		let tagDraftName = '';
-		let tagDraftColor = tagColors[1];
-		let tagError = '';
-		let themeMenuOpen = false;
-		let kebabMenuOpen = false;
-		let homeMenuOpen = false;
-
-		${runnable('openTagEditor')}
-		${runnable('tagNameTakenElsewhere')}
-		${runnable('applyTag')}
-		${runnable('openTagEditorFromContextMenu')}
-		${runnable('clearTag')}
-		${runnable('togglePinnedTag')}
-		${runnable('handleGlobalDismiss')}
-
-		return {
-			state: () => ({ tagEditorOpen, tagDraftName, tagDraftColor, tagError, homeMenuOpen }),
-			setDraft: (name, color) => { tagDraftName = name; tagDraftColor = color; },
-			typeName: (name) => { tagDraftName = name; (${handlerSource(elementByTag(editor, 'input'), 'oninput')})(); },
-			openHomeMenu: () => { homeMenuOpen = true; },
-			openTagEditor,
-			applyTag,
-			chipClick: ${handlerSource(element('window-tag-chip'), 'onclick')},
-			chipContextMenu: ${handlerSource(element('window-tag-chip'), 'oncontextmenu')},
-			pinClick: ${handlerSource(pin, 'onclick')},
-			pinLabel: () => (${textExpression(pin)}),
-			pinRendered: () => (${enclosingIfTest(pin)}),
-			removeClick: ${handlerSource(remove, 'onclick')},
-			removeRendered: () => (${enclosingIfTest(remove)}),
-			closeRendered: () => (${enclosingIfTest(close)}),
-			editorClick: ${handlerSource(editor, 'onclick')},
-			editorKeydown: ${handlerSource(editor, 'onkeydown')},
-			homeMenuTagItemClick: ${handlerSource(elementByHandler(element('home-dropdown-menu'), 'openTagEditor()'), 'onclick')},
-			homeMenuClick: ${handlerSource(element('home-dropdown-menu'), 'onclick')},
-			tabAreaTagged: () => (${directiveSource(tabArea, 'ClassDirective', 'tagged')}),
-			tabAreaTagColor: () => (${directiveSource(tabArea, 'StyleDirective', '--tag-color')}),
-			dismissEffect: () => ${dismissEffectBody},
-		};
-		`,
-	) as (...args: unknown[]) => TitleBar;
-
-	return factory(tabManager, constantValue('tagColors'), invoke, windowStub, hasRealFilePath, t, 'en');
-}
-
-export const COLORS = constantValue('tagColors') as string[];
-
-type SetupOptions = {
-	/** Answers `is_window_tag_taken`; every other command resolves to null. */
-	tagTakenElsewhere?: boolean | (() => boolean | Promise<boolean>);
-	/** Fails every `invoke`, to drive the "backend cannot answer" path. */
-	invokeFails?: boolean;
-	/** Answers `rename_pinned_tag`. */
-	pinRename?: 'renamed' | 'missing' | 'taken';
-	/** Answers `save_pinned_tag`: `false` when another pin holds the name. */
-	pinCreated?: boolean;
-};
-
-export function setup(options: SetupOptions = {}) {
-	const listeners = new Map<string, () => void>();
-	const windowStub: WindowStub = {
-		listeners,
-		addEventListener: (type, fn) => void listeners.set(type, fn),
-		removeEventListener: (type, fn) => {
-			if (listeners.get(type) === fn) listeners.delete(type);
-		},
-	};
-
-	const invokeCalls: InvokeCall[] = [];
-	const invoke = (cmd: string, args: any) => {
-		invokeCalls.push({ cmd, args });
-		if (options.invokeFails) return Promise.reject(new Error(`invoke failed: ${cmd}`));
-		if (cmd === 'rename_pinned_tag') return Promise.resolve(options.pinRename ?? 'renamed');
-		if (cmd === 'save_pinned_tag') return Promise.resolve(options.pinCreated ?? true);
-		if (cmd !== 'is_window_tag_taken') return Promise.resolve(null);
-		const answer = options.tagTakenElsewhere ?? false;
-		return Promise.resolve(typeof answer === 'function' ? answer() : answer);
-	};
-
-	tabManager.setWindowTag(null);
-	const bar = createTitleBar(windowStub, invoke);
-	let cleanup: (() => void) | undefined;
-
-	/** Re-run the effect the way Svelte does: previous teardown, then the body. */
-	const flush = () => {
-		cleanup?.();
-		cleanup = bar.dismissEffect();
-	};
-
-	/**
-	 * One click, dispatched along a bubble path: target handler first, then each
-	 * ancestor's, then `window` — unless something on the way called
-	 * `stopPropagation`.
-	 *
-	 * The path matters because the effect that installs `handleGlobalDismiss`
-	 * runs before the click has finished bubbling, so the window listener sees
-	 * the very click that opened the popover. That is why the chip stops
-	 * propagation, and why a menu item that opens the tag editor is safe only if
-	 * something above it does. Modelling the path is the only way a test can
-	 * tell a working entry point from one that opens the popover and dismisses
-	 * it again in the same click.
-	 *
-	 * The listener is re-read after `flush()` but falls back to the one already
-	 * installed before the click, so both orderings — a listener present because
-	 * another popover was open, and one installed by this very click — reach the
-	 * same `handleGlobalDismiss`.
-	 */
-	const clickPath = (...handlers: ClickHandler[]) => {
-		const installed = listeners.get('click');
-		let stopped = false;
-		for (const handler of handlers) {
-			if (stopped) break;
-			handler({ stopPropagation: () => void (stopped = true) });
-		}
-		flush();
-		if (!stopped) (listeners.get('click') ?? installed)?.();
-	};
-
-	/** A click anywhere the component does not handle. */
-	const clickOutside = () => {
-		flush();
-		listeners.get('click')?.();
-	};
-
-	/**
-	 * A right-click on the chip, along the same bubble path as `clickPath`: the
-	 * chip's own handler first, then the window `contextmenu` listener unless
-	 * something stopped propagation. That listener is `handleGlobalDismiss`, so
-	 * a right-click that reaches it opens the popover and dismisses it again in
-	 * one gesture — which is what makes the path, rather than the handler
-	 * alone, the thing worth running.
-	 */
-	const rightClick = () => {
-		let stopped = false;
-		let defaultPrevented = false;
-		const installed = listeners.get('contextmenu');
-		bar.chipContextMenu({
-			preventDefault: () => void (defaultPrevented = true),
-			stopPropagation: () => void (stopped = true),
-		});
-		flush();
-		if (!stopped) (listeners.get('contextmenu') ?? installed)?.();
-		return { defaultPrevented, stopped };
-	};
-
-	return { bar, listeners, invokeCalls, flush, clickPath, clickOutside, rightClick };
-}
-
-/** Let a handler's pending microtasks run before asserting on what it wrote. */
-export const settle = () => new Promise<void>((resolve) => setTimeout(resolve, 0));
diff --git a/scripts/windows.checks.spec.ts b/scripts/windows.checks.spec.ts
deleted file mode 100644
index 451eb03d..00000000
--- a/scripts/windows.checks.spec.ts
+++ /dev/null
@@ -1,276 +0,0 @@
-import assert from 'node:assert/strict';
-
-import { describe, test } from 'vitest';
-
-import { parse } from 'svelte/compiler';
-
-import { readSource } from './sourceTree.js';
-
-/*
- * Issue #392, second half (reported by @PathGao): "the Home tab it opens
- * renders blank".
- *
- * MarkdownViewer.svelte draws the whole application body from one `{#if}`:
- * the consequent is the markdown container (editor + preview), the alternate
- * is `<HomePage>`. The home screen therefore appears only when that condition
- * is FALSE, and the condition was
- *
- *     activeTab && (activeTab.path !== '' || activeTab.title !== 'Recents') && !showHome
- *
- * which is a description of a tab that no longer exists. When the gate was
- * written (0694991, 24 Jan) the home tab really was `{ path: '', title:
- * 'Recents' }`, so both halves went false and the alternate ran. A week later
- * edfb555 changed it to `{ path: 'HOME', title: 'Home' }` — a commit about
- * scroll position, which happened to pass through the tab store — and the two
- * halves became permanently true. From then on the home tab fell into the
- * markdown container and rendered an empty document. The later i18n pass
- * turned the title into `t('tabs.home', lang)`, which merely made the dead
- * half unrecoverable in 26 languages instead of one.
- *
- * Nothing could see that coupling: a template string compared against a
- * localised title is invisible to the compiler, to `npm run check`, and to
- * every test that imports the store rather than reading the component.
- *
- * So this file reads the REAL gate. It parses the component, finds the `{#if}`
- * whose `{:else}` renders `<HomePage>`, and evaluates that exact expression
- * against the REAL `TabManager`. It asserts nothing about how the condition is
- * spelled — rewrite it any way that keeps the home tab out of the document
- * container and these tests stay green.
- *
- * What this does not establish: that `<HomePage>` itself renders anything
- * useful, or anything about CSS. It establishes which branch the app takes.
- */
-
-// ---------------------------------------------------------------- environment
-// Svelte runes and the Tauri bridge, faked exactly as homeSentinelSnapshot.ts
-// does, so `tabs.svelte.ts` and `settings.svelte.ts` import under plain node.
-
-// The runes are the compiler's, not ours: vitest builds `.svelte.ts` through the
-// Svelte plugin, so the store and the session run under real reactivity, and jsdom
-// supplies `window` and `localStorage`. Only the Tauri backend is stubbed.
-(window as any).__TAURI_INTERNALS__ = {
-	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
-	invoke: (cmd: string) => Promise.resolve(cmd === 'get_os_type' ? 'macos' : null),
-};
-
-const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
-const { HOME_TAB_PATH, isHomePath } = await import('../src/lib/utils/homeTab.js');
-const { hasRealFilePath } = await import('../src/lib/utils/tabFileActions.js');
-const { getSupportedLanguages, t } = await import('../src/lib/utils/i18n.js');
-
-describe('the home tab renders the home screen', () => {
-	// ------------------------------------------------------- the gate, as written
-
-	const VIEWER = 'src/lib/MarkdownViewer.svelte';
-	const source = readSource(VIEWER);
-
-	type Node = Record<string, any>;
-
-	function collect(node: unknown, hit: (node: Node) => void): void {
-		if (!node || typeof node !== 'object') return;
-		if (Array.isArray(node)) {
-			for (const child of node) collect(child, hit);
-			return;
-		}
-		hit(node as Node);
-		for (const key of Object.keys(node as Node)) {
-			if (key === 'parent') continue;
-			collect((node as Node)[key], hit);
-		}
-	}
-
-	/**
-	 * Every `{#if}` whose `{:else}` branch renders `<HomePage>`, and which is not
-	 * merely an ancestor of one that does.
-	 *
-	 * The whole component body sits inside the `mode === 'loading' / 'installer' /
-	 * 'uninstall'` chain, so those outer blocks contain `<HomePage>` too. Only the
-	 * innermost one is the gate — the one that actually decides between the home
-	 * screen and a document.
-	 */
-	function homeScreenGates(): Node[] {
-		const ast = parse(source, { modern: true, filename: VIEWER });
-		const rendersHomePage = (node: Node) => {
-			let found = false;
-			collect(node, (inner) => {
-				if (inner.type === 'Component' && inner.name === 'HomePage') found = true;
-			});
-			return found;
-		};
-
-		const candidates: Node[] = [];
-		collect(ast.fragment, (node) => {
-			if (node.type === 'IfBlock' && node.alternate && rendersHomePage(node.alternate)) candidates.push(node);
-		});
-
-		return candidates.filter((gate) => {
-			let nested = false;
-			collect(gate.alternate, (inner) => {
-				if (inner !== gate && candidates.includes(inner)) nested = true;
-			});
-			return !nested;
-		});
-	}
-
-	const gateNode = (() => {
-		const gates = homeScreenGates();
-		assert.equal(
-			gates.length,
-			1,
-			`expected exactly one {#if} in ${VIEWER} whose {:else} renders <HomePage>, found ${gates.length} — ` +
-				'if the home screen moved out of this branch, move these tests with it',
-		);
-		return gates[0];
-	})();
-
-	const gateSource = source.slice(gateNode.test.start, gateNode.test.end);
-
-	/**
-	 * The gate as a callable, over whatever it happens to reference today.
-	 *
-	 * Free identifiers are read off the parsed expression rather than hard-coded,
-	 * so a rewrite that uses a different helper fails with "the gate references X"
-	 * instead of a bare ReferenceError from inside `new Function`.
-	 */
-	const evaluateGate = (() => {
-		const names = new Set<string>();
-		const skip = new Set<unknown>();
-		collect(gateNode.test, (node) => {
-			if (node.type === 'MemberExpression' && !node.computed) skip.add(node.property);
-			if (node.type === 'Property' && !node.computed) skip.add(node.key);
-		});
-		collect(gateNode.test, (node) => {
-			if (node.type === 'Identifier' && !skip.has(node)) names.add(node.name);
-		});
-
-		const available: Record<string, unknown> = { tabManager, isHomePath, hasRealFilePath };
-		const ordered = [...names].sort();
-		for (const name of ordered) {
-			if (name === 'showHome') continue;
-			assert.ok(
-				name in available,
-				`the home-screen gate references \`${name}\`, which these tests cannot supply — ` +
-					`add it to \`available\` in ${'scripts/homeTabRender.test.ts'} so the gate can still be evaluated`,
-			);
-		}
-
-		const params = ordered.filter((name) => name !== 'showHome');
-		const body = `return Boolean(${gateSource});`;
-		const fn = new Function('showHome', ...params, body) as (showHome: boolean, ...rest: unknown[]) => boolean;
-		return (showHome: boolean) => fn(showHome, ...params.map((name) => available[name]));
-	})();
-
-	/** True when the app draws the document container; false when it draws HomePage. */
-	const showsDocumentContainer = (showHome = false) => evaluateGate(showHome);
-
-	function reset() {
-		tabManager.closeAll();
-		localStorage.clear();
-	}
-
-	// --------------------------------------------------------------- the regression
-
-	test('the home tab renders the home screen, not an empty document', () => {
-		reset();
-		tabManager.addHomeTab();
-
-		assert.equal(tabManager.activeTab?.path, HOME_TAB_PATH, 'precondition: the home tab is active');
-		assert.equal(
-			showsDocumentContainer(),
-			false,
-			'the active home tab fell into the markdown container instead of the {:else} branch that ' +
-				`renders <HomePage> — the user sees a blank page. Gate: ${gateSource}`,
-		);
-	});
-
-	test('a home tab opened next to files still renders the home screen', () => {
-		// Ctrl+T from a window that already has documents open — the reported path.
-		reset();
-		tabManager.addTab('/notes/a.md');
-		tabManager.addTab('/notes/b.md');
-		tabManager.addHomeTab();
-
-		assert.equal(showsDocumentContainer(), false, `blank home tab alongside open files. Gate: ${gateSource}`);
-	});
-
-	test('the home screen is reached by tab kind, never by the tab title', () => {
-		// The dead half of the old gate. `title` is user-facing text: localised,
-		// and for a file tab it is just a filename, so a document called
-		// `Recents` used to be enough to hide the editor. Nothing about which
-		// branch runs may depend on it.
-		reset();
-		tabManager.addHomeTab();
-		const home = tabManager.activeTab!;
-
-		for (const { code } of getSupportedLanguages()) {
-			home.title = t('tabs.home', code);
-			assert.equal(showsDocumentContainer(), false, `the home screen disappears in locale ${code}`);
-		}
-
-		home.title = 'Recents';
-		assert.equal(showsDocumentContainer(), false, 'the pre-i18n English title must not be what makes this work');
-
-		reset();
-		tabManager.addTab('/notes/Recents');
-		assert.equal(showsDocumentContainer(), true, 'a document named Recents is a document');
-	});
-
-	// ---------------------------------------------------------------- the neighbours
-	//
-	// The three states that already worked. They are the fence: a gate that simply
-	// always chose HomePage would pass the tests above and fail every one of these.
-
-	test('a saved file renders the document container', () => {
-		reset();
-		tabManager.addTab('/notes/a.md');
-
-		assert.equal(showsDocumentContainer(), true);
-	});
-
-	test('an untitled buffer renders the document container', () => {
-		// The distinction the fix rests on: an untitled tab has no file either, so
-		// `hasRealFilePath` is false for both — but it IS a document, and gating on
-		// that predicate would have hidden the editor for every new file.
-		reset();
-		tabManager.addNewTab();
-
-		assert.equal(tabManager.activeTab?.path, '', 'precondition: an untitled tab has no path');
-		assert.equal(hasRealFilePath(''), false, 'precondition: and no real file either');
-		assert.equal(isHomePath(''), false, 'but it is not the home tab');
-		assert.equal(showsDocumentContainer(), true, 'a new file must still get an editor');
-	});
-
-	test('an empty window renders the home screen', () => {
-		reset();
-
-		assert.equal(tabManager.activeTab, undefined);
-		assert.equal(showsDocumentContainer(), false);
-	});
-
-	test('the Home toolbar button still overlays the home screen on any tab', () => {
-		// `showHome` is the other, older route to the same screen: a transient flag
-		// set by the toolbar/menu item, independent of any tab. It must keep
-		// winning over whatever tab is active.
-		reset();
-		tabManager.addTab('/notes/a.md');
-		assert.equal(showsDocumentContainer(true), false, 'a file tab with showHome set');
-
-		tabManager.addNewTab();
-		assert.equal(showsDocumentContainer(true), false, 'an untitled tab with showHome set');
-
-		tabManager.addHomeTab();
-		assert.equal(showsDocumentContainer(true), false, 'the home tab with showHome set');
-	});
-
-	test('switching from the home tab back to a file returns to the document', () => {
-		reset();
-		tabManager.addTab('/notes/a.md');
-		const file = tabManager.activeTab!.id;
-		tabManager.addHomeTab();
-		assert.equal(showsDocumentContainer(), false);
-
-		tabManager.setActive(file);
-
-		assert.equal(showsDocumentContainer(), true, 'the document container must come back');
-	});
-});
diff --git a/scripts/windows.checks.test.ts b/scripts/windows.checks.test.ts
index 1e20372f..601cd12f 100644
--- a/scripts/windows.checks.test.ts
+++ b/scripts/windows.checks.test.ts
@@ -1,137 +1,21 @@
 import assert from 'node:assert/strict';
-import { existsSync } from 'node:fs';
 import { describe, test } from 'node:test';
 
-import ts from 'typescript';
-
-import { reviewDirtyTabs } from '../src/lib/sessions/closeReview.js';
-import { isHomePath } from '../src/lib/utils/homeTab.js';
-import { openPinnedTagWindow, pinnedTagFromWindowLabel, pinnedWindowToken } from '../src/lib/utils/pinnedTagWindow.js';
-import { hasRealFilePath } from '../src/lib/utils/tabFileActions.js';
-import { viewerCommandFor } from '../src/lib/utils/viewerKeymap.js';
 import {
 	filesMatching,
 	functionSource,
-	offsetOf,
 	readRustBackend,
 	readSource,
 	readSourceFiles,
-	sliceBetween,
-	sliceFrom,
 } from './sourceTree.js';
 
-// Window close (issue #189): instead of one aggregate "you have N unsaved
-// files" modal, the red close button walks the dirty tabs one at a time —
-// activating each and showing the SAME localized unsaved-changes dialog a
-// single tab close shows (canCloseTab). Cancel stops the walk; the window
-// stays open with the remaining tabs.
-describe('the window close handler', () => {
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-	const documentSessionPath = 'src/lib/sessions/documentSession.svelte.ts';
-	const documentSession = existsSync(documentSessionPath) ? readSource(documentSessionPath) : '';
-
-	function closeHandler(): string {
-		return sliceBetween(viewer, 'appWindow.onCloseRequested', 'onDragDropEvent');
-	}
-
-	/** The walk and the snapshot, which the in-app update runs too (#761). */
-	function settle(): string {
-		return functionSource(viewer, 'settleForExit');
-	}
-
-	test('the aggregate unsaved-files modal is gone from the close handler', () => {
-		for (const scope of [closeHandler(), settle()]) {
-			assert.doesNotMatch(scope, /youHaveUnsavedFiles/);
-			// and the old "clear all dirty flags then close" discard path with it.
-			// Pinned as the assignment rather than as the `forEach` one-liner it was
-			// written in: the same silent discard spelled `for (const t of
-			// tabManager.tabs) t.isDirty = false;` passed the old regex, and the walk
-			// below then found nothing to review.
-			assert.doesNotMatch(scope, /\.isDirty\s*=\s*false/);
-		}
-	});
-
-	test('the close is prevented synchronously before the walk starts', () => {
-		const handler = closeHandler();
-		// Not the re-entry guard's `preventDefault`: the one between that guard and
-		// the walk.
-		const guardEnd = offsetOf(handler, 'return;', offsetOf(handler, 'if (isCloseWalkActive)'));
-		const walk = offsetOf(handler, 'await settleForExit(');
-		const prevent = handler.lastIndexOf('event.preventDefault()', walk);
-		assert.ok(guardEnd < prevent, 'the close is prevented before the walk starts');
-		assert.match(settle(), /reviewDirtyTabs\(\{/, 'and the walk is what settleForExit runs');
-	});
-
-	test('the window closes only after every dirty tab is resolved', () => {
-		const handler = closeHandler();
-		const walk = offsetOf(handler, 'await settleForExit(');
-		const close = offsetOf(handler, 'appWindow.close()', walk);
-		assert.ok(walk < close, 'the window closes after the walk, not during it');
-	});
-
-	test('a cancelled walk stops the handler before it persists or closes', () => {
-		const body = settle();
-		const walk = offsetOf(body, 'reviewDirtyTabs({');
-		const bail = offsetOf(body, 'return false;', offsetOf(body, 'if (!resolved)', walk));
-		assert.ok(bail < offsetOf(body, 'persistWindowState(', walk), 'cancel returns before the snapshot');
-
-		const handler = closeHandler();
-		const stop = offsetOf(handler, 'return;', offsetOf(handler, 'if (!(await settleForExit(endsSession))) {'));
-		assert.ok(stop < offsetOf(handler, 'appWindow.close()', stop), 'and before the close is re-triggered');
-	});
-
-	test('a second close request cannot start a competing walk', () => {
-		// The native red button bypasses the dialog overlay; re-entry must be
-		// swallowed while a walk is active, or two walks fight over setActive
-		// and the highlighted tab stops matching the dialog.
-		assert.match(closeHandler(), /if \(isCloseWalkActive\) \{\s*event\.preventDefault\(\);\s*return;\s*\}/);
-		// and the flag is always released, even when the user cancels mid-walk
-		assert.match(settle(), /finally \{\s*isCloseWalkActive = false;\s*\}/);
-	});
-
-	test('the walk proceeds in strict tab-strip order', () => {
-		// Which tab is next is the component's half of the walk: the order comes
-		// from the tab array, and an active-first shortcut made the sequence look
-		// random to the reader. The walking itself is covered above.
-		const body = settle();
-		assert.match(body, /nextDirtyTab: \(\) => tabManager\.tabs\.find\(\(t\) => t\.isDirty\)/);
-		assert.doesNotMatch(body, /active\?\.isDirty/);
-	});
-
-	test('the untitled save dialog prefills the numbered tab title', () => {
-		const scope = sliceBetween(documentSession, 'async function saveContent', 'async function saveContentAs');
-		assert.match(scope, /defaultPath: tab\.title/);
-	});
-
-	test('save-as writes a snapshot rather than the buffer as it stands', () => {
-		// The other half — that a keystroke landing during that write is still
-		// unsaved afterwards — is `isDirty` reading the two buffers, and it runs
-		// for real in documents.save.spec.ts.
-		const fn = sliceFrom(documentSession, 'async function saveContentAs');
-		assert.match(fn, /const snapshot = tab\.rawContent;/);
-	});
-
-	test('the restore-on-reopen branch persists window state via the shared helper', () => {
-		assert.match(settle(), /persistWindowState\(await remember\(\)\);/);
-		// no durable-write experiment left behind
-		assert.doesNotMatch(viewer, /saveSessionState|sessionState\.js/);
-	});
-});
-
-// The window-state plugin saves only on a clean exit, so after a crash every
-// window came back at its default size. Moving or resizing a window has to
-// reach the plugin's save while the app runs. Needs a live window to execute;
-// the 500 ms bound is `coalesced`, tested in Rust.
+// The plugin's builder flags cannot be read back, and the mock runtime keeps no
+// window geometry, so this pairing stays a source check. The move/resize save
+// itself is tested in Rust (`a_move_or_resize_schedules_a_geometry_save`,
+// `setup_manages_the_geometry_saver`).
 describe('window geometry is saved while the app runs', () => {
 	const rust = readRustBackend();
 
-	test('a move or resize schedules a geometry save', () => {
-		const handler = sliceBetween(rust, 'pub fn handle_window_event', 'tauri::WindowEvent::Focused(true)');
-		assert.match(handler, /WindowEvent::Moved\(_\) \| tauri::WindowEvent::Resized\(_\)/);
-		assert.match(handler, /try_state::<GeometrySaver>\(\)/);
-		assert.match(rust, /app\.manage\(window_runtime::GeometrySaver::new\(/);
-	});
-
 	test('the running save and the plugin keep the same fields', () => {
 		assert.match(rust, /\.with_state_flags\(window_runtime::geometry_flags\(\)\)/);
 		assert.match(rust, /app\.save_window_state\(geometry_flags\(\)\)/);
@@ -139,41 +23,6 @@ describe('window geometry is saved while the app runs', () => {
 });
 
 describe('moving tabs between windows', () => {
-	const runtime = readSource('src-tauri/src/window_runtime.rs');
-	const session = readSource('src/lib/sessions/windowSession.svelte.ts');
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-	const tab = readSource('src/lib/components/Tab.svelte');
-	const titleBar = readSource('src/lib/components/TitleBar.svelte');
-
-	test('the runtime registers live viewer windows in stable creation order', () => {
-		assert.match(runtime, /window_counter/);
-		assert.match(runtime, /pub fn set_window_meta/);
-		assert.match(runtime, /pub fn list_viewer_windows/);
-		assert.match(runtime, /list\.sort_by_key\(\|entry\| entry\.meta\.number\)/);
-
-		// Deregistration, read inside the arm that has to do it. The previous form
-		// was `/window_registry[\s\S]*?remove\(window\.label\(\)\)/` over the whole
-		// file: `window_registry` is the struct field at the top, `remove(window
-		// .label())` is the *watcher* cleanup ~430 lines down, and nothing required
-		// the two to be one statement. Measured — deleting the registry removal from
-		// the `Destroyed` arm left the suite green, and every closed window stayed in
-		// `list_viewer_windows` as a transfer target that no longer exists.
-		const destroyed = sliceBetween(runtime, 'tauri::WindowEvent::Destroyed => {', '\n        }');
-		assert.match(
-			destroyed,
-			/window_registry\)\.remove\(window\.label\(\)\)/,
-			'a destroyed window must be deregistered, or it is still offered as a move target',
-		);
-	});
-
-	test('moving to an existing window uses the acknowledged transfer protocol', () => {
-		assert.match(session, /async function transfer\(/);
-		assert.match(session, /invoke\('complete_detached_tab', \{ token \}\)/);
-		assert.match(session, /onTransferClaimed\(tabId\)/);
-		assert.match(session, /async function acceptOfferedTransfer/);
-		assert.match(viewer, /invoke\('offer_tab_to_window', \{ targetLabel, token \}\)/);
-	});
-
 	// `WebviewWindowBuilder::build()` deadlocks when called from a
 	// *synchronous* Tauri command on Windows/WebView2, because the main thread is
 	// blocked inside the command while WebView2 waits for that same thread to pump
@@ -187,24 +36,6 @@ describe('moving tabs between windows', () => {
 		assert.match(lib, /#\[tauri::command\]\n(?:pub )?async fn create_transfer_window\(/);
 		assert.doesNotMatch(lib, /#\[tauri::command\]\n(?:pub )?fn create_transfer_window\(/);
 	});
-
-	test('window organization exposes move, merge, and carry actions', () => {
-		assert.match(tab, /list_viewer_windows/);
-		assert.match(tab, /menu-tab-move/);
-		assert.match(viewer, /async function mergeAllWindowsHere/);
-		assert.match(viewer, /async function carryActiveTabToNextWindow/);
-		// The chord itself moved to `viewerKeymap.ts`, so it is asked rather
-		// than matched — and the answer names the command, not the local variable the
-		// branch happened to be written with.
-		assert.equal(
-			viewerCommandFor(
-				{ key: 'm', code: 'KeyM', ctrlKey: true, metaKey: false, shiftKey: true, altKey: false },
-				{ mode: 'app', osType: 'windows', isSplit: false, overlayOpen: false, dialogOpen: false, isEditing: false, editorHasFocus: false },
-			),
-			'move-tab-to-next-window',
-		);
-		assert.match(titleBar, /onmergeAllWindows/);
-	});
 });
 
 describe('startup keeps the window handle it built', () => {
@@ -263,254 +94,9 @@ describe('windows are equal views of one session', () => {
 	});
 });
 
-/*
- * A pinned tag's file list is written when its window ends. Every way of ending
- * a window closes tabs on the way — the last tab's ×, the close review with
- * restore off, a merge into another window — and the pin used to be written
- * after they were gone, so Home showed the group with no files.
- *
- * The window-ending functions are lifted out of MarkdownViewer.svelte and RUN
- * against a stub window; what is asserted is the last list sent to
- * `update_pinned_tag`.
- */
-
-describe('a pinned tag keeps its files when its window ends', () => {
-	const LIFTED = [
-		'openFilePaths',
-		'savePinnedTagIfNeeded',
-		'closeTabAndWindowIfLast',
-		'destroyWindowAfterTabsClosed',
-		'settleForExit',
-		'settleForUpdate',
-		'mergeSelfInto',
-		'openPinnedTag',
-	];
-
-	type Tab = { id: string; path: string; isDirty: boolean };
-
-	function pinnedWindow(tabs: Tab[], settings: { closeWindowWithLastTab?: boolean; restoreStateOnReopen?: boolean } = {}) {
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		const source = LIFTED.map((name) => functionSource(viewer, name)).join('\n');
-		const js = ts.transpileModule(source, {
-			compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext },
-		}).outputText;
-
-		const saves: string[][] = [];
-		// Whether the pin file still has this window's entry. Another window can
-		// unpin the tag from Home while this one holds it.
-		const pin = { exists: true };
-		const calls: string[] = [];
-		const loaded: string[] = [];
-		let destroyed = false;
-		const closeTab = (id: string) => {
-			const at = tabs.findIndex((tab) => tab.id === id);
-			if (at !== -1) tabs.splice(at, 1);
-		};
-		const tabManager = {
-			tabs,
-			windowTag: { name: 'work', color: '#f00', pinned: true } as object | null,
-			closeTab,
-			setActive: () => {},
-			setWindowTag: (tag: object | null) => void (tabManager.windowTag = tag),
-		};
-		const known: Record<string, unknown> = {
-			tabManager,
-			settings: { closeWindowWithLastTab: true, restoreStateOnReopen: false, autoSave: false, language: 'en', ...settings },
-			invoke: async (command: string, args?: { files?: string[]; token?: string }) => {
-				if (command === 'update_pinned_tag') {
-					saves.push([...args!.files!]);
-					return pin.exists;
-				}
-				if (command === 'save_pinned_tag') throw new Error('a closing window recreated its pin');
-				calls.push(args?.token ? `${command}:${pinnedTagFromWindowLabel(`window-${args.token}`)}` : command);
-			},
-			pinnedTagHolder: async () => undefined,
-			pinnedWindowToken,
-			loadMarkdown: async (file: string) => void loaded.push(file),
-			appWindow: { label: 'main', destroy: async () => void (destroyed = true) },
-			canCloseTab: async (id: string) => {
-				const tab = tabs.find((item) => item.id === id);
-				if (tab) tab.isDirty = false;
-				return true;
-			},
-			moveTabToWindow: async (id: string) => (closeTab(id), true),
-			persistWindowState: async () => {},
-			tick: async () => {},
-			reviewDirtyTabs,
-			hasRealFilePath,
-			isHomePath,
-			liveMode: false,
-			isCloseWalkActive: false,
-		};
-		// Anything else the functions keep between calls lands here, as it would
-		// on the component.
-		const scope = new Proxy(known, {
-			has: () => true,
-			get: (target, key) => (key in target ? target[key as string] : (globalThis as any)[key]),
-		});
-		const build = new Function('scope', `with (scope) { ${js}\nreturn { ${LIFTED.join(', ')} }; }`);
-		const fns = build(scope) as Record<string, (...args: any[]) => Promise<unknown>>;
-		return { fns, tabs, saves, pin, calls, loaded, tabManager, isDestroyed: () => destroyed };
-	}
-
-	const twoFiles = (): Tab[] => [
-		{ id: 'a', path: '/notes/a.md', isDirty: false },
-		{ id: 'b', path: '/notes/b.md', isDirty: false },
-	];
-
-	test('closing every tab with × keeps the last file in the pin', async () => {
-		const w = pinnedWindow(twoFiles());
-		await w.fns.closeTabAndWindowIfLast('a');
-		await w.fns.closeTabAndWindowIfLast('b');
-		assert.equal(w.isDestroyed(), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/b.md']);
-	});
-
-	test('with the window kept open, closing the empty window later does not empty the pin', async () => {
-		const w = pinnedWindow(twoFiles(), { closeWindowWithLastTab: false });
-		await w.fns.closeTabAndWindowIfLast('a');
-		await w.fns.closeTabAndWindowIfLast('b');
-		assert.equal(w.isDestroyed(), false);
-		assert.equal(await w.fns.settleForExit(async () => true), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/b.md']);
-	});
-
-	test('the close review with restore off keeps the dirty tabs it closes in the pin', async () => {
-		const tabs = twoFiles();
-		tabs[0].isDirty = true;
-		const w = pinnedWindow(tabs);
-		assert.equal(await w.fns.settleForExit(async () => true), true);
-		assert.deepEqual(w.tabs.map((tab) => tab.id), ['b'], 'the review closed the dirty tab');
-		// The handler re-triggers the close after a review, and settles again.
-		assert.equal(await w.fns.settleForExit(async () => true), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
-
-		// A window that lives on after that (an update that failed to install)
-		// saves what it has open, not the list the review started from.
-		w.tabs.push({ id: 'c', path: '/notes/c.md', isDirty: false });
-		assert.equal(await w.fns.settleForExit(async () => true), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/b.md', '/notes/c.md']);
-	});
-
-	test('an update whose install fails leaves no stale review list behind', async () => {
-		// The update settles like a close but is not followed by one: when the
-		// install fails the window stays, and a later last-tab close saved the
-		// list the update's review started from.
-		const tabs = twoFiles();
-		tabs[0].isDirty = true;
-		const w = pinnedWindow(tabs);
-		assert.equal(await w.fns.settleForUpdate(), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
-
-		w.tabs.push({ id: 'c', path: '/notes/c.md', isDirty: false });
-		await w.fns.closeTabAndWindowIfLast('b');
-		await w.fns.closeTabAndWindowIfLast('c');
-		assert.deepEqual(w.saves.at(-1), ['/notes/c.md']);
-	});
-
-	test('merging a pinned window into another keeps its files in the pin', async () => {
-		const w = pinnedWindow(twoFiles());
-		await w.fns.mergeSelfInto('other');
-		assert.equal(w.isDestroyed(), true);
-		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
-	});
-
-	test('a pin another window removed stays removed when this window closes', async () => {
-		const w = pinnedWindow(twoFiles());
-		w.pin.exists = false;
-		assert.equal(await w.fns.settleForExit(async () => true), true);
-		assert.deepEqual(w.tabManager.windowTag, { name: 'work', color: '#f00', pinned: false }, 'the window still claims the pin');
-	});
-
-	const research = { name: 'research', color: '#0a0', files: ['/papers/x.md', '/papers/y.md'] };
-
-	test('opening a pinned group in a window with tabs opens a new window for it', async () => {
-		const w = pinnedWindow(twoFiles());
-		await w.fns.openPinnedTag(research);
-		assert.deepEqual(w.calls, ['create_transfer_window:research'], 'the new window reads the group from its label');
-		assert.deepEqual(w.loaded, [], 'no file of the group joins this window');
-		assert.deepEqual(w.tabs.map((tab) => tab.id), ['a', 'b']);
-		assert.deepEqual(w.tabManager.windowTag, { name: 'work', color: '#f00', pinned: true });
-	});
-
-	test('an empty window adopts the pinned group in place', async () => {
-		const w = pinnedWindow([]);
-		w.tabManager.windowTag = null;
-		await w.fns.openPinnedTag(research);
-		assert.deepEqual(w.calls, []);
-		assert.deepEqual(w.loaded, research.files);
-		assert.deepEqual(w.tabManager.windowTag, { ...research, pinned: true });
-	});
-});
-
-describe('a pinned group opens in a window that holds it', () => {
-	test('a window opened for a pinned group is created as the group\'s holder', async () => {
-		// The window reports its tag only once it has mounted and read the group.
-		// Until then the registry knew nothing of it, so a second click on the same
-		// group opened a second window. `tagName` has the backend record the holder
-		// as it creates the window.
-		const calls: { cmd: string; args: any }[] = [];
-		(globalThis as any).window = {
-			__TAURI_INTERNALS__: {
-				invoke: async (cmd: string, args: any) => {
-					calls.push({ cmd, args });
-					return cmd === 'list_viewer_windows' ? [] : null;
-				},
-			},
-		};
-		try {
-			await openPinnedTagWindow('Work');
-		} finally {
-			delete (globalThis as any).window;
-		}
-		const create = calls.find((call) => call.cmd === 'create_transfer_window');
-		assert.equal(create?.args.tagName, 'Work');
-		assert.equal(pinnedTagFromWindowLabel(`window-${create?.args.token}`), 'Work');
-
-		// The other route that opens a pinned group in a new window says the same.
-		const viewer = readSource('src/lib/MarkdownViewer.svelte');
-		const pinnedCreates = viewer.match(/invoke\('create_transfer_window', \{[^}]*pinnedWindowToken[^}]*\}\)/g) ?? [];
-		assert.ok(pinnedCreates.length > 0, 'MarkdownViewer no longer opens a pinned group in a new window');
-		for (const call of pinnedCreates) {
-			assert.match(call, /tagName:/, call);
-		}
-		// And the window does not report itself, clearing that name, before it has
-		// adopted the group.
-		assert.match(viewer, /\$effect\(\(\) => \{\n\t\tif \(!windowMetaReady\) return;\n\t\tinvoke\('set_window_meta'/);
-	});
-});
-
 describe('a cold start does not steal focus', () => {
 	const backend = readRustBackend();
 
-	function showWindowSource(): string {
-		const match = /pub async fn show_window\([\s\S]*?\n\}/.exec(backend);
-		assert.ok(match, 'show_window is gone: this file no longer states anything');
-		return match[0];
-	}
-
-	test('the launch window is shown without being activated on a cold start', () => {
-		const showWindow = showWindowSource();
-
-		// The defect (#702): the window is built hidden and revealed once the
-		// frontend mounts, seconds after launch, and the reveal called `set_focus`
-		// unconditionally — pulling the user out of whatever they had switched to.
-		// The label and the one-shot flag together are what make it the FIRST show
-		// of the LAUNCH window that stays quiet.
-		assert.match(showWindow, /window\.label\(\)\s*==\s*LAUNCH_LABEL/);
-		assert.match(showWindow, /MAIN_WINDOW_SHOWN\.swap\(true,/);
-
-		// Not vacuous: the other callers — a detached tab window, the close walk
-		// needing its dialog visible — still activate, so this cannot pass by
-		// `set_focus` having been deleted outright.
-		assert.match(showWindow, /set_focus\(\)/);
-
-		// And the quiet path returns before reaching it.
-		const guard = showWindow.indexOf('return;');
-		const focus = showWindow.indexOf('set_focus()');
-		assert.ok(guard > 0 && guard < focus, 'the cold-start path falls through to set_focus');
-	});
-
 	test('no window builder opts out of focus', () => {
 		// `.focused(false)` on a window built hidden leaves WebView2 on Windows with
 		// no drop target, so every file dragged onto the window is refused (#768,
@@ -522,48 +108,11 @@ describe('a cold start does not steal focus', () => {
 	});
 });
 
-describe('every opened document path reaches a window', () => {
-	const runtime = readSource('src-tauri/src/window_runtime.rs');
-	const tauriLib = readRustBackend();
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-
-	test('macOS open-document events preserve every delivered file path', () => {
-		assert.match(runtime, /startup_files: Mutex<Option<Vec<String>>>/);
-		// Every delivered url is pushed, and the queue is taken whole: the
-		// defect this guards against was consuming only `urls.first()`.
-		assert.match(tauriLib, /for url in urls/);
-		assert.match(tauriLib, /deliver_opened_path\(/);
-		assert.match(runtime, /paths\.push\(path\.clone\(\)\)/);
-		assert.match(runtime, /startup_files\)\.take\(\)/);
-		assert.match(runtime, /for path in opened\.into_iter\(\)\.rev\(\)/);
-		assert.match(viewer, /for \(const path of args\) await loadMarkdown\(path\);/);
-	});
-
-	test('a second launch hands every argv path to the running window', () => {
-		// `markpad a.md b.md` with Markpad already running arrives here instead of
-		// at `send_markdown_path`. Taking only the first path opened a.md alone.
-		const secondInstance = sliceBetween(runtime, 'pub fn handle_single_instance', 'fn create_transfer_window');
-		assert.match(secondInstance, /startup_paths\(/);
-		// Windows Explorer's per-file launches must share the macOS pending-open
-		// implementation: emitting directly loses files before the listener exists.
-		assert.match(secondInstance, /deliver_opened_path\(/);
-		assert.doesNotMatch(secondInstance, /emit_to/);
-		assert.doesNotMatch(secondInstance, /\.next\(\)|\.first\(\)/);
-	});
-});
-
 describe('the recent-file list is written through one helper', () => {
 	// --- wiring ------------------------------------------------------------------
 
 	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 
-	test('every mutation goes through the read-modify-write helper', () => {
-		assert.match(viewer, /recentFiles = updateStoredRecentFiles\(\((\w+)\) => promoteRecentFile\(\1, path\)\)/);
-		assert.match(viewer, /recentFiles = updateStoredRecentFiles\(\((\w+)\) => dropRecentFile\(\1, path\)\)/);
-		assert.match(viewer, /recentFiles = updateStoredRecentFiles\(\((\w+)\) => renameRecentFile\(\1, oldPath, newPath\)\)/);
-		assert.equal(viewer.match(/updateStoredRecentFiles\(/g)?.length, 3, 'exactly three call sites, all of them shown above');
-	});
-
 	test('nothing writes the key directly any more', () => {
 		// Any surviving `setItem('recent-files', ...)` is a window publishing its
 		// own snapshot again, which is the whole defect.
@@ -576,19 +125,9 @@ describe('the recent-file list is written through one helper', () => {
 		// `tabManager.closeTab`, with no unsaved-changes prompt.
 		assert.doesNotMatch(functionSource(viewer, 'removeRecentFile'), /closeTab/);
 	});
-
-	test('a window folds in what its siblings did', () => {
-		// localStorage fires `storage` in every OTHER same-origin document. Without
-		// this the home screen showed a stale list until restart — and that stale
-		// list was what the next write published.
-		assert.match(viewer, /isRecentFilesStorageEvent\(event\)\) recentFiles = readStoredRecentFiles\(\)/);
-		assert.match(viewer, /window\.addEventListener\('storage', onStorage\)/);
-		assert.match(viewer, /window\.removeEventListener\('storage', onStorage\)/);
-	});
 });
 
 describe('window state restore', () => {
-	const tabs = readSource('src/lib/stores/tabs.svelte.ts');
 	const viewer = readSource('src/lib/MarkdownViewer.svelte');
 	const session = readSource('src/lib/sessions/windowSession.svelte.ts');
 
@@ -597,142 +136,25 @@ describe('window state restore', () => {
 	// always lives on disk — the snapshot never carries rawContent, so unsaved
 	// changes are handled exclusively by the per-tab close dialogs.
 
-	/** What the close handler and the in-app update run before the window goes away. */
-	function settleForExit(): string {
-		return functionSource(viewer, 'settleForExit');
-	}
-
-	test('startup restore reads content from disk, not from the snapshot', () => {
-		const restore = sliceBetween(session, 'async function restore', 'async function claimTransferredTab');
-		// The tab on screen is read the way an open reads it, through the document
-		// session's `loadMarkdown`; restore itself reads no file, and never takes a
-		// document's text from the snapshot (windows.sessionRestore.spec.ts).
-		assert.match(restore, /await options\.loadRestoredTab\(active\.id\);/);
-		assert.doesNotMatch(restore, /invoke\('read_file/);
-		assert.match(viewer, /loadRestoredTab: \(tabId\) => documentSession\.readRestoredTab\(tabId\),/);
-		// Its read is taken before the first await, so the activation effect cannot
-		// start a second one while the breadcrumb is being written.
-		assert.ok(
-			offsetOf(restore, 'tabManager.takeUnread(active.id)') < offsetOf(restore, 'progress.pending = active.path'),
-			'the read is taken before the breadcrumb write',
-		);
-		// the others wait unread; a deferred document is unavailable instead, so
-		// activation does not read it behind the breadcrumb's back
-		assert.match(restore, /tabManager\.markTabContentUnavailable\(tab\.id\);/);
-		assert.match(restore, /else tabManager\.markTabUnread\(tab\.id\);/);
-		// dropping is reserved for an entry that is not a file at all — a legacy
-		// 'HOME' sentinel (windows.spec.ts)
-		assert.match(restore, /if \(!hasRealFilePath\(tab\.path\)\) \{\s*\n\s*options\.dropRestoredTab\(tab\.id\);/);
-		assert.match(viewer, /await windowSession\.restore\(\);/);
-	});
-
-	test('an editor on a buffer that is not the whole file refuses typing', () => {
-		// An unread or unreadable tab in edit mode shows an empty buffer that no
-		// save will ever accept. Read-only at the keyboard, not a toast at the save.
-		assert.match(viewer, /readOnly=\{tabManager\.activeTab\.isTruncated === true\}/);
-		const editor = readSource('src/lib/components/Editor.svelte');
-		assert.match(editor, /editor\.updateOptions\(\{ \.\.\.editorOptionsFromSettings\(settings, zoomLevel, fontIsMonospace\), readOnly \}\)/);
-	});
-
-	test('the close flow resolves dirty tabs before serializing window state', () => {
-		const body = settleForExit();
-		const walk = offsetOf(body, 'reviewDirtyTabs({');
-		const persist = offsetOf(body, 'persistWindowState(');
-		assert.ok(walk < persist, 'dirty tabs must be resolved before the snapshot is written');
-	});
-
 	test('v2 snapshots are invisible to legacy builds (Rust file, localStorage keys removed)', () => {
-		// An older build restoring a snapshot it cannot understand ends up with
-		// undefined tab content; its editor then attributes a stale buffer to the
-		// wrong tab and auto-save writes it to disk. The snapshot now lives in a
-		// Rust-written file (setItem is an async message to the WebKit storage
-		// process and loses a flush race when the last window's close ends the
-		// process); both localStorage keys are removed on write, so a downgraded
-		// build starts a fresh session instead of misreading anything.
-		const scope = sliceBetween(session, 'async function persistState', 'async function restore');
-		// Through the session's one snapshot writer, which calls the Rust command.
-		assert.match(scope, /snapshots\.flush\(/);
-		assert.match(session, /write: \(json\) => invoke\('save_window_state'/);
-		assert.doesNotMatch(scope, /setItem\(/);
-		assert.match(scope, /removeItem\(options\.windowStateKey\)/);
-		assert.match(scope, /removeItem\(options\.legacyStateKey\)/);
+		// Behaviour: windows.sessionRestore.spec.ts. What stays here is the
+		// contract: the localStorage key older builds read, and the Rust commands
+		// that hold the snapshot now.
 		assert.match(viewer, /const WINDOW_STATE_KEY = 'savedTabsDataV2';/);
-		// startup prefers the Rust file and falls back to the localStorage keys
-		// (v2 first, then legacy) for one-time migration of older snapshots
+		assert.match(session, /write: \(json\) => invoke\('save_window_state'/);
 		assert.match(session, /invoke\('load_window_state'\)/);
-		assert.match(
-			session,
-			/localStorage\.getItem\(options\.windowStateKey\) \?\?\n?\s*localStorage\.getItem\(options\.legacyStateKey\)/,
-		);
-		// The shared helper clears the Rust snapshot and both localStorage keys.
-		// Only turning the setting off uses it: a restore that goes wrong must never
-		// delete the record of which documents were open, and quitting writes the
-		// snapshot rather than discarding it.
-		const discardScope = sliceBetween(session, 'async function discardPersistedState', 'async function readProgress');
-		assert.match(discardScope, /clear_window_state/);
-		assert.match(discardScope, /removeItem\(options\.windowStateKey\)/);
-		assert.match(discardScope, /removeItem\(options\.legacyStateKey\)/);
-	});
-
-	test('quitting writes the session instead of discarding it', () => {
-		// ⌘Q used to discard the snapshot, so it and the red button disagreed
-		// about whether the session came back — silently, because the dialog that
-		// explained the difference only appeared when a tab was dirty (#390).
-		// Quitting now closes every window and each one persists through its own
-		// close handler.
-		const exitScope = sliceBetween(viewer, 'async function appExit', '\n\t}');
-		assert.doesNotMatch(exitScope, /discardPersistedWindowState/);
-		assert.match(exitScope, /await getAllWindows\(\)/, 'every window is asked, not just the focused one');
-		assert.match(exitScope, /other\.label !== appWindow\.label/, 'this window closes last');
-		// Nothing may skip the close handler's review and persist step any more.
-		assert.doesNotMatch(viewer, /isForceExiting/);
-	});
-
-	test('with restore enabled resolved titled tabs stay open for the snapshot', () => {
-		const handler = settleForExit();
-		// tabs are closed one-by-one only when restore is off (or untitled).
-		// The walk itself is covered by windowClosePerTab, which runs it; what is
-		// asserted here is the policy the component hands it.
-		assert.match(handler, /!settings\.restoreStateOnReopen \|\| tab\.path === ''/);
+		assert.match(session, /invoke\('clear_window_state'\)/);
 	});
 
-	test('auto-save fast path silently saves titled tabs before the walk', () => {
-		const handler = settleForExit();
-		const fastPath = offsetOf(handler, 'if (settings.autoSave) {');
-		const walk = offsetOf(handler, 'reviewDirtyTabs({');
-		assert.ok(fastPath < walk, 'the silent save runs before the per-tab walk');
-	});
 });
 
 describe('window tags and pinned sessions', () => {
 	const runtime = readSource('src-tauri/src/window_runtime.rs');
-	const viewer = readSource('src/lib/MarkdownViewer.svelte');
-	const titleBar = readSource('src/lib/components/TitleBar.svelte');
 	const home = readSource('src/lib/components/HomePage.svelte');
 
 	test('only explicitly pinned tags create reusable sessions', () => {
 		assert.match(runtime, /pub fn save_pinned_tag/);
 		assert.match(runtime, /pub fn remove_pinned_tag/);
-		assert.match(viewer, /if \(!tag\?\.pinned\) return;/);
-		assert.match(viewer, /savePinnedTagIfNeeded/);
 		assert.match(home, /onopenPinnedTag/);
 	});
-
-	test('the title bar exposes a named color chip and pin control', () => {
-		assert.match(titleBar, /tagColors/);
-		assert.match(titleBar, /window-tag-chip/);
-		assert.match(titleBar, /togglePinnedTag/);
-	});
-
-	test('the Home menu groups window organization below export actions', () => {
-		const exportIndex = offsetOf(titleBar, "t('menu.exportPdf', currentLanguage)");
-		const tagIndex = offsetOf(titleBar, "t('menu.setWindowTag', currentLanguage)");
-		const mergeIndex = offsetOf(titleBar, "t('menu.mergeAllWindows', currentLanguage)");
-		const exitIndex = offsetOf(titleBar, "t('menu.exit', currentLanguage)");
-
-		assert.ok(exportIndex < tagIndex);
-		assert.ok(tagIndex < mergeIndex);
-		assert.ok(mergeIndex < exitIndex);
-		assert.match(titleBar, /homeMenuOpen = false;\s*openTagEditor\(\);/);
-	});
 });
diff --git a/scripts/windows.exit.test.ts b/scripts/windows.exit.test.ts
new file mode 100644
index 00000000..d4204b19
--- /dev/null
+++ b/scripts/windows.exit.test.ts
@@ -0,0 +1,399 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import { createWindowExit, type WindowExitOptions } from '../src/lib/sessions/windowExit.js';
+import { pinnedTagFromWindowLabel } from '../src/lib/utils/pinnedTagWindow.js';
+
+// Every way a window ends runs `createWindowExit` against a stub window. The
+// Tauri bridge is the one boundary doubled: `invoke` calls are recorded, and
+// `update_pinned_tag` answers whether the pin entry still exists.
+
+type Tab = { id: string; path: string; isDirty: boolean };
+type Answer = boolean | Promise<boolean>;
+
+let invoked: { cmd: string; args: any }[] = [];
+let handleInvoke: (cmd: string, args: any) => unknown = () => null;
+(globalThis as any).window = {
+	__TAURI_INTERNALS__: {
+		invoke: async (cmd: string, args: any) => {
+			invoked.push({ cmd, args });
+			return handleInvoke(cmd, args);
+		},
+	},
+};
+
+function stubWindow(
+	tabs: Tab[],
+	settings: Partial<WindowExitOptions['settings']> = {},
+	answers: Record<string, Answer> = {},
+	recovery: Partial<WindowExitOptions['recovery']> = {},
+) {
+	invoked = [];
+	const log: string[] = [];
+	const saves: string[][] = [];
+	const pin = { exists: true };
+	const loaded: string[] = [];
+	let destroyed = false;
+	let closed = false;
+	handleInvoke = (cmd, args) => {
+		if (cmd === 'update_pinned_tag') {
+			saves.push([...args.files]);
+			return pin.exists;
+		}
+		if (cmd === 'save_pinned_tag') throw new Error('a closing window recreated its pin');
+		if (cmd === 'list_viewer_windows') return [];
+		if (cmd === 'keeps_unsaved_on_close') return true;
+		return null;
+	};
+	const closeTab = (id: string) => {
+		log.push(`close:${id}`);
+		const at = tabs.findIndex((tab) => tab.id === id);
+		if (at !== -1) tabs.splice(at, 1);
+	};
+	const tabManager = {
+		tabs,
+		windowTag: { name: 'work', color: '#f00', pinned: true } as { name: string; color: string; pinned: boolean } | null,
+		closeTab,
+		setActive: (id: string) => void log.push(`active:${id}`),
+		setWindowTag: (tag: any) => void (tabManager.windowTag = tag ? { ...tag, pinned: tag.pinned === true } : null),
+	};
+	const others = [
+		{ label: 'second', close: async () => void log.push('close-window:second') },
+		{ label: 'main', close: async () => void log.push('close-window:main(other)') },
+	];
+	const exit = createWindowExit({
+		tabManager,
+		settings: {
+			autoSave: false,
+			restoreStateOnReopen: false,
+			closeWindowWithLastTab: true,
+			persistOpenEditors: false,
+			...settings,
+		},
+		appWindow: {
+			label: 'main',
+			close: async () => {
+				closed = true;
+				log.push('close-window:main');
+			},
+			destroy: async () => {
+				destroyed = true;
+				log.push('destroy');
+			},
+		},
+		allWindows: async () => others,
+		recovery: { isReady: () => false, keep: async () => true, drop: async () => true, ...recovery },
+		persistWindowState: async (remember) => void log.push(`persist:${remember}`),
+		canCloseTab: async (id) => {
+			log.push(`ask:${id}`);
+			const answer = await (answers[id] ?? true);
+			// Save or Don't Save resolves the tab; Cancel leaves it as it was.
+			if (answer) {
+				const tab = tabs.find((item) => item.id === id);
+				if (tab) tab.isDirty = false;
+			}
+			return answer;
+		},
+		saveSilently: async (id) => {
+			log.push(`silent:${id}`);
+			const tab = tabs.find((item) => item.id === id)!;
+			tab.isDirty = false;
+			return true;
+		},
+		hasExternalChangeConflict: () => false,
+		onAutoSaveFailed: () => void log.push('toast:autoSaveFailed'),
+		settle: async () => {},
+		loadMarkdown: async (file) => void loaded.push(file),
+		setShowHome: () => {},
+		moveTabToWindow: async (id) => (closeTab(id), true),
+	});
+	return { exit, tabs, log, saves, pin, loaded, tabManager, isDestroyed: () => destroyed, isClosed: () => closed };
+}
+
+const closeEvent = (log: string[]) => ({ preventDefault: () => void log.push('prevent') });
+
+const files = (...dirty: boolean[]): Tab[] =>
+	dirty.map((isDirty, i) => ({ id: 'abc'[i], path: `/notes/${'abc'[i]}.md`, isDirty }));
+
+/** A dialog answer the test settles by hand, to look at the window while it is up. */
+function pendingAnswer() {
+	let answer!: (value: boolean) => void;
+	const promise = new Promise<boolean>((resolve) => (answer = resolve));
+	return { promise, answer };
+}
+
+// Window close (issue #189): instead of one aggregate "you have N unsaved
+// files" modal, the red close button walks the dirty tabs one at a time —
+// activating each and showing the SAME unsaved-changes dialog a single tab
+// close shows. Cancel stops the walk; the window stays open.
+describe('the window close handler', () => {
+	test('the aggregate unsaved-files modal is gone from the close handler', async () => {
+		// Each dirty tab gets its own dialog, and none is discarded unasked: the
+		// old discard path cleared every dirty flag and then closed.
+		const w = stubWindow(files(true, true), {}, { b: false });
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.deepEqual(w.log.filter((line) => line.startsWith('ask:')), ['ask:a', 'ask:b']);
+		assert.equal(w.tabs.find((tab) => tab.id === 'b')?.isDirty, true, 'the cancelled tab keeps its edits');
+		assert.equal(w.isClosed(), false);
+	});
+
+	test('closing the window still reviews unsaved tabs', async () => {
+		const w = stubWindow(files(false, true));
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.deepEqual(w.log.slice(0, 3), ['prevent', 'active:b', 'ask:b']);
+		assert.equal(w.isClosed(), true);
+	});
+
+	test('the close is prevented synchronously before the walk starts', async () => {
+		const w = stubWindow(files(true));
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.ok(w.log.indexOf('prevent') !== -1 && w.log.indexOf('prevent') < w.log.indexOf('ask:a'), w.log.join(' '));
+	});
+
+	test('the window closes only after every dirty tab is resolved', async () => {
+		const w = stubWindow(files(true, true));
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.equal(w.log.at(-1), 'close-window:main', w.log.join(' '));
+		assert.ok(w.log.indexOf('ask:b') < w.log.indexOf('close-window:main'));
+	});
+
+	test('a clean window is not held open', async () => {
+		// The fence for the tests above: with nothing to review the native close
+		// proceeds on its own, so nothing prevents it or re-triggers it.
+		const w = stubWindow(files(false));
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.equal(w.log.includes('prevent'), false);
+		assert.equal(w.isClosed(), false);
+	});
+
+	test('a cancelled walk stops the handler before it persists or closes', async () => {
+		const w = stubWindow(files(true), {}, { a: false });
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.equal(w.log.some((line) => line.startsWith('persist:')), false, 'cancel writes no snapshot');
+		assert.equal(w.isClosed(), false, 'and the window stays open');
+		assert.deepEqual(invoked.at(-1), { cmd: 'set_quitting', args: { quitting: false } }, 'a cancelled close cancels the quit');
+	});
+
+	test('a second close request cannot start a competing walk', async () => {
+		const dialog = pendingAnswer();
+		const w = stubWindow(files(true), {}, { a: dialog.promise });
+		const first = w.exit.handleCloseRequested(closeEvent(w.log));
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.deepEqual(w.log, ['prevent', 'active:a', 'ask:a'], 'precondition: the first walk is showing its dialog');
+
+		const second: string[] = [];
+		const swallowed = await Promise.race([
+			w.exit.handleCloseRequested(closeEvent(second)).then(() => true),
+			new Promise((resolve) => setTimeout(() => resolve(false), 50)),
+		]);
+		assert.equal(swallowed, true, 'the second request returns at once instead of waiting on a dialog');
+		assert.deepEqual(second, ['prevent'], 'the second request is swallowed');
+		assert.equal(w.log.filter((line) => line === 'ask:a').length, 1, 'and asks nothing');
+
+		// Cancelling releases the guard, so the next close walks again.
+		dialog.answer(false);
+		await first;
+		await w.exit.handleCloseRequested(closeEvent(second));
+		assert.equal(w.log.filter((line) => line === 'ask:a').length, 2);
+	});
+
+	test('the walk proceeds in strict tab-strip order', async () => {
+		const tabs = files(false, true, true);
+		const w = stubWindow(tabs);
+		w.tabManager.setActive('c');
+		await w.exit.settleForExit(async () => true);
+		assert.deepEqual(w.log.filter((line) => line.startsWith('ask:')), ['ask:b', 'ask:c']);
+	});
+
+	test('the restore-on-reopen branch persists window state via the shared helper', async () => {
+		// Whether the window is remembered is asked once the walk is over, and the
+		// answer is what the snapshot helper is handed.
+		for (const remember of [true, false]) {
+			const w = stubWindow(files(true));
+			let askedAfterWalk = false;
+			await w.exit.settleForExit(async () => {
+				askedAfterWalk = w.log.includes('ask:a');
+				return remember;
+			});
+			assert.equal(askedAfterWalk, true);
+			assert.equal(w.log.at(-1), `persist:${remember}`);
+		}
+	});
+
+	test('the close flow resolves dirty tabs before serializing window state', async () => {
+		const w = stubWindow(files(true, true), { restoreStateOnReopen: true });
+		await w.exit.settleForExit(async () => true);
+		assert.ok(w.log.indexOf('ask:b') < w.log.indexOf('persist:true'), w.log.join(' '));
+	});
+
+	test('with restore enabled resolved titled tabs stay open for the snapshot', async () => {
+		const tabs = [...files(true), { id: 'u', path: '', isDirty: true }];
+		const w = stubWindow(tabs, { restoreStateOnReopen: true });
+		await w.exit.settleForExit(async () => true);
+		assert.deepEqual(w.tabs.map((tab) => tab.id), ['a'], 'the titled tab stays, the untitled one has nothing to restore');
+
+		const off = stubWindow(files(true), { restoreStateOnReopen: false });
+		await off.exit.settleForExit(async () => true);
+		assert.deepEqual(off.tabs, [], 'with restore off the review closes tabs one by one');
+	});
+
+	test('auto-save fast path silently saves titled tabs before the walk', async () => {
+		const tabs = [...files(true), { id: 'u', path: '', isDirty: true }];
+		const w = stubWindow(tabs, { autoSave: true });
+		await w.exit.settleForExit(async () => true);
+		assert.deepEqual(
+			w.log.filter((line) => line.startsWith('silent:') || line.startsWith('ask:')),
+			['silent:a', 'ask:u'],
+			'the titled tab is saved without a prompt; the untitled one needs the dialog',
+		);
+	});
+
+	test('quitting writes the session instead of discarding it', async () => {
+		// Quit closes every window, each through its own close handler, which
+		// persists like the red button. This window goes last.
+		const w = stubWindow(files(false));
+		await w.exit.appExit();
+		assert.deepEqual(invoked[0], { cmd: 'set_quitting', args: { quitting: true } });
+		assert.deepEqual(w.log, ['close-window:second', 'close-window:main']);
+		assert.equal(w.log.some((line) => line === 'persist:false'), false, 'nothing is discarded');
+	});
+});
+
+// Hot exit ("Restore unsaved changes on launch"): the close keeps the dirty
+// buffers in the backup instead of asking about them.
+describe('hot exit keeps unsaved buffers', () => {
+	function hotExitWindow(autoSave: boolean) {
+		const kept: string[] = [];
+		const w = stubWindow(files(true, false), { autoSave, persistOpenEditors: true }, {}, {
+			isReady: () => true,
+			keep: async () => {
+				kept.push(w.tabs.filter((tab) => tab.isDirty).map((tab) => tab.id).join(','));
+				return true;
+			},
+		});
+		return { ...w, kept };
+	}
+
+	test('with auto-save off, the dirty buffer is kept and its file is not written', async () => {
+		// Auto-save off means the reader decides when a file is written. Closing
+		// the window is not that decision: the buffer goes to the backup, and the
+		// file on disk stays as it was.
+		const w = hotExitWindow(false);
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.deepEqual(w.log.filter((line) => line.startsWith('silent:')), [], 'nothing is saved to disk');
+		assert.deepEqual(w.kept, ['a'], 'the dirty buffer is in the backup');
+		assert.equal(w.log.some((line) => line.startsWith('ask:')), false, 'and nothing is asked');
+		assert.ok(w.log.includes('persist:true'));
+	});
+
+	test('with auto-save on, pending saves write their files before the backup', async () => {
+		const w = hotExitWindow(true);
+		await w.exit.handleCloseRequested(closeEvent(w.log));
+		assert.deepEqual(w.log.filter((line) => line.startsWith('silent:')), ['silent:a']);
+		assert.deepEqual(w.kept, [''], 'the backup is written after the save, with nothing left dirty');
+	});
+});
+
+/*
+ * A pinned tag's file list is written when its window ends. Every way of ending
+ * a window closes tabs on the way — the last tab's ×, the close review with
+ * restore off, a merge into another window — and the pin used to be written
+ * after they were gone, so Home showed the group with no files. What is
+ * asserted is the last list sent to `update_pinned_tag`.
+ */
+describe('a pinned tag keeps its files when its window ends', () => {
+	test('closing every tab with × keeps the last file in the pin', async () => {
+		const w = stubWindow(files(false, false));
+		await w.exit.closeTabAndWindowIfLast('a');
+		await w.exit.closeTabAndWindowIfLast('b');
+		assert.equal(w.isDestroyed(), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/b.md']);
+	});
+
+	test('with the window kept open, closing the empty window later does not empty the pin', async () => {
+		const w = stubWindow(files(false, false), { closeWindowWithLastTab: false });
+		await w.exit.closeTabAndWindowIfLast('a');
+		await w.exit.closeTabAndWindowIfLast('b');
+		assert.equal(w.isDestroyed(), false);
+		assert.equal(await w.exit.settleForExit(async () => true), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/b.md']);
+	});
+
+	test('the close review with restore off keeps the dirty tabs it closes in the pin', async () => {
+		const w = stubWindow(files(true, false));
+		assert.equal(await w.exit.settleForExit(async () => true), true);
+		assert.deepEqual(w.tabs.map((tab) => tab.id), ['b'], 'the review closed the dirty tab');
+		// The handler re-triggers the close after a review, and settles again.
+		assert.equal(await w.exit.settleForExit(async () => true), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
+
+		// A window that lives on after that (an update that failed to install)
+		// saves what it has open, not the list the review started from.
+		w.tabs.push({ id: 'c', path: '/notes/c.md', isDirty: false });
+		assert.equal(await w.exit.settleForExit(async () => true), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/b.md', '/notes/c.md']);
+	});
+
+	test('an update whose install fails leaves no stale review list behind', async () => {
+		// The update settles like a close but is not followed by one: when the
+		// install fails the window stays, and a later last-tab close saved the
+		// list the update's review started from.
+		const w = stubWindow(files(true, false));
+		assert.equal(await w.exit.settleForUpdate(), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
+
+		w.tabs.push({ id: 'c', path: '/notes/c.md', isDirty: false });
+		await w.exit.closeTabAndWindowIfLast('b');
+		await w.exit.closeTabAndWindowIfLast('c');
+		assert.deepEqual(w.saves.at(-1), ['/notes/c.md']);
+	});
+
+	test('merging a pinned window into another keeps its files in the pin', async () => {
+		const w = stubWindow(files(false, false));
+		await w.exit.mergeSelfInto('other');
+		assert.equal(w.isDestroyed(), true);
+		assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
+	});
+
+	test('a pin another window removed stays removed when this window closes', async () => {
+		const w = stubWindow(files(false, false));
+		w.pin.exists = false;
+		assert.equal(await w.exit.settleForExit(async () => true), true);
+		assert.deepEqual(w.tabManager.windowTag, { name: 'work', color: '#f00', pinned: false }, 'the window still claims the pin');
+	});
+
+	test('only explicitly pinned tags create reusable sessions', async () => {
+		// An unpinned tag is a label on this window only: ending the window
+		// writes no pin entry for it.
+		const w = stubWindow(files(false, false));
+		w.tabManager.windowTag = { name: 'work', color: '#f00', pinned: false };
+		await w.exit.closeTabAndWindowIfLast('a');
+		await w.exit.closeTabAndWindowIfLast('b');
+		assert.equal(w.isDestroyed(), true);
+		assert.deepEqual(w.saves, []);
+		assert.equal(invoked.some((call) => call.cmd.includes('pinned_tag')), false);
+	});
+
+	const research = { name: 'research', color: '#0a0', files: ['/papers/x.md', '/papers/y.md'] };
+
+	test('opening a pinned group in a window with tabs opens a new window for it', async () => {
+		const w = stubWindow(files(false, false));
+		await w.exit.openPinnedTag(research);
+		const creates = invoked.filter((call) => call.cmd === 'create_transfer_window');
+		assert.equal(creates.length, 1);
+		assert.equal(pinnedTagFromWindowLabel(`window-${creates[0].args.token}`), 'research', 'the new window reads the group from its label');
+		assert.equal(creates[0].args.tagName, 'research', "and is created as the group's holder");
+		assert.deepEqual(w.loaded, [], 'no file of the group joins this window');
+		assert.deepEqual(w.tabs.map((tab) => tab.id), ['a', 'b']);
+		assert.deepEqual(w.tabManager.windowTag, { name: 'work', color: '#f00', pinned: true });
+	});
+
+	test('an empty window adopts the pinned group in place', async () => {
+		const w = stubWindow([]);
+		w.tabManager.windowTag = null;
+		await w.exit.openPinnedTag(research);
+		assert.equal(invoked.some((call) => call.cmd === 'create_transfer_window'), false);
+		assert.deepEqual(w.loaded, research.files);
+		assert.deepEqual(w.tabManager.windowTag, { ...research, pinned: true });
+	});
+});
diff --git a/scripts/windows.recentFiles.test.ts b/scripts/windows.recentFiles.test.ts
index 5bb5065b..ab01f4b3 100644
--- a/scripts/windows.recentFiles.test.ts
+++ b/scripts/windows.recentFiles.test.ts
@@ -11,9 +11,8 @@ import { describe, test } from 'node:test';
  * which both survived.
  *
  * The fix is the one #370 established for settings: re-read before writing, and
- * let a `storage` listener fold in what the siblings did. This file runs the
- * real module for the merge semantics; the three call sites are asserted
- * against the component's source, because they live in a Svelte file.
+ * let a `storage` listener fold in what the siblings did. Each window here is
+ * the real `createRecentFiles` the viewer builds.
  *
  * `recentFiles.ts` reaches `writeStoredSetting` in `settings.svelte.ts`, which
  * is a runes module — hence the shims below, the same ones
@@ -59,12 +58,11 @@ Object.defineProperty(globalThis, 'window', {
 Object.defineProperty(globalThis, 'navigator', { value: { language: 'en-US' }, configurable: true });
 
 const {
-	dropRecentFile,
+	createRecentFiles,
 	isRecentFilesStorageEvent,
 	parseRecentFiles,
 	promoteRecentFile,
 	readStoredRecentFiles,
-	renameRecentFile,
 	updateStoredRecentFiles,
 } = await import('../src/lib/utils/recentFiles.js');
 
@@ -96,25 +94,11 @@ describe('the recent-file list is shared by every window', () => {
 
 	const stored = () => parseRecentFiles(backing.get(KEY) ?? null);
 
-	/**
-	 * A window: its own in-memory copy of the list, exactly as the component holds
-	 * one. `open`/`remove` are what the component's `saveRecentFile` and
-	 * `deleteRecentFile` now do.
-	 */
+	/** A window: its own in-memory copy of the list, as the viewer holds one. */
 	function makeWindow(initial: string[]) {
-		const self = {
-			files: [...initial],
-			open(path: string) {
-				self.files = updateStoredRecentFiles((current) => promoteRecentFile(current, path));
-			},
-			remove(path: string) {
-				self.files = updateStoredRecentFiles((current) => dropRecentFile(current, path));
-			},
-			rename(from: string, to: string) {
-				self.files = updateStoredRecentFiles((current) => renameRecentFile(current, from, to));
-			},
-		};
-		return self;
+		const self = { files: [...initial] };
+		const list = createRecentFiles((files) => (self.files = files));
+		return Object.assign(self, { open: list.save, remove: list.remove, rename: list.rename, list });
 	}
 
 	test('a second window opening a file does not erase the first one', () => {
@@ -235,6 +219,28 @@ describe('the recent-file list is shared by every window', () => {
 		);
 	});
 
+	test('a window folds in what its siblings did', () => {
+		// localStorage fires `storage` in every OTHER same-origin document. Without
+		// this the home screen showed a stale list until restart, and that stale
+		// list was what the next write published.
+		seed(['/a.md']);
+		const a = makeWindow([]);
+		const target = new EventTarget();
+		const stop = a.list.listen(target as unknown as Window);
+		const storageEvent = (key: string | null) => Object.assign(new Event('storage'), { key, storageArea: null });
+
+		backing.set(KEY, JSON.stringify(['/from-sibling.md', '/a.md']));
+		target.dispatchEvent(storageEvent('theme'));
+		assert.deepEqual(a.files, [], 'another key is not a recent-files change');
+		target.dispatchEvent(storageEvent(KEY));
+		assert.deepEqual(a.files, ['/from-sibling.md', '/a.md']);
+
+		stop();
+		backing.set(KEY, JSON.stringify(['/later.md']));
+		target.dispatchEvent(storageEvent(KEY));
+		assert.deepEqual(a.files, ['/from-sibling.md', '/a.md'], 'a closed window stops listening');
+	});
+
 	// The Open dialog hands over `C:\n\b.md` and a followed link resolves to
 	// `C:/n/b.md`. One file, so one entry, under the spelling opened last.
 	test('a Windows path is one recent entry whichever separators it arrived with', () => {
diff --git a/scripts/windows.sessionRestore.spec.ts b/scripts/windows.sessionRestore.spec.ts
index 3c716c19..a0d47068 100644
--- a/scripts/windows.sessionRestore.spec.ts
+++ b/scripts/windows.sessionRestore.spec.ts
@@ -324,6 +324,36 @@ describe('startup restore keeps the session', () => {
 		assert.equal(a.rawContent, '# a');
 	});
 
+	test('the tab on screen is read once even if activation runs during the breadcrumb write', async () => {
+		// Restore takes the read before its first await. Otherwise the activation
+		// effect, re-running while the breadcrumb is on its way to disk, finds the
+		// tab still unread and starts a second read of it.
+		reset(['/a.md', '/b.md'], { '/a.md': '# a' });
+		let release!: () => void;
+		const written = new Promise<void>((resolve) => (release = resolve));
+		let held = false;
+		const real = (window as any).__TAURI_INTERNALS__.invoke;
+		(window as any).__TAURI_INTERNALS__.invoke = (cmd: string, args: any) => {
+			if (!held && cmd === 'save_restore_progress' && JSON.parse(args.json).pending === '/a.md') {
+				held = true;
+				return written.then(() => real(cmd, args));
+			}
+			return real(cmd, args);
+		};
+		try {
+			const restoring = makeSession().restore();
+			while (!held) await flush();
+			await documents.readActiveIfUnread();
+			release();
+			await restoring;
+		} finally {
+			(window as any).__TAURI_INTERNALS__.invoke = real;
+		}
+
+		assert.deepEqual(readsOf(), ['/a.md']);
+		assert.equal(tabManager.activeTab?.rawContent, '# a');
+	});
+
 	test('an unread tab cannot be saved over its file', async () => {
 		reset(['/a.md', '/b.md']);
 		await makeSession().restore();
@@ -695,6 +725,37 @@ describe('startup restore keeps the session', () => {
 		assert.equal(storedSnapshot, null, 'the file on the Rust side goes too');
 	});
 
+	// An older build restoring a v2 snapshot it cannot understand ends up with
+	// undefined tab content, and auto-save writes a stale buffer over the wrong
+	// file. So nothing is left in the keys an older build reads.
+	test('a saved window leaves nothing in localStorage for a legacy build to misread', async () => {
+		reset(['/a.md', '/b.md']);
+		const session = makeSession();
+		await session.restore();
+		localStorage.setItem(WINDOW_STATE_KEY, 'stale');
+		localStorage.setItem(LEGACY_STATE_KEY, 'stale');
+		storedSnapshot = null;
+
+		await session.persistState(true);
+
+		assert.deepEqual(persistedPaths(), ['/a.md', '/b.md'], 'the snapshot goes to the Rust side');
+		assert.equal(localStorage.getItem(WINDOW_STATE_KEY), null);
+		assert.equal(localStorage.getItem(LEGACY_STATE_KEY), null);
+	});
+
+	test('turning session restore off clears the localStorage keys as well as the file', async () => {
+		reset(['/a.md']);
+		restoreEnabled = false;
+		localStorage.setItem(WINDOW_STATE_KEY, 'stale');
+		localStorage.setItem(LEGACY_STATE_KEY, 'stale');
+
+		await makeSession().restore();
+
+		assert.equal(storedSnapshot, null);
+		assert.equal(localStorage.getItem(WINDOW_STATE_KEY), null);
+		assert.equal(localStorage.getItem(LEGACY_STATE_KEY), null);
+	});
+
 	test('a snapshot an older build left in localStorage is still restored, then migrated', async () => {
 		reset(['/a.md', '/b.md']);
 		// The world at first launch of a build that persists through Rust: the old
diff --git a/scripts/windows.spec.ts b/scripts/windows.spec.ts
index b04beeae..81a9f09e 100644
--- a/scripts/windows.spec.ts
+++ b/scripts/windows.spec.ts
@@ -36,6 +36,14 @@ const { snapshotTab, validateTransferPayload } = await import('../src/lib/utils/
 const { default: HomePage } = await import('../src/lib/components/HomePage.svelte');
 const { promoteRecentFile, updateStoredRecentFiles } = await import('../src/lib/utils/recentFiles.js');
 const { FolderManager, folderName, isInside, snapshotFolder } = await import('../src/lib/stores/folder.svelte.js');
+const { HOME_TAB_PATH, isHomePath, showsHomeScreen } = await import('../src/lib/utils/homeTab.js');
+const { hasRealFilePath } = await import('../src/lib/utils/tabFileActions.js');
+const { openPinnedTagWindow, pinnedTagFromWindowLabel } = await import('../src/lib/utils/pinnedTagWindow.js');
+const { reportWindowMeta } = await import('../src/lib/sessions/windowMeta.svelte.js');
+const { runeEffect } = await import('./runeEffect.svelte.js');
+const { getSupportedLanguages, t } = await import('../src/lib/utils/i18n.js');
+const { viewerCommandFor } = await import('../src/lib/utils/viewerKeymap.js');
+const { viewerCommandTable } = await import('../src/lib/utils/viewerCommands.js');
 
 function useTauri(next: Partial<Bridge> = {}) {
 	beforeAll(() => {
@@ -986,3 +994,290 @@ describe('the folder sidebar store', () => {
 		assert.ok(!isInside('/a/b', '/a/b'));
 	});
 });
+
+/*
+ * Issue #392, second half: "the Home tab it opens renders blank". The viewer
+ * draws the home screen only when `showsHomeScreen` says so; the old gate
+ * compared the tab title against 'Recents', a home tab that no longer existed,
+ * so the home tab fell into the document container.
+ */
+describe('the home tab renders the home screen', () => {
+	useTauri();
+
+	/** True when the app draws the document container; false when it draws HomePage. */
+	const showsDocumentContainer = (showHome = false) => !showsHomeScreen(() => tabManager.activeTab, showHome);
+
+	function reset() {
+		tabManager.closeAll();
+		localStorage.clear();
+	}
+
+	// --------------------------------------------------------------- the regression
+
+	test('the home tab renders the home screen, not an empty document', () => {
+		reset();
+		tabManager.addHomeTab();
+
+		assert.equal(tabManager.activeTab?.path, HOME_TAB_PATH, 'precondition: the home tab is active');
+		assert.equal(
+			showsDocumentContainer(),
+			false,
+			'the active home tab fell into the document container: the user sees a blank page',
+		);
+	});
+
+	test('a home tab opened next to files still renders the home screen', () => {
+		// Ctrl+T from a window that already has documents open — the reported path.
+		reset();
+		tabManager.addTab('/notes/a.md');
+		tabManager.addTab('/notes/b.md');
+		tabManager.addHomeTab();
+
+		assert.equal(showsDocumentContainer(), false, 'blank home tab alongside open files');
+	});
+
+	test('the home screen is reached by tab kind, never by the tab title', () => {
+		// The dead half of the old gate. `title` is user-facing text: localised,
+		// and for a file tab it is just a filename, so a document called
+		// `Recents` used to be enough to hide the editor. Nothing about which
+		// branch runs may depend on it.
+		reset();
+		tabManager.addHomeTab();
+		const home = tabManager.activeTab!;
+
+		for (const { code } of getSupportedLanguages()) {
+			home.title = t('tabs.home', code);
+			assert.equal(showsDocumentContainer(), false, `the home screen disappears in locale ${code}`);
+		}
+
+		home.title = 'Recents';
+		assert.equal(showsDocumentContainer(), false, 'the pre-i18n English title must not be what makes this work');
+
+		reset();
+		tabManager.addTab('/notes/Recents');
+		assert.equal(showsDocumentContainer(), true, 'a document named Recents is a document');
+	});
+
+	// ---------------------------------------------------------------- the neighbours
+	//
+	// The three states that already worked. They are the fence: a gate that simply
+	// always chose HomePage would pass the tests above and fail every one of these.
+
+	test('a saved file renders the document container', () => {
+		reset();
+		tabManager.addTab('/notes/a.md');
+
+		assert.equal(showsDocumentContainer(), true);
+	});
+
+	test('an untitled buffer renders the document container', () => {
+		// The distinction the fix rests on: an untitled tab has no file either, so
+		// `hasRealFilePath` is false for both — but it IS a document, and gating on
+		// that predicate would have hidden the editor for every new file.
+		reset();
+		tabManager.addNewTab();
+
+		assert.equal(tabManager.activeTab?.path, '', 'precondition: an untitled tab has no path');
+		assert.equal(hasRealFilePath(''), false, 'precondition: and no real file either');
+		assert.equal(isHomePath(''), false, 'but it is not the home tab');
+		assert.equal(showsDocumentContainer(), true, 'a new file must still get an editor');
+	});
+
+	test('an empty window renders the home screen', () => {
+		reset();
+
+		assert.equal(tabManager.activeTab, undefined);
+		assert.equal(showsDocumentContainer(), false);
+	});
+
+	test('the Home toolbar button still overlays the home screen on any tab', () => {
+		// `showHome` is the other, older route to the same screen: a transient flag
+		// set by the toolbar/menu item, independent of any tab. It must keep
+		// winning over whatever tab is active.
+		reset();
+		tabManager.addTab('/notes/a.md');
+		assert.equal(showsDocumentContainer(true), false, 'a file tab with showHome set');
+
+		tabManager.addNewTab();
+		assert.equal(showsDocumentContainer(true), false, 'an untitled tab with showHome set');
+
+		tabManager.addHomeTab();
+		assert.equal(showsDocumentContainer(true), false, 'the home tab with showHome set');
+	});
+
+	test('switching from the home tab back to a file returns to the document', () => {
+		reset();
+		tabManager.addTab('/notes/a.md');
+		const file = tabManager.activeTab!.id;
+		tabManager.addHomeTab();
+		assert.equal(showsDocumentContainer(), false);
+
+		tabManager.setActive(file);
+
+		assert.equal(showsDocumentContainer(), true, 'the document container must come back');
+	});
+});
+
+describe('a pinned group opens in a window that holds it', () => {
+	const calls: { cmd: string; args: any }[] = [];
+	useTauri({
+		invoke: async (cmd: string, args: any) => {
+			calls.push({ cmd, args });
+			if (cmd === 'get_os_type') return 'macos';
+			return cmd === 'list_viewer_windows' ? [] : null;
+		},
+	});
+
+	test("a window opened for a pinned group is created as the group's holder", async () => {
+		// The window reports its tag only once it has mounted and read the group.
+		// Until then the registry knew nothing of it, so a second click on the same
+		// group opened a second window. `tagName` has the backend record the holder
+		// as it creates the window. (The viewer's own route, `openPinnedTag`, is
+		// asserted in windows.exit.test.ts.)
+		await openPinnedTagWindow('Work');
+		const create = calls.find((call) => call.cmd === 'create_transfer_window');
+		assert.equal(create?.args.tagName, 'Work');
+		assert.equal(pinnedTagFromWindowLabel(`window-${create?.args.token}`), 'Work');
+
+		// And the new window does not report itself, clearing that name, before it
+		// has adopted the group.
+		tabManager.addTab('/notes/a.md');
+		calls.length = 0;
+		const metaCalls = () => calls.filter((call) => call.cmd === 'set_window_meta');
+		let meta!: { markReady: () => void };
+		const dispose = runeEffect(() => void (meta = reportWindowMeta(tabManager, false)));
+		try {
+			flushSync();
+			assert.deepEqual(metaCalls(), [], 'reported before the group was adopted');
+			tabManager.setWindowTag({ name: 'Work', color: '#f00', pinned: true });
+			meta.markReady();
+			flushSync();
+			assert.equal(metaCalls().at(-1)?.args.tagName, 'Work');
+		} finally {
+			dispose();
+		}
+	});
+});
+
+describe('window organization', () => {
+	// jsdom has no Web Animations, and the Home menu flies in. An animation that
+	// never finishes is enough: the assertions read the menu, not the motion.
+	Element.prototype.animate ??= function () {
+		return { cancel() {}, playState: 'finished', effect: null, onfinish: null } as unknown as Animation;
+	};
+	const invoked: { cmd: string; args: any }[] = [];
+	useTauri({
+		invoke: (cmd: string, args: any) => {
+			invoked.push({ cmd, args });
+			if (cmd === 'get_os_type') return Promise.resolve('macos');
+			if (cmd === 'list_pinned_tags') return Promise.resolve([]);
+			if (cmd === 'list_viewer_windows') {
+				return Promise.resolve([
+					{ label: 'main', title: 'Main' },
+					{ label: 'window-2', title: 'Other' },
+				]);
+			}
+			return Promise.resolve(null);
+		},
+	});
+
+	function mounted(Component: any, props: Record<string, unknown>) {
+		const target = document.createElement('div');
+		document.body.append(target);
+		const instance = mount(Component, { target, props, intro: false });
+		flushSync();
+		return {
+			target,
+			[Symbol.dispose]() {
+				unmount(instance);
+				target.remove();
+			},
+		};
+	}
+
+	async function openHomeMenu(onmergeAllWindows: () => void) {
+		const { default: TitleBar } = await import('../src/lib/components/TitleBar.svelte');
+		tabManager.addTab('/notes/a.md', '# A document');
+		const view = mounted(TitleBar, {
+			isFocused: true,
+			isScrolled: false,
+			currentFile: '/notes/a.md',
+			liveMode: false,
+			windowTitle: 'a.md',
+			showHome: false,
+			isEditing: false,
+			ontoggleHome: () => {},
+			ononpenFileLocation: () => {},
+			ontoggleLiveMode: () => {},
+			onsetViewMode: () => {},
+			onmergeAllWindows,
+			theme: 'dark',
+		});
+		view.target.querySelector<HTMLButtonElement>('.icon-home-btn')!.click();
+		flushSync();
+		const items = [...view.target.querySelectorAll<HTMLButtonElement>('.home-menu-item')];
+		return { view, items, labels: items.map((item) => item.textContent?.replace(/\s+/g, ' ').trim() ?? '') };
+	}
+
+	test('window organization exposes move, merge, and carry actions', async () => {
+		// Move: the tab's context menu offers every other window by name, and
+		// choosing one asks this window to move the tab there.
+		const { default: TabView } = await import('../src/lib/components/Tab.svelte');
+		tabManager.closeAll();
+		tabManager.addTab('/notes/a.md', 'text');
+		const tab = tabManager.activeTab!;
+		{
+			using view = mounted(TabView, { tab, isActive: true, onclick: () => {}, onclose: () => {} });
+			view.target.querySelector('.tab')!.dispatchEvent(new MouseEvent('contextmenu', { bubbles: true, cancelable: true }));
+			await new Promise((resolve) => setTimeout(resolve, 0));
+			flushSync();
+			const moveLabel = t('menu.moveToWindow', 'en');
+			const moves = [...view.target.querySelectorAll<HTMLButtonElement>('.menu-item')].filter((item) => {
+				const label = item.textContent?.trim() ?? '';
+				return label.startsWith(`${moveLabel} `) && label !== t('menu.moveToNewWindow', 'en');
+			});
+			assert.equal(moves.length, 1, 'one entry per other window, none for this one');
+			invoked.length = 0;
+			moves[0].click();
+			const emitted = invoked.find((call) => call.cmd === 'plugin:event|emit_to');
+			assert.equal(emitted?.args.event, 'menu-tab-move');
+			assert.deepEqual(emitted?.args.payload, { tabId: tab.id, targetLabel: 'window-2' });
+		}
+
+		// Merge: the Home menu entry reaches the viewer's handler.
+		let merged = 0;
+		{
+			const { view, items, labels } = await openHomeMenu(() => merged++);
+			using _ = view;
+			items[labels.indexOf(t('menu.mergeAllWindows', 'en'))].click();
+			flushSync();
+			assert.equal(merged, 1);
+		}
+
+		// Carry: the chord names the command, and the command carries the tab.
+		const command = viewerCommandFor(
+			{ key: 'm', code: 'KeyM', ctrlKey: true, metaKey: false, shiftKey: true, altKey: false },
+			{ mode: 'app', osType: 'windows', isSplit: false, overlayOpen: false, dialogOpen: false, isEditing: false, editorHasFocus: false },
+		);
+		assert.equal(command, 'move-tab-to-next-window');
+		const calls: string[] = [];
+		const host = new Proxy({} as any, {
+			get: (_, prop) => (prop === 'settings' || prop === 'tabManager' ? {} : () => void calls.push(String(prop))),
+		});
+		viewerCommandTable(host)[command]();
+		assert.deepEqual(calls, ['carryActiveTabToNextWindow']);
+	});
+
+	test('the Home menu groups window organization below export actions', async () => {
+		const { view, labels } = await openHomeMenu(() => {});
+		using _ = view;
+		const at = (key: string) => {
+			const index = labels.findIndex((label) => label.startsWith(t(key, 'en')));
+			assert.notEqual(index, -1, `${key} is in the menu`);
+			return index;
+		};
+		assert.ok(at('menu.exportPdf') < at('menu.setWindowTag'));
+		assert.ok(at('menu.setWindowTag') < at('menu.mergeAllWindows'));
+		assert.ok(at('menu.mergeAllWindows') < at('menu.exit'));
+	});
+});
diff --git a/scripts/windows.tagEditor.checks.test.ts b/scripts/windows.tagEditor.checks.test.ts
deleted file mode 100644
index d4b95250..00000000
--- a/scripts/windows.tagEditor.checks.test.ts
+++ /dev/null
@@ -1,575 +0,0 @@
-import assert from 'node:assert/strict';
-import { before, describe, test } from 'node:test';
-
-import { COLORS, setup, settle, styleRule, tabManager } from './windowTagEditor.js';
-
-// windowTagEditor.ts installs its rune and Tauri shims on import, which is why
-// these cases keep a file of their own. Each describe starts from an empty
-// window, as each used to start from a fresh process.
-
-/*
- * The window-tag popover in TitleBar.svelte had no way out that did not write
- * something. `tagEditorOpen` went false in exactly two places — `applyTag`
- * (Save/Enter) and `clearTag` (Remove Tag, which only renders once a tag
- * exists) — so on a window with no tag yet, Save was the single exit. Escape
- * did nothing, a click elsewhere did nothing, and the chip re-opened rather
- * than toggled.
- *
- * The three other popovers in the same component — the Home menu, the theme
- * menu and the kebab menu — all take Escape on the container and all appear in
- * `handleGlobalDismiss`, which a `$effect` wires to window `click`,
- * `contextmenu` and `blur` while any of them is open. The tag editor was the
- * only one missing from both.
- *
- * The Save button has since gone, as in Chrome's tab-group editor: a click
- * elsewhere, the chip and Enter now commit the draft, and Escape alone
- * discards it.
- *
- * These tests RUN the real handlers rather than looking for them; see
- * windowTagEditor.ts for how the component's own functions and markup handlers
- * are lifted into one scope over the REAL `TabManager`. Nothing below asserts
- * how any of it is spelled: rewrite the dismissal any way that keeps these
- * outcomes and they stay green.
- *
- * What this does not establish: focus, CSS, or that Svelte flushes the effect
- * where `clickPath` assumes it does. It establishes what the handlers do when
- * they run.
- */
-
-describe('dismissing the window-tag editor', () => {
-	before(() => tabManager.closeAll());
-
-	// --------------------------------------------------------------- the regression
-
-	test('Escape closes the tag editor on a window that has no tag yet', () => {
-		// The reported dead end: with no tag set, `Remove Tag` is not rendered and
-		// Save is the only control that closes the popover.
-		const { bar } = setup();
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-
-		bar.editorKeydown({ key: 'Escape' });
-
-		assert.equal(bar.state().tagEditorOpen, false, 'Escape left the popover open');
-		assert.equal(tabManager.windowTag, null, 'Escape wrote a tag — dismissing must not commit the draft');
-	});
-
-	test('a click elsewhere in the window commits the draft and closes', async () => {
-		// There is no Save button, so leaving the popover is how a tag is saved.
-		const { bar, clickOutside } = setup();
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-
-		clickOutside();
-		await settle();
-
-		assert.equal(bar.state().tagEditorOpen, false, 'a click outside left the popover open');
-		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: false }, 'a click outside dropped the draft');
-	});
-
-	test('a click elsewhere with a taken name keeps the popover open on the refusal', async () => {
-		const { bar, clickOutside } = setup({ tagTakenElsewhere: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-
-		clickOutside();
-		await settle();
-
-		assert.equal(tabManager.windowTag, null, 'the duplicate name was written anyway');
-		assert.equal(bar.state().tagEditorOpen, true, 'the popover closed, so the refusal had nowhere to appear');
-		assert.notEqual(bar.state().tagError, '');
-	});
-
-	test('a click elsewhere on an unchanged tag asks the backend nothing', () => {
-		const { bar, clickOutside, invokeCalls } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-		bar.openTagEditor();
-
-		clickOutside();
-
-		assert.equal(bar.state().tagEditorOpen, false);
-		assert.deepEqual(invokeCalls, [], 'closing an untouched popover went to the backend');
-	});
-
-	test('the chip toggles the tag editor instead of only opening it', () => {
-		const { bar, clickPath } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-
-		clickPath(bar.chipClick);
-		assert.equal(bar.state().tagEditorOpen, true, 'the chip did not open the popover, or opened it into its own dismissal');
-
-		clickPath(bar.chipClick);
-		assert.equal(bar.state().tagEditorOpen, false, 'a second click on the chip left the popover open');
-		assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned: false }, 'toggling the chip changed the tag');
-	});
-
-	test('opening the tag editor from the Home menu survives the click that opened it', () => {
-		/*
-		 * The other entry point, and the one this fix could plausibly have broken.
-		 * `Home > Set window tag` runs `homeMenuOpen = false; openTagEditor();` and
-		 * calls no `stopPropagation` of its own, while `homeMenuOpen` being true
-		 * means the window `click` listener is ALREADY installed when it runs. Now
-		 * that `handleGlobalDismiss` closes the tag editor too, a click that reached
-		 * the window would open the popover and shut it again in one gesture, and
-		 * the user would see nothing happen.
-		 *
-		 * It does not reach the window: `.home-dropdown-menu` — the item's parent —
-		 * carries `onclick={(e) => e.stopPropagation()}`, which is why none of the
-		 * menu items need one each. That containment is load-bearing for this fix
-		 * and was previously untested, so the whole path runs here: listener already
-		 * installed, then the item's handler, then the container's.
-		 */
-		const { bar, listeners, flush, clickPath } = setup();
-		bar.openHomeMenu();
-		flush();
-		assert.ok(listeners.get('click'), 'precondition: an open Home menu has already installed the window listener');
-
-		clickPath(bar.homeMenuTagItemClick, bar.homeMenuClick);
-
-		assert.equal(bar.state().homeMenuOpen, false, 'the Home menu stayed open');
-		assert.equal(bar.state().tagEditorOpen, true, 'the menu item opened the tag editor into its own dismissal');
-	});
-
-	test('Escape discards the draft: reopening shows the stored tag', () => {
-		// Escape is the one exit that discards, matching the Escape-cancels
-		// convention of every popover editor. The mechanism is `openTagEditor`
-		// re-seeding both draft fields.
-		const { bar } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-		bar.openTagEditor();
-		bar.setDraft('Docs, rewritten', COLORS[4]);
-
-		bar.editorKeydown({ key: 'Escape' });
-		assert.equal(bar.state().tagEditorOpen, false, 'Escape left the popover open');
-		bar.openTagEditor();
-
-		assert.equal(bar.state().tagDraftName, 'Docs', 'the abandoned name came back');
-		assert.equal(bar.state().tagDraftColor, COLORS[1], 'the abandoned colour came back');
-		assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned: false });
-	});
-
-	// ------------------------------------------------------------------ the fences
-	//
-	// Each of these passes today and would also pass for a popover that simply
-	// closed on everything — which is what they are here to stop.
-
-	test('Enter still saves the draft', async () => {
-		const { bar } = setup();
-		bar.openTagEditor();
-		bar.setDraft('Notes', COLORS[3]);
-
-		bar.editorKeydown({ key: 'Enter' });
-		await settle();
-
-		assert.equal(bar.state().tagEditorOpen, false);
-		assert.deepEqual(tabManager.windowTag, { name: 'Notes', color: COLORS[3], pinned: false }, 'Enter stopped committing');
-	});
-
-	test('typing in the name field does not close the tag editor', () => {
-		const { bar } = setup();
-		bar.openTagEditor();
-
-		for (const key of ['a', 'Backspace', 'Tab', 'ArrowLeft', ' ']) {
-			bar.editorKeydown({ key });
-			assert.equal(bar.state().tagEditorOpen, true, `\`${key}\` closed the popover`);
-		}
-	});
-
-	test('clicks inside the tag editor do not dismiss it', () => {
-		// Picking a colour is a click in the window like any other; without the
-		// popover swallowing it, the dismissal added above would eat the editor
-		// the moment the user chose a colour.
-		const { bar, clickPath } = setup();
-		bar.openTagEditor();
-
-		clickPath(bar.editorClick);
-
-		assert.equal(bar.state().tagEditorOpen, true, 'a click inside the popover dismissed it');
-	});
-
-	test('the window listeners exist only while something is open', () => {
-		const { bar, listeners, flush } = setup();
-
-		flush();
-		assert.deepEqual([...listeners.keys()], [], 'listeners are installed with every popover closed');
-
-		bar.openTagEditor();
-		flush();
-		assert.deepEqual([...listeners.keys()].sort(), ['blur', 'click', 'contextmenu']);
-
-		// Every route the menus already used has to dismiss the tag editor too,
-		// not just the click one asserted above.
-		for (const type of ['blur', 'contextmenu']) {
-			bar.openTagEditor();
-			flush();
-			listeners.get(type)!();
-			assert.equal(bar.state().tagEditorOpen, false, `\`${type}\` did not dismiss the tag editor`);
-		}
-
-		flush();
-		assert.deepEqual([...listeners.keys()], [], 'listeners outlived the last open popover');
-	});
-});
-
-/*
- * A window tag is a property of the WINDOW. `TabManager.windowTag` is one
- * nullable record; Tab.svelte and TabList.svelte never read it. Every tab in
- * the window is under the tag and there is no such thing as a tab that is not.
- *
- * The chip renders as a coloured pill at the left end of the tab strip —
- * exactly where Chrome puts a tab-GROUP chip, where a coloured enclosure marks
- * which tabs belong. So the control asks "which of these tabs?" and the screen
- * answers nothing. Three changes make the visual language agree with the
- * semantics, and none of them introduces per-tab membership:
- *
- *   1. one continuous line under the whole strip, in the tag's colour;
- *   2. left-click the chip edits the tag, right-click commands it;
- *   3. a tag name may be held by only one window at a time.
- *
- * These tests RUN the component's own handlers over the real `TabManager` —
- * see windowTagEditor.ts. The two CSS assertions are the exception and say so:
- * there is no layout engine here, so they query the parsed stylesheet for the
- * declarations that decide where the line is drawn.
- */
-
-describe('a window tag is scoped to the whole window', () => {
-	before(() => tabManager.closeAll());
-
-	// ------------------------------------------------------------ 1. scope line
-
-	test('the scope line follows the window tag, and is the strip’s property', () => {
-		const { bar } = setup();
-
-		assert.equal(!!bar.tabAreaTagged(), false, 'an untagged window drew a scope line');
-		assert.equal(bar.tabAreaTagColor(), undefined, 'an untagged window still carried a tag colour');
-
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[4] });
-
-		assert.equal(!!bar.tabAreaTagged(), true, 'a tagged window drew no scope line');
-		assert.equal(bar.tabAreaTagColor(), COLORS[4], 'the line did not take the tag’s colour');
-
-		// The point of putting it on the strip: nothing about it is per tab, so a
-		// tab opened after the tag was set needs no marking of its own.
-		const before = bar.tabAreaTagColor();
-		tabManager.addNewTab();
-		tabManager.addNewTab();
-		assert.equal(bar.tabAreaTagColor(), before, 'opening tabs changed what the scope line shows');
-		assert.equal(!!bar.tabAreaTagged(), true, 'a tab opened after the tag was set left the strip unmarked');
-
-		tabManager.setWindowTag(null);
-		assert.equal(!!bar.tabAreaTagged(), false, 'removing the tag left the scope line behind');
-		tabManager.closeAll();
-	});
-
-	test('the scope line is drawn on the strip, in a channel the active tab does not use', () => {
-		/*
-		 * Not executed: there is no layout engine in this runner, so this reads the
-		 * parsed stylesheet rather than a rendered box. It is here because the
-		 * decision it records is the one that makes the line safe — the active tab
-		 * is marked with `background-color`, so a line along the bottom edge of the
-		 * strip cannot be misread as "this tab", and nothing has to arbitrate
-		 * between the two markings.
-		 */
-		const line = styleRule('src/lib/components/TitleBar.svelte', '.tab-area.tagged::after');
-		assert.ok(line.size > 0, 'no rule draws the scope line');
-		assert.equal(line.get('position'), 'absolute');
-		assert.equal(line.get('bottom'), '0');
-		assert.equal(line.get('left'), '0');
-		assert.equal(line.get('right'), '0', 'the line stops short of the end of the strip');
-		assert.equal(line.get('background'), 'var(--tag-color)', 'the line is not painted in the tag’s colour');
-		assert.equal(line.get('pointer-events'), 'none', 'the line would swallow clicks and drags on the title bar');
-		assert.equal(styleRule('src/lib/components/TitleBar.svelte', '.tab-area').get('position'), 'relative', 'the line has nothing to position against');
-
-		const activeTab = styleRule('src/lib/components/Tab.svelte', '.tab.active');
-		assert.ok(activeTab.size > 0, 'the active tab has no styling at all — this test is looking at the wrong rule');
-		for (const property of ['border-bottom', 'border-bottom-color', 'border', 'box-shadow', 'outline']) {
-			assert.equal(
-				activeTab.get(property),
-				undefined,
-				`the active tab now marks itself with \`${property}\`, which competes with the scope line along the same edge`,
-			);
-		}
-		assert.ok(activeTab.has('background-color'), 'the active tab no longer marks itself with a background');
-	});
-
-	// ------------------------------------------------- 2. left-click / right-click
-
-	test('both buttons on the chip open the one popover', () => {
-		/*
-		 * The chip borrows Chrome's tab-group chip visually, but not the state that
-		 * makes Chrome's left/right division necessary: there, left-click collapses
-		 * and expands the group, so the commands need a second surface. A window tag
-		 * has nothing to collapse, so left-click has no second job and a right-click
-		 * menu would only hide Pin and Remove behind a gesture that advertises
-		 * nothing. What right-click does owe the user is not raising the platform
-		 * menu over the title bar.
-		 */
-		const { bar, clickPath, rightClick } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-
-		clickPath(bar.chipClick);
-		assert.equal(bar.state().tagEditorOpen, true, 'left-click did not open the popover');
-
-		clickPath(bar.chipClick);
-		assert.equal(bar.state().tagEditorOpen, false, 'precondition: left-click still toggles');
-
-		const { defaultPrevented } = rightClick();
-		assert.equal(defaultPrevented, true, 'the platform context menu was left to open over the title bar');
-		assert.equal(bar.state().tagEditorOpen, true, 'right-click did not open the popover');
-	});
-
-	test('right-click opens but never closes, and never discards a draft', () => {
-		/*
-		 * The one place the two gestures differ, and why. `openTagEditor` re-seeds
-		 * the draft from the stored tag, so a right-click that re-opened an open
-		 * popover would throw away a name the user was in the middle of typing —
-		 * and a gesture whose whole purpose is "show me the tag's controls" should
-		 * not sometimes hide them.
-		 */
-		const { bar, rightClick } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-		bar.openTagEditor();
-		bar.setDraft('Docs, half-ty', COLORS[5]);
-
-		rightClick();
-
-		assert.equal(bar.state().tagEditorOpen, true, 'right-click closed the popover it exists to open');
-		assert.equal(bar.state().tagDraftName, 'Docs, half-ty', 'right-click re-seeded the draft over what the user had typed');
-		assert.equal(bar.state().tagDraftColor, COLORS[5], 'right-click re-seeded the colour');
-	});
-
-	test('the popover carries Pin/Unpin and Remove, and each acts on the tag', async () => {
-		/*
-		 * Run through each button's own `onclick`, so this fails if a control is
-		 * unwired as well as if it is missing.
-		 */
-		const { bar, invokeCalls } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-		tabManager.addTab('/notes/a.md');
-		bar.openTagEditor();
-
-		// Pin persists the window's documents under the tag's name.
-		assert.equal(bar.pinLabel(), 'Pin Tag', 'the pin control does not offer to pin an unpinned tag');
-		bar.pinClick({ stopPropagation: () => {} });
-		await settle();
-		assert.equal(tabManager.windowTag?.pinned, true, 'Pin did not pin the tag');
-		assert.deepEqual(
-			invokeCalls.filter((call) => call.cmd === 'save_pinned_tag').map((call) => call.args),
-			[{ name: 'Docs', color: COLORS[1], files: ['/notes/a.md'] }],
-			'Pin did not persist the window’s documents',
-		);
-		assert.equal(bar.pinLabel(), 'Unpin Tag', 'the pin control does not track the pin state');
-
-		// Remove drops the tag and the saved session with it.
-		bar.removeClick({ stopPropagation: () => {} });
-		assert.equal(tabManager.windowTag, null, 'Remove left the tag in place');
-		assert.ok(
-			invokeCalls.some((call) => call.cmd === 'remove_pinned_tag' && call.args.name === 'Docs'),
-			'Remove dropped a pinned tag from the window without dropping its saved session',
-		);
-		tabManager.closeAll();
-	});
-
-	test('Close Tag is offered only for a pinned tag, the one Home can reopen', () => {
-		// Closing an unpinned tag would lose it for good, which is Remove's job.
-		const { bar } = setup();
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-		bar.openTagEditor();
-		assert.equal(!!bar.closeRendered(), false, 'an unpinned tag was offered Close');
-
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1], pinned: true });
-		assert.equal(!!bar.closeRendered(), true, 'a pinned tag was not offered Close');
-	});
-
-	test('Pin and Remove are offered only once a tag exists', () => {
-		// They act on a stored tag, and `Home > Window Tag…` opens this popover on a
-		// window that has none. Both render under `{#if tabManager.windowTag}`; this
-		// evaluates that condition rather than reading it.
-		const { bar } = setup();
-		bar.openTagEditor();
-
-		assert.equal(!!bar.pinRendered(), false, 'a window with no tag was offered Pin');
-		assert.equal(!!bar.removeRendered(), false, 'a window with no tag was offered Remove');
-
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
-
-		assert.equal(!!bar.pinRendered(), true, 'a tagged window was not offered Pin');
-		assert.equal(!!bar.removeRendered(), true, 'a tagged window was not offered Remove');
-	});
-
-	test('an emptied name keeps the tag, pinned or not, and asks the backend nothing', async () => {
-		// With commit-on-dismiss, an emptied name that removed the tag would let a
-		// stray click delete a pinned session. Remove Tag is the only way out.
-		for (const pinned of [false, true]) {
-			const { bar, invokeCalls } = setup({ tagTakenElsewhere: true });
-			tabManager.setWindowTag({ name: 'Docs', color: COLORS[1], pinned });
-			bar.openTagEditor();
-			bar.setDraft('   ', COLORS[4]);
-
-			await bar.applyTag();
-
-			assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned }, 'an emptied name changed the tag');
-			assert.equal(bar.state().tagEditorOpen, false, 'the popover stayed open');
-			assert.deepEqual(invokeCalls, [], 'an emptied name went to the backend');
-		}
-	});
-
-	// ----------------------------------------------------------- 4. exclusivity
-
-	test('a name another window already holds is refused, in the popover', async () => {
-		const { bar, invokeCalls } = setup({ tagTakenElsewhere: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-
-		await bar.applyTag();
-
-		assert.equal(tabManager.windowTag, null, 'the duplicate name was written anyway');
-		assert.equal(bar.state().tagEditorOpen, true, 'the popover closed, so the refusal had nowhere to appear');
-		assert.match(bar.state().tagError, /already uses this name/i, 'the refusal does not say what happened');
-		assert.match(bar.state().tagError, /pick a different one/i, 'the refusal does not say what to do about it');
-		assert.deepEqual(
-			invokeCalls.filter((call) => call.cmd === 'is_window_tag_taken').map((call) => call.args),
-			[{ name: 'Research' }],
-			'the name was not checked, or was checked more than once',
-		);
-		assert.equal(bar.state().tagDraftName, 'Research', 'the refused name was taken away from the user to retype');
-	});
-
-	test('editing the name clears the refusal', async () => {
-		const { bar } = setup({ tagTakenElsewhere: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-		await bar.applyTag();
-		assert.notEqual(bar.state().tagError, '', 'precondition: the save was refused');
-
-		bar.typeName('Research notes');
-
-		assert.equal(bar.state().tagError, '', 'the refusal stayed on screen while the user fixed it');
-	});
-
-	test('the name is trimmed before it is checked and before it is stored', async () => {
-		// Otherwise `"Research "` slips past a check for `"Research"` and lands in
-		// the registry as a second, invisible spelling of the same name.
-		const seen: string[] = [];
-		const { bar, invokeCalls } = setup({ tagTakenElsewhere: () => true });
-		bar.openTagEditor();
-		bar.setDraft('  Research  ', COLORS[2]);
-
-		await bar.applyTag();
-		seen.push(...invokeCalls.filter((call) => call.cmd === 'is_window_tag_taken').map((call) => call.args.name));
-
-		assert.deepEqual(seen, ['Research'], 'the untrimmed name was sent to the check');
-	});
-
-	test('a window may keep its own name — the check excludes the asker', async () => {
-		// Changing only the colour re-saves the same name. The exclusion is the
-		// backend's (`tag_held_by_another_window` skips the asking label), so what
-		// this pins down is that the frontend asks and obeys rather than
-		// second-guessing: given "not taken", the save goes through.
-		const { bar } = setup({ tagTakenElsewhere: false });
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[6]);
-
-		await bar.applyTag();
-
-		assert.deepEqual(
-			tabManager.windowTag,
-			{ name: 'Research', color: COLORS[6], pinned: true },
-			're-saving a window’s own tag name was refused, or lost its pin',
-		);
-		assert.equal(bar.state().tagError, '');
-	});
-
-	test('a backend that cannot answer does not block the user’s own save', async () => {
-		// The check exists to stop one window quietly overwriting another's pinned
-		// documents. An IPC failure is not evidence that it would, and refusing
-		// here would make a broken command look like a naming rule.
-		const { bar } = setup({ invokeFails: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[2]);
-
-		await bar.applyTag();
-
-		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: false }, 'a failed check swallowed the save');
-		assert.equal(bar.state().tagEditorOpen, false);
-		assert.equal(bar.state().tagError, '');
-	});
-
-	// -------------------------------------------------------- 5. renaming a pin
-
-	test('renaming a pinned tag renames its pin, which keeps the window pinned', async () => {
-		// The closing save refreshes the pin by the window's current name. A rename
-		// that left pinned-tags.json alone found nothing there at close, and the
-		// window silently unpinned itself while Home kept the old name.
-		const { bar, invokeCalls } = setup();
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
-		bar.openTagEditor();
-		bar.setDraft('Papers', COLORS[6]);
-
-		await bar.applyTag();
-
-		assert.deepEqual(
-			invokeCalls.filter((call) => call.cmd === 'rename_pinned_tag').map((call) => call.args),
-			[{ oldName: 'Research', name: 'Papers', color: COLORS[6] }],
-			'the pin file was not told about the rename',
-		);
-		assert.deepEqual(tabManager.windowTag, { name: 'Papers', color: COLORS[6], pinned: true });
-	});
-
-	test('a name another pinned tag holds is refused, in the popover', async () => {
-		const { bar } = setup({ pinRename: 'taken' });
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
-		bar.openTagEditor();
-		bar.setDraft('Notes', COLORS[2]);
-
-		await bar.applyTag();
-
-		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: true }, 'the rename went through anyway');
-		assert.equal(bar.state().tagEditorOpen, true);
-		assert.match(bar.state().tagError, /pinned tag already uses this name/i);
-	});
-
-	test('pinning under a name a closed pinned group holds is refused, in the popover', async () => {
-		// The group's window is closed, so no open window holds the name and the
-		// rename check never saw it. Pinning used to replace that group's files.
-		const { bar } = setup({ pinCreated: false });
-		tabManager.setWindowTag({ name: 'Work', color: COLORS[2] });
-		bar.openTagEditor();
-
-		bar.pinClick({ stopPropagation: () => {} });
-		await settle();
-
-		assert.deepEqual(tabManager.windowTag, { name: 'Work', color: COLORS[2], pinned: false }, 'the window was marked pinned anyway');
-		assert.equal(bar.state().tagEditorOpen, true);
-		assert.match(bar.state().tagError, /pinned tag already uses this name/i);
-	});
-
-	test('renaming a tag another window unpinned renames the window unpinned', async () => {
-		const { bar } = setup({ pinRename: 'missing' });
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
-		bar.openTagEditor();
-		bar.setDraft('Papers', COLORS[2]);
-
-		await bar.applyTag();
-
-		assert.deepEqual(tabManager.windowTag, { name: 'Papers', color: COLORS[2], pinned: false });
-	});
-
-	test('an unpinned rename and a pinned colour change leave the pin file to the closing save', async () => {
-		// The closing save sends the colour with the files, so a colour change
-		// reaches the pin file without a rename.
-		const { bar, invokeCalls } = setup();
-		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
-		bar.openTagEditor();
-		bar.setDraft('Research', COLORS[6]);
-		await bar.applyTag();
-
-		tabManager.setWindowTag({ name: 'Docs', color: COLORS[2] });
-		bar.openTagEditor();
-		bar.setDraft('Papers', COLORS[2]);
-		await bar.applyTag();
-
-		assert.deepEqual(invokeCalls.filter((call) => call.cmd === 'rename_pinned_tag'), []);
-	});
-});
diff --git a/scripts/windows.tagEditor.spec.ts b/scripts/windows.tagEditor.spec.ts
new file mode 100644
index 00000000..e10eccac
--- /dev/null
+++ b/scripts/windows.tagEditor.spec.ts
@@ -0,0 +1,519 @@
+import assert from 'node:assert/strict';
+
+import { flushSync } from 'svelte';
+import { beforeEach, describe, onTestFinished, test } from 'vitest';
+
+/*
+ * The title bar's popovers — Home, theme, kebab and the window-tag editor —
+ * run here as TitleBar.svelte runs them: `TitleBarPopovers` over the real
+ * `TabManager`, under the compiler's runes, with its dismissal installed by a
+ * real `$effect`. Only the Tauri backend is stubbed.
+ *
+ * What this does not establish: that the markup wires each handler to the
+ * element named in the test, focus, or CSS.
+ */
+
+type InvokeCall = { cmd: string; args: any };
+type Backend = {
+	/** Answers `is_window_tag_taken`. */
+	tagTakenElsewhere?: boolean;
+	/** Fails every command, to drive the "backend cannot answer" path. */
+	invokeFails?: boolean;
+	/** Answers `rename_pinned_tag`. */
+	pinRename?: 'renamed' | 'missing' | 'taken';
+	/** Answers `save_pinned_tag`: `false` when another pin holds the name. */
+	pinCreated?: boolean;
+};
+
+let backend: Backend = {};
+let invokeCalls: InvokeCall[] = [];
+
+(window as any).__TAURI_INTERNALS__ = {
+	metadata: { currentWindow: { label: 'main' }, currentWebview: { windowLabel: 'main', label: 'main' } },
+	invoke: (cmd: string, args: any) => {
+		// The settings store boots on import; see AGENTS.md on `get_os_type`.
+		if (cmd === 'get_os_type') return Promise.resolve('macos');
+		invokeCalls.push({ cmd, args });
+		if (backend.invokeFails) return Promise.reject(new Error(`invoke failed: ${cmd}`));
+		if (cmd === 'rename_pinned_tag') return Promise.resolve(backend.pinRename ?? 'renamed');
+		if (cmd === 'save_pinned_tag') return Promise.resolve(backend.pinCreated ?? true);
+		if (cmd === 'is_window_tag_taken') return Promise.resolve(backend.tagTakenElsewhere ?? false);
+		return Promise.resolve(null);
+	},
+	transformCallback: (fn: unknown) => fn,
+};
+
+const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
+const { settings } = await import('../src/lib/stores/settings.svelte.js');
+const { TAG_COLORS: COLORS, TitleBarPopovers, containClick, scopeLine } = await import('../src/lib/stores/titleBarPopovers.svelte.js');
+const { runeEffect } = await import('./runeEffect.svelte.js');
+
+/** An `EventTarget` standing in for `window` that reports which listeners are on it. */
+class ListenedTarget extends EventTarget {
+	readonly types = new Map<string, number>();
+	addEventListener(type: string, fn: EventListenerOrEventListenerObject | null, options?: unknown) {
+		this.types.set(type, (this.types.get(type) ?? 0) + 1);
+		super.addEventListener(type, fn, options as AddEventListenerOptions);
+	}
+	removeEventListener(type: string, fn: EventListenerOrEventListenerObject | null, options?: unknown) {
+		const count = this.types.get(type) ?? 0;
+		if (count <= 1) this.types.delete(type);
+		else this.types.set(type, count - 1);
+		super.removeEventListener(type, fn, options as EventListenerOptions);
+	}
+	listening(): string[] {
+		return [...this.types.keys()].sort();
+	}
+}
+
+function setup(next: Backend = {}) {
+	backend = next;
+	invokeCalls = [];
+	tabManager.setWindowTag(null);
+	const target = new ListenedTarget();
+	const bar = new TitleBarPopovers();
+	onTestFinished(runeEffect(() => bar.listenForDismiss(target)));
+	flushSync();
+
+	/**
+	 * One gesture along its bubble path: each handler in turn, then the window —
+	 * unless something on the way called `stopPropagation`. Effects flush
+	 * between the element's handlers and the window listener, as they do for a
+	 * real click, so a listener installed by this very click sees it.
+	 */
+	const gesture = (type: string, ...handlers: Array<(event: Event) => void>) => {
+		const event = new Event(type, { cancelable: true });
+		let stopped = false;
+		event.stopPropagation = () => void (stopped = true);
+		for (const handler of handlers) {
+			if (stopped) break;
+			handler(event);
+		}
+		flushSync();
+		if (!stopped) target.dispatchEvent(new Event(type));
+		flushSync();
+		return event;
+	};
+	const clickPath = (...handlers: Array<(event: Event) => void>) => gesture('click', ...handlers);
+	const clickOutside = () => clickPath();
+	const rightClickChip = () => gesture('contextmenu', (event) => bar.openTagEditorFromContextMenu(event));
+	const chipClick = (event: Event) => bar.toggleTagEditor(event);
+
+	return { bar, target, clickPath, clickOutside, rightClickChip, chipClick };
+}
+
+const settle = () => new Promise<void>((resolve) => setTimeout(resolve, 0));
+
+beforeEach(() => {
+	tabManager.closeAll();
+	settings.language = 'en';
+});
+
+/*
+ * The window-tag popover had no way out that did not write something: on a
+ * window with no tag yet, Save was the single exit. Escape did nothing, a click
+ * elsewhere did nothing, and the chip re-opened rather than toggled. The Save
+ * button has since gone, as in Chrome's tab-group editor: a click elsewhere,
+ * the chip and Enter commit the draft, and Escape alone discards it.
+ */
+describe('dismissing the window-tag editor', () => {
+	test('Escape closes the tag editor on a window that has no tag yet', () => {
+		const { bar } = setup();
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+		bar.tagDraftColor = COLORS[2];
+
+		bar.editorKeydown({ key: 'Escape' });
+
+		assert.equal(bar.tagEditorOpen, false, 'Escape left the popover open');
+		assert.equal(tabManager.windowTag, null, 'Escape wrote a tag — dismissing must not commit the draft');
+	});
+
+	test('a click elsewhere in the window commits the draft and closes', async () => {
+		const { bar, clickOutside } = setup();
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+		bar.tagDraftColor = COLORS[2];
+
+		clickOutside();
+		await settle();
+
+		assert.equal(bar.tagEditorOpen, false, 'a click outside left the popover open');
+		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: false }, 'a click outside dropped the draft');
+	});
+
+	test('a click elsewhere with a taken name keeps the popover open on the refusal', async () => {
+		const { bar, clickOutside } = setup({ tagTakenElsewhere: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+
+		clickOutside();
+		await settle();
+
+		assert.equal(tabManager.windowTag, null, 'the duplicate name was written anyway');
+		assert.equal(bar.tagEditorOpen, true, 'the popover closed, so the refusal had nowhere to appear');
+		assert.notEqual(bar.tagError, '');
+	});
+
+	test('a click elsewhere on an unchanged tag asks the backend nothing', () => {
+		const { bar, clickOutside } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		bar.openTagEditor();
+
+		clickOutside();
+
+		assert.equal(bar.tagEditorOpen, false);
+		assert.deepEqual(invokeCalls, [], 'closing an untouched popover went to the backend');
+	});
+
+	test('the chip toggles the tag editor instead of only opening it', () => {
+		const { bar, clickPath, chipClick } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+
+		clickPath(chipClick);
+		assert.equal(bar.tagEditorOpen, true, 'the chip did not open the popover, or opened it into its own dismissal');
+
+		clickPath(chipClick);
+		assert.equal(bar.tagEditorOpen, false, 'a second click on the chip left the popover open');
+		assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned: false }, 'toggling the chip changed the tag');
+	});
+
+	test('opening the tag editor from the Home menu survives the click that opened it', () => {
+		// The item calls no `stopPropagation` of its own while the open Home menu
+		// has already installed the window listener; its container does.
+		const { bar, target, clickPath } = setup();
+		bar.homeMenuOpen = true;
+		flushSync();
+		assert.ok(target.listening().includes('click'), 'precondition: an open Home menu has already installed the window listener');
+
+		clickPath(() => bar.openTagEditorFromHomeMenu(), containClick);
+
+		assert.equal(bar.homeMenuOpen, false, 'the Home menu stayed open');
+		assert.equal(bar.tagEditorOpen, true, 'the menu item opened the tag editor into its own dismissal');
+	});
+
+	test('Escape discards the draft: reopening shows the stored tag', () => {
+		const { bar } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Docs, rewritten';
+		bar.tagDraftColor = COLORS[4];
+
+		bar.editorKeydown({ key: 'Escape' });
+		assert.equal(bar.tagEditorOpen, false, 'Escape left the popover open');
+		bar.openTagEditor();
+
+		assert.equal(bar.tagDraftName, 'Docs', 'the abandoned name came back');
+		assert.equal(bar.tagDraftColor, COLORS[1], 'the abandoned colour came back');
+		assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned: false });
+	});
+
+	test('Enter still saves the draft', async () => {
+		const { bar } = setup();
+		bar.openTagEditor();
+		bar.tagDraftName = 'Notes';
+		bar.tagDraftColor = COLORS[3];
+
+		bar.editorKeydown({ key: 'Enter' });
+		await settle();
+
+		assert.equal(bar.tagEditorOpen, false);
+		assert.deepEqual(tabManager.windowTag, { name: 'Notes', color: COLORS[3], pinned: false }, 'Enter stopped committing');
+	});
+
+	test('typing in the name field does not close the tag editor', () => {
+		const { bar } = setup();
+		bar.openTagEditor();
+
+		for (const key of ['a', 'Backspace', 'Tab', 'ArrowLeft', ' ']) {
+			bar.editorKeydown({ key });
+			assert.equal(bar.tagEditorOpen, true, `\`${key}\` closed the popover`);
+		}
+	});
+
+	test('clicks inside the tag editor do not dismiss it', () => {
+		const { bar, clickPath } = setup();
+		bar.openTagEditor();
+		flushSync();
+
+		clickPath(() => (bar.tagDraftColor = COLORS[5]), containClick);
+
+		assert.equal(bar.tagEditorOpen, true, 'a click inside the popover dismissed it');
+	});
+
+	test('the window listeners exist only while something is open', () => {
+		const { bar, target } = setup();
+		assert.deepEqual(target.listening(), [], 'listeners are installed with every popover closed');
+
+		bar.openTagEditor();
+		flushSync();
+		assert.deepEqual(target.listening(), ['blur', 'click', 'contextmenu']);
+
+		for (const type of ['blur', 'contextmenu']) {
+			bar.openTagEditor();
+			flushSync();
+			target.dispatchEvent(new Event(type));
+			flushSync();
+			assert.equal(bar.tagEditorOpen, false, `\`${type}\` did not dismiss the tag editor`);
+		}
+
+		assert.deepEqual(target.listening(), [], 'listeners outlived the last open popover');
+	});
+});
+
+/*
+ * A window tag is a property of the WINDOW: one nullable record on the
+ * `TabManager`, under which every tab in the window sits. The chip sits where
+ * Chrome puts a tab-group chip, so the strip draws one line under all of it,
+ * both mouse buttons open the one popover, and a name is held by one window.
+ */
+describe('a window tag is scoped to the whole window', () => {
+	test('the scope line follows the window tag, and is the strip’s property', () => {
+		setup();
+		assert.deepEqual(scopeLine(tabManager.windowTag), { tagged: false, color: undefined }, 'an untagged window drew a scope line');
+
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[4] });
+		assert.deepEqual(scopeLine(tabManager.windowTag), { tagged: true, color: COLORS[4] }, 'a tagged window drew no scope line in its colour');
+
+		// Nothing about it is per tab, so a tab opened after the tag was set needs
+		// no marking of its own.
+		tabManager.addNewTab();
+		tabManager.addNewTab();
+		assert.deepEqual(scopeLine(tabManager.windowTag), { tagged: true, color: COLORS[4] }, 'opening tabs changed what the scope line shows');
+
+		tabManager.setWindowTag(null);
+		assert.equal(scopeLine(tabManager.windowTag).tagged, false, 'removing the tag left the scope line behind');
+	});
+
+	test('both buttons on the chip open the one popover', () => {
+		const { bar, clickPath, chipClick, rightClickChip } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+
+		clickPath(chipClick);
+		assert.equal(bar.tagEditorOpen, true, 'left-click did not open the popover');
+		clickPath(chipClick);
+		assert.equal(bar.tagEditorOpen, false, 'precondition: left-click still toggles');
+
+		const event = rightClickChip();
+		assert.equal(event.defaultPrevented, true, 'the platform context menu was left to open over the title bar');
+		assert.equal(bar.tagEditorOpen, true, 'right-click did not open the popover, or opened it into its own dismissal');
+	});
+
+	test('right-click opens but never closes, and never discards a draft', () => {
+		const { bar, rightClickChip } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Docs, half-ty';
+		bar.tagDraftColor = COLORS[5];
+		flushSync();
+
+		rightClickChip();
+
+		assert.equal(bar.tagEditorOpen, true, 'right-click closed the popover it exists to open');
+		assert.equal(bar.tagDraftName, 'Docs, half-ty', 'right-click re-seeded the draft over what the user had typed');
+		assert.equal(bar.tagDraftColor, COLORS[5], 'right-click re-seeded the colour');
+	});
+
+	test('the popover carries Pin/Unpin and Remove, and each acts on the tag', async () => {
+		const { bar } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		tabManager.addTab('/notes/a.md');
+		bar.openTagEditor();
+
+		assert.equal(bar.tagActions?.pinned, false, 'the pin control does not offer to pin an unpinned tag');
+		await bar.togglePinnedTag();
+		assert.equal(tabManager.windowTag?.pinned, true, 'Pin did not pin the tag');
+		assert.deepEqual(
+			invokeCalls.filter((call) => call.cmd === 'save_pinned_tag').map((call) => call.args),
+			[{ name: 'Docs', color: COLORS[1], files: ['/notes/a.md'] }],
+			'Pin did not persist the window’s documents',
+		);
+		assert.equal(bar.tagActions?.pinned, true, 'the pin control does not track the pin state');
+
+		bar.clearTag();
+		assert.equal(tabManager.windowTag, null, 'Remove left the tag in place');
+		assert.ok(
+			invokeCalls.some((call) => call.cmd === 'remove_pinned_tag' && call.args.name === 'Docs'),
+			'Remove dropped a pinned tag from the window without dropping its saved session',
+		);
+	});
+
+	test('Close Tag is offered only for a pinned tag, the one Home can reopen', () => {
+		const { bar } = setup();
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		assert.equal(bar.tagActions?.canClose, false, 'an unpinned tag was offered Close');
+
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1], pinned: true });
+		assert.equal(bar.tagActions?.canClose, true, 'a pinned tag was not offered Close');
+	});
+
+	test('Pin and Remove are offered only once a tag exists', () => {
+		const { bar } = setup();
+		bar.openTagEditor();
+		assert.equal(bar.tagActions, null, 'a window with no tag was offered Pin and Remove');
+
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[1] });
+		assert.notEqual(bar.tagActions, null, 'a tagged window was not offered Pin and Remove');
+	});
+
+	test('an emptied name keeps the tag, pinned or not, and asks the backend nothing', async () => {
+		for (const pinned of [false, true]) {
+			const { bar } = setup({ tagTakenElsewhere: true });
+			tabManager.setWindowTag({ name: 'Docs', color: COLORS[1], pinned });
+			bar.openTagEditor();
+			bar.tagDraftName = '   ';
+			bar.tagDraftColor = COLORS[4];
+
+			await bar.applyTag();
+
+			assert.deepEqual(tabManager.windowTag, { name: 'Docs', color: COLORS[1], pinned }, 'an emptied name changed the tag');
+			assert.equal(bar.tagEditorOpen, false, 'the popover stayed open');
+			assert.deepEqual(invokeCalls, [], 'an emptied name went to the backend');
+		}
+	});
+
+	test('a name another window already holds is refused, in the popover', async () => {
+		const { bar } = setup({ tagTakenElsewhere: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+
+		await bar.applyTag();
+
+		assert.equal(tabManager.windowTag, null, 'the duplicate name was written anyway');
+		assert.equal(bar.tagEditorOpen, true, 'the popover closed, so the refusal had nowhere to appear');
+		assert.match(bar.tagError, /already uses this name/i, 'the refusal does not say what happened');
+		assert.match(bar.tagError, /pick a different one/i, 'the refusal does not say what to do about it');
+		assert.deepEqual(
+			invokeCalls.filter((call) => call.cmd === 'is_window_tag_taken').map((call) => call.args),
+			[{ name: 'Research' }],
+			'the name was not checked, or was checked more than once',
+		);
+		assert.equal(bar.tagDraftName, 'Research', 'the refused name was taken away from the user to retype');
+	});
+
+	test('editing the name clears the refusal', async () => {
+		const { bar } = setup({ tagTakenElsewhere: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+		await bar.applyTag();
+		assert.notEqual(bar.tagError, '', 'precondition: the save was refused');
+
+		bar.tagDraftName = 'Research notes';
+		bar.nameEdited();
+
+		assert.equal(bar.tagError, '', 'the refusal stayed on screen while the user fixed it');
+	});
+
+	test('the name is trimmed before it is checked and before it is stored', async () => {
+		// Otherwise `"Research "` slips past a check for `"Research"`.
+		const { bar } = setup();
+		bar.openTagEditor();
+		bar.tagDraftName = '  Research  ';
+		bar.tagDraftColor = COLORS[2];
+
+		await bar.applyTag();
+
+		assert.deepEqual(
+			invokeCalls.filter((call) => call.cmd === 'is_window_tag_taken').map((call) => call.args.name),
+			['Research'],
+			'the untrimmed name was sent to the check',
+		);
+		assert.equal(tabManager.windowTag?.name, 'Research', 'the untrimmed name was stored');
+	});
+
+	test('a window may keep its own name — the check excludes the asker', async () => {
+		// The exclusion is the backend's; the frontend asks and obeys.
+		const { bar } = setup({ tagTakenElsewhere: false });
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
+		bar.openTagEditor();
+		bar.tagDraftColor = COLORS[6];
+
+		await bar.applyTag();
+
+		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[6], pinned: true }, 're-saving a window’s own tag name was refused, or lost its pin');
+		assert.equal(bar.tagError, '');
+	});
+
+	test('a backend that cannot answer does not block the user’s own save', async () => {
+		const { bar } = setup({ invokeFails: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Research';
+		bar.tagDraftColor = COLORS[2];
+
+		await bar.applyTag();
+
+		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: false }, 'a failed check swallowed the save');
+		assert.equal(bar.tagEditorOpen, false);
+		assert.equal(bar.tagError, '');
+	});
+
+	test('renaming a pinned tag renames its pin, which keeps the window pinned', async () => {
+		// The closing save refreshes the pin by the window's current name; a rename
+		// that left pinned-tags.json alone unpinned the window at close.
+		const { bar } = setup();
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Papers';
+		bar.tagDraftColor = COLORS[6];
+
+		await bar.applyTag();
+
+		assert.deepEqual(
+			invokeCalls.filter((call) => call.cmd === 'rename_pinned_tag').map((call) => call.args),
+			[{ oldName: 'Research', name: 'Papers', color: COLORS[6] }],
+			'the pin file was not told about the rename',
+		);
+		assert.deepEqual(tabManager.windowTag, { name: 'Papers', color: COLORS[6], pinned: true });
+	});
+
+	test('a name another pinned tag holds is refused, in the popover', async () => {
+		const { bar } = setup({ pinRename: 'taken' });
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Notes';
+
+		await bar.applyTag();
+
+		assert.deepEqual(tabManager.windowTag, { name: 'Research', color: COLORS[2], pinned: true }, 'the rename went through anyway');
+		assert.equal(bar.tagEditorOpen, true);
+		assert.match(bar.tagError, /pinned tag already uses this name/i);
+	});
+
+	test('pinning under a name a closed pinned group holds is refused, in the popover', async () => {
+		const { bar } = setup({ pinCreated: false });
+		tabManager.setWindowTag({ name: 'Work', color: COLORS[2] });
+		bar.openTagEditor();
+
+		await bar.togglePinnedTag();
+
+		assert.deepEqual(tabManager.windowTag, { name: 'Work', color: COLORS[2], pinned: false }, 'the window was marked pinned anyway');
+		assert.equal(bar.tagEditorOpen, true);
+		assert.match(bar.tagError, /pinned tag already uses this name/i);
+	});
+
+	test('renaming a tag another window unpinned renames the window unpinned', async () => {
+		const { bar } = setup({ pinRename: 'missing' });
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Papers';
+
+		await bar.applyTag();
+
+		assert.deepEqual(tabManager.windowTag, { name: 'Papers', color: COLORS[2], pinned: false });
+	});
+
+	test('an unpinned rename and a pinned colour change leave the pin file to the closing save', async () => {
+		const { bar } = setup();
+		tabManager.setWindowTag({ name: 'Research', color: COLORS[2], pinned: true });
+		bar.openTagEditor();
+		bar.tagDraftColor = COLORS[6];
+		await bar.applyTag();
+
+		tabManager.setWindowTag({ name: 'Docs', color: COLORS[2] });
+		bar.openTagEditor();
+		bar.tagDraftName = 'Papers';
+		await bar.applyTag();
+
+		assert.deepEqual(invokeCalls.filter((call) => call.cmd === 'rename_pinned_tag'), []);
+	});
+});
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 4e703e91..a8dcb2c7 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -54,6 +54,11 @@ image = { version = "0.25", default-features = false, features = ["png"] }
 chardetng = "1"
 encoding_rs = "0.8"
 
+[target.'cfg(not(windows))'.dev-dependencies]
+# Mock runtime (`tauri::test`) for tests that need an AppHandle or a window.
+# Not on Windows: see `setup_tests` in app.rs.
+tauri = { version = "2", features = ["test"] }
+
 
 
 [target.'cfg(windows)'.dependencies]
diff --git a/src-tauri/src/app.rs b/src-tauri/src/app.rs
index ef638b70..a2d3f680 100644
--- a/src-tauri/src/app.rs
+++ b/src-tauri/src/app.rs
@@ -4,7 +4,7 @@
 use crate::window_runtime::{AppState, WatcherState};
 use crate::{asset_protocol, commands, tab_transfer, window_runtime};
 use std::fs;
-use tauri::{Emitter, Manager};
+use tauri::{Emitter, Manager, Runtime};
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
@@ -70,87 +70,7 @@ pub fn run() {
                 // before the plugin loads if that ever matters.
                 .build(),
         )
-        .setup(|app| {
-            app.manage(window_runtime::GeometrySaver::new(app.handle().clone()));
-            let args: Vec<String> = std::env::args().collect();
-
-            let mut window_builder = tauri::WebviewWindowBuilder::new(
-                app,
-                window_runtime::LAUNCH_LABEL,
-                tauri::WebviewUrl::App("index.html".into()),
-            )
-            .title("Markpad")
-            .inner_size(900.0, 650.0)
-            .min_inner_size(400.0, 300.0)
-            .visible(false)
-            // Not `.focused(false)`: on a window built hidden it leaves WebView2
-            // on Windows with no drop target, so every file dragged in is
-            // refused (#768, tauri-apps/wry#1639). tao also keeps applying it
-            // after the first show, so minimizing a maximized window flashes it
-            // at its restored size (#776, tauri-apps/tao#1338). `show_window` skipping
-            // `set_focus` is what keeps a cold start from stealing focus.
-            .resizable(true)
-            .shadow(false)
-            .center();
-
-            #[cfg(target_os = "macos")]
-            {
-                window_builder = window_builder
-                    .decorations(true)
-                    .title_bar_style(tauri::TitleBarStyle::Overlay)
-                    .hidden_title(true);
-            }
-
-            #[cfg(not(target_os = "macos"))]
-            {
-                window_builder = window_builder.decorations(false);
-            }
-
-            let window = window_builder.build()?;
-
-            let config_dir = app.path().app_config_dir()?;
-            let theme_path = config_dir.join("theme.txt");
-            let theme_pref =
-                fs::read_to_string(theme_path).unwrap_or_else(|_| "system".to_string());
-
-            // An APPEARANCE, written by `save_theme` — see the note there. It
-            // used to be the raw theme setting, which meant every `vscode:<name>`
-            // theme landed in the fallback arm below and asked the OS instead: a
-            // dark VS Code theme on a light desktop flashed a white window on
-            // every launch. A file left over from that older format still lands
-            // there, and self-corrects as soon as the frontend applies its theme.
-            let bg_color = match theme_pref.as_str() {
-                "dark" => Some(tauri::window::Color(24, 24, 24, 255)),
-                "light" => Some(tauri::window::Color(253, 253, 253, 255)),
-                _ => {
-                    if let Ok(t) = window.theme() {
-                        match t {
-                            tauri::Theme::Dark => Some(tauri::window::Color(24, 24, 24, 255)),
-                            _ => Some(tauri::window::Color(253, 253, 253, 255)),
-                        }
-                    } else {
-                        Some(tauri::window::Color(253, 253, 253, 255))
-                    }
-                }
-            };
-
-            let _ = window.set_background_color(bg_color);
-
-            let _ = window.set_shadow(true);
-
-            // Same vetting as `send_markdown_path`, which reads the same argv:
-            // the frontend consumes BOTH channels, so a path this one lets
-            // through reaches `loadMarkdown` no matter what the other decides.
-            let startup_files =
-                window_runtime::startup_paths(&args, &std::env::current_dir().unwrap_or_default());
-
-            if let Some(path) = startup_files.first() {
-                let _ = window.emit("file-path", path.as_str());
-                window_runtime::bring_to_front(&window);
-            }
-
-            Ok(())
-        })
+        .setup(setup)
         .invoke_handler(tauri::generate_handler![
             commands::clipboard_write_text,
             commands::clipboard_read_text,
@@ -227,14 +147,140 @@ pub fn run() {
         .run(|_app_handle, _event| {
             #[cfg(target_os = "macos")]
             if let tauri::RunEvent::Opened { urls } = _event {
-                for url in urls {
-                    if let Ok(path_buf) = url.to_file_path() {
-                        window_runtime::deliver_opened_path(
-                            _app_handle,
-                            path_buf.to_string_lossy().to_string(),
-                        );
-                    }
+                for path in opened_file_paths(urls) {
+                    window_runtime::deliver_opened_path(_app_handle, path);
                 }
             }
         });
 }
+
+/// Builds the launch window and hands it the launch's first file.
+fn setup<R: Runtime>(app: &mut tauri::App<R>) -> Result<(), Box<dyn std::error::Error>> {
+    app.manage(window_runtime::GeometrySaver::new(app.handle().clone()));
+    let args: Vec<String> = std::env::args().collect();
+
+    let mut window_builder = tauri::WebviewWindowBuilder::new(
+        app,
+        window_runtime::LAUNCH_LABEL,
+        tauri::WebviewUrl::App("index.html".into()),
+    )
+    .title("Markpad")
+    .inner_size(900.0, 650.0)
+    .min_inner_size(400.0, 300.0)
+    .visible(false)
+    // Not `.focused(false)`: on a window built hidden it leaves WebView2
+    // on Windows with no drop target, so every file dragged in is
+    // refused (#768, tauri-apps/wry#1639). tao also keeps applying it
+    // after the first show, so minimizing a maximized window flashes it
+    // at its restored size (#776, tauri-apps/tao#1338). `show_window` skipping
+    // `set_focus` is what keeps a cold start from stealing focus.
+    .resizable(true)
+    .shadow(false)
+    .center();
+
+    #[cfg(target_os = "macos")]
+    {
+        window_builder = window_builder
+            .decorations(true)
+            .title_bar_style(tauri::TitleBarStyle::Overlay)
+            .hidden_title(true);
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    {
+        window_builder = window_builder.decorations(false);
+    }
+
+    let window = window_builder.build()?;
+
+    let config_dir = app.path().app_config_dir()?;
+    let theme_path = config_dir.join("theme.txt");
+    let theme_pref = fs::read_to_string(theme_path).unwrap_or_else(|_| "system".to_string());
+
+    // An APPEARANCE, written by `save_theme` — see the note there. It
+    // used to be the raw theme setting, which meant every `vscode:<name>`
+    // theme landed in the fallback arm below and asked the OS instead: a
+    // dark VS Code theme on a light desktop flashed a white window on
+    // every launch. A file left over from that older format still lands
+    // there, and self-corrects as soon as the frontend applies its theme.
+    let bg_color = match theme_pref.as_str() {
+        "dark" => Some(tauri::window::Color(24, 24, 24, 255)),
+        "light" => Some(tauri::window::Color(253, 253, 253, 255)),
+        _ => {
+            if let Ok(t) = window.theme() {
+                match t {
+                    tauri::Theme::Dark => Some(tauri::window::Color(24, 24, 24, 255)),
+                    _ => Some(tauri::window::Color(253, 253, 253, 255)),
+                }
+            } else {
+                Some(tauri::window::Color(253, 253, 253, 255))
+            }
+        }
+    };
+
+    let _ = window.set_background_color(bg_color);
+
+    let _ = window.set_shadow(true);
+
+    // Same vetting as `send_markdown_path`, which reads the same argv:
+    // the frontend consumes BOTH channels, so a path this one lets
+    // through reaches `loadMarkdown` no matter what the other decides.
+    let startup_files =
+        window_runtime::startup_paths(&args, &std::env::current_dir().unwrap_or_default());
+
+    if let Some(path) = startup_files.first() {
+        let _ = window.emit("file-path", path.as_str());
+        window_runtime::bring_to_front(&window);
+    }
+
+    Ok(())
+}
+
+/// The file paths in a macOS open-document event, every one of them.
+#[cfg(target_os = "macos")]
+fn opened_file_paths(urls: Vec<tauri::Url>) -> Vec<String> {
+    urls.into_iter()
+        .filter_map(|url| url.to_file_path().ok())
+        .map(|path| path.to_string_lossy().to_string())
+        .collect()
+}
+
+#[cfg(all(test, target_os = "macos"))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_open_document_event_yields_every_file_path() {
+        let urls = [
+            "file:///n/a.md",
+            "file:///n/b.md",
+            "https://example.com/c.md",
+        ]
+        .map(|url| tauri::Url::parse(url).unwrap())
+        .to_vec();
+        assert_eq!(opened_file_paths(urls), vec!["/n/a.md", "/n/b.md"]);
+    }
+}
+
+#[cfg(all(test, not(windows)))]
+// Not on Windows: the mock runtime pulls in Common Controls v6 entry points,
+// and a test binary has no manifest declaring them, so it fails to load
+// (STATUS_ENTRYPOINT_NOT_FOUND) before any test runs.
+mod setup_tests {
+    use super::*;
+    use tauri::test::{mock_builder, mock_context, noop_assets};
+
+    // The window-state plugin saves only on a clean exit; the running save
+    // depends on the saver `handle_window_event` looks up being managed.
+    #[test]
+    fn setup_manages_the_geometry_saver() {
+        let mut app = mock_builder()
+            .setup(setup)
+            .build(mock_context(noop_assets()))
+            .unwrap();
+        // Runs `setup` once; the mock event loop does nothing else.
+        #[allow(deprecated)]
+        app.run_iteration(|_, _| {});
+        assert!(app.try_state::<window_runtime::GeometrySaver>().is_some());
+    }
+}
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 92dad687..93c5744a 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -772,14 +772,18 @@ pub async fn get_system_fonts() -> Vec<String> {
 #[tauri::command]
 pub fn self_update_supported(app: AppHandle) -> bool {
     #[cfg(target_os = "linux")]
-    {
-        app.env().appimage.is_some()
-    }
+    let is_appimage = app.env().appimage.is_some();
     #[cfg(not(target_os = "linux"))]
-    {
+    let is_appimage = {
         let _ = app;
-        true
-    }
+        false
+    };
+    self_update_supported_for(is_appimage)
+}
+
+/// Only Linux is gated: there only an AppImage can be replaced in place.
+fn self_update_supported_for(is_appimage: bool) -> bool {
+    !cfg!(target_os = "linux") || is_appimage
 }
 
 #[tauri::command]
@@ -814,18 +818,25 @@ pub fn get_os_type() -> String {
 /// and Windows write into a store the system owns.
 #[cfg(all(unix, not(target_os = "macos")))]
 fn retain_clipboard_ownership() {
-    use std::sync::atomic::{AtomicBool, Ordering};
+    use std::sync::atomic::AtomicBool;
     static RETAINED: AtomicBool = AtomicBool::new(false);
 
-    // Racing threads would leak a second handle, not a second connection; both
-    // are `Arc`s onto the same global. Failure is not recorded, so a copy
-    // attempted before the display is reachable does not poison later ones.
-    if RETAINED.load(Ordering::Relaxed) {
+    retain_forever(&RETAINED, || arboard::Clipboard::new().ok());
+}
+
+/// Builds one value with `make` and never drops it. Racing threads would leak a
+/// second handle, not a second connection; both are `Arc`s onto the same
+/// global. Failure is not recorded, so a copy attempted before the display is
+/// reachable does not poison later ones.
+#[cfg(any(test, all(unix, not(target_os = "macos"))))]
+fn retain_forever<T>(retained: &std::sync::atomic::AtomicBool, make: impl FnOnce() -> Option<T>) {
+    use std::sync::atomic::Ordering;
+    if retained.load(Ordering::Relaxed) {
         return;
     }
-    if let Ok(clipboard) = arboard::Clipboard::new() {
-        std::mem::forget(clipboard);
-        RETAINED.store(true, Ordering::Relaxed);
+    if let Some(value) = make() {
+        std::mem::forget(value);
+        retained.store(true, Ordering::Relaxed);
     }
 }
 
@@ -1476,4 +1487,48 @@ pub(crate) mod tests {
 
         fs::remove_dir_all(root).unwrap();
     }
+
+    #[test]
+    fn only_linux_gates_self_update() {
+        // Windows runs the downloaded NSIS installer and macOS replaces the
+        // bundle, so neither may be gated; on Linux only an AppImage updates.
+        if cfg!(target_os = "linux") {
+            assert!(self_update_supported_for(true));
+            assert!(!self_update_supported_for(false));
+        } else {
+            assert!(self_update_supported_for(false));
+            assert!(self_update_supported_for(true));
+        }
+    }
+
+    #[test]
+    fn the_retained_clipboard_handle_is_never_dropped() {
+        // #729: arboard gives up X11 clipboard ownership when its last handle
+        // drops, so the handle retained for the copy command must outlive it.
+        use std::cell::Cell;
+        use std::sync::atomic::AtomicBool;
+
+        struct Handle<'a>(&'a Cell<u32>);
+        impl Drop for Handle<'_> {
+            fn drop(&mut self) {
+                self.0.set(self.0.get() + 1);
+            }
+        }
+
+        let drops = Cell::new(0);
+        let made = Cell::new(0);
+        let retained = AtomicBool::new(false);
+        let make = || {
+            made.set(made.get() + 1);
+            Some(Handle(&drops))
+        };
+
+        // A display not reachable yet is not recorded as retained.
+        retain_forever::<Handle>(&retained, || None);
+        retain_forever(&retained, make);
+        retain_forever(&retained, make);
+
+        assert_eq!(made.get(), 1, "one handle, built once");
+        assert_eq!(drops.get(), 0, "and never dropped");
+    }
 }
diff --git a/src-tauri/src/markdown.rs b/src-tauri/src/markdown.rs
index 11587f4c..13a7743c 100644
--- a/src-tauri/src/markdown.rs
+++ b/src-tauri/src/markdown.rs
@@ -3159,6 +3159,15 @@ pub(crate) mod tests {
         );
     }
 
+    #[test]
+    fn heading_anchor_id_answers_each_lookup_afresh() {
+        // A wikilink names a heading by text, which only ever reaches the first
+        // heading with it, so a second lookup is not numbered `-1` the way a
+        // second heading in one document is.
+        assert_eq!(heading_anchor_id("Objectives"), "objectives");
+        assert_eq!(heading_anchor_id("Objectives"), "objectives");
+    }
+
     #[test]
     fn wikilink_targets_survive_punctuation_in_the_heading() {
         // "1. 概述" used to become "1.-概述" while comrak rendered "1-概述",
diff --git a/src-tauri/src/window_runtime.rs b/src-tauri/src/window_runtime.rs
index a904a794..c4278a01 100644
--- a/src-tauri/src/window_runtime.rs
+++ b/src-tauri/src/window_runtime.rs
@@ -9,7 +9,7 @@ use std::sync::{
     Arc, Mutex,
 };
 use std::time::Duration;
-use tauri::{AppHandle, Emitter, Manager, State};
+use tauri::{AppHandle, Emitter, Manager, Runtime, State};
 
 pub struct WatcherState {
     pub(crate) watchers: Mutex<HashMap<String, RecommendedWatcher>>,
@@ -119,6 +119,52 @@ impl AppState {
             claimed_recovery: Mutex::new(HashSet::new()),
         }
     }
+
+    /// A viewer window's own report of itself. Its number is given on its first
+    /// report and kept, so the Move-to-window list stays in creation order.
+    fn record_window_meta(
+        &self,
+        label: String,
+        tag_name: Option<String>,
+        tag_color: Option<String>,
+        active_tab_title: String,
+        tab_count: usize,
+    ) {
+        let mut registry = lock_recover(&self.window_registry);
+        let entry = registry.entry(label).or_insert_with(|| WindowMeta {
+            number: self.window_counter.fetch_add(1, Ordering::SeqCst) + 1,
+            tag_name: None,
+            tag_color: None,
+            active_tab_title: String::new(),
+            tab_count: 0,
+        });
+        entry.tag_name = tag_name;
+        entry.tag_color = tag_color;
+        entry.active_tab_title = active_tab_title;
+        entry.tab_count = tab_count;
+    }
+
+    fn viewer_windows(&self) -> Vec<WindowListEntry> {
+        let registry = lock_recover(&self.window_registry);
+        let mut list: Vec<WindowListEntry> = registry
+            .iter()
+            .map(|(label, meta)| WindowListEntry {
+                label: label.clone(),
+                meta: meta.clone(),
+            })
+            .collect();
+        list.sort_by_key(|entry| entry.meta.number);
+        list
+    }
+
+    /// A closed window is no longer a move target, and a quit under way
+    /// remembers that it closed it.
+    fn window_destroyed(&self, label: &str) {
+        lock_recover(&self.window_registry).remove(label);
+        if let Some(closed) = lock_recover(&self.quit).as_mut() {
+            closed.push(label.to_string());
+        };
+    }
 }
 
 #[derive(Clone, serde::Serialize)]
@@ -355,18 +401,7 @@ pub fn set_window_meta(
     if !is_viewer_label(&label) {
         return;
     }
-    let mut registry = lock_recover(&state.window_registry);
-    let entry = registry.entry(label).or_insert_with(|| WindowMeta {
-        number: state.window_counter.fetch_add(1, Ordering::SeqCst) + 1,
-        tag_name: None,
-        tag_color: None,
-        active_tab_title: String::new(),
-        tab_count: 0,
-    });
-    entry.tag_name = tag_name;
-    entry.tag_color = tag_color;
-    entry.active_tab_title = active_tab_title;
-    entry.tab_count = tab_count;
+    state.record_window_meta(label, tag_name, tag_color, active_tab_title, tab_count);
 }
 
 /// Whether a window other than `label` currently carries `name` as its tag.
@@ -410,16 +445,7 @@ pub fn is_window_tag_taken(
 
 #[tauri::command]
 pub fn list_viewer_windows(state: State<'_, AppState>) -> Vec<WindowListEntry> {
-    let registry = lock_recover(&state.window_registry);
-    let mut list: Vec<WindowListEntry> = registry
-        .iter()
-        .map(|(label, meta)| WindowListEntry {
-            label: label.clone(),
-            meta: meta.clone(),
-        })
-        .collect();
-    list.sort_by_key(|entry| entry.meta.number);
-    list
+    state.viewer_windows()
 }
 
 /// Starts a quit (`true`) or ends one a close cancelled (`false`), returning
@@ -513,6 +539,12 @@ pub fn focus_window(app: AppHandle, label: String) -> Result<(), String> {
 /// Consumed by the launch window's first show. See `show_window`.
 static MAIN_WINDOW_SHOWN: AtomicBool = AtomicBool::new(false);
 
+/// Whether this show is the launch window's first, the one that must not
+/// activate. Asking consumes it. See `show_window`.
+fn is_cold_start_show(label: &str, shown: &AtomicBool) -> bool {
+    label == LAUNCH_LABEL && !shown.swap(true, Ordering::Relaxed)
+}
+
 /// Reveals a window that was built hidden.
 ///
 /// The launch window is built hidden so no empty frame is on screen while the
@@ -532,8 +564,7 @@ static MAIN_WINDOW_SHOWN: AtomicBool = AtomicBool::new(false);
 /// of those must still come to the front.
 #[tauri::command]
 pub async fn show_window(window: tauri::Window) {
-    let is_cold_start =
-        window.label() == LAUNCH_LABEL && !MAIN_WINDOW_SHOWN.swap(true, Ordering::Relaxed);
+    let is_cold_start = is_cold_start_show(window.label(), &MAIN_WINDOW_SHOWN);
 
     let _ = window.show();
 
@@ -996,7 +1027,7 @@ fn is_viewer_label(label: &str) -> bool {
     label == LAUNCH_LABEL || label.starts_with("window-")
 }
 
-pub fn bring_to_front(window: &tauri::WebviewWindow) {
+pub fn bring_to_front<R: Runtime>(window: &tauri::WebviewWindow<R>) {
     let _ = window.show();
     let _ = window.unminimize();
     let _ = window.set_focus();
@@ -1015,7 +1046,7 @@ fn delivery_label<'a>(
         .or_else(|| open.first().copied())
 }
 
-pub fn pick_delivery_window(app: &AppHandle) -> Option<tauri::WebviewWindow> {
+pub fn pick_delivery_window<R: Runtime>(app: &AppHandle<R>) -> Option<tauri::WebviewWindow<R>> {
     let windows = app.webview_windows();
     let mut open: Vec<&str> = windows
         .keys()
@@ -1033,19 +1064,40 @@ pub fn pick_delivery_window(app: &AppHandle) -> Option<tauri::WebviewWindow> {
     windows.get(label).cloned()
 }
 
+/// Joins `path` to the launch's files while the launch window has not taken them
+/// yet, keeping every one delivered. False once they have been taken.
+fn queue_startup_file(pending: &mut Option<Vec<String>>, path: &str) -> bool {
+    match pending.as_mut() {
+        Some(paths) => {
+            paths.push(path.to_string());
+            true
+        }
+        None => false,
+    }
+}
+
+/// The launch's files: every path the OS delivered before the launch window
+/// asked, in delivery order, ahead of the argv paths it did not already name.
+fn merge_startup_files(opened: Vec<String>, mut files: Vec<String>) -> Vec<String> {
+    for path in opened.into_iter().rev() {
+        if !files.contains(&path) {
+            files.insert(0, path);
+        }
+    }
+    files
+}
+
 /// A file opened by the OS. Until the launch window has taken the launch's files it
 /// joins them, so it lands there and in no other window; after that it goes
 /// where `pick_delivery_window` says.
-pub fn deliver_opened_path(app: &AppHandle, path: String) {
+pub fn deliver_opened_path<R: Runtime>(app: &AppHandle<R>, path: String) {
     let state = app.state::<AppState>();
     let target = {
         let mut pending = lock_recover(&state.startup_files);
-        match pending.as_mut() {
-            Some(paths) => {
-                paths.push(path.clone());
-                app.get_webview_window(LAUNCH_LABEL)
-            }
-            None => pick_delivery_window(app),
+        if queue_startup_file(&mut pending, &path) {
+            app.get_webview_window(LAUNCH_LABEL)
+        } else {
+            pick_delivery_window(app)
         }
     };
     if let Some(window) = target {
@@ -1107,7 +1159,7 @@ pub fn startup_paths(args: &[String], cwd: &Path) -> Vec<String> {
         .collect()
 }
 
-pub fn handle_single_instance(app: &AppHandle, args: Vec<String>, cwd: String) {
+pub fn handle_single_instance<R: Runtime>(app: &AppHandle<R>, args: Vec<String>, cwd: String) {
     // Explorer launches one process per selected file, so these can arrive
     // before the launch window listens; `deliver_opened_path` queues them and
     // fronts the window each one lands in.
@@ -1344,13 +1396,8 @@ pub fn send_markdown_path(window: tauri::Window, state: State<'_, AppState>) ->
         return Vec::new();
     };
     let args: Vec<String> = std::env::args().collect();
-    let mut files = startup_paths(&args, &std::env::current_dir().unwrap_or_default());
-    for path in opened.into_iter().rev() {
-        if !files.contains(&path) {
-            files.insert(0, path);
-        }
-    }
-    files
+    let files = startup_paths(&args, &std::env::current_dir().unwrap_or_default());
+    merge_startup_files(opened, files)
 }
 
 /// What the window-state plugin keeps for every window.
@@ -1373,7 +1420,7 @@ pub fn geometry_flags() -> tauri_plugin_window_state::StateFlags {
 pub struct GeometrySaver(Mutex<Box<dyn Fn() + Send>>);
 
 impl GeometrySaver {
-    pub fn new(app: AppHandle) -> Self {
+    pub fn new<R: Runtime>(app: AppHandle<R>) -> Self {
         Self(Mutex::new(Box::new(coalesced(
             Duration::from_millis(500),
             move || {
@@ -1386,7 +1433,7 @@ impl GeometrySaver {
     }
 }
 
-pub fn handle_window_event(window: &tauri::Window, event: &tauri::WindowEvent) {
+pub fn handle_window_event<R: Runtime>(window: &tauri::Window<R>, event: &tauri::WindowEvent) {
     match event {
         tauri::WindowEvent::Moved(_) | tauri::WindowEvent::Resized(_) => {
             if let Some(saver) = window.try_state::<GeometrySaver>() {
@@ -1405,11 +1452,7 @@ pub fn handle_window_event(window: &tauri::Window, event: &tauri::WindowEvent) {
             window
                 .state::<crate::folder::FolderWatcherState>()
                 .forget_window(window.label());
-            let app_state = window.state::<AppState>();
-            lock_recover(&app_state.window_registry).remove(window.label());
-            if let Some(closed) = lock_recover(&app_state.quit).as_mut() {
-                closed.push(window.label().to_string());
-            };
+            window.state::<AppState>().window_destroyed(window.label());
         }
         _ => {}
     }
@@ -1420,6 +1463,73 @@ mod tests {
     use super::*;
     use std::collections::HashSet;
 
+    // macOS open-document events: opening several files from Finder delivers
+    // several paths, and every one has to reach the launch window. The defect
+    // this guards against was consuming only the first.
+    #[test]
+    fn macos_open_document_events_preserve_every_delivered_file_path() {
+        let mut pending = Some(Vec::new());
+        assert!(queue_startup_file(&mut pending, "/n/a.md"));
+        assert!(queue_startup_file(&mut pending, "/n/b.md"));
+        let opened = pending.take().unwrap();
+        assert_eq!(
+            merge_startup_files(opened, vec!["/n/c.md".into()]),
+            vec!["/n/a.md", "/n/b.md", "/n/c.md"]
+        );
+        // argv naming one of them again does not open it twice.
+        assert_eq!(
+            merge_startup_files(vec!["/n/a.md".into()], vec!["/n/a.md".into()]),
+            vec!["/n/a.md"]
+        );
+        // Once taken, a later file is not queued for the launch window again.
+        assert!(!queue_startup_file(&mut pending, "/n/d.md"));
+        assert_eq!(pending, None);
+    }
+
+    // The window-state plugin saves only on a clean exit, so after a crash
+    // every window came back at its default size. A move or a resize reaches
+    // the managed saver while the app runs; other events do not.
+    #[test]
+    #[cfg(not(windows))] // mock runtime; see app.rs setup_tests
+    fn a_move_or_resize_schedules_a_geometry_save() {
+        use tauri::{PhysicalPosition, PhysicalSize, WindowEvent};
+        let app = tauri::test::mock_app();
+        let calls = Arc::new(AtomicU64::new(0));
+        let counted = calls.clone();
+        app.manage(GeometrySaver(Mutex::new(Box::new(move || {
+            counted.fetch_add(1, Ordering::SeqCst);
+        }))));
+        let webview_window =
+            tauri::WebviewWindowBuilder::new(&app, "window-1", tauri::WebviewUrl::default())
+                .build()
+                .unwrap();
+        let window = webview_window.as_ref().window();
+
+        handle_window_event(&window, &WindowEvent::Focused(false));
+        assert_eq!(calls.load(Ordering::SeqCst), 0);
+        handle_window_event(&window, &WindowEvent::Moved(PhysicalPosition::new(10, 20)));
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+        handle_window_event(&window, &WindowEvent::Resized(PhysicalSize::new(800, 600)));
+        assert_eq!(calls.load(Ordering::SeqCst), 2);
+    }
+
+    // `markpad a.md b.md` with Markpad already running arrives here instead of
+    // at `send_markdown_path`. Taking only the first path opened a.md alone,
+    // and emitting straight to a window lost the files that arrived before
+    // the launch window listened (Explorer launches one process per file).
+    #[test]
+    #[cfg(not(windows))] // mock runtime; see app.rs setup_tests
+    fn a_second_launch_hands_every_argv_path_to_the_running_window() {
+        let app = tauri::test::mock_app();
+        app.manage(AppState::new());
+        let args = ["markpad", "a.md", "b.md"].map(String::from).to_vec();
+        handle_single_instance(app.handle(), args, "/n".into());
+        let pending = lock_recover(&app.state::<AppState>().startup_files).clone();
+        let expected =
+            ["a.md", "b.md"].map(|name| Path::new("/n").join(name).display().to_string());
+        assert_eq!(pending, Some(expected.to_vec()));
+    }
+
     fn idle_watcher() -> RecommendedWatcher {
         RecommendedWatcher::new(|_: notify::Result<notify::Event>| {}, Config::default()).unwrap()
     }
@@ -2415,6 +2525,49 @@ mod tests {
 
         fs::remove_dir_all(&dir).unwrap();
     }
+
+    fn listed(state: &AppState) -> Vec<String> {
+        state
+            .viewer_windows()
+            .into_iter()
+            .map(|entry| entry.label)
+            .collect()
+    }
+
+    /// Move-to-window lists open windows in the order they were opened, and
+    /// never one that has closed: a closed window offered as a target takes the
+    /// tab nowhere.
+    #[test]
+    fn the_runtime_registers_live_viewer_windows_in_stable_creation_order() {
+        let state = AppState::new();
+        for label in ["main", "window-b", "window-a"] {
+            state.record_window_meta(label.into(), None, None, "t".into(), 1);
+        }
+        // A later report from the first window keeps its place.
+        state.record_window_meta("main".into(), Some("Work".into()), None, "u".into(), 2);
+        assert_eq!(listed(&state), ["main", "window-b", "window-a"]);
+
+        update_quit(&state.quit, true);
+        state.window_destroyed("window-b");
+        assert_eq!(listed(&state), ["main", "window-a"]);
+        assert_eq!(update_quit(&state.quit, false), ["window-b"]);
+    }
+
+    /// Only the launch window's first show stays in the background (#702); a
+    /// detached tab window or the close walk revealing a window still activates.
+    #[test]
+    fn the_launch_window_is_shown_without_being_activated_on_a_cold_start() {
+        let shown = AtomicBool::new(false);
+        assert!(
+            !is_cold_start_show("window-a", &shown),
+            "another window's show is not the cold start"
+        );
+        assert!(is_cold_start_show(LAUNCH_LABEL, &shown));
+        assert!(
+            !is_cold_start_show(LAUNCH_LABEL, &shown),
+            "only the first show is quiet"
+        );
+    }
 }
 
 /// Does a watch armed on a FILE survive that file being replaced by a rename?
diff --git a/src/lib/MarkdownViewer.svelte b/src/lib/MarkdownViewer.svelte
index 5aedab21..efbcdd87 100644
--- a/src/lib/MarkdownViewer.svelte
+++ b/src/lib/MarkdownViewer.svelte
@@ -21,17 +21,23 @@
 	import Toc from './components/Toc.svelte';
 	import Toast from './components/Toast.svelte';
 	import FindBar from './components/FindBar.svelte';
-	import { reviewDirtyTabs } from './sessions/closeReview.js';
+	import { createWindowExit } from './sessions/windowExit.js';
+	import { createExternalChange } from './sessions/externalChange.svelte.js';
+	import { createViewMode } from './sessions/viewMode.svelte.js';
+import { createFrontMatterEdit } from './sessions/frontMatterEdit.js';
+import { createColdEnrichmentRestore } from './sessions/coldEnrichmentRestore.js';
+	import { autoSaveFailureNeedsToast, isAutoSaveEligible } from './utils/autoSaveTimer.js';
 	import { exportAsHtml as _exportHtml, exportAsPdf as _exportPdf } from './utils/export';
 	import { askToOpenExportedFile } from './utils/openExportedFile.js';
-	import { isHomePath } from './utils/homeTab.js';
-	import { copyableFlavours } from './utils/previewCopy.js';
-	import { hasExportableDocument, hasRealFilePath } from './utils/tabFileActions.js';
+	import { showsHomeScreen } from './utils/homeTab.js';
+	import { handleCopy as handlePreviewCopy } from './utils/previewCopy.js';
+	import { hasExportableDocument } from './utils/tabFileActions.js';
 	import { editorLanguageFor } from './utils/editorLanguage.js';
-	import { type ViewMode, viewModeOf } from './utils/titlebarToolbar.js';
+	import { editorReadOnly } from './utils/editorOptions.js';
+	import { viewModeOf } from './utils/titlebarToolbar.js';
 	import { buildMenuModel, installAppMenu, type MenuAction } from './utils/appMenu.js';
 	import ZoomOverlay from './components/ZoomOverlay.svelte';
-import { MARKDOWN_LINK_EXTENSIONS } from './utils/markdownLinks.js';
+import { MARKDOWN_OPEN_FILTERS } from './utils/markdownLinks.js';
 import {
 	resolveMermaidTheme,
 } from './utils/mermaidPrint.js';
@@ -39,40 +45,33 @@ import {
 	flashCopiedLabel,
 	renderRichContent as renderRichContentInto,
 } from './utils/richContent.js';
-import { observeFoldLayout, type FoldLayoutObservation } from './utils/foldLayout.js';
-import { patchPreview } from './utils/previewPatch.js';
+import { type FoldLayoutObservation } from './utils/foldLayout.js';
+import { followFoldLayout, previewPaneShown } from './utils/foldLayoutEffect.svelte.js';
+import { followPreviewPatch } from './utils/previewPatchEffect.svelte.js';
+import { patchHost } from './utils/previewPatch.js';
+import { refreshesPreviewCache } from './utils/previewRefresh.js';
 import {
 	revealFold,
 	toggleFold,
 	toggleFoldFromClick,
 	type FoldHost,
 } from './utils/foldState.js';
-import { dropPaneFor, dropZoneLabel, routeDroppedFile } from './utils/fileDrop.js';
-import { fontFamilyValue } from './utils/fontFamily.js';
-import { headingReference, headingText, preferredReferenceStyle } from './utils/headingReference.js';
+import { dropPaneFor, dropZoneLabel, handleDrop } from './utils/fileDrop.js';
+import { headingSlug, headingText, referenceForTab } from './utils/headingReference.js';
 import {
-	findSourceLineRange,
-	getSourceLineAtPreviewOffset,
-	invalidateAnchorMemos,
 	measureAnchorBox,
-	mergeSourceLineRanges,
 	restorePreviewReadingPosition,
-	PREVIEW_ANCHOR_OFFSET,
 	anchorScrollTop,
 	type AnchorBox,
 	type AnchorNode,
-	type LineRange,
 	type OffsetLayoutNode,
 } from './utils/previewAnchor.js';
 import { pointAtSource, sourceAtPoint, type SourceLineReader } from './utils/previewCursor.js';
 import { annotationOf, hitAt, occurrenceRanges, overlapping, rangeOf, type Annotation } from './utils/previewAnnotations.js';
 import {
-	asBufferLine,
 	asRendererLine,
 	lineCoordinates,
-	tabAnchorForEditorTopLine,
 	type BufferLine,
-	type BufferLineRange,
 	type RendererLine,
 } from './utils/lineCoordinates.js';
 import {
@@ -80,12 +79,12 @@ import {
 	getMarkdownBodyWithoutFrontMatter,
 	getFrontMatterListItems,
 	parseFrontMatter,
-	parseFrontMatterEditableValue,
 	removeFrontMatterListItem,
 	updateFrontMatterListItem,
 	updateFrontMatterField,
 	type FrontMatterField,
 } from './utils/frontMatter.js';
+import { FrontMatterFieldState } from './utils/frontMatterFieldState.svelte.js';
 import {
 	anchorIdCandidates,
 	getMarkdownLinkTarget as getRelativeMarkdownTarget,
@@ -93,43 +92,40 @@ import {
 	resolveMarkdownTargetPath,
 	type MarkdownLinkTarget as RelativeMarkdownTarget,
 } from './utils/markdownLinks.js';
-import { resolveLocalFileLinkPath } from './utils/localFileLinks.js';
-import { canonicalizePath, isSameFilePath } from './utils/pathIdentity.js';
-import { findSeedFromSelection } from './utils/findSeed.js';
-import { normalizeAssetPath } from './utils/exportHtml.js';
-import {
-	dropRecentFile,
-	isRecentFilesStorageEvent,
-	promoteRecentFile,
-	readStoredRecentFiles,
-	renameRecentFile,
-	updateStoredRecentFiles,
-} from './utils/recentFiles.js';
+import { followDocumentLink, handlePreviewClick, linkTooltipFor, openRelativeMarkdownTarget as openRelativeTarget, openWithSystem as openPathWithSystem } from './utils/previewLinks.js';
+import { canonicalizePath } from './utils/pathIdentity.js';
+import { ChoiceDialog } from './utils/choiceDialog.svelte.js';
+import { contextMenuFor, editorContextMenuItems, imageMenuItems, saveImageAs as saveImageAsFile } from './utils/viewerContextMenu.js';
+import { seedFindBar } from './utils/findSeed.js';
+import { createRecentFiles } from './utils/recentFiles.js';
 
 	const appWindow = getCurrentWindow();
 
 	import HomePage from './components/HomePage.svelte';
-	import { openNewWindow, pinnedTagFromWindowLabel, pinnedTagHolder, pinnedWindowToken } from './utils/pinnedTagWindow.js';
+	import { openNewWindow, pinnedTagFromWindowLabel } from './utils/pinnedTagWindow.js';
 import { tabManager, type Tab } from './stores/tabs.svelte.js';
-import { snapshotTab } from './utils/tabTransfer.js';
-import { outgoingTabAnchorLine } from './utils/editorPosition.js';
+import { createTabMovers, createTransferOptions } from './sessions/windowTransfer.js';
 import { createPaneSlider, planPaneSlide, type PanesShown } from './utils/paneSlide.js';
-import { adjustPreviewMaxWidth, getPreviewContentWidth } from './utils/previewWidth.js';
-import { isTocOverhanging } from './utils/tocOverlay.js';
-import { splitRatioAfterMove } from './utils/splitPanes.js';
-import { viewerCommandFor, type KeyContext, type ViewerCommand } from './utils/viewerKeymap.js';
+import { viewerCommandTable } from './utils/viewerCommands.js';
+import { dismissesToc, tocAutoCollapses } from './utils/tocOverlay.js';
+import { exportContextFrom, previewAppearanceFrom, previewLayout } from './utils/previewLayout.js';
+import { splitRatioAfterDrag, splitRatioAfterKey } from './utils/splitPanes.js';
+import { dispatchViewerKey, type KeyContext, type ViewerCommand } from './utils/viewerKeymap.js';
 import {
-	getScrollSyncPositionFromPixels,
-	getScrollTopForSyncPosition,
-	type ScrollSyncPosition,
-} from './utils/scrollSync.js';
+	getPreviewScrollAnchor as previewScrollAnchor,
+	getPreviewScrollSyncPosition as previewScrollSyncPosition,
+	getPreviewScrollTopForSyncPosition,
+} from './utils/previewScrollSync.js';
+import { type ScrollSyncPosition } from './utils/scrollSync.js';
 import { resolveTheme, settings, TOC_WIDTH_RANGE, wheelZoomFactor } from './stores/settings.svelte.js';
 import { t } from './utils/i18n.js';
 import { formatChord, modifierFor, opensInNewTab } from './utils/shortcuts.js';
-import { jumpScrollBehavior } from './utils/motion.js';
+import { commitWithoutTransitions, jumpScrollBehavior } from './utils/motion.js';
 import { createWindowSession } from './sessions/windowSession.svelte.js';
+import { reportWindowMeta } from './sessions/windowMeta.svelte.js';
 import { createBoundedWriter, restoreRecords, recoverySnapshot } from './sessions/unsavedRecovery.js';
-import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from './sessions/documentSession.svelte.js';
+import { createDocumentSession, type LoadMarkdownOptions } from './sessions/documentSession.svelte.js';
+import { followActiveFile } from './sessions/fileWatch.svelte.js';
 
 	import 'highlight.js/styles/github-dark.css';
 	import 'katex/dist/katex.min.css';
@@ -140,6 +136,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	let showSettings = $state(false);
 
 	let recentFiles = $state<string[]>([]);
+	const recentFileList = createRecentFiles((files) => (recentFiles = files));
 	let isFocused = $state(true);
 	
 	let markdownBody: HTMLElement | null = $state(null);
@@ -165,20 +162,8 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	let previewBlocks = $derived(
 		tabManager.activeTabId ? (previewHosts[tabManager.activeTabId] ?? null) : null,
 	);
-	let foldLayout: FoldLayoutObservation | null = null;
+	const foldLayout: { current: FoldLayoutObservation | null } = { current: null };
 	
-	const highlightColorMap: Record<string, string> = {
-		default: 'color-mix(in srgb, var(--color-accent-fg) 40%, transparent)',
-		yellow: 'rgba(255, 208, 0, 0.4)',
-		orange: 'rgba(255, 140, 0, 0.4)',
-		red: 'rgba(255, 60, 60, 0.4)',
-		pink: 'rgba(255, 105, 180, 0.4)',
-		purple: 'rgba(164, 108, 244, 0.4)',
-		blue: 'rgba(67, 138, 243, 0.4)',
-		cyan: 'rgba(43, 185, 178, 0.4)',
-		green: 'rgba(77, 177, 88, 0.4)',
-	};
-
 	let editorPane = $state<{ 
 		syncScrollToPosition: (position: ScrollSyncPosition, options?: { cursorIntoView?: boolean }) => void;
 		setCursor: (line: number, column: number) => void;
@@ -225,11 +210,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		if (editorHasFocus || !previewVisible) {
 			editorPane?.triggerFind?.();
 		} else if (markdownBody) {
-			// Seed BEFORE opening, so the bar that appears already holds the query.
-			// Nothing to seed leaves the previous query alone, which is what a
-			// repeated Cmd/Ctrl+F expects.
-			const seed = findSeedFromSelection(window.getSelection(), markdownBody);
-			if (seed) findBar?.setQuery(seed);
+			seedFindBar(findBar, window.getSelection(), markdownBody);
 			// Focus explicitly: `findOpen = true` is a no-op once open.
 			findOpen = true;
 			findBar?.focusInput();
@@ -246,15 +227,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 * back to what the menu has always produced.
 	 */
 	function copyHeadingReference(text: string, slug: string) {
-		const tab = tabManager.activeTab;
-		const fileName = tab?.path ? tab.path.split(/[/\\]/).pop() || null : null;
-		const reference = headingReference({
-			text,
-			slug,
-			fileName,
-			style: preferredReferenceStyle(tab?.rawContent ?? ''),
-		});
-		invoke('clipboard_write_text', { text: reference });
+		invoke('clipboard_write_text', { text: referenceForTab(text, slug, tabManager.activeTab) });
 	}
 
 	function reportUnsupportedDrop(path: string) {
@@ -328,16 +301,13 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 * preview but not the editor beside it (#744).
 	 */
 	let hasEditorPane = $derived(isEditing || isSplit);
-	let hasPreviewPane = $derived(!isEditing || isSplit);
+	let hasPreviewPane = $derived(previewPaneShown(isEditing, isSplit));
 	let frontMatterInfo = $derived(parseFrontMatter(rawContent));
 
 	let currentFile = $derived(tabManager.activeTab?.path ?? '');
 	let frontMatterPanelKey = $derived(currentFile || tabManager.activeTabId || 'untitled');
 	let frontMatterCollapsedByKey = $state<Record<string, boolean>>({});
-	let frontMatterEditErrors = $state<Record<string, string>>({});
-	let frontMatterTagDrafts = $state<Record<string, string>>({});
-	let frontMatterTagEditIndexes = $state<Record<string, number | null>>({});
-	let frontMatterTagEditDrafts = $state<Record<string, string>>({});
+	const frontMatterFields = new FrontMatterFieldState(() => frontMatterPanelKey);
 	let isFrontMatterCollapsed = $derived(frontMatterCollapsedByKey[frontMatterPanelKey] ?? true);
 	// An untitled tab is Markdown until saved under another name; see `editorLanguageFor`.
 	let isMarkdown = $derived(currentFile === '' || hasMarkdownLinkExtension(currentFile));
@@ -397,26 +367,9 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	let paneTopChrome = $derived(
 		hasEditorPane && settings.showEditorToolbar ? editorToolbarHeight : 0,
 	);
-	let previewContentWidth = $derived(getPreviewContentWidth(settings.previewMaxWidth, settings.previewFullWidth));
-	let previewAppearance = $derived({
-		fontFamily: fontFamilyValue(settings.previewFont, 'sans-serif'),
-		fontSize: settings.previewFontSize,
-		codeFontFamily: fontFamilyValue(settings.codeFont, 'monospace'),
-		codeFontSize: settings.codeFontSize,
-		highlightColor: highlightColorMap[settings.highlightColor] || highlightColorMap.yellow,
-	});
-	let isOverhanging = $derived(
-		isTocOverhanging({
-			isEditing,
-			isSplit,
-			tocSide: settings.tocSide,
-			splitEditorSide: settings.splitEditorSide,
-			isFullWidth: settings.previewFullWidth,
-			viewerWidth,
-			previewContentWidth,
-			tocWidth: settings.tocWidth,
-		}),
-	);
+	let previewAppearance = $derived(previewAppearanceFrom(settings));
+	let layout = $derived(previewLayout(settings, { isEditing, isSplit, viewerWidth }));
+	let isOverhanging = $derived(layout.isOverhanging);
 
 	/**
 	 * Reaching past a floating outline to touch what it is covering is a request
@@ -424,15 +377,9 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 * sidebar, and one sitting in the margin is not in anybody's way.
 	 */
 	$effect(() => {
-		if (!settings.showToc || settings.pinnedToc || !isOverhanging) return;
+		if (!settings.showToc || !tocAutoCollapses(() => isOverhanging, settings.pinnedToc)) return;
 		const dismiss = (e: PointerEvent) => {
-			const target = e.target as Node | null;
-			if (!target) return;
-			// The toggle button owns its own click; closing here as well would
-			// open and shut the panel in one gesture. Anything inside the panel —
-			// the resize handle included — is use, not dismissal.
-			if (tocWrapperEl?.contains(target) || tocToggleEl?.contains(target)) return;
-			settings.showToc = false;
+			if (dismissesToc(e.target as Node | null, tocWrapperEl, tocToggleEl)) settings.showToc = false;
 		};
 		// Capture, so a handler that stops propagation on its way up cannot leave
 		// the outline stranded over the text.
@@ -440,7 +387,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		return () => window.removeEventListener('pointerdown', dismiss, { capture: true });
 	});
 
-	import { loadVscodeTheme, clearVscodeTheme } from './utils/theme';
+	import { followTheme } from './utils/themeEffect.svelte.js';
 
 	onMount(() => {
 		// Clear the forced background color from app.html
@@ -463,80 +410,18 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		invoke('save_theme', { theme: appearance }).catch(console.error);
 	}
 
-	$effect(() => {
-		// Persistence and cross-window sync belong to the settings store; this
-		// effect is only the part that cannot: applying the theme to the document.
-		const theme = settings.theme;
-
-		// Mermaid bakes its colours into the SVG it produces, so the diagrams have
-		// to be drawn again; `renderRichContent` finds the ones drawn for another
-		// theme. No `roots`, because the whole article is what changed appearance
-		// — including the hosts of tabs that are not on screen, which the reader
-		// switches back to without anything else re-rendering them.
-		//
-		// Called from each branch rather than once at the end, because the
-		// `vscode:` branch does not know its own appearance until
-		// `parseAndApplyVscodeTheme` has published `dataset.themeType`, and that
-		// is what `currentMermaidTheme` reads. Calling here would have re-drawn
-		// every diagram in the theme being replaced.
-		//
-		// `untrack` for the reason #740 established: `renderRichContent` reads
-		// reactive state before its first `await`, so a tracked call makes this
-		// effect re-run on unrelated changes — re-enriching every open tab's
-		// host on top of the pass the patch effect owns.
-		const recolourDiagrams = () => untrack(() => { if (markdownBody) renderRichContent(); });
-
-		if (theme === 'system' || theme === 'light' || theme === 'dark') {
-			if (theme === 'system') {
-				delete document.documentElement.dataset.theme;
-				delete document.documentElement.dataset.themeType;
-			} else {
-				document.documentElement.dataset.theme = theme;
-				document.documentElement.dataset.themeType = theme;
-			}
-			clearVscodeTheme();
-			saveStartupAppearance(theme);
-			recolourDiagrams();
-			// No Monaco write here. It used to set `vs`/`vs-dark` through the
-			// `monaco` global, and because a child's effects run before its
-			// parent's it landed AFTER `Editor`'s own — stripping the editor of
-			// `app-theme-*` on every theme change. `editorTheme.ts`'s
-			// `monacoThemeName` is the one answer now, and `Editor` is the only
-			// pane that asks it; with no editor mounted there is nothing to
-			// paint, and a later mount reads the theme from the same seam.
-		} else {
-			const name = theme.replace('vscode:', '');
-			loadVscodeTheme(name, (name) => invoke<string>('read_vscode_theme', { name })).then((applied) => {
-				// A later choice replaced this one while it loaded; that choice
-				// owns the window now.
-				if (!applied) return;
-				// `parseAndApplyVscodeTheme` decides dark vs. light from the theme's
-				// own `type` field and publishes it here.
-				saveStartupAppearance(document.documentElement.dataset.themeType === 'dark' ? 'dark' : 'light');
-				recolourDiagrams();
-			}).catch(e => {
-				console.error("Failed to load vscode theme", e);
-				settings.theme = 'system';
-			});
-		}
+	followTheme(() => settings.theme, {
+		saveStartupAppearance,
+		readVscodeTheme: (name) => invoke<string>('read_vscode_theme', { name }),
+		recolourDiagrams: () => { if (markdownBody) renderRichContent(); },
+		onLoadFailed: (e) => {
+			console.error("Failed to load vscode theme", e);
+			settings.theme = 'system';
+		},
 	});
 
 	let tooltip = $state({ show: false, text: '', shortcut: '', html: '', isFootnote: false, x: 0, y: 0, align: 'top' as 'top' | 'right' | 'left' | 'below' });
-	let modalState = $state<{
-		show: boolean;
-		title: string;
-		message: string;
-		kind: 'info' | 'warning' | 'error';
-		showSave: boolean;
-		resolve: ((v: 'save' | 'discard' | 'cancel') => void) | null;
-	}>({
-		show: false,
-		title: '',
-		message: '',
-		kind: 'info',
-		showSave: false,
-		resolve: null,
-	});
+	const modalState = new ChoiceDialog();
 
 	let docContextMenu = $state<{
 		show: boolean;
@@ -551,21 +436,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	});
 
 	function askCustom(message: string, options: { title: string; kind: 'info' | 'warning' | 'error'; showSave?: boolean }): Promise<'save' | 'discard' | 'cancel'> {
-		// A second question replaces the first dialog, so the first caller is
-		// answered 'cancel' rather than left awaiting a resolver that is about to
-		// be overwritten — a close walk left that way never finished, and the
-		// window could not be closed again. An already-answered one ignores it.
-		modalState.resolve?.('cancel');
-		return new Promise((resolve) => {
-			modalState = {
-				show: true,
-				title: options.title,
-				message,
-				kind: options.kind,
-				showSave: options.showSave ?? false,
-				resolve,
-			};
-		});
+		return modalState.ask(message, options);
 	}
 
 	// window.prompt() is a silent no-op inside the webview (wry does not
@@ -597,30 +468,20 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	}
 
 	function closeModal(choice: 'save' | 'cancel') {
-		modalState.resolve?.(choice);
-		modalState.show = false;
+		modalState.close(choice);
 	}
 
-	// Self-contained rather than closeModal('discard'): shortcuts.checks.test.ts
-	// lifts it on its own.
 	function handleModalConfirm() {
-		if (modalState.resolve) modalState.resolve('discard');
-		modalState.show = false;
+		modalState.close('discard');
 	}
 
 	function handleSplitterKeyDown(e: KeyboardEvent) {
 		const activeTab = tabManager.activeTab;
 		if (!activeTab || !tabManager.activeTabId) return;
 
-		// The same step the bar takes under the pointer, in the same units, so
-		// `splitRatioAfterMove` is the only thing that knows which way is wider.
-		const step = e.key === 'ArrowLeft' ? -0.05 : e.key === 'ArrowRight' ? 0.05 : 0;
-		if (step === 0) return;
-
-		tabManager.setSplitRatio(
-			tabManager.activeTabId,
-			splitRatioAfterMove(activeTab.splitRatio, step, settings.splitEditorSide),
-		);
+		const next = splitRatioAfterKey(activeTab.splitRatio, e.key, settings.splitEditorSide);
+		if (next === null) return;
+		tabManager.setSplitRatio(tabManager.activeTabId, next);
 	}
 
 	function handleTocResizeKeyDown(e: KeyboardEvent) {
@@ -641,10 +502,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		}
 	}
 
-	// True while the window-close walk is showing per-tab dialogs; the native
-	// red button is not blocked by the dialog overlay, so this keeps a second
-	// close request from starting a competing walk.
-	let isCloseWalkActive = false;
 	let identifyFlash = $state('');
 	let identifyFlashTimer: ReturnType<typeof setTimeout> | undefined;
 
@@ -698,47 +555,27 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		}
 	}
 
-	/**
-	 * Hot exit: keep unsaved buffers instead of asking. Pending auto-saves write
-	 * their files first; a refused or failed save stays dirty and is kept. False
-	 * when the backup cannot be written or `applies` says no, and the caller asks
-	 * as usual. `applies` runs inside the walk guard, so a second close is refused meanwhile.
-	 */
-	async function keepUnsavedForExit(applies = async () => true): Promise<boolean> {
-		if (!recoveryReady) return false;
-		isCloseWalkActive = true;
-		try {
-			if (!(await applies())) return false;
-			if (settings.autoSave) {
-				for (const tab of tabManager.tabs.filter((t) => t.isDirty && t.path !== '')) await saveSilently(tab.id);
-			}
-			if (!(await unsavedRecovery.flush(recoverySnapshot(tabManager.tabs)))) return false;
-		} finally {
-			isCloseWalkActive = false;
-		}
-		await savePinnedTagIfNeeded();
-		await persistWindowState(true);
-		return true;
-	}
-
 	// The snapshot: window shape only, never document content. `folderRoot`
 	// rides along so each window gets its own folder back.
 	const windowStateJson = () => tabManager.serializeState({ folderRoot: folderManager.root });
 	let restoredFolder: string | null = null;
 
+	const transferOptions = createTransferOptions({
+		editorPane: () => editorPane,
+		windowStateJson,
+		isCloseWalkActive: () => windowExit.isCloseWalkActive(),
+		isDisposed: () => isDisposed,
+		renderPreview: renderTabPreviewFromRaw,
+		restoreReadingPosition: (tab) => {
+			if (markdownBody) restorePreviewReadingPosition(markdownBody, tab, getPreviewScrollMax(markdownBody), measurePreviewBox);
+		},
+	});
+
 	const windowSession = createWindowSession({
 		windowStateKey: WINDOW_STATE_KEY,
 		legacyStateKey: LEGACY_STATE_KEY,
 		restoreInProgressKey: RESTORE_IN_PROGRESS_KEY,
-		serializeState: () => {
-			// Same reason as `transferPayload` below, at a different moment: this
-			// runs at close and at each checkpoint with the editor still mounted,
-			// so the tab being edited would be persisted at the position it held
-			// when the editor last came down. Only the active tab can be the one
-			// the editor holds.
-			if (tabManager.activeTabId) editorPane?.flushPositionTo(tabManager.activeTabId);
-			return windowStateJson();
-		},
+		serializeState: transferOptions.serializeState,
 		shouldRestoreState: () => settings.restoreStateOnReopen,
 		isDisposed: () => isDisposed,
 		restoreState: (json) => {
@@ -748,87 +585,11 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		restoredTabs: () => tabManager.tabs.map((tab) => ({ id: tab.id, path: tab.path })),
 		loadRestoredTab: (tabId) => documentSession.readRestoredTab(tabId),
 		dropRestoredTab: (tabId) => tabManager.closeTab(tabId),
-		// A partially loaded buffer must never be handed to another window.
-		// The transfer payload has no field for "incomplete" (see
-		// tabTransfer.ts) and the destination rebuilds the tab from the
-		// payload alone, so the arriving copy would look authoritative and its
-		// auto-save would truncate the file. handleDetach and moveTabToWindow
-		// complete the buffer first; these predicates are the backstop.
-		canTransfer: (tabId) => {
-			const tab = tabManager.tabs.find((item) => item.id === tabId);
-			return !isCloseWalkActive && tab !== undefined && !isHomePath(tab.path) && !tab.isTruncated;
-		},
-		canDetach: (tabId) => {
-			const tab = tabManager.tabs.find((item) => item.id === tabId);
-			return !isCloseWalkActive && tab !== undefined && !isHomePath(tab.path) && !tab.isTruncated && tabManager.tabs.length >= 2;
-		},
-		transferPayload: (tabId) => {
-			const tab = tabManager.tabs.find((item) => item.id === tabId);
-			if (!tab) throw new Error('Tab disappeared before transfer');
-			// The snapshot carries the reading position and is taken here,
-			// synchronously, with the editor still mounted — so a tab being
-			// edited would travel with the position from its last teardown, and a
-			// tab opened straight into edit mode with 0. The preview writes its
-			// own fields on every scroll and needs nothing; this is edit mode's
-			// equivalent, and it is a no-op for any tab the editor is not on.
-			editorPane?.flushPositionTo(tabId);
-			// The other half of the same problem: the flush can only speak for
-			// the tab the editor is holding, and any other tab can be sent from
-			// here too — the tab context menu names one, and `mergeSelfInto`
-			// walks all of them. `editorViewState` is what covers a background
-			// edit-mode tab in memory and it is excluded from the payload, so
-			// the anchor is recovered from it before it is dropped.
-			return JSON.stringify({
-				...snapshotTab(tab),
-				anchorLine: outgoingTabAnchorLine(tab, tabManager.activeTabId),
-			});
-		},
+		canTransfer: transferOptions.canTransfer,
+		canDetach: transferOptions.canDetach,
+		transferPayload: transferOptions.transferPayload,
 		onTransferClaimed: (tabId) => tabManager.closeTab(tabId),
-		acceptTransferredTab: async (snapshot) => {
-			// The tab has to exist before it can be rendered, which leaves a
-			// window where this side owns a document the source still shows.
-			// Anything that goes wrong from here must undo the insert, or the
-			// same file stays open in both windows with two auto-save timers
-			// writing over each other.
-			const id = tabManager.insertTransferredTab(snapshot);
-			try {
-				const transferred = tabManager.tabs.find((tab) => tab.id === id);
-				if (!transferred) return null;
-				await renderTabPreviewFromRaw(transferred);
-				if (isDisposed) {
-					tabManager.closeTab(id);
-					return null;
-				}
-				// The reading position travels with the tab, and until here nothing
-				// put it back. `insertTransferredTab` activates the tab
-				// synchronously, while its `content` is still `''`; the restore
-				// effect below runs on that activation against a host with no
-				// document in it, finds no anchor and no scroll range, and the
-				// document the reader left arrives afterwards at the top. That effect
-				// cannot cover this by depending on the render — it also runs while
-				// the reader is typing in split view, where a per-render dependency
-				// would drag the preview back on every debounce — so the arrival
-				// asks again, now that `renderTabPreviewFromRaw` has awaited the
-				// patch and the host holds the document.
-				//
-				// Guarded on the tab still being the active one: only the active
-				// host is displayed, and `markdownBody` is the article all of them
-				// share, so scrolling it for a tab the user has since switched away
-				// from would move somebody else's document.
-				if (markdownBody && tabManager.activeTabId === id) {
-					restorePreviewReadingPosition(
-						markdownBody,
-						transferred,
-						getPreviewScrollMax(markdownBody),
-						measurePreviewBox,
-					);
-				}
-				return id;
-			} catch (error) {
-				tabManager.closeTab(id);
-				throw error;
-			}
-		},
+		acceptTransferredTab: transferOptions.acceptTransferredTab,
 		onError: (message, error) => {
 			console.error(message, error);
 			addToast(`${message}: ${String(error)}`, 'error');
@@ -846,6 +607,11 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 				'warning',
 			),
 	});
+	const { handleDetach, moveTabToWindow } = createTabMovers({
+		ensureFullContent: (tabId) => documentSession.ensureFullContent(tabId),
+		onPartialDocument: () => addToast(t('toast.partialDocument', settings.language), 'error'),
+		session: windowSession,
+	});
 
 	// The session is recorded as it changes, so a crash or kill brings this
 	// window back as it was. Tracks the window's shape only: which tabs, in
@@ -864,19 +630,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		windowSession.record(untrack(windowStateJson));
 	});
 
-	// A window opened for a pinned group is entered in the registry under the
-	// group's name when it is created. Reporting before it has adopted the
-	// group would clear that name and let a second click open the group again.
-	let windowMetaReady = $state(pinnedTagFromWindowLabel(appWindow.label) === null);
-	$effect(() => {
-		if (!windowMetaReady) return;
-		invoke('set_window_meta', {
-			tagName: tabManager.windowTag?.name ?? null,
-			tagColor: tabManager.windowTag?.color ?? null,
-			activeTabTitle: tabManager.activeTab?.title ?? '',
-			tabCount: tabManager.tabs.length,
-		}).catch(() => {});
-	});
+	const windowMeta = reportWindowMeta(tabManager, pinnedTagFromWindowLabel(appWindow.label) === null);
 
 	$effect(() => {
 		const tag = tabManager.windowTag;
@@ -889,59 +643,19 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		pinnedTags = (await invoke('list_pinned_tags')) as typeof pinnedTags;
 	}
 
-	// The files the close review started from. It can close tabs, and the
-	// close it re-triggers settles again, so both saves use this list.
-	let pinFilesAtClose: string[] | null = null;
-
-	function openFilePaths() {
-		return tabManager.tabs.filter((tab) => hasRealFilePath(tab.path)).map((tab) => tab.path);
-	}
-
-	/**
-	 * Every path that ends a window saves the pin before it closes tabs. An
-	 * empty window says nothing about the group, so it never overwrites it.
-	 * It only refreshes the entry: another window may have unpinned the tag.
-	 */
-	async function savePinnedTagIfNeeded() {
-		const tag = tabManager.windowTag;
-		if (!tag?.pinned) return;
-		const files = pinFilesAtClose ?? openFilePaths();
-		if (files.length === 0) return;
-		const pinned = await invoke('update_pinned_tag', { name: tag.name, color: tag.color, files });
-		if (!pinned) tabManager.setWindowTag({ ...tag, pinned: false });
-	}
-
-	async function openPinnedTag(tag: { name: string; color: string; files: string[] }) {
-		// Two windows sharing a tag share one pin entry, and the last to save wins.
-		const holder = await pinnedTagHolder(tag.name, appWindow.label);
-		if (holder) {
-			await invoke('focus_window', { label: holder });
-			return;
-		}
-		// Tabs already here belong to this window's own group. The pinned one
-		// opens in a window of its own, which adopts it from its label.
-		if (tabManager.tabs.some((tab) => !isHomePath(tab.path))) {
-			await invoke('create_transfer_window', { token: pinnedWindowToken(tag.name, Date.now()), tagName: tag.name });
-			return;
-		}
-		tabManager.setWindowTag({ ...tag, pinned: true });
-		for (const file of tag.files) await loadMarkdown(file);
-		showHome = false;
-	}
-
 	async function unpinTagFromHome(name: string) {
 		await invoke('remove_pinned_tag', { name });
 		if (tabManager.windowTag?.name === name) tabManager.setWindowTag({ ...tabManager.windowTag, pinned: false });
 		await refreshPinnedTags();
 	}
 
-	// Same condition as the template's HomePage gate: an empty window or the
-	// home tab shows Home without `showHome`, which is the cold-start case.
+	// The template's HomePage gate: an empty window or the home tab shows Home
+	// without `showHome`, which is the cold-start case.
 	// Reading the window tag re-runs this when the title bar pins or unpins it.
 	// The pin's IPC is sent first and sync commands run in order, so the list sees it.
 	$effect(() => {
 		void tabManager.windowTag?.pinned;
-		if (showHome || !tabManager.activeTab || isHomePath(tabManager.activeTab.path)) refreshPinnedTags().catch(console.error);
+		if (showsHomeScreen(() => tabManager.activeTab, showHome)) refreshPinnedTags().catch(console.error);
 	});
 
 	const documentSession = createDocumentSession({
@@ -965,7 +679,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			console.error(message, error);
 			addToast(`${message}: ${String(error)}`, 'error');
 		},
-		onDiskChangedUnderSave: noteExternalChangeConflict,
+		onDiskChangedUnderSave: (id) => externalChange.noteExternalChangeConflict(id),
 		cancelPendingAutoSave,
 		// Two questions, one dialog. With the file untouched, Save means "write
 		// what I typed" and the ordinary wording is right. With the disk moved
@@ -991,6 +705,70 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		onPartialCopySaved: () => addToast(t('toast.partialCopySaved', settings.language), 'info'),
 	});
 
+	const externalChange = createExternalChange({
+		tabManager,
+		settings,
+		documentSession,
+		loadMarkdown,
+		canCloseTab,
+		readFile: (path) => invoke('read_file_content_checked', { path }),
+		editorLanguageFor,
+		addToast,
+		t,
+	});
+	const {
+		saveContent,
+		saveActiveTab,
+		saveSilently,
+		flushBeforeLeavingEditableMode,
+		hasExternalChangeConflict,
+		noteExternalChangeConflict,
+		resolveExternalChangeByReloading,
+		reloadFromDisk,
+		compareExternalChange,
+		resolveExternalChangeByKeepingBuffer,
+	} = externalChange;
+
+	const viewMode = createViewMode({
+		tabManager,
+		settings,
+		documentSession,
+		flushBeforeLeavingEditableMode,
+		readFile: (path) => invoke('read_file_content_checked', { path }),
+		renderTabPreviewFromRaw,
+		tick,
+		addToast,
+		t,
+		get editorPane() {
+			return editorPane;
+		},
+		get markdownBody() {
+			return markdownBody;
+		},
+		get previewBlocks() {
+			return previewBlocks;
+		},
+		get lineCoords() {
+			return lineCoords;
+		},
+		readRendererLine: (line) => readRendererLine(line),
+		getPreviewScrollSyncPosition,
+		scrollPreviewToSyncPosition,
+		getPreviewScrollAnchor,
+	});
+	const {
+		handleEditorCursor,
+		placePreviewCursor,
+		handleEditorScrollSync,
+		followPreviewScroll,
+		syncEditorToPreviewScroll,
+		toggleEdit,
+		toggleEditView,
+		editSourceRangeAt,
+		toggleSplitView,
+		setViewMode,
+	} = viewMode;
+
 	// Persisted through Rust, not localStorage: setItem is an async message
 	// to the WebKit storage process that dies in transit when the last
 	// window's close ends the process (reproduced in QA as "close secondary
@@ -1008,132 +786,35 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		else if (settings.restoreStateOnReopen) await windowSession.persistState(true);
 	}
 
-	/**
-	 * The save/discard close, used when "Restore unsaved changes on launch" is off, when
-	 * closing one of several windows, or when the backup cannot be written
-	 * (`keepUnsavedForExit` runs first otherwise).
-	 * Resolve this window's unsaved tabs, then write the restore snapshot: the
-	 * work that has to happen before the window goes away. False when the reader
-	 * cancelled, and nothing has been written.
-	 *
-	 * The close button and the in-app update both run it. An update ends the
-	 * process without closing a window — the Windows updater exits inside
-	 * `downloadAndInstall`, `relaunch()` requests an exit elsewhere — so
-	 * CloseRequested never fires, and both jobs used to go down with it (#761).
-	 */
-	async function settleForExit(remember: () => Promise<boolean>): Promise<boolean> {
-		// Unsaved content and session restore are separate concerns: dirty tabs
-		// are resolved FIRST through the per-tab dialogs, then the restore
-		// snapshot records window state only (open files, active tab, edit mode,
-		// split, scroll) — it never carries document content.
-		const dirtyTabs = tabManager.tabs.filter((t) => t.isDirty);
-		if (dirtyTabs.length > 0) {
-			isCloseWalkActive = true;
-			pinFilesAtClose ??= openFilePaths();
-			// The walk's dialogs are in-app modals inside THIS window: with
-			// multiple windows, another window may be covering it and the review
-			// would be invisible. Bring the reviewing window to the front first.
-			invoke('show_window').catch(console.error);
-			try {
-				// Auto-save without confirmation: silently save every dirty tab
-				// that has a real path. Untitled tabs need a Save dialog, so the
-				// walk below handles them. A failed silent save is surfaced and its
-				// tab also goes to the walk. `saveContent` cancels each tab's pending
-				// timer itself, so no writer here can be raced by its own debounce.
-				// A tab whose file changed underneath is refused rather than
-				// overwritten, and the walk asks the changed-on-disk question.
-				if (settings.autoSave) {
-					for (const tab of dirtyTabs.filter((t) => t.path !== '')) {
-						const ok = await saveSilently(tab.id);
-						if (!ok && hasExternalChangeConflict(tab.id)) continue;
-						if (!ok) {
-							addToast(t('toast.autoSaveFailed', settings.language), 'error');
-							break;
-						}
-					}
-				}
-
-				// Close review (issue #189): walk the remaining dirty tabs one at a
-				// time — activate each and run the same localized unsaved-changes
-				// dialog a single tab close shows. Cancel stops the walk and keeps
-				// the window open. Strict tab-strip order (left to right) so the
-				// sequence is predictable; numbered untitled titles let the dialog
-				// name each tab. Re-find every round — a save can leave a tab dirty
-				// again (TOCTOU) and tabs can change while a dialog is up.
-				const resolved = await reviewDirtyTabs({
-					nextDirtyTab: () => tabManager.tabs.find((t) => t.isDirty),
-					setActive: (id) => tabManager.setActive(id),
-					settle: tick,
-					canCloseTab,
-					closeTab: (id) => tabManager.closeTab(id),
-					// Resolved tabs (saved, or reverted by Don't Save) stay open for
-					// the window-state snapshot when restore is enabled; untitled
-					// tabs have nothing to restore, and with restore off the red
-					// button closes tabs one by one.
-					shouldCloseAfterResolving: (tab) =>
-						!settings.restoreStateOnReopen || tab.path === '',
-				});
-				if (!resolved) {
-					pinFilesAtClose = null;
-					return false;
-				}
-			} finally {
-				isCloseWalkActive = false;
-			}
-		}
-
-		// Session is clean now; record the window state for restore. Awaited:
-		// the caller holds the exit until the Rust write returns, so the process
-		// cannot exit under the snapshot.
-		await savePinnedTagIfNeeded();
-		// The re-triggered close finds nothing to review and uses the list last.
-		if (dirtyTabs.length === 0) pinFilesAtClose = null;
-		// Asked now, not when the close began: the review above can take minutes.
-		await persistWindowState(await remember());
-		return true;
-	}
-
-	/**
-	 * The update's settle. No re-triggered close follows it: the process exits,
-	 * or the install fails and the window stays. Either way the review's list
-	 * has been saved, and kept it would outlive a failed install into the next
-	 * last-tab close, merge or Close Tag.
-	 */
-	async function settleForUpdate(): Promise<boolean> {
-		if (settings.persistOpenEditors && (await keepUnsavedForExit())) return true;
-		try {
-			// The process exits with every window, so this one is remembered.
-			return await settleForExit(async () => true);
-		} finally {
-			pinFilesAtClose = null;
-		}
-	}
-
-	/**
-	 * Quit is the red button applied to every window. Each one runs its own
-	 * `onCloseRequested`: reviews its unsaved tabs, writes its own restore
-	 * snapshot, and closes.
-	 *
-	 * It used to discard the snapshot instead, so ⌘Q and the red button
-	 * disagreed about whether the session came back — and the dialog that
-	 * explained the difference only appeared when a tab was dirty, which is
-	 * not the path most people take (#390). It also closed nothing but the
-	 * focused window, so quitting with two windows open did not quit.
-	 *
-	 * Every other window is asked at once rather than one after another:
-	 * `close()` resolves when the request is sent, not when the window is
-	 * gone, and there is no reply saying whether the reader cancelled. Two
-	 * windows with unsaved work therefore show their own dialogs side by side,
-	 * each still guarding its own buffers.
-	 */
-	async function appExit() {
-		// Quit keeps unsaved changes in every window, not only the last one.
-		await invoke('set_quitting', { quitting: true }).catch(console.error);
-		for (const other of await getAllWindows()) {
-			if (other.label !== appWindow.label) await other.close();
-		}
-		await appWindow.close();
-	}
+	const windowExit = createWindowExit({
+		tabManager,
+		settings,
+		appWindow,
+		allWindows: getAllWindows,
+		recovery: {
+			isReady: () => recoveryReady,
+			keep: () => unsavedRecovery.flush(recoverySnapshot(tabManager.tabs)),
+			drop: () => unsavedRecovery.flush('[]'),
+		},
+		persistWindowState,
+		canCloseTab,
+		saveSilently,
+		hasExternalChangeConflict,
+		onAutoSaveFailed: () => addToast(t('toast.autoSaveFailed', settings.language), 'error'),
+		settle: tick,
+		loadMarkdown,
+		setShowHome: (value) => (showHome = value),
+		moveTabToWindow,
+	});
+	const {
+		savePinnedTagIfNeeded,
+		openPinnedTag,
+		settleForUpdate,
+		appExit,
+		destroyWindowAfterTabsClosed,
+		closeTabAndWindowIfLast,
+		mergeSelfInto,
+	} = windowExit;
 
 	/**
 	 * A tab switch must not animate. Switching to a tab in another mode changes
@@ -1147,11 +828,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	$effect(() => {
 		const _ = tabManager.activeTabId;
 		const container = untrack(() => layoutContainerEl);
-		if (container) {
-			container.classList.add('tab-switching');
-			void container.offsetHeight;
-			container.classList.remove('tab-switching');
-		}
+		if (container) commitWithoutTransitions(container);
 		showHome = false;
 		findOpen = false;
 	});
@@ -1186,16 +863,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		});
 	});
 
-	// Watched whether or not Auto-Reload is on: an edit made elsewhere under
-	// unsaved changes is reported when it happens, not at the next save.
-	// Auto-Reload only decides whether a clean tab reloads.
-	$effect(() => {
-		if (currentFile) {
-			invoke('watch_file', { path: currentFile }).catch(console.error);
-		} else {
-			invoke('unwatch_file').catch(console.error);
-		}
-	});
+	followActiveFile(() => currentFile);
 
 	// The preview and the export run the same filter in opposite orders, on
 	// purpose. The export sanitizes the renderer output first and processes
@@ -1234,10 +902,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		return `frontmatter-${key.replace(/[^a-zA-Z0-9_-]/g, '-')}`;
 	}
 
-	function frontMatterFieldStateKey(field: FrontMatterField) {
-		return `${frontMatterPanelKey}:${field.key}`;
-	}
-
 	function tagsEqual(left: string[], right: string[]) {
 		return left.length === right.length && left.every((value, index) => value === right[index]);
 	}
@@ -1254,7 +918,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	}
 
 	function clearFrontMatterEditError(field: FrontMatterField) {
-		delete frontMatterEditErrors[frontMatterFieldStateKey(field)];
+		frontMatterFields.clearEditError(field);
 	}
 
 	// `nextValue` runs inside the try so a parse error lands on the field.
@@ -1265,74 +929,49 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			clearFrontMatterEditError(field);
 			await renderTabPreviewFromRaw(tab);
 		} catch (error) {
-			frontMatterEditErrors = {
-				...frontMatterEditErrors,
-				[frontMatterFieldStateKey(field)]: String(error),
-			};
+			frontMatterFields.setEditError(field, error);
 		}
 	}
 
-	async function handleFrontMatterEdit(field: FrontMatterField, value: string) {
-		const tab = tabManager.activeTab;
-		if (!tab) return;
-		// Front matter is editable from reading mode, which a large file can
-		// reach while its buffer is still the preview slice. Rewriting that
-		// slice and saving it would drop the rest of the document.
-		if (!(await documentSession.ensureFullContent(tab.id))) {
-			addToast(t('toast.partialDocument', settings.language), 'error');
-			return;
-		}
-		await applyFrontMatter(tab, field, () => parseFrontMatterEditableValue(field, value));
-	}
+	const { handleFrontMatterEdit, handleFrontMatterListChange } = createFrontMatterEdit({
+		tabManager,
+		settings,
+		documentSession,
+		addToast,
+		t,
+		applyFrontMatter,
+	});
 
 	function getFrontMatterTagDraft(field: FrontMatterField) {
-		return frontMatterTagDrafts[frontMatterFieldStateKey(field)] ?? '';
+		return frontMatterFields.tagDraft(field);
 	}
 
 	function setFrontMatterTagDraft(field: FrontMatterField, value: string) {
-		frontMatterTagDrafts[frontMatterFieldStateKey(field)] = value;
-		clearFrontMatterEditError(field);
+		frontMatterFields.setTagDraft(field, value);
 	}
 
 	function clearFrontMatterTagDraft(field: FrontMatterField) {
-		delete frontMatterTagDrafts[frontMatterFieldStateKey(field)];
+		frontMatterFields.clearTagDraft(field);
 	}
 
 	function getFrontMatterTagEditIndex(field: FrontMatterField) {
-		return frontMatterTagEditIndexes[frontMatterFieldStateKey(field)] ?? null;
+		return frontMatterFields.tagEditIndex(field);
 	}
 
 	function getFrontMatterTagEditDraft(field: FrontMatterField, fallback: string) {
-		return frontMatterTagEditDrafts[frontMatterFieldStateKey(field)] ?? fallback;
+		return frontMatterFields.tagEditDraft(field, fallback);
 	}
 
 	function setFrontMatterTagEditDraft(field: FrontMatterField, value: string) {
-		frontMatterTagEditDrafts[frontMatterFieldStateKey(field)] = value;
-		clearFrontMatterEditError(field);
+		frontMatterFields.setTagEditDraft(field, value);
 	}
 
 	function startFrontMatterTagEdit(field: FrontMatterField, index: number, value: string) {
-		const key = frontMatterFieldStateKey(field);
-		frontMatterTagEditIndexes[key] = index;
-		frontMatterTagEditDrafts[key] = value;
-		clearFrontMatterEditError(field);
+		frontMatterFields.startTagEdit(field, index, value);
 	}
 
 	function clearFrontMatterTagEdit(field: FrontMatterField) {
-		const key = frontMatterFieldStateKey(field);
-		delete frontMatterTagEditIndexes[key];
-		delete frontMatterTagEditDrafts[key];
-	}
-
-	async function handleFrontMatterListChange(field: FrontMatterField, nextItems: string[]) {
-		const tab = tabManager.activeTab;
-		if (!tab) return;
-		// Same partial-buffer guard as handleFrontMatterEdit.
-		if (!(await documentSession.ensureFullContent(tab.id))) {
-			addToast(t('toast.partialDocument', settings.language), 'error');
-			return;
-		}
-		await applyFrontMatter(tab, field, () => nextItems);
+		frontMatterFields.clearTagEdit(field);
 	}
 
 	async function commitFrontMatterTagAdd(field: FrontMatterField) {
@@ -1437,31 +1076,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		});
 	}
 
-	/**
-	 * How many documents the preview DOM has been given, as a number anything
-	 * downstream of the render can wait on.
-	 *
-	 * `htmlContent` looks like the same signal and is not. It says a document
-	 * has been *rendered*, and the outline used to take it as saying the article
-	 * now *holds* that document — which is true only if the patch below has
-	 * already run. On a mount it has not: Svelte runs a child component's
-	 * effects before its parent's, so `<Toc>` scanned the article in the same
-	 * flush, one step ahead of the patch that fills it, and found nothing. The
-	 * string does not change again, so nothing asked it to look twice and the
-	 * outline stayed empty until it was unmounted and remounted.
-	 *
-	 * A pinned outline is the one that never gets that remount, which is why it
-	 * was the only place the bug was visible: an overhanging floating outline
-	 * closes itself, and reopening it builds a new component against a DOM that
-	 * is by then complete.
-	 *
-	 * The counter is kept twice on purpose — `previewPatches` is the plain one
-	 * this effect increments, so the `$state` is only ever written here and
-	 * never read, and the effect cannot schedule itself.
-	 */
-	let previewRevision = $state(0);
-	let previewPatches = 0;
-
 	/**
 	 * The one place a rendered document becomes preview DOM: patch, then enrich
 	 * only what the patch inserted.
@@ -1471,15 +1085,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 * restores the reading position again, because KaTeX and Mermaid can push
 	 * the anchor down by hundreds of pixels.
 	 */
-	$effect(() => {
-		const host = previewBlocks;
-		if (!host) {
-			// Still a read, so a document that lands before the element exists
-			// re-runs this rather than being missed.
-			void htmlContent;
-			return;
-		}
-
+	const previewPatch = followPreviewPatch(() => previewBlocks, () => htmlContent, (host, htmlContent) => {
 		// This document is injected into the app's own document, so it runs the
 		// same policy the export runs — the one place a document is untrusted
 		// must not have its own private copy of the rules. The preview used to
@@ -1492,89 +1098,32 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		// ./utils/sanitize.ts for the policy itself, and renderMarkdownPreview
 		// for why this path sanitizes last.
 		//
-		// A host that already holds this document — a tab being re-activated —
-		// is not sanitized and diffed again: every block would compare equal.
-		// The switch did change which host is displayed, which the anchor memos
-		// read, and the patch is what would have invalidated them.
-		const unchanged = patchedHtml.get(host) === htmlContent;
-		patchedHtml.set(host, htmlContent);
-		if (unchanged) invalidateAnchorMemos();
-		// Untracked: a fold toggle or a rename is not a new document.
-		const patch = unchanged
-			? { inserted: [], wrappers: [] }
-			: untrack(() => {
-					const tab = tabManager.activeTab;
-					return patchPreview(host, htmlContent, tab?.path ?? '', tab?.foldOverrides ?? NO_FOLD_OVERRIDES);
-				});
-		// Only the new blocks. `ResizeObserver.observe` on a target it is already
-		// watching re-registers it rather than doing nothing, and a fresh
-		// registration delivers an initial observation — so handing it the whole
-		// host would put back exactly the per-keystroke re-measure of every fold
-		// that keeping the observation alive removed.
-		for (const block of patch.inserted) foldLayout?.observe(block);
-		for (const wrapper of patch.wrappers) foldLayout?.observe(wrapper);
-		// A host's first enrichment is the cold start above: it waits for
-		// whichever libraries the document needs. A tab being re-activated
-		// patches to nothing, and its host is in the set from that first render.
-		const cold = patch.inserted.length > 0 && !enrichedHosts.has(host);
-		if (cold) enrichedHosts.add(host);
-		const enrichment = renderRichContent(patch.inserted);
-		if (cold) restoreAfterColdEnrichment(enrichment, tabManager.activeTabId);
-		previewRevision = ++previewPatches;
+		// Untracked inside patchHost: a fold toggle or a rename is not a new document.
+		const patch = patchHost(
+			host,
+			htmlContent,
+			() => {
+				const tab = tabManager.activeTab;
+				return { filePath: tab?.path ?? '', foldOverrides: tab?.foldOverrides ?? NO_FOLD_OVERRIDES };
+			},
+			(scope) => foldLayout.current?.observe(scope),
+		);
+		// A host's first enrichment is the cold start above: see `coldRestore`.
+		coldRestore.afterEnrichment(host, patch.inserted.length, renderRichContent(patch.inserted));
 	});
 
-	/**
-	 * The hosts whose document has been through `renderRichContent` at least
-	 * once. A `WeakMap`/`WeakSet` keyed on the container for the same reason
-	 * `states` in `previewPatch.ts` is: a host that Svelte destroys with its
-	 * tab takes its entry with it, so this cannot drift from the set of live
-	 * tabs the way a hand-kept registry can.
-	 */
-	const enrichedHosts = new WeakSet<HTMLElement>();
-	/** The `htmlContent` each host was last patched with. */
-	const patchedHtml = new WeakMap<HTMLElement, string>();
-
-	/**
-	 * Put the reader back where they were, once, after a cold start's enrichment
-	 * has changed the layout underneath them.
-	 *
-	 * Through `restorePreviewReadingPosition` — the same cascade the restore
-	 * effect runs, in the same order — because two sites consulting a tab's
-	 * three position fields in different orders are two answers for one tab.
-	 * That effect cannot do this itself: giving it a dependency on the render
-	 * would drag the preview back to the anchor on every debounced re-render
-	 * while the reader is typing in split view.
-	 *
-	 * Only for the tab that is still on screen. The enrichment is awaited, a
-	 * switch can happen inside it, and restoring another tab's position into the
-	 * article would move the document the reader is actually looking at.
-	 */
-	async function restoreAfterColdEnrichment(enrichment: Promise<void>, tabId: string | null) {
-		await enrichment;
-		await tick();
-		const body = markdownBody;
-		if (!body || !tabId || tabManager.activeTabId !== tabId) return;
-		const tab = tabManager.tabs.find((t) => t.id === tabId);
-		if (tab) restorePreviewReadingPosition(body, tab, getPreviewScrollMax(body), measurePreviewBox);
-	}
-
-	$effect(() => {
-		const host = previewBlocks;
-		if (!host || !hasPreviewPane) return;
-
-		// Keyed on the visible host only. A keystroke must not re-observe: a fresh
-		// `observe` reports at once and would re-measure every fold. The patch
-		// effect observes new blocks itself. A hidden host is not observed at all,
-		// because its boxes measure 0 (see `previewHosts`).
-		const observation = observeFoldLayout(host);
-		foldLayout = observation;
-
-		return () => {
-			observation.stop();
-			if (foldLayout === observation) foldLayout = null;
-		};
+	const coldRestore = createColdEnrichmentRestore({
+		tabManager,
+		tick,
+		get markdownBody() {
+			return markdownBody;
+		},
+		restore: (body, tab) => restorePreviewReadingPosition(body, tab, getPreviewScrollMax(body), measurePreviewBox),
 	});
 
+	// A hidden host is not observed: its boxes measure 0 (see `previewHosts`).
+	followFoldLayout(foldLayout, () => previewBlocks, () => hasPreviewPane);
+
 	// Re-apply find highlights after a render. The patch only replaces the blocks
 	// that changed, so most highlights now survive on their own nodes — but the
 	// ones inside a replaced block do not, and without this they vanish until the
@@ -1624,16 +1173,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		return Math.max(0, target.scrollHeight - target.clientHeight);
 	}
 
-	function getPreviewFrontMatterScrollEnd(target: HTMLElement) {
-		const panel = target.querySelector<HTMLElement>('.frontmatter-panel');
-		if (!panel) return 0;
-
-		// In the same space as `target.scrollTop`, which is what it is compared
-		// against — see `measurePreviewBox`.
-		const box = measurePreviewBox(panel);
-		return Math.max(0, Math.min(getPreviewScrollMax(target), box.top + box.height));
-	}
-
 	// Not `element.offsetTop`: that is measured from the element's offset parent,
 	// and the preview is full of them — every `<table>` is the offset parent of
 	// its own rows and cells, and `.code-block-shell` is positioned. See
@@ -1647,129 +1186,27 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	}
 
 	function getPreviewScrollSyncPosition(target: HTMLElement): ScrollSyncPosition {
-		const position = getScrollSyncPositionFromPixels(
-			target.scrollTop,
-			getPreviewScrollMax(target),
-			getPreviewFrontMatterScrollEnd(target),
-		);
-
-		// Front matter is a rendered panel with no source range, so there is no
-		// line to send and the section ratio is the only thing that can carry it.
-		// This is the carve-out `scrollSync.ts` exists for, unchanged.
-		if (position.section !== 'body') return position;
-
-		const line = lineCoords.bufferLineAtPreviewOffset(target, target.scrollTop, measurePreviewBox);
-
-		return line === null ? position : { ...position, line };
+		return previewScrollSyncPosition(target, getPreviewScrollMax(target), lineCoords, measurePreviewBox);
 	}
 
 	function scrollPreviewToSyncPosition(position: ScrollSyncPosition) {
 		if (!markdownBody) return;
-
-		const scrollMax = getPreviewScrollMax(markdownBody);
-		let targetScroll: number | null = null;
-
-		if (position.section === 'body' && position.line !== undefined) {
-			const offset = lineCoords.previewOffsetForBufferLine(
-				markdownBody,
-				position.line,
-				measurePreviewBox,
-			);
-			if (offset !== null) targetScroll = offset;
-		}
-
-		if (targetScroll === null) {
-			targetScroll = getScrollTopForSyncPosition(
-				position,
-				scrollMax,
-				getPreviewFrontMatterScrollEnd(markdownBody),
-			);
-		}
-
-		// The line mapping can point past either end — the last block interpolates
-		// beyond the bottom of a preview that has no room left to scroll. Clamping
-		// before the threshold check is what keeps `isProgrammaticScroll` honest:
-		// an unreachable target fires no scroll event, and the flag would then be
-		// spent swallowing the reader's next real scroll instead.
-		targetScroll = Math.max(0, Math.min(scrollMax, targetScroll));
-
-		if (Math.abs(markdownBody.scrollTop - targetScroll) <= 5) return;
+		const targetScroll = getPreviewScrollTopForSyncPosition(
+			markdownBody,
+			getPreviewScrollMax(markdownBody),
+			position,
+			lineCoords,
+			measurePreviewBox,
+		);
+		if (targetScroll === null) return;
 
 		isProgrammaticScroll = true;
 		markdownBody.scrollTop = targetScroll;
 	}
 
-	/**
-	 * The source line the reader is on, for the outline to follow (#169).
-	 *
-	 * BOTH panes answer here, which is the point: the outline used to decide by
-	 * rendered box, and only the preview has those. A source line is something
-	 * either pane can produce — the editor sends one on every scroll (the same
-	 * position scroll sync uses, whether or not sync is on), and the preview
-	 * already computes one for the tab's reading position. One rule then picks
-	 * the entry, so the two panes cannot disagree about which heading is
-	 * current while both are on screen.
-	 */
-	let tocActiveLine = $state<RendererLine | null>(null);
-
-	/**
-	 * The one gate on `tocActiveLine`. With `settings.tocFollows` set to
-	 * 'cursor' and a cursor the reader can see (the editor is on screen, or
-	 * `settings.previewCursor` draws one the reader placed in the preview), only
-	 * the cursor moves the outline, and scrolling either pane leaves it where it
-	 * is. Otherwise the pane that scrolled last decides. In the preview alone
-	 * with `previewCursor` off, the editor's last cursor is kept for Ctrl+E but
-	 * not followed: nothing on screen would say why the outline stopped.
-	 *
-	 * A preview that is not on screen never decides: in the editor alone it is
-	 * still mounted at zero width, and its scroll events report lines from that
-	 * layout, which put the outline on the wrong heading after Ctrl+E (#799).
-	 * Nor does a preview Ctrl+E has just brought back, until
-	 * `restoreAfterLeavingEditor` has placed it: its scroll events before that
-	 * report the first headings.
-	 */
-	function followToc(from: 'cursor' | 'editor' | 'preview', line: RendererLine) {
-		const cursorLeads = settings.tocFollows === 'cursor' && (hasEditorPane || (settings.previewCursor && activeCursor !== null));
-		const previewSettled = hasPreviewPane && !previewPlacing;
-		const accepted = from === 'cursor' ? cursorLeads : !cursorLeads && (from === 'editor' || previewSettled);
-		if (accepted) tocActiveLine = line;
-	}
-
-	/** True from Ctrl+E out of the editor until the preview is placed. */
-	let previewPlacing = false;
-
-	/**
-	 * Each tab's cursor, shared by its two panes (#799): the editor's while it
-	 * is on screen, and with `settings.previewCursor` a click in the preview
-	 * moves it too. With that setting the preview draws it, and Ctrl+E puts the
-	 * editor's cursor on it. A tab only read so far has none.
-	 */
-	let cursorByTab = $state<Record<string, { line: BufferLine; column: number }>>({});
-	let activeCursor = $derived((tabManager.activeTabId && cursorByTab[tabManager.activeTabId]) || null);
-
-	function handleEditorCursor(line: BufferLine, column: number) {
-		if (tabManager.activeTabId) cursorByTab[tabManager.activeTabId] = { line, column };
-		followToc('cursor', lineCoords.toRendererLine(line));
-	}
-
 	let bufferLines = $derived(rawContent.split('\n'));
 	const readRendererLine: SourceLineReader = (line) => bufferLines[lineCoords.toBufferLine(asRendererLine(line)) - 1];
 
-	function placePreviewCursor(e: MouseEvent) {
-		const tabId = tabManager.activeTabId;
-		if (!tabId || !previewBlocks || !settings.previewCursor || e.detail !== 1) return;
-		if (!window.getSelection()?.isCollapsed) return;
-
-		const caret = document.caretRangeFromPoint(e.clientX, e.clientY);
-		const point = caret && sourceAtPoint(previewBlocks, { node: caret.startContainer, offset: caret.startOffset }, readRendererLine);
-		if (!point) return;
-
-		const line = lineCoords.toBufferLine(point.line);
-		cursorByTab[tabId] = { line, column: point.column };
-		followToc('cursor', point.line);
-		if (isSplit) editorPane?.setCursor(line, point.column);
-	}
-
 	/** The drawn cursor, in the article's scroll content; null while it isn't shown. */
 	let previewCursorBox = $state<{ top: number; left: number; height: number } | null>(null);
 
@@ -1789,7 +1226,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	});
 
 	$effect(() => {
-		const cursor = activeCursor;
+		const cursor = viewMode.activeCursor;
 		const shown = settings.previewCursor && cursor !== null && hasPreviewPane;
 		void htmlContent;
 		void previewLayoutVersion;
@@ -1915,66 +1352,8 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		};
 	});
 
-	function handleEditorScrollSync(position: ScrollSyncPosition) {
-		// The line the tab would record as its reading position, not the line
-		// the viewport cuts in half: `tabAnchorForEditorTopLine` is the one
-		// crossing from a Monaco top line into the outline's numbering (it
-		// counts from the body, and sits `EDITOR_ANCHOR_LINE_OFFSET` lines
-		// down). Handing over the raw top line left the outline one entry
-		// behind whenever a heading was the first line on screen (#744).
-		if (position.line !== undefined) {
-			followToc('editor', tabAnchorForEditorTopLine(lineCoords, asBufferLine(position.line)));
-		}
-
-		if (splitScrollSyncOn()) {
-			scrollPreviewToSyncPosition(position);
-		}
-	}
-
-	/**
-	 * Scroll sync is a split-view feature, and `isScrollSynced` outlives the
-	 * split: it is the tab's remembered choice for the next one. Out of split
-	 * the other pane is still mounted at zero width, so a position mapped
-	 * through it drags the visible pane off the line Ctrl+E put it on (#799).
-	 */
-	function splitScrollSyncOn() {
-		const tab = tabManager.activeTab;
-		return !!tab?.isSplit && tab.isScrollSynced;
-	}
-
-	/**
-	 * The source line to save as this tab's reading position: the one rendered
-	 * `PREVIEW_ANCHOR_OFFSET` below the top of the viewport, which is where the
-	 * restore puts it back.
-	 *
-	 * This used to be its own scan — `querySelectorAll('[data-sourcepos]')` over
-	 * the whole preview, then `offsetTop` and `offsetHeight` on every element it
-	 * returned, on every scroll event. Two things were wrong with that beyond the
-	 * cost (8.3ms per event on a 13,000-line document, measured in Chrome). It
-	 * took the FIRST element covering the offset in document order, which is the
-	 * outermost, while the restore's `findAnchorElement` takes the narrowest — so
-	 * capture and restore disagreed about which block a position belonged to. And
-	 * it had no opinion about `<br>`, which carries a source range and no box, so
-	 * an anchor at the top of the document could resolve to one (#464).
-	 */
 	function getPreviewScrollAnchor(target: HTMLElement): RendererLine | null {
-		const line = getSourceLineAtPreviewOffset(
-			target,
-			target.scrollTop + PREVIEW_ANCHOR_OFFSET,
-			measurePreviewBox,
-		);
-
-		// Straight off `data-sourcepos`, so it is already a renderer line: the
-		// two consumers — the tab's saved reading position and the outline —
-		// both count from the first line of the body.
-		return line === null ? null : asRendererLine(Math.round(line));
-	}
-
-	function syncEditorToPreviewScroll(target: HTMLElement) {
-		if (!splitScrollSyncOn() || !editorPane) return;
-
-		const position = getPreviewScrollSyncPosition(target);
-		editorPane.syncScrollToPosition(position);
+		return previewScrollAnchor(target, measurePreviewBox);
 	}
 
 	let isScrolling = $state(false);
@@ -2005,14 +1384,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 				tabManager.updateTabScrollPercentage(tabManager.activeTabId, percentage);
 			}
 
-			// One descent, two consumers: the tab's reading position, and the
-			// outline. Both want the line at the top of the preview, and this is
-			// already the only place it is measured.
-			const anchorLine = getPreviewScrollAnchor(target);
-			if (anchorLine !== null) {
-				tabManager.updateTabAnchorLine(tabManager.activeTabId, anchorLine);
-				followToc('preview', anchorLine);
-			}
+			followPreviewScroll(target);
 		}
 
 		syncEditorToPreviewScroll(target);
@@ -2080,127 +1452,44 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		return false;
 	}
 
-	async function openRelativeMarkdownTarget(target: RelativeMarkdownTarget) {
-		const from = currentFile;
-		const resolved = resolveMarkdownTargetPath(from, target);
-		if (!resolved) return;
-		// The same file, not the same string: `readme.md#a` inside `Readme.md`
-		// on macOS, or a link through a symlink, is a jump within this document,
-		// not a reload that asks to discard its unsaved edits.
-		const [resolvedKey, fromKey] = await Promise.all([canonicalizePath(resolved), canonicalizePath(from)]);
-		if (isSameFilePath({ path: resolved, pathKey: resolvedKey }, { path: from, pathKey: fromKey })) {
-			if (target.hash) {
-				await scrollToAnchorWhenReady(target.hash);
-			} else if (markdownBody) {
+	function openRelativeMarkdownTarget(target: RelativeMarkdownTarget) {
+		return openRelativeTarget(target, {
+			currentFile,
+			canonicalizePath,
+			scrollToAnchorWhenReady,
+			scrollToTop: () => {
+				if (!markdownBody) return;
 				pushScrollHistory();
 				markdownBody.scrollTo({ top: 0, behavior: jumpBehavior });
-			}
-			return;
-		}
-		if (tabManager.activeTabId && !(await canCloseTab(tabManager.activeTabId))) return;
-		await loadMarkdown(resolved, { navigate: true });
-		if (target.hash) {
-			await scrollToAnchorWhenReady(target.hash, { pushHistory: false }, resolved);
-		}
+			},
+			get activeTabId() { return tabManager.activeTabId; },
+			canCloseTab,
+			loadMarkdown: (path) => loadMarkdown(path, { navigate: true }),
+		});
 	}
 
 	async function openMarkdownTargetInNewTab(target: RelativeMarkdownTarget) {
 		const resolved = resolveMarkdownTargetPath(currentFile, target);
 		if (!resolved) return;
 
-		// The ordinary open path, as the Open dialog takes it: `loadMarkdown`
-		// resolves the file's identity first, so a tab already holding it under
-		// another spelling is activated instead of a second tab being built.
-		await loadMarkdown(resolved, { inNewTab: true });
+		await documentSession.openInNewTab(resolved);
 		if (target.hash) {
 			await scrollToAnchorWhenReady(target.hash, { pushHistory: false }, tabManager.activeTab?.path);
 		}
 	}
 
-	async function handleLinkClick(e: MouseEvent) {
-		const target = e.target as HTMLElement;
-
-		// The hover preview describes the element under the cursor, and only
-		// `mouseout` takes it down. A click that replaces the document removes
-		// that element while the cursor is still on it, and removing a node
-		// dispatches no `mouseout` — so the box was left on screen until the
-		// pointer happened to cross another link. Dropping it here, before any
-		// branch, is the same thing a browser does with its own link preview:
-		// the click is the moment the description stops being about anything.
-		tooltip.show = false;
-
-		// Fold toggle: the heading's chevron, or a foldable callout's whole title
-		// bar. One branch for both, because they are one feature — the callout's
-		// own branch used to toggle the classes and stop there, so a folded
-		// callout re-opened on the next render while a folded heading did not.
-		if (toggleFoldFromClick(foldHost, target)) {
-			if (e.detail > 1) e.preventDefault(); // prevent double-click selection
-			e.stopPropagation();
-			return;
-		}
-
-		const a = target.closest('a');
-		if (a) {
-			const href = a.getAttribute('href');
-			if (href?.startsWith('#') && href.length > 1) {
-				e.preventDefault();
-				await scrollToAnchorWhenReady(href.substring(1));
-				return;
-			}
-
-			const relativeMarkdownTarget = href ? getRelativeMarkdownTarget(href) : null;
-			if (relativeMarkdownTarget) {
-				e.preventDefault();
-				e.stopPropagation();
-				// Which of the two this is depends on the setting and the chord
-				// together — the chord means "the other one". Opening a tab goes
-				// through `addTab`, which already resolves a file that is open to
-				// the tab holding it, so one gesture answers both halves of #661:
-				// a new tab, or the one that already has the file.
-				if (opensInNewTab(settings.osType, e, settings.linksOpenInNewTab)) {
-					await openMarkdownTargetInNewTab(relativeMarkdownTarget);
-				} else {
-					await openRelativeMarkdownTarget(relativeMarkdownTarget);
-				}
-				return;
-			}
-
-			// Every other link is opened by `handleDocumentClick` on `document`,
-			// and SvelteKit's router sits in between (on
-			// `document.documentElement`), claiming any same-origin href whose
-			// click nobody else has: `[a](Files/a.pdf)` became a client-side
-			// navigation to a route that does not exist, and its 404 page
-			// replaced the app — including the title bar it draws, which on
-			// Windows is the only way to close the window (#772). The router
-			// bails on `event.defaultPrevented`.
-			e.preventDefault();
-			return;
-		}
-
-        // media zoom handling
-        const img = target.closest('img');
-        if (img) {
-            zoomData = { src: img.src };
-            return;
-        }
-
-        const mermaidDiv = target.closest('.mermaid-diagram');
-        if (mermaidDiv) {
-            const svg = mermaidDiv.querySelector('svg');
-            if (svg) {
-                // clone and strip fixed dimensions so viewBox governs scaling
-                const clone = svg.cloneNode(true) as SVGElement;
-                clone.removeAttribute('width');
-                clone.removeAttribute('height');
-                clone.style.width = '';
-                clone.style.height = '';
-                zoomData = { html: clone.outerHTML };
-                return;
-            }
-        }
-
-		placePreviewCursor(e);
-    }
+	function handleLinkClick(e: MouseEvent) {
+		return handlePreviewClick(e, {
+			hideTooltip: () => { tooltip.show = false; },
+			toggleFold: (target) => toggleFoldFromClick(foldHost, target),
+			scrollToAnchor: (id) => scrollToAnchorWhenReady(id),
+			opensInNewTab: (event) => opensInNewTab(settings.osType, event, settings.linksOpenInNewTab),
+			openInNewTab: openMarkdownTargetInNewTab,
+			openHere: openRelativeMarkdownTarget,
+			zoom: (data) => { zoomData = data; },
+			placeCursor: placePreviewCursor,
+		});
+	}
 
 	async function handleTaskCheckboxChange(event: Event) {
 		const checkbox = event.target as HTMLInputElement;
@@ -2226,37 +1515,21 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 
 
 
-	/*
-	 * All three mutations go through `updateStoredRecentFiles`, which re-reads
-	 * the stored list first. Writing `JSON.stringify(recentFiles)` from this
-	 * window's copy published a snapshot from whenever this window last looked,
-	 * so with two windows open the later write erased the other's entries.
-	 */
 	function saveRecentFile(path: string) {
-		recentFiles = updateStoredRecentFiles((current) => promoteRecentFile(current, path));
+		recentFileList.save(path);
 	}
 
 	function loadRecentFiles() {
-		recentFiles = readStoredRecentFiles();
+		recentFileList.load();
 	}
 
 	function deleteRecentFile(path: string) {
-		recentFiles = updateStoredRecentFiles((current) => dropRecentFile(current, path));
+		recentFileList.remove(path);
 	}
 
-	/*
-	 * localStorage fires `storage` in every *other* same-origin document, so
-	 * this is how a window learns that a sibling opened or removed a file. Home
-	 * screens in other windows used to keep showing a stale list until restart,
-	 * and — worse — that stale list was what their next write published.
-	 */
 	$effect(() => {
 		if (typeof window === 'undefined') return;
-		const onStorage = (event: StorageEvent) => {
-			if (isRecentFilesStorageEvent(event)) recentFiles = readStoredRecentFiles();
-		};
-		window.addEventListener('storage', onStorage);
-		return () => window.removeEventListener('storage', onStorage);
+		return recentFileList.listen(window);
 	});
 
 	function removeRecentFile(path: string, event: MouseEvent) {
@@ -2270,246 +1543,15 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		return documentSession.canCloseTab(tabId);
 	}
 
-	/**
-	 * The last auto-save a tab gets before it stops being auto-saveable.
-	 *
-	 * Shared by the two ways out of an editable pane (leaving edit mode,
-	 * closing split view). It is NOT a condition of the switch: the view
-	 * changes whether or not the write succeeds, and nothing here asks the
-	 * user anything. The only reason it exists is that the background debounce
-	 * requires `isEditing || isSplit` (see the auto-save effect), so the tab is
-	 * about to lose its scheduled writer while still dirty — a user who asked
-	 * for "save automatically" would otherwise be left with edits that no timer
-	 * is going to flush.
-	 *
-	 * Untitled tabs are excluded on purpose: `saveContent` would open the Save
-	 * dialog for them, which is exactly the forced save decision this stopped
-	 * making.
-	 */
-	async function flushBeforeLeavingEditableMode(tab: Tab) {
-		if (!tab.isDirty || tab.path === '') return;
-		// Auto-save off means edits are kept until the user saves them, so
-		// leaving the pane must not write either — closing keeps or asks.
-		if (!settings.autoSave) return;
-
-		const success = await saveSilently(tab.id);
-		if (!success) {
-			// Refused because the file changed underneath: the edit stays in
-			// the buffer and the conflict bar is already asking about it.
-			if (hasExternalChangeConflict(tab.id)) return;
-			// Reported, not obeyed. A file that cannot be written — read-only
-			// path, a buffer the lossy-decode guard refuses — used to trap the
-			// user in the editor with no way to look at their own text.
-			addToast(t('toast.autoSaveFailed', settings.language), 'error');
-			return;
-		}
-		if (tab.isDirty) {
-			// TOCTOU: the user typed during the await, so the file is one
-			// revision behind and the debounce is about to be dropped. The
-			// preview shows those newest edits, so nothing is lost or wrong on
-			// screen; the disk is what the user should hear about.
-			addToast(t('toast.savedNewerEdits', settings.language), 'info');
-		}
-	}
-
-	/**
-	 * Reading mode's HTML, rendered from the tab's own buffer and its own path.
-	 * Writes through the tab id, so a tab switch during the render cannot land
-	 * one document's HTML on another — and, unlike the `loadMarkdown` call this
-	 * replaces, it neither activates the tab nor re-reads the file.
-	 */
-	async function renderPreviewLeavingEditableMode(tab: Tab) {
-		try {
-			await renderTabPreviewFromRaw(tab);
-		} catch (e) {
-			console.error('Failed to render markdown', e);
-		}
-	}
-
-	/**
-	 * Move the active tab between reading and editing. Just the mode — where
-	 * the reader LANDS is `editSourceRange`'s business, and `toggleEditView`
-	 * is what decides which of the two a ⌘E means.
-	 */
-	async function toggleEdit() {
-		const tab = tabManager.activeTab;
-		if (!tab) return;
-
-		if (isEditing) {
-			// Back to reading. The preview renders the buffer, not the file, so no
-			// save is needed (#168). The tab stays dirty, and closing it or the
-			// window (`settleForExit`) still asks.
-			await flushBeforeLeavingEditableMode(tab);
-			// Ctrl+E lands on the line the other pane was showing, mapped the way
-			// split view maps it (#799).
-			const position = editorPane?.scrollSyncPosition() ?? null;
-			previewPlacing = position !== null;
-			tab.isEditing = false;
-			await renderPreviewLeavingEditableMode(tab);
-			if (position) void restoreAfterLeavingEditor(tab.id, position);
-		} else {
-			// Switch to edit
-			const position = markdownBody ? getPreviewScrollSyncPosition(markdownBody) : null;
-			if (tab.path !== '') {
-				if (tab.isDirty) {
-					// Unsaved edits are already in memory (made in reading
-					// mode, or kept when leaving the editor with auto-save
-					// off). Reading from disk would overwrite them, so only
-					// switch.
-					tab.isEditing = true;
-				} else {
-					const mayApply = claimTabForRead(tab.id);
-					try {
-						// This buffer is about to be handed to the editor, and
-						// the editor arms auto-save. The checked command is what
-						// says whether the decode was lossy, so the tab carries
-						// its own verdict instead of relying on the one
-						// `loadMarkdown` left behind — a file can be converted
-						// to UTF-8 (or away from it) between the two reads.
-						const [content, lossy, encoding] = (await invoke('read_file_content_checked', { path: tab.path })) as [string, boolean, string];
-						// A task ticked, or the tab closed, while this was out.
-						if (!mayApply()) return;
-						tabManager.setTabDecodedLossy(tab.id, lossy);
-						tabManager.setTabEncoding(tab.id, encoding);
-						// Goes through the store so a tab that held only the
-						// large-file preview slice stops being flagged partial.
-						tabManager.setTabRawContent(tab.id, content);
-						tab.isEditing = true;
-					} catch (e) {
-						console.error('Failed to read file for editing', e);
-					}
-				}
-			} else {
-				tab.isEditing = true;
-			}
-			if (position && tab.isEditing) {
-				await tick();
-				editorPane?.syncScrollToPosition(position, { cursorIntoView: settings.tocFollows === 'cursor' });
-			}
-		}
-	}
-
-	/**
-	 * The preview half of #799. The restore effect cannot do it: the article
-	 * stays mounted at zero width in edit mode, so nothing it depends on changes
-	 * with the mode. The pane takes its real width in the same frame (its slide
-	 * is a `transform`, see `utils/paneSlide.ts`), so the line is placed right
-	 * after the render, before the old position is ever painted.
-	 */
-	async function restoreAfterLeavingEditor(tabId: string, position: ScrollSyncPosition) {
-		await tick();
-		previewPlacing = false;
-		const body = markdownBody;
-		if (!body || tabManager.activeTab?.id !== tabId || tabManager.activeTab.isEditing) return;
-		scrollPreviewToSyncPosition(position);
-		// That scroll is marked programmatic, so the tab's anchor and the
-		// outline's current entry are written here.
-		const anchorLine = getPreviewScrollAnchor(body);
-		if (anchorLine !== null) {
-			tabManager.updateTabAnchorLine(tabId, anchorLine);
-			followToc('preview', anchorLine);
-		}
-	}
-
-	/**
-	 * A jump the editor has not been asked for yet, because it does not exist
-	 * yet: `toggleEdit` only flips a flag, and the `Editor` it mounts — and the
-	 * `editorPane` binding that reaches it — arrive on the next render. The
-	 * effect below spends it the moment they do, and immediately when the
-	 * editor is already on screen (split view).
-	 */
-	let pendingEditReveal = $state<BufferLineRange | null>(null);
-
+	// `viewMode.pendingEditReveal`, spent the moment the editor exists.
 	$effect(() => {
-		const range = pendingEditReveal;
+		const range = viewMode.pendingEditReveal;
 		if (!range || !editorPane) return;
 
-		pendingEditReveal = null;
+		viewMode.pendingEditReveal = null;
 		editorPane.revealSourceRange(range.startLine, range.endLine);
 	});
 
-	/**
-	 * Which source lines the reader means by right-clicking here (#90).
-	 *
-	 * The selection when there is one, so a range spanning several blocks opens
-	 * the editor on all of them; a caret or a click with nothing selected falls
-	 * through to whatever is under the pointer, which is how a click on an
-	 * image lands on the image.
-	 *
-	 * `null` when nothing under the pointer came from the document: the front
-	 * matter panel, the outline, the window chrome. The caller then leaves the
-	 * "Edit" entry doing exactly what it did before.
-	 */
-	function getContextMenuSourceRange(e: MouseEvent): LineRange | null {
-		return getSelectionSourceRange() ?? findSourceLineRange(e.target as Node | null);
-	}
-
-	/**
-	 * The source lines the reader has selected in the preview, or null when
-	 * nothing is selected or the selection came from outside the document.
-	 *
-	 * Both ends resolve independently and are merged, so a selection spanning
-	 * several blocks answers with all of them, and one end landing somewhere
-	 * with no range (the front matter panel, the outline) leaves the other end
-	 * in charge. Direction-independent: `startContainer` is the range's start,
-	 * not the point the drag began at.
-	 */
-	function getSelectionSourceRange(): LineRange | null {
-		const selection = window.getSelection();
-		if (!selection || selection.rangeCount === 0 || selection.isCollapsed) return null;
-		return mergeSourceLineRanges(
-			findSourceLineRange(selection.getRangeAt(0).startContainer),
-			findSourceLineRange(selection.getRangeAt(selection.rangeCount - 1).endContainer),
-		);
-	}
-
-	/**
-	 * What ⌘E means, from every entry point that offers it — the hotkey, the
-	 * toolbar, the title bar, and Monaco's own command.
-	 *
-	 * One function so the chord cannot mean two things depending on where the
-	 * caret happens to be (`shortcuts.checks.test.ts` holds the two layers
-	 * together), and so "take me to the editor" behaves the same whether the
-	 * reader asked for it with a key or with a menu item.
-	 */
-	async function toggleEditView() {
-		const selected = getSelectionSourceRange();
-
-		if (!hasPreviewPane) {
-			// The editor is already the whole window: nowhere further to take
-			// the reader, so this is the toggle back out.
-			await toggleEdit();
-			return;
-		}
-
-		if (isSplit && !selected) {
-			// Deliberately nothing.
-			//
-			// What ⌘E is asked for is the ability to edit, and split view
-			// already grants it — the editor is on screen. With no selection
-			// there is no fragment to travel to either, so every remaining
-			// reading of the chord is a LAYOUT change nobody asked for: closing
-			// the preview on a mistyped ⌘E costs the reader the pane and a
-			// second keystroke to get it back, while doing nothing costs
-			// nothing. ⌘\ opens and closes the split, and stays the only way.
-			return;
-		}
-
-		// Reading, or split with a selection: same as the context menu's "Edit".
-		await editSourceRange(selected);
-	}
-
-	/**
-	 * Open the editor on `range`. Toggles into edit mode when `isEditing` is
-	 * false, including split view entered from reading mode.
-	 */
-	async function editSourceRange(range: LineRange | null) {
-		if (!isEditing) await toggleEdit();
-		// `toggleEdit` swallows a failed read and stays in reading mode. Arming
-		// the jump anyway would fire it at whatever document is edited next.
-		if (range && tabManager.activeTab?.isEditing) pendingEditReveal = lineCoords.toBufferRange(range);
-	}
-
 	/**
 	 * This document's two line numberings, and the only thing that converts
 	 * between them.
@@ -2529,134 +1571,15 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 */
 	let lineCoords = $derived(lineCoordinates(rawContent));
 
-	async function saveContent(tabId?: string): Promise<boolean> {
-		const id = tabId ?? tabManager.activeTabId ?? '';
-		// Only the saves the user asked for come here — Cmd+S, the menu and
-		// title bar Save. Saves nobody asked for go through `saveSilently`.
-		// So a save that lands here IS the answer "keep my version": it both
-		// authorises the write the session would otherwise refuse, and leaves
-		// the bar with nothing to ask.
-		//
-		// Without the first half the bar became a trap: the disk really has
-		// changed, so the guard in `saveContent` refuses, so the bar goes back
-		// up, and Cmd+S can never get the user out of it.
-		if (hasExternalChangeConflict(id)) documentSession.allowOverwriteOnce(id);
-		return saveSilently(id);
-	}
-
-	/**
-	 * A save nobody asked for: the debounce, leaving an editable pane, the
-	 * exit's auto-save. It never authorises overwriting a changed file, so on
-	 * a conflicted tab the session's guard refuses it and the bar stays up.
-	 */
-	async function saveSilently(tabId: string): Promise<boolean> {
-		const saved = await documentSession.saveContent(tabId);
-		if (saved) clearExternalChangeConflict(tabId);
-		return saved;
-	}
-
 	async function saveContentAs(): Promise<boolean> {
 		return documentSession.saveContentAs();
 	}
 
-	// --- External change conflicts ---
-	// A file changed on disk while the tab holding it had unsaved edits. The
-	// reload is NOT performed: `setTabRawContent` replaces originalContent
-	// too, so an automatic reload would erase the edits and the fact that
-	// there were any. The tab is flagged instead and the user picks.
-	//
-	// The question is about one file at one baseline, so that is what is
-	// recorded. Anything that puts another document in the tab — a link, back
-	// and forward, Reload, Save As, the close dialog's Save or Don't Save —
-	// moves the path or the baseline, and the conflict is void without each of
-	// them having to remember to clear it.
-	let externalChangeConflicts = $state<Record<string, { path: string; baseline: string }>>({});
 	let activeExternalChangeConflict = $derived(
 		tabManager.activeTabId ? hasExternalChangeConflict(tabManager.activeTabId) : false,
 	);
 
-	function hasExternalChangeConflict(tabId: string): boolean {
-		const conflict = externalChangeConflicts[tabId];
-		const tab = tabManager.tabs.find((item) => item.id === tabId);
-		return !!conflict && !!tab && tab.path === conflict.path && tab.originalContent === conflict.baseline;
-	}
-
-	function noteExternalChangeConflict(tabId: string) {
-		const tab = tabManager.tabs.find((item) => item.id === tabId);
-		if (tab) externalChangeConflicts[tabId] = { path: tab.path, baseline: tab.originalContent };
-	}
-
-	function clearExternalChangeConflict(tabId: string) {
-		delete externalChangeConflicts[tabId];
-	}
-
-	/** "Reload": the user chose the disk version over their own edits. */
-	async function resolveExternalChangeByReloading(tabId: string) {
-		// The reload lands in the active tab, so it is refused for any other.
-		const tab = tabManager.activeTab;
-		if (!tab?.path || tab.id !== tabId) return;
-		comparison = null;
-		clearExternalChangeConflict(tab.id);
-		await loadMarkdown(tab.path, {
-			preserveEditState: true,
-			skipTabManagement: true,
-			resetScrollHistory: true,
-			// The user answered "the file changed under your edits" with the
-			// disk version. Every other caller of loadMarkdown is an OPEN and
-			// must leave an edited buffer alone; this one is the revert, and
-			// says so rather than leaving the session to infer it.
-			discardUnsavedBuffer: true,
-		});
-	}
-
-	/**
-	 * The two versions the conflict bar is asking about, once the user has
-	 * asked to see them.
-	 *
-	 * Read on demand rather than kept alongside the flag: the bar can stand for
-	 * a while, and what matters is what the file says when the question is
-	 * actually being answered, not what it said when it was raised.
-	 */
-	let comparison = $state<{ tabId: string; onDisk: string; mine: string; language: string } | null>(null);
-
-	// The overlay answers for the tab it was opened on. Switching tabs, or that
-	// tab's conflict going void, closes it rather than letting its buttons land
-	// on whatever is in front.
-	$effect(() => {
-		if (comparison && (comparison.tabId !== tabManager.activeTabId || !hasExternalChangeConflict(comparison.tabId))) {
-			comparison = null;
-		}
-	});
-
-	/** "Compare": show what Reload would replace, before it is irreversible. */
-	async function compareExternalChange() {
-		const tab = tabManager.activeTab;
-		if (!tab?.path) return;
-		try {
-			const [onDisk] = (await invoke('read_file_content_checked', { path: tab.path })) as [string, boolean, string];
-			if (tabManager.activeTabId !== tab.id) return;
-			comparison = {
-				tabId: tab.id,
-				onDisk,
-				mine: tab.rawContent,
-				language: editorLanguageFor(tab.path),
-			};
-		} catch (error) {
-			console.error('Failed to read the file for comparison', error);
-			addToast(`${t('externalChange.compare', settings.language)}: ${String(error)}`, 'error');
-		}
-	}
-
-	/** "Keep my version": dismiss. The buffer stays dirty and saveable. */
-	function resolveExternalChangeByKeepingBuffer(id: string) {
-		// The answer is about a write, not about a bar: the next save has to be
-		// allowed past the guard that would otherwise refuse to overwrite the
-		// changed file. One save only — a third program writing a minute later
-		// is a new question, and the user has not answered that one.
-		documentSession.allowOverwriteOnce(id);
-		comparison = null;
-		clearExternalChangeConflict(id);
-	}
+	$effect(() => externalChange.closeStaleComparison());
 
 	/**
 	 * Auto-save effect.
@@ -2709,21 +1632,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			const seenIds = new Set<string>();
 			for (const s of snapshot) {
 				seenIds.add(s.id);
-				// A tab with an unanswered external-change conflict is NOT
-				// eligible: the debounce would fire while the bar is still
-				// asking "reload or keep mine", write the buffer, and destroy
-				// the disk version the question was about — leaving the user to
-				// answer a question whose "reload" branch no longer exists.
-				// Only this background timer is held back. Cmd+S and the close
-				// dialog's Save still write, because that answer means "keep
-				// mine".
-				// A tab whose buffer was decoded lossily is dropped once the
-				// guard has refused it and said why. The first attempt is what
-				// produces that explanation, so it is deliberately allowed
-				// through; re-arming after it would only reach the same refusal
-				// every 1.5s for as long as the user keeps typing.
-				const eligible = s.isDirty && s.path !== '' && s.editable && !s.hasPendingConflict
-					&& !(s.decodedLossily && documentSession.isLossySaveRefused(s.id));
+				const eligible = isAutoSaveEligible(s, documentSession.isLossySaveRefused);
 				const prevRef = lastContentRefByTab.get(s.id);
 				const refChanged = prevRef !== s.contentRef;
 
@@ -2759,15 +1668,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 						(ok) => {
 							if (!ok) {
 								console.error('Auto-save failed for tab', s.id);
-								// A refusal already explained itself, naming the
-								// file and the way out. "Auto-save failed" on top
-								// of that says nothing new.
-								if (documentSession.isLossySaveRefused(s.id)) return;
-								// Same reasoning for the other refusal: the disk
-								// moved under the write, and the conflict bar is
-								// already on screen saying so and offering both
-								// ways out.
-								if (hasExternalChangeConflict(s.id)) return;
+								if (!autoSaveFailureNeedsToast(s.id, { isLossySaveRefused: documentSession.isLossySaveRefused, hasExternalChangeConflict })) return;
 								addToast(
 									t('toast.autoSaveFailed', settings.language),
 									'error',
@@ -2800,21 +1701,17 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 
 	async function exportAsHtml() {
 		const tab = tabManager.activeTab;
-		const result = await _exportHtml({
-			rawContent,
-			tabTitle: tab?.title || '',
-			tabPath: tab?.path || '',
-			// The exported page carries the appearance it was made in (see
-			// `exportThemeAttribute`), and Mermaid bakes its theme into the SVG,
-			// so the diagrams have to be rendered for the same appearance.
-			mermaidTheme: currentMermaidTheme(),
-			// The same value the live preview is wearing as `--preview-max-width`,
-			// so the exported file is read at the measure it was written at.
-			contentWidth: previewContentWidth,
-			appearance: previewAppearance,
-			newlineBreaks: settings.previewNewlineBreaks,
-			frontMatterTitle: t('frontMatter.properties', settings.language),
-		});
+		const result = await _exportHtml(
+			exportContextFrom(settings, {
+				rawContent,
+				tabTitle: tab?.title || '',
+				tabPath: tab?.path || '',
+				// The exported page carries the appearance it was made in (see
+				// `exportThemeAttribute`), and Mermaid bakes its theme into the SVG,
+				// so the diagrams have to be rendered for the same appearance.
+				mermaidTheme: currentMermaidTheme(),
+			}),
+		);
 		if (result?.missingImages) {
 			addToast(
 				t('toast.exportedHtmlMissingImages', settings.language).replace(
@@ -2861,14 +1758,12 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			// from the buffer through the same path, so neither the preview's
 			// state nor the window's has anything to do with what prints (#668).
 			path = await _exportPdf({
-				rawContent,
-				tabTitle: tab?.title || '',
-				tabPath: tab?.path || '',
-				mermaidTheme: currentMermaidTheme(),
-					contentWidth: previewContentWidth,
-				appearance: previewAppearance,
-				newlineBreaks: settings.previewNewlineBreaks,
-				frontMatterTitle: t('frontMatter.properties', settings.language),
+				...exportContextFrom(settings, {
+					rawContent,
+					tabTitle: tab?.title || '',
+					tabPath: tab?.path || '',
+					mermaidTheme: currentMermaidTheme(),
+				}),
 				osType: settings.osType,
 				printRoot: printRootEl,
 				onStart: () => {
@@ -2904,25 +1799,14 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		showHome = false;
 	}
 
-	/**
-	 * Hands a file Markpad does not edit to the OS: a document link to
-	 * `data.csv`, or a non-Markdown file clicked in the folder sidebar.
-	 */
-	async function openWithSystem(path: string) {
-		try {
-			// The OS default handler runs a program (`./setup.command`,
-			// `Calculator.app`, `x.exe`) rather than showing it, so one
-			// click on a document's link would launch it. Reveal it instead.
-			if (await invoke<boolean>('is_launchable_path', { path })) {
-				await invoke('open_file_folder', { path });
-				addToast(t('toast.launchableLinkRevealed', settings.language).replace('{{target}}', path), 'info');
-				return;
-			}
-			await openPath(path);
-		} catch (error) {
-			console.error('Failed to open local file', path, error);
-			addToast(t('toast.openFailed', settings.language).replace('{{target}}', path), 'error');
-		}
+	function openWithSystem(path: string) {
+		return openPathWithSystem(path, {
+			isLaunchable: (p) => invoke<boolean>('is_launchable_path', { path: p }),
+			reveal: (p) => invoke('open_file_folder', { path: p }),
+			openPath,
+			revealed: (p) => addToast(t('toast.launchableLinkRevealed', settings.language).replace('{{target}}', p), 'info'),
+			openFailed: (p) => addToast(t('toast.openFailed', settings.language).replace('{{target}}', p), 'error'),
+		});
 	}
 
 	async function selectFolder() {
@@ -2942,39 +1826,13 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	async function selectFile() {
 		const selected = await open({
 			multiple: true,
-			filters: [
-				// The one list every other part of the app already treats as a
-				// Markpad document — including `.txt`, which loads, renders and
-				// saves like any other note (#535). Hardcoding a shorter list here
-				// only hid those files behind "All Files".
-				{ name: 'Markdown', extensions: MARKDOWN_LINK_EXTENSIONS },
-				{ name: 'All Files', extensions: ['*'] },
-			],
+			filters: MARKDOWN_OPEN_FILTERS,
 		});
 		if (!selected) return;
 		const paths = Array.isArray(selected) ? selected : [selected];
 		for (const path of paths) await loadMarkdown(path);
 	}
 
-	async function reloadFromDisk() {
-		const activeId = tabManager.activeTabId;
-		const tab = tabManager.activeTab;
-		if (!activeId || !tab?.path) return;
-		if (!(await canCloseTab(activeId))) return;
-
-		await loadMarkdown(tab.path, {
-			preserveEditState: true,
-			skipTabManagement: true,
-			resetScrollHistory: true,
-			// canCloseTab has already resolved the buffer, so normally there is
-			// nothing left to discard — but the user can type during that await,
-			// and a reload that silently did nothing would be worse than one
-			// that does what its menu item says.
-			discardUnsavedBuffer: true,
-		});
-		addToast(t('toast.reloadedFromDisk', settings.language), 'info');
-	}
-
 	function toggleHome() {
 		showHome = !showHome;
 	}
@@ -2988,18 +1846,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		await closeTabAndWindowIfLast(tabManager.activeTabId);
 	}
 
-	async function closeTabAndWindowIfLast(tabId: string) {
-		if (!(await canCloseTab(tabId))) return;
-
-		if (tabManager.tabs.length === 1) await savePinnedTagIfNeeded();
-		tabManager.closeTab(tabId);
-		if (tabManager.tabs.length > 0) return;
-
-		invoke('unwatch_file').catch(console.error);
-		// Off, the empty window stays and renders Home.
-		if (settings.closeWindowWithLastTab) await destroyWindowAfterTabsClosed();
-	}
-
 	async function closeTabsWithConfirmation(tabIds: string[]) {
 		for (const tabId of tabIds) {
 			if (!(await canCloseTab(tabId))) return;
@@ -3018,14 +1864,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		if (tabManager.tabs.length === 0) tabManager.setWindowTag(null);
 	}
 
-	async function destroyWindowAfterTabsClosed() {
-		// No tabs left: drop this window's backup so a discarded buffer stays gone.
-		if (recoveryReady) await unsavedRecovery.flush('[]');
-		await persistWindowState(false);
-
-		await appWindow.destroy();
-	}
-
 	async function openFileLocation() {
 		if (currentFile) await invoke('open_file_folder', { path: currentFile });
 	}
@@ -3034,40 +1872,13 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		liveMode = !liveMode;
 	}
 
-	/**
-	 * `img.src` is an asset URL, a remote URL or a `data:` URL.
-	 * `normalizeAssetPath` recognises both asset URL forms (Windows
-	 * `http://asset.localhost/…`, others `asset://localhost/…`) and rejects
-	 * lookalike hosts (#363).
-	 */
 	async function saveImageAs(src: string) {
-		const realPath = normalizeAssetPath(src) ?? '';
-
-		if (!realPath) {
-			// The webview cannot fetch the bytes of a remote image at all: the
-			// app's CSP is `connect-src 'self'`, so a cross-origin `fetch` is
-			// refused before it leaves the page. (`img-src ... https:` is a
-			// different directive; it only governs what an `<img>` may
-			// display.) The download has to happen in Rust, and there is no
-			// command for it yet, so say that rather than reporting a network
-			// failure that never happened.
-			addToast(t('toast.remoteImageNotSupported', settings.language), 'error');
-			return;
-		}
-
-		const ext = realPath.split('.').pop() || 'png';
-		const dest = await save({
-			defaultPath: `image.${ext}`,
-			filters: [{ name: 'Images', extensions: ['png', 'jpg', 'jpeg', 'webp', 'gif', 'svg'] }]
+		await saveImageAsFile(src, {
+			save,
+			copyFile: (from, dest) => invoke('copy_file', { src: from, dest }),
+			toast: addToast,
+			language: () => settings.language,
 		});
-		if (dest) {
-			try {
-				await invoke('copy_file', { src: realPath, dest });
-				addToast(t('toast.imageSavedSuccessfully', settings.language));
-			} catch (e) {
-				addToast(`${t('toast.failedToSaveImage', settings.language)}: ${e}`, 'error');
-			}
-		}
 	}
 
 	async function saveDiagramAs(container: HTMLElement) {
@@ -3104,40 +1915,11 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		if (!editorPane) return;
 		e.preventDefault();
 
-		// Chords only for the items people learn the shortcut from. Undo is
-		// listed because Windows has no menu bar to find it in (#997).
-		const modifier = modifierFor(settings.osType);
-		const chord = (c: string) => formatChord(c, modifier);
-
 		docContextMenu = {
 			show: true,
 			x: e.clientX,
 			y: e.clientY,
-			items: [
-				{ label: t('menu.undo', settings.language), shortcut: chord('Mod+Z'), onClick: () => editorPane?.undo() },
-				{
-					label: t('menu.redo', settings.language),
-					shortcut: chord(modifier === 'Cmd' ? 'Mod+Shift+Z' : 'Mod+Y'),
-					onClick: () => editorPane?.redo(),
-				},
-				{ separator: true },
-				{ label: t('menu.cut', settings.language), onClick: () => editorPane?.cutToClipboard() },
-				{ label: t('menu.copy', settings.language), onClick: () => editorPane?.copyToClipboard() },
-				{ label: t('menu.paste', settings.language), onClick: () => editorPane?.pasteFromClipboard() },
-				{ label: t('menu.selectAll', settings.language), onClick: () => editorPane?.selectAll() },
-				{ separator: true },
-				// Monaco's other items need a language provider Markdown lacks.
-				{
-					label: t('menu.commandPalette', settings.language),
-					shortcut: 'F1',
-					onClick: () => editorPane?.runEditorAction('editor.action.quickCommand'),
-				},
-				{
-					label: t('menu.changeAllOccurrences', settings.language),
-					shortcut: chord('Mod+F2'),
-					onClick: () => editorPane?.runEditorAction('editor.action.changeAll'),
-				},
-			],
+			items: editorContextMenuItems(() => editorPane, settings.language, settings.osType),
 		};
 	}
 
@@ -3149,32 +1931,16 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	 * selection, so cancelling there would copy an empty string.
 	 */
 	function handleCopy(e: ClipboardEvent) {
-		const active = document.activeElement;
-		if (active instanceof HTMLInputElement || active instanceof HTMLTextAreaElement) return;
-		const selection = window.getSelection();
-		if (!selection || selection.isCollapsed || !selection.rangeCount || !e.clipboardData) return;
-		// Rendered content keeps its formatting when copied (#674), as in a
-		// browser or VS Code's Markdown preview.
-		const { text, html } = copyableFlavours(selection, currentFile);
-		e.clipboardData.setData('text/plain', text);
-		e.clipboardData.setData('text/html', html);
-		e.preventDefault();
+		handlePreviewCopy(e, currentFile);
 	}
 
 	function handleContextMenu(e: MouseEvent) {
-		if (modalState.show) return;
-		if (mode !== 'app') return;
-		// The editor gets its own menu, and this branch has to come first:
-		// Monaco takes input through a hidden `<textarea>`, so the text-field
-		// carve-out below would otherwise claim every right-click in it.
-		if ((e.target as HTMLElement).closest('.editor-container')) {
+		const menu = contextMenuFor(e.target as HTMLElement, { modalOpen: modalState.show, inApp: mode === 'app' });
+		if (menu === 'editor') {
 			showEditorContextMenu(e);
 			return;
 		}
-		// Text fields keep the webview's own editing menu (Cut/Copy/Paste);
-		// the document menu below is about the rendered preview and has no
-		// edit items, so swallowing the native one leaves no way to paste.
-		if ((e.target as HTMLElement).closest('input, textarea, [contenteditable="true"]')) return;
+		if (menu !== 'document') return;
 		e.preventDefault();
 
 		const selection = window.getSelection();
@@ -3193,30 +1959,17 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		let copyRefItem: any[] = [];
 		if (heading) {
 			const text = headingText(heading);
-			// The rendered id, straight off the element: comrak wrote it, and
-			// the outline reads it the same way — it can be on an anchor comrak
-			// nests inside the heading rather than on the heading itself.
-			const slug = heading.id || heading.querySelector('a.anchor')?.id || '';
+			const slug = headingSlug(heading);
 			copyRefItem = [
 				{ label: t('menu.copyReference', settings.language), onClick: () => copyHeadingReference(text, slug) },
 				{ separator: true },
 			];
 		}
 
-		const img = (e.target as HTMLElement).closest('img');
-		let mediaItems: any[] = [];
-		// Only a local file can be saved: see `saveImageAs`.
-		if (img && normalizeAssetPath(img.src)) {
-			mediaItems = [
-				{ label: t('menu.saveImageAs', settings.language), onClick: () => saveImageAs(img.src) },
-				{ separator: true }
-			];
-		}
+		let mediaItems: any[] = imageMenuItems(e.target as HTMLElement, settings.language, saveImageAs);
 
-		// Resolved now rather than inside the "Edit" handler: by the time that
-		// runs the reader has clicked a menu item, and a click is how a
-		// selection goes away.
-		const editSourceTarget = getContextMenuSourceRange(e);
+		// Resolved now: see `editSourceRangeAt`.
+		const editAtTarget = editSourceRangeAt(e);
 
 		// Read now for the same reason: the click on the item clears the selection.
 		const selected = canAnnotate && settings.previewAnnotations ? selectionAnnotation() : null;
@@ -3280,7 +2033,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 				} },
 				{ separator: true },
 				{ label: t('menu.openFileLocation', settings.language), onClick: openFileLocation, disabled: !currentFile },
-				{ label: t('menu.edit', settings.language), onClick: () => editSourceRange(editSourceTarget) },
+				{ label: t('menu.edit', settings.language), onClick: editAtTarget },
 				{ separator: true },
 				{ label: t('menu.closeFile', settings.language), onClick: closeFile },
 			],
@@ -3296,50 +2049,11 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	function handleMouseOver(event: MouseEvent) {
 		if (mode !== 'app') return;
 		const anchor = linkAt(event.target);
-		if (anchor) {
-			const rawHref = anchor.getAttribute('href') || '';
-
-			// tooltip for same-page anchor links: show text of target header
-			if (rawHref.startsWith('#')) {
-				const el = findAnchorTarget(rawHref.substring(1));
-				if (el) {
-					// Use data-label if it's a block anchor, otherwise use textContent
-					let text = el.getAttribute('data-label') || el.textContent || '';
-					text = text.replace(/↩.*$/, '').trim(); // remove backrefs if any
-					if (text) {
-						const rect = anchor.getBoundingClientRect();
-						tooltip = { show: true, text, shortcut: '', html: '', isFootnote: false, x: rect.left + rect.width / 2, y: rect.top - 8, align: 'top' };
-						return;
-					}
-				}
-				return;
-			}
-
-			// footnote references: show footnote content instead of URL
-			if (anchor.hasAttribute('data-footnote-ref') || anchor.closest('[data-footnote-ref]') || rawHref.match(/#fn-|#fnref-|#user-content-fn/)) {
-				const fnId = rawHref.replace(/^#/, '');
-				const fnLi = previewBlocks?.querySelector(`#${CSS.escape(fnId)}`) ||
-				              previewBlocks?.querySelector(`li#${CSS.escape(fnId)}`);
-				if (fnLi) {
-					// clone to remove backref arrow from tooltip
-					const clone = fnLi.cloneNode(true) as HTMLElement;
-					const backrefs = clone.querySelectorAll('.footnote-backref, a[href^="#fnref-"]');
-					backrefs.forEach(b => b.remove());
-					
-					let fnHtml = clone.innerHTML.trim();
-					if (fnHtml) {
-						const rect = anchor.getBoundingClientRect();
-						tooltip = { show: true, text: '', shortcut: '', html: fnHtml, isFootnote: true, x: rect.left + rect.width / 2, y: rect.top - 8, align: 'top' };
-						return;
-					}
-				}
-			}
-
-			// The raw href. The DOM-resolved one starts with `tauri://localhost`.
-			if (rawHref) {
-				const rect = anchor.getBoundingClientRect();
-				tooltip = { show: true, text: rawHref, shortcut: '', html: '', isFootnote: false, x: rect.left + rect.width / 2, y: rect.top - 8, align: 'top' };
-			}
+		if (!anchor) return;
+		const label = linkTooltipFor(anchor, { findAnchorTarget, footnoteRoot: previewBlocks });
+		if (label) {
+			const rect = anchor.getBoundingClientRect();
+			tooltip = { show: true, ...label, shortcut: '', x: rect.left + rect.width / 2, y: rect.top - 8, align: 'top' };
 		}
 	}
 
@@ -3350,43 +2064,14 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	async function handleDocumentClick(event: MouseEvent) {
 		if (mode !== 'app') return;
 		const anchor = linkAt(event.target);
-		if (anchor) {
-			const rawHref = anchor.getAttribute('href');
-			if (!rawHref) return;
-
-			if (rawHref.startsWith('#')) return;
-
-			const relativeMarkdownTarget = getRelativeMarkdownTarget(rawHref);
-			if (relativeMarkdownTarget) {
-				event.preventDefault();
-				await openRelativeMarkdownTarget(relativeMarkdownTarget);
-				return;
-			}
-
-			// A link to a local non-markdown file (`[data](./data.csv)`) is a
-			// path, and `anchor.href` is not: the DOM resolved it against the
-			// webview origin. Hand the OS the resolved disk path instead.
-			const localFilePath = resolveLocalFileLinkPath(rawHref, currentFile);
-			if (localFilePath) {
-				event.preventDefault();
-				await openWithSystem(localFilePath);
-				return;
-			}
-
-			if (anchor.href) {
-				event.preventDefault();
-				// `openUrl` rejects anything outside the opener plugin's scope
-				// (`mailto:`, `tel:`, `http://*`, `https://*`). Without this the
-				// rejection was unhandled: the click did nothing, said nothing,
-				// and left an uncaught promise rejection behind.
-				try {
-					await openUrl(anchor.href);
-				} catch (error) {
-					console.error('Failed to open link', anchor.href, error);
-					addToast(t('toast.openFailed', settings.language).replace('{{target}}', rawHref), 'error');
-				}
-			}
-		}
+		if (!anchor) return;
+		await followDocumentLink(event, anchor, {
+			currentFile,
+			openHere: openRelativeMarkdownTarget,
+			openWithSystem,
+			openUrl,
+			openFailed: (rawHref) => addToast(t('toast.openFailed', settings.language).replace('{{target}}', rawHref), 'error'),
+		});
 	}
 
 	function handleWheel(e: WheelEvent) {
@@ -3400,7 +2085,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	$effect(() => {
 		const tab = tabManager.activeTab;
 		const renderRevision = ++previewRenderRevision;
-		if (tab && (tab.isSplit || (isEditing && settings.showToc)) && tab.rawContent !== undefined) {
+		if (tab && refreshesPreviewCache(tab, () => isEditing, () => settings.showToc)) {
 			const tabId = tab.id;
 			const rawContent = tab.rawContent;
 			if (tab.previewedRawContent === rawContent) return;
@@ -3437,61 +2122,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		if (tabManager.activeTab?.unread) untrack(() => void documentSession.readActiveIfUnread());
 	});
 
-	async function toggleSplitView(tabId: string) {
-		const tab = tabManager.tabs.find((t) => t.id === tabId);
-		if (!tab) return;
-
-		if (!tab.isSplit) {
-			// Split view is an editor, and its first keystroke arms auto-save.
-			// The buffer must be complete first (not empty, not a large file's
-			// partial read), or auto-save writes a truncated file.
-			if (tab.path && !tab.isEditing && !tab.rawContent) {
-				const mayApply = claimTabForRead(tab.id);
-				try {
-					// Checked, like every other read that fills an editable
-					// buffer: split view is an editor, so this tab must carry
-					// the fidelity of its own decode rather than inherit one.
-					const [content, lossy, encoding] = (await invoke('read_file_content_checked', { path: tab.path })) as [string, boolean, string];
-					if (!mayApply()) return;
-					tabManager.setTabDecodedLossy(tab.id, lossy);
-					tabManager.setTabEncoding(tab.id, encoding);
-					tabManager.setTabRawContent(tab.id, content);
-				} catch (e) {
-					console.error('Failed to load raw content for split view', e);
-				}
-			}
-			if (!(await documentSession.ensureFullContent(tab.id))) {
-				addToast(t('toast.partialDocument', settings.language), 'error');
-				return;
-			}
-			tabManager.setSplitEnabled(tab.id, true);
-		} else {
-			// Like leaving edit mode: the surviving pane renders the buffer, so
-			// nothing is saved or asked.
-			await flushBeforeLeavingEditableMode(tab);
-			tabManager.setSplitEnabled(tab.id, false);
-			await renderPreviewLeavingEditableMode(tab);
-		}
-	}
-
-	/** The title bar's three mode buttons (#806): go straight to one, from any. */
-	async function setViewMode(target: ViewMode) {
-		const tab = tabManager.activeTab;
-		if (!tab || viewModeOf(tab) === target) return;
-		if (target === 'split') return toggleSplitView(tab.id);
-		if (!tab.isSplit) return target === 'edit' ? toggleEditView() : toggleEdit();
-		// Leaving split: the editor is already on screen and holds the full
-		// buffer, so Edit only drops the preview. Preview goes through the
-		// normal close, which flushes and renders.
-		if (target === 'edit') {
-			tab.isEditing = true;
-			tabManager.setSplitEnabled(tab.id, false);
-			return;
-		}
-		tab.isEditing = false;
-		await toggleSplitView(tab.id);
-	}
-
 	/*
 	 * `viewerKeymap.ts` decides which command a keystroke means. This maps each
 	 * command to the function that runs it. Every command is preventDefaulted
@@ -3511,79 +2141,32 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		};
 	}
 
+	const viewerCommands = viewerCommandTable({
+		settings,
+		tabManager,
+		reloadFromDisk,
+		carryActiveTabToNextWindow,
+		closeFile,
+		handleNewFile,
+		openNewWindow,
+		selectFile,
+		appExit,
+		toggleSplitView,
+		toggleLiveMode,
+		toggleEditView,
+		saveContentAs,
+		saveActiveTab,
+		handleUndoCloseTab,
+		navigateFileHistory,
+		openSettings: () => (showSettings = true),
+		toggleHome,
+		exportAsPdf,
+		openFileLocation,
+		triggerFindAction,
+	});
+
 	function runViewerCommand(command: ViewerCommand) {
-		switch (command) {
-			case 'preview-width-narrower':
-			case 'preview-width-wider':
-				settings.previewFullWidth = false;
-				settings.previewMaxWidth = adjustPreviewMaxWidth(
-					settings.previewMaxWidth,
-					command === 'preview-width-narrower' ? -40 : 40,
-				);
-				return;
-			case 'reload-from-disk':
-				return void reloadFromDisk();
-			case 'move-tab-to-next-window':
-				return void carryActiveTabToNextWindow();
-			case 'close-file':
-				return void closeFile();
-			case 'new-file':
-				return void handleNewFile();
-			case 'new-window':
-				return void openNewWindow().catch(console.error);
-			case 'open-file':
-				return void selectFile();
-			case 'app-exit':
-				return void appExit();
-			case 'toggle-split-view':
-				if (tabManager.activeTabId) toggleSplitView(tabManager.activeTabId);
-				return;
-			case 'toggle-live-mode':
-				return void toggleLiveMode();
-			case 'toggle-zen-mode':
-				return settings.toggleZenMode();
-			case 'toggle-tabs':
-				settings.showTabs = !settings.showTabs;
-				return;
-			case 'toggle-edit-view':
-				return void toggleEditView();
-			case 'save-as':
-				return void saveContentAs();
-			case 'save': {
-				// Save from any mode. An untitled buffer has content to write. A
-				// clean saved file is a no-op, so its mtime does not wake the watcher.
-				const saveTarget = tabManager.activeTab;
-				if (saveTarget && (saveTarget.isDirty || saveTarget.path === '')) saveContent();
-				return;
-			}
-			case 'undo-close-tab':
-				return void handleUndoCloseTab();
-			case 'next-tab':
-				return tabManager.cycleTab('next');
-			case 'previous-tab':
-				return tabManager.cycleTab('prev');
-			case 'history-back':
-				return void navigateFileHistory('back');
-			case 'history-forward':
-				return void navigateFileHistory('forward');
-			case 'zoom-in':
-				return settings.zoomIn();
-			case 'zoom-out':
-				return settings.zoomOut();
-			case 'zoom-reset':
-				return settings.resetZoom();
-			case 'open-settings':
-				showSettings = true;
-				return;
-			case 'toggle-home':
-				return toggleHome();
-			case 'export-pdf':
-				return void exportAsPdf();
-			case 'reveal-file':
-				return void openFileLocation();
-			case 'find':
-				return triggerFindAction();
-		}
+		viewerCommands[command]();
 	}
 
 	/*
@@ -3647,10 +2230,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	}
 
 	function handleKeyDown(e: KeyboardEvent) {
-		const command = viewerCommandFor(e, keyContext());
-		if (!command) return;
-		e.preventDefault();
-		runViewerCommand(command);
+		dispatchViewerKey(e, keyContext(), runViewerCommand);
 	}
 
 	async function navigateFileHistory(direction: 'back' | 'forward') {
@@ -3712,34 +2292,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		}
 	}
 
-	// Moving a tab to a new window preserves its state as-is — dirty content,
-	// edit/split mode, history — so there is deliberately no canCloseTab()
-	// save prompt here: movement is not closing. The content travels through
-	// the Rust broker (never disk, never localStorage), and the source tab is
-	// deleted only after the destination confirms the claim, so any failure —
-	// window creation error, timeout — leaves the tab exactly where it was.
-	// A large file may still be holding only its preview slice. The receiving
-	// window cannot tell, so the buffer is completed here, before the payload
-	// is built — otherwise the document arrives short and gets written back
-	// that way.
-	async function handleDetach(tabId: string) {
-		if (!(await documentSession.ensureFullContent(tabId))) {
-			addToast(t('toast.partialDocument', settings.language), 'error');
-			return false;
-		}
-		return windowSession.detach(tabId);
-	}
-
-	async function moveTabToWindow(tabId: string, targetLabel: string, focusAfter = false) {
-		if (!(await documentSession.ensureFullContent(tabId))) {
-			addToast(t('toast.partialDocument', settings.language), 'error');
-			return false;
-		}
-		const moved = await windowSession.transfer(tabId, (token) => invoke('offer_tab_to_window', { targetLabel, token }));
-		if (moved && focusAfter) await invoke('focus_window', { label: targetLabel });
-		return moved;
-	}
-
 	async function carryActiveTabToNextWindow() {
 		const activeId = tabManager.activeTabId;
 		if (!activeId) return;
@@ -3763,23 +2315,6 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		await Promise.all(others.map((window) => emitTo(window.label, 'merge-into', appWindow.label)));
 	}
 
-	async function mergeSelfInto(targetLabel: string) {
-		if (isCloseWalkActive) return;
-		await savePinnedTagIfNeeded();
-		for (const tab of [...tabManager.tabs]) {
-			if (isHomePath(tab.path)) {
-				tabManager.closeTab(tab.id);
-				continue;
-			}
-			await moveTabToWindow(tab.id, targetLabel);
-		}
-		if (tabManager.tabs.length === 0) {
-			if (recoveryReady) await unsavedRecovery.flush('[]');
-			await persistWindowState(false);
-			await appWindow.destroy();
-		}
-	}
-
 	function startDrag(e: MouseEvent, tabId: string | null) {
 		if (!tabId) return;
 		e.preventDefault();
@@ -3791,10 +2326,9 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 		const containerWidth = window.innerWidth;
 
 		const onMove = (moveEvent: MouseEvent) => {
-			const deltaX = moveEvent.clientX - startX;
 			tabManager.setSplitRatio(
 				tabId,
-				splitRatioAfterMove(startRatio, deltaX / containerWidth, settings.splitEditorSide),
+				splitRatioAfterDrag(startRatio, startX, moveEvent.clientX, containerWidth, settings.splitEditorSide),
 			);
 		};
 
@@ -3888,7 +2422,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 					if (tag) await openPinnedTag(tag);
 				}
 			}
-			windowMetaReady = true;
+			windowMeta.markReady();
 			if (isDisposed) return;
 
 			const urlParams = new URLSearchParams(window.location.search);
@@ -3907,21 +2441,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			document.addEventListener('visibilitychange', checkpointWhenHidden);
 			unlisteners.push(() => document.removeEventListener('visibilitychange', checkpointWhenHidden));
 			unlisteners.push(
-				await appWindow.listen('file-changed', async (event) => {
-					const changedPath = event.payload as string;
-					// The event names the changed file. Which tab that touches —
-					// and whether it may be reloaded at all — is decided by the
-					// session: it owns the self-write grace window (so our own
-					// auto-save does not bounce back) and it refuses to reload a
-					// tab with unsaved edits.
-					const outcome = await documentSession.resolveExternalChange(changedPath);
-					if (outcome.action === 'ignore') return;
-					if (outcome.action === 'conflict') {
-						noteExternalChangeConflict(outcome.tabId);
-						return;
-					}
-					if (liveMode) loadMarkdown(outcome.path);
-				}),
+				await appWindow.listen('file-changed', (event) => externalChange.handleFileChanged(event.payload as string, liveMode)),
 			);
 
 			const listeners: [string, EventCallback<any>][] = [
@@ -3943,7 +2463,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 						const newPath = oldPath.replace(/[/\\][^/\\]+$/, (m) => m.charAt(0) + newName);
 						try {
 							await documentSession.renameFile(tabId, newPath);
-							recentFiles = updateStoredRecentFiles((current) => renameRecentFile(current, oldPath, newPath));
+							recentFileList.rename(oldPath, newPath);
 						} catch (e) {
 							console.error('Failed to rename file', e);
 							await askCustom(`Failed to rename file: ${e}`, { title: 'Error', kind: 'error' });
@@ -3968,7 +2488,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 					moveTabToWindow(tabId, targetLabel).catch((error) => console.error('Failed to move tab', error));
 				}],
 				['tab-transfer-offer', (event) => {
-					if (isCloseWalkActive) return;
+					if (windowExit.isCloseWalkActive()) return;
 					windowSession.acceptOfferedTransfer(event.payload);
 				}],
 				['merge-into', (event) => {
@@ -3995,42 +2515,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			];
 			for (const [event, handler] of listeners) unlisteners.push(await appWindow.listen(event, handler));
 			unlisteners.push(
-				await appWindow.onCloseRequested(async (event) => {
-					// The red button is a native control, so it is NOT blocked
-					// by the in-app dialog overlay: a second click while the
-					// walk below is showing a dialog would re-enter this handler
-					// and start a competing walk whose setActive calls fight the
-					// first one — the highlighted tab stops matching the dialog.
-					// One walk at a time.
-					if (isCloseWalkActive) {
-						event.preventDefault();
-						return;
-					}
-
-					// Hot exit on quit or when the app exits with this window: the
-					// backup is written, nothing to ask, close proceeds. Closing one
-					// of several windows asks below. Decided before `hadDirtyTabs`:
-					// the buffers stay dirty, and a re-triggered close would only
-					// find them again. If unsure, ask.
-					const keepsUnsaved = () => invoke<boolean>('keeps_unsaved_on_close').catch(() => false);
-					if (settings.persistOpenEditors && (await keepUnsavedForExit(keepsUnsaved))) return;
-
-					// With tabs to review the close is held open while their
-					// dialogs are up, then re-triggered: the handler re-enters,
-					// finds nothing dirty, and the close proceeds.
-					const hadDirtyTabs = tabManager.tabs.some((t) => t.isDirty);
-					if (hadDirtyTabs) event.preventDefault();
-					// Closing one of several windows forgets it; quit or the last window remembers.
-					const endsSession = () => invoke<boolean>('keeps_unsaved_on_close').catch(() => true);
-					if (!(await settleForExit(endsSession))) {
-						// A cancelled close cancels the quit, so the windows left ask again.
-						invoke('set_quitting', { quitting: false }).catch(console.error);
-						return;
-					}
-					// Resolved: drop the backup, so a discarded buffer stays gone.
-					if (recoveryReady) await unsavedRecovery.flush('[]');
-					if (hadDirtyTabs) appWindow.close();
-				}),
+				await appWindow.onCloseRequested(windowExit.handleCloseRequested),
 			);
 
 			unlisteners.push(
@@ -4059,23 +2544,10 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 						const paths = event.payload.paths;
 						const currentEditor = editorPane;
 						if (currentEditor) currentEditor.hideDragCaret();
-						// Both panes route through `routeDroppedFile`. The editor's
-						// branch used to look for an image and silently discard
-						// everything else, so a `.md` dropped there did nothing at
-						// all while the same drop on the preview opened it.
-						const pane = dropPaneFor(dragTarget, !!currentEditor);
-						paths.forEach(path => {
-							switch (routeDroppedFile(path, pane)) {
-								case 'insert':
-									currentEditor?.handleDroppedFile(path, x, y);
-									break;
-								case 'open':
-									loadMarkdown(path);
-									break;
-								case 'unsupported':
-									reportUnsupportedDrop(path);
-									break;
-							}
+						handleDrop(paths, dragTarget, !!currentEditor, {
+							insert: (path) => currentEditor?.handleDroppedFile(path, x, y),
+							open: (path) => loadMarkdown(path),
+							unsupported: reportUnsupportedDrop,
 						});
 						
 						isDragging = false;
@@ -4099,7 +2571,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			try {
 				const args: string[] = await invoke('send_markdown_path');
 				if (!isDisposed && args?.length > 0) {
-					for (const path of args) await loadMarkdown(path);
+					await documentSession.openFiles(args);
 				}
 			} catch (error) {
 				console.error('Error receiving Markdown file path:', error);
@@ -4216,10 +2688,10 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 	<Settings show={showSettings} theme={settings.theme} onSetTheme={(t) => (settings.theme = t)} onclose={() => (showSettings = false)} />
 
 	<DiffOverlay
-		show={comparison !== null}
-		onDisk={comparison?.onDisk ?? ''}
-		mine={comparison?.mine ?? ''}
-		language={comparison?.language ?? 'markdown'}
+		show={externalChange.comparison !== null}
+		onDisk={externalChange.comparison?.onDisk ?? ''}
+		mine={externalChange.comparison?.mine ?? ''}
+		language={externalChange.comparison?.language ?? 'markdown'}
 		labels={{
 			onDisk: t('externalChange.onDisk', settings.language),
 			mine: t('externalChange.mine', settings.language),
@@ -4227,9 +2699,9 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			keepMine: t('externalChange.keepMine', settings.language),
 			close: t('externalChange.close', settings.language),
 		}}
-		onclose={() => (comparison = null)}
-		onreload={() => comparison && resolveExternalChangeByReloading(comparison.tabId)}
-		onkeep={() => comparison && resolveExternalChangeByKeepingBuffer(comparison.tabId)} />
+		onclose={externalChange.closeComparison}
+		onreload={() => externalChange.comparison && resolveExternalChangeByReloading(externalChange.comparison.tabId)}
+		onkeep={() => externalChange.comparison && resolveExternalChangeByKeepingBuffer(externalChange.comparison.tabId)} />
 
 	{#if sidebarSide}
 		<Sidebar
@@ -4267,7 +2739,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 			</button>
 		</div>
 	{/if}
-	{#if tabManager.activeTab && !isHomePath(tabManager.activeTab.path) && !showHome}
+	{#if tabManager.activeTab && !showsHomeScreen(() => tabManager.activeTab, showHome)}
 			<div
 				class="markdown-container"
 				style="zoom: {hasPreviewPane ? settings.zoomLevel / 100 : 1}; --code-font: {previewAppearance.codeFontFamily}; --code-font-size: {previewAppearance.codeFontSize}px; --highlight-color: {previewAppearance.highlightColor};"
@@ -4313,14 +2785,14 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 							<Editor
 								bind:this={editorPane}
 								value={tabManager.activeTab.rawContent}
-								readOnly={tabManager.activeTab.isTruncated === true}
+								readOnly={editorReadOnly(tabManager.activeTab)}
 								language={editorLanguage}
 								theme={settings.theme}
 								zoomLevel={settings.zoomLevel}
 								oncommand={runViewerCommand}
 								onscrollsync={handleEditorScrollSync}
 								oncursor={handleEditorCursor}
-								sharedCursor={settings.previewCursor ? activeCursor : null} />
+								sharedCursor={settings.previewCursor ? viewMode.activeCursor : null} />
 						{/if}
 					</div>
 
@@ -4363,7 +2835,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 										if(e.key === 'Enter' || e.key === ' ') handleLinkClick(e as unknown as MouseEvent);
 									}}
 									tabindex="-1"
-									style="outline: none; font-family: {previewAppearance.fontFamily}; font-size: {previewAppearance.fontSize}px; flex: 1; --preview-max-width: {previewContentWidth === null ? '100%' : `${previewContentWidth}px`};">
+									style="outline: none; font-family: {previewAppearance.fontFamily}; font-size: {previewAppearance.fontSize}px; flex: 1; --preview-max-width: {layout.maxWidthCss};">
 									{#if frontMatterInfo.exists}
 										<details
 											class="frontmatter-panel"
@@ -4453,8 +2925,8 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 															{:else}
 																<code>{field.displayValue}</code>
 															{/if}
-															{#if frontMatterEditErrors[frontMatterFieldStateKey(field)]}
-																<div class="frontmatter-field-error" role="status">{frontMatterEditErrors[frontMatterFieldStateKey(field)]}</div>
+															{#if frontMatterFields.editError(field)}
+																<div class="frontmatter-field-error" role="status">{frontMatterFields.editError(field)}</div>
 															{/if}
 														</div>
 													{/each}
@@ -4549,10 +3021,10 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 									onpointerdown={startTocResize}
 									onkeydown={handleTocResizeKeyDown}></div>
 								<Toc
-									activeLine={tocActiveLine} 
+									activeLine={viewMode.tocActiveLine} 
 										{markdownBody} 
 										contentRoot={previewBlocks}
-										{previewRevision}
+										previewRevision={previewPatch.revision}
 										onBeforeJump={pushScrollHistory} 
 										{foldOverrides} 
 										ontoggleFold={(key: string) => toggleFold(foldHost, key)} 
@@ -4564,7 +3036,7 @@ import { claimTabForRead, createDocumentSession, type LoadMarkdownOptions } from
 											// sidebar and stays; not overhanging it is sitting in the
 											// margin harming nothing, and closing it would take away a
 											// behaviour that was already fine.
-											if (isOverhanging && !settings.pinnedToc) settings.showToc = false;
+											if (tocAutoCollapses(() => isOverhanging, settings.pinnedToc)) settings.showToc = false;
 											if (hasEditorPane && editorPane) {
 												// Same renderer-to-buffer shift as the context menu: the
 												// outline reads `data-sourcepos` too, and has been landing
diff --git a/src/lib/components/DiffOverlay.svelte b/src/lib/components/DiffOverlay.svelte
index afc37463..97834948 100644
--- a/src/lib/components/DiffOverlay.svelte
+++ b/src/lib/components/DiffOverlay.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import type * as Monaco from 'monaco-editor';
+	import { openDiffView } from '../utils/diffView.js';
 
 	/**
 	 * Side-by-side view of what is on disk against what the buffer holds.
@@ -35,14 +35,11 @@
 	} = $props();
 
 	let host = $state<HTMLDivElement | null>(null);
-	let editor: Monaco.editor.IStandaloneDiffEditor | null = null;
-	let models: Monaco.editor.ITextModel[] = [];
+	let closeView: (() => void) | null = null;
 
 	function dispose() {
-		editor?.dispose();
-		editor = null;
-		for (const model of models) model.dispose();
-		models = [];
+		closeView?.();
+		closeView = null;
 	}
 
 	$effect(() => {
@@ -60,21 +57,7 @@
 			const monaco = await import('monaco-editor');
 			if (cancelled) return;
 			dispose();
-			// Models of its own rather than the tab's: this view must not be
-			// able to touch the document, and handing it the live model would
-			// put a second editor on a buffer that `Editor.svelte` owns.
-			const left = monaco.editor.createModel(original, languageId);
-			const right = monaco.editor.createModel(modified, languageId);
-			models = [left, right];
-			editor = monaco.editor.createDiffEditor(element, {
-				readOnly: true,
-				originalEditable: false,
-				automaticLayout: true,
-				renderSideBySide: true,
-				scrollBeyondLastLine: false,
-				minimap: { enabled: false },
-			});
-			editor.setModel({ original: left, modified: right });
+			closeView = openDiffView(monaco, element, original, modified, languageId);
 		})();
 
 		return () => {
diff --git a/src/lib/components/Editor.svelte b/src/lib/components/Editor.svelte
index 464b8467..0012f0b0 100644
--- a/src/lib/components/Editor.svelte
+++ b/src/lib/components/Editor.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
 	import { onMount, onDestroy } from "svelte";
 	import { tabManager } from "../stores/tabs.svelte.js";
-	import { settings, wheelZoomFactor } from "../stores/settings.svelte.js";
-	import { t, type LanguageCode } from '../utils/i18n.js';
-	import { MARKDOWN_LANGUAGE_ID, shouldLinkifyPastedUrl } from '../utils/pasteContext.js';
+	import { settings } from "../stores/settings.svelte.js";
+	import { t } from '../utils/i18n.js';
+	import * as editorEdits from '../utils/editorEdits.js';
 	import {
 		INLINE_WRAP_LOOKAROUND,
 		inlineWrapEdit,
@@ -12,26 +12,19 @@
 		type InlineWrapToolId,
 		type LineMarkerToolId,
 	} from '../utils/editorToolbar.js';
-	import { isInFencedCode } from '../utils/codeFence.js';
-	import { frontMatterFenceLines, frontMatterLineOffset } from '../utils/frontMatter.js';
-	import { isAltGraphChord, type ViewerCommand } from '../utils/viewerKeymap.js';
+	import { editorFrontMatterScrollEnd } from '../utils/editorFrontMatter.js';
+	import type { ViewerCommand } from '../utils/viewerKeymap.js';
 	import { platformOf } from '../utils/platform.js';
-	import { blockEnter, parseListItem, shiftListItem, type ListEdit } from '../utils/listEditing.js';
-	import { tableOperation, tableStep, type TableEdit, type TableOperation } from '../utils/tableEditing.js';
-	import { editorOptionsFromSettings } from '../utils/editorOptions.js';
-	import { markdownTokenRules, monacoThemeName, semanticTokenRules } from '../utils/editorTheme.js';
+	import { editorKeyHandlers } from '../utils/editorKeyHandlers.js';
+	import type { TableOperation } from '../utils/tableEditing.js';
+	import { updatedEditorOptions } from '../utils/editorOptions.js';
+	import { monacoThemeName } from '../utils/editorTheme.js';
 	import { paragraphAround } from '../utils/focusParagraph.js';
-	import { createMarkdownSemanticTokensProvider } from '../utils/semanticTokens.js';
-	import { getTabModel, lineEndingLabel, tabModelUri } from '../utils/tabModels.js';
-	import { installVimScrollCommands } from '../utils/vimScrollCommands.js';
-	import { installVimClipboardRegisters } from '../utils/vimClipboardRegisters.js';
-	import { countWords } from '../utils/wordCount.js';
-	import {
-		headingLinkContext,
-		headingQueryStart,
-		type HeadingAnchor,
-	} from '../utils/headingCompletion.js';
-	import { headingFoldRanges, headingSymbols } from '../utils/headingSymbols.js';
+	import { EditorDocument } from '../utils/editorDocument.svelte.js';
+	import { bindScrollSync, EditorJumps, type RevealPlacement } from '../utils/editorJumps.js';
+	import { attachVimMode } from '../utils/vimAttach.js';
+	import { mountAfterLoad } from '../utils/editorMount.js';
+	import { mountEditor } from '../utils/mountEditor.js';
 	import {
 		getLineAtVerticalOffset,
 		getScrollSyncPositionFromPixels,
@@ -41,17 +34,13 @@
 	} from '../utils/scrollSync.js';
 	import {
 		asBufferLine,
-		editorTopLineForTabAnchor,
 		lineCoordinates,
 		type BufferLine,
 	} from '../utils/lineCoordinates.js';
-	import { editorReadingPosition } from '../utils/editorPosition.js';
-	import {
-		documentParentDir,
-		imageEmbed,
-		resolveImageDirectory,
-	} from '../utils/imageEmbed.js';
-	import { routeDroppedFile } from '../utils/fileDrop.js';
+	import { editorActions } from '../utils/editorActions.js';
+	import * as editorClipboard from '../utils/editorClipboard.js';
+	import { localizedEditorActions } from '../utils/editorLocalizedActions.svelte.js';
+	import type { EditorClipboardDeps } from '../utils/editorClipboard.js';
 
 	// Monaco is ~86% of the startup JavaScript (a 4.4 MB chunk, ~360ms of
 	// parse+eval, paid once per window because every window is its own webview)
@@ -72,7 +61,6 @@
 	import cssWorker from "monaco-editor/esm/vs/language/css/css.worker?worker";
 	import htmlWorker from "monaco-editor/esm/vs/language/html/html.worker?worker";
 	import tsWorker from "monaco-editor/esm/vs/language/typescript/ts.worker?worker";
-	import { openUrl } from "@tauri-apps/plugin-opener";
 	import { invoke } from "@tauri-apps/api/core";
 
 	let {
@@ -128,27 +116,16 @@
 	let cursorPosition = $state<Monaco.Position | null>(null);
 	let selectionCount = $state(0);
 	let cursorCount = $state(0);
-	let wordCount = $state(0);
-	let wordCountTimer: ReturnType<typeof setTimeout> | undefined;
-	/** The attached model's text as the content listener last read it; null after a model swap. */
-	let emittedText: string | null = null;
-	let currentLanguage = $state("markdown");
-	let lineEnding = $state<"LF" | "CRLF">("LF");
-	/**
-	 * The file's encoding, which a save writes back (#372). Read from the tab,
-	 * not the Monaco model: it belongs to the file, not the buffer.
-	 */
-	let encoding = $derived(tabManager.activeTab?.encoding ?? 'UTF-8');
-	let currentTabId = tabManager.activeTabId;
-
-	// A Monaco action captures its label when it is registered, so actions built
-	// once at mount keep whatever language they were built with — switching the
-	// UI language used to leave the editor's context menu in the old one until
-	// the app was restarted. `addAction` returns an `IDisposable` for exactly
-	// this case: the registration below is re-run on every language change, and
-	// the previous disposables are released first so ids are never registered
-	// twice (a duplicate id leaves a duplicate context-menu entry behind).
-	//
+	// Which document the editor shows, the keystroke-to-tab route, and the
+	// status-bar readings of the document; see `utils/editorDocument.svelte.ts`.
+	const doc = new EditorDocument({
+		monaco: () => monaco,
+		editor: () => editor,
+		tabs: tabManager,
+		value: () => value,
+		showWordCount: () => settings.wordCount,
+	});
+
 	// `editorReady` has to be `$state` rather than a plain `if (editor)` guard:
 	// `editor` is assigned inside `onMount` and is not reactive, so an effect
 	// that bailed out on it would never re-run once the editor appeared. That
@@ -157,8 +134,14 @@
 	// the editor has to gate on this flag, or it runs once against a missing
 	// editor and never runs again.
 	let editorReady = $state(false);
+	// Syncs and reveals asked for before Monaco loaded; see `utils/editorJumps.ts`.
+	const jumps = new EditorJumps({
+		monaco: () => monaco,
+		editor: () => editor,
+		ready: () => editorReady,
+		scrollTo: scrollToSyncPosition,
+	});
 	let fontIsMonospace = $state(true);
-	let localizedActions: Monaco.IDisposable[] = [];
 
 	// Synchronous, so the keybindings can be registered once at mount; see
 	// `platformOf` for why its fallback cannot disagree with `settings.osType`.
@@ -166,55 +149,6 @@
 		return platformOf(settings.osType) === 'macos';
 	}
 
-	/**
-	 * The `ITextModel` belonging to a tab — Monaco's document object, and the
-	 * thing that owns the undo stack.
-	 *
-	 * One per tab, created here because this component holds the dynamically
-	 * imported Monaco namespace, and reaped by `TabManager` because that is
-	 * what knows a tab is gone; see `utils/tabModels.ts` for both halves.
-	 *
-	 * The language is re-applied on every call rather than only at creation.
-	 * `language` is derived from the ACTIVE TAB'S PATH, and a tab can be
-	 * repointed at a file of another type without being recreated — following a
-	 * link, back/forward, Save As. The model outlives all of those, so a
-	 * language fixed at creation would be the extension of whatever file the tab
-	 * held the first time it was edited. `setModelLanguage` is a no-op when the
-	 * id already matches.
-	 */
-	function acquireTabModel(tabId: string, seed: string, languageId: string) {
-		const model = getTabModel(tabId, () =>
-			monaco.editor.createModel(seed, languageId, monaco.Uri.parse(tabModelUri(tabId))),
-		);
-		if (model.getLanguageId() !== languageId) monaco.editor.setModelLanguage(model, languageId);
-		return model;
-	}
-
-	/**
-	 * The status-bar readings that are properties of the DOCUMENT rather than of
-	 * an edit: the language, the word count and the line ending.
-	 *
-	 * They used to be refreshed only by `onDidChangeModelContent`, which was
-	 * enough while a tab switch went through `setValue` — that fires a content
-	 * change (a flush) as a side effect. `setModel` does not, because no content
-	 * changed: a different document arrived. So switching tabs has to ask for
-	 * these explicitly, or the status bar keeps the previous document's numbers.
-	 */
-	function syncStatusFromModel(deferWordCount = false) {
-		const model = editor.getModel();
-		if (!model) return;
-		currentLanguage = model.getLanguageId();
-		lineEnding = lineEndingLabel(model);
-		// `countWords` is several full-text regex passes, ~400 ms on a 1 MB
-		// document: skipped while the status bar hides it, and on a keystroke
-		// left for a pause in typing.
-		clearTimeout(wordCountTimer);
-		if (!settings.wordCount) return;
-		const count = () => (wordCount = countWords(model.getValue()));
-		if (deferWordCount) wordCountTimer = setTimeout(count, 300);
-		else count();
-	}
-
 	self.MonacoEnvironment = {
 		getWorker: function (_moduleId: string, label: string) {
 			if (label === "json") {
@@ -233,703 +167,47 @@
 		},
 	};
 
-	onMount(() => {
-		let cancelled = false;
-		let teardown: (() => void) | null = null;
-
-		// `onMount` itself stays synchronous: Svelte only treats a *synchronously*
-		// returned function as the unmount cleanup, so an `async` callback would
-		// hand it a promise and silently leak the editor, its listeners and the
-		// `window.open` patch. The await lives in this inner task instead, and the
-		// synchronous return closes over both the cancel flag (the component can
-		// be destroyed while the chunk is still in flight — Ctrl+E then Ctrl+E
-		// again) and whatever cleanup `createEditor` produced.
-		void (async () => {
-			monaco = await import("monaco-editor");
-			if (cancelled) return;
-			teardown = createEditor();
-		})();
-
-		return () => {
-			cancelled = true;
-			teardown?.();
-		};
-	});
+	// `onMount` itself stays synchronous; see utils/editorMount.ts.
+	onMount(() => mountAfterLoad(async () => (monaco = await import("monaco-editor")), createEditor));
 
 	function createEditor() {
-		const originalOpen = window.open;
-		window.open = function (
-			url?: string | URL,
-			target?: string,
-			features?: string,
-		) {
-			if (
-				typeof url === "string" &&
-				(url.startsWith("http://") || url.startsWith("https://"))
-			) {
-				openUrl(url);
-				return null;
-			}
-			return originalOpen.apply(this, arguments as any);
-		};
-
-		const defineThemes = () => {
-			monaco.editor.defineTheme("app-theme-dark", {
-				base: "vs-dark",
-				inherit: true,
-				rules: [...markdownTokenRules('dark'), ...semanticTokenRules('dark')],
-				colors: {
-					"editor.background": "#181818",
-					"menu.background": "#181818",
-					"menu.foreground": "#cccccc",
-					"menu.selectionBackground": "#2a2d2e",
-					"menu.selectionForeground": "#ffffff",
-					"menu.separatorBackground": "#454545",
-					"editorWidget.background": "#181818",
-					"editorWidget.border": "#454545",
-					"scrollbarSlider.background": "#78787859",
-					"scrollbarSlider.hoverBackground": "#7878788c",
-					"scrollbarSlider.activeBackground": "#7878788c",
-				},
-			});
-
-			monaco.editor.defineTheme("app-theme-light", {
-				base: "vs",
-				inherit: true,
-				rules: [...markdownTokenRules('light'), ...semanticTokenRules('light')],
-				colors: {
-					"editor.background": "#FDFDFD",
-					"menu.background": "#FDFDFD",
-					"menu.foreground": "#333333",
-					"menu.selectionBackground": "#eeeeee",
-					"menu.selectionForeground": "#000000",
-					"menu.separatorBackground": "#cccccc",
-					"editorWidget.background": "#FDFDFD",
-					"editorWidget.border": "#cccccc",
-					"scrollbarSlider.background": "#78787859",
-					"scrollbarSlider.hoverBackground": "#7878788c",
-					"scrollbarSlider.activeBackground": "#7878788c",
-				},
-			});
-		};
-
-		defineThemes();
-
-		// The active tab can change while the Monaco chunk is downloading (open a
-		// document in edit mode, then Ctrl+Tab before it lands). The effect that
-		// normally handles a tab switch bailed out on the missing editor, so
-		// re-read the id here: the view state saved on unmount has to be filed
-		// against the tab the editor is really showing, not the one that was
-		// active when this component was created.
-		currentTabId = tabManager.activeTabId;
-
-		const getTheme = () =>
-			monacoThemeName(
-				theme,
-				window.matchMedia("(prefers-color-scheme: dark)").matches,
-			);
-
-		// The editor is a VIEW; the document it shows is the active tab's model.
-		// Passing `model` rather than `value`/`language` also settles ownership:
-		// `StandaloneEditor` only sets `_ownsModel` when it had to build the
-		// model itself, and `_postDetachModelCleanup` disposes the model on
-		// `editor.dispose()` only when it owns it. So a model handed in here
-		// SURVIVES the editor — which is the point, because this component is
-		// unmounted every time the user switches a tab to reading mode.
-		//
-		// With no active tab there is nothing to key a model by, so the editor
-		// builds and owns a throwaway one, exactly as it did before. That state
-		// is not reachable from the markup (the pane renders under
-		// `tabManager.activeTab`); it is the honest fallback for the window
-		// between the Monaco chunk resolving and this function running.
-		const documentOptions = currentTabId
-			? { model: acquireTabModel(currentTabId, value, language) }
-			: { value, language };
-
-		editor = monaco.editor.create(container, {
-			...documentOptions,
-			theme: getTheme(),
-			dragAndDrop: true,
-			automaticLayout: true,
-			// Off by default, and `'configuredByTheme'` cannot turn it on here:
-			// `StandaloneTheme.semanticHighlighting` is hard-coded false, so the
-			// switch has to be explicit or the provider above is never asked.
-			'semanticHighlighting.enabled': true,
-			// The settings-derived options, shared with the updateOptions
-			// effect below. The real zoom, not 100: the view state, the
-			// anchor line and a pending sync are all placed before that
-			// effect runs, and a font size changed under them afterwards
-			// keeps the pixel offset, not the line (#799).
-			...editorOptionsFromSettings(settings, zoomLevel),
+		return mountEditor({
+			monaco,
+			container,
+			doc,
+			jumps,
+			tabs: tabManager,
+			settings,
+			value,
+			language,
+			theme: () => theme,
+			zoomLevel,
 			readOnly,
-			scrollBeyondLastLine: true,
-			wordBasedSuggestions: "off",
-			quickSuggestions: false,
-			// Monaco's Unicode highlighter is built for source code, where a
-			// character that looks like ASCII but is not is an attack vector. In
-			// prose it fires on the punctuation CJK authors type all day: `，`
-			// `！` `？` `（` `）` `；` `：` are all confusables of an ASCII
-			// counterpart, so Monaco outlines each one (#186, #94).
-			//
-			// It only fires when the confusable shares a word with basic ASCII —
-			// shouldHighlightNonBasicASCII() suppresses the box when the
-			// surrounding word is entirely non-ASCII — which is why pure CJK
-			// looks fine and `使用 Monaco，然后保存。` or `安装依赖（npm ci）` does
-			// not. Latin technical terms inside CJK prose are the normal case,
-			// and `**粗体**，` triggers it with no Latin word at all.
-			//
-			// invisibleCharacters stays on, but not for the reason first written
-			// here. That comment claimed it "never fires on something typed on
-			// purpose"; measured against this Monaco build, U+3000 IDEOGRAPHIC
-			// SPACE — the space bar under every CJK IME — is in the invisible
-			// set and gets outlined, which is the same complaint as #186/#94 one
-			// option over. The set is the flattened union of every locale bucket
-			// (`strings.js` getData()), 465 code points, so `allowedLocales`
-			// cannot exclude it; only `allowedCharacters` can.
-			//
-			// The rest stays on because the NBSP hazard is real: an NBSP after
-			// `-` stops a list from parsing. Worth recording that the other
-			// stated hazard does NOT hold — a zero-width space inside CJK text
-			// is not flagged at all, because shouldHighlightNonBasicASCII()
-			// suppresses it when the surrounding word has no basic ASCII.
-			//
-			// nonBasicASCII needs no setting — it defaults to
-			// `inUntrustedWorkspace` and standalone Monaco's workspace-trust
-			// service returns true unconditionally, so it is already off; were it
-			// on, every ideograph would be boxed rather than the punctuation.
-			unicodeHighlight: {
-				ambiguousCharacters: false,
-				allowedCharacters: { "　": true },
+			sharedCursor,
+			oncursor: (line, column) => oncursor?.(line, column),
+			keyHandlers: {
+				cutToClipboard,
+				pasteFromClipboard,
+				continueListOnEnter,
+				handleTabKey,
+				handleShiftTabKey,
+				handleModEnterKey,
+				handleModShiftEnterKey,
 			},
-			// Word-wise navigation — ⌥←/→, double-click-to-select, ⌥⌫ — splits on
-			// `wordSeparators`, and a language that does not put spaces between
-			// its words has none. So a whole Chinese clause counts as one word:
-			// ⌥→ jumps the sentence, double-click selects it, ⌥⌫ deletes it.
-			//
-			// A non-empty list switches on `Intl.Segmenter` (see
-			// `wordCharacterClassifier.js`), which knows where the words are.
-			//
-			// It is closer to a switch than to a whitelist, and the naming hides
-			// that: ICU dispatches its dictionary breaking by SCRIPT, not by this
-			// list. Thai, Khmer, Lao, Burmese and Tibetan get segmented too and
-			// none of them are named here, while `['zh']`, `['ja']` and
-			// `['zh','ja']` all produce identical output — even on Han text,
-			// where the two dictionaries might have been expected to disagree.
-			// Written as the two the app has locales for, rather than a longer
-			// list that would read as a claim about coverage it does not make.
-			//
-			// Nothing is taken from space-delimited languages: Korean,
-			// Vietnamese, Russian and English segment word-for-word identically
-			// to splitting on whitespace. An unsupported tag is dropped by
-			// Monaco's own `validate()`, so this cannot fail closed.
-			wordSegmenterLocales: ['zh', 'ja'],
-			// Markpad draws the editor's context menu itself, in
-			// MarkdownViewer.svelte, beside the one the preview already had.
-			//
-			// Not a style choice. Monaco's menu offers Cut, Copy and Paste, and
-			// its Paste cannot work here: it reads the clipboard through the
-			// webview, which wry leaves switched off and which Tauri has no
-			// answer for (tauri-apps/tauri#12007). Everything else Monaco would
-			// contribute to that menu — Go to Definition, Go to References,
-			// inlay hints — needs a language provider this app does not
-			// register, so nothing is lost by drawing our own.
-			contextmenu: false,
-			// Monaco writes a styled `text/html` flavour beside the plain text on a
-			// copy. Everything Markpad produces IS plain text, so pasting into Word
-			// or Outlook gave coloured monospace instead of the Markdown that was
-			// copied — the styled flavour has no audience here (#393).
-			//
-			// Still needed after cut/copy/paste were collapsed onto three functions
-			// of our own, which is easy to get wrong: those cover ⌘C and the context
-			// menu, and macOS has a third way in. Edit > Copy in the menu bar is a
-			// predefined Copy item (#527), which asks the webview to perform
-			// its own copy — Monaco's, not ours. Without this the menu bar would put
-			// a different clipboard on the pasteboard than the other two routes.
-			copyWithSyntaxHighlighting: false,
-			// The same argument one option over. U+2028 (LINE SEPARATOR) and
-			// U+2029 (PARAGRAPH SEPARATOR) break a JavaScript string literal,
-			// which is what Monaco's guard is for; in Markdown they are just
-			// characters, and they arrive by ordinary means — several word
-			// processors and PDF text extractors emit U+2028 for a soft line
-			// break, so pasting one in is normal here.
-			//
-			// The default is 'prompt', and in standalone Monaco that prompt is
-			// `StandaloneDialogService.doConfirm`, i.e. a bare
-			// `mainWindow.confirm()`: an unstyled browser dialog inside a Tauri
-			// window, carrying Monaco's English string in an app translated
-			// into 26 locales, offering to rewrite the user's bytes. 'auto'
-			// would rewrite them without asking, which is worse.
-			//
-			// 'off' loses no visibility: the line renderer substitutes U+FFFD
-			// for LINE_SEPARATOR and PARAGRAPH_SEPARATOR unconditionally, so
-			// they stay as visible as they ever were. Only the dialog goes.
-			unusualLineTerminators: "off",
-			padding: { top: 20 },
-			// The overview ruler sits under the vertical scrollbar, and its
-			// border drew a 1px line down the track's left edge.
-			overviewRulerBorder: false,
-			scrollbar: {
-				vertical: "visible",
-				horizontal: "visible",
-				useShadows: false,
-				verticalHasArrows: false,
-				horizontalHasArrows: false,
-				// Same track and thumb as the preview's ::-webkit-scrollbar in styles.css.
-				verticalScrollbarSize: 14,
-				horizontalScrollbarSize: 14,
-				verticalSliderSize: 8,
-				horizontalSliderSize: 8,
-			},
-		});
-
-		// Feeds the wrapping strategy in `editorOptionsFromSettings`. `fontInfo`
-		// changes with the font setting and when Monaco remeasures after a font
-		// finishes loading. Read before anything is placed, for the same
-		// reason as the zoom above: a proportional font rewraps every line.
-		fontIsMonospace = editor.getOption(monaco.editor.EditorOption.fontInfo).isMonospace;
-		if (!fontIsMonospace) applySettingsOptions();
-
-		if (tabManager.activeTab?.editorViewState) {
-			editor.restoreViewState(tabManager.activeTab.editorViewState);
-		} else if (tabManager.activeTab) {
-			let scrolled = false;
-			if (tabManager.activeTab.anchorLine > 0) {
-				// The anchor is a RENDERER line, whoever recorded it — this pane
-				// or the preview — and Monaco can only be aimed with a buffer
-				// line. The conversion is the whole point of the crossing: a tab
-				// last scrolled in the preview used to open here the height of
-				// its front matter too far up the document.
-				editor.revealLineNearTop(
-					editorTopLineForTabAnchor(lineCoordinates(value), tabManager.activeTab.anchorLine),
-					monaco.editor.ScrollType.Immediate,
-				);
-				scrolled = true;
-			}
-
-			if (!scrolled) {
-				const scrollHeight = editor.getScrollHeight();
-				const clientHeight = editor.getLayoutInfo().height;
-				if (scrollHeight > clientHeight) {
-					const targetScroll =
-						tabManager.activeTab.scrollPercentage *
-						(scrollHeight - clientHeight);
-					editor.setScrollTop(targetScroll);
-				}
-			}
-		}
-
-		const updateTheme = () => {
-			monaco.editor.setTheme(getTheme());
-		};
-
-		const mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
-		mediaQuery.addEventListener("change", updateTheme);
-
-		editor.focus();
-
-		// The one route from a keystroke to the document. `value` is a plain
-		// prop — it reads the active tab's `rawContent` and nothing here writes
-		// it back — so this call is not a second opinion about the buffer, it is
-		// the only opinion. It used to be a `bind:value` writing the field
-		// directly PLUS this call, and the tab only stayed dirty-tracked because
-		// Svelte's assignment happened to run first: deleting this line left the
-		// text on screen correct and the dirty flag, the auto-save trigger and
-		// the close prompt silently dead. Delete it now and the editor stops
-		// editing the document at all, which is a bug you can see.
-		//
-		// The guard is what stops the loop: the effect below pushes an external
-		// buffer replacement in with `setValue`, which fires this listener with
-		// text `value` already holds, and writing that back to the store would
-		// be a write the user did not make.
-		editor.onDidChangeModelContent(() => {
-			const newValue = editor.getValue();
-			emittedText = newValue;
-			if (value !== newValue && tabManager.activeTabId) {
-				tabManager.updateTabRawContent(tabManager.activeTabId, newValue);
-			}
-
-			syncStatusFromModel(true);
-		});
-
-		editor.onDidChangeCursorPosition((e) => {
-			cursorPosition = e.position;
-			oncursor?.(asBufferLine(e.position.lineNumber), e.position.column);
+			applySettingsOptions,
+			setEditor: (created) => (editor = created),
+			setFontIsMonospace: (monospace) => (fontIsMonospace = monospace),
+			setCursorPosition: (position) => (cursorPosition = position),
+			setSelectionCount: (count) => (selectionCount = count),
+			setCursorCount: (count) => (cursorCount = count),
+			setEditorReady: (ready) => (editorReady = ready),
 		});
-		// The view state above put the cursor back without an event, and a
-		// Ctrl+E into the editor wants the outline on it straight away.
-		if (sharedCursor) editor.setPosition({ lineNumber: sharedCursor.line, column: sharedCursor.column });
-		const mounted = editor.getPosition();
-		oncursor?.(asBufferLine(mounted?.lineNumber ?? 1), mounted?.column ?? 1);
-
-		editor.onDidChangeCursorSelection((e) => {
-			const selections = editor.getSelections() || [];
-			cursorCount = selections.length;
-			const model = editor.getModel();
-
-			if (model && selections.length > 0) {
-				selectionCount = selections.reduce(
-					(acc: number, selection: Monaco.Selection) => {
-						return acc + model.getValueInRange(selection).length;
-					},
-					0,
-				);
-			} else {
-				selectionCount = 0;
-			}
-		});
-
-		editor.onDidChangeConfiguration((e) => {
-			if (e.hasChanged(monaco.editor.EditorOption.fontInfo)) {
-				fontIsMonospace = editor.getOption(monaco.editor.EditorOption.fontInfo).isMonospace;
-			}
-		});
-
-		syncStatusFromModel();
-
-		const wheelListener = (e: WheelEvent) => {
-			if (e.ctrlKey || e.metaKey) {
-				e.preventDefault();
-				e.stopPropagation();
-				settings.zoomBy(wheelZoomFactor(e.deltaY));
-			}
-		};
-
-		container.addEventListener("wheel", wheelListener, { capture: true });
-
-		/**
-	 * This document's headings, from the Rust side that renders them.
-	 *
-	 * Cached on the model's version, which changes on every edit: a completion
-	 * fires per keystroke once the dropdown is open, and re-parsing a
-	 * 3,000-line document for each of them would be paid for nothing — the
-	 * headings cannot have moved between two keystrokes of the same edit.
-	 *
-	 * Asked of Rust rather than derived here: the ids come out of comrak's
-	 * anchorizer, and a second implementation in TypeScript would drift from
-	 * it silently, producing links that look right and land nowhere.
-	 *
-	 * Keyed on the model as well: each tab has its own, and version ids are
-	 * counted per model, so two tabs can stand at the same one.
-	 *
-	 * The block folds come with them, from the same parse: the folding provider
-	 * wants both for every version. The promise is what is cached, so the
-	 * folding and symbol providers asking at once share one call.
-	 */
-	type Outline = { anchors: HeadingAnchor[]; folds: Monaco.languages.FoldingRange[] };
-	let outlineCache: { model: Monaco.editor.ITextModel; version: number; outline: Promise<Outline> } | null = null;
-
-	function documentOutline(model: Monaco.editor.ITextModel): Promise<Outline> {
-		const version = model.getVersionId();
-		if (outlineCache?.model === model && outlineCache.version === version) return outlineCache.outline;
-
-		const markdown = model.getValue();
-		const outline = (
-			invoke("markdown_outline", {
-				markdown,
-				frontMatterLines: frontMatterFenceLines(markdown),
-			}) as Promise<Outline>
-		).catch(() => ({ anchors: [], folds: [] }));
-		outlineCache = { model, version, outline };
-		return outline;
-	}
-
-	async function headingAnchors(model: Monaco.editor.ITextModel): Promise<HeadingAnchor[]> {
-		return (await documentOutline(model)).anchors;
-	}
-
-	// The colours that come from the renderer rather than from the grammar's
-	// regexes (`utils/semanticTokens.ts`). Registered once per editor, beside the
-	// completion provider, and disposed with it.
-	const { provider: semanticTokensProvider } = createMarkdownSemanticTokensProvider(monaco);
-	const semanticTokens = monaco.languages.registerDocumentSemanticTokensProvider(
-		MARKDOWN_LANGUAGE_ID,
-		semanticTokensProvider,
-	);
-
-	// What sticky scroll pins (#759), from the same heading list link completion
-	// uses.
-	const documentSymbols = monaco.languages.registerDocumentSymbolProvider(MARKDOWN_LANGUAGE_ID, {
-		provideDocumentSymbols: async (model) => {
-			const lineCount = model.getLineCount();
-			return headingSymbols(await headingAnchors(model), lineCount, monaco.languages.SymbolKind.String);
-		},
-	});
-
-	// Headings, plus the list items, code blocks, quotes and tables that
-	// indentation folding covered: registering this turns that fallback off (#777).
-	const foldingRanges = monaco.languages.registerFoldingRangeProvider(MARKDOWN_LANGUAGE_ID, {
-		provideFoldingRanges: async (model) => {
-			const { anchors, folds } = await documentOutline(model);
-			return [...headingFoldRanges(anchors, model.getLineCount(), (n) => model.getLineContent(n)), ...folds];
-		},
-	});
-
-	const completionProvider = monaco.languages.registerCompletionItemProvider(
-			"markdown",
-			{
-				triggerCharacters: ["(", "/", "\\", '"', "#"],
-				provideCompletionItems: async (model, position) => {
-					const lineContent = model.getLineContent(position.lineNumber);
-					const prefix = lineContent.substring(0, position.column - 1);
-
-					// #200: this document's headings, as link targets. Asked
-					// first because `](#` is also the tail of the embed context
-					// below — once a `#` is typed the answer is headings, not
-					// files.
-					const headingContext = headingLinkContext(prefix);
-					if (headingContext) {
-						const anchors = await headingAnchors(model);
-						const range = new monaco.Range(
-							position.lineNumber,
-							headingQueryStart(prefix) + 1,
-							position.lineNumber,
-							position.column,
-						);
-
-						return {
-							suggestions: anchors.map((anchor, index) => ({
-								// Labelled by what it reads as, inserted as
-								// whatever that context needs. Monaco filters on
-								// the label, so typing "mermaid" finds
-								// "11. Mermaid Diagrams" and writes the slug.
-								label: anchor.text,
-								detail: `#${anchor.slug}`,
-								kind: monaco.languages.CompletionItemKind.Reference,
-								insertText:
-									headingContext === "slug" ? anchor.slug : anchor.text,
-								// Document order, not alphabetical: a heading's
-								// neighbours are what the writer is thinking in.
-								sortText: String(index).padStart(5, "0"),
-								range,
-							})),
-						};
-					}
-
-					const isEmbedContext = /(!?\[.*\]\(|<img.*src=["']|src=["'])$/.test(
-						prefix,
-					);
-					if (!isEmbedContext) return { suggestions: [] };
-
-					const tab = tabManager.activeTab;
-					if (!tab?.path) return { suggestions: [] };
-
-					const lastSlash = Math.max(
-						tab.path.lastIndexOf("\\"),
-						tab.path.lastIndexOf("/"),
-					);
-					const parentDir = tab.path.substring(0, lastSlash);
-					const imgDirName = resolveImageDirectory(
-						settings.imageDirectory,
-						tab.path,
-					);
-
-					try {
-						const [currentEntries, imgEntries] = await Promise.all([
-							invoke("list_directory_contents", { path: parentDir })
-								.then((r) => r as string[])
-								.catch(() => []),
-							invoke("list_directory_contents", { path: `${parentDir}/${imgDirName}` })
-								.then((r) => r as string[])
-								.catch(() => []),
-						]);
-
-						const word = model.getWordUntilPosition(position);
-						const range = new monaco.Range(
-							position.lineNumber,
-							word.startColumn,
-							position.lineNumber,
-							word.endColumn,
-						);
-
-						const suggestions: Monaco.languages.CompletionItem[] = [
-							...currentEntries.map((e) => ({
-								label: e,
-								kind: e.endsWith("/")
-									? monaco.languages.CompletionItemKind.Folder
-									: monaco.languages.CompletionItemKind.File,
-								insertText: e,
-								range,
-							})),
-							...imgEntries.map((e) => ({
-								label: `${imgDirName}/${e}`,
-								kind: e.endsWith("/")
-									? monaco.languages.CompletionItemKind.Folder
-									: monaco.languages.CompletionItemKind.File,
-								insertText: `${imgDirName}/${e}`,
-								range,
-							})),
-						];
-
-						return { suggestions };
-					} catch (err) {
-						return { suggestions: [] };
-					}
-				},
-			},
-		);
-
-		// ⌘X. Monaco leaves all three of these keys unbound in a browser
-		// ("Do not bind cut keybindings in the browser, since browsers do that
-		// for us" — clipboard.js), so the slots are free and binding them is
-		// what makes the keyboard and the context menu run the same code.
-		editor.addCommand(monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyX, cutToClipboard, "editorTextFocus");
-
-		// clipboard handling: Ctrl+C is a localized action (see
-		// `registerLocalizedActions`) so its label can follow the UI language;
-		// Ctrl+V is a plain command with no label, so it has nothing to
-		// re-register on a language change.
-		editor.addCommand(monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyV, pasteFromClipboard, "editorTextFocus");
-
-		// Enter, Tab and Shift+Tab inside a list item or a table (#604). Bare
-		// commands rather than actions for the same reason Ctrl+V is one: they
-		// carry no label and appear in no menu — they are what those three keys
-		// already mean, one Markdown rule further on. The shortcuts panel does
-		// list them (group `context` in utils/shortcuts.ts), because a behaviour
-		// nobody is told about is a behaviour nobody uses.
-		//
-		// ONE HANDLER PER KEY, dispatching inside. Tab is a table key, a list key
-		// and a Tab, in that order of specificity; two commands on one chord would
-		// leave which of them wins to Monaco's registration order.
-		//
-		// THE `when` CLAUSES ARE THE WHOLE RISK HERE.
-		//
-		// `addCommand` registers at weight 1000, above every Monaco default
-		// including the suggest widget's — so a binding with no condition does not
-		// merely add a meaning to Enter, it TAKES Enter away from whatever else
-		// wanted it. Each clause below names something that owns the key first:
-		//
-		//   editorTextFocus      the caret is in the text, not in the find box or
-		//                        the rename input (both of which take Enter);
-		//   !editorReadonly      reading mode types nothing;
-		//   !suggestWidgetVisible  the completion popup is open, where Enter
-		//                        accepts and Tab accepts — this app has a heading
-		//                        and a file-path completion provider, so it is a
-		//                        live case, not a hypothetical one;
-		//   !inSnippetMode       Tab jumps to the next placeholder;
-		//   !editorTabMovesFocus the accessibility toggle, whose entire purpose is
-		//                        that Tab leaves the editor.
-		//
-		// Neither handler is a dead end: when the caret is not on a list item they
-		// re-trigger the ordinary command, so a non-list Enter is a plain Enter and
-		// a non-list Tab is a plain Tab, auto-indent and all.
-		//
-		// VIM MODE NEEDS NO CLAUSE OF ITS OWN. monaco-vim listens on
-		// `editor.onKeyDown`, which fires on the textarea — inside the container
-		// the keybinding service listens on — and it calls `stopPropagation()` on
-		// every key its keymap claims. So in normal mode vim's Enter (move down a
-		// line) runs and this command never sees the key; in insert mode vim
-		// passes the key through and continuation happens, which is what a vim
-		// user writing a list wants. The order is DOM nesting, not luck.
-		const EDITING_KEY_CONTEXT =
-			"editorTextFocus && !editorReadonly && !suggestWidgetVisible && !inSnippetMode";
-		editor.addCommand(monaco.KeyCode.Enter, continueListOnEnter, EDITING_KEY_CONTEXT);
-		editor.addCommand(
-			monaco.KeyCode.Tab,
-			handleTabKey,
-			`${EDITING_KEY_CONTEXT} && !editorTabMovesFocus`,
-		);
-		editor.addCommand(
-			monaco.KeyMod.Shift | monaco.KeyCode.Tab,
-			handleShiftTabKey,
-			`${EDITING_KEY_CONTEXT} && !editorTabMovesFocus`,
-		);
-		// The same two keys Monaco binds to Insert Line Below / Above, which is why
-		// they need no guard of their own beyond the shared one: the only other
-		// claimants on Mod+Enter in the bundle are the find widget's Replace All and
-		// the references peek, and `editorTextFocus` is false in both.
-		editor.addCommand(
-			monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter,
-			handleModEnterKey,
-			EDITING_KEY_CONTEXT,
-		);
-		editor.addCommand(
-			monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Enter,
-			handleModShiftEnterKey,
-			EDITING_KEY_CONTEXT,
-		);
-
-		// AltGr on Windows arrives as Ctrl+Alt, and Monaco resolves a keystroke
-		// from Ctrl/Alt and the key code without looking at AltGraph, so Polish
-		// AltGr+Z matched Ctrl+Alt+Z and ż was never typed. The editor's own
-		// keydown fires before the keybinding service dispatches (see the vim
-		// note above), so this key is set in time for the Ctrl+Alt actions'
-		// `keybindingContext` to refuse it. `editor.spec.ts` shows both.
-		const altGraphChord = editor.createContextKey<boolean>("altGraphChord", false);
-		editor.onKeyDown((e) => altGraphChord.set(isAltGraphChord(e.browserEvent)));
-
-		editorReady = true;
-
-		// After the view-state / anchor-line restore above, deliberately: an
-		// explicit "edit this fragment" beats the position the tab was left at.
-		if (pendingSync) {
-			const position = pendingSync;
-			pendingSync = null;
-			syncScrollToPosition(position, { cursorIntoView: pendingCursorIntoView });
-		}
-		if (pendingReveal) {
-			const { startLine, endLine, placement } = pendingReveal;
-			pendingReveal = null;
-			revealSourceRange(startLine, endLine, placement);
-		}
-
-		return () => {
-			editorReady = false;
-			clearTimeout(wordCountTimer);
-			window.open = originalOpen;
-			mediaQuery.removeEventListener("change", updateTheme);
-			container.removeEventListener("wheel", wheelListener, { capture: true });
-			completionProvider.dispose();
-			semanticTokens.dispose();
-			documentSymbols.dispose();
-			foldingRanges.dispose();
-
-			if (editor && currentTabId) writeEditorPosition(currentTabId);
-
-			editor.dispose();
-		};
-	}
-
-	/**
-	 * Record on `tabId` where the editor is: the Monaco view state, and the two
-	 * position fields `editorReadingPosition` derives from one reading.
-	 *
-	 * Three layout reads (`getScrollHeight`, `getLayoutInfo`,
-	 * `getVisibleRanges`), so this belongs at moments and never on the hot path
-	 * — the teardown above is one such moment, `flushPositionTo` below is the
-	 * other, and there are no others.
-	 *
-	 * The caller has already established that `editor` is up and that `tabId` is
-	 * the tab it is holding.
-	 */
-	function writeEditorPosition(tabId: string) {
-		tabManager.updateTabEditorState(tabId, editor.saveViewState());
-
-		const ranges = editor.getVisibleRanges();
-		const model = editor.getModel();
-		const { scrollPercentage, anchorLine } = editorReadingPosition({
-			scrollTop: editor.getScrollTop(),
-			contentHeight: editor.getScrollHeight(),
-			viewportHeight: editor.getLayoutInfo().height,
-			topLine: ranges.length > 0 && model ? ranges[0].startLineNumber : null,
-			text: model?.getValue() ?? '',
-		});
-
-		if (scrollPercentage !== null) tabManager.updateTabScrollPercentage(tabId, scrollPercentage);
-		if (anchorLine !== null) tabManager.updateTabAnchorLine(tabId, anchorLine);
 	}
 
 	// Editing primitives used by the context-menu actions. They live at
 	// component scope, not inside `onMount`, because the actions that call them
 	// are torn down and rebuilt whenever the UI language changes.
 
-	const insertTextAtCursor = (text: string) => {
-		const selection = editor.getSelection();
-		if (!selection) return;
-		const op = { range: selection, text: text, forceMoveMarkers: true };
-		editor.pushUndoStop();
-		editor.executeEdits("my-source", [op]);
-	};
-
 	// Which markers each of these tools writes and which it accepts back lives in
 	// `utils/editorToolbar.ts`, beside the line-marker table and keyed by the same
 	// ids — so the button, the shortcut and the context-menu entry cannot disagree
@@ -1060,788 +338,71 @@
 		transformSelectedLines(id, (lines) => toggleLineMarker(id, lines));
 	};
 
-	/**
-	 * Enter on a list item writes the next item's marker; Enter on a block quote
-	 * writes the quote (#700); Enter on either with a marker and no text takes
-	 * the marker away instead, which is how the block ends — except on a nested
-	 * list item, where it takes one level away (#856). What the next line
-	 * should say is decided by `blockEnter` in utils/listEditing.ts, where it can
-	 * be tested without a browser.
-	 *
-	 * Only a single collapsed caret is claimed. A selection, or several carets,
-	 * gets the ordinary Enter: replacing a multi-cursor edit with one edit at
-	 * the primary selection would silently drop the others' work.
-	 */
-	const continueListOnEnter = () => {
-		// The key's ordinary meaning, re-sent. `type` with a newline is what the
-		// keyboard itself delivers, so auto-indent and the model's own EOL still
-		// apply — this handler is a detour, never a replacement.
-		const plainEnter = () => editor.trigger("keyboard", "type", { text: "\n" });
-		const caret = soleCaret();
-		if (!caret) return plainEnter();
-
-		const { model, line, column } = caret;
-		const next = blockEnter(model.getLineContent(line), column);
-		if (!next) return plainEnter();
-
-		// An empty item below the margin gives up one level, as Shift+Tab would
-		// (#856); only an item with no level left ends the list.
-		if (next.kind === "clear") {
-			const level = shiftListItem(model, line, column, true);
-			if (level) return applyLineEdit(level, "list-outdent");
-		}
-
-		// Its own undo step, so one Ctrl+Z gives back the marker this took away
-		// rather than unwinding the sentence typed before it.
-		editor.pushUndoStop();
-
-		if (next.kind === "clear") {
-			editor.executeEdits(
-				"list-continuation",
-				[{ range: new monaco.Range(line, 1, line, model.getLineMaxColumn(line)), text: next.line }],
-				[new monaco.Selection(line, next.line.length + 1, line, next.line.length + 1)],
-			);
-			return;
-		}
-
-		const after = next.text.length + 1;
-		editor.executeEdits(
-			"list-continuation",
-			[{ range: new monaco.Range(line, column, line, column), text: `${model.getEOL()}${next.text}` }],
-			[new monaco.Selection(line + 1, after, line + 1, after)],
-		);
-	};
-
-	/**
-	 * The single collapsed caret these keys claim, or null.
-	 *
-	 * A selection, or several carets, is handed back to the key's ordinary
-	 * meaning everywhere below: one edit at the primary selection would silently
-	 * drop what the other carets were about to do, and Monaco's own Tab already
-	 * indents every line of a multi-line selection.
-	 *
-	 * So is a caret inside a fenced code block. `1. a` or `|a|b|` there is code,
-	 * and renumbering or re-aligning it rewrites the code; Enter, Tab and the
-	 * table keys all ask here, so none of them can forget.
-	 */
-	const soleCaret = () => {
-		const model = editor.getModel();
-		const selections = editor.getSelections();
-		if (!model || selections?.length !== 1 || !selections[0].isEmpty()) return null;
-		const line = selections[0].startLineNumber;
-		if (isInFencedCode(model, line)) return null;
-		return { model, line, column: selections[0].startColumn };
-	};
-
-	/**
-	 * Replace a run of lines with what a Markdown edit says they should be, and
-	 * put the caret where it says. Every table operation ends here, because every
-	 * one of them changes a column's width and therefore has to redraw the pipes;
-	 * so does every list level change (#711), which renumbers the items the moved
-	 * one left behind and is therefore a run of lines rather than one line.
-	 *
-	 * An edit that changes nothing but the caret — Shift+Tab in the first cell of
-	 * an already-aligned table — moves the caret WITHOUT an edit, so it does not
-	 * push an undo step that undoes nothing.
-	 */
-	const applyLineEdit = (edit: TableEdit | ListEdit, source: string) => {
-		const model = editor.getModel();
-		if (!model) return;
-
-		const range = new monaco.Range(
-			edit.startLine,
-			1,
-			edit.endLine,
-			model.getLineMaxColumn(edit.endLine),
-		);
-		const text = edit.lines.join(model.getEOL());
-		const caret = new monaco.Selection(
-			edit.caretLine,
-			edit.caretColumn,
-			edit.caretLine,
-			edit.caretColumn,
-		);
-
-		if (model.getValueInRange(range) === text) {
-			editor.setSelection(caret);
-			return;
-		}
-		editor.pushUndoStop();
-		editor.executeEdits(source, [{ range, text }], [caret]);
-	};
-
-	/** Tab / Shift+Tab inside a table. False when the caret is not in one. */
-	const stepTableCell = (back: boolean) => {
-		const caret = soleCaret();
-		if (!caret) return false;
-		const step = tableStep(caret.model, caret.line, caret.column, back);
-		if (!step) return false;
-		applyLineEdit(step, "table-step");
-		return true;
-	};
-
-	/**
-	 * The row and column commands, which are the same edit one level up. False
-	 * when the caret is not in a table, or when the table refuses the edit — which
-	 * is what lets the two Enter keys hand themselves back to Monaco.
-	 */
-	const editTable = (operation: TableOperation) => {
-		const caret = soleCaret();
-		if (!caret) return false;
-		const edit = tableOperation(caret.model, caret.line, caret.column, operation);
-		if (!edit) return false;
-		applyLineEdit(edit, `table-${operation}`);
-		return true;
-	};
-
-	/**
-	 * Tab / Shift+Tab on a list item: the level, decided by `shiftListItem` in
-	 * utils/listEditing.ts, where it can be tested without a browser.
-	 *
-	 * A LIST ITEM'S TAB NEVER FALLS THROUGH, not even when the edit is refused.
-	 * On a list item this key means the level and only the level, and the two
-	 * refusals are both "there is no other level": Tab on the first item of a
-	 * list, which has nothing to nest under, and Shift+Tab on an item already at
-	 * the margin. Handing those to `indentLines` or `outdent` would move the line
-	 * by `tabSize` into a column that nests under nothing — which is half of
-	 * #711 — so the key does nothing instead, as it does in every outliner.
-	 */
-	const shiftListLevel = (back: boolean) => {
-		const caret = soleCaret();
-		if (!caret || !parseListItem(caret.model.getLineContent(caret.line))) return false;
-		const edit = shiftListItem(caret.model, caret.line, caret.column, back);
-		if (edit) applyLineEdit(edit, back ? "list-outdent" : "list-indent");
-		return true;
-	};
-
-	/** Tab: the next cell of a table, else a list item's nesting level, else a Tab. */
-	const handleTabKey = () => {
-		if (stepTableCell(false)) return;
-		if (shiftListLevel(false)) return;
-		editor.trigger("keyboard", "tab", null);
-	};
+	// Enter, Tab, Shift+Tab and the two Mod+Enter keys: utils/editorKeyHandlers.ts.
+	const keyHandlers = () => editorKeyHandlers(editor, monaco);
+	const continueListOnEnter = () => keyHandlers().continueListOnEnter();
+	const editTable = (operation: TableOperation) => keyHandlers().editTable(operation);
+	const handleTabKey = () => keyHandlers().handleTabKey();
+	const handleShiftTabKey = () => keyHandlers().handleShiftTabKey();
+	const handleModEnterKey = () => keyHandlers().handleModEnterKey();
+	const handleModShiftEnterKey = () => keyHandlers().handleModShiftEnterKey();
 
-	/**
-	 * Shift+Tab: the previous cell of a table, else a list item's level, else
-	 * Monaco's own `outdent`.
-	 *
-	 * IT USED TO BE A PURE FALL-THROUGH, and the reason it no longer is, is #711.
-	 * `outdent` takes `tabSize` columns off the line wherever the caret sits on
-	 * it, which was close enough to right while nothing renumbered — but a level
-	 * is not a `tabSize`, and an item that leaves a sub-list has to take the
-	 * number of the list it rejoins. Both are `shiftListItem`'s, in the same
-	 * function as Tab's, because they are the same edit with the sign flipped.
-	 *
-	 * `outdent` remains what the chord means on every line that is not a list
-	 * item, which is what the third line preserves.
-	 */
-	const handleShiftTabKey = () => {
-		if (stepTableCell(true)) return;
-		if (shiftListLevel(true)) return;
-		editor.trigger("keyboard", "outdent", null);
-	};
+	// utils/editorEdits.ts.
+	const wrapAsCodeBlock = () => editorEdits.wrapAsCodeBlock(editor);
+	const insertLink = () => editorEdits.insertLink(editor);
 
 	/**
-	 * Mod+Enter: a row below in a table, else Monaco's own "Insert Line Below".
-	 *
-	 * THE KEY IS NOT BEING TAKEN, IT IS BEING SPECIALISED. Monaco already binds
-	 * `Mod+Enter` to `editor.action.insertLineAfter` and `Mod+Shift+Enter` to
-	 * `insertLineBefore`, and inside a table "the line below" IS "the row below" —
-	 * so these two handlers are the same shape as Shift+Tab's above: take the key,
-	 * and hand it straight back everywhere the table branch declines.
-	 *
-	 * The rows used to be on `Mod+K R`, and a two-key chord for the commonest edit
-	 * a table gets is a chord nobody presses. Columns keep theirs: they are rarer,
-	 * and no unmodified key means "insert a column" in any editor.
+	 * Every action whose label comes from `t()`, rebuilt when the UI language
+	 * changes: utils/editorLocalizedActions.svelte.ts. Actions with no
+	 * user-visible label (the Ctrl+V command) stay in `onMount`.
 	 */
-	const handleModEnterKey = () => {
-		if (editTable("insert-row")) return;
-		editor.trigger("keyboard", "editor.action.insertLineAfter", null);
-	};
-
-	/** Mod+Shift+Enter: a row above in a table, else "Insert Line Above". */
-	const handleModShiftEnterKey = () => {
-		if (editTable("insert-row-above")) return;
-		editor.trigger("keyboard", "editor.action.insertLineBefore", null);
-	};
+	const disposeLocalizedActions = localizedEditorActions({
+		language: () => settings.language,
+		ready: () => editorReady,
+		editor: () => editor,
+		descriptors: (lang) => editorActions(
+			{
+				monaco,
+				isMac: isMacPlatform(),
+				settings,
+				oncommand: (command) => oncommand?.(command),
+				copyToClipboard,
+				toggleInlineWrapTool,
+				toggleTagFormat,
+				toggleLineMarkerTool,
+				wrapAsCodeBlock,
+				insertLink,
+				insertSimpleTable,
+				editTable,
+			},
+			lang,
+		),
+	});
 
-	const wrapAsCodeBlock = () => {
+	const insertSimpleTable = () => {
 		const selection = editor.getSelection();
-		const model = editor.getModel();
-		if (!selection || !model) return;
-
-		const text = model.getValueInRange(selection);
-		const block = text.startsWith("```\n") && text.endsWith("\n```")
-			? text.slice(4, -4).replace(/\n$/, "")
-			: `\`\`\`\n${text}\n\`\`\``;
-		editor.pushUndoStop();
-		editor.executeEdits("fmt-code-block", [
-			{ range: selection, text: block, forceMoveMarkers: true },
-		]);
-	};
+		if (!selection) return;
 
-	const insertLink = () => {
-		const selection = editor.getSelection();
-		const model = editor.getModel();
-		if (!selection || !model) return;
+		const cols = 3;
+		const rows = 2;
+		let table = "\n";
+		table += "| " + Array(cols).fill("Header").join(" | ") + " |\n";
+		table += "| " + Array(cols).fill("---").join(" | ") + " |\n";
+		for (let i = 0; i < rows; i++) {
+			table += "| " + Array(cols).fill("Cell").join(" | ") + " |\n";
+		}
+		table += "\n";
 
-		const text = model.getValueInRange(selection);
-		const label = text || "link text";
-		const link = `[${label}](url)`;
 		editor.pushUndoStop();
-		editor.executeEdits("fmt-link", [
-			{ range: selection, text: link, forceMoveMarkers: true },
+		editor.executeEdits("insert-table", [
+			{
+				range: selection,
+				text: table,
+				forceMoveMarkers: true,
+			},
 		]);
 	};
 
-	/**
-	 * Pasting a URL only turns into `[label](url)` where markdown links mean
-	 * something. Inside a fenced or indented code block, inside inline code, or
-	 * inside YAML front matter, the user wants the bare URL they copied.
-	 *
-	 * The decision is taken once per paste, from the primary selection: a paste
-	 * is a single user action, and re-tokenizing for every cursor of a large
-	 * multi-cursor selection would cost far more than the edge case is worth.
-	 */
-	function isLinkifyPasteTarget(
-		model: Monaco.editor.ITextModel,
-		selection: Monaco.Selection,
-	): boolean {
-		return shouldLinkifyPastedUrl({
-			languageId: model.getLanguageId(),
-			content: model.getValue(),
-			linesUpToCaret: model.getLinesContent().slice(0, selection.startLineNumber),
-			column: selection.startColumn,
-			tokenize: (text) => monaco.editor.tokenize(text, MARKDOWN_LANGUAGE_ID),
-		});
-	}
-
-	function disposeLocalizedActions() {
-		for (const action of localizedActions) action.dispose();
-		localizedActions = [];
-	}
-
-	/**
-	 * Every action whose label comes from `t()` is registered here, so the whole
-	 * set can be rebuilt in one place when the UI language changes. Actions with
-	 * no user-visible label (the Ctrl+V command) stay in `onMount`.
-	 */
-	function registerLocalizedActions(lang: LanguageCode) {
-		// Belt and braces: Svelte runs the effect cleanup before a re-run, but
-		// re-registering an id without disposing the old action would leave a
-		// duplicate entry in the context menu, so never assume it happened.
-		disposeLocalizedActions();
-
-		// macOS reserves Cmd+Tab for the system application switcher, so a
-		// CtrlCmd-based binding never reaches the editor there. VS Code binds the
-		// real Ctrl key (KeyMod.WinCtrl) on macOS for its own Tab cycling.
-		const tabCycleModifier = isMacPlatform()
-			? monaco.KeyMod.WinCtrl
-			: monaco.KeyMod.CtrlCmd;
-
-		localizedActions = [
-			// ⌘C. Keeps its label so the command palette can show it
-			// translated; the work itself is the shared function.
-			editor.addAction({
-				id: "custom-copy",
-				label: t('menu.copy', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyC],
-				keybindingContext: "editorTextFocus",
-				run: copyToClipboard,
-			}),
-
-			editor.addAction({
-				id: "toggle-minimap",
-				label: t('settings.minimap', lang),
-				run: () => {
-					settings.minimap = !settings.minimap;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-word-wrap",
-				label: t('settings.wordWrap', lang),
-				run: () => {
-					settings.toggleWordWrap();
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-line-numbers",
-				label: t('settings.lineNumbers', lang),
-				run: () => {
-					settings.toggleLineNumbers();
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-vim-mode",
-				label: t('settings.vimMode', lang),
-				run: () => {
-					settings.vimMode = !settings.vimMode;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-status-bar",
-				label: t('settings.statusBar', lang),
-				run: () => {
-					settings.statusBar = !settings.statusBar;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-word-count",
-				label: t('settings.wordCount', lang),
-				run: () => {
-					settings.wordCount = !settings.wordCount;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-line-highlight",
-				label: t('settings.lineHighlight', lang),
-				run: () => {
-					settings.toggleLineHighlight();
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-occurrences-highlight",
-				label: t('settings.occurrencesHighlight', lang),
-				run: () => {
-					settings.occurrencesHighlight = !settings.occurrencesHighlight;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-whitespace",
-				label: t('settings.showWhitespace', lang),
-				run: () => {
-					settings.showWhitespace = !settings.showWhitespace;
-				},
-			}),
-
-			editor.addAction({
-				id: "toggle-tabs",
-				label: t('settings.showTabs', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyB,
-				],
-				run: () => oncommand?.("toggle-tabs"),
-			}),
-
-			editor.addAction({
-				id: "toggle-zen-mode",
-				label: t('settings.zenMode', lang),
-				// THE THIRD ADDRESS THIS COMMAND HAS HAD, and the first two are why
-				// the note is this long. It was Ctrl/Cmd+Shift+Z, which is REDO — on
-				// macOS redo's ONLY key, because Monaco's mac override replaces the
-				// default rule rather than adding to it, so Cmd+Y (the escape hatch
-				// Windows and Linux keep) does not exist there. `addAction` registers
-				// at weight 1000, so zen mode did not share that key, it took it, and
-				// a mac user had no way to redo from the keyboard at all.
-				//
-				// Then Ctrl/Cmd+Shift+D, which was free — but the Ctrl/Cmd+Shift row
-				// is where the formatting verbs live (B, E, F, X and now the digits),
-				// and a view mode is not one of them. Ctrl/Cmd+Alt+Z is unclaimed in
-				// Monaco on all three platforms, Z is for zen, and it sits with the
-				// other Alt-modified commands rather than among the formatters.
-				// `editor.checks.spec.ts` reads Monaco's real keymap and is
-				// what refuses the next such landing.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Alt | monaco.KeyCode.KeyZ,
-				],
-				keybindingContext: "!altGraphChord",
-				run: () => oncommand?.("toggle-zen-mode"),
-			}),
-
-			editor.addAction({
-				id: "fmt-bold",
-				label: t('menu.bold', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyB],
-				run: () => toggleInlineWrapTool("fmt-bold"),
-			}),
-
-			editor.addAction({
-				id: "fmt-italic",
-				label: t('menu.italic', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyI],
-				run: () => toggleInlineWrapTool("fmt-italic"),
-			}),
-
-			editor.addAction({
-				id: "fmt-underline",
-				label: t('menu.underline', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyU],
-				run: () => toggleTagFormat("<u>|</u>"),
-			}),
-
-			editor.addAction({
-				id: "fmt-strikethrough",
-				label: t('menu.strikethrough', lang),
-				// GitHub's chord. editor.checks.spec.ts checks Monaco binds
-				// nothing on it.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyX,
-				],
-				run: () => toggleInlineWrapTool("fmt-strikethrough"),
-			}),
-
-			// The six bindings below were chosen against the whole keymap, not
-			// against VS Code's: standalone Monaco and VS Code do not ship the
-			// same defaults, and the chords the mainstream Markdown editors use
-			// for these actions are the ones Monaco is most likely to be sitting
-			// on. `addAction` registers at weight 1000, above every Monaco
-			// default, so a clash is silent — our action simply wins and the
-			// Monaco command loses its key. The reasoning per binding is below,
-			// and `shortcuts.checks.test.ts` is what stops the next one from
-			// landing on an occupied chord.
-
-			editor.addAction({
-				id: "fmt-inline-code",
-				label: t('menu.inlineCode', lang),
-				// GitHub's Markdown editor binds inline code to Ctrl/Cmd+E, but
-				// plain Ctrl/Cmd+E is already `view-toggle-edit` here — which is
-				// itself the mainstream reading (Obsidian and Mark Text both use
-				// it for edit/read). So: same letter, plus Shift. Typora's
-				// Ctrl+Shift+` and Mark Text's Ctrl+` are rejected on purpose —
-				// #121 is *about* the backtick being a dead key on QWERTZ.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyE,
-				],
-				run: () => toggleInlineWrapTool("fmt-inline-code"),
-			}),
-
-			editor.addAction({
-				id: "fmt-code-block",
-				label: t('menu.codeBlock', lang),
-				// No mainstream chord survives contact with Monaco. Typora and
-				// Mark Text both use Ctrl+Shift+K on Windows/Linux, which is
-				// `editor.action.deleteLines` on BOTH platforms, and both switch
-				// to Cmd+Option+C on macOS, which is `toggleFindCaseSensitive`.
-				// F is for the fences ("Code Fences" is Typora's own name for
-				// the command); it is free everywhere.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyF,
-				],
-				run: () => wrapAsCodeBlock(),
-			}),
-
-			editor.addAction({
-				id: "fmt-quote",
-				label: t('menu.quote', lang),
-				// GitHub's documented blockquote chord, and the only one that is
-				// the same on both platforms in any editor surveyed: Shift+. is
-				// `>` on a US layout, the blockquote marker itself. Typora and
-				// Mark Text use Ctrl+Shift+Q, which macOS cannot deliver —
-				// Shift+Cmd+Q is the system Log Out — which is why both of them
-				// fall back to Cmd+Option+Q there.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Period,
-				],
-				run: () => toggleLineMarkerTool("fmt-quote"),
-			}),
-
-			// Typora binds Ctrl/Cmd+1..6 and Mark Text binds Cmd+1..6; Markpad
-			// has only three heading actions, so it binds three. 4, 5 and 6 are
-			// left unbound rather than given to something else, so completing
-			// the range later moves nothing.
-			editor.addAction({
-				id: "fmt-heading-1",
-				label: t('menu.heading1', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit1],
-				run: () => toggleLineMarkerTool("fmt-heading-1"),
-			}),
-
-			editor.addAction({
-				id: "fmt-heading-2",
-				label: t('menu.heading2', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit2],
-				run: () => toggleLineMarkerTool("fmt-heading-2"),
-			}),
-
-			editor.addAction({
-				id: "fmt-heading-3",
-				label: t('menu.heading3', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit3],
-				run: () => toggleLineMarkerTool("fmt-heading-3"),
-			}),
-
-			// The three list buttons, which had actions and no keys at all.
-			// Ctrl/Cmd+Shift+7 and +8 are GitHub's documented chords, the same on
-			// both its platforms, and Monaco leaves the whole Ctrl/Cmd+Shift digit
-			// row alone except for `1` (replaceOne). Numbered is 7 and bulleted is
-			// 8 because that is the way round GitHub has them.
-			editor.addAction({
-				id: "fmt-bullet-list",
-				label: t('menu.bulletList', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit8,
-				],
-				run: () => toggleLineMarkerTool("fmt-bullet-list"),
-			}),
-
-			editor.addAction({
-				id: "fmt-numbered-list",
-				label: t('menu.numberedList', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit7,
-				],
-				run: () => toggleLineMarkerTool("fmt-numbered-list"),
-			}),
-
-			// 9 HAS NO PRECEDENT, and this says so rather than implying one:
-			// GitHub documents no task-list chord, nor do Typora and Obsidian, and
-			// the two editors that do bind one disagree and are both occupied here
-			// (Bear's Cmd+T is New File; iA Writer's Opt+Cmd+L is Monaco's
-			// `toggleFindInSelection` on macOS). So the third list button takes the
-			// digit next to the two above it.
-			editor.addAction({
-				id: "fmt-checklist",
-				label: t('menu.checklist', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit9,
-				],
-				run: () => toggleLineMarkerTool("fmt-checklist"),
-			}),
-
-			editor.addAction({
-				id: "fmt-link",
-				label: t('menu.link', lang),
-				// ⌘K / Ctrl+K. Typora, Bear, iA Writer and GitHub all document this
-				// for Insert Link — the only command in the survey where four
-				// independent sources agree exactly — and the button had no key at
-				// all.
-				//
-				// Monaco binds no COMPLETE keybinding on Ctrl/Cmd+K; what it binds is
-				// 31 chord SEQUENCES behind it. Claiming the key as a whole chord
-				// ends that namespace, which is deliberate and argued in
-				// editor.checks.spec.ts rather than here, because the loss is
-				// keymap-wide rather than one command's.
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyK],
-				run: () => insertLink(),
-			}),
-
-			editor.addAction({
-				id: "insert-table-simple",
-				label: t('menu.insertTable', lang),
-				// ONE STROKE, not a sequence. This was `Mod+K T` (in both its
-				// released and modifier-held forms, the way VS Code registers its own
-				// Mod+K chords); Mod+K is Insert Link now, and a two-key gesture was
-				// awkward enough to press that it is what started this rework.
-				// Ctrl+Alt+T / ⌥⌘T is Typora's and Bear's chord for the same command,
-				// and Monaco binds nothing on it on any of the three platforms.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Alt | monaco.KeyCode.KeyT,
-				],
-				keybindingContext: "!altGraphChord",
-				run: () => {
-					const selection = editor.getSelection();
-					if (!selection) return;
-
-					const cols = 3;
-					const rows = 2;
-					let table = "\n";
-					table += "| " + Array(cols).fill("Header").join(" | ") + " |\n";
-					table += "| " + Array(cols).fill("---").join(" | ") + " |\n";
-					for (let i = 0; i < rows; i++) {
-						table += "| " + Array(cols).fill("Cell").join(" | ") + " |\n";
-					}
-					table += "\n";
-
-					editor.pushUndoStop();
-					editor.executeEdits("insert-table", [
-						{
-							range: selection,
-							text: table,
-							forceMoveMarkers: true,
-						},
-					]);
-				},
-			}),
-
-			// The rest of the table verbs. Actions rather than bare commands, so the
-			// command palette and the shortcuts panel can list them. Which verbs get
-			// a chord: TABLE_VERBS_WITHOUT_A_CHORD in shortcuts.test.ts.
-			editor.addAction({
-				id: "table-insert-row",
-				label: t('menu.insertTableRow', lang),
-				run: () => {
-					editTable("insert-row");
-				},
-			}),
-
-			editor.addAction({
-				id: "table-delete-row",
-				label: t('menu.deleteTableRow', lang),
-				run: () => {
-					editTable("delete-row");
-				},
-			}),
-
-			editor.addAction({
-				id: "table-insert-column",
-				label: t('menu.insertTableColumn', lang),
-				// C for Column, and one of the "insert a structure" family: it sits
-				// with Ctrl/Cmd+Shift+7, +8 and +9, which insert the three list
-				// kinds. Monaco binds nothing on Ctrl/Cmd+Shift+C on any of the three
-				// platforms, as a whole chord or as a prefix.
-				//
-				// It was on `Mod+K C`, which cannot be typed any more: `Mod+K` is
-				// Insert Link and is no longer a prefix. `Mod+Alt+C` was the obvious
-				// replacement and had to be refused — see the note above
-				// DELIBERATE_OVERRIDES in editor.checks.spec.ts. Palette-only
-				// was tried first and is too weak for a verb people reach for while
-				// building a table: Mod+P, type the name, Enter.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyC,
-				],
-				run: () => {
-					editTable("insert-column");
-				},
-			}),
-
-			editor.addAction({
-				id: "table-delete-column",
-				label: t('menu.deleteTableColumn', lang),
-				// Backspace, not D: D sits next to Insert Column's C, and one slip
-				// would delete a column. Monaco binds nothing on this chord.
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Backspace,
-				],
-				run: () => {
-					editTable("delete-column");
-				},
-			}),
-
-			editor.addAction({
-				id: "file-new",
-				label: t('menu.newFile', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyN,
-					monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyT,
-				],
-				run: () => oncommand?.("new-file"),
-			}),
-
-			editor.addAction({
-				id: "file-open",
-				label: t('menu.openFile', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyO],
-				run: () => oncommand?.("open-file"),
-			}),
-
-			editor.addAction({
-				id: "file-save",
-				label: t('menu.save', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyS],
-				run: () => oncommand?.("save"),
-			}),
-
-			editor.addAction({
-				id: "file-close",
-				label: t('menu.closeFile', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyW],
-				run: () => oncommand?.("close-file"),
-			}),
-
-			editor.addAction({
-				id: "app-home",
-				label: t('menu.home', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyH,
-				],
-				run: () => oncommand?.("toggle-home"),
-			}),
-
-			editor.addAction({
-				id: "file-reveal",
-				label: t('menu.openFileLocation', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyR,
-				],
-				run: () => oncommand?.("reveal-file"),
-			}),
-
-			editor.addAction({
-				id: "file-export-pdf",
-				label: t('menu.exportPdf', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyP,
-				],
-				run: () => oncommand?.("export-pdf"),
-			}),
-
-			editor.addAction({
-				id: "view-toggle-edit",
-				label: t('menu.editMode', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyE],
-				run: () => oncommand?.("toggle-edit-view"),
-			}),
-
-			editor.addAction({
-				id: "view-toggle-live",
-				label: t('menu.autoReload', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyL],
-				run: () => oncommand?.("toggle-live-mode"),
-			}),
-
-			editor.addAction({
-				id: "view-toggle-split",
-				label: t('menu.toggleSplitView', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyCode.Backslash,
-					monaco.KeyMod.CtrlCmd | monaco.KeyCode.IntlBackslash,
-				],
-				run: () => oncommand?.("toggle-split-view"),
-			}),
-
-			editor.addAction({
-				id: "tab-next",
-				label: t('menu.nextTab', lang),
-				keybindings: [tabCycleModifier | monaco.KeyCode.Tab],
-				run: () => oncommand?.("next-tab"),
-			}),
-
-			editor.addAction({
-				id: "tab-prev",
-				label: t('menu.previousTab', lang),
-				keybindings: [
-					tabCycleModifier | monaco.KeyMod.Shift | monaco.KeyCode.Tab,
-				],
-				run: () => oncommand?.("previous-tab"),
-			}),
-
-			editor.addAction({
-				id: "tab-undo-close",
-				label: t('menu.undoCloseTab', lang),
-				keybindings: [
-					monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyT,
-				],
-				run: () => oncommand?.("undo-close-tab"),
-			}),
-
-			editor.addAction({
-				id: "app-command-palette",
-				label: t('menu.commandPalette', lang),
-				keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyP],
-				run: (ed) => {
-					ed.trigger("keyboard", "editor.action.quickCommand", {});
-				},
-			}),
-
-		];
-	}
-
-	$effect(() => {
-		const lang = settings.language;
-		if (!editorReady) return;
-
-		registerLocalizedActions(lang);
-		return disposeLocalizedActions;
-	});
-
 	onDestroy(disposeLocalizedActions);
 
 	function getEditorContentScrollMax() {
@@ -1851,28 +412,7 @@
 		return Math.max(0, editor.getContentHeight() - layout.height);
 	}
 
-	let frontMatterOffsetCache: { model: Monaco.editor.ITextModel; version: number; offset: number } | null = null;
-
-	function getEditorFrontMatterScrollEnd() {
-		if (!editor) return 0;
-
-		const model = editor.getModel();
-		if (!model) return 0;
-
-		// The preview's rule, not a second one: a leading `---` block that is not
-		// a YAML mapping is body there, and the two panes must agree on where the
-		// front matter ends or every position above it syncs to the top. Cached on
-		// the model's version because this runs on every scroll event.
-		const version = model.getVersionId();
-		if (frontMatterOffsetCache?.model !== model || frontMatterOffsetCache.version !== version) {
-			frontMatterOffsetCache = { model, version, offset: frontMatterLineOffset(model.getValue()) };
-		}
-		const bodyStartLine = frontMatterOffsetCache.offset + 1;
-		if (bodyStartLine <= 1) return 0;
-
-		const safeBodyStartLine = Math.max(1, Math.min(model.getLineCount(), bodyStartLine));
-		return Math.max(0, Math.min(getEditorContentScrollMax(), editor.getTopForLineNumber(safeBodyStartLine)));
-	}
+	const getEditorFrontMatterScrollEnd = editorFrontMatterScrollEnd(() => editor, getEditorContentScrollMax);
 
 	// Monaco's own line -> pixel measurement, which already accounts for folded
 	// regions, wrapped lines and view zones. `getLineAtVerticalOffset` inverts it
@@ -1911,256 +451,24 @@
 		return Number.isFinite(line) ? { ...position, line } : position;
 	}
 
-	/**
-	 * Cut, copy and paste — one implementation each, reached from the keyboard
-	 * and from the context menu alike.
-	 *
-	 * All three go through Rust (`arboard`) rather than through the webview's
-	 * `navigator.clipboard`, which is the only thing that works everywhere:
-	 * wry leaves the webview's clipboard permission off by default, and turning
-	 * it on does not help — tauri-apps/tauri#12007 is open on exactly this, and
-	 * the official answer is the clipboard plugin, which is the same Rust route
-	 * Markpad already had for ⌘V. Verified by hand on Windows: with the wry
-	 * permission enabled, the webview's own paste still does nothing.
-	 *
-	 * Six entry points, three functions. Before this there were six
-	 * implementations: ⌘X was the browser's, ⌘C and ⌘V were ours, and the three
-	 * menu items were Monaco's — of which Paste could not work in a webview at
-	 * all (#207) and Cut and Copy are dead on Linux, where the same wry default
-	 * gates `set_javascript_can_access_clipboard`.
-	 */
-	function clipboardTextForSelection(): { text: string; range: Monaco.Range | null } {
-		const selection = editor?.getSelection();
-		const model = editor?.getModel();
-		if (!selection || !model) return { text: '', range: null };
-
-		if (!selection.isEmpty()) {
-			return { text: model.getValueInRange(selection), range: selection };
-		}
-
-		// Nothing selected copies the whole line, line ending included —
-		// Monaco's `emptySelectionClipboard` default, and VS Code's and Sublime
-		// Text's. Kept because it is what this editor has always done; whether
-		// an app that calls itself the Notepad equivalent should do it at all
-		// is a separate question (#393).
-		const line = selection.startLineNumber;
-		const lastLine = model.getLineCount();
-		return {
-			text: model.getLineContent(line) + model.getEOL(),
-			// Cutting that line has to take its line ending with it, so the
-			// range runs to the start of the next one. The last line has no
-			// next, and the range stops at its end.
-			range:
-				line < lastLine
-					? new monaco.Range(line, 1, line + 1, 1)
-					: new monaco.Range(line, 1, line, model.getLineMaxColumn(line)),
-		};
-	}
-
-	export async function pasteFromClipboard() {
-		// Focus first, as `runEditorAction` does, and for the same reason: this
-		// runs from the context menu as well as from ⌘V, and a menu item leaves
-		// the focus on itself. Paste then inserted the text and left no caret —
-		// no blink, and the next ⌘Z went nowhere, which reads as "undo is
-		// broken" rather than "the editor is not focused".
-		//
-		// A no-op on the ⌘V path, where the editor is focused by definition.
-		editor?.focus();
-			try {
-				// The image is written before it is linked, and the reader can
-				// switch tabs while it is: the link then belongs to no other model.
-				const pasteModel = editor.getModel();
-				const tabPath = tabManager.activeTab?.path;
-				const parentDir = tabPath ? documentParentDir(tabPath) : null;
-				if (tabPath && parentDir !== null) {
-					const imgDirName = resolveImageDirectory(
-						settings.imageDirectory,
-						tabPath,
-					);
-					const embeds: string[] = [];
-
-					// A file copied in Explorer or Finder is a path on the clipboard,
-					// not pixels (#768). Read it first and copy it as a drop does, so
-					// it keeps its own name and bytes rather than whatever preview the
-					// file manager put beside it.
-					const files = await invoke("clipboard_read_file_list").catch(() => null) as string[] | null;
-					for (const srcPath of files ?? []) {
-						if (routeDroppedFile(srcPath, "editor") !== "insert") continue;
-						const relPath = (await invoke("copy_file_to_img", {
-							srcPath,
-							parentDir,
-							imageDirectory: imgDirName,
-						})) as string;
-						embeds.push(imageEmbed(relPath));
-					}
-
-					if (embeds.length === 0) {
-						// check for image in clipboard via Rust
-						const base64Image = await invoke("clipboard_read_image", { macosImageScaling: settings.macosImageScaling }).catch(() => null) as string | null;
-						if (base64Image) {
-							const filename = `paste_${Date.now()}.png`; // output of Rust command is always PNG
-							const relPath = (await invoke("save_image", {
-								parentDir,
-								filename,
-								base64Data: base64Image,
-								imageDirectory: imgDirName,
-							})) as string;
-							embeds.push(imageEmbed(relPath));
-						}
-					}
-
-					// The written file stays: it is in the first tab's folder, where
-					// the reader can see it, and deleting on a guess is what #368 removed.
-					if (editor.getModel() !== pasteModel) return;
-					const position = editor.getPosition();
-					if (embeds.length > 0 && position) {
-						const selection = editor.getSelection();
-						const range =
-							selection && !selection.isEmpty()
-								? selection
-								: new monaco.Range(
-										position.lineNumber,
-										position.column,
-										position.lineNumber,
-										position.column,
-									);
-
-						editor.pushUndoStop();
-						editor.executeEdits("paste-image", [
-							{
-								range,
-								text: embeds.join("\n"),
-								forceMoveMarkers: true,
-							},
-						]);
-
-						return;
-					}
-				}
-
-				// fall through to text paste via Rust
-				const rawText = await invoke("clipboard_read_text").catch(() => "") as string;
-				if (!rawText) return;
-				// Every edit below is a paste, and a paste is its own undo step:
-				// `executeEdits` appends to the step typing left open, so without
-				// this one Cmd+Z takes back the paste AND the words before it.
-				editor.pushUndoStop();
-				
-				const text = rawText.trim();
-				const urlRegex = /^(?:(?:https?|file|tauri):\/\/|www\.)[^\s]{2,}$/i;
-				const isUrl = urlRegex.test(text);
-
-				const selections = editor.getSelections();
-				const model = editor.getModel();
-				if (!selections || selections.length === 0 || !model) {
-					insertTextAtCursor(rawText);
-					return;
-				}
-
-				// if it's not a URL or we have no multi-line selection/complex case, just insert
-				const hasSelection = selections.some((s) => !s.isEmpty());
-				const isMultiLine = selections.some((s) => s.startLineNumber !== s.endLineNumber);
-
-				if (!isUrl || isMultiLine || !isLinkifyPasteTarget(model, selections[0])) {
-					const edits = selections.map(s => ({
-						range: s,
-						text: rawText,
-						forceMoveMarkers: true
-					}));
-					editor.executeEdits("paste-text", edits);
-					return;
-				}
-
-				if (hasSelection) {
-					const edits = selections.map((selection) => {
-						const selectedText = model.getValueInRange(selection);
-						// Pasting a URL over a URL replaces it. Wrapping would
-						// nest the old URL as the link text — and inside
-						// existing link syntax like ![](url) it produces
-						// broken nesting: ![]([old](new)).
-						if (urlRegex.test(selectedText.trim())) {
-							return {
-								range: selection,
-								text,
-								forceMoveMarkers: true,
-							};
-						}
-						const linkUrl = text.toLowerCase().startsWith("www.")
-							? `http://${text}`
-							: text;
-						return {
-							range: selection,
-							text: `[${selectedText}](${linkUrl})`,
-							forceMoveMarkers: true,
-						};
-					});
-					editor.executeEdits("paste-link", edits);
-				} else {
-					const displayText = text.replace(
-						/^(?:https?|file|tauri):\/\/|www\./i,
-						"",
-					);
-					const linkUrl = text.toLowerCase().startsWith("www.")
-						? `http://${text}`
-						: text;
-					const template = `[${displayText}](${linkUrl})`;
-					const edits = selections.map((selection) => {
-						return {
-							range: selection,
-							text: template,
-							forceMoveMarkers: true,
-						};
-					});
-
-					editor.executeEdits("paste-link", edits);
-
-					let accumulatedShift = 0;
-					let lastLine = -1;
-					const newSelections = selections.map((s) => {
-						if (s.startLineNumber !== lastLine) {
-							accumulatedShift = 0;
-							lastLine = s.startLineNumber;
-						}
-						const startColumn = s.startColumn + accumulatedShift + 1;
-						const endColumn = startColumn + displayText.length;
-						accumulatedShift += template.length;
-						return new monaco.Selection(
-							s.startLineNumber,
-							startColumn,
-							s.startLineNumber,
-							endColumn,
-						);
-					});
-					editor.setSelections(newSelections);
-				}
-			} catch (err) {
-				console.error("Paste failed:", err);
-			}
+	// Cut, copy, paste and the drop handler: utils/editorClipboard.ts.
+	const clipboard: EditorClipboardDeps = {
+		editor: () => editor,
+		monaco: () => monaco,
+		invoke,
+		tabs: tabManager,
+		settings,
+	};
+	export function pasteFromClipboard() {
+		return editorClipboard.pasteFromClipboard(clipboard);
 	}
-
-	export async function copyToClipboard() {
-		editor?.focus();
-		const { text } = clipboardTextForSelection();
-		if (text) await invoke('clipboard_write_text', { text }).catch(console.error);
+	export function copyToClipboard() {
+		return editorClipboard.copyToClipboard(clipboard);
 	}
-
-	export async function cutToClipboard() {
-		editor?.focus();
-		const { text, range } = clipboardTextForSelection();
-		if (!text || !range || !editor) return;
-		const model = editor.getModel();
-		await invoke('clipboard_write_text', { text }).catch(console.error);
-		// `range` is in this model's coordinates; after a tab switch it would
-		// delete text from the other document.
-		if (editor.getModel() !== model) return;
-		editor.pushUndoStop();
-		editor.executeEdits('cut', [{ range, text: '', forceMoveMarkers: true }]);
+	export function cutToClipboard() {
+		return editorClipboard.cutToClipboard(clipboard);
 	}
 
-	/** A sync asked for before Monaco loaded, spent right after the view-state restore. */
-	let pendingSync: ScrollSyncPosition | null = null;
-	let pendingCursorIntoView = false;
-
 	/**
 	 * `cursorIntoView` is Ctrl+E's, with the outline following the cursor: an
 	 * outline that marks the cursor's heading while the page shows another one
@@ -2168,12 +476,11 @@
 	 * Split view's live sync never passes it, and never moves the cursor.
 	 */
 	export function syncScrollToPosition(position: ScrollSyncPosition, { cursorIntoView = false } = {}) {
-		if (!editorReady || !editor) {
-			pendingSync = position;
-			pendingCursorIntoView = cursorIntoView;
-			return;
-		}
+		jumps.syncScrollToPosition(position, { cursorIntoView });
+	}
 
+	/** `syncScrollToPosition` once the editor is ready. */
+	function scrollToSyncPosition(position: ScrollSyncPosition, { cursorIntoView }: { cursorIntoView: boolean }) {
 		const scrollMax = getEditorContentScrollMax();
 		let targetScroll: number | null = null;
 
@@ -2255,11 +562,7 @@
 				onscrollsync?.(getEditorScrollSyncPosition());
 			};
 
-			const scrollListener = editor.onDidScrollChange((e) => {
-				if (e.scrollTopChanged) {
-					emitSync();
-				}
-			});
+			const scrollListener = bindScrollSync(editor, emitSync);
 			return () => {
 				scrollListener.dispose();
 			};
@@ -2294,50 +597,12 @@
 
 		if (!editorReady || !editor) return;
 
-		const switched = activeTabId !== currentTabId;
-
-		if (switched && currentTabId) {
-			const state = editor.saveViewState();
-			tabManager.updateTabEditorState(currentTabId, state);
-		}
-
-		currentTabId = activeTabId;
-
-		if (activeTabId) {
-			const model = acquireTabModel(activeTabId, content, languageId);
-			if (editor.getModel() !== model) {
-				editor.setModel(model);
-				emittedText = null;
-			}
-		}
-
-		// The keystroke that changed `value` came from this editor, and the
-		// model already holds it: no need to copy the buffer out to compare.
-		if (content !== emittedText && editor.getValue() !== content) {
-			editor.setValue(content);
-		}
-
-		if (switched) {
-			// The view state is the editor's, not the model's — cursor, scroll,
-			// selections and the folding contribution — so it still has to be
-			// restored by hand, and only after the model it describes is
-			// attached.
-			if (tabManager.activeTab?.editorViewState) {
-				editor.restoreViewState(tabManager.activeTab.editorViewState);
-			} else {
-				editor.setScrollTop(0);
-				editor.setPosition({ lineNumber: 1, column: 1 });
-			}
-		}
-
-		// Cheap on the hot path: this effect re-runs on every keystroke (it
-		// reads `value`), and on a keystroke neither test holds.
-		if (switched || currentLanguage !== languageId) syncStatusFromModel();
+		doc.activate(activeTabId, content, languageId);
 	});
 
 	/** The one place the settings, and `readOnly`, reach Monaco after creation: the effect below, and `onMount` once the font is measured. */
 	function applySettingsOptions() {
-		editor.updateOptions({ ...editorOptionsFromSettings(settings, zoomLevel, fontIsMonospace), readOnly });
+		editor.updateOptions(updatedEditorOptions(settings, zoomLevel, fontIsMonospace, readOnly));
 	}
 
 	$effect(() => {
@@ -2346,7 +611,7 @@
 
 	// The count is not kept while hidden, so showing it has to take one.
 	$effect(() => {
-		if (editorReady && editor && settings.wordCount) syncStatusFromModel();
+		if (editorReady && editor && settings.wordCount) doc.syncStatus();
 	});
 
 	// Focus Mode (#819): the paragraph the cursor is in keeps full strength and
@@ -2399,18 +664,8 @@
 			let vim: { dispose: () => void } | null = null;
 			const currentEditor = editor;
 			const currentStatusNode = vimStatusNode;
-			import("monaco-vim").then(({ initVimMode, VimMode }) => {
-				// Before the adapter is attached, and unconditionally: it patches
-				// monaco-vim's own module-level command tables, which outlive this
-				// effect, and it is idempotent. See vimScrollCommands.ts for what
-				// 0.4.4 does to `zz`, `zt`, `zb`, `z.`, `z-` and `z<CR>` (#104).
-				installVimScrollCommands(VimMode);
-				// Same reason, for `"+` and `"*` (#775).
-				installVimClipboardRegisters(VimMode, (text) => {
-					invoke('clipboard_write_text', { text }).catch(console.error);
-				});
-				if (disposed) return;
-				vim = initVimMode(currentEditor, currentStatusNode);
+			import("monaco-vim").then((module) => {
+				vim = attachVimMode(module, currentEditor, currentStatusNode, invoke, () => disposed);
 			});
 			return () => {
 				disposed = true;
@@ -2418,60 +673,8 @@
 			};
 		}
 	});
-	export async function handleDroppedFile(path: string, x: number, y: number) {
-		if (!editor || !tabManager.activeTab?.path) return;
-
-		const target = (editor as any).getTargetAtClientPoint(x, y);
-		const position = target?.position || editor.getPosition();
-		if (!position) return;
-
-		const tabPath = tabManager.activeTab.path;
-		const parentDir = documentParentDir(tabPath);
-		if (parentDir === null) return;
-		const dropModel = editor.getModel();
-
-		try {
-			const imgDirName = resolveImageDirectory(
-				settings.imageDirectory,
-				tabPath,
-			);
-			const relPath = (await invoke("copy_file_to_img", {
-				srcPath: path,
-				parentDir,
-				imageDirectory: imgDirName,
-			})) as string;
-			// As in `pasteFromClipboard`: a tab switch during the copy leaves the
-			// file where it was copied and the link out of the other document.
-			if (editor.getModel() !== dropModel) return;
-			const embed = imageEmbed(relPath);
-
-			editor.pushUndoStop();
-			editor.executeEdits(
-				"drop-image",
-				[
-					{
-						range: new monaco.Range(
-							position.lineNumber,
-							position.column,
-							position.lineNumber,
-							position.column,
-						),
-						text: embed,
-						forceMoveMarkers: true,
-					},
-				],
-				[
-					new monaco.Selection(
-						position.lineNumber,
-						position.column + embed.length,
-						position.lineNumber,
-						position.column + embed.length,
-					),
-				],
-			);
-		} catch (err) {
-			console.error("Failed to copy dropped file:", err);
-		}
+	export function handleDroppedFile(path: string, x: number, y: number) {
+		return editorClipboard.handleDroppedFile(clipboard, path, x, y);
 	}
 
 	let dragCaretDecoration: string[] = [];
@@ -2503,95 +706,12 @@
 		dragCaretDecoration = editor.deltaDecorations(dragCaretDecoration, []);
 	}
 
-	/**
-	 * Where a revealed range lands in the viewport. The outline asks for `top`:
-	 * the preview answers the same click by putting the heading just under its
-	 * top edge, and with scroll sync off the two panes then show the same
-	 * place. The context menu's Edit keeps `center`, the reading it had.
-	 */
-	type RevealPlacement = 'center' | 'top';
-	/**
-	 * A reveal asked for before Monaco loaded. The preview can call in several
-	 * frames before `editor` exists; `createEditor` spends it once it does.
-	 */
-	let pendingReveal: { startLine: number; endLine: number; placement: RevealPlacement } | null = null;
-
-	/**
-	 * Put the reader on `startLine`..`endLine` of the buffer.
-	 *
-	 * The one line-to-editor jump in this component. The outline reaches it
-	 * through `revealHeader`, and the preview's context-menu "Edit" calls it
-	 * with the source range of whatever the reader had selected (#90).
-	 *
-	 * The selection IS the highlight #90 asks for: Monaco draws it in the
-	 * theme's own selection colour, so it needs no decoration, no CSS and no
-	 * timer — and it clears itself on the reader's next click or keystroke,
-	 * which is precisely when it has stopped being useful. A decoration that
-	 * fades on a timer would be a second highlighting mechanism doing what this
-	 * one already does, and would leave the caret at the top of the file.
-	 */
 	export function revealSourceRange(startLine: number, endLine: number, placement: RevealPlacement = 'center') {
-		if (!editorReady || !editor) {
-			pendingReveal = { startLine, endLine, placement };
-			return;
-		}
-
-		const model = editor.getModel();
-		if (!model) return;
-
-		// Clamp before `getLineMaxColumn`, which throws on a line past the end
-		// of the buffer. Both callers can hand one over: the preview's HTML is
-		// the render of a buffer that may since have been replaced by a shorter
-		// one (an external change, a session restored around a file edited
-		// elsewhere), and the outline carries the same lines.
-		const lastLine = model.getLineCount();
-		const start = Math.min(Math.max(1, Math.trunc(startLine)), lastLine);
-		const end = Math.min(Math.max(start, Math.trunc(endLine)), lastLine);
-
-		if (placement === 'top') editor.revealLineNearTop(start, monaco.editor.ScrollType.Smooth);
-		else editor.revealLineInCenterIfOutsideViewport(start, monaco.editor.ScrollType.Smooth);
-		editor.setSelection({
-			startLineNumber: start,
-			startColumn: 1,
-			endLineNumber: end,
-			endColumn: model.getLineMaxColumn(end),
-		});
-		editor.focus();
+		jumps.revealSourceRange(startLine, endLine, placement);
 	}
 
-	/**
-	 * `sourceLine` is a BUFFER line, and the type is the whole point: the
-	 * outline reads `data-sourcepos`, which counts from the first line of the
-	 * body, and handed it over unshifted for as long as both features existed.
-	 * The caller now has to go through `lineCoordinates` to produce one.
-	 */
 	export function revealHeader(sourceLine: BufferLine | null, text: string) {
-		if (!editor) return;
-		const model = editor.getModel();
-		if (!model) return;
-		const lineNumber = sourceLine ?? 0;
-		if (Number.isInteger(lineNumber) && lineNumber > 0) {
-			revealSourceRange(lineNumber, lineNumber, 'top');
-			return;
-		}
-
-		const escapedText = text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-		const regex = new RegExp(`^#+\\s+.*${escapedText}.*$`, "m");
-		
-		const match = model.findNextMatch(regex.source, { lineNumber: 1, column: 1 }, true, false, null, true);
-		
-		if (match) {
-			editor.revealLineNearTop(match.range.startLineNumber, monaco.editor.ScrollType.Smooth);
-			editor.setSelection(match.range);
-			editor.focus();
-		} else {
-			const fallbackMatch = model.findNextMatch(escapedText, { lineNumber: 1, column: 1 }, false, false, null, false);
-			if (fallbackMatch) {
-				editor.revealLineNearTop(fallbackMatch.range.startLineNumber, monaco.editor.ScrollType.Smooth);
-				editor.setSelection(fallbackMatch.range);
-				editor.focus();
-			}
-		}
+		jumps.revealHeader(sourceLine, text);
 	}
 
 	export const undo = () => {
@@ -2676,8 +796,8 @@
 	 * the caller named — a wrong position on two tabs instead of one.
 	 */
 	export function flushPositionTo(tabId: string) {
-		if (!editorReady || !editor || currentTabId !== tabId) return;
-		writeEditorPosition(tabId);
+		if (!editorReady || !editor) return;
+		doc.flushPositionTo(tabId);
 	}
 </script>
 
@@ -2725,20 +845,20 @@
 		{/if}
 		{#if settings.wordCount}
 			<div class="status-item">
-				{t('editor.status.words', settings.language).replace('{{count}}', wordCount.toString())}
+				{t('editor.status.words', settings.language).replace('{{count}}', doc.wordCount.toString())}
 			</div>
 		{/if}
 		<div class="status-item">
 			{zoomLevel}%
 		</div>
 		<div class="status-item">
-			{currentLanguage}
+			{doc.language}
 		</div>
 		<!-- Not translated, like the language id and the zoom level above it:
 		     "LF" and "CRLF" are acronyms, and the `crlf` key they replace held
 		     the same ASCII in all five locales that bothered to define it. -->
-		<div class="status-item">{lineEnding}</div>
-		<div class="status-item">{encoding}</div>
+		<div class="status-item">{doc.lineEnding}</div>
+		<div class="status-item">{doc.encoding}</div>
 	</div>
 {/if}
 
diff --git a/src/lib/components/FindBar.svelte b/src/lib/components/FindBar.svelte
index e9d40b15..04a661d9 100644
--- a/src/lib/components/FindBar.svelte
+++ b/src/lib/components/FindBar.svelte
@@ -4,6 +4,7 @@
 	import { t } from '../utils/i18n.js';
 	import type { LanguageCode } from '../utils/i18n.js';
 	import { collapsedFoldsAround } from '../utils/foldState.js';
+	import { FOLD_TRANSITION_MS } from '../utils/foldLayout.js';
 	import { settings } from '../stores/settings.svelte.js';
 	import { jumpScrollBehavior } from '../utils/motion.js';
 	import { findMatches, markMatches } from '../utils/findText.js';
@@ -53,9 +54,6 @@
 	// (content the browser cannot reveal, `display: none`, is not matched at
 	// all). So the matches stay in the count and the fold opens on the way to
 	// them.
-	//
-	// styles.css animates the fold height for 0.25s.
-	const FOLD_TRANSITION_MS = 300;
 
 	let inputEl = $state<HTMLInputElement>();
 	let query = $state('');
diff --git a/src/lib/components/Modal.svelte b/src/lib/components/Modal.svelte
index 6b4db664..7c732b28 100644
--- a/src/lib/components/Modal.svelte
+++ b/src/lib/components/Modal.svelte
@@ -2,6 +2,7 @@
 	import { fade, scale } from 'svelte/transition';
 	import { t } from '../utils/i18n.js';
 	import { settings } from '../stores/settings.svelte.js';
+	import { handleModalBackdropContextMenu } from '../utils/modalContextMenu.js';
 
 	let {
 		show,
@@ -112,12 +113,7 @@
 		class="modal-backdrop"
 		transition:fade={{ duration: 150 }}
 		onclick={handleBackdropClick}
-		oncontextmenu={(e) => {
-			// The prompt input needs the webview's Cut/Copy/Paste menu.
-			if ((e.target as HTMLElement).closest('input, textarea')) return;
-			e.preventDefault();
-			e.stopPropagation();
-		}}
+		oncontextmenu={handleModalBackdropContextMenu}
 		role="presentation">
 		<div
 			class="modal-content {kind}"
diff --git a/src/lib/components/Settings.svelte b/src/lib/components/Settings.svelte
index 8407a6d0..29156519 100644
--- a/src/lib/components/Settings.svelte
+++ b/src/lib/components/Settings.svelte
@@ -1,16 +1,12 @@
 <script lang="ts">
 	import { invoke } from '@tauri-apps/api/core';
-	import { getVersion } from '@tauri-apps/api/app';
 	import { openUrl } from '@tauri-apps/plugin-opener';
 	import { open, save } from '@tauri-apps/plugin-dialog';
 	import {
 		settings,
-		clampToRange,
 		applySettings,
 		exportSettings,
 		parseSettingsFile,
-		isWithinRange,
-		parseStoredNumber,
 		resolveTheme,
 		stepWithinRange,
 		CODE_FONT_SIZE_RANGE,
@@ -26,15 +22,18 @@
 	import { t, getSupportedLanguages } from '../utils/i18n.js';
 	import { shortcutSections } from '../utils/shortcuts.js';
 	import { platformOf } from '../utils/platform.js';
+	import {
+		SETTINGS_PANES,
+		folderSideFollowsTabs,
+		numberInputHandlers,
+		setNumberSetting,
+		type SettingsRow,
+	} from '../utils/settingsPanes.js';
+	import { createSettingsOpen } from '../utils/settingsOpen.svelte.js';
 	import type { LanguageCode } from '../utils/i18n.js';
 	import { getEditorToolbarTools } from '../utils/editorToolbar.js';
 	import { getTitlebarToolbarActions, type TitlebarToolbarPlacement } from '../utils/titlebarToolbar.js';
-	import {
-		DEFAULT_PREVIEW_MAX_WIDTH,
-		MAX_PREVIEW_MAX_WIDTH,
-		MIN_PREVIEW_MAX_WIDTH,
-		normalizePreviewMaxWidth,
-	} from '../utils/previewWidth.js';
+	import { DEFAULT_PREVIEW_MAX_WIDTH, normalizePreviewMaxWidth } from '../utils/previewWidth.js';
 
 	let {
 		show = false,
@@ -50,57 +49,11 @@
 		settings.previewMaxWidth = normalizePreviewMaxWidth(value);
 	}
 
-	/**
-	 * Keystroke handler for a numeric setting input.
-	 *
-	 * `min`/`max` on `<input type="number">` only drive validation styling and
-	 * the spin buttons; they do not stop typing, and Svelte's `bind:value`
-	 * assigns `null` for an empty field — which used to reach the store and
-	 * render as `font-size: nullpx` before being persisted as the string
-	 * "null". So the binding is one-way and every commit goes through the
-	 * shared range.
-	 *
-	 * While typing we accept only values that already fall inside the range and
-	 * ignore everything else, rather than clamping eagerly: clamping on each
-	 * keystroke would turn the intermediate "1" of "18" into "10" and leave the
-	 * caret stranded. Out-of-range or empty input is settled on commit instead.
-	 */
-	function handleNumberInput(event: Event, range: NumericSettingRange, assign: (value: number) => void) {
-		const input = event.currentTarget as HTMLInputElement;
-		if (input.value.trim() === '') return;
-		const parsed = Number(input.value);
-		if (!isWithinRange(parsed, range)) return;
-		assign(Math.round(parsed));
-	}
-
-	/**
-	 * Commit handler (blur / Enter). Clamps, falls back to the range default for
-	 * an empty or unparseable field, and writes the result back to the DOM —
-	 * the element needs that explicitly, because when the clamped value equals
-	 * the value already in the store there is no state change for Svelte to
-	 * re-render from and the input would keep showing the rejected text.
-	 */
-	function commitNumberInput(event: Event, range: NumericSettingRange, assign: (value: number) => void) {
-		const input = event.currentTarget as HTMLInputElement;
-		const next = parseStoredNumber(input.value, range);
-		assign(next);
-		input.value = String(next);
-	}
-
-	function handleNumberKeydown(event: KeyboardEvent, range: NumericSettingRange, assign: (value: number) => void) {
-		if (event.key !== 'Enter') return;
-		commitNumberInput(event, range, assign);
-	}
-
 	/** Spin buttons share the clamping rules with typing and with persistence. */
 	function stepSetting(current: number, delta: number, range: NumericSettingRange, assign: (value: number) => void) {
 		assign(stepWithinRange(current, delta, range));
 	}
 
-	const setEditorFontSize = (value: number) => { settings.editorFontSize = clampToRange(value, EDITOR_FONT_SIZE_RANGE); };
-	const setEditorMaxWidth = (value: number) => { settings.editorMaxWidth = clampToRange(value, EDITOR_MAX_WIDTH_RANGE); };
-	const setPreviewFontSize = (value: number) => { settings.previewFontSize = clampToRange(value, PREVIEW_FONT_SIZE_RANGE); };
-	const setCodeFontSize = (value: number) => { settings.codeFontSize = clampToRange(value, CODE_FONT_SIZE_RANGE); };
 	const highlightColors = [
 		{ value: 'default', color: 'var(--color-accent-fg)' },
 		{ value: 'yellow', color: '#ffd000' },
@@ -155,16 +108,7 @@
 		{ className: 'resize-nw', edges: ['top', 'left'] },
 	];
 
-	let systemFonts = $state<string[]>([]);
-	// Plain variables on purpose: neither is rendered, and both are read *and*
-	// written by the open-effect below. As `$state` they made that effect
-	// re-enter itself — `loadFonts()` reads `loaded` synchronously and sets it
-	// after its await, which re-ran the effect and clobbered the saved
-	// `previousActiveElement` with a control inside the dialog.
-	let loaded = false;
-	let previousActiveElement: HTMLElement | null = null;
 	let settingsModal = $state<HTMLDivElement>();
-	let appVersion = $state<string>('');
 	let defaultFonts = $derived(DEFAULT_FONTS[settings.osType] || DEFAULT_FONTS.unknown);
 
 	/**
@@ -521,50 +465,7 @@
 		}
 	}
 
-	async function loadFonts() {
-		if (loaded) return;
-		try {
-			systemFonts = await invoke<string[]>('get_system_fonts');
-			loaded = true;
-		} catch (e) {
-			console.error('Failed to load system fonts:', e);
-			systemFonts = ['Consolas', 'Courier New', 'Monaco', 'Menlo', 'Segoe UI'];
-		}
-	}
-
-	// Guarded by a plain (non-reactive) flag rather than by `if (!appVersion)`.
-	// The old form made the open-effect below *read* `appVersion` and the
-	// resolved promise *write* it, so the whole effect re-ran once the version
-	// arrived — and the re-run re-captured `previousActiveElement`, which by then
-	// was a button inside the dialog. Closing settings then returned focus into
-	// the dialog instead of to the control that opened it.
-	let versionRequested = false;
-	function ensureAppVersion() {
-		if (versionRequested) return;
-		versionRequested = true;
-		getVersion()
-			.then((v) => (appVersion = v))
-			.catch(console.error);
-	}
-
-	$effect(() => {
-		if (show) {
-			loadFonts();
-			ensureAppVersion();
-			loadVscodeThemes();
-			previousActiveElement = document.activeElement as HTMLElement;
-			setTimeout(() => {
-				const firstFocusable = settingsModal?.querySelector('button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])') as HTMLElement | null;
-				if (firstFocusable) {
-					firstFocusable.focus();
-				} else {
-					settingsModal?.focus();
-				}
-			}, 50);
-		} else if (previousActiveElement) {
-			previousActiveElement.focus();
-		}
-	});
+	const dialog = createSettingsOpen({ isOpen: () => show, modal: () => settingsModal, onOpen: loadVscodeThemes });
 
 	function handleModalKeydown(e: KeyboardEvent) {
 		if (e.key === 'Escape') {
@@ -648,10 +549,269 @@
 		}
 	}
 
-	// With the tabs in a side column, the folder stacks into that column and this choice does not apply.
-	const folderSideFollowsTabs = $derived(settings.tabPlacement === 'left' || settings.tabPlacement === 'right');
+
+	function rowModified(row: SettingsRow): boolean {
+		return 'key' in row && row.key !== undefined ? ((modified as Record<string, boolean>)[row.key] ?? false) : false;
+	}
+
+	function rowTitle(row: SettingsRow): string | undefined {
+		if (row.titleKey) return t(row.titleKey, settings.language);
+		if (row.inactiveTitleKey) return row.inactive?.(settings) ? t(row.inactiveTitleKey, settings.language) : '';
+		return undefined;
+	}
 </script>
 
+{#snippet customRow(row: SettingsRow)}
+	{#if row.id === 'appearance-language'}
+		<div class="setting-item">
+			<label for="appearance-language">{t(row.labelKey, settings.language)}</label>
+			<div class="select-wrapper">
+				<select id="appearance-language" value={settings.language} onchange={(e) => settings.setLanguage(e.currentTarget.value as LanguageCode)}>
+					{#each getSupportedLanguages() as lang}
+						<option value={lang.code}>{lang.nativeName}</option>
+					{/each}
+				</select>
+				<svg
+					class="select-arrow"
+					width="12"
+					height="12"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
+			</div>
+		</div>
+	{:else if row.id === 'appearance-theme'}
+		<div class="setting-item">
+			<label for="appearance-theme">{t(row.labelKey, settings.language)}</label>
+			<div class="select-wrapper">
+				<select id="appearance-theme" value={theme} onchange={(e) => onSetTheme?.(resolveTheme(e.currentTarget.value))}>
+					<option value="system">{t('settings.themeFollowSystem', settings.language)}</option>
+					<option value="light">{t('settings.themeDefaultLight', settings.language)}</option>
+					<option value="dark">{t('settings.themeDefaultDark', settings.language)}</option>
+					{#if savedVscodeThemes.length > 0}
+						<optgroup label={t('settings.vsCodeThemes', settings.language)}>
+							{#each savedVscodeThemes as themeOption}
+								<option value={`vscode:${themeOption}`}>{themeOption}</option>
+							{/each}
+						</optgroup>
+					{/if}
+				</select>
+				<svg
+					class="select-arrow"
+					width="12"
+					height="12"
+					viewBox="0 0 24 24"
+					fill="none"
+					stroke="currentColor"
+					stroke-width="2"
+					stroke-linecap="round"
+					stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
+			</div>
+		</div>
+
+		{#if theme.startsWith('vscode:')}
+			<div class="setting-block">
+				<button class="reset-text-btn delete-theme" onclick={() => deleteTheme(theme.replace('vscode:', ''))}>
+					{t('settings.deleteSelectedTheme', settings.language)}
+				</button>
+			</div>
+		{/if}
+	{:else if row.id === 'theme-import'}
+		<div class="setting-block">
+			<div class="setting-block-row">
+				<label for="theme-import">{t(row.labelKey, settings.language)}</label>
+				<button
+					class="reset-text-btn"
+					onclick={() =>
+						openUrl('https://vscodethemes.com/')
+							.catch(() => window.open('https://vscodethemes.com/', '_blank'))}
+				>
+					{t('settings.browseThemes', settings.language)}
+				</button>
+			</div>
+			<div class="setting-block-row">
+				<input
+					type="text"
+					id="theme-import"
+					class="text-input theme-import-url"
+					placeholder="https://vscodethemes.com/e/..."
+					bind:value={themeImportUrl}
+					onkeydown={e => e.key === 'Enter' && importVscodeTheme()}
+				/>
+				<button class="import-btn" onclick={importVscodeTheme} disabled={importingTheme || !themeImportUrl}>
+					{importingTheme ? t('settings.importing', settings.language) : t('settings.import', settings.language)}
+				</button>
+			</div>
+		</div>
+	{:else if row.id === 'appearance-highlight-color'}
+			<div class="setting-item">
+				<label for="appearance-highlight-color">{t(row.labelKey, settings.language)}</label>
+				<div class="custom-dropdown-wrapper">
+					<button 
+						class="custom-dropdown-btn" 
+						onclick={(e) => { e.stopPropagation(); highlightMenuOpen = !highlightMenuOpen; }}>
+							<div style="display: flex; align-items: center; gap: 8px;">
+							<div class="color-circle" style="background-color: {highlightColors.find(c => c.value === settings.highlightColor)?.color || 'var(--color-accent-fg)'}"></div>
+							<span>{t(`colors.${settings.highlightColor || 'default'}`, settings.language)}</span>
+						</div>
+							<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
+					</button>
+					{#if highlightMenuOpen}
+						<div
+							class="custom-dropdown-menu"
+							role="menu"
+							tabindex="-1"
+							transition:fly={{ y: 5, duration: 150 }}
+							onclick={(e) => e.stopPropagation()}
+							onkeydown={(e) => {
+								if (e.key === 'Escape') highlightMenuOpen = false;
+							}}>
+							{#each highlightColors as color, index}
+								{#if index === 1}
+									<div class="theme-menu-divider" style="height: 1px; background-color: var(--color-border-muted); margin: 4px 0; transform: scaleY(0.5);"></div>
+								{/if}
+								<button 
+										class="custom-dropdown-option {settings.highlightColor === color.value ? 'selected' : ''}" 
+										onclick={() => {
+											settings.highlightColor = color.value;
+											highlightMenuOpen = false;
+										}}
+									>
+										<div class="color-circle" style="background-color: {color.color}"></div>
+										<span>{t(`colors.${color.value}`, settings.language)}</span>
+									</button>
+							{/each}
+						</div>
+					{/if}
+				</div>
+		</div>
+	{:else if row.id === 'image-directory'}
+		<div class="setting-item">
+			<label for="image-directory">{t(row.labelKey, settings.language)}</label>
+			<input
+				type="text"
+				id="image-directory"
+				class="text-input"
+				style="width: 120px;"
+				bind:value={settings.imageDirectory}
+				placeholder="img"
+				title={t('settings.imageDirectoryHint', settings.language)}
+			/>
+		</div>
+	{:else if row.id === 'macos-image-scaling'}
+		{#if settings.osType === 'macos'}
+			<div class="setting-item">
+				<label for="macos-image-scaling">{t(row.labelKey, settings.language)}</label>
+				<label class="toggle">
+					<input id="macos-image-scaling" type="checkbox" bind:checked={settings.macosImageScaling} />
+					<span class="toggle-slider"></span>
+				</label>
+				<span class="slider-value">{t('settings.reduceSizeBy50', settings.language)}</span>
+			</div>
+		{/if}
+	{:else if row.id === 'settings-file-import'}
+		<div class="setting-item">
+			<label for="settings-file-import">{t(row.labelKey, settings.language)}</label>
+			<div class="settings-file-actions">
+				<button id="settings-file-import" class="import-btn" onclick={importSettingsFile}>{t('settings.importSettings', settings.language)}</button>
+				<button class="import-btn" onclick={exportSettingsFile}>{t('settings.exportSettings', settings.language)}</button>
+			</div>
+		</div>
+	{/if}
+{/snippet}
+
+{#snippet settingRow(row: SettingsRow)}
+	{#if row.kind === 'custom'}
+		{@render customRow(row)}
+	{:else}
+		<div class="setting-item" class:modified={rowModified(row)} class:inactive={row.inactive?.(settings) ?? false}>
+			<label for={row.id} class:has-hint={!!row.hintKey} title={rowTitle(row)}>{t(row.labelKey, settings.language)}{#if row.hintKey}<span class="setting-hint">{t(row.hintKey, settings.language)}</span>{/if}</label>
+			{#if row.kind === 'font'}
+				<div class="select-wrapper">
+					<select id={row.id} bind:value={settings[row.key]}>
+						{#each dialog.systemFonts as font}
+							<option value={font}>{font === defaultFonts[row.key] ? font + ' (' + t('settings.default', settings.language) + ')' : font}</option>
+						{/each}
+					</select>
+					<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
+				</div>
+			{:else if row.kind === 'number'}
+				{@const disabled = row.inactive?.(settings) ?? false}
+				{@const assign = (value: number) => setNumberSetting(settings, row, value)}
+				<div class="slider-container">
+					<div class="number-input-wrapper horizontal">
+						<button class="spin-btn minus" {disabled} onclick={() => stepSetting(settings[row.key], -row.range.step, row.range, assign)} aria-label={t('common.decrease', settings.language)}>
+							<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+						><line x1="5" y1="12" x2="19" y2="12"></line></svg>
+						</button>
+						<input
+							type="number"
+							id={row.id}
+							min={row.range.min}
+							max={row.range.max}
+							step={row.range.step}
+							value={settings[row.key]}
+							{...numberInputHandlers(row.range, assign)}
+							class="number-input"
+							{disabled}
+						/>
+						<button class="spin-btn plus" {disabled} onclick={() => stepSetting(settings[row.key], row.range.step, row.range, assign)} aria-label={t('common.increase', settings.language)}>
+							<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+						><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
+						</button>
+					</div>
+					<span class="unit-label">{row.unit}</span>
+				</div>
+			{:else if row.kind === 'previewWidth'}
+				<div class="slider-container">
+					<div class="number-input-wrapper horizontal">
+						<button class="spin-btn minus" onclick={() => updatePreviewMaxWidth(settings.previewMaxWidth - row.range.step)} aria-label={t('common.decrease', settings.language)}>
+							<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+						><line x1="5" y1="12" x2="19" y2="12"></line></svg>
+						</button>
+						<input
+							type="number"
+							id={row.id}
+							min={row.range.min}
+							max={row.range.max}
+							step={row.range.step}
+							bind:value={settings.previewMaxWidth}
+							onchange={() => updatePreviewMaxWidth(settings.previewMaxWidth)}
+							class="number-input"
+						/>
+						<button class="spin-btn plus" onclick={() => updatePreviewMaxWidth(settings.previewMaxWidth + row.range.step)} aria-label={t('common.increase', settings.language)}>
+							<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+						><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
+						</button>
+					</div>
+					<span class="unit-label">px</span>
+				</div>
+			{:else if row.kind === 'select'}
+				<div class="select-wrapper">
+					<select id={row.id} disabled={row.inactive?.(settings) ?? false} bind:value={settings[row.key]}>
+						{#each row.options as option}
+							<option value={option.value}>{t(option.labelKey, settings.language)}</option>
+						{/each}
+					</select>
+					<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
+				</div>
+			{:else if row.kind === 'toggle'}
+				<label class="toggle">
+					{#if row.key}
+						<input id={row.id} type="checkbox" bind:checked={settings[row.key]} disabled={row.inactive?.(settings) ?? false} />
+					{:else}
+						<input id={row.id} type="checkbox" checked={row.checked?.(settings)} onchange={() => row.toggle?.(settings)} />
+					{/if}
+					<span class="toggle-slider"></span>
+				</label>
+			{/if}
+		</div>
+	{/if}
+{/snippet}
+
 {#if show}
 	<div class="settings-backdrop" transition:fade={{ duration: 150 }} role="presentation">
 		<div
@@ -827,8 +987,8 @@
 										></path>
 								</svg>
 								<span>{t('menu.github', settings.language)}</span>
-							{#if appVersion}
-								<span class="version-code">v{appVersion}</span>
+							{#if dialog.appVersion}
+								<span class="version-code">v{dialog.appVersion}</span>
 							{/if}
 						</button>
 					</div>
@@ -842,169 +1002,14 @@
 								<button
 									class="reset-text-btn"
 									class:disabled={!editorSettingsModified}
-									onclick={() => { settings.resetEditorFont(); settings.resetEditorMaxWidth(); }}>
+									onclick={() => SETTINGS_PANES.editor.reset?.(settings)}>
 									{t('settings.resetEditorSettings', settings.language)}
 								</button>
 							</div>
 
-							<div class="setting-item" class:modified={modified.editorFont}>
-								<label for="editor-font">{t('settings.font', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="editor-font" bind:value={settings.editorFont}>
-										{#each systemFonts as font}
-											<option value={font}>{font === defaultFonts.editorFont ? font + ' (' + t('settings.default', settings.language) + ')' : font}</option>
-										{/each}
-									</select>
-									<svg
-										class="select-arrow"
-										width="12"
-										height="12"
-										viewBox="0 0 24 24"
-										fill="none"
-										stroke="currentColor"
-										stroke-width="2"
-										stroke-linecap="round"
-										stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.editorFontSize}>
-								<label for="editor-font-size">{t('settings.fontSize', settings.language)}</label>
-								<div class="slider-container">
-									<div class="number-input-wrapper horizontal">
-										<button class="spin-btn minus" onclick={() => stepSetting(settings.editorFontSize, -EDITOR_FONT_SIZE_RANGE.step, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)} aria-label={t('common.decrease', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-										<input
-											type="number"
-											id="editor-font-size"
-											min={EDITOR_FONT_SIZE_RANGE.min}
-											max={EDITOR_FONT_SIZE_RANGE.max}
-											step={EDITOR_FONT_SIZE_RANGE.step}
-											value={settings.editorFontSize}
-											oninput={(e) => handleNumberInput(e, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)}
-											onchange={(e) => commitNumberInput(e, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)}
-											onblur={(e) => commitNumberInput(e, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)}
-											onkeydown={(e) => handleNumberKeydown(e, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)}
-											class="number-input"
-										/>
-										<button class="spin-btn plus" onclick={() => stepSetting(settings.editorFontSize, EDITOR_FONT_SIZE_RANGE.step, EDITOR_FONT_SIZE_RANGE, setEditorFontSize)} aria-label={t('common.increase', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-									</div>
-									<span class="unit-label">px</span>
-								</div>
-							</div>
-
-<div class="setting-item">
-								<label for="editor-word-wrap">{t('settings.wordWrap', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="editor-word-wrap" bind:value={settings.wordWrap}>
-										<option value="off">{t('menu.wordWrapOff', settings.language)}</option>
-										<option value="on">{t('menu.wordWrapOn', settings.language)}</option>
-										<option value="wordWrapColumn">{t('menu.wordWrapColumn', settings.language)}</option>
-									</select>
-									<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.editorMaxWidth} class:inactive={settings.wordWrap !== 'wordWrapColumn'}>
-								<label for="editor-max-width">{t('settings.wrapColumn', settings.language)}</label>
-								<div class="slider-container">
-									<div class="number-input-wrapper horizontal">
-										<button class="spin-btn minus" disabled={settings.wordWrap !== 'wordWrapColumn'} onclick={() => stepSetting(settings.editorMaxWidth, -EDITOR_MAX_WIDTH_RANGE.step, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)} aria-label={t('common.decrease', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-										<input
-											type="number"
-											id="editor-max-width"
-											min={EDITOR_MAX_WIDTH_RANGE.min}
-											max={EDITOR_MAX_WIDTH_RANGE.max}
-											step={EDITOR_MAX_WIDTH_RANGE.step}
-											value={settings.editorMaxWidth}
-											oninput={(e) => handleNumberInput(e, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)}
-											onchange={(e) => commitNumberInput(e, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)}
-											onblur={(e) => commitNumberInput(e, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)}
-											onkeydown={(e) => handleNumberKeydown(e, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)}
-											class="number-input"
-											disabled={settings.wordWrap !== 'wordWrapColumn'}
-										/>
-										<button class="spin-btn plus" disabled={settings.wordWrap !== 'wordWrapColumn'} onclick={() => stepSetting(settings.editorMaxWidth, EDITOR_MAX_WIDTH_RANGE.step, EDITOR_MAX_WIDTH_RANGE, setEditorMaxWidth)} aria-label={t('common.increase', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-									</div>
-									<span class="unit-label">chars</span>
-								</div>
-							</div>
-
-							
-							<div class="setting-item">
-								<label for="editor-line-numbers">{t('settings.lineNumbers', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-line-numbers" type="checkbox" checked={settings.lineNumbers === 'on'} onchange={() => settings.toggleLineNumbers()} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="editor-minimap">{t('settings.minimap', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-minimap" type="checkbox" bind:checked={settings.minimap} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="editor-vim-mode">{t('settings.vimMode', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-vim-mode" type="checkbox" bind:checked={settings.vimMode} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="editor-status-bar">{t('settings.statusBar', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-status-bar" type="checkbox" bind:checked={settings.statusBar} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item" class:inactive={!settings.statusBar}>
-								<label for="editor-word-count">{t('settings.wordCount', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-word-count" type="checkbox" bind:checked={settings.wordCount} disabled={!settings.statusBar} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="editor-show-whitespace">{t('settings.showWhitespace', settings.language)}</label>
-								<label class="toggle">
-									<input id="editor-show-whitespace" type="checkbox" bind:checked={settings.showWhitespace} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-						<div class="setting-item">
-							<label for="editor-sticky-scroll">{t('settings.stickyScroll', settings.language)}</label>
-							<label class="toggle">
-								<input id="editor-sticky-scroll" type="checkbox" bind:checked={settings.stickyScroll} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="editor-line-highlight">{t('settings.lineHighlight', settings.language)}</label>
-							<label class="toggle">
-								<input id="editor-line-highlight" type="checkbox" checked={settings.renderLineHighlight === 'line'} onchange={() => settings.toggleLineHighlight()} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
+						{#each SETTINGS_PANES.editor.rows as row (row.id)}
+							{@render settingRow(row)}
+						{/each}
 					</div>
 					{:else if activeCategory === 'preview'}
 						<div class="settings-group">
@@ -1013,437 +1018,22 @@
 								<button
 									class="reset-text-btn"
 									class:disabled={!previewSettingsModified}
-									onclick={() => {
-										settings.resetPreviewFont();
-										settings.resetPreviewMaxWidth();
-									}}>
+									onclick={() => SETTINGS_PANES.preview.reset?.(settings)}>
 									{t('settings.resetPreviewSettings', settings.language)}
 								</button>
 							</div>
 
-							<div class="setting-item" class:modified={modified.previewMaxWidth}>
-								<label for="preview-max-width">{t('settings.previewMaxWidth', settings.language)}</label>
-								<div class="slider-container">
-									<div class="number-input-wrapper horizontal">
-										<button class="spin-btn minus" onclick={() => updatePreviewMaxWidth(settings.previewMaxWidth - 40)} aria-label={t('common.decrease', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-										<input
-											type="number"
-											id="preview-max-width"
-											min={MIN_PREVIEW_MAX_WIDTH}
-											max={MAX_PREVIEW_MAX_WIDTH}
-											step="40"
-											bind:value={settings.previewMaxWidth}
-											onchange={() => updatePreviewMaxWidth(settings.previewMaxWidth)}
-											class="number-input"
-										/>
-										<button class="spin-btn plus" onclick={() => updatePreviewMaxWidth(settings.previewMaxWidth + 40)} aria-label={t('common.increase', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-									</div>
-									<span class="unit-label">px</span>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.previewFont}>
-								<label for="preview-font">{t('settings.previewBodyFont', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="preview-font" bind:value={settings.previewFont}>
-										{#each systemFonts as font}
-											<option value={font}>{font === defaultFonts.previewFont ? font + ' (' + t('settings.default', settings.language) + ')' : font}</option>
-										{/each}
-									</select>
-									<svg
-										class="select-arrow"
-										width="12"
-										height="12"
-										viewBox="0 0 24 24"
-										fill="none"
-										stroke="currentColor"
-										stroke-width="2"
-										stroke-linecap="round"
-										stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.previewFontSize}>
-								<label for="preview-font-size">{t('settings.previewBodyFontSize', settings.language)}</label>
-								<div class="slider-container">
-									<div class="number-input-wrapper horizontal">
-										<button class="spin-btn minus" onclick={() => stepSetting(settings.previewFontSize, -PREVIEW_FONT_SIZE_RANGE.step, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)} aria-label={t('common.decrease', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-										<input
-											type="number"
-											id="preview-font-size"
-											min={PREVIEW_FONT_SIZE_RANGE.min}
-											max={PREVIEW_FONT_SIZE_RANGE.max}
-											step={PREVIEW_FONT_SIZE_RANGE.step}
-											value={settings.previewFontSize}
-											oninput={(e) => handleNumberInput(e, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)}
-											onchange={(e) => commitNumberInput(e, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)}
-											onblur={(e) => commitNumberInput(e, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)}
-											onkeydown={(e) => handleNumberKeydown(e, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)}
-											class="number-input"
-										/>
-										<button class="spin-btn plus" onclick={() => stepSetting(settings.previewFontSize, PREVIEW_FONT_SIZE_RANGE.step, PREVIEW_FONT_SIZE_RANGE, setPreviewFontSize)} aria-label={t('common.increase', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-									</div>
-									<span class="unit-label">px</span>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.codeFont}>
-								<label for="code-font">{t('settings.previewCodeFont', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="code-font" bind:value={settings.codeFont}>
-										{#each systemFonts as font}
-											<option value={font}>{font === defaultFonts.codeFont ? font + ' (' + t('settings.default', settings.language) + ')' : font}</option>
-										{/each}
-									</select>
-									<svg
-										class="select-arrow"
-										width="12"
-										height="12"
-										viewBox="0 0 24 24"
-										fill="none"
-										stroke="currentColor"
-										stroke-width="2"
-										stroke-linecap="round"
-										stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item" class:modified={modified.codeFontSize}>
-								<label for="code-font-size">{t('settings.previewCodeFontSize', settings.language)}</label>
-								<div class="slider-container">
-									<div class="number-input-wrapper horizontal">
-										<button class="spin-btn minus" onclick={() => stepSetting(settings.codeFontSize, -CODE_FONT_SIZE_RANGE.step, CODE_FONT_SIZE_RANGE, setCodeFontSize)} aria-label={t('common.decrease', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-										<input
-											type="number"
-											id="code-font-size"
-											min={CODE_FONT_SIZE_RANGE.min}
-											max={CODE_FONT_SIZE_RANGE.max}
-											step={CODE_FONT_SIZE_RANGE.step}
-											value={settings.codeFontSize}
-											oninput={(e) => handleNumberInput(e, CODE_FONT_SIZE_RANGE, setCodeFontSize)}
-											onchange={(e) => commitNumberInput(e, CODE_FONT_SIZE_RANGE, setCodeFontSize)}
-											onblur={(e) => commitNumberInput(e, CODE_FONT_SIZE_RANGE, setCodeFontSize)}
-											onkeydown={(e) => handleNumberKeydown(e, CODE_FONT_SIZE_RANGE, setCodeFontSize)}
-											class="number-input"
-										/>
-										<button class="spin-btn plus" onclick={() => stepSetting(settings.codeFontSize, CODE_FONT_SIZE_RANGE.step, CODE_FONT_SIZE_RANGE, setCodeFontSize)} aria-label={t('common.increase', settings.language)}>
-											<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-												><line x1="12" y1="5" x2="12" y2="19"></line><line x1="5" y1="12" x2="19" y2="12"></line></svg>
-										</button>
-									</div>
-									<span class="unit-label">px</span>
-								</div>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-cursor">{t('settings.previewCursor', settings.language)}</label>
-								<label class="toggle">
-									<input id="preview-cursor" type="checkbox" bind:checked={settings.previewCursor} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-occurrences">{t('settings.previewOccurrences', settings.language)}</label>
-								<label class="toggle">
-									<input id="preview-occurrences" type="checkbox" bind:checked={settings.previewOccurrences} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-annotations">{t('settings.previewAnnotations', settings.language)}</label>
-								<label class="toggle">
-									<input id="preview-annotations" type="checkbox" bind:checked={settings.previewAnnotations} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-table-breakout" class="has-hint">{t('settings.previewTableBreakout', settings.language)}<span class="setting-hint">{t('settings.previewTableBreakoutHint', settings.language)}</span></label>
-								<label class="toggle">
-									<input id="preview-table-breakout" type="checkbox" bind:checked={settings.previewTableBreakout} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-table-scroll" class="has-hint">{t('settings.previewTableScroll', settings.language)}<span class="setting-hint">{t('settings.previewTableScrollHint', settings.language)}</span></label>
-								<label class="toggle">
-									<input id="preview-table-scroll" type="checkbox" bind:checked={settings.previewTableScroll} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-								<label for="preview-newline-breaks" class="has-hint">{t('settings.previewNewlineBreaks', settings.language)}<span class="setting-hint">{t('settings.previewNewlineBreaksHint', settings.language)}</span></label>
-								<label class="toggle">
-									<input id="preview-newline-breaks" type="checkbox" bind:checked={settings.previewNewlineBreaks} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
+							{#each SETTINGS_PANES.preview.rows as row (row.id)}
+								{@render settingRow(row)}
+							{/each}
 						</div>
 					{:else if activeCategory === 'appearance'}
 						<div class="settings-group">
 						<h2>{t('settings.appearanceSettings', settings.language)}</h2>
 
-						<div class="setting-item">
-							<label for="appearance-language">{t('settings.language', settings.language)}</label>
-							<div class="select-wrapper">
-								<select id="appearance-language" value={settings.language} onchange={(e) => settings.setLanguage(e.currentTarget.value as LanguageCode)}>
-									{#each getSupportedLanguages() as lang}
-										<option value={lang.code}>{lang.nativeName}</option>
-									{/each}
-								</select>
-								<svg
-									class="select-arrow"
-									width="12"
-									height="12"
-									viewBox="0 0 24 24"
-									fill="none"
-									stroke="currentColor"
-									stroke-width="2"
-									stroke-linecap="round"
-									stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-							</div>
-						</div>
-
-						<div class="setting-item">
-							<label for="appearance-theme">{t('settings.theme', settings.language)}</label>
-							<div class="select-wrapper">
-								<select id="appearance-theme" value={theme} onchange={(e) => onSetTheme?.(resolveTheme(e.currentTarget.value))}>
-									<option value="system">{t('settings.themeFollowSystem', settings.language)}</option>
-									<option value="light">{t('settings.themeDefaultLight', settings.language)}</option>
-									<option value="dark">{t('settings.themeDefaultDark', settings.language)}</option>
-									{#if savedVscodeThemes.length > 0}
-										<optgroup label={t('settings.vsCodeThemes', settings.language)}>
-											{#each savedVscodeThemes as themeOption}
-												<option value={`vscode:${themeOption}`}>{themeOption}</option>
-											{/each}
-										</optgroup>
-									{/if}
-								</select>
-								<svg
-									class="select-arrow"
-									width="12"
-									height="12"
-									viewBox="0 0 24 24"
-									fill="none"
-									stroke="currentColor"
-									stroke-width="2"
-									stroke-linecap="round"
-									stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-							</div>
-						</div>
-
-						{#if theme.startsWith('vscode:')}
-							<div class="setting-block">
-								<button class="reset-text-btn delete-theme" onclick={() => deleteTheme(theme.replace('vscode:', ''))}>
-									{t('settings.deleteSelectedTheme', settings.language)}
-								</button>
-							</div>
-						{/if}
-
-						<div class="setting-block">
-							<div class="setting-block-row">
-								<label for="theme-import">{t('settings.importVSCodeTheme', settings.language)}</label>
-								<button
-									class="reset-text-btn"
-									onclick={() =>
-										openUrl('https://vscodethemes.com/')
-											.catch(() => window.open('https://vscodethemes.com/', '_blank'))}
-								>
-									{t('settings.browseThemes', settings.language)}
-								</button>
-							</div>
-							<div class="setting-block-row">
-								<input
-									type="text"
-									id="theme-import"
-									class="text-input theme-import-url"
-									placeholder="https://vscodethemes.com/e/..."
-									bind:value={themeImportUrl}
-									onkeydown={e => e.key === 'Enter' && importVscodeTheme()}
-								/>
-								<button class="import-btn" onclick={importVscodeTheme} disabled={importingTheme || !themeImportUrl}>
-									{importingTheme ? t('settings.importing', settings.language) : t('settings.import', settings.language)}
-								</button>
-							</div>
-						</div>
-
-							<div class="setting-item">
-								<label for="appearance-tabs">{t('settings.showTabs', settings.language)}</label>
-								<label class="toggle">
-									<input id="appearance-tabs" type="checkbox" bind:checked={settings.showTabs} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item" class:inactive={!settings.showTabs}>
-								<label for="appearance-tab-position">{t('settings.tabPosition', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="appearance-tab-position" disabled={!settings.showTabs} bind:value={settings.tabPosition}>
-										<option value="top">{t('settings.tabPositionTop', settings.language)}</option>
-										<option value="left">{t('settings.tabPositionLeft', settings.language)}</option>
-										<option value="right">{t('settings.tabPositionRight', settings.language)}</option>
-									</select>
-									<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item" class:inactive={folderSideFollowsTabs}>
-								<label for="appearance-folder-side" title={folderSideFollowsTabs ? t('settings.folderSideFollowsTabs', settings.language) : ''}>{t('settings.folderSide', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="appearance-folder-side" disabled={folderSideFollowsTabs} bind:value={settings.folderSide}>
-										<option value="left">{t('settings.folderSideLeft', settings.language)}</option>
-										<option value="right">{t('settings.folderSideRight', settings.language)}</option>
-									</select>
-									<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item">
-								<label for="appearance-sidebar-stack">{t('settings.sidebarStackOrder', settings.language)}</label>
-								<div class="select-wrapper">
-									<select id="appearance-sidebar-stack" bind:value={settings.sidebarStackOrder}>
-										<option value="openFilesTop">{t('settings.sidebarStackOpenFilesTop', settings.language)}</option>
-										<option value="folderTop">{t('settings.sidebarStackFolderTop', settings.language)}</option>
-									</select>
-									<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</div>
-							</div>
-
-							<div class="setting-item">
-								<label for="appearance-folder-all-files" title={t('settings.folderShowAllFilesHint', settings.language)}>{t('settings.folderShowAllFiles', settings.language)}</label>
-								<label class="toggle">
-									<input id="appearance-folder-all-files" type="checkbox" bind:checked={settings.folderShowAllFiles} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item" class:inactive={!settings.showTabs}>
-								<label for="appearance-duplicate-name-folder">{t('settings.showFolderForDuplicateNames', settings.language)}</label>
-								<label class="toggle">
-									<input id="appearance-duplicate-name-folder" type="checkbox" disabled={!settings.showTabs} bind:checked={settings.showFolderForDuplicateNames} />
-									<span class="toggle-slider"></span>
-								</label>
-							</div>
-
-							<div class="setting-item">
-							<label for="appearance-toc">{t('settings.showTableOfContents', settings.language)}</label>
-							<label class="toggle">
-								<input id="appearance-toc" type="checkbox" bind:checked={settings.showToc} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="appearance-toc-follows">{t('settings.tocFollows', settings.language)}</label>
-							<div class="select-wrapper">
-								<select id="appearance-toc-follows" bind:value={settings.tocFollows}>
-									<option value="scroll">{t('settings.tocFollowsScroll', settings.language)}</option>
-									<option value="cursor">{t('settings.tocFollowsCursor', settings.language)}</option>
-								</select>
-								<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-							</div>
-						</div>
-
-						<div class="setting-item">
-							<label for="appearance-animate-jump">{t('settings.animateJumpScroll', settings.language)}</label>
-							<label class="toggle">
-								<input id="appearance-animate-jump" type="checkbox" bind:checked={settings.animateJumpScroll} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="appearance-animate-cursor">{t('settings.animateCursor', settings.language)}</label>
-							<label class="toggle">
-								<input id="appearance-animate-cursor" type="checkbox" bind:checked={settings.animateCursor} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="appearance-highlight-color">{t('settings.highlightColor', settings.language)}</label>
-							<div class="custom-dropdown-wrapper">
-								<button 
-									class="custom-dropdown-btn" 
-									onclick={(e) => { e.stopPropagation(); highlightMenuOpen = !highlightMenuOpen; }}>
-										<div style="display: flex; align-items: center; gap: 8px;">
-										<div class="color-circle" style="background-color: {highlightColors.find(c => c.value === settings.highlightColor)?.color || 'var(--color-accent-fg)'}"></div>
-										<span>{t(`colors.${settings.highlightColor || 'default'}`, settings.language)}</span>
-									</div>
-										<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-								</button>
-								{#if highlightMenuOpen}
-									<div
-										class="custom-dropdown-menu"
-										role="menu"
-										tabindex="-1"
-										transition:fly={{ y: 5, duration: 150 }}
-										onclick={(e) => e.stopPropagation()}
-										onkeydown={(e) => {
-											if (e.key === 'Escape') highlightMenuOpen = false;
-										}}>
-										{#each highlightColors as color, index}
-											{#if index === 1}
-												<div class="theme-menu-divider" style="height: 1px; background-color: var(--color-border-muted); margin: 4px 0; transform: scaleY(0.5);"></div>
-											{/if}
-											<button 
-													class="custom-dropdown-option {settings.highlightColor === color.value ? 'selected' : ''}" 
-													onclick={() => {
-														settings.highlightColor = color.value;
-														highlightMenuOpen = false;
-													}}
-												>
-													<div class="color-circle" style="background-color: {color.color}"></div>
-													<span>{t(`colors.${color.value}`, settings.language)}</span>
-												</button>
-										{/each}
-									</div>
-								{/if}
-							</div>
-					</div>
-
-					<div class="setting-item">
-						<label for="appearance-zen-mode" class="has-hint">{t('settings.zenMode', settings.language)}<span class="setting-hint">{t('settings.zenModeHint', settings.language)}</span></label>
-						<label class="toggle">
-							<input id="appearance-zen-mode" type="checkbox" checked={settings.zenMode} onchange={() => settings.toggleZenMode()} />
-							<span class="toggle-slider"></span>
-						</label>
-					</div>
-
-					<div class="setting-item">
-						<label for="appearance-focus-mode" class="has-hint">{t('settings.focusMode', settings.language)}<span class="setting-hint">{t('settings.focusModeHint', settings.language)}</span></label>
-						<label class="toggle">
-							<input id="appearance-focus-mode" type="checkbox" bind:checked={settings.focusMode} />
-							<span class="toggle-slider"></span>
-						</label>
-					</div>
-
-					<div class="setting-item">
-						<label for="appearance-typewriter-mode" class="has-hint">{t('settings.typewriterMode', settings.language)}<span class="setting-hint">{t('settings.typewriterModeHint', settings.language)}</span></label>
-						<label class="toggle">
-							<input id="appearance-typewriter-mode" type="checkbox" bind:checked={settings.typewriterMode} />
-							<span class="toggle-slider"></span>
-						</label>
-					</div>
+						{#each SETTINGS_PANES.appearance.rows as row (row.id)}
+							{@render settingRow(row)}
+						{/each}
 					</div>
 					{:else if activeCategory === 'toolbars'}
 					<div class="settings-group">
@@ -1610,105 +1200,9 @@
 							<h2>{t('settings.fileSettings', settings.language)}</h2>
 						</div>
 
-						<div class="setting-item">
-							<label for="files-open-file-mode">{t('settings.openFileMode', settings.language)}</label>
-							<div class="select-wrapper">
-								<select id="files-open-file-mode" bind:value={settings.openFileMode}>
-									<option value="preview">{t('settings.preview', settings.language)}</option>
-									<option value="editor">{t('settings.editor', settings.language)}</option>
-									<option value="split">{t('menu.splitView', settings.language)}</option>
-								</select>
-								<svg class="select-arrow" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
-							</div>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-new-file-mode">{t('settings.newFileDefaultMode', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-new-file-mode" type="checkbox" bind:checked={settings.newFileDefaultMode} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-links-new-tab">{t('settings.linksOpenInNewTab', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-links-new-tab" type="checkbox" bind:checked={settings.linksOpenInNewTab} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-recent-files">{t('settings.showRecentFiles', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-recent-files" type="checkbox" bind:checked={settings.showRecentFiles} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-auto-save">{t('settings.autoSave', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-auto-save" type="checkbox" bind:checked={settings.autoSave} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-restore-state" title={t('settings.restoreStateOnReopenHint', settings.language)}>{t('settings.restoreStateOnReopen', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-restore-state" type="checkbox" bind:checked={settings.restoreStateOnReopen} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="files-recovery" title={t('settings.persistOpenEditorsHint', settings.language)}>{t('settings.persistOpenEditors', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-recovery" type="checkbox" bind:checked={settings.persistOpenEditors} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="image-directory">{t('settings.imageDirectory', settings.language)}</label>
-							<input
-								type="text"
-								id="image-directory"
-								class="text-input"
-								style="width: 120px;"
-								bind:value={settings.imageDirectory}
-								placeholder="img"
-								title={t('settings.imageDirectoryHint', settings.language)}
-							/>
-						</div>
-
-						{#if settings.osType === 'macos'}
-							<div class="setting-item">
-								<label for="macos-image-scaling">{t('settings.scaleMacOSScreenshots', settings.language)}</label>
-								<label class="toggle">
-									<input id="macos-image-scaling" type="checkbox" bind:checked={settings.macosImageScaling} />
-									<span class="toggle-slider"></span>
-								</label>
-								<span class="slider-value">{t('settings.reduceSizeBy50', settings.language)}</span>
-							</div>
-						{/if}
-
-						<div class="setting-item">
-							<label for="files-close-window-last-tab">{t('settings.closeWindowWithLastTab', settings.language)}</label>
-							<label class="toggle">
-								<input id="files-close-window-last-tab" type="checkbox" bind:checked={settings.closeWindowWithLastTab} />
-								<span class="toggle-slider"></span>
-							</label>
-						</div>
-
-						<div class="setting-item">
-							<label for="settings-file-import">{t('settings.settingsFile', settings.language)}</label>
-							<div class="settings-file-actions">
-								<button id="settings-file-import" class="import-btn" onclick={importSettingsFile}>{t('settings.importSettings', settings.language)}</button>
-								<button class="import-btn" onclick={exportSettingsFile}>{t('settings.exportSettings', settings.language)}</button>
-							</div>
-						</div>
+						{#each SETTINGS_PANES.files.rows as row (row.id)}
+							{@render settingRow(row)}
+						{/each}
 					</div>
 					{:else if activeCategory === 'shortcuts'}
 					<!--
diff --git a/src/lib/components/Tab.svelte b/src/lib/components/Tab.svelte
index e4948030..9f620917 100644
--- a/src/lib/components/Tab.svelte
+++ b/src/lib/components/Tab.svelte
@@ -10,6 +10,7 @@
 	import { isHomePath } from '../utils/homeTab.js';
 	import { modifierFor, shortcutLabel } from '../utils/shortcuts.js';
 	import { windowDisplay, type ViewerWindowEntry } from '../utils/viewerWindows.js';
+	import { tabMenuItems } from '../utils/tabContextMenu.js';
 
 	let { tab, folderSuffix, isActive, onclick, onclose, vertical = false } = $props<{
 		tab: Tab;
@@ -83,10 +84,6 @@
 		e.stopPropagation();
 
 		const currentLang = settings.language;
-		// ContextMenu prints `shortcut` into the same `<span class="menu-shortcut">`
-		// the app menu uses, so a literal here sits a keystroke away from the app
-		// menu's registry-derived chord and disagrees with it on macOS.
-		const modifier = modifierFor(settings.osType);
 		const fileActionItems: ContextMenuItem[] = getTabFileActions(tab.path).map((action) => ({
 			label: t(action.labelKey, currentLang),
 			disabled: action.disabled,
@@ -112,32 +109,15 @@
 			show: true,
 			x: e.clientX,
 			y: e.clientY,
-			items: [
-				{ label: t('menu.newFile', currentLang), shortcut: shortcutLabel('file-new', modifier), onClick: () => emitTo(selfLabel, 'menu-tab-new') },
-				{ label: t('menu.undoCloseTab', currentLang), shortcut: shortcutLabel('tab-undo-close', modifier), onClick: () => emitTo(selfLabel, 'menu-tab-undo') },
-				{
-					label: t('menu.rename', currentLang),
-					// Rename renames the file on disk; untitled and home tabs have
-					// no file.
-					disabled: !hasRealFilePath(tab.path),
-					onClick: () => emitTo(selfLabel, 'menu-tab-rename', tab.id),
-				},
-				{ separator: true },
-				...fileActionItems,
-				{ separator: true },
-				{
-					label: t('menu.moveToNewWindow', currentLang),
-					// Moving the only tab would just churn windows, and the home
-					// tab is recreatable anywhere; both stay in place.
-					disabled: isHomePath(tab.path) || tabManager.tabs.length < 2,
-					onClick: () => emitTo(selfLabel, 'menu-tab-detach', tab.id),
-				},
-				...moveToWindowItems,
-				{ separator: true },
-				{ label: t('menu.closeFile', currentLang), shortcut: shortcutLabel('file-close', modifier), onClick: () => emitTo(selfLabel, 'menu-tab-close', tab.id) },
-				{ label: t('menu.closeOtherTabs', currentLang), onClick: () => emitTo(selfLabel, 'menu-tab-close-others', tab.id) },
-				{ label: t('menu.closeTabsToRight', currentLang), onClick: () => emitTo(selfLabel, 'menu-tab-close-right', tab.id) },
-			],
+			items: tabMenuItems({
+				tab,
+				language: currentLang,
+				osType: settings.osType,
+				tabCount: tabManager.tabs.length,
+				fileActionItems,
+				moveToWindowItems,
+				emit: (event, payload) => emitTo(selfLabel, event, payload),
+			}),
 		};
 	}
 
diff --git a/src/lib/components/TabList.svelte b/src/lib/components/TabList.svelte
index abe7dec3..8a9694a5 100644
--- a/src/lib/components/TabList.svelte
+++ b/src/lib/components/TabList.svelte
@@ -7,6 +7,7 @@
 	import { emitTo } from '@tauri-apps/api/event';
 	import { getCurrentWindow } from '@tauri-apps/api/window';
 	import { modifierFor, shortcutLabel } from '../utils/shortcuts.js';
+	import { tabListMenuItems } from '../utils/tabContextMenu.js';
 	import { duplicateNameSuffixes } from '../utils/duplicateTabNames.js';
 	import { closestSlotIndex, dragDistance } from '../utils/tabReorder.js';
 
@@ -183,16 +184,11 @@
 		if (e.target !== e.currentTarget && !(e.target as HTMLElement).classList.contains('tab-list-spacer')) return;
 		e.preventDefault();
 
-		const currentLang = settings.language;
-		const modifier = modifierFor(settings.osType);
 		tabListContextMenu = {
 			show: true,
 			x: e.clientX,
 			y: e.clientY,
-			items: [
-				{ label: t('menu.newFile', currentLang), shortcut: shortcutLabel('file-new', modifier), onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-new') },
-				{ label: t('menu.undoCloseTab', currentLang), shortcut: shortcutLabel('tab-undo-close', modifier), onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-undo') },
-			]
+			items: tabListMenuItems(settings.language, settings.osType, (event) => emitTo(getCurrentWindow().label, event)),
 		};
 	}
 </script>
diff --git a/src/lib/components/TitleBar.svelte b/src/lib/components/TitleBar.svelte
index f80e3156..b6b13d91 100644
--- a/src/lib/components/TitleBar.svelte
+++ b/src/lib/components/TitleBar.svelte
@@ -9,11 +9,12 @@
 	import { settings } from '../stores/settings.svelte.js';
 	import { t } from '../utils/i18n.js';
 	import { getConfiguredTitlebarToolbarIds, visibleTitlebarActionIds, type ViewMode, viewModeOf } from '../utils/titlebarToolbar.js';
-	import { modifierFor, shortcutLabel } from '../utils/shortcuts.js';
-	import { platformOf } from '../utils/platform.js';
-	import { hasExportableDocument, hasRealFilePath } from '../utils/tabFileActions.js';
+	import { shortcutLabel } from '../utils/shortcuts.js';
+	import { TitleBarPlatform } from '../stores/titleBarPlatform.svelte.js';
+	import { canExportTab } from '../utils/tabFileActions.js';
 	import { openNewWindow, openPinnedTagWindow } from '../utils/pinnedTagWindow.js';
 	import { getVersion } from '@tauri-apps/api/app';
+	import { TAG_COLORS, TitleBarPopovers, containClick, scopeLine } from '../stores/titleBarPopovers.svelte.js';
 
 	let currentLanguage = $derived(settings.language);
 
@@ -112,154 +113,15 @@
 	let innerWidth = $state(1000);
 	let isCollapsed = $derived(innerWidth <= 450 || settings.zenMode);
 
-	// The platform comes from `settings.osType` — the Rust `get_os_type` answer
-	// the rest of the app already reads — rather than from this component's own
-	// user-agent sniff for "Macintosh", which was a second source that could
-	// disagree with it. `platformOf` covers the window before that
-	// command answers; see the comment on it for why the title bar cannot simply
-	// read `settings.osType` directly without flashing Windows chrome on a Mac.
-	//
-	// `$derived` rather than plain consts: the source is now reactive state, and
-	// `osType` can change once after mount (unknown → resolved). At plain consts
-	// the title bar would keep whatever the fallback said and never correct
-	// itself on a machine where the two do differ.
-	let platform = $derived(platformOf(settings.osType));
-	let isMac = $derived(platform === 'macos');
-	let modifier = $derived(modifierFor(platform));
+	const titleBarPlatform = new TitleBarPlatform();
+	let isMac = $derived(titleBarPlatform.isMac);
+	let modifier = $derived(titleBarPlatform.modifier);
 
 	let isWin11 = $state(false);
-	const tagColors = ['#5f6368', '#1a73e8', '#d93025', '#f9ab00', '#188038', '#d01884', '#a142f4', '#007b83'];
-	let tagEditorOpen = $state(false);
-	let tagDraftName = $state('');
-	let tagDraftColor = $state(tagColors[1]);
-	let tagError = $state('');
+	const popovers = new TitleBarPopovers();
 
 	export function openTagEditor() {
-		tagDraftName = tabManager.windowTag?.name ?? '';
-		tagDraftColor = tabManager.windowTag?.color ?? tagColors[1];
-		tagError = '';
-		tagEditorOpen = true;
-	}
-
-	/**
-	 * Whether a *different* live window already carries this name.
-	 *
-	 * Asked here — when the popover commits, the moment the user names the window — and
-	 * nowhere else. In particular not at session restore: a snapshot written by
-	 * an older build can legitimately contain two windows under one name, and
-	 * refusing it there would clear a tag the user set, silently, at a moment
-	 * they are not even looking at the popover. Leaving a restored duplicate
-	 * alone costs at most a confusing pair of chips; rejecting it costs state
-	 * the user cannot get back.
-	 *
-	 * A backend that cannot answer means the user's own save goes through. The
-	 * check exists to stop one window from quietly overwriting another's pinned
-	 * documents, and an IPC failure is not evidence that it would.
-	 */
-	async function tagNameTakenElsewhere(name: string): Promise<boolean> {
-		try {
-			return (await invoke('is_window_tag_taken', { name })) === true;
-		} catch (error) {
-			console.error('Failed to check window tag exclusivity', error);
-			return false;
-		}
-	}
-
-	/**
-	 * Commit the draft and close. There is no Save button: Enter, a click
-	 * elsewhere and the chip all land here, so leaving the popover is what
-	 * saves it. Escape is the one exit that discards.
-	 *
-	 * An empty name keeps the stored tag. Clearing the field used to remove
-	 * the tag, which was harmless behind an explicit Save but would make a
-	 * stray click outside a way to delete a pinned session. Remove Tag is the
-	 * only exit that removes a tag.
-	 */
-	async function applyTag() {
-		const name = tagDraftName.trim();
-		const tag = tabManager.windowTag;
-		if (!name || (tag && name === tag.name && tagDraftColor === tag.color)) {
-			tagEditorOpen = false;
-			tagError = '';
-			return;
-		}
-		if (await tagNameTakenElsewhere(name)) {
-			// Refused in place, with the popover still open on the name that was
-			// refused: this is a correction the user makes in the field they are
-			// already in, not news to be delivered somewhere else.
-			tagError = t('menu.windowTagTaken', currentLanguage);
-			return;
-		}
-		let pinned = tag?.pinned;
-		// The closing save refreshes the pin by the window's current name, so a
-		// rename has to reach the pin file first or the window unpins at close.
-		// A colour change needs nothing here: the closing save carries it.
-		if (tag?.pinned && name !== tag.name) {
-			const renamed = await invoke('rename_pinned_tag', { oldName: tag.name, name, color: tagDraftColor }).catch((error) => {
-				console.error('Failed to rename the pinned tag', error);
-				return 'failed';
-			});
-			if (renamed === 'taken') {
-				tagError = t('menu.pinnedTagTaken', currentLanguage);
-				return;
-			}
-			pinned = renamed === 'renamed';
-		}
-		tabManager.setWindowTag({ name, color: tagDraftColor, pinned });
-		tagEditorOpen = false;
-		tagError = '';
-	}
-
-	/**
-	 * Right-click the chip: the same popover left-click opens.
-	 *
-	 * The chip borrows Chrome's tab-group chip visually, but not the state that
-	 * makes Chrome's left/right division necessary. There, left-click collapses
-	 * and expands the group, so the commands need somewhere else to live. A
-	 * window tag has nothing to collapse — it scopes the whole window — so
-	 * left-click has no second job, and putting Pin/Remove behind a right-click
-	 * would only hide them behind a gesture with no affordance advertising it.
-	 * The one thing right-click does owe the user is not raising the platform
-	 * menu over the title bar, hence `preventDefault`.
-	 *
-	 * It opens but never closes, unlike the left-click toggle. `openTagEditor`
-	 * re-seeds the draft from the stored tag, so re-opening an open popover
-	 * would throw away a name the user is in the middle of typing; and a
-	 * gesture whose whole purpose is "show me the tag's controls" should not
-	 * sometimes hide them. `stopPropagation` for the same reason the chip's
-	 * left-click has one: `handleGlobalDismiss` is wired to window
-	 * `contextmenu`, and would otherwise dismiss the popover this just opened.
-	 */
-	function openTagEditorFromContextMenu(event: MouseEvent) {
-		event.preventDefault();
-		event.stopPropagation();
-		if (!tagEditorOpen) openTagEditor();
-	}
-
-	function clearTag() {
-		const tag = tabManager.windowTag;
-		if (tag?.pinned) invoke('remove_pinned_tag', { name: tag.name }).catch(console.error);
-		tabManager.setWindowTag(null);
-		tagEditorOpen = false;
-	}
-
-	async function togglePinnedTag() {
-		const tag = tabManager.windowTag;
-		if (!tag) return;
-		if (tag.pinned) {
-			invoke('remove_pinned_tag', { name: tag.name }).catch(console.error);
-			tabManager.setWindowTag({ ...tag, pinned: false });
-			return;
-		}
-		const files = tabManager.tabs.filter((tab) => hasRealFilePath(tab.path)).map((tab) => tab.path);
-		// A pinned group whose window is closed still holds its name, and
-		// pinning over it would replace its files. Refused the way a rename is.
-		const created = await invoke('save_pinned_tag', { name: tag.name, color: tag.color, files }).catch(console.error);
-		if (created === false) {
-			tagError = t('menu.pinnedTagTaken', currentLanguage);
-			return;
-		}
-		tabManager.setWindowTag({ ...tag, pinned: true });
+		popovers.openTagEditor();
 	}
 
 	$effect(() => {
@@ -295,7 +157,7 @@
 	});
 
 	function showTooltip(e: MouseEvent, text: string, shortcut: string | undefined = '', force: boolean = false) {
-		if (!force && (kebabMenuOpen || homeMenuOpen)) return;
+		if (!force && (popovers.kebabMenuOpen || popovers.homeMenuOpen)) return;
 		const target = e.currentTarget as HTMLElement;
 		const rect = target.getBoundingClientRect();
 		const windowWidth = window.innerWidth;
@@ -337,7 +199,7 @@
 			}
 
 			const kebabBtn = document.querySelector('.kebab-btn') as HTMLElement;
-			if (kebabBtn && !kebabMenuOpen && !homeMenuOpen && !themeMenuOpen) {
+			if (kebabBtn && !popovers.kebabMenuOpen && !popovers.homeMenuOpen && !popovers.themeMenuOpen) {
 				const rect = kebabBtn.getBoundingClientRect();
 				tooltip.text = `${zoomLevel}%`;
 				tooltip.shortcut = '';
@@ -384,13 +246,10 @@
 		),
 	);
 
-	let themeMenuOpen = $state(false);
-	let kebabMenuOpen = $state(false);
-	let homeMenuOpen = $state(false);
 	let pinnedTags = $state<Array<{ name: string; color: string }>>([]);
 
 	$effect(() => {
-		if (!homeMenuOpen) return;
+		if (!popovers.homeMenuOpen) return;
 		invoke<Array<{ name: string; color: string }>>('list_pinned_tags')
 			.then((tags) => (pinnedTags = tags))
 			.catch(console.error);
@@ -399,7 +258,7 @@
 	let savedVscodeThemes = $state<string[]>([]);
 	
 	$effect(() => {
-		if (themeMenuOpen) {
+		if (popovers.themeMenuOpen) {
 			invoke('get_saved_vscode_themes')
 				.then((themes) => {
 					savedVscodeThemes = themes as string[];
@@ -418,28 +277,10 @@
 
 	function handleSetTheme(t: string) {
 		if (onSetTheme) onSetTheme(t);
-		themeMenuOpen = false;
-	}
-
-	function handleGlobalDismiss() {
-		themeMenuOpen = false;
-		kebabMenuOpen = false;
-		homeMenuOpen = false;
-		if (tagEditorOpen) applyTag();
+		popovers.themeMenuOpen = false;
 	}
 
-	$effect(() => {
-		if (themeMenuOpen || kebabMenuOpen || homeMenuOpen || tagEditorOpen) {
-			window.addEventListener('click', handleGlobalDismiss);
-			window.addEventListener('contextmenu', handleGlobalDismiss);
-			window.addEventListener('blur', handleGlobalDismiss);
-		}
-		return () => {
-			window.removeEventListener('click', handleGlobalDismiss);
-			window.removeEventListener('contextmenu', handleGlobalDismiss);
-			window.removeEventListener('blur', handleGlobalDismiss);
-		};
-	});
+	$effect(() => popovers.listenForDismiss(window));
 </script>
 
 <svelte:window bind:innerWidth />
@@ -451,19 +292,19 @@
 	<div class="window-controls-left" data-tauri-drag-region>
 		<div class="home-menu-container" role="presentation">
 			<button
-				class="icon-home-btn {homeMenuOpen ? 'active' : ''}"
+				class="icon-home-btn {popovers.homeMenuOpen ? 'active' : ''}"
 				onclick={(e) => {
 					e.stopPropagation();
-					homeMenuOpen = !homeMenuOpen;
-					if (homeMenuOpen) {
-						themeMenuOpen = false;
-						kebabMenuOpen = false;
+					popovers.homeMenuOpen = !popovers.homeMenuOpen;
+					if (popovers.homeMenuOpen) {
+						popovers.themeMenuOpen = false;
+						popovers.kebabMenuOpen = false;
 						hideTooltip();
 					}
 				}}
 				aria-label={t('tooltip.menu', currentLanguage)}
 			onmouseenter={(e) => {
-							if (!homeMenuOpen) showTooltip(e, t('tooltip.menu', currentLanguage));
+							if (!popovers.homeMenuOpen) showTooltip(e, t('tooltip.menu', currentLanguage));
 						}}
 				onmousedown={(e) => e.preventDefault()}
 				onmouseleave={hideTooltip}>
@@ -473,20 +314,20 @@
 					class="window-icon"
 					style:filter={theme === 'dark' || (theme === 'system' && window.matchMedia('(prefers-color-scheme: dark)').matches) ? 'none' : 'invert(0.7)'} />
 			</button>
-			{#if homeMenuOpen}
+			{#if popovers.homeMenuOpen}
 				<div
 					class="home-dropdown-menu"
 					role="menu"
 					tabindex="-1"
 					transition:fly={{ y: 5, duration: 150 }}
-					onclick={(e) => e.stopPropagation()}
+					onclick={containClick}
 					onkeydown={(e) => {
-						if (e.key === 'Escape') homeMenuOpen = false;
+						if (e.key === 'Escape') popovers.homeMenuOpen = false;
 					}}>
 					<button
 				class="home-menu-item"
 				onclick={() => {
-					homeMenuOpen = false;
+					popovers.homeMenuOpen = false;
 					ontoggleHome();
 				}}>
 				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -497,7 +338,7 @@
 					<button
 				class="home-menu-item"
 				onclick={() => {
-					homeMenuOpen = false;
+					popovers.homeMenuOpen = false;
 					onnewFile?.();
 				}}>
 				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -513,7 +354,7 @@
 			<button
 				class="home-menu-item"
 				onclick={() => {
-					homeMenuOpen = false;
+					popovers.homeMenuOpen = false;
 					openNewWindow().catch(console.error);
 				}}>
 				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -524,7 +365,7 @@
 			<button
 				class="home-menu-item"
 				onclick={() => {
-					homeMenuOpen = false;
+					popovers.homeMenuOpen = false;
 					onopenFile?.();
 				}}>
 				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -540,7 +381,7 @@
 			<button
 				class="home-menu-item"
 				onclick={() => {
-					homeMenuOpen = false;
+					popovers.homeMenuOpen = false;
 					onopenFolder?.();
 				}}>
 				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -551,7 +392,7 @@
 						<button
 						class="home-menu-item"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							onsaveFile?.();
 						}}>
 						<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -564,7 +405,7 @@
 					<button
 						class="home-menu-item"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							onsaveFileAs?.();
 						}}>
 						<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -578,7 +419,7 @@
 						<button
 							class="home-menu-item"
 							onclick={() => {
-								homeMenuOpen = false;
+								popovers.homeMenuOpen = false;
 								onreloadFromDisk?.();
 							}}>
 							<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -588,21 +429,12 @@
 						</button>
 					{/if}
 					{/if}
-					<!--
-						`rawContent`, not `content`: the exports read the Markdown buffer
-						(`exportAsHtml` returns null on an empty `ctx.rawContent`), while
-						`content` is the rendered-preview HTML, refreshed only while the
-						preview is on screen. In plain edit mode with the TOC closed —
-						the default state of a new file — `content` is still empty for a
-						buffer that has never been rendered, so gating on it hid an export
-						that would have produced a file.
-					-->
-					{#if hasExportableDocument(tabManager.activeTab?.rawContent)}
+					{#if canExportTab(tabManager.activeTab)}
 						<div class="home-menu-divider"></div>
 						<button
 						class="home-menu-item"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							onexportHtml?.();
 						}}>
 						<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -612,7 +444,7 @@
 					<button
 						class="home-menu-item"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							onexportPdf?.();
 						}}>
 						<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -624,16 +456,13 @@
 					<div class="home-menu-divider"></div>
 					<button
 						class="home-menu-item"
-						onclick={() => {
-							homeMenuOpen = false;
-							openTagEditor();
-						}}>
+						onclick={() => popovers.openTagEditorFromHomeMenu()}>
 						{t('menu.setWindowTag', currentLanguage)}
 					</button>
 					<button
 						class="home-menu-item"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							onmergeAllWindows?.();
 						}}>
 						{t('menu.mergeAllWindows', currentLanguage)}
@@ -644,7 +473,7 @@
 							<button
 								class="home-menu-item"
 								onclick={() => {
-									homeMenuOpen = false;
+									popovers.homeMenuOpen = false;
 									openPinnedTagWindow(tag.name).catch(console.error);
 								}}>
 								<span class="pinned-tag-dot" style:--tag-color={tag.color}></span>
@@ -656,7 +485,7 @@
 					<button
 					class="home-menu-item"
 					onclick={() => {
-						homeMenuOpen = false;
+						popovers.homeMenuOpen = false;
 						onexit?.();
 					}}>
 					<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
@@ -668,7 +497,7 @@
 					<button
 						class="home-menu-footer"
 						onclick={() => {
-							homeMenuOpen = false;
+							popovers.homeMenuOpen = false;
 							openUrl('https://github.com/alecdotdev/Markpad')
 								.catch(() => window.open('https://github.com/alecdotdev/Markpad', '_blank'));
 						}}>
@@ -683,42 +512,35 @@
 			<button
 				class="window-tag-chip"
 				style:--tag-color={tabManager.windowTag.color}
-				oncontextmenu={openTagEditorFromContextMenu}
-				onclick={(event) => {
-					event.stopPropagation();
-					if (tagEditorOpen) applyTag();
-					else openTagEditor();
-				}}>
+				oncontextmenu={(event) => popovers.openTagEditorFromContextMenu(event)}
+				onclick={(event) => popovers.toggleTagEditor(event)}>
 				{tabManager.windowTag.name}
 			</button>
 		{/if}
-		{#if tagEditorOpen}
+		{#if popovers.tagEditorOpen}
 			<div
 				class="tag-editor"
 				role="dialog"
 				tabindex="-1"
-				onclick={(event) => event.stopPropagation()}
-				onkeydown={(event) => {
-					if (event.key === 'Escape') tagEditorOpen = false;
-					else if (event.key === 'Enter') applyTag();
-				}}>
+				onclick={containClick}
+				onkeydown={(event) => popovers.editorKeydown(event)}>
 				<!-- svelte-ignore a11y_autofocus -->
 				<input
 					autofocus
 					spellcheck="false"
 					placeholder={t('menu.windowTagPlaceholder', currentLanguage)}
-					bind:value={tagDraftName}
-					oninput={() => (tagError = '')} />
-				{#if tagError}<p class="tag-error" role="alert">{tagError}</p>{/if}
+					bind:value={popovers.tagDraftName}
+					oninput={() => popovers.nameEdited()} />
+				{#if popovers.tagError}<p class="tag-error" role="alert">{popovers.tagError}</p>{/if}
 				<div class="tag-colors">
-					{#each tagColors as color}
-						<button class:selected={tagDraftColor === color} style:--tag-color={color} onclick={() => (tagDraftColor = color)} aria-label={color}></button>
+					{#each TAG_COLORS as color}
+						<button class:selected={popovers.tagDraftColor === color} style:--tag-color={color} onclick={() => (popovers.tagDraftColor = color)} aria-label={color}></button>
 					{/each}
 				</div>
-				{#if tabManager.windowTag}
+				{#if popovers.tagActions}
 					<div class="home-menu-divider"></div>
-					<button class="home-menu-item" onclick={togglePinnedTag}>
-						{#if tabManager.windowTag.pinned}
+					<button class="home-menu-item" onclick={() => popovers.togglePinnedTag()}>
+						{#if popovers.tagActions.pinned}
 							<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
 								><path d="M12 17v5" /><path d="M15 9.34V7a1 1 0 0 1 1-1 2 2 0 0 0 0-4H7.89" /><path d="m2 2 20 20" /><path
 									d="M9 9v1.76a2 2 0 0 1-1.11 1.79l-1.78.9A2 2 0 0 0 5 15.24V16a1 1 0 0 0 1 1h11" /></svg>
@@ -727,18 +549,17 @@
 								><path d="M12 17v5" /><path
 									d="M9 10.76a2 2 0 0 1-1.11 1.79l-1.78.9A2 2 0 0 0 5 15.24V16a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-.76a2 2 0 0 0-1.11-1.79l-1.78-.9A2 2 0 0 1 15 10.76V7a1 1 0 0 1 1-1 2 2 0 0 0 0-4H8a2 2 0 0 0 0 4 1 1 0 0 1 1 1z" /></svg>
 						{/if}
-						{t(tabManager.windowTag.pinned ? 'menu.unpinWindowTag' : 'menu.pinWindowTag', currentLanguage)}
+						{t(popovers.tagActions.pinned ? 'menu.unpinWindowTag' : 'menu.pinWindowTag', currentLanguage)}
 					</button>
-					<!-- Only a pinned tag can be closed: closing saves the pin and Home reopens it. An unpinned tag would be gone for good, which is Remove Tag's job. -->
-					{#if tabManager.windowTag.pinned}
-						<button class="home-menu-item" onclick={() => { tagEditorOpen = false; onclosetag?.(); }}>
+					{#if popovers.tagActions.canClose}
+						<button class="home-menu-item" onclick={() => { popovers.tagEditorOpen = false; onclosetag?.(); }}>
 							<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
 								><rect width="18" height="18" x="3" y="3" rx="2" ry="2" /><path d="m15 9-6 6" /><path d="m9 9 6 6" /></svg>
 							{t('menu.closeWindowTag', currentLanguage)}
 						</button>
 					{/if}
 					<div class="home-menu-divider"></div>
-					<button class="home-menu-item" onclick={clearTag}>
+					<button class="home-menu-item" onclick={() => popovers.clearTag()}>
 						<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
 							><path d="M21 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h6" /><path d="m21 3-9 9" /><path d="M15 3h6v6" /></svg>
 						{t('menu.windowTagClear', currentLanguage)}
@@ -750,7 +571,7 @@
 
 	<!-- With the tabs in a side column (#884) the bar shows the window title, as it does with tabs hidden. -->
 	{#if tabManager.tabs.length > 0 && settings.tabPlacement === 'top'}
-		<div class="tab-area" class:tagged={tabManager.windowTag !== null} style:--tag-color={tabManager.windowTag?.color}>
+		<div class="tab-area" class:tagged={scopeLine(tabManager.windowTag).tagged} style:--tag-color={scopeLine(tabManager.windowTag).color}>
 			<TabList onnewTab={() => tabManager.addNewTab()} {showHome} {ontabclick} {oncloseTab} />
 		</div>
 	{:else}
@@ -766,17 +587,17 @@
 	<div class="title-actions-container {isCollapsed ? 'collapsed' : ''}" data-tauri-drag-region>
 		{#snippet kebabButton()}
 			<button
-				class="kebab-btn {kebabMenuOpen ? 'active' : ''}"
+				class="kebab-btn {popovers.kebabMenuOpen ? 'active' : ''}"
 				onclick={(e) => {
 					e.stopPropagation();
-					kebabMenuOpen = !kebabMenuOpen;
-					if (kebabMenuOpen) {
-						themeMenuOpen = false;
+					popovers.kebabMenuOpen = !popovers.kebabMenuOpen;
+					if (popovers.kebabMenuOpen) {
+						popovers.themeMenuOpen = false;
 						hideTooltip();
 					}
 				}}
 				onmouseenter={(e) => {
-							if (!kebabMenuOpen) showTooltip(e, t('tooltip.more', currentLanguage));
+							if (!popovers.kebabMenuOpen) showTooltip(e, t('tooltip.more', currentLanguage));
 						}}
 				onmousedown={(e) => e.preventDefault()}
 				onmouseleave={hideTooltip}
@@ -796,7 +617,7 @@
 						class="title-action-btn {showHome ? 'active' : ''}"
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							ontoggleHome();
 						}}
 						aria-label={t('menu.home', currentLanguage)}
@@ -815,7 +636,7 @@
 						disabled={!canGoBack}
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							onback?.();
 						}}
 						aria-label={t('tooltip.back', currentLanguage)}
@@ -835,7 +656,7 @@
 						disabled={!canGoForward}
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							onforward?.();
 						}}
 						aria-label={t('tooltip.forward', currentLanguage)}
@@ -854,7 +675,7 @@
 						class="title-action-btn"
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							onopenSettings?.();
 						}}
 						aria-label={t('tooltip.settings', currentLanguage)}
@@ -931,7 +752,7 @@
 						class="title-action-btn"
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							onfind?.();
 						}}
 						aria-label={t('tooltip.find', currentLanguage)}
@@ -972,7 +793,7 @@
 								aria-pressed={currentViewMode === mode.id}
 								onclick={() => {
 									hideTooltip();
-									kebabMenuOpen = false;
+									popovers.kebabMenuOpen = false;
 									onsetViewMode(mode.id);
 								}}
 								aria-label={mode.label}
@@ -1040,7 +861,7 @@
 						class="title-action-btn"
 						onclick={() => {
 							hideTooltip();
-							kebabMenuOpen = false;
+							popovers.kebabMenuOpen = false;
 							onreloadFromDisk?.();
 						}}
 						aria-label={t('tooltip.reloadFromDisk', currentLanguage)}
@@ -1083,15 +904,15 @@
 				{:else if id === 'theme'}
 					<div class="theme-dropdown-container">
 						<button
-							class="title-action-btn {themeMenuOpen ? 'active' : ''}"
+							class="title-action-btn {popovers.themeMenuOpen ? 'active' : ''}"
 							onclick={(e) => {
 								e.stopPropagation();
-								themeMenuOpen = !themeMenuOpen;
-								if (themeMenuOpen) hideTooltip();
+								popovers.themeMenuOpen = !popovers.themeMenuOpen;
+								if (popovers.themeMenuOpen) hideTooltip();
 							}}
 							aria-label={t('tooltip.changeTheme', currentLanguage)}
 														onmouseenter={(e) => {
-														if (!themeMenuOpen) showTooltip(e, t('tooltip.changeTheme', currentLanguage));
+														if (!popovers.themeMenuOpen) showTooltip(e, t('tooltip.changeTheme', currentLanguage));
 												}}
 							onmousedown={(e) => e.preventDefault()}
 							onmouseleave={hideTooltip}
@@ -1118,7 +939,7 @@
 							{/if}
 							<span class="action-label">{t('menu.changeTheme', currentLanguage)}</span>
 						</button>
-						{#if themeMenuOpen}
+						{#if popovers.themeMenuOpen}
 							<div
 								class="theme-menu"
 								role="menu"
@@ -1126,7 +947,7 @@
 								transition:fly={{ y: 5, duration: 150 }}
 								onclick={(e) => e.stopPropagation()}
 								onkeydown={(e) => {
-									if (e.key === 'Escape') themeMenuOpen = false;
+									if (e.key === 'Escape') popovers.themeMenuOpen = false;
 								}}>
 								<button class="theme-option {theme === 'system' ? 'selected' : ''}" onclick={() => handleSetTheme('system')}> {t('theme.followSystem', currentLanguage)} </button>
 								<button class="theme-option {theme === 'light' ? 'selected' : ''}" onclick={() => handleSetTheme('light')}> {t('theme.defaultLight', currentLanguage)} </button>
@@ -1149,7 +970,7 @@
 		{#snippet actionMenu(ids: string[])}
 			{#if ids.length > 0}
 				{@render kebabButton()}
-				{#if kebabMenuOpen}
+				{#if popovers.kebabMenuOpen}
 					<div
 						class="title-actions show-dropdown"
 						data-tauri-drag-region
@@ -1158,7 +979,7 @@
 						transition:fly={{ y: 5, duration: 150 }}
 						onclick={(e) => e.stopPropagation()}
 						onkeydown={(e) => {
-							if (e.key === 'Escape') kebabMenuOpen = false;
+							if (e.key === 'Escape') popovers.kebabMenuOpen = false;
 						}}>
 						{@render actionItems(ids)}
 					</div>
diff --git a/src/lib/components/Toc.svelte b/src/lib/components/Toc.svelte
index 491806de..29c547ca 100644
--- a/src/lib/components/Toc.svelte
+++ b/src/lib/components/Toc.svelte
@@ -1,13 +1,8 @@
 <script lang="ts">
-	import { untrack } from 'svelte';
-
 	import { settings } from '../stores/settings.svelte.js';
 	import { t } from '../utils/i18n.js';
-	import { activeTocIdForLine, sourceLineOf } from '../utils/tocFollow.js';
-	import { foldKeyOf } from '../utils/foldState.js';
-	import { headingText } from '../utils/headingReference.js';
-	import { anchorScrollTop } from '../utils/previewAnchor.js';
-	import { jumpScrollBehavior } from '../utils/motion.js';
+	import { TocNavigator } from '../stores/tocNavigator.svelte.js';
+	import { buildTocEntries, tocFingerprint, type TocItem } from '../utils/tocEntries.js';
 	import type { RendererLine } from '../utils/lineCoordinates.js';
 
 	let { markdownBody, contentRoot, previewRevision, activeLine = null, onBeforeJump, foldOverrides, ontoggleFold, oncopyref, oncontext, onjump, onshowTooltip, onhideTooltip } = $props<{
@@ -54,40 +49,6 @@
 		onhideTooltip?: () => void;
 	}>();
 
-	interface TocItem {
-		id: string;
-		text: string;
-		level: number;
-		isBlock: boolean;
-		hasChildren?: boolean;
-		/**
-		 * How the fold state names this heading — read off the rendered heading,
-		 * never recomputed, so the outline and the renderer cannot disagree about
-		 * it. `''` for a block anchor, which is not a fold.
-		 */
-		foldKey: string;
-		/** Where this entry starts in the source, for following the editor. */
-		line: RendererLine | null;
-	}
-
-	/**
-	 * Everything the outline can show, in the order the document holds it.
-	 *
-	 * One query rather than three. `querySelectorAll` returns document order,
-	 * so asking for the headings and the block anchors together IS the
-	 * interleaving — this used to ask for each separately and then sort the two
-	 * lists back together against a third walk (`[id]`, which matches every
-	 * element in the document carrying one) built into a position map.
-	 *
-	 * That cost is per render, and a render is a keystroke. #632 stopped the
-	 * preview rebuilding its article for one character; an outline that walks
-	 * the whole of it three times regardless spends a good part of that back,
-	 * and on the documents where the patch matters most — 7819 elements in
-	 * `samples/stress-test.md` — it is the largest remaining full-document pass
-	 * in the render.
-	 */
-	const ENTRY_SELECTOR = 'h1, h2, h3, h4, h5, h6, a[id].block-id-anchor, span[id].block-id-anchor';
-
 	let items = $state<TocItem[]>([]);
 	/**
 	 * What `items` currently holds, for deciding whether the scan changed
@@ -99,15 +60,8 @@
 	 * outline scanned the whole document twice.
 	 */
 	let itemsFingerprint = '';
-	let activeId = $state<string | null>(null);
 	let tocContainer: HTMLElement | null = $state(null);
-	let activeTargetEl: HTMLElement | null = null;
-	
-	// when user clicks a toc entry, lock active id until scroll catches up
-	let clickLock: string | null = null;
-	let clickLockTimer: ReturnType<typeof setTimeout> | null = null;
-	/** How long a jump's own smooth scroll is given to settle. */
-	const CLICK_LOCK_MS = 600;
+	const outline = new TocNavigator(() => tocContainer);
 
 	/**
 	 * Whether the entries about to be rendered belong to a different document
@@ -139,40 +93,9 @@
 		scannedRoot = contentRoot;
 
 		if (contentRoot) {
-			const result: TocItem[] = [];
-
-			const entries = contentRoot.querySelectorAll(ENTRY_SELECTOR) as NodeListOf<HTMLElement>;
-			for (const el of Array.from(entries)) {
-				if (el.classList.contains('block-id-anchor')) {
-					result.push({ id: el.id, text: el.getAttribute('data-label') || el.id, foldKey: '', level: 0, isBlock: true, line: sourceLineOf(el.dataset.sourcepos) });
-					continue;
-				}
-
-				// Everything the selector matches that is not a block anchor is a
-				// heading, which is the only other thing it asks for.
-				const h = el;
-				const text = headingText(h);
-				const anchor = h.querySelector('a.anchor') as HTMLElement | null;
-				const id = h.id || (anchor ? anchor.id : '');
-				if (id) {
-					result.push({ id, text, foldKey: foldKeyOf(h), level: parseInt(h.tagName[1], 10), isBlock: false, line: sourceLineOf(h.dataset.sourcepos) });
-				}
-			}
+			const result = buildTocEntries(contentRoot);
 
-			for (let i = 0; i < result.length; i++) {
-				const item = result[i];
-				if (item.isBlock) continue;
-				item.hasChildren = false;
-				
-				if (i + 1 < result.length) {
-					const next = result[i+1];
-					if (next.isBlock || next.level > item.level) {
-						item.hasChildren = true;
-					}
-				}
-			}
-
-			const newFingerprint = result.map(i => `${i.id}-${i.text}-${i.level}-${i.line}`).join('|');
+			const newFingerprint = tocFingerprint(result);
 			if (newFingerprint !== itemsFingerprint) {
 				itemsFingerprint = newFingerprint;
 				items = result;
@@ -214,166 +137,21 @@
 		return result;
 	});
 
-	/**
-	 * Drop the "you jumped here" highlight.
-	 *
-	 * It is a temporary emphasis, so it has to end on anything that means the
-	 * reader has moved on. Hanging it off scrolling alone made it permanent
-	 * whenever that one event did not arrive — the jump's own smooth scroll is
-	 * swallowed by `clickLock`, and if nothing scrolls the preview afterwards
-	 * there is no second chance.
-	 */
-	function clearTargetHighlight() {
-		if (!activeTargetEl) return;
-
-		activeTargetEl.classList.remove('toc-target-active');
-		activeTargetEl = null;
-	}
-
-	/**
-	 * The highlight is worn by an element in the PREVIEW, which outlives this
-	 * component. Going away while one is showing — the outline collapsing itself
-	 * after a jump, or the reader hiding it by hand — used to leave that mark on
-	 * the heading with nothing able to clear it: the listeners left with the
-	 * component, and a later instance starts with its own `activeTargetEl` and
-	 * cannot see what an earlier one marked. So hand the clearing over to
-	 * listeners that belong to nobody, and take them all off the first time the
-	 * reader moves.
-	 */
-	function releaseStrandedHighlight(el: HTMLElement) {
-		const stranded = activeTargetEl;
-		if (!stranded) return;
-		activeTargetEl = null;
-
-		const clear = () => {
-			stranded.classList.remove('toc-target-active');
-			el.removeEventListener('scroll', clear);
-			el.removeEventListener('pointerdown', clear);
-			window.removeEventListener('keydown', clear);
-		};
-		const listen = () => {
-			el.addEventListener('scroll', clear, { passive: true });
-			el.addEventListener('pointerdown', clear, { passive: true });
-			window.addEventListener('keydown', clear, { passive: true });
-		};
-
-		// Exactly what `clickLock` is for, and the reason it cannot simply be
-		// read here: the jump's own smooth scroll is still running, and it must
-		// not be mistaken for the reader scrolling away from what they just
-		// asked to see. The timer outlives the component, the lock does not.
-		if (clickLock) setTimeout(listen, CLICK_LOCK_MS);
-		else listen();
-	}
-
-	function handleScroll() {
-		// The lock is here for the jump's OWN smooth scroll, which would
-		// otherwise clear the highlight before the reader has seen it.
-		if (clickLock) return;
-		clearTargetHighlight();
-	}
-
-	/**
-	 * A deliberate action by the reader, which the lock must not swallow: the
-	 * lock exists to ignore scrolling the app itself caused, and a click or a
-	 * keystroke is never that.
-	 */
-	function handleReaderAction() {
-		clearTargetHighlight();
-	}
-
-	/**
-	 * Keep the current entry in the MIDDLE of the outline, not merely on screen.
-	 *
-	 * `block: 'nearest'` scrolls the least it can get away with, so the outline
-	 * sat still until the current entry crossed an edge and then jumped by one
-	 * row — the reader saw the highlight walk down to the last visible line and
-	 * stay pinned there, with no idea what came next. Centring costs the same
-	 * one call and keeps the entries either side of where you are visible,
-	 * which is the reason to look at an outline while scrolling at all.
-	 */
-	function scrollTocIntoView() {
-		if (tocContainer && activeId) {
-			const activeEl = tocContainer.querySelector(`[data-id="${CSS.escape(activeId)}"]`);
-			if (activeEl) activeEl.scrollIntoView({ block: 'center', behavior: 'smooth' });
-		}
-	}
-
-	/**
-	 * Which entry the reader is on, from whichever pane they are scrolling.
-	 *
-	 * This is the whole of #169. The outline used to decide by rendered box,
-	 * which only the preview has: in editor-only mode the preview never
-	 * scrolls, and in split view it moves only while scroll sync is on, so the
-	 * outline sat still. A source line is something both panes can produce, and
-	 * resolving it is a comparison rather than a layout read.
-	 *
-	 * A click still wins until its own scroll settles — the same `clickLock`
-	 * the preview's handler respected.
-	 */
 	$effect(() => {
 		const line = activeLine;
-		if (line === null || clickLock) return;
-
-		const next = activeTocIdForLine(visibleItems, line);
-		if (next === null || next === untrack(() => activeId)) return;
-
-		activeId = next;
-		untrack(scrollTocIntoView);
+		outline.follow(line, () => visibleItems);
 	});
 
 	$effect(() => {
-		// Capture the element the listener was attached to: the cleanup must
-		// detach from that same node, not from whatever `markdownBody` points at
-		// when the effect re-runs (a changed prop would leak the old listener, a
-		// null prop would throw).
 		const el: HTMLElement | null = markdownBody;
-		if (el) {
-			el.addEventListener('scroll', handleScroll, { passive: true });
-			// `pointerdown`, not `click`: clicking a link inside the preview
-			// navigates, and the click never completes on the element that
-			// carried the highlight.
-			el.addEventListener('pointerdown', handleReaderAction, { passive: true });
-			// On the window, because after a jump the focus can be in either
-			// pane or in neither — the reader typing anywhere has moved on.
-			window.addEventListener('keydown', handleReaderAction, { passive: true });
-			return () => {
-				el.removeEventListener('scroll', handleScroll);
-				el.removeEventListener('pointerdown', handleReaderAction);
-				window.removeEventListener('keydown', handleReaderAction);
-				releaseStrandedHighlight(el);
-			};
-		}
+		if (el) return outline.listen(el);
 	});
 
 	import { slide } from 'svelte/transition';
 	import { cubicOut } from 'svelte/easing';
 
 	function jumpTo(id: string) {
-		const el = contentRoot?.querySelector(`[id="${CSS.escape(id)}"]`) as HTMLElement | null;
-		if (el && markdownBody) {
-			onBeforeJump?.();
-			// lock active id immediately so scroll handler doesn't override
-			clickLock = id;
-			activeId = id;
-			scrollTocIntoView();
-			
-			const item = items.find(i => i.id === id);
-			if (item) onjump?.(id, item.text, sourceLineOf(el.dataset.sourcepos));
-
-			// highlight element persistently until scroll
-			clearTargetHighlight();
-			el.classList.add('toc-target-active');
-			activeTargetEl = el;
-
-			markdownBody.scrollTo({
-				top: anchorScrollTop(markdownBody, el),
-				behavior: jumpScrollBehavior(settings.animateJumpScroll),
-			});
-
-			// release lock after scroll settles
-			if (clickLockTimer) clearTimeout(clickLockTimer);
-			clickLockTimer = setTimeout(() => { clickLock = null; }, CLICK_LOCK_MS);
-		}
+		outline.jumpTo(id, { contentRoot, markdownBody, items, onBeforeJump, onjump });
 	}
 </script>
 
@@ -425,7 +203,7 @@
 					style="padding-left: {(Math.max(1, item.level || 2) - 1) * 10 + 8}px !important">
 					{#if item.isBlock}
 					<button
-						class="toc-link toc-block {activeId === item.id ? 'active' : ''}"
+						class="toc-link toc-block {outline.activeId === item.id ? 'active' : ''}"
 						data-id={item.id}
 						onclick={() => jumpTo(item.id)}
 						use:checkTruncation>
@@ -440,7 +218,7 @@
 								<svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"></polyline></svg>
 							</button>
 							<button
-								class="toc-link {activeId === item.id ? 'active' : ''}"
+								class="toc-link {outline.activeId === item.id ? 'active' : ''}"
 								data-id={item.id}
 								onclick={() => jumpTo(item.id)}
 								oncontextmenu={(e) => { e.preventDefault(); e.stopPropagation(); oncontext ? oncontext(e, item) : oncopyref?.(item.text, item.id); }}
diff --git a/src/lib/sessions/coldEnrichmentRestore.ts b/src/lib/sessions/coldEnrichmentRestore.ts
new file mode 100644
index 00000000..93a2aa6c
--- /dev/null
+++ b/src/lib/sessions/coldEnrichmentRestore.ts
@@ -0,0 +1,68 @@
+import type { Tab, tabManager as TabManager } from '../stores/tabs.svelte.js';
+
+export type ColdEnrichmentRestoreOptions = {
+	tabManager: typeof TabManager;
+	tick: () => Promise<void>;
+	/** The article on screen, read when the restore runs. */
+	readonly markdownBody: HTMLElement | null | undefined;
+	/** `restorePreviewReadingPosition` with the viewer's measurements. */
+	restore: (body: HTMLElement, tab: Tab) => void;
+};
+
+/**
+ * The second restore a cold start needs: the rich-content libraries land after
+ * the document is already in the preview and after its position was restored
+ * against it.
+ */
+export function createColdEnrichmentRestore(o: ColdEnrichmentRestoreOptions) {
+	const { tabManager, tick } = o;
+
+	/**
+	 * The hosts whose document has been through `renderRichContent` at least
+	 * once. A `WeakMap`/`WeakSet` keyed on the container for the same reason
+	 * `states` in `previewPatch.ts` is: a host that Svelte destroys with its
+	 * tab takes its entry with it, so this cannot drift from the set of live
+	 * tabs the way a hand-kept registry can.
+	 */
+	const enrichedHosts = new WeakSet<HTMLElement>();
+
+	/**
+	 * Put the reader back where they were, once, after a cold start's enrichment
+	 * has changed the layout underneath them.
+	 *
+	 * Through `restorePreviewReadingPosition` — the same cascade the restore
+	 * effect runs, in the same order — because two sites consulting a tab's
+	 * three position fields in different orders are two answers for one tab.
+	 * That effect cannot do this itself: giving it a dependency on the render
+	 * would drag the preview back to the anchor on every debounced re-render
+	 * while the reader is typing in split view.
+	 *
+	 * Only for the tab that is still on screen. The enrichment is awaited, a
+	 * switch can happen inside it, and restoring another tab's position into the
+	 * article would move the document the reader is actually looking at.
+	 */
+	async function restoreAfterColdEnrichment(enrichment: Promise<void>, tabId: string | null) {
+		await enrichment;
+		await tick();
+		const body = o.markdownBody;
+		if (!body || !tabId || tabManager.activeTabId !== tabId) return;
+		const tab = tabManager.tabs.find((t) => t.id === tabId);
+		if (tab) o.restore(body, tab);
+	}
+
+	/**
+	 * Called by the patch effect after it hands `insertedBlocks` new blocks of
+	 * `host` to `renderRichContent`. A host's first enrichment is the cold
+	 * start: it waits for whichever libraries the document needs. A tab being
+	 * re-activated patches to nothing, and its host is in the set from that
+	 * first render.
+	 */
+	function afterEnrichment(host: HTMLElement, insertedBlocks: number, enrichment: Promise<void>) {
+		const cold = insertedBlocks > 0 && !enrichedHosts.has(host);
+		if (!cold) return;
+		enrichedHosts.add(host);
+		void restoreAfterColdEnrichment(enrichment, tabManager.activeTabId);
+	}
+
+	return { afterEnrichment };
+}
diff --git a/src/lib/sessions/documentSession.svelte.ts b/src/lib/sessions/documentSession.svelte.ts
index b3856ad2..3d5fe31c 100644
--- a/src/lib/sessions/documentSession.svelte.ts
+++ b/src/lib/sessions/documentSession.svelte.ts
@@ -1054,5 +1054,20 @@ export function createDocumentSession(options: DocumentSessionOptions) {
 		return readRestoredTab(tab.id);
 	}
 
-	return { loadMarkdown, readRestoredTab, readActiveIfUnread, saveContent, saveContentAs, renameFile, toggleTaskCheckbox, allowOverwriteOnce, resolveExternalChange, dirtyTabsChangedOnDisk, ensureFullContent, canCloseTab, isLossySaveRefused };
+	/**
+	 * A link opened in a new tab. The ordinary open path, as the Open dialog
+	 * takes it: `loadMarkdown` resolves the file's identity first, so a tab
+	 * already holding it under another spelling is activated instead of a
+	 * second tab being built.
+	 */
+	function openInNewTab(filePath: string) {
+		return loadMarkdown(filePath, { inNewTab: true });
+	}
+
+	/** Open every path, in order: the files the OS handed the launch window. */
+	async function openFiles(filePaths: readonly string[]) {
+		for (const filePath of filePaths) await loadMarkdown(filePath);
+	}
+
+	return { loadMarkdown, openInNewTab, openFiles, readRestoredTab, readActiveIfUnread, saveContent, saveContentAs, renameFile, toggleTaskCheckbox, allowOverwriteOnce, resolveExternalChange, dirtyTabsChangedOnDisk, ensureFullContent, canCloseTab, isLossySaveRefused };
 }
diff --git a/src/lib/sessions/externalChange.svelte.ts b/src/lib/sessions/externalChange.svelte.ts
new file mode 100644
index 00000000..2446097f
--- /dev/null
+++ b/src/lib/sessions/externalChange.svelte.ts
@@ -0,0 +1,267 @@
+import type { LanguageCode } from '../utils/i18n.js';
+import type { LoadMarkdownOptions } from './documentSession.svelte.js';
+
+type ConflictTab = { id: string; path: string; originalContent: string; rawContent: string; isDirty: boolean };
+
+export type ExternalChangeOptions = {
+	tabManager: {
+		readonly tabs: ConflictTab[];
+		readonly activeTab: ConflictTab | null | undefined;
+		readonly activeTabId: string | null | undefined;
+	};
+	settings: { readonly autoSave: boolean; readonly language: LanguageCode };
+	documentSession: {
+		saveContent: (tabId: string) => Promise<boolean>;
+		allowOverwriteOnce: (tabId: string) => void;
+		resolveExternalChange: (
+			changedPath: string,
+		) => Promise<{ action: 'ignore' } | { action: 'reload' | 'conflict'; tabId: string; path: string }>;
+	};
+	loadMarkdown: (path: string, options: LoadMarkdownOptions) => Promise<unknown>;
+	canCloseTab: (tabId: string) => Promise<boolean>;
+	/** `read_file_content_checked`: the file as it is on disk now. */
+	readFile: (path: string) => Promise<[string, boolean, string]>;
+	editorLanguageFor: (path: string) => string;
+	addToast: (message: string, type?: 'info' | 'error' | 'warning') => unknown;
+	t: (key: string, language: LanguageCode) => string;
+};
+
+export type Comparison = { tabId: string; onDisk: string; mine: string; language: string };
+
+/**
+ * The viewer's saves and the external-change conflict bar they answer to:
+ * Cmd+S, the saves nobody asked for, Reload, Compare and Keep mine.
+ */
+export function createExternalChange(options: ExternalChangeOptions) {
+	const { tabManager, settings, documentSession, loadMarkdown, addToast, t } = options;
+
+	async function saveContent(tabId?: string): Promise<boolean> {
+		const id = tabId ?? tabManager.activeTabId ?? '';
+		// Only the saves the user asked for come here — Cmd+S, the menu and
+		// title bar Save. Saves nobody asked for go through `saveSilently`.
+		// So a save that lands here IS the answer "keep my version": it both
+		// authorises the write the session would otherwise refuse, and leaves
+		// the bar with nothing to ask.
+		//
+		// Without the first half the bar became a trap: the disk really has
+		// changed, so the guard in `saveContent` refuses, so the bar goes back
+		// up, and Cmd+S can never get the user out of it.
+		if (hasExternalChangeConflict(id)) documentSession.allowOverwriteOnce(id);
+		return saveSilently(id);
+	}
+
+	/**
+	 * Ctrl+S from any mode. An untitled buffer has content to write. A clean
+	 * saved file is a no-op, so its mtime does not wake the watcher.
+	 */
+	function saveActiveTab(): Promise<boolean> | undefined {
+		const saveTarget = tabManager.activeTab;
+		if (saveTarget && (saveTarget.isDirty || saveTarget.path === '')) return saveContent();
+	}
+
+	/**
+	 * A save nobody asked for: the debounce, leaving an editable pane, the
+	 * exit's auto-save. It never authorises overwriting a changed file, so on
+	 * a conflicted tab the session's guard refuses it and the bar stays up.
+	 */
+	async function saveSilently(tabId: string): Promise<boolean> {
+		const saved = await documentSession.saveContent(tabId);
+		if (saved) clearExternalChangeConflict(tabId);
+		return saved;
+	}
+
+	/**
+	 * The last auto-save a tab gets before it stops being auto-saveable.
+	 *
+	 * Shared by the two ways out of an editable pane (leaving edit mode,
+	 * closing split view). It is NOT a condition of the switch: the view
+	 * changes whether or not the write succeeds, and nothing here asks the
+	 * user anything. The only reason it exists is that the background debounce
+	 * requires `isEditing || isSplit` (see the auto-save effect), so the tab is
+	 * about to lose its scheduled writer while still dirty — a user who asked
+	 * for "save automatically" would otherwise be left with edits that no timer
+	 * is going to flush.
+	 *
+	 * Untitled tabs are excluded on purpose: `saveContent` would open the Save
+	 * dialog for them, which is exactly the forced save decision this stopped
+	 * making.
+	 */
+	async function flushBeforeLeavingEditableMode(tab: ConflictTab) {
+		if (!tab.isDirty || tab.path === '') return;
+		// Auto-save off means edits are kept until the user saves them, so
+		// leaving the pane must not write either — closing keeps or asks.
+		if (!settings.autoSave) return;
+
+		const success = await saveSilently(tab.id);
+		if (!success) {
+			// Refused because the file changed underneath: the edit stays in
+			// the buffer and the conflict bar is already asking about it.
+			if (hasExternalChangeConflict(tab.id)) return;
+			// Reported, not obeyed. A file that cannot be written — read-only
+			// path, a buffer the lossy-decode guard refuses — used to trap the
+			// user in the editor with no way to look at their own text.
+			addToast(t('toast.autoSaveFailed', settings.language), 'error');
+			return;
+		}
+		if (tab.isDirty) {
+			// TOCTOU: the user typed during the await, so the file is one
+			// revision behind and the debounce is about to be dropped. The
+			// preview shows those newest edits, so nothing is lost or wrong on
+			// screen; the disk is what the user should hear about.
+			addToast(t('toast.savedNewerEdits', settings.language), 'info');
+		}
+	}
+
+	// --- External change conflicts ---
+	// A file changed on disk while the tab holding it had unsaved edits. The
+	// reload is NOT performed: `setTabRawContent` replaces originalContent
+	// too, so an automatic reload would erase the edits and the fact that
+	// there were any. The tab is flagged instead and the user picks.
+	//
+	// The question is about one file at one baseline, so that is what is
+	// recorded. Anything that puts another document in the tab — a link, back
+	// and forward, Reload, Save As, the close dialog's Save or Don't Save —
+	// moves the path or the baseline, and the conflict is void without each of
+	// them having to remember to clear it.
+	const externalChangeConflicts = $state<Record<string, { path: string; baseline: string }>>({});
+
+	function hasExternalChangeConflict(tabId: string): boolean {
+		const conflict = externalChangeConflicts[tabId];
+		const tab = tabManager.tabs.find((item) => item.id === tabId);
+		return !!conflict && !!tab && tab.path === conflict.path && tab.originalContent === conflict.baseline;
+	}
+
+	function noteExternalChangeConflict(tabId: string) {
+		const tab = tabManager.tabs.find((item) => item.id === tabId);
+		if (tab) externalChangeConflicts[tabId] = { path: tab.path, baseline: tab.originalContent };
+	}
+
+	function clearExternalChangeConflict(tabId: string) {
+		delete externalChangeConflicts[tabId];
+	}
+
+	/** "Reload": the user chose the disk version over their own edits. */
+	async function resolveExternalChangeByReloading(tabId: string) {
+		// The reload lands in the active tab, so it is refused for any other.
+		const tab = tabManager.activeTab;
+		if (!tab?.path || tab.id !== tabId) return;
+		comparison = null;
+		clearExternalChangeConflict(tab.id);
+		await loadMarkdown(tab.path, {
+			preserveEditState: true,
+			skipTabManagement: true,
+			resetScrollHistory: true,
+			// The user answered "the file changed under your edits" with the
+			// disk version. Every other caller of loadMarkdown is an OPEN and
+			// must leave an edited buffer alone; this one is the revert, and
+			// says so rather than leaving the session to infer it.
+			discardUnsavedBuffer: true,
+		});
+	}
+
+	async function reloadFromDisk() {
+		const activeId = tabManager.activeTabId;
+		const tab = tabManager.activeTab;
+		if (!activeId || !tab?.path) return;
+		if (!(await options.canCloseTab(activeId))) return;
+
+		await loadMarkdown(tab.path, {
+			preserveEditState: true,
+			skipTabManagement: true,
+			resetScrollHistory: true,
+			// canCloseTab has already resolved the buffer, so normally there is
+			// nothing left to discard — but the user can type during that await,
+			// and a reload that silently did nothing would be worse than one
+			// that does what its menu item says.
+			discardUnsavedBuffer: true,
+		});
+		addToast(t('toast.reloadedFromDisk', settings.language), 'info');
+	}
+
+	/**
+	 * The two versions the conflict bar is asking about, once the user has
+	 * asked to see them.
+	 *
+	 * Read on demand rather than kept alongside the flag: the bar can stand for
+	 * a while, and what matters is what the file says when the question is
+	 * actually being answered, not what it said when it was raised.
+	 */
+	let comparison = $state<Comparison | null>(null);
+
+	// The overlay answers for the tab it was opened on. Switching tabs, or that
+	// tab's conflict going void, closes it rather than letting its buttons land
+	// on whatever is in front. The viewer runs this in an `$effect`.
+	function closeStaleComparison() {
+		if (comparison && (comparison.tabId !== tabManager.activeTabId || !hasExternalChangeConflict(comparison.tabId))) {
+			comparison = null;
+		}
+	}
+
+	/** "Compare": show what Reload would replace, before it is irreversible. */
+	async function compareExternalChange() {
+		const tab = tabManager.activeTab;
+		if (!tab?.path) return;
+		try {
+			const [onDisk] = await options.readFile(tab.path);
+			if (tabManager.activeTabId !== tab.id) return;
+			comparison = {
+				tabId: tab.id,
+				onDisk,
+				mine: tab.rawContent,
+				language: options.editorLanguageFor(tab.path),
+			};
+		} catch (error) {
+			console.error('Failed to read the file for comparison', error);
+			addToast(`${t('externalChange.compare', settings.language)}: ${String(error)}`, 'error');
+		}
+	}
+
+	/** "Keep my version": dismiss. The buffer stays dirty and saveable. */
+	function resolveExternalChangeByKeepingBuffer(id: string) {
+		// The answer is about a write, not about a bar: the next save has to be
+		// allowed past the guard that would otherwise refuse to overwrite the
+		// changed file. One save only — a third program writing a minute later
+		// is a new question, and the user has not answered that one.
+		documentSession.allowOverwriteOnce(id);
+		comparison = null;
+		clearExternalChangeConflict(id);
+	}
+
+	/**
+	 * A `file-changed` event from the watcher. The event names the changed
+	 * file. Which tab that touches — and whether it may be reloaded at all —
+	 * is decided by the session: it owns the self-write grace window (so our
+	 * own auto-save does not bounce back) and it refuses to reload a tab with
+	 * unsaved edits. A conflict is noted with Live Mode off too; Live Mode
+	 * gates only the reload.
+	 */
+	async function handleFileChanged(changedPath: string, liveMode: boolean) {
+		const outcome = await options.documentSession.resolveExternalChange(changedPath);
+		if (outcome.action === 'ignore') return;
+		if (outcome.action === 'conflict') {
+			noteExternalChangeConflict(outcome.tabId);
+			return;
+		}
+		if (liveMode) options.loadMarkdown(outcome.path, {});
+	}
+
+	return {
+		get comparison() {
+			return comparison;
+		},
+		closeComparison: () => void (comparison = null),
+		closeStaleComparison,
+		saveContent,
+		saveActiveTab,
+		saveSilently,
+		flushBeforeLeavingEditableMode,
+		hasExternalChangeConflict,
+		noteExternalChangeConflict,
+		clearExternalChangeConflict,
+		resolveExternalChangeByReloading,
+		reloadFromDisk,
+		compareExternalChange,
+		resolveExternalChangeByKeepingBuffer,
+		handleFileChanged,
+	};
+}
diff --git a/src/lib/sessions/fileWatch.svelte.ts b/src/lib/sessions/fileWatch.svelte.ts
new file mode 100644
index 00000000..095f88ef
--- /dev/null
+++ b/src/lib/sessions/fileWatch.svelte.ts
@@ -0,0 +1,23 @@
+import { invoke } from '@tauri-apps/api/core';
+
+/**
+ * Keeps this window's file watcher on the file `path` returns, and gives it up
+ * when that is ''. Call it while a component initialises; the effect is the
+ * component's. This is the one place that asks for a watch: a load re-issuing
+ * `watch_file` made the watcher follow whichever document loaded last rather
+ * than the active one (#296).
+ *
+ * Watched whether or not Auto-Reload is on: an edit made elsewhere under
+ * unsaved changes is reported when it happens, not at the next save.
+ * Auto-Reload only decides whether a clean tab reloads.
+ */
+export function followActiveFile(path: () => string) {
+	$effect(() => {
+		const currentFile = path();
+		if (currentFile) {
+			invoke('watch_file', { path: currentFile }).catch(console.error);
+		} else {
+			invoke('unwatch_file').catch(console.error);
+		}
+	});
+}
diff --git a/src/lib/sessions/frontMatterEdit.ts b/src/lib/sessions/frontMatterEdit.ts
new file mode 100644
index 00000000..684baef9
--- /dev/null
+++ b/src/lib/sessions/frontMatterEdit.ts
@@ -0,0 +1,45 @@
+import type { settings as Settings } from '../stores/settings.svelte.js';
+import type { Tab, tabManager as TabManager } from '../stores/tabs.svelte.js';
+import { parseFrontMatterEditableValue, type FrontMatterField } from '../utils/frontMatter.js';
+import type { LanguageCode } from '../utils/i18n.js';
+
+export type FrontMatterEditOptions = {
+	tabManager: typeof TabManager;
+	settings: typeof Settings;
+	documentSession: { ensureFullContent: (tabId: string) => Promise<boolean> };
+	addToast: (message: string, type?: 'info' | 'error' | 'warning') => unknown;
+	t: (key: string, language: LanguageCode) => string;
+	/** Rewrites the field in the tab's buffer and re-renders; `nextValue` may throw. */
+	applyFrontMatter: (tab: Tab, field: FrontMatterField, nextValue: () => unknown) => Promise<void>;
+};
+
+/** The front matter panel's edits, made from reading mode. */
+export function createFrontMatterEdit(o: FrontMatterEditOptions) {
+	const { tabManager, settings, documentSession, addToast, t, applyFrontMatter } = o;
+
+	async function handleFrontMatterEdit(field: FrontMatterField, value: string) {
+		const tab = tabManager.activeTab;
+		if (!tab) return;
+		// Front matter is editable from reading mode, which a large file can
+		// reach while its buffer is still the preview slice. Rewriting that
+		// slice and saving it would drop the rest of the document.
+		if (!(await documentSession.ensureFullContent(tab.id))) {
+			addToast(t('toast.partialDocument', settings.language), 'error');
+			return;
+		}
+		await applyFrontMatter(tab, field, () => parseFrontMatterEditableValue(field, value));
+	}
+
+	async function handleFrontMatterListChange(field: FrontMatterField, nextItems: string[]) {
+		const tab = tabManager.activeTab;
+		if (!tab) return;
+		// Same partial-buffer guard as handleFrontMatterEdit.
+		if (!(await documentSession.ensureFullContent(tab.id))) {
+			addToast(t('toast.partialDocument', settings.language), 'error');
+			return;
+		}
+		await applyFrontMatter(tab, field, () => nextItems);
+	}
+
+	return { handleFrontMatterEdit, handleFrontMatterListChange };
+}
diff --git a/src/lib/sessions/viewMode.svelte.ts b/src/lib/sessions/viewMode.svelte.ts
new file mode 100644
index 00000000..446523bb
--- /dev/null
+++ b/src/lib/sessions/viewMode.svelte.ts
@@ -0,0 +1,461 @@
+import type { settings as Settings } from '../stores/settings.svelte.js';
+import type { Tab, tabManager as TabManager } from '../stores/tabs.svelte.js';
+import type { LanguageCode } from '../utils/i18n.js';
+import {
+	asBufferLine,
+	tabAnchorForEditorTopLine,
+	type BufferLine,
+	type BufferLineRange,
+	type LineCoordinates,
+	type RendererLine,
+} from '../utils/lineCoordinates.js';
+import { findSourceLineRange, mergeSourceLineRanges, type LineRange } from '../utils/previewAnchor.js';
+import { sourceAtPoint, type SourceLineReader } from '../utils/previewCursor.js';
+import type { ScrollSyncPosition } from '../utils/scrollSync.js';
+import { type ViewMode, viewModeOf } from '../utils/titlebarToolbar.js';
+import { claimTabForRead } from './documentSession.svelte.js';
+
+export type ViewModeEditorPane = {
+	syncScrollToPosition: (position: ScrollSyncPosition, options?: { cursorIntoView?: boolean }) => void;
+	setCursor: (line: number, column: number) => void;
+	scrollSyncPosition: () => ScrollSyncPosition | null;
+};
+
+export type ViewModeOptions = {
+	tabManager: typeof TabManager;
+	settings: typeof Settings;
+	documentSession: { ensureFullContent: (tabId: string) => Promise<boolean> };
+	flushBeforeLeavingEditableMode: (tab: Tab) => Promise<unknown>;
+	/** `read_file_content_checked`: the file and the fidelity of its decode. */
+	readFile: (path: string) => Promise<[string, boolean, string]>;
+	renderTabPreviewFromRaw: (tab: Tab) => Promise<void>;
+	tick: () => Promise<void>;
+	addToast: (message: string, type?: 'info' | 'error' | 'warning') => unknown;
+	t: (key: string, language: LanguageCode) => string;
+	// The viewer's panes and measurements, read when a handler runs.
+	readonly editorPane: ViewModeEditorPane | null | undefined;
+	readonly markdownBody: HTMLElement | null | undefined;
+	readonly previewBlocks: HTMLElement | null | undefined;
+	readonly lineCoords: LineCoordinates;
+	readRendererLine: SourceLineReader;
+	getPreviewScrollSyncPosition: (target: HTMLElement) => ScrollSyncPosition;
+	scrollPreviewToSyncPosition: (position: ScrollSyncPosition) => void;
+	getPreviewScrollAnchor: (target: HTMLElement) => RendererLine | null;
+};
+
+/**
+ * The viewer's three modes and what moves between them: the view toggles
+ * (Ctrl+E, ⌘\, the title bar's mode buttons), scroll sync between the panes,
+ * the outline's current entry, and the cursor the two panes share.
+ */
+export function createViewMode(o: ViewModeOptions) {
+	const { tabManager, settings, documentSession, flushBeforeLeavingEditableMode, readFile, renderTabPreviewFromRaw, tick, addToast, t } = o;
+
+	const isEditing = () => tabManager.activeTab?.isEditing ?? false;
+	const isSplit = () => tabManager.activeTab?.isSplit ?? false;
+	const hasEditorPane = () => isEditing() || isSplit();
+	const hasPreviewPane = () => !isEditing() || isSplit();
+
+	/**
+	 * The source line the reader is on, for the outline to follow (#169).
+	 *
+	 * BOTH panes answer here, which is the point: the outline used to decide by
+	 * rendered box, and only the preview has those. A source line is something
+	 * either pane can produce — the editor sends one on every scroll (the same
+	 * position scroll sync uses, whether or not sync is on), and the preview
+	 * already computes one for the tab's reading position. One rule then picks
+	 * the entry, so the two panes cannot disagree about which heading is
+	 * current while both are on screen.
+	 */
+	let tocActiveLine = $state<RendererLine | null>(null);
+
+	/**
+	 * The one gate on `tocActiveLine`. With `settings.tocFollows` set to
+	 * 'cursor' and a cursor the reader can see (the editor is on screen, or
+	 * `settings.previewCursor` draws one the reader placed in the preview), only
+	 * the cursor moves the outline, and scrolling either pane leaves it where it
+	 * is. Otherwise the pane that scrolled last decides. In the preview alone
+	 * with `previewCursor` off, the editor's last cursor is kept for Ctrl+E but
+	 * not followed: nothing on screen would say why the outline stopped.
+	 *
+	 * A preview that is not on screen never decides: in the editor alone it is
+	 * still mounted at zero width, and its scroll events report lines from that
+	 * layout, which put the outline on the wrong heading after Ctrl+E (#799).
+	 * Nor does a preview Ctrl+E has just brought back, until
+	 * `restoreAfterLeavingEditor` has placed it: its scroll events before that
+	 * report the first headings.
+	 */
+	function followToc(from: 'cursor' | 'editor' | 'preview', line: RendererLine) {
+		const cursorLeads = settings.tocFollows === 'cursor' && (hasEditorPane() || (settings.previewCursor && activeCursor() !== null));
+		const previewSettled = hasPreviewPane() && !previewPlacing;
+		const accepted = from === 'cursor' ? cursorLeads : !cursorLeads && (from === 'editor' || previewSettled);
+		if (accepted) tocActiveLine = line;
+	}
+
+	/** True from Ctrl+E out of the editor until the preview is placed. */
+	let previewPlacing = false;
+
+	/**
+	 * Each tab's cursor, shared by its two panes (#799): the editor's while it
+	 * is on screen, and with `settings.previewCursor` a click in the preview
+	 * moves it too. With that setting the preview draws it, and Ctrl+E puts the
+	 * editor's cursor on it. A tab only read so far has none.
+	 */
+	let cursorByTab = $state<Record<string, { line: BufferLine; column: number }>>({});
+	const activeCursor = () => (tabManager.activeTabId && cursorByTab[tabManager.activeTabId]) || null;
+
+	function handleEditorCursor(line: BufferLine, column: number) {
+		if (tabManager.activeTabId) cursorByTab[tabManager.activeTabId] = { line, column };
+		followToc('cursor', o.lineCoords.toRendererLine(line));
+	}
+
+	function placePreviewCursor(e: MouseEvent) {
+		const tabId = tabManager.activeTabId;
+		const previewBlocks = o.previewBlocks;
+		if (!tabId || !previewBlocks || !settings.previewCursor || e.detail !== 1) return;
+		if (!window.getSelection()?.isCollapsed) return;
+
+		const caret = document.caretRangeFromPoint(e.clientX, e.clientY);
+		const point = caret && sourceAtPoint(previewBlocks, { node: caret.startContainer, offset: caret.startOffset }, o.readRendererLine);
+		if (!point) return;
+
+		const line = o.lineCoords.toBufferLine(point.line);
+		cursorByTab[tabId] = { line, column: point.column };
+		followToc('cursor', point.line);
+		if (isSplit()) o.editorPane?.setCursor(line, point.column);
+	}
+
+	function handleEditorScrollSync(position: ScrollSyncPosition) {
+		// The line the tab would record as its reading position, not the line
+		// the viewport cuts in half: `tabAnchorForEditorTopLine` is the one
+		// crossing from a Monaco top line into the outline's numbering (it
+		// counts from the body, and sits `EDITOR_ANCHOR_LINE_OFFSET` lines
+		// down). Handing over the raw top line left the outline one entry
+		// behind whenever a heading was the first line on screen (#744).
+		if (position.line !== undefined) {
+			followToc('editor', tabAnchorForEditorTopLine(o.lineCoords, asBufferLine(position.line)));
+		}
+
+		if (splitScrollSyncOn()) {
+			o.scrollPreviewToSyncPosition(position);
+		}
+	}
+
+	/**
+	 * Scroll sync is a split-view feature, and `isScrollSynced` outlives the
+	 * split: it is the tab's remembered choice for the next one. Out of split
+	 * the other pane is still mounted at zero width, so a position mapped
+	 * through it drags the visible pane off the line Ctrl+E put it on (#799).
+	 */
+	function splitScrollSyncOn() {
+		const tab = tabManager.activeTab;
+		return !!tab?.isSplit && tab.isScrollSynced;
+	}
+
+	/**
+	 * A preview scroll, read once for two consumers: the tab's reading position
+	 * and the outline. Both want the line at the top of the preview, and the
+	 * scroll handler is already the only place it is measured.
+	 */
+	function followPreviewScroll(target: HTMLElement) {
+		const tabId = tabManager.activeTabId;
+		if (!tabId) return;
+		const anchorLine = o.getPreviewScrollAnchor(target);
+		if (anchorLine === null) return;
+		tabManager.updateTabAnchorLine(tabId, anchorLine);
+		followToc('preview', anchorLine);
+	}
+
+	function syncEditorToPreviewScroll(target: HTMLElement) {
+		const editorPane = o.editorPane;
+		if (!splitScrollSyncOn() || !editorPane) return;
+
+		const position = o.getPreviewScrollSyncPosition(target);
+		editorPane.syncScrollToPosition(position);
+	}
+
+	/**
+	 * Reading mode's HTML, rendered from the tab's own buffer and its own path.
+	 * Writes through the tab id, so a tab switch during the render cannot land
+	 * one document's HTML on another — and, unlike the `loadMarkdown` call this
+	 * replaces, it neither activates the tab nor re-reads the file.
+	 */
+	async function renderPreviewLeavingEditableMode(tab: Tab) {
+		try {
+			await renderTabPreviewFromRaw(tab);
+		} catch (e) {
+			console.error('Failed to render markdown', e);
+		}
+	}
+
+	/**
+	 * Move the active tab between reading and editing. Just the mode — where
+	 * the reader LANDS is `editSourceRange`'s business, and `toggleEditView`
+	 * is what decides which of the two a ⌘E means.
+	 */
+	async function toggleEdit() {
+		const tab = tabManager.activeTab;
+		if (!tab) return;
+
+		if (isEditing()) {
+			// Back to reading. The preview renders the buffer, not the file, so no
+			// save is needed (#168). The tab stays dirty, and closing it or the
+			// window (`settleForExit`) still asks.
+			await flushBeforeLeavingEditableMode(tab);
+			// Ctrl+E lands on the line the other pane was showing, mapped the way
+			// split view maps it (#799).
+			const position = o.editorPane?.scrollSyncPosition() ?? null;
+			previewPlacing = position !== null;
+			tab.isEditing = false;
+			await renderPreviewLeavingEditableMode(tab);
+			if (position) void restoreAfterLeavingEditor(tab.id, position);
+		} else {
+			// Switch to edit
+			const markdownBody = o.markdownBody;
+			const position = markdownBody ? o.getPreviewScrollSyncPosition(markdownBody) : null;
+			if (tab.path !== '') {
+				if (tab.isDirty) {
+					// Unsaved edits are already in memory (made in reading
+					// mode, or kept when leaving the editor with auto-save
+					// off). Reading from disk would overwrite them, so only
+					// switch.
+					tab.isEditing = true;
+				} else {
+					const mayApply = claimTabForRead(tab.id);
+					try {
+						// This buffer is about to be handed to the editor, and
+						// the editor arms auto-save. The checked command is what
+						// says whether the decode was lossy, so the tab carries
+						// its own verdict instead of relying on the one
+						// `loadMarkdown` left behind — a file can be converted
+						// to UTF-8 (or away from it) between the two reads.
+						const [content, lossy, encoding] = await readFile(tab.path);
+						// A task ticked, or the tab closed, while this was out.
+						if (!mayApply()) return;
+						tabManager.setTabDecodedLossy(tab.id, lossy);
+						tabManager.setTabEncoding(tab.id, encoding);
+						// Goes through the store so a tab that held only the
+						// large-file preview slice stops being flagged partial.
+						tabManager.setTabRawContent(tab.id, content);
+						tab.isEditing = true;
+					} catch (e) {
+						console.error('Failed to read file for editing', e);
+					}
+				}
+			} else {
+				tab.isEditing = true;
+			}
+			if (position && tab.isEditing) {
+				await tick();
+				o.editorPane?.syncScrollToPosition(position, { cursorIntoView: settings.tocFollows === 'cursor' });
+			}
+		}
+	}
+
+	/**
+	 * The preview half of #799. The restore effect cannot do it: the article
+	 * stays mounted at zero width in edit mode, so nothing it depends on changes
+	 * with the mode. The pane takes its real width in the same frame (its slide
+	 * is a `transform`, see `utils/paneSlide.ts`), so the line is placed right
+	 * after the render, before the old position is ever painted.
+	 */
+	async function restoreAfterLeavingEditor(tabId: string, position: ScrollSyncPosition) {
+		await tick();
+		previewPlacing = false;
+		const body = o.markdownBody;
+		if (!body || tabManager.activeTab?.id !== tabId || tabManager.activeTab.isEditing) return;
+		o.scrollPreviewToSyncPosition(position);
+		// That scroll is marked programmatic, so the tab's anchor and the
+		// outline's current entry are written here.
+		const anchorLine = o.getPreviewScrollAnchor(body);
+		if (anchorLine !== null) {
+			tabManager.updateTabAnchorLine(tabId, anchorLine);
+			followToc('preview', anchorLine);
+		}
+	}
+
+	/**
+	 * A jump the editor has not been asked for yet, because it does not exist
+	 * yet: `toggleEdit` only flips a flag, and the `Editor` it mounts — and the
+	 * `editorPane` binding that reaches it — arrive on the next render. The
+	 * viewer's effect spends it the moment they do, and immediately when the
+	 * editor is already on screen (split view).
+	 */
+	let pendingEditReveal = $state<BufferLineRange | null>(null);
+
+	/**
+	 * Which source lines the reader means by right-clicking here (#90).
+	 *
+	 * The selection when there is one, so a range spanning several blocks opens
+	 * the editor on all of them; a caret or a click with nothing selected falls
+	 * through to whatever is under the pointer, which is how a click on an
+	 * image lands on the image.
+	 *
+	 * `null` when nothing under the pointer came from the document: the front
+	 * matter panel, the outline, the window chrome. The caller then leaves the
+	 * "Edit" entry doing exactly what it did before.
+	 */
+	function getContextMenuSourceRange(e: MouseEvent): LineRange | null {
+		return getSelectionSourceRange() ?? findSourceLineRange(e.target as Node | null);
+	}
+
+	/**
+	 * The source lines the reader has selected in the preview, or null when
+	 * nothing is selected or the selection came from outside the document.
+	 *
+	 * Both ends resolve independently and are merged, so a selection spanning
+	 * several blocks answers with all of them, and one end landing somewhere
+	 * with no range (the front matter panel, the outline) leaves the other end
+	 * in charge. Direction-independent: `startContainer` is the range's start,
+	 * not the point the drag began at.
+	 */
+	function getSelectionSourceRange(): LineRange | null {
+		const selection = window.getSelection();
+		if (!selection || selection.rangeCount === 0 || selection.isCollapsed) return null;
+		return mergeSourceLineRanges(
+			findSourceLineRange(selection.getRangeAt(0).startContainer),
+			findSourceLineRange(selection.getRangeAt(selection.rangeCount - 1).endContainer),
+		);
+	}
+
+	/**
+	 * What ⌘E means, from every entry point that offers it — the hotkey, the
+	 * toolbar, the title bar, and Monaco's own command.
+	 *
+	 * One function so the chord cannot mean two things depending on where the
+	 * caret happens to be (`shortcuts.checks.test.ts` holds the two layers
+	 * together), and so "take me to the editor" behaves the same whether the
+	 * reader asked for it with a key or with a menu item.
+	 */
+	async function toggleEditView() {
+		const selected = getSelectionSourceRange();
+
+		if (!hasPreviewPane()) {
+			// The editor is already the whole window: nowhere further to take
+			// the reader, so this is the toggle back out.
+			await toggleEdit();
+			return;
+		}
+
+		if (isSplit() && !selected) {
+			// Deliberately nothing.
+			//
+			// What ⌘E is asked for is the ability to edit, and split view
+			// already grants it — the editor is on screen. With no selection
+			// there is no fragment to travel to either, so every remaining
+			// reading of the chord is a LAYOUT change nobody asked for: closing
+			// the preview on a mistyped ⌘E costs the reader the pane and a
+			// second keystroke to get it back, while doing nothing costs
+			// nothing. ⌘\ opens and closes the split, and stays the only way.
+			return;
+		}
+
+		// Reading, or split with a selection: same as the context menu's "Edit".
+		await editSourceRange(selected);
+	}
+
+	/**
+	 * Open the editor on `range`. Toggles into edit mode when `isEditing` is
+	 * false, including split view entered from reading mode.
+	 */
+	async function editSourceRange(range: LineRange | null) {
+		if (!isEditing()) await toggleEdit();
+		// `toggleEdit` swallows a failed read and stays in reading mode. Arming
+		// the jump anyway would fire it at whatever document is edited next.
+		if (range && tabManager.activeTab?.isEditing) pendingEditReveal = o.lineCoords.toBufferRange(range);
+	}
+
+	/**
+	 * The context menu's "Edit" for the right-click `e`. The target is resolved
+	 * now rather than inside the click handler: by the time that runs the
+	 * reader has clicked a menu item, and a click is how a selection goes away.
+	 */
+	function editSourceRangeAt(e: MouseEvent) {
+		const target = getContextMenuSourceRange(e);
+		return () => editSourceRange(target);
+	}
+
+	async function toggleSplitView(tabId: string) {
+		const tab = tabManager.tabs.find((t) => t.id === tabId);
+		if (!tab) return;
+
+		if (!tab.isSplit) {
+			// Split view is an editor, and its first keystroke arms auto-save.
+			// The buffer must be complete first (not empty, not a large file's
+			// partial read), or auto-save writes a truncated file.
+			if (tab.path && !tab.isEditing && !tab.rawContent) {
+				const mayApply = claimTabForRead(tab.id);
+				try {
+					// Checked, like every other read that fills an editable
+					// buffer: split view is an editor, so this tab must carry
+					// the fidelity of its own decode rather than inherit one.
+					const [content, lossy, encoding] = await readFile(tab.path);
+					if (!mayApply()) return;
+					tabManager.setTabDecodedLossy(tab.id, lossy);
+					tabManager.setTabEncoding(tab.id, encoding);
+					tabManager.setTabRawContent(tab.id, content);
+				} catch (e) {
+					console.error('Failed to load raw content for split view', e);
+				}
+			}
+			if (!(await documentSession.ensureFullContent(tab.id))) {
+				addToast(t('toast.partialDocument', settings.language), 'error');
+				return;
+			}
+			tabManager.setSplitEnabled(tab.id, true);
+		} else {
+			// Like leaving edit mode: the surviving pane renders the buffer, so
+			// nothing is saved or asked.
+			await flushBeforeLeavingEditableMode(tab);
+			tabManager.setSplitEnabled(tab.id, false);
+			await renderPreviewLeavingEditableMode(tab);
+		}
+	}
+
+	/** The title bar's three mode buttons (#806): go straight to one, from any. */
+	async function setViewMode(target: ViewMode) {
+		const tab = tabManager.activeTab;
+		if (!tab || viewModeOf(tab) === target) return;
+		if (target === 'split') return toggleSplitView(tab.id);
+		if (!tab.isSplit) return target === 'edit' ? toggleEditView() : toggleEdit();
+		// Leaving split: the editor is already on screen and holds the full
+		// buffer, so Edit only drops the preview. Preview goes through the
+		// normal close, which flushes and renders.
+		if (target === 'edit') {
+			tab.isEditing = true;
+			tabManager.setSplitEnabled(tab.id, false);
+			return;
+		}
+		tab.isEditing = false;
+		await toggleSplitView(tab.id);
+	}
+
+	return {
+		get tocActiveLine() {
+			return tocActiveLine;
+		},
+		get activeCursor() {
+			return activeCursor();
+		},
+		get pendingEditReveal() {
+			return pendingEditReveal;
+		},
+		set pendingEditReveal(range: BufferLineRange | null) {
+			pendingEditReveal = range;
+		},
+		followToc,
+		handleEditorCursor,
+		placePreviewCursor,
+		handleEditorScrollSync,
+		followPreviewScroll,
+		syncEditorToPreviewScroll,
+		toggleEdit,
+		restoreAfterLeavingEditor,
+		getContextMenuSourceRange,
+		toggleEditView,
+		editSourceRange,
+		editSourceRangeAt,
+		toggleSplitView,
+		setViewMode,
+	};
+}
diff --git a/src/lib/sessions/windowExit.ts b/src/lib/sessions/windowExit.ts
new file mode 100644
index 00000000..521f04ec
--- /dev/null
+++ b/src/lib/sessions/windowExit.ts
@@ -0,0 +1,339 @@
+import { invoke } from '@tauri-apps/api/core';
+
+import { reviewDirtyTabs } from './closeReview.js';
+import { isHomePath } from '../utils/homeTab.js';
+import { pinnedTagHolder, pinnedWindowToken } from '../utils/pinnedTagWindow.js';
+import { hasRealFilePath } from '../utils/tabFileActions.js';
+
+type ExitTab = { id: string; path: string; isDirty: boolean };
+type WindowTag = { name: string; color: string; pinned: boolean };
+export type PinnedTag = { name: string; color: string; files: string[] };
+
+export type WindowExitOptions = {
+	tabManager: {
+		readonly tabs: ExitTab[];
+		readonly windowTag: WindowTag | null;
+		closeTab: (id: string) => void;
+		setActive: (id: string) => void;
+		setWindowTag: (tag: { name: string; color: string; pinned?: boolean } | null) => void;
+	};
+	settings: {
+		readonly autoSave: boolean;
+		readonly restoreStateOnReopen: boolean;
+		readonly closeWindowWithLastTab: boolean;
+		readonly persistOpenEditors: boolean;
+	};
+	appWindow: { readonly label: string; close: () => Promise<void>; destroy: () => Promise<void> };
+	/** Every window of the app, this one included (`getAllWindows`). */
+	allWindows: () => Promise<{ readonly label: string; close: () => Promise<void> }[]>;
+	/** The unsaved-change backup: whether it was restored, and its two writes. */
+	recovery: {
+		isReady: () => boolean;
+		/** Write the current buffers. False when the backup could not be written. */
+		keep: () => Promise<boolean>;
+		/** Write an empty backup, so a discarded buffer stays gone. */
+		drop: () => Promise<boolean>;
+	};
+	persistWindowState: (remember: boolean) => Promise<void>;
+	canCloseTab: (id: string) => Promise<boolean>;
+	saveSilently: (id: string) => Promise<boolean>;
+	hasExternalChangeConflict: (id: string) => boolean;
+	onAutoSaveFailed: () => void;
+	/** Let an activation paint before a dialog covers it — `tick()` in the app. */
+	settle: () => Promise<void>;
+	loadMarkdown: (path: string) => Promise<unknown>;
+	setShowHome: (value: boolean) => void;
+	moveTabToWindow: (tabId: string, targetLabel: string) => Promise<unknown>;
+};
+
+/**
+ * Every way a window ends: the red button, quit, the in-app update, the last
+ * tab's ×, and a merge into another window. Each one resolves unsaved tabs,
+ * saves a pinned tag's files and writes the window snapshot, in that order.
+ */
+export function createWindowExit(options: WindowExitOptions) {
+	const { tabManager, settings, appWindow } = options;
+
+	// True while the window-close walk is showing per-tab dialogs; the native
+	// red button is not blocked by the dialog overlay, so this keeps a second
+	// close request from starting a competing walk.
+	let closeWalkActive = false;
+
+	// The files the close review started from. It can close tabs, and the
+	// close it re-triggers settles again, so both saves use this list.
+	let pinFilesAtClose: string[] | null = null;
+
+	function openFilePaths() {
+		return tabManager.tabs.filter((tab) => hasRealFilePath(tab.path)).map((tab) => tab.path);
+	}
+
+	/**
+	 * Every path that ends a window saves the pin before it closes tabs. An
+	 * empty window says nothing about the group, so it never overwrites it.
+	 * It only refreshes the entry: another window may have unpinned the tag.
+	 */
+	async function savePinnedTagIfNeeded() {
+		const tag = tabManager.windowTag;
+		if (!tag?.pinned) return;
+		const files = pinFilesAtClose ?? openFilePaths();
+		if (files.length === 0) return;
+		const pinned = await invoke('update_pinned_tag', { name: tag.name, color: tag.color, files });
+		if (!pinned) tabManager.setWindowTag({ ...tag, pinned: false });
+	}
+
+	async function openPinnedTag(tag: PinnedTag) {
+		// Two windows sharing a tag share one pin entry, and the last to save wins.
+		const holder = await pinnedTagHolder(tag.name, appWindow.label);
+		if (holder) {
+			await invoke('focus_window', { label: holder });
+			return;
+		}
+		// Tabs already here belong to this window's own group. The pinned one
+		// opens in a window of its own, which adopts it from its label.
+		if (tabManager.tabs.some((tab) => !isHomePath(tab.path))) {
+			await invoke('create_transfer_window', { token: pinnedWindowToken(tag.name, Date.now()), tagName: tag.name });
+			return;
+		}
+		tabManager.setWindowTag({ ...tag, pinned: true });
+		for (const file of tag.files) await options.loadMarkdown(file);
+		options.setShowHome(false);
+	}
+
+	/**
+	 * Hot exit: keep unsaved buffers instead of asking. Pending auto-saves write
+	 * their files first; a refused or failed save stays dirty and is kept. False
+	 * when the backup cannot be written or `applies` says no, and the caller asks
+	 * as usual. `applies` runs inside the walk guard, so a second close is refused meanwhile.
+	 */
+	async function keepUnsavedForExit(applies = async () => true): Promise<boolean> {
+		if (!options.recovery.isReady()) return false;
+		closeWalkActive = true;
+		try {
+			if (!(await applies())) return false;
+			if (settings.autoSave) {
+				for (const tab of tabManager.tabs.filter((t) => t.isDirty && t.path !== '')) await options.saveSilently(tab.id);
+			}
+			if (!(await options.recovery.keep())) return false;
+		} finally {
+			closeWalkActive = false;
+		}
+		await savePinnedTagIfNeeded();
+		await options.persistWindowState(true);
+		return true;
+	}
+
+	/**
+	 * The save/discard close, used when "Restore unsaved changes on launch" is off, when
+	 * closing one of several windows, or when the backup cannot be written
+	 * (`keepUnsavedForExit` runs first otherwise).
+	 * Resolve this window's unsaved tabs, then write the restore snapshot: the
+	 * work that has to happen before the window goes away. False when the reader
+	 * cancelled, and nothing has been written.
+	 *
+	 * The close button and the in-app update both run it. An update ends the
+	 * process without closing a window — the Windows updater exits inside
+	 * `downloadAndInstall`, `relaunch()` requests an exit elsewhere — so
+	 * CloseRequested never fires, and both jobs used to go down with it (#761).
+	 */
+	async function settleForExit(remember: () => Promise<boolean>): Promise<boolean> {
+		// Unsaved content and session restore are separate concerns: dirty tabs
+		// are resolved FIRST through the per-tab dialogs, then the restore
+		// snapshot records window state only (open files, active tab, edit mode,
+		// split, scroll) — it never carries document content.
+		const dirtyTabs = tabManager.tabs.filter((t) => t.isDirty);
+		if (dirtyTabs.length > 0) {
+			closeWalkActive = true;
+			pinFilesAtClose ??= openFilePaths();
+			// The walk's dialogs are in-app modals inside THIS window: with
+			// multiple windows, another window may be covering it and the review
+			// would be invisible. Bring the reviewing window to the front first.
+			invoke('show_window').catch(console.error);
+			try {
+				// Auto-save without confirmation: silently save every dirty tab
+				// that has a real path. Untitled tabs need a Save dialog, so the
+				// walk below handles them. A failed silent save is surfaced and its
+				// tab also goes to the walk. `saveContent` cancels each tab's pending
+				// timer itself, so no writer here can be raced by its own debounce.
+				// A tab whose file changed underneath is refused rather than
+				// overwritten, and the walk asks the changed-on-disk question.
+				if (settings.autoSave) {
+					for (const tab of dirtyTabs.filter((t) => t.path !== '')) {
+						const ok = await options.saveSilently(tab.id);
+						if (!ok && options.hasExternalChangeConflict(tab.id)) continue;
+						if (!ok) {
+							options.onAutoSaveFailed();
+							break;
+						}
+					}
+				}
+
+				// Close review (issue #189): walk the remaining dirty tabs one at a
+				// time — activate each and run the same localized unsaved-changes
+				// dialog a single tab close shows. Cancel stops the walk and keeps
+				// the window open. Strict tab-strip order (left to right) so the
+				// sequence is predictable; numbered untitled titles let the dialog
+				// name each tab. Re-find every round — a save can leave a tab dirty
+				// again (TOCTOU) and tabs can change while a dialog is up.
+				const resolved = await reviewDirtyTabs({
+					nextDirtyTab: () => tabManager.tabs.find((t) => t.isDirty),
+					setActive: (id) => tabManager.setActive(id),
+					settle: options.settle,
+					canCloseTab: options.canCloseTab,
+					closeTab: (id) => tabManager.closeTab(id),
+					// Resolved tabs (saved, or reverted by Don't Save) stay open for
+					// the window-state snapshot when restore is enabled; untitled
+					// tabs have nothing to restore, and with restore off the red
+					// button closes tabs one by one.
+					shouldCloseAfterResolving: (tab) => !settings.restoreStateOnReopen || tab.path === '',
+				});
+				if (!resolved) {
+					pinFilesAtClose = null;
+					return false;
+				}
+			} finally {
+				closeWalkActive = false;
+			}
+		}
+
+		// Session is clean now; record the window state for restore. Awaited:
+		// the caller holds the exit until the Rust write returns, so the process
+		// cannot exit under the snapshot.
+		await savePinnedTagIfNeeded();
+		// The re-triggered close finds nothing to review and uses the list last.
+		if (dirtyTabs.length === 0) pinFilesAtClose = null;
+		// Asked now, not when the close began: the review above can take minutes.
+		await options.persistWindowState(await remember());
+		return true;
+	}
+
+	/**
+	 * The update's settle. No re-triggered close follows it: the process exits,
+	 * or the install fails and the window stays. Either way the review's list
+	 * has been saved, and kept it would outlive a failed install into the next
+	 * last-tab close, merge or Close Tag.
+	 */
+	async function settleForUpdate(): Promise<boolean> {
+		if (settings.persistOpenEditors && (await keepUnsavedForExit())) return true;
+		try {
+			// The process exits with every window, so this one is remembered.
+			return await settleForExit(async () => true);
+		} finally {
+			pinFilesAtClose = null;
+		}
+	}
+
+	/** `appWindow.onCloseRequested`'s handler. */
+	async function handleCloseRequested(event: { preventDefault: () => void }) {
+		// The red button is a native control, so it is NOT blocked
+		// by the in-app dialog overlay: a second click while the
+		// walk below is showing a dialog would re-enter this handler
+		// and start a competing walk whose setActive calls fight the
+		// first one — the highlighted tab stops matching the dialog.
+		// One walk at a time.
+		if (closeWalkActive) {
+			event.preventDefault();
+			return;
+		}
+
+		// Hot exit on quit or when the app exits with this window: the
+		// backup is written, nothing to ask, close proceeds. Closing one
+		// of several windows asks below. Decided before `hadDirtyTabs`:
+		// the buffers stay dirty, and a re-triggered close would only
+		// find them again. If unsure, ask.
+		const keepsUnsaved = () => invoke<boolean>('keeps_unsaved_on_close').catch(() => false);
+		if (settings.persistOpenEditors && (await keepUnsavedForExit(keepsUnsaved))) return;
+
+		// With tabs to review the close is held open while their
+		// dialogs are up, then re-triggered: the handler re-enters,
+		// finds nothing dirty, and the close proceeds.
+		const hadDirtyTabs = tabManager.tabs.some((t) => t.isDirty);
+		if (hadDirtyTabs) event.preventDefault();
+		// Closing one of several windows forgets it; quit or the last window remembers.
+		const endsSession = () => invoke<boolean>('keeps_unsaved_on_close').catch(() => true);
+		if (!(await settleForExit(endsSession))) {
+			// A cancelled close cancels the quit, so the windows left ask again.
+			invoke('set_quitting', { quitting: false }).catch(console.error);
+			return;
+		}
+		// Resolved: drop the backup, so a discarded buffer stays gone.
+		if (options.recovery.isReady()) await options.recovery.drop();
+		if (hadDirtyTabs) appWindow.close();
+	}
+
+	/**
+	 * Quit is the red button applied to every window. Each one runs its own
+	 * `onCloseRequested`: reviews its unsaved tabs, writes its own restore
+	 * snapshot, and closes.
+	 *
+	 * It used to discard the snapshot instead, so ⌘Q and the red button
+	 * disagreed about whether the session came back — and the dialog that
+	 * explained the difference only appeared when a tab was dirty, which is
+	 * not the path most people take (#390). It also closed nothing but the
+	 * focused window, so quitting with two windows open did not quit.
+	 *
+	 * Every other window is asked at once rather than one after another:
+	 * `close()` resolves when the request is sent, not when the window is
+	 * gone, and there is no reply saying whether the reader cancelled. Two
+	 * windows with unsaved work therefore show their own dialogs side by side,
+	 * each still guarding its own buffers.
+	 */
+	async function appExit() {
+		// Quit keeps unsaved changes in every window, not only the last one.
+		await invoke('set_quitting', { quitting: true }).catch(console.error);
+		for (const other of await options.allWindows()) {
+			if (other.label !== appWindow.label) await other.close();
+		}
+		await appWindow.close();
+	}
+
+	async function destroyWindowAfterTabsClosed() {
+		// No tabs left: drop this window's backup so a discarded buffer stays gone.
+		if (options.recovery.isReady()) await options.recovery.drop();
+		await options.persistWindowState(false);
+
+		await appWindow.destroy();
+	}
+
+	async function closeTabAndWindowIfLast(tabId: string) {
+		if (!(await options.canCloseTab(tabId))) return;
+
+		if (tabManager.tabs.length === 1) await savePinnedTagIfNeeded();
+		tabManager.closeTab(tabId);
+		if (tabManager.tabs.length > 0) return;
+
+		invoke('unwatch_file').catch(console.error);
+		// Off, the empty window stays and renders Home.
+		if (settings.closeWindowWithLastTab) await destroyWindowAfterTabsClosed();
+	}
+
+	async function mergeSelfInto(targetLabel: string) {
+		if (closeWalkActive) return;
+		await savePinnedTagIfNeeded();
+		for (const tab of [...tabManager.tabs]) {
+			if (isHomePath(tab.path)) {
+				tabManager.closeTab(tab.id);
+				continue;
+			}
+			await options.moveTabToWindow(tab.id, targetLabel);
+		}
+		if (tabManager.tabs.length === 0) {
+			if (options.recovery.isReady()) await options.recovery.drop();
+			await options.persistWindowState(false);
+			await appWindow.destroy();
+		}
+	}
+
+	return {
+		isCloseWalkActive: () => closeWalkActive,
+		savePinnedTagIfNeeded,
+		openPinnedTag,
+		keepUnsavedForExit,
+		settleForExit,
+		settleForUpdate,
+		handleCloseRequested,
+		appExit,
+		destroyWindowAfterTabsClosed,
+		closeTabAndWindowIfLast,
+		mergeSelfInto,
+	};
+}
diff --git a/src/lib/sessions/windowMeta.svelte.ts b/src/lib/sessions/windowMeta.svelte.ts
new file mode 100644
index 00000000..6328378d
--- /dev/null
+++ b/src/lib/sessions/windowMeta.svelte.ts
@@ -0,0 +1,30 @@
+import { invoke } from '@tauri-apps/api/core';
+
+type MetaSource = {
+	readonly windowTag: { name: string; color: string } | null;
+	readonly activeTab: { title: string } | undefined;
+	readonly tabs: readonly unknown[];
+};
+
+/**
+ * Keeps the backend's window registry up to date with this window's tag,
+ * active title and tab count. Call during component init.
+ *
+ * A window opened for a pinned group is entered in the registry under the
+ * group's name when it is created. Reporting before it has adopted the group
+ * would clear that name and let a second click open the group again, so such a
+ * window starts not ready and reports from `markReady` on.
+ */
+export function reportWindowMeta(tabManager: MetaSource, readyAtStart: boolean) {
+	let ready = $state(readyAtStart);
+	$effect(() => {
+		if (!ready) return;
+		invoke('set_window_meta', {
+			tagName: tabManager.windowTag?.name ?? null,
+			tagColor: tabManager.windowTag?.color ?? null,
+			activeTabTitle: tabManager.activeTab?.title ?? '',
+			tabCount: tabManager.tabs.length,
+		}).catch(() => {});
+	});
+	return { markReady: () => void (ready = true) };
+}
diff --git a/src/lib/sessions/windowTransfer.ts b/src/lib/sessions/windowTransfer.ts
new file mode 100644
index 00000000..1f1cab01
--- /dev/null
+++ b/src/lib/sessions/windowTransfer.ts
@@ -0,0 +1,148 @@
+import { invoke } from '@tauri-apps/api/core';
+
+import { tabManager, type Tab } from '../stores/tabs.svelte.js';
+import { outgoingTabAnchorLine } from '../utils/editorPosition.js';
+import { isHomePath } from '../utils/homeTab.js';
+import { snapshotTab } from '../utils/tabTransfer.js';
+
+type EditorPane = { flushPositionTo(tabId: string): void } | null | undefined;
+
+/**
+ * The viewer's half of the window session's options: what this window
+ * sends when a tab leaves it, and how it takes one in.
+ */
+export function createTransferOptions(options: {
+	editorPane: () => EditorPane;
+	windowStateJson: () => string;
+	isCloseWalkActive: () => boolean;
+	isDisposed: () => boolean;
+	renderPreview: (tab: Tab) => Promise<void>;
+	/** Puts the preview back at the tab's reading position. */
+	restoreReadingPosition: (tab: Tab) => void;
+}) {
+	const find = (tabId: string) => tabManager.tabs.find((item) => item.id === tabId);
+
+	return {
+		serializeState: () => {
+			// Same reason as `transferPayload` below, at a different moment: this
+			// runs at close and at each checkpoint with the editor still mounted,
+			// so the tab being edited would be persisted at the position it held
+			// when the editor last came down. Only the active tab can be the one
+			// the editor holds.
+			if (tabManager.activeTabId) options.editorPane()?.flushPositionTo(tabManager.activeTabId);
+			return options.windowStateJson();
+		},
+		// A partially loaded buffer must never be handed to another window.
+		// The transfer payload has no field for "incomplete" (see
+		// tabTransfer.ts) and the destination rebuilds the tab from the
+		// payload alone, so the arriving copy would look authoritative and its
+		// auto-save would truncate the file. handleDetach and moveTabToWindow
+		// complete the buffer first; these predicates are the backstop.
+		canTransfer: (tabId: string) => {
+			const tab = find(tabId);
+			return !options.isCloseWalkActive() && tab !== undefined && !isHomePath(tab.path) && !tab.isTruncated;
+		},
+		canDetach: (tabId: string) => {
+			const tab = find(tabId);
+			return !options.isCloseWalkActive() && tab !== undefined && !isHomePath(tab.path) && !tab.isTruncated && tabManager.tabs.length >= 2;
+		},
+		transferPayload: (tabId: string) => {
+			const tab = find(tabId);
+			if (!tab) throw new Error('Tab disappeared before transfer');
+			// The snapshot carries the reading position and is taken here,
+			// synchronously, with the editor still mounted — so a tab being
+			// edited would travel with the position from its last teardown, and a
+			// tab opened straight into edit mode with 0. The preview writes its
+			// own fields on every scroll and needs nothing; this is edit mode's
+			// equivalent, and it is a no-op for any tab the editor is not on.
+			options.editorPane()?.flushPositionTo(tabId);
+			// The other half of the same problem: the flush can only speak for
+			// the tab the editor is holding, and any other tab can be sent from
+			// here too — the tab context menu names one, and `mergeSelfInto`
+			// walks all of them. `editorViewState` is what covers a background
+			// edit-mode tab in memory and it is excluded from the payload, so
+			// the anchor is recovered from it before it is dropped.
+			return JSON.stringify({
+				...snapshotTab(tab),
+				anchorLine: outgoingTabAnchorLine(tab, tabManager.activeTabId),
+			});
+		},
+		acceptTransferredTab: async (snapshot: Parameters<typeof tabManager.insertTransferredTab>[0]) => {
+			// The tab has to exist before it can be rendered, which leaves a
+			// window where this side owns a document the source still shows.
+			// Anything that goes wrong from here must undo the insert, or the
+			// same file stays open in both windows with two auto-save timers
+			// writing over each other.
+			const id = tabManager.insertTransferredTab(snapshot);
+			try {
+				const transferred = find(id);
+				if (!transferred) return null;
+				await options.renderPreview(transferred);
+				if (options.isDisposed()) {
+					tabManager.closeTab(id);
+					return null;
+				}
+				// The reading position travels with the tab, and until here nothing
+				// put it back. `insertTransferredTab` activates the tab
+				// synchronously, while its `content` is still `''`; the restore
+				// effect runs on that activation against a host with no document in
+				// it, finds no anchor and no scroll range, and the document the
+				// reader left arrives afterwards at the top. That effect cannot
+				// cover this by depending on the render — it also runs while the
+				// reader is typing in split view, where a per-render dependency
+				// would drag the preview back on every debounce — so the arrival
+				// asks again, now that the render has awaited the patch and the
+				// host holds the document.
+				//
+				// Guarded on the tab still being the active one: only the active
+				// host is displayed, and the article all of them share would move
+				// somebody else's document.
+				if (tabManager.activeTabId === id) options.restoreReadingPosition(transferred);
+				return id;
+			} catch (error) {
+				tabManager.closeTab(id);
+				throw error;
+			}
+		},
+	};
+}
+
+/**
+ * Moving a tab out of this window preserves its state as-is — dirty content,
+ * edit/split mode, history — so there is deliberately no canCloseTab() save
+ * prompt here: movement is not closing. The content travels through the Rust
+ * broker (never disk, never localStorage), and the source tab is deleted only
+ * after the destination confirms the claim, so any failure — window creation
+ * error, timeout — leaves the tab exactly where it was.
+ *
+ * A large file may still be holding only its preview slice. The receiving
+ * window cannot tell, so the buffer is completed here, before the payload is
+ * built — otherwise the document arrives short and gets written back that way.
+ */
+export function createTabMovers(options: {
+	ensureFullContent: (tabId: string) => Promise<boolean>;
+	onPartialDocument: () => void;
+	session: {
+		detach: (tabId: string) => Promise<boolean>;
+		transfer: (tabId: string, deliver: (token: string) => Promise<void>) => Promise<boolean>;
+	};
+}) {
+	return {
+		async handleDetach(tabId: string) {
+			if (!(await options.ensureFullContent(tabId))) {
+				options.onPartialDocument();
+				return false;
+			}
+			return options.session.detach(tabId);
+		},
+		async moveTabToWindow(tabId: string, targetLabel: string, focusAfter = false) {
+			if (!(await options.ensureFullContent(tabId))) {
+				options.onPartialDocument();
+				return false;
+			}
+			const moved = await options.session.transfer(tabId, (token) => invoke('offer_tab_to_window', { targetLabel, token }));
+			if (moved && focusAfter) await invoke('focus_window', { label: targetLabel });
+			return moved;
+		},
+	};
+}
diff --git a/src/lib/stores/settings.svelte.ts b/src/lib/stores/settings.svelte.ts
index a79075cd..c0bbe5be 100644
--- a/src/lib/stores/settings.svelte.ts
+++ b/src/lib/stores/settings.svelte.ts
@@ -206,6 +206,13 @@ export function isTabPosition(value: unknown): value is TabPosition {
 	return value === 'top' || value === 'left' || value === 'right';
 }
 
+/** The Settings select for the tab position, in order. */
+export const TAB_POSITION_OPTIONS: readonly { value: TabPosition; labelKey: string }[] = [
+	{ value: 'top', labelKey: 'settings.tabPositionTop' },
+	{ value: 'left', labelKey: 'settings.tabPositionLeft' },
+	{ value: 'right', labelKey: 'settings.tabPositionRight' },
+];
+
 /**
  * The allowed range of a numeric setting. Single source of truth: the settings
  * UI renders `min`/`max`/`step` from it and every write path (typing, spin
diff --git a/src/lib/stores/titleBarPlatform.svelte.ts b/src/lib/stores/titleBarPlatform.svelte.ts
new file mode 100644
index 00000000..c1bc16bd
--- /dev/null
+++ b/src/lib/stores/titleBarPlatform.svelte.ts
@@ -0,0 +1,23 @@
+import { settings } from './settings.svelte.js';
+import { platformOf } from '../utils/platform.js';
+import { modifierFor } from '../utils/shortcuts.js';
+
+/**
+ * The platform the title bar draws its chrome and menu chords for.
+ *
+ * It comes from `settings.osType` — the Rust `get_os_type` answer the rest of
+ * the app already reads — rather than from the title bar's own user-agent sniff
+ * for "Macintosh", which was a second source that could disagree with it.
+ * `platformOf` covers the window before that command answers; see the comment
+ * on it for why the title bar cannot simply read `settings.osType` directly
+ * without flashing Windows chrome on a Mac.
+ *
+ * `$derived` rather than plain values: `osType` can change once after mount
+ * (unknown → resolved). Computed once, the title bar would keep whatever the
+ * fallback said and never correct itself on a machine where the two differ.
+ */
+export class TitleBarPlatform {
+	platform = $derived(platformOf(settings.osType));
+	isMac = $derived(this.platform === 'macos');
+	modifier = $derived(modifierFor(this.platform));
+}
diff --git a/src/lib/stores/titleBarPopovers.svelte.ts b/src/lib/stores/titleBarPopovers.svelte.ts
new file mode 100644
index 00000000..3aa36adb
--- /dev/null
+++ b/src/lib/stores/titleBarPopovers.svelte.ts
@@ -0,0 +1,232 @@
+import { invoke } from '@tauri-apps/api/core';
+import { tabManager } from './tabs.svelte.js';
+import { settings } from './settings.svelte.js';
+import { t } from '../utils/i18n.js';
+import { hasRealFilePath } from '../utils/tabFileActions.js';
+
+export const TAG_COLORS = ['#5f6368', '#1a73e8', '#d93025', '#f9ab00', '#188038', '#d01884', '#a142f4', '#007b83'];
+
+type WindowTag = { name: string; color: string; pinned: boolean };
+
+/** What the tag strip draws: one line under the whole strip, in the tag's colour. */
+export function scopeLine(tag: WindowTag | null): { tagged: boolean; color: string | undefined } {
+	return { tagged: tag !== null, color: tag?.color };
+}
+
+/**
+ * The title bar's four popovers — Home, theme, kebab and the window-tag editor —
+ * and the window-level dismissal they share.
+ */
+export class TitleBarPopovers {
+	themeMenuOpen = $state(false);
+	kebabMenuOpen = $state(false);
+	homeMenuOpen = $state(false);
+	tagEditorOpen = $state(false);
+	tagDraftName = $state('');
+	tagDraftColor = $state(TAG_COLORS[1]);
+	tagError = $state('');
+
+	get anyOpen(): boolean {
+		return this.themeMenuOpen || this.kebabMenuOpen || this.homeMenuOpen || this.tagEditorOpen;
+	}
+
+	/**
+	 * The controls the popover offers for the stored tag, or null on a window
+	 * with none: Pin/Unpin and Remove act on a stored tag. Only a pinned tag can
+	 * be closed: closing saves the pin and Home reopens it. An unpinned tag would
+	 * be gone for good, which is Remove Tag's job.
+	 */
+	get tagActions(): { pinned: boolean; canClose: boolean } | null {
+		const tag = tabManager.windowTag;
+		if (!tag) return null;
+		return { pinned: tag.pinned, canClose: tag.pinned };
+	}
+
+	openTagEditor() {
+		this.tagDraftName = tabManager.windowTag?.name ?? '';
+		this.tagDraftColor = tabManager.windowTag?.color ?? TAG_COLORS[1];
+		this.tagError = '';
+		this.tagEditorOpen = true;
+	}
+
+	/**
+	 * Whether a *different* live window already carries this name.
+	 *
+	 * Asked here — when the popover commits, the moment the user names the window — and
+	 * nowhere else. In particular not at session restore: a snapshot written by
+	 * an older build can legitimately contain two windows under one name, and
+	 * refusing it there would clear a tag the user set, silently, at a moment
+	 * they are not even looking at the popover. Leaving a restored duplicate
+	 * alone costs at most a confusing pair of chips; rejecting it costs state
+	 * the user cannot get back.
+	 *
+	 * A backend that cannot answer means the user's own save goes through. The
+	 * check exists to stop one window from quietly overwriting another's pinned
+	 * documents, and an IPC failure is not evidence that it would.
+	 */
+	private async tagNameTakenElsewhere(name: string): Promise<boolean> {
+		try {
+			return (await invoke('is_window_tag_taken', { name })) === true;
+		} catch (error) {
+			console.error('Failed to check window tag exclusivity', error);
+			return false;
+		}
+	}
+
+	/**
+	 * Commit the draft and close. There is no Save button: Enter, a click
+	 * elsewhere and the chip all land here, so leaving the popover is what
+	 * saves it. Escape is the one exit that discards.
+	 *
+	 * An empty name keeps the stored tag. Clearing the field used to remove
+	 * the tag, which was harmless behind an explicit Save but would make a
+	 * stray click outside a way to delete a pinned session. Remove Tag is the
+	 * only exit that removes a tag.
+	 */
+	async applyTag() {
+		const name = this.tagDraftName.trim();
+		const tag = tabManager.windowTag;
+		if (!name || (tag && name === tag.name && this.tagDraftColor === tag.color)) {
+			this.tagEditorOpen = false;
+			this.tagError = '';
+			return;
+		}
+		if (await this.tagNameTakenElsewhere(name)) {
+			// Refused in place, with the popover still open on the name that was
+			// refused: this is a correction the user makes in the field they are
+			// already in, not news to be delivered somewhere else.
+			this.tagError = t('menu.windowTagTaken', settings.language);
+			return;
+		}
+		let pinned = tag?.pinned;
+		// The closing save refreshes the pin by the window's current name, so a
+		// rename has to reach the pin file first or the window unpins at close.
+		// A colour change needs nothing here: the closing save carries it.
+		if (tag?.pinned && name !== tag.name) {
+			const renamed = await invoke('rename_pinned_tag', { oldName: tag.name, name, color: this.tagDraftColor }).catch((error) => {
+				console.error('Failed to rename the pinned tag', error);
+				return 'failed';
+			});
+			if (renamed === 'taken') {
+				this.tagError = t('menu.pinnedTagTaken', settings.language);
+				return;
+			}
+			pinned = renamed === 'renamed';
+		}
+		tabManager.setWindowTag({ name, color: this.tagDraftColor, pinned });
+		this.tagEditorOpen = false;
+		this.tagError = '';
+	}
+
+	/**
+	 * Left-click the chip: a toggle. `stopPropagation` because the window
+	 * `click` listener is `dismiss`, and would otherwise dismiss the popover this
+	 * just opened.
+	 */
+	toggleTagEditor(event: Event) {
+		event.stopPropagation();
+		if (this.tagEditorOpen) this.applyTag();
+		else this.openTagEditor();
+	}
+
+	/**
+	 * Right-click the chip: the same popover left-click opens.
+	 *
+	 * The chip borrows Chrome's tab-group chip visually, but not the state that
+	 * makes Chrome's left/right division necessary. There, left-click collapses
+	 * and expands the group, so the commands need somewhere else to live. A
+	 * window tag has nothing to collapse — it scopes the whole window — so
+	 * left-click has no second job, and putting Pin/Remove behind a right-click
+	 * would only hide them behind a gesture with no affordance advertising it.
+	 * The one thing right-click does owe the user is not raising the platform
+	 * menu over the title bar, hence `preventDefault`.
+	 *
+	 * It opens but never closes, unlike the left-click toggle. `openTagEditor`
+	 * re-seeds the draft from the stored tag, so re-opening an open popover
+	 * would throw away a name the user is in the middle of typing; and a
+	 * gesture whose whole purpose is "show me the tag's controls" should not
+	 * sometimes hide them. `stopPropagation` for the same reason the chip's
+	 * left-click has one: `dismiss` is wired to window `contextmenu`, and would
+	 * otherwise dismiss the popover this just opened.
+	 */
+	openTagEditorFromContextMenu(event: Event) {
+		event.preventDefault();
+		event.stopPropagation();
+		if (!this.tagEditorOpen) this.openTagEditor();
+	}
+
+	/**
+	 * Home > Set window tag. It calls no `stopPropagation` of its own while the
+	 * open Home menu has already installed the window listener: the menu
+	 * container's `containClick` keeps this click from reaching it.
+	 */
+	openTagEditorFromHomeMenu() {
+		this.homeMenuOpen = false;
+		this.openTagEditor();
+	}
+
+	editorKeydown(event: { key: string }) {
+		if (event.key === 'Escape') this.tagEditorOpen = false;
+		else if (event.key === 'Enter') this.applyTag();
+	}
+
+	nameEdited() {
+		this.tagError = '';
+	}
+
+	clearTag() {
+		const tag = tabManager.windowTag;
+		if (tag?.pinned) invoke('remove_pinned_tag', { name: tag.name }).catch(console.error);
+		tabManager.setWindowTag(null);
+		this.tagEditorOpen = false;
+	}
+
+	async togglePinnedTag() {
+		const tag = tabManager.windowTag;
+		if (!tag) return;
+		if (tag.pinned) {
+			invoke('remove_pinned_tag', { name: tag.name }).catch(console.error);
+			tabManager.setWindowTag({ ...tag, pinned: false });
+			return;
+		}
+		const files = tabManager.tabs.filter((tab) => hasRealFilePath(tab.path)).map((tab) => tab.path);
+		// A pinned group whose window is closed still holds its name, and
+		// pinning over it would replace its files. Refused the way a rename is.
+		const created = await invoke('save_pinned_tag', { name: tag.name, color: tag.color, files }).catch(console.error);
+		if (created === false) {
+			this.tagError = t('menu.pinnedTagTaken', settings.language);
+			return;
+		}
+		tabManager.setWindowTag({ ...tag, pinned: true });
+	}
+
+	/** Closes every menu; the tag editor commits its draft on the way out. */
+	dismiss = () => {
+		this.themeMenuOpen = false;
+		this.kebabMenuOpen = false;
+		this.homeMenuOpen = false;
+		if (this.tagEditorOpen) this.applyTag();
+	};
+
+	/**
+	 * Run inside an `$effect`: while any popover is open, a click, a context
+	 * menu or the window losing focus dismisses it. The returned teardown takes
+	 * the listeners off again.
+	 */
+	listenForDismiss(target: EventTarget): () => void {
+		const types = ['click', 'contextmenu', 'blur'];
+		if (this.anyOpen) for (const type of types) target.addEventListener(type, this.dismiss);
+		return () => {
+			for (const type of types) target.removeEventListener(type, this.dismiss);
+		};
+	}
+}
+
+/**
+ * A popover's own clicks stay inside it: without this, picking a colour in the
+ * tag editor, or an item in the Home menu, would reach the window listener and
+ * dismiss the popover it was made in.
+ */
+export function containClick(event: Event) {
+	event.stopPropagation();
+}
diff --git a/src/lib/stores/tocNavigator.svelte.ts b/src/lib/stores/tocNavigator.svelte.ts
new file mode 100644
index 00000000..1552f64c
--- /dev/null
+++ b/src/lib/stores/tocNavigator.svelte.ts
@@ -0,0 +1,194 @@
+import { untrack } from 'svelte';
+
+import { settings } from './settings.svelte.js';
+import { jumpScrollBehavior } from '../utils/motion.js';
+import { anchorScrollTop } from '../utils/previewAnchor.js';
+import type { RendererLine } from '../utils/lineCoordinates.js';
+import type { TocItem } from '../utils/tocEntries.js';
+import { activeTocIdForLine, sourceLineOf } from '../utils/tocFollow.js';
+
+/** How long a jump's own smooth scroll is given to settle. */
+export const CLICK_LOCK_MS = 600;
+
+export interface TocJump {
+	contentRoot: HTMLElement | null;
+	markdownBody: HTMLElement | null;
+	items: readonly TocItem[];
+	onBeforeJump?: () => void;
+	onjump?: (id: string, text: string, sourceLine: RendererLine | null) => void;
+}
+
+/**
+ * The outline's current entry, its jumps, and the highlight a jump leaves on
+ * its target in the preview. `Toc.svelte` renders it and wires its effects
+ * through it.
+ */
+export class TocNavigator {
+	activeId = $state<string | null>(null);
+
+	// when user clicks a toc entry, lock active id until scroll catches up
+	private clickLock: string | null = null;
+	private clickLockTimer: ReturnType<typeof setTimeout> | null = null;
+	private activeTargetEl: HTMLElement | null = null;
+
+	constructor(private readonly tocContainer: () => HTMLElement | null) {}
+
+	/**
+	 * Drop the "you jumped here" highlight.
+	 *
+	 * It is a temporary emphasis, so it has to end on anything that means the
+	 * reader has moved on. Hanging it off scrolling alone made it permanent
+	 * whenever that one event did not arrive — the jump's own smooth scroll is
+	 * swallowed by `clickLock`, and if nothing scrolls the preview afterwards
+	 * there is no second chance.
+	 */
+	private clearTargetHighlight() {
+		if (!this.activeTargetEl) return;
+
+		this.activeTargetEl.classList.remove('toc-target-active');
+		this.activeTargetEl = null;
+	}
+
+	/**
+	 * The highlight is worn by an element in the PREVIEW, which outlives this
+	 * component. Going away while one is showing — the outline collapsing itself
+	 * after a jump, or the reader hiding it by hand — used to leave that mark on
+	 * the heading with nothing able to clear it: the listeners left with the
+	 * component, and a later instance starts with its own `activeTargetEl` and
+	 * cannot see what an earlier one marked. So hand the clearing over to
+	 * listeners that belong to nobody, and take them all off the first time the
+	 * reader moves.
+	 */
+	private releaseStrandedHighlight(el: HTMLElement) {
+		const stranded = this.activeTargetEl;
+		if (!stranded) return;
+		this.activeTargetEl = null;
+
+		const clear = () => {
+			stranded.classList.remove('toc-target-active');
+			el.removeEventListener('scroll', clear);
+			el.removeEventListener('pointerdown', clear);
+			window.removeEventListener('keydown', clear);
+		};
+		const listen = () => {
+			el.addEventListener('scroll', clear, { passive: true });
+			el.addEventListener('pointerdown', clear, { passive: true });
+			window.addEventListener('keydown', clear, { passive: true });
+		};
+
+		// Exactly what `clickLock` is for, and the reason it cannot simply be
+		// read here: the jump's own smooth scroll is still running, and it must
+		// not be mistaken for the reader scrolling away from what they just
+		// asked to see. The timer outlives the component, the lock does not.
+		if (this.clickLock) setTimeout(listen, CLICK_LOCK_MS);
+		else listen();
+	}
+
+	private handleScroll = () => {
+		// The lock is here for the jump's OWN smooth scroll, which would
+		// otherwise clear the highlight before the reader has seen it.
+		if (this.clickLock) return;
+		this.clearTargetHighlight();
+	};
+
+	/**
+	 * A deliberate action by the reader, which the lock must not swallow: the
+	 * lock exists to ignore scrolling the app itself caused, and a click or a
+	 * keystroke is never that.
+	 */
+	private handleReaderAction = () => {
+		this.clearTargetHighlight();
+	};
+
+	/**
+	 * Keep the current entry in the MIDDLE of the outline, not merely on screen.
+	 *
+	 * `block: 'nearest'` scrolls the least it can get away with, so the outline
+	 * sat still until the current entry crossed an edge and then jumped by one
+	 * row — the reader saw the highlight walk down to the last visible line and
+	 * stay pinned there, with no idea what came next. Centring costs the same
+	 * one call and keeps the entries either side of where you are visible,
+	 * which is the reason to look at an outline while scrolling at all.
+	 */
+	private scrollTocIntoView() {
+		const tocContainer = this.tocContainer();
+		if (tocContainer && this.activeId) {
+			const activeEl = tocContainer.querySelector(`[data-id="${CSS.escape(this.activeId)}"]`);
+			if (activeEl) activeEl.scrollIntoView({ block: 'center', behavior: 'smooth' });
+		}
+	}
+
+	/**
+	 * Which entry the reader is on, from whichever pane they are scrolling.
+	 * Run inside an `$effect`: `line` is its input, and `visibleItems` is read
+	 * only once the lock lets it through.
+	 *
+	 * This is the whole of #169. The outline used to decide by rendered box,
+	 * which only the preview has: in editor-only mode the preview never
+	 * scrolls, and in split view it moves only while scroll sync is on, so the
+	 * outline sat still. A source line is something both panes can produce, and
+	 * resolving it is a comparison rather than a layout read.
+	 *
+	 * A click still wins until its own scroll settles — the same `clickLock`
+	 * the preview's handler respected.
+	 */
+	follow(line: RendererLine | null, visibleItems: () => readonly TocItem[]) {
+		if (line === null || this.clickLock) return;
+
+		const next = activeTocIdForLine(visibleItems(), line);
+		if (next === null || next === untrack(() => this.activeId)) return;
+
+		this.activeId = next;
+		untrack(() => this.scrollTocIntoView());
+	}
+
+	/** Attach to the preview's scrolling box; the return value detaches. */
+	listen(el: HTMLElement): () => void {
+		// Capture the element the listener was attached to: the cleanup must
+		// detach from that same node, not from whatever `markdownBody` points at
+		// when the effect re-runs (a changed prop would leak the old listener, a
+		// null prop would throw).
+		el.addEventListener('scroll', this.handleScroll, { passive: true });
+		// `pointerdown`, not `click`: clicking a link inside the preview
+		// navigates, and the click never completes on the element that
+		// carried the highlight.
+		el.addEventListener('pointerdown', this.handleReaderAction, { passive: true });
+		// On the window, because after a jump the focus can be in either
+		// pane or in neither — the reader typing anywhere has moved on.
+		window.addEventListener('keydown', this.handleReaderAction, { passive: true });
+		return () => {
+			el.removeEventListener('scroll', this.handleScroll);
+			el.removeEventListener('pointerdown', this.handleReaderAction);
+			window.removeEventListener('keydown', this.handleReaderAction);
+			this.releaseStrandedHighlight(el);
+		};
+	}
+
+	jumpTo(id: string, { contentRoot, markdownBody, items, onBeforeJump, onjump }: TocJump) {
+		const el = contentRoot?.querySelector(`[id="${CSS.escape(id)}"]`) as HTMLElement | null;
+		if (el && markdownBody) {
+			onBeforeJump?.();
+			// lock active id immediately so scroll handler doesn't override
+			this.clickLock = id;
+			this.activeId = id;
+			this.scrollTocIntoView();
+
+			const item = items.find(i => i.id === id);
+			if (item) onjump?.(id, item.text, sourceLineOf(el.dataset.sourcepos));
+
+			// highlight element persistently until scroll
+			this.clearTargetHighlight();
+			el.classList.add('toc-target-active');
+			this.activeTargetEl = el;
+
+			markdownBody.scrollTo({
+				top: anchorScrollTop(markdownBody, el),
+				behavior: jumpScrollBehavior(settings.animateJumpScroll),
+			});
+
+			// release lock after scroll settles
+			if (this.clickLockTimer) clearTimeout(this.clickLockTimer);
+			this.clickLockTimer = setTimeout(() => { this.clickLock = null; }, CLICK_LOCK_MS);
+		}
+	}
+}
diff --git a/src/lib/utils/autoSaveTimer.ts b/src/lib/utils/autoSaveTimer.ts
new file mode 100644
index 00000000..381fe93f
--- /dev/null
+++ b/src/lib/utils/autoSaveTimer.ts
@@ -0,0 +1,46 @@
+/** One tab as the auto-save debounce sees it on a pass. */
+export type AutoSaveTabState = {
+	id: string;
+	path: string;
+	isDirty: boolean;
+	/** In edit mode or split view. */
+	editable: boolean;
+	hasPendingConflict: boolean;
+	decodedLossily: boolean;
+};
+
+/** Whether the debounce arms (or keeps) a timer for this tab. */
+export function isAutoSaveEligible(s: AutoSaveTabState, isLossySaveRefused: (tabId: string) => boolean): boolean {
+	// A tab with an unanswered external-change conflict is NOT
+	// eligible: the debounce would fire while the bar is still
+	// asking "reload or keep mine", write the buffer, and destroy
+	// the disk version the question was about — leaving the user to
+	// answer a question whose "reload" branch no longer exists.
+	// Only this background timer is held back. Cmd+S and the close
+	// dialog's Save still write, because that answer means "keep
+	// mine".
+	// A tab whose buffer was decoded lossily is dropped once the
+	// guard has refused it and said why. The first attempt is what
+	// produces that explanation, so it is deliberately allowed
+	// through; re-arming after it would only reach the same refusal
+	// every 1.5s for as long as the user keeps typing.
+	return s.isDirty && s.path !== '' && s.editable && !s.hasPendingConflict
+		&& !(s.decodedLossily && isLossySaveRefused(s.id));
+}
+
+/** Whether an auto-save that resolved false gets the generic "auto-save failed" toast. */
+export function autoSaveFailureNeedsToast(
+	tabId: string,
+	reasons: { isLossySaveRefused: (tabId: string) => boolean; hasExternalChangeConflict: (tabId: string) => boolean },
+): boolean {
+	// A refusal already explained itself, naming the
+	// file and the way out. "Auto-save failed" on top
+	// of that says nothing new.
+	if (reasons.isLossySaveRefused(tabId)) return false;
+	// Same reasoning for the other refusal: the disk
+	// moved under the write, and the conflict bar is
+	// already on screen saying so and offering both
+	// ways out.
+	if (reasons.hasExternalChangeConflict(tabId)) return false;
+	return true;
+}
diff --git a/src/lib/utils/choiceDialog.svelte.ts b/src/lib/utils/choiceDialog.svelte.ts
new file mode 100644
index 00000000..5bb373b3
--- /dev/null
+++ b/src/lib/utils/choiceDialog.svelte.ts
@@ -0,0 +1,32 @@
+export type DialogChoice = 'save' | 'discard' | 'cancel';
+
+/** The one save/discard/cancel dialog the viewer shows. */
+export class ChoiceDialog {
+	show = $state(false);
+	title = $state('');
+	message = $state('');
+	kind = $state<'info' | 'warning' | 'error'>('info');
+	showSave = $state(false);
+	resolve: ((v: DialogChoice) => void) | null = null;
+
+	ask(message: string, options: { title: string; kind: 'info' | 'warning' | 'error'; showSave?: boolean }): Promise<DialogChoice> {
+		// A second question replaces the first dialog, so the first caller is
+		// answered 'cancel' rather than left awaiting a resolver that is about to
+		// be overwritten — a close walk left that way never finished, and the
+		// window could not be closed again. An already-answered one ignores it.
+		this.resolve?.('cancel');
+		return new Promise((resolve) => {
+			this.show = true;
+			this.title = options.title;
+			this.message = message;
+			this.kind = options.kind;
+			this.showSave = options.showSave ?? false;
+			this.resolve = resolve;
+		});
+	}
+
+	close(choice: DialogChoice) {
+		this.resolve?.(choice);
+		this.show = false;
+	}
+}
diff --git a/src/lib/utils/diffView.ts b/src/lib/utils/diffView.ts
new file mode 100644
index 00000000..30aeb574
--- /dev/null
+++ b/src/lib/utils/diffView.ts
@@ -0,0 +1,35 @@
+import type * as Monaco from 'monaco-editor';
+
+/**
+ * Builds the read-only side-by-side diff for `DiffOverlay.svelte` and returns
+ * its teardown.
+ *
+ * Models of its own rather than the tab's: this view must not be able to touch
+ * the document, and handing it the live model would put a second editor on a
+ * buffer that `Editor.svelte` owns. The teardown disposes both models too, or
+ * opening the view repeatedly leaks one document's worth of text each time.
+ */
+export function openDiffView(
+	monaco: Pick<typeof Monaco, 'editor'>,
+	element: HTMLElement,
+	original: string,
+	modified: string,
+	languageId: string,
+): () => void {
+	const left = monaco.editor.createModel(original, languageId);
+	const right = monaco.editor.createModel(modified, languageId);
+	const models = [left, right];
+	const editor = monaco.editor.createDiffEditor(element, {
+		readOnly: true,
+		originalEditable: false,
+		automaticLayout: true,
+		renderSideBySide: true,
+		scrollBeyondLastLine: false,
+		minimap: { enabled: false },
+	});
+	editor.setModel({ original: left, modified: right });
+	return () => {
+		editor.dispose();
+		for (const model of models) model.dispose();
+	};
+}
diff --git a/src/lib/utils/editorActions.ts b/src/lib/utils/editorActions.ts
new file mode 100644
index 00000000..af0942b3
--- /dev/null
+++ b/src/lib/utils/editorActions.ts
@@ -0,0 +1,645 @@
+import type * as Monaco from 'monaco-editor';
+
+import type { InlineWrapToolId, LineMarkerToolId } from './editorToolbar.js';
+import { t, type LanguageCode } from './i18n.js';
+import type { TableOperation } from './tableEditing.js';
+import type { ViewerCommand } from './viewerKeymap.js';
+
+/**
+ * The editor's keymap: every action it registers (id, translated label,
+ * keybindings, `run`) and every nameless key command, as data.
+ *
+ * `Editor.svelte` hands these to `editor.addAction` / `editor.addCommand`. They
+ * live here rather than in the component so a test can ask what a chord is bound
+ * to, and what running it does, without Monaco or a mounted component. Monaco is
+ * passed in for its `KeyMod`/`KeyCode` numbers, because the component loads it
+ * with a dynamic `import()` and this module must not pull it into the startup
+ * graph.
+ */
+
+/** The two Monaco namespaces a keybinding number is built from. */
+export type MonacoKeys = { KeyMod: typeof Monaco.KeyMod; KeyCode: typeof Monaco.KeyCode };
+
+/** What the actions' `run` reaches: the editing primitives and settings the component owns. */
+export type EditorActionDeps = {
+	monaco: MonacoKeys;
+	isMac: boolean;
+	settings: {
+		minimap: boolean;
+		vimMode: boolean;
+		statusBar: boolean;
+		wordCount: boolean;
+		occurrencesHighlight: boolean;
+		showWhitespace: boolean;
+		toggleWordWrap(): void;
+		toggleLineNumbers(): void;
+		toggleLineHighlight(): void;
+	};
+	oncommand?: (command: ViewerCommand) => void;
+	copyToClipboard: () => Promise<void>;
+	toggleInlineWrapTool: (id: InlineWrapToolId) => void;
+	toggleTagFormat: (marker: string) => void;
+	toggleLineMarkerTool: (id: LineMarkerToolId) => void;
+	wrapAsCodeBlock: () => void;
+	insertLink: () => void;
+	insertSimpleTable: () => void;
+	editTable: (operation: TableOperation) => boolean;
+};
+
+/**
+ * Every action whose label comes from `t()`, labelled in `lang`. The component
+ * re-registers the whole set when the UI language changes.
+ */
+export function editorActions(deps: EditorActionDeps, lang: LanguageCode): Monaco.editor.IActionDescriptor[] {
+	const {
+		monaco,
+		settings,
+		oncommand,
+		copyToClipboard,
+		toggleInlineWrapTool,
+		toggleTagFormat,
+		toggleLineMarkerTool,
+		wrapAsCodeBlock,
+		insertLink,
+		insertSimpleTable,
+		editTable,
+	} = deps;
+
+	// macOS reserves Cmd+Tab for the system application switcher, so a
+	// CtrlCmd-based binding never reaches the editor there. VS Code binds the
+	// real Ctrl key (KeyMod.WinCtrl) on macOS for its own Tab cycling.
+	const tabCycleModifier = deps.isMac
+		? monaco.KeyMod.WinCtrl
+		: monaco.KeyMod.CtrlCmd;
+
+	return [
+		// ⌘C. Keeps its label so the command palette can show it
+		// translated; the work itself is the shared function.
+		{
+			id: "custom-copy",
+			label: t('menu.copy', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyC],
+			keybindingContext: "editorTextFocus",
+			run: copyToClipboard,
+		},
+
+		{
+			id: "toggle-minimap",
+			label: t('settings.minimap', lang),
+			run: () => {
+				settings.minimap = !settings.minimap;
+			},
+		},
+
+		{
+			id: "toggle-word-wrap",
+			label: t('settings.wordWrap', lang),
+			run: () => {
+				settings.toggleWordWrap();
+			},
+		},
+
+		{
+			id: "toggle-line-numbers",
+			label: t('settings.lineNumbers', lang),
+			run: () => {
+				settings.toggleLineNumbers();
+			},
+		},
+
+		{
+			id: "toggle-vim-mode",
+			label: t('settings.vimMode', lang),
+			run: () => {
+				settings.vimMode = !settings.vimMode;
+			},
+		},
+
+		{
+			id: "toggle-status-bar",
+			label: t('settings.statusBar', lang),
+			run: () => {
+				settings.statusBar = !settings.statusBar;
+			},
+		},
+
+		{
+			id: "toggle-word-count",
+			label: t('settings.wordCount', lang),
+			run: () => {
+				settings.wordCount = !settings.wordCount;
+			},
+		},
+
+		{
+			id: "toggle-line-highlight",
+			label: t('settings.lineHighlight', lang),
+			run: () => {
+				settings.toggleLineHighlight();
+			},
+		},
+
+		{
+			id: "toggle-occurrences-highlight",
+			label: t('settings.occurrencesHighlight', lang),
+			run: () => {
+				settings.occurrencesHighlight = !settings.occurrencesHighlight;
+			},
+		},
+
+		{
+			id: "toggle-whitespace",
+			label: t('settings.showWhitespace', lang),
+			run: () => {
+				settings.showWhitespace = !settings.showWhitespace;
+			},
+		},
+
+		{
+			id: "toggle-tabs",
+			label: t('settings.showTabs', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyB,
+			],
+			run: () => oncommand?.("toggle-tabs"),
+		},
+
+		{
+			id: "toggle-zen-mode",
+			label: t('settings.zenMode', lang),
+			// THE THIRD ADDRESS THIS COMMAND HAS HAD, and the first two are why
+			// the note is this long. It was Ctrl/Cmd+Shift+Z, which is REDO — on
+			// macOS redo's ONLY key, because Monaco's mac override replaces the
+			// default rule rather than adding to it, so Cmd+Y (the escape hatch
+			// Windows and Linux keep) does not exist there. `addAction` registers
+			// at weight 1000, so zen mode did not share that key, it took it, and
+			// a mac user had no way to redo from the keyboard at all.
+			//
+			// Then Ctrl/Cmd+Shift+D, which was free — but the Ctrl/Cmd+Shift row
+			// is where the formatting verbs live (B, E, F, X and now the digits),
+			// and a view mode is not one of them. Ctrl/Cmd+Alt+Z is unclaimed in
+			// Monaco on all three platforms, Z is for zen, and it sits with the
+			// other Alt-modified commands rather than among the formatters.
+			// `editor.chords.spec.ts` reads Monaco's real keymap and is
+			// what refuses the next such landing.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Alt | monaco.KeyCode.KeyZ,
+			],
+			keybindingContext: "!altGraphChord",
+			run: () => oncommand?.("toggle-zen-mode"),
+		},
+
+		{
+			id: "fmt-bold",
+			label: t('menu.bold', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyB],
+			run: () => toggleInlineWrapTool("fmt-bold"),
+		},
+
+		{
+			id: "fmt-italic",
+			label: t('menu.italic', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyI],
+			run: () => toggleInlineWrapTool("fmt-italic"),
+		},
+
+		{
+			id: "fmt-underline",
+			label: t('menu.underline', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyU],
+			run: () => toggleTagFormat("<u>|</u>"),
+		},
+
+		{
+			id: "fmt-strikethrough",
+			label: t('menu.strikethrough', lang),
+			// GitHub's chord. editor.chords.spec.ts checks Monaco binds
+			// nothing on it.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyX,
+			],
+			run: () => toggleInlineWrapTool("fmt-strikethrough"),
+		},
+
+		// The six bindings below were chosen against the whole keymap, not
+		// against VS Code's: standalone Monaco and VS Code do not ship the
+		// same defaults, and the chords the mainstream Markdown editors use
+		// for these actions are the ones Monaco is most likely to be sitting
+		// on. `addAction` registers at weight 1000, above every Monaco
+		// default, so a clash is silent — our action simply wins and the
+		// Monaco command loses its key. The reasoning per binding is below,
+		// and `shortcuts.checks.test.ts` is what stops the next one from
+		// landing on an occupied chord.
+
+		{
+			id: "fmt-inline-code",
+			label: t('menu.inlineCode', lang),
+			// GitHub's Markdown editor binds inline code to Ctrl/Cmd+E, but
+			// plain Ctrl/Cmd+E is already `view-toggle-edit` here — which is
+			// itself the mainstream reading (Obsidian and Mark Text both use
+			// it for edit/read). So: same letter, plus Shift. Typora's
+			// Ctrl+Shift+` and Mark Text's Ctrl+` are rejected on purpose —
+			// #121 is *about* the backtick being a dead key on QWERTZ.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyE,
+			],
+			run: () => toggleInlineWrapTool("fmt-inline-code"),
+		},
+
+		{
+			id: "fmt-code-block",
+			label: t('menu.codeBlock', lang),
+			// No mainstream chord survives contact with Monaco. Typora and
+			// Mark Text both use Ctrl+Shift+K on Windows/Linux, which is
+			// `editor.action.deleteLines` on BOTH platforms, and both switch
+			// to Cmd+Option+C on macOS, which is `toggleFindCaseSensitive`.
+			// F is for the fences ("Code Fences" is Typora's own name for
+			// the command); it is free everywhere.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyF,
+			],
+			run: () => wrapAsCodeBlock(),
+		},
+
+		{
+			id: "fmt-quote",
+			label: t('menu.quote', lang),
+			// GitHub's documented blockquote chord, and the only one that is
+			// the same on both platforms in any editor surveyed: Shift+. is
+			// `>` on a US layout, the blockquote marker itself. Typora and
+			// Mark Text use Ctrl+Shift+Q, which macOS cannot deliver —
+			// Shift+Cmd+Q is the system Log Out — which is why both of them
+			// fall back to Cmd+Option+Q there.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Period,
+			],
+			run: () => toggleLineMarkerTool("fmt-quote"),
+		},
+
+		// Typora binds Ctrl/Cmd+1..6 and Mark Text binds Cmd+1..6; Markpad
+		// has only three heading actions, so it binds three. 4, 5 and 6 are
+		// left unbound rather than given to something else, so completing
+		// the range later moves nothing.
+		{
+			id: "fmt-heading-1",
+			label: t('menu.heading1', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit1],
+			run: () => toggleLineMarkerTool("fmt-heading-1"),
+		},
+
+		{
+			id: "fmt-heading-2",
+			label: t('menu.heading2', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit2],
+			run: () => toggleLineMarkerTool("fmt-heading-2"),
+		},
+
+		{
+			id: "fmt-heading-3",
+			label: t('menu.heading3', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.Digit3],
+			run: () => toggleLineMarkerTool("fmt-heading-3"),
+		},
+
+		// The three list buttons, which had actions and no keys at all.
+		// Ctrl/Cmd+Shift+7 and +8 are GitHub's documented chords, the same on
+		// both its platforms, and Monaco leaves the whole Ctrl/Cmd+Shift digit
+		// row alone except for `1` (replaceOne). Numbered is 7 and bulleted is
+		// 8 because that is the way round GitHub has them.
+		{
+			id: "fmt-bullet-list",
+			label: t('menu.bulletList', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit8,
+			],
+			run: () => toggleLineMarkerTool("fmt-bullet-list"),
+		},
+
+		{
+			id: "fmt-numbered-list",
+			label: t('menu.numberedList', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit7,
+			],
+			run: () => toggleLineMarkerTool("fmt-numbered-list"),
+		},
+
+		// 9 HAS NO PRECEDENT, and this says so rather than implying one:
+		// GitHub documents no task-list chord, nor do Typora and Obsidian, and
+		// the two editors that do bind one disagree and are both occupied here
+		// (Bear's Cmd+T is New File; iA Writer's Opt+Cmd+L is Monaco's
+		// `toggleFindInSelection` on macOS). So the third list button takes the
+		// digit next to the two above it.
+		{
+			id: "fmt-checklist",
+			label: t('menu.checklist', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Digit9,
+			],
+			run: () => toggleLineMarkerTool("fmt-checklist"),
+		},
+
+		{
+			id: "fmt-link",
+			label: t('menu.link', lang),
+			// ⌘K / Ctrl+K. Typora, Bear, iA Writer and GitHub all document this
+			// for Insert Link — the only command in the survey where four
+			// independent sources agree exactly — and the button had no key at
+			// all.
+			//
+			// Monaco binds no COMPLETE keybinding on Ctrl/Cmd+K; what it binds is
+			// 31 chord SEQUENCES behind it. Claiming the key as a whole chord
+			// ends that namespace, which is deliberate and argued in
+			// editor.chords.spec.ts rather than here, because the loss is
+			// keymap-wide rather than one command's.
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyK],
+			run: () => insertLink(),
+		},
+
+		{
+			id: "insert-table-simple",
+			label: t('menu.insertTable', lang),
+			// ONE STROKE, not a sequence. This was `Mod+K T` (in both its
+			// released and modifier-held forms, the way VS Code registers its own
+			// Mod+K chords); Mod+K is Insert Link now, and a two-key gesture was
+			// awkward enough to press that it is what started this rework.
+			// Ctrl+Alt+T / ⌥⌘T is Typora's and Bear's chord for the same command,
+			// and Monaco binds nothing on it on any of the three platforms.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Alt | monaco.KeyCode.KeyT,
+			],
+			keybindingContext: "!altGraphChord",
+			run: () => insertSimpleTable(),
+		},
+
+		// The rest of the table verbs. Actions rather than bare commands, so the
+		// command palette and the shortcuts panel can list them. Which verbs get
+		// a chord: TABLE_VERBS_WITHOUT_A_CHORD in shortcuts.test.ts.
+		{
+			id: "table-insert-row",
+			label: t('menu.insertTableRow', lang),
+			run: () => {
+				editTable("insert-row");
+			},
+		},
+
+		{
+			id: "table-delete-row",
+			label: t('menu.deleteTableRow', lang),
+			run: () => {
+				editTable("delete-row");
+			},
+		},
+
+		{
+			id: "table-insert-column",
+			label: t('menu.insertTableColumn', lang),
+			// C for Column, and one of the "insert a structure" family: it sits
+			// with Ctrl/Cmd+Shift+7, +8 and +9, which insert the three list
+			// kinds. Monaco binds nothing on Ctrl/Cmd+Shift+C on any of the three
+			// platforms, as a whole chord or as a prefix.
+			//
+			// It was on `Mod+K C`, which cannot be typed any more: `Mod+K` is
+			// Insert Link and is no longer a prefix. `Mod+Alt+C` was the obvious
+			// replacement and had to be refused — see the note above
+			// DELIBERATE_OVERRIDES in editor.chords.spec.ts. Palette-only
+			// was tried first and is too weak for a verb people reach for while
+			// building a table: Mod+P, type the name, Enter.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyC,
+			],
+			run: () => {
+				editTable("insert-column");
+			},
+		},
+
+		{
+			id: "table-delete-column",
+			label: t('menu.deleteTableColumn', lang),
+			// Backspace, not D: D sits next to Insert Column's C, and one slip
+			// would delete a column. Monaco binds nothing on this chord.
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Backspace,
+			],
+			run: () => {
+				editTable("delete-column");
+			},
+		},
+
+		{
+			id: "file-new",
+			label: t('menu.newFile', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyN,
+				monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyT,
+			],
+			run: () => oncommand?.("new-file"),
+		},
+
+		{
+			id: "file-open",
+			label: t('menu.openFile', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyO],
+			run: () => oncommand?.("open-file"),
+		},
+
+		{
+			id: "file-save",
+			label: t('menu.save', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyS],
+			run: () => oncommand?.("save"),
+		},
+
+		{
+			id: "file-close",
+			label: t('menu.closeFile', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyW],
+			run: () => oncommand?.("close-file"),
+		},
+
+		{
+			id: "app-home",
+			label: t('menu.home', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyH,
+			],
+			run: () => oncommand?.("toggle-home"),
+		},
+
+		{
+			id: "file-reveal",
+			label: t('menu.openFileLocation', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyR,
+			],
+			run: () => oncommand?.("reveal-file"),
+		},
+
+		{
+			id: "file-export-pdf",
+			label: t('menu.exportPdf', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyP,
+			],
+			run: () => oncommand?.("export-pdf"),
+		},
+
+		{
+			id: "view-toggle-edit",
+			label: t('menu.editMode', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyE],
+			run: () => oncommand?.("toggle-edit-view"),
+		},
+
+		{
+			id: "view-toggle-live",
+			label: t('menu.autoReload', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyL],
+			run: () => oncommand?.("toggle-live-mode"),
+		},
+
+		{
+			id: "view-toggle-split",
+			label: t('menu.toggleSplitView', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyCode.Backslash,
+				monaco.KeyMod.CtrlCmd | monaco.KeyCode.IntlBackslash,
+			],
+			run: () => oncommand?.("toggle-split-view"),
+		},
+
+		{
+			id: "tab-next",
+			label: t('menu.nextTab', lang),
+			keybindings: [tabCycleModifier | monaco.KeyCode.Tab],
+			run: () => oncommand?.("next-tab"),
+		},
+
+		{
+			id: "tab-prev",
+			label: t('menu.previousTab', lang),
+			keybindings: [
+				tabCycleModifier | monaco.KeyMod.Shift | monaco.KeyCode.Tab,
+			],
+			run: () => oncommand?.("previous-tab"),
+		},
+
+		{
+			id: "tab-undo-close",
+			label: t('menu.undoCloseTab', lang),
+			keybindings: [
+				monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.KeyT,
+			],
+			run: () => oncommand?.("undo-close-tab"),
+		},
+
+		{
+			id: "app-command-palette",
+			label: t('menu.commandPalette', lang),
+			keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyP],
+			run: (ed) => {
+				ed.trigger("keyboard", "editor.action.quickCommand", {});
+			},
+		},
+
+	];
+}
+
+/** The component functions a nameless key command can run. */
+export type EditorKeyHandler =
+	| 'cutToClipboard'
+	| 'pasteFromClipboard'
+	| 'continueListOnEnter'
+	| 'handleTabKey'
+	| 'handleShiftTabKey'
+	| 'handleModEnterKey'
+	| 'handleModShiftEnterKey';
+
+/** One `editor.addCommand(binding, handler, when)` call. */
+export type EditorKeyCommand = { binding: number; handler: EditorKeyHandler; when: string };
+
+/**
+ * The keys the editor binds with no action id: no label, no menu entry, so
+ * `editorActions` cannot carry them.
+ *
+ * ⌘X and ⌘V. Monaco leaves cut and paste unbound in a browser ("Do not bind cut
+ * keybindings in the browser, since browsers do that for us" — clipboard.js), so
+ * the slots are free and binding them is what makes the keyboard and the
+ * context menu run the same code. Ctrl+C is a localized action instead, so its
+ * label can follow the UI language; Ctrl+V has no label, so it has nothing to
+ * re-register on a language change.
+ *
+ * Enter, Tab and Shift+Tab inside a list item or a table (#604). Bare commands
+ * rather than actions for the same reason Ctrl+V is one: they carry no label and
+ * appear in no menu — they are what those three keys already mean, one Markdown
+ * rule further on. The shortcuts panel does list them (group `context` in
+ * utils/shortcuts.ts), because a behaviour nobody is told about is a behaviour
+ * nobody uses.
+ *
+ * ONE HANDLER PER KEY, dispatching inside. Tab is a table key, a list key and a
+ * Tab, in that order of specificity; two commands on one chord would leave which
+ * of them wins to Monaco's registration order.
+ *
+ * THE `when` CLAUSES ARE THE WHOLE RISK HERE.
+ *
+ * `addCommand` registers at weight 1000, above every Monaco default including
+ * the suggest widget's — so a binding with no condition does not merely add a
+ * meaning to Enter, it TAKES Enter away from whatever else wanted it. Each
+ * clause below names something that owns the key first:
+ *
+ *   editorTextFocus      the caret is in the text, not in the find box or
+ *                        the rename input (both of which take Enter);
+ *   !editorReadonly      reading mode types nothing;
+ *   !suggestWidgetVisible  the completion popup is open, where Enter
+ *                        accepts and Tab accepts — this app has a heading
+ *                        and a file-path completion provider, so it is a
+ *                        live case, not a hypothetical one;
+ *   !inSnippetMode       Tab jumps to the next placeholder;
+ *   !editorTabMovesFocus the accessibility toggle, whose entire purpose is
+ *                        that Tab leaves the editor.
+ *
+ * Neither handler is a dead end: when the caret is not on a list item they
+ * re-trigger the ordinary command, so a non-list Enter is a plain Enter and a
+ * non-list Tab is a plain Tab, auto-indent and all.
+ *
+ * VIM MODE NEEDS NO CLAUSE OF ITS OWN. monaco-vim listens on `editor.onKeyDown`,
+ * which fires on the textarea — inside the container the keybinding service
+ * listens on — and it calls `stopPropagation()` on every key its keymap claims.
+ * So in normal mode vim's Enter (move down a line) runs and this command never
+ * sees the key; in insert mode vim passes the key through and continuation
+ * happens, which is what a vim user writing a list wants. The order is DOM
+ * nesting, not luck.
+ */
+export function editorKeyCommands(monaco: MonacoKeys): EditorKeyCommand[] {
+	const EDITING_KEY_CONTEXT =
+		"editorTextFocus && !editorReadonly && !suggestWidgetVisible && !inSnippetMode";
+	return [
+		{ binding: monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyX, handler: 'cutToClipboard', when: "editorTextFocus" },
+		{ binding: monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyV, handler: 'pasteFromClipboard', when: "editorTextFocus" },
+		{ binding: monaco.KeyCode.Enter, handler: 'continueListOnEnter', when: EDITING_KEY_CONTEXT },
+		{
+			binding: monaco.KeyCode.Tab,
+			handler: 'handleTabKey',
+			when: `${EDITING_KEY_CONTEXT} && !editorTabMovesFocus`,
+		},
+		{
+			binding: monaco.KeyMod.Shift | monaco.KeyCode.Tab,
+			handler: 'handleShiftTabKey',
+			when: `${EDITING_KEY_CONTEXT} && !editorTabMovesFocus`,
+		},
+		// The same two keys Monaco binds to Insert Line Below / Above, which is why
+		// they need no guard of their own beyond the shared one: the only other
+		// claimants on Mod+Enter in the bundle are the find widget's Replace All and
+		// the references peek, and `editorTextFocus` is false in both.
+		{
+			binding: monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter,
+			handler: 'handleModEnterKey',
+			when: EDITING_KEY_CONTEXT,
+		},
+		{
+			binding: monaco.KeyMod.CtrlCmd | monaco.KeyMod.Shift | monaco.KeyCode.Enter,
+			handler: 'handleModShiftEnterKey',
+			when: EDITING_KEY_CONTEXT,
+		},
+	];
+}
diff --git a/src/lib/utils/editorClipboard.ts b/src/lib/utils/editorClipboard.ts
new file mode 100644
index 00000000..8e05ebef
--- /dev/null
+++ b/src/lib/utils/editorClipboard.ts
@@ -0,0 +1,302 @@
+import type * as Monaco from 'monaco-editor';
+import { clipboardTextForSelection, insertTextAtCursor } from './editorEdits.js';
+import { routeDroppedFile } from './fileDrop.js';
+import { documentParentDir, imageEmbed, resolveImageDirectory } from './imageEmbed.js';
+import { isLinkifyPasteTarget } from './pasteContext.js';
+
+/**
+ * What the editor's clipboard and drop handlers reach: the editor and the
+ * Monaco module (both assigned once Monaco has loaded, hence getters), the
+ * Tauri bridge, the active tab and the image settings.
+ */
+export type EditorClipboardDeps = {
+	editor: () => Monaco.editor.IStandaloneCodeEditor;
+	monaco: () => typeof Monaco;
+	invoke: (cmd: string, args?: Record<string, unknown>) => Promise<unknown>;
+	tabs: { readonly activeTab: { readonly path?: string } | null | undefined };
+	settings: { readonly imageDirectory: string; readonly macosImageScaling: boolean };
+};
+
+/**
+ * Cut, copy and paste — one implementation each, reached from the keyboard
+ * and from the context menu alike.
+ *
+ * All three go through Rust (`arboard`) rather than through the webview's
+ * `navigator.clipboard`, which is the only thing that works everywhere:
+ * wry leaves the webview's clipboard permission off by default, and turning
+ * it on does not help — tauri-apps/tauri#12007 is open on exactly this, and
+ * the official answer is the clipboard plugin, which is the same Rust route
+ * Markpad already had for ⌘V. Verified by hand on Windows: with the wry
+ * permission enabled, the webview's own paste still does nothing.
+ *
+ * Six entry points, three functions. Before this there were six
+ * implementations: ⌘X was the browser's, ⌘C and ⌘V were ours, and the three
+ * menu items were Monaco's — of which Paste could not work in a webview at
+ * all (#207) and Cut and Copy are dead on Linux, where the same wry default
+ * gates `set_javascript_can_access_clipboard`.
+ *
+ * What cut and copy take: `clipboardTextForSelection` in utils/editorEdits.ts.
+ */
+export async function pasteFromClipboard(deps: EditorClipboardDeps) {
+	const editor = deps.editor();
+	const monaco = deps.monaco();
+	// Focus first, as `runEditorAction` does, and for the same reason: this
+	// runs from the context menu as well as from ⌘V, and a menu item leaves
+	// the focus on itself. Paste then inserted the text and left no caret —
+	// no blink, and the next ⌘Z went nowhere, which reads as "undo is
+	// broken" rather than "the editor is not focused".
+	//
+	// A no-op on the ⌘V path, where the editor is focused by definition.
+	editor?.focus();
+		try {
+			// The image is written before it is linked, and the reader can
+			// switch tabs while it is: the link then belongs to no other model.
+			const pasteModel = editor.getModel();
+			const tabPath = deps.tabs.activeTab?.path;
+			const parentDir = tabPath ? documentParentDir(tabPath) : null;
+			if (tabPath && parentDir !== null) {
+				const imgDirName = resolveImageDirectory(
+					deps.settings.imageDirectory,
+					tabPath,
+				);
+				const embeds: string[] = [];
+
+				// A file copied in Explorer or Finder is a path on the clipboard,
+				// not pixels (#768). Read it first and copy it as a drop does, so
+				// it keeps its own name and bytes rather than whatever preview the
+				// file manager put beside it.
+				const files = await deps.invoke("clipboard_read_file_list").catch(() => null) as string[] | null;
+				for (const srcPath of files ?? []) {
+					if (routeDroppedFile(srcPath, "editor") !== "insert") continue;
+					const relPath = (await deps.invoke("copy_file_to_img", {
+						srcPath,
+						parentDir,
+						imageDirectory: imgDirName,
+					})) as string;
+					embeds.push(imageEmbed(relPath));
+				}
+
+				if (embeds.length === 0) {
+					// check for image in clipboard via Rust
+					const base64Image = await deps.invoke("clipboard_read_image", { macosImageScaling: deps.settings.macosImageScaling }).catch(() => null) as string | null;
+					if (base64Image) {
+						const filename = `paste_${Date.now()}.png`; // output of Rust command is always PNG
+						const relPath = (await deps.invoke("save_image", {
+							parentDir,
+							filename,
+							base64Data: base64Image,
+							imageDirectory: imgDirName,
+						})) as string;
+						embeds.push(imageEmbed(relPath));
+					}
+				}
+
+				// The written file stays: it is in the first tab's folder, where
+				// the reader can see it, and deleting on a guess is what #368 removed.
+				if (editor.getModel() !== pasteModel) return;
+				const position = editor.getPosition();
+				if (embeds.length > 0 && position) {
+					const selection = editor.getSelection();
+					const range =
+						selection && !selection.isEmpty()
+							? selection
+							: new monaco.Range(
+									position.lineNumber,
+									position.column,
+									position.lineNumber,
+									position.column,
+								);
+
+					editor.pushUndoStop();
+					editor.executeEdits("paste-image", [
+						{
+							range,
+							text: embeds.join("\n"),
+							forceMoveMarkers: true,
+						},
+					]);
+
+					return;
+				}
+			}
+
+			// fall through to text paste via Rust
+			const rawText = await deps.invoke("clipboard_read_text").catch(() => "") as string;
+			if (!rawText) return;
+			// Every edit below is a paste, and a paste is its own undo step:
+			// `executeEdits` appends to the step typing left open, so without
+			// this one Cmd+Z takes back the paste AND the words before it.
+			editor.pushUndoStop();
+			
+			const text = rawText.trim();
+			const urlRegex = /^(?:(?:https?|file|tauri):\/\/|www\.)[^\s]{2,}$/i;
+			const isUrl = urlRegex.test(text);
+
+			const selections = editor.getSelections();
+			const model = editor.getModel();
+			if (!selections || selections.length === 0 || !model) {
+				insertTextAtCursor(editor, rawText);
+				return;
+			}
+
+			// if it's not a URL or we have no multi-line selection/complex case, just insert
+			const hasSelection = selections.some((s) => !s.isEmpty());
+			const isMultiLine = selections.some((s) => s.startLineNumber !== s.endLineNumber);
+
+			if (!isUrl || isMultiLine || !isLinkifyPasteTarget(model, selections[0], monaco.editor)) {
+				const edits = selections.map(s => ({
+					range: s,
+					text: rawText,
+					forceMoveMarkers: true
+				}));
+				editor.executeEdits("paste-text", edits);
+				return;
+			}
+
+			if (hasSelection) {
+				const edits = selections.map((selection) => {
+					const selectedText = model.getValueInRange(selection);
+					// Pasting a URL over a URL replaces it. Wrapping would
+					// nest the old URL as the link text — and inside
+					// existing link syntax like ![](url) it produces
+					// broken nesting: ![]([old](new)).
+					if (urlRegex.test(selectedText.trim())) {
+						return {
+							range: selection,
+							text,
+							forceMoveMarkers: true,
+						};
+					}
+					const linkUrl = text.toLowerCase().startsWith("www.")
+						? `http://${text}`
+						: text;
+					return {
+						range: selection,
+						text: `[${selectedText}](${linkUrl})`,
+						forceMoveMarkers: true,
+					};
+				});
+				editor.executeEdits("paste-link", edits);
+			} else {
+				const displayText = text.replace(
+					/^(?:https?|file|tauri):\/\/|www\./i,
+					"",
+				);
+				const linkUrl = text.toLowerCase().startsWith("www.")
+					? `http://${text}`
+					: text;
+				const template = `[${displayText}](${linkUrl})`;
+				const edits = selections.map((selection) => {
+					return {
+						range: selection,
+						text: template,
+						forceMoveMarkers: true,
+					};
+				});
+
+				editor.executeEdits("paste-link", edits);
+
+				let accumulatedShift = 0;
+				let lastLine = -1;
+				const newSelections = selections.map((s) => {
+					if (s.startLineNumber !== lastLine) {
+						accumulatedShift = 0;
+						lastLine = s.startLineNumber;
+					}
+					const startColumn = s.startColumn + accumulatedShift + 1;
+					const endColumn = startColumn + displayText.length;
+					accumulatedShift += template.length;
+					return new monaco.Selection(
+						s.startLineNumber,
+						startColumn,
+						s.startLineNumber,
+						endColumn,
+					);
+				});
+				editor.setSelections(newSelections);
+			}
+		} catch (err) {
+			console.error("Paste failed:", err);
+		}
+}
+
+export async function copyToClipboard(deps: EditorClipboardDeps) {
+	const editor = deps.editor();
+	const monaco = deps.monaco();
+	editor?.focus();
+	const { text } = clipboardTextForSelection(editor, monaco);
+	if (text) await deps.invoke('clipboard_write_text', { text }).catch(console.error);
+}
+
+export async function cutToClipboard(deps: EditorClipboardDeps) {
+	const editor = deps.editor();
+	const monaco = deps.monaco();
+	editor?.focus();
+	const { text, range } = clipboardTextForSelection(editor, monaco);
+	if (!text || !range || !editor) return;
+	const model = editor.getModel();
+	await deps.invoke('clipboard_write_text', { text }).catch(console.error);
+	// `range` is in this model's coordinates; after a tab switch it would
+	// delete text from the other document.
+	if (editor.getModel() !== model) return;
+	editor.pushUndoStop();
+	editor.executeEdits('cut', [{ range, text: '', forceMoveMarkers: true }]);
+}
+
+export async function handleDroppedFile(deps: EditorClipboardDeps, path: string, x: number, y: number) {
+	const editor = deps.editor();
+	const monaco = deps.monaco();
+	if (!editor || !deps.tabs.activeTab?.path) return;
+
+	const target = (editor as any).getTargetAtClientPoint(x, y);
+	const position = target?.position || editor.getPosition();
+	if (!position) return;
+
+	const tabPath = deps.tabs.activeTab.path;
+	const parentDir = documentParentDir(tabPath);
+	if (parentDir === null) return;
+	const dropModel = editor.getModel();
+
+	try {
+		const imgDirName = resolveImageDirectory(
+			deps.settings.imageDirectory,
+			tabPath,
+		);
+		const relPath = (await deps.invoke("copy_file_to_img", {
+			srcPath: path,
+			parentDir,
+			imageDirectory: imgDirName,
+		})) as string;
+		// As in `pasteFromClipboard`: a tab switch during the copy leaves the
+		// file where it was copied and the link out of the other document.
+		if (editor.getModel() !== dropModel) return;
+		const embed = imageEmbed(relPath);
+
+		editor.pushUndoStop();
+		editor.executeEdits(
+			"drop-image",
+			[
+				{
+					range: new monaco.Range(
+						position.lineNumber,
+						position.column,
+						position.lineNumber,
+						position.column,
+					),
+					text: embed,
+					forceMoveMarkers: true,
+				},
+			],
+			[
+				new monaco.Selection(
+					position.lineNumber,
+					position.column + embed.length,
+					position.lineNumber,
+					position.column + embed.length,
+				),
+			],
+		);
+	} catch (err) {
+		console.error("Failed to copy dropped file:", err);
+	}
+}
diff --git a/src/lib/utils/editorDocument.svelte.ts b/src/lib/utils/editorDocument.svelte.ts
new file mode 100644
index 00000000..b32a074e
--- /dev/null
+++ b/src/lib/utils/editorDocument.svelte.ts
@@ -0,0 +1,254 @@
+import type * as Monaco from 'monaco-editor';
+import type { tabManager as TabManagerInstance } from '../stores/tabs.svelte.js';
+import { editorReadingPosition } from './editorPosition.js';
+import { getTabModel, lineEndingLabel, tabModelUri } from './tabModels.js';
+import { countWords } from './wordCount.js';
+
+type TextModel = Monaco.editor.ITextModel;
+
+/** The slice of the Monaco namespace this needs: building a model and re-languaging one. */
+export type DocumentMonaco = {
+	editor: Pick<typeof Monaco.editor, 'createModel' | 'setModelLanguage'>;
+	Uri: Pick<typeof Monaco.Uri, 'parse'>;
+};
+
+/** The editor as a view onto whichever model is attached. */
+export type DocumentEditor = Pick<
+	Monaco.editor.IStandaloneCodeEditor,
+	| 'getModel'
+	| 'setModel'
+	| 'getValue'
+	| 'setValue'
+	| 'saveViewState'
+	| 'restoreViewState'
+	| 'setScrollTop'
+	| 'setPosition'
+	| 'getVisibleRanges'
+	| 'getScrollTop'
+	| 'getScrollHeight'
+	| 'getLayoutInfo'
+>;
+
+type Tabs = Pick<
+	typeof TabManagerInstance,
+	| 'activeTabId'
+	| 'activeTab'
+	| 'updateTabEditorState'
+	| 'updateTabRawContent'
+	| 'updateTabScrollPercentage'
+	| 'updateTabAnchorLine'
+>;
+
+/**
+ * Which document the one Monaco editor shows, how a keystroke reaches the tab,
+ * and the status-bar readings that describe the document.
+ *
+ * Moved out of `Editor.svelte` as it was. `monaco` and `editor` are getters
+ * because the component builds both in `onMount`, after this object exists.
+ */
+export class EditorDocument {
+	language = $state('markdown');
+	lineEnding = $state<'LF' | 'CRLF'>('LF');
+	wordCount = $state(0);
+	/** The tab whose model the editor is holding. */
+	currentTabId: string | null;
+	/** The attached model's text as the content listener last read it; null after a model swap. */
+	private emittedText: string | null = null;
+	private wordCountTimer: ReturnType<typeof setTimeout> | undefined;
+
+	constructor(
+		private readonly deps: {
+			monaco: () => DocumentMonaco;
+			editor: () => DocumentEditor;
+			tabs: Tabs;
+			/** The `value` prop: the active tab's `rawContent`. */
+			value: () => string;
+			showWordCount: () => boolean;
+		},
+	) {
+		this.currentTabId = deps.tabs.activeTabId;
+	}
+
+	/**
+	 * The file's encoding, which a save writes back (#372). Read from the tab,
+	 * not the Monaco model: it belongs to the file, not the buffer.
+	 */
+	get encoding() {
+		return this.deps.tabs.activeTab?.encoding ?? 'UTF-8';
+	}
+
+	/**
+	 * The `ITextModel` belonging to a tab — Monaco's document object, and the
+	 * thing that owns the undo stack.
+	 *
+	 * One per tab, created here because the component holds the dynamically
+	 * imported Monaco namespace, and reaped by `TabManager` because that is
+	 * what knows a tab is gone; see `utils/tabModels.ts` for both halves.
+	 *
+	 * The language is re-applied on every call rather than only at creation.
+	 * `language` is derived from the ACTIVE TAB'S PATH, and a tab can be
+	 * repointed at a file of another type without being recreated — following a
+	 * link, back/forward, Save As. The model outlives all of those, so a
+	 * language fixed at creation would be the extension of whatever file the tab
+	 * held the first time it was edited. `setModelLanguage` is a no-op when the
+	 * id already matches.
+	 */
+	acquireTabModel(tabId: string, seed: string, languageId: string): TextModel {
+		const monaco = this.deps.monaco();
+		const model = getTabModel(tabId, () =>
+			monaco.editor.createModel(seed, languageId, monaco.Uri.parse(tabModelUri(tabId))),
+		);
+		if (model.getLanguageId() !== languageId) monaco.editor.setModelLanguage(model, languageId);
+		return model;
+	}
+
+	/**
+	 * The status-bar readings that are properties of the DOCUMENT rather than of
+	 * an edit: the language, the word count and the line ending.
+	 *
+	 * They used to be refreshed only by `onDidChangeModelContent`, which was
+	 * enough while a tab switch went through `setValue` — that fires a content
+	 * change (a flush) as a side effect. `setModel` does not, because no content
+	 * changed: a different document arrived. So switching tabs has to ask for
+	 * these explicitly, or the status bar keeps the previous document's numbers.
+	 */
+	syncStatus(deferWordCount = false) {
+		const model = this.deps.editor().getModel();
+		if (!model) return;
+		this.language = model.getLanguageId();
+		this.lineEnding = lineEndingLabel(model);
+		// `countWords` is several full-text regex passes, ~400 ms on a 1 MB
+		// document: skipped while the status bar hides it, and on a keystroke
+		// left for a pause in typing.
+		clearTimeout(this.wordCountTimer);
+		if (!this.deps.showWordCount()) return;
+		const count = () => (this.wordCount = countWords(model.getValue()));
+		if (deferWordCount) this.wordCountTimer = setTimeout(count, 300);
+		else count();
+	}
+
+	/** Drops a word count still waiting for a pause in typing. */
+	cancelPendingWordCount() {
+		clearTimeout(this.wordCountTimer);
+	}
+
+	/**
+	 * The one route from a keystroke to the document. `value` is a plain
+	 * prop — it reads the active tab's `rawContent` and nothing here writes
+	 * it back — so this call is not a second opinion about the buffer, it is
+	 * the only opinion. It used to be a `bind:value` writing the field
+	 * directly PLUS this call, and the tab only stayed dirty-tracked because
+	 * Svelte's assignment happened to run first: deleting this line left the
+	 * text on screen correct and the dirty flag, the auto-save trigger and
+	 * the close prompt silently dead. Delete it now and the editor stops
+	 * editing the document at all, which is a bug you can see.
+	 *
+	 * The guard is what stops the loop: `activate` pushes an external
+	 * buffer replacement in with `setValue`, which fires this listener with
+	 * text `value` already holds, and writing that back to the store would
+	 * be a write the user did not make.
+	 */
+	contentChanged() {
+		const newValue = this.deps.editor().getValue();
+		this.emittedText = newValue;
+		const activeTabId = this.deps.tabs.activeTabId;
+		if (this.deps.value() !== newValue && activeTabId) {
+			this.deps.tabs.updateTabRawContent(activeTabId, newValue);
+		}
+
+		this.syncStatus(true);
+	}
+
+	/**
+	 * Tab activation, run by the component's effect on every change of the
+	 * active tab, its buffer or its language. A switch swaps the editor's MODEL;
+	 * see the comment on that effect in `Editor.svelte` for why `setValue` is
+	 * still here.
+	 */
+	activate(activeTabId: string | null, content: string, languageId: string) {
+		const editor = this.deps.editor();
+		const tabs = this.deps.tabs;
+		const switched = activeTabId !== this.currentTabId;
+
+		if (switched && this.currentTabId) {
+			const state = editor.saveViewState();
+			tabs.updateTabEditorState(this.currentTabId, state);
+		}
+
+		this.currentTabId = activeTabId;
+
+		if (activeTabId) {
+			const model = this.acquireTabModel(activeTabId, content, languageId);
+			if (editor.getModel() !== model) {
+				editor.setModel(model);
+				this.emittedText = null;
+			}
+		}
+
+		// The keystroke that changed `value` came from this editor, and the
+		// model already holds it: no need to copy the buffer out to compare.
+		if (content !== this.emittedText && editor.getValue() !== content) {
+			editor.setValue(content);
+		}
+
+		if (switched) {
+			// The view state is the editor's, not the model's — cursor, scroll,
+			// selections and the folding contribution — so it still has to be
+			// restored by hand, and only after the model it describes is
+			// attached.
+			if (tabs.activeTab?.editorViewState) {
+				editor.restoreViewState(tabs.activeTab.editorViewState);
+			} else {
+				editor.setScrollTop(0);
+				editor.setPosition({ lineNumber: 1, column: 1 });
+			}
+		}
+
+		// Cheap on the hot path: this re-runs on every keystroke (it is handed
+		// `value`), and on a keystroke neither test holds.
+		if (switched || this.language !== languageId) this.syncStatus();
+	}
+
+	/**
+	 * Record on `tabId` where the editor is: the Monaco view state, and the two
+	 * position fields `editorReadingPosition` derives from one reading.
+	 *
+	 * Three layout reads (`getScrollHeight`, `getLayoutInfo`,
+	 * `getVisibleRanges`), so this belongs at moments and never on the hot path
+	 * — the component's teardown is one such moment, `flushPositionTo` below is
+	 * the other, and there are no others.
+	 *
+	 * The caller has already established that `editor` is up and that `tabId` is
+	 * the tab it is holding.
+	 */
+	writePosition(tabId: string) {
+		const editor = this.deps.editor();
+		const tabs = this.deps.tabs;
+		tabs.updateTabEditorState(tabId, editor.saveViewState());
+
+		const ranges = editor.getVisibleRanges();
+		const model = editor.getModel();
+		const { scrollPercentage, anchorLine } = editorReadingPosition({
+			scrollTop: editor.getScrollTop(),
+			contentHeight: editor.getScrollHeight(),
+			viewportHeight: editor.getLayoutInfo().height,
+			topLine: ranges.length > 0 && model ? ranges[0].startLineNumber : null,
+			text: model?.getValue() ?? '',
+		});
+
+		if (scrollPercentage !== null) tabs.updateTabScrollPercentage(tabId, scrollPercentage);
+		if (anchorLine !== null) tabs.updateTabAnchorLine(tabId, anchorLine);
+	}
+
+	/**
+	 * `writePosition`, for an editor that is up, and only when it is holding
+	 * `tabId`. There is one Editor per window and it swaps models between tabs
+	 * (`utils/tabModels.ts`), so an unguarded flush would copy the ACTIVE tab's
+	 * position onto whichever record the caller named — a wrong position on two
+	 * tabs instead of one.
+	 */
+	flushPositionTo(tabId: string) {
+		if (this.currentTabId !== tabId) return;
+		this.writePosition(tabId);
+	}
+}
diff --git a/src/lib/utils/editorEdits.ts b/src/lib/utils/editorEdits.ts
new file mode 100644
index 00000000..67c59d36
--- /dev/null
+++ b/src/lib/utils/editorEdits.ts
@@ -0,0 +1,77 @@
+import type * as Monaco from 'monaco-editor';
+
+/** The part of a Monaco editor the format tools touch. */
+export type EditingEditor = Pick<Monaco.editor.ICodeEditor, 'getSelection' | 'getModel' | 'pushUndoStop' | 'executeEdits'>;
+
+/**
+ * What cut and copy take from `editor`: the selection, or with nothing
+ * selected the caret's whole line. `monaco` supplies the `Range` constructor,
+ * which lives on the lazily imported module.
+ */
+export function clipboardTextForSelection(
+	editor: Pick<Monaco.editor.ICodeEditor, 'getSelection' | 'getModel'> | undefined,
+	monaco: Pick<typeof Monaco, 'Range'>,
+): { text: string; range: Monaco.Range | null } {
+	const selection = editor?.getSelection();
+	const model = editor?.getModel();
+	if (!selection || !model) return { text: '', range: null };
+
+	if (!selection.isEmpty()) {
+		return { text: model.getValueInRange(selection), range: selection };
+	}
+
+	// Nothing selected copies the whole line, line ending included —
+	// Monaco's `emptySelectionClipboard` default, and VS Code's and Sublime
+	// Text's. Kept because it is what this editor has always done; whether
+	// an app that calls itself the Notepad equivalent should do it at all
+	// is a separate question (#393).
+	const line = selection.startLineNumber;
+	const lastLine = model.getLineCount();
+	return {
+		text: model.getLineContent(line) + model.getEOL(),
+		// Cutting that line has to take its line ending with it, so the
+		// range runs to the start of the next one. The last line has no
+		// next, and the range stops at its end.
+		range:
+			line < lastLine
+				? new monaco.Range(line, 1, line + 1, 1)
+				: new monaco.Range(line, 1, line, model.getLineMaxColumn(line)),
+	};
+}
+
+export function insertTextAtCursor(editor: EditingEditor, text: string) {
+	const selection = editor.getSelection();
+	if (!selection) return;
+	const op = { range: selection, text: text, forceMoveMarkers: true };
+	editor.pushUndoStop();
+	editor.executeEdits("my-source", [op]);
+}
+
+export function wrapAsCodeBlock(editor: EditingEditor) {
+	const selection = editor.getSelection();
+	const model = editor.getModel();
+	if (!selection || !model) return;
+
+	const text = model.getValueInRange(selection);
+	const block = text.startsWith("```\n") && text.endsWith("\n```")
+		? text.slice(4, -4).replace(/\n$/, "")
+		: `\`\`\`\n${text}\n\`\`\``;
+	editor.pushUndoStop();
+	editor.executeEdits("fmt-code-block", [
+		{ range: selection, text: block, forceMoveMarkers: true },
+	]);
+}
+
+export function insertLink(editor: EditingEditor) {
+	const selection = editor.getSelection();
+	const model = editor.getModel();
+	if (!selection || !model) return;
+
+	const text = model.getValueInRange(selection);
+	const label = text || "link text";
+	const link = `[${label}](url)`;
+	editor.pushUndoStop();
+	editor.executeEdits("fmt-link", [
+		{ range: selection, text: link, forceMoveMarkers: true },
+	]);
+}
diff --git a/src/lib/utils/editorFrontMatter.ts b/src/lib/utils/editorFrontMatter.ts
new file mode 100644
index 00000000..83364142
--- /dev/null
+++ b/src/lib/utils/editorFrontMatter.ts
@@ -0,0 +1,38 @@
+import type * as Monaco from 'monaco-editor';
+
+import { frontMatterLineOffset } from './frontMatter.js';
+
+type ScrollEditor = Pick<Monaco.editor.ICodeEditor, 'getModel' | 'getTopForLineNumber'>;
+
+/**
+ * The editor's scroll offset where the front matter ends, or 0 when there is
+ * none: what split view hands across as "inside the front matter".
+ */
+export function editorFrontMatterScrollEnd(
+	getEditor: () => ScrollEditor | undefined,
+	getEditorContentScrollMax: () => number,
+): () => number {
+	let frontMatterOffsetCache: { model: unknown; version: number; offset: number } | null = null;
+
+	return function getEditorFrontMatterScrollEnd() {
+		const editor = getEditor();
+		if (!editor) return 0;
+
+		const model = editor.getModel();
+		if (!model) return 0;
+
+		// The preview's rule, not a second one: a leading `---` block that is not
+		// a YAML mapping is body there, and the two panes must agree on where the
+		// front matter ends or every position above it syncs to the top. Cached on
+		// the model's version because this runs on every scroll event.
+		const version = model.getVersionId();
+		if (frontMatterOffsetCache?.model !== model || frontMatterOffsetCache.version !== version) {
+			frontMatterOffsetCache = { model, version, offset: frontMatterLineOffset(model.getValue()) };
+		}
+		const bodyStartLine = frontMatterOffsetCache.offset + 1;
+		if (bodyStartLine <= 1) return 0;
+
+		const safeBodyStartLine = Math.max(1, Math.min(model.getLineCount(), bodyStartLine));
+		return Math.max(0, Math.min(getEditorContentScrollMax(), editor.getTopForLineNumber(safeBodyStartLine)));
+	};
+}
diff --git a/src/lib/utils/editorJumps.ts b/src/lib/utils/editorJumps.ts
new file mode 100644
index 00000000..8c9b427b
--- /dev/null
+++ b/src/lib/utils/editorJumps.ts
@@ -0,0 +1,162 @@
+import type * as Monaco from 'monaco-editor';
+import type { BufferLine } from './lineCoordinates.js';
+import type { ScrollSyncPosition } from './scrollSync.js';
+
+/**
+ * Where a revealed range lands in the viewport. The outline asks for `top`:
+ * the preview answers the same click by putting the heading just under its
+ * top edge, and with scroll sync off the two panes then show the same
+ * place. The context menu's Edit keeps `center`, the reading it had.
+ */
+export type RevealPlacement = 'center' | 'top';
+
+export type JumpEditor = Pick<
+	Monaco.editor.IStandaloneCodeEditor,
+	'getModel' | 'revealLineNearTop' | 'revealLineInCenterIfOutsideViewport' | 'setSelection' | 'focus'
+>;
+
+type Deps = {
+	monaco: () => { editor: { ScrollType: typeof Monaco.editor.ScrollType } };
+	editor: () => JumpEditor | undefined;
+	/** The component's `editorReady`. */
+	ready: () => boolean;
+	/** The scroll itself, run once the editor is ready. */
+	scrollTo: (position: ScrollSyncPosition, options: { cursorIntoView: boolean }) => void;
+};
+
+/**
+ * The editor's jumps from outside: the preview's sync (Ctrl+E, split view),
+ * the outline, and the context menu's Edit. Any of them can arrive while
+ * Monaco is still loading, and is then queued until `spendPending`.
+ */
+export class EditorJumps {
+	/** A sync asked for before Monaco loaded, spent right after the view-state restore. */
+	private pendingSync: ScrollSyncPosition | null = null;
+	private pendingCursorIntoView = false;
+	/**
+	 * A reveal asked for before Monaco loaded. The preview can call in several
+	 * frames before `editor` exists; `createEditor` spends it once it does.
+	 */
+	private pendingReveal: { startLine: number; endLine: number; placement: RevealPlacement } | null = null;
+
+	constructor(private deps: Deps) {}
+
+	syncScrollToPosition(position: ScrollSyncPosition, { cursorIntoView = false } = {}) {
+		if (!this.deps.ready() || !this.deps.editor()) {
+			this.pendingSync = position;
+			this.pendingCursorIntoView = cursorIntoView;
+			return;
+		}
+		this.deps.scrollTo(position, { cursorIntoView });
+	}
+
+	/** Called by `createEditor` after the view-state / anchor-line restore. */
+	spendPending() {
+		// After the view-state / anchor-line restore, deliberately: an
+		// explicit "edit this fragment" beats the position the tab was left at.
+		if (this.pendingSync) {
+			const position = this.pendingSync;
+			this.pendingSync = null;
+			this.syncScrollToPosition(position, { cursorIntoView: this.pendingCursorIntoView });
+		}
+		if (this.pendingReveal) {
+			const { startLine, endLine, placement } = this.pendingReveal;
+			this.pendingReveal = null;
+			this.revealSourceRange(startLine, endLine, placement);
+		}
+	}
+
+	/**
+	 * Put the reader on `startLine`..`endLine` of the buffer.
+	 *
+	 * The one line-to-editor jump in this component. The outline reaches it
+	 * through `revealHeader`, and the preview's context-menu "Edit" calls it
+	 * with the source range of whatever the reader had selected (#90).
+	 *
+	 * The selection IS the highlight #90 asks for: Monaco draws it in the
+	 * theme's own selection colour, so it needs no decoration, no CSS and no
+	 * timer — and it clears itself on the reader's next click or keystroke,
+	 * which is precisely when it has stopped being useful. A decoration that
+	 * fades on a timer would be a second highlighting mechanism doing what this
+	 * one already does, and would leave the caret at the top of the file.
+	 */
+	revealSourceRange(startLine: number, endLine: number, placement: RevealPlacement = 'center') {
+		const editor = this.deps.editor();
+		if (!this.deps.ready() || !editor) {
+			this.pendingReveal = { startLine, endLine, placement };
+			return;
+		}
+		const monaco = this.deps.monaco();
+
+		const model = editor.getModel();
+		if (!model) return;
+
+		// Clamp before `getLineMaxColumn`, which throws on a line past the end
+		// of the buffer. Both callers can hand one over: the preview's HTML is
+		// the render of a buffer that may since have been replaced by a shorter
+		// one (an external change, a session restored around a file edited
+		// elsewhere), and the outline carries the same lines.
+		const lastLine = model.getLineCount();
+		const start = Math.min(Math.max(1, Math.trunc(startLine)), lastLine);
+		const end = Math.min(Math.max(start, Math.trunc(endLine)), lastLine);
+
+		if (placement === 'top') editor.revealLineNearTop(start, monaco.editor.ScrollType.Smooth);
+		else editor.revealLineInCenterIfOutsideViewport(start, monaco.editor.ScrollType.Smooth);
+		editor.setSelection({
+			startLineNumber: start,
+			startColumn: 1,
+			endLineNumber: end,
+			endColumn: model.getLineMaxColumn(end),
+		});
+		editor.focus();
+	}
+
+	/**
+	 * `sourceLine` is a BUFFER line, and the type is the whole point: the
+	 * outline reads `data-sourcepos`, which counts from the first line of the
+	 * body, and handed it over unshifted for as long as both features existed.
+	 * The caller now has to go through `lineCoordinates` to produce one.
+	 */
+	revealHeader(sourceLine: BufferLine | null, text: string) {
+		const editor = this.deps.editor();
+		if (!editor) return;
+		const monaco = this.deps.monaco();
+		const model = editor.getModel();
+		if (!model) return;
+		const lineNumber = sourceLine ?? 0;
+		if (Number.isInteger(lineNumber) && lineNumber > 0) {
+			this.revealSourceRange(lineNumber, lineNumber, 'top');
+			return;
+		}
+
+		const escapedText = text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const regex = new RegExp(`^#+\\s+.*${escapedText}.*$`, "m");
+
+		const match = model.findNextMatch(regex.source, { lineNumber: 1, column: 1 }, true, false, null, true);
+
+		if (match) {
+			editor.revealLineNearTop(match.range.startLineNumber, monaco.editor.ScrollType.Smooth);
+			editor.setSelection(match.range);
+			editor.focus();
+		} else {
+			const fallbackMatch = model.findNextMatch(escapedText, { lineNumber: 1, column: 1 }, false, false, null, false);
+			if (fallbackMatch) {
+				editor.revealLineNearTop(fallbackMatch.range.startLineNumber, monaco.editor.ScrollType.Smooth);
+				editor.setSelection(fallbackMatch.range);
+				editor.focus();
+			}
+		}
+	}
+}
+
+/** Split view's editor-to-preview sync listens to scrolling, not to the caret: typing must not initiate a sync. */
+export function bindScrollSync(
+	editor: Pick<Monaco.editor.IStandaloneCodeEditor, 'onDidScrollChange'>,
+	emit: () => void,
+): Monaco.IDisposable {
+	return editor.onDidScrollChange((e) => {
+		if (e.scrollTopChanged) {
+			emit();
+		}
+	});
+}
diff --git a/src/lib/utils/editorKeyHandlers.ts b/src/lib/utils/editorKeyHandlers.ts
new file mode 100644
index 00000000..b8fbeaa4
--- /dev/null
+++ b/src/lib/utils/editorKeyHandlers.ts
@@ -0,0 +1,232 @@
+import type * as Monaco from 'monaco-editor';
+
+import { isInFencedCode } from './codeFence.js';
+import { blockEnter, parseListItem, shiftListItem, type ListEdit } from './listEditing.js';
+import { tableOperation, tableStep, type TableEdit, type TableOperation } from './tableEditing.js';
+
+/** The part of a Monaco editor the editing keys touch. */
+export type KeyHandlerEditor = Pick<
+	Monaco.editor.ICodeEditor,
+	'getModel' | 'getSelections' | 'pushUndoStop' | 'executeEdits' | 'setSelection' | 'trigger'
+>;
+
+/**
+ * Enter, Tab, Shift+Tab, Mod+Enter and Mod+Shift+Enter inside a list item, a
+ * block quote or a table (#604), over `editor`. `monaco` supplies the `Range`
+ * and `Selection` constructors, which live on the lazily imported module.
+ */
+export function editorKeyHandlers(editor: KeyHandlerEditor, monaco: Pick<typeof Monaco, 'Range' | 'Selection'>) {
+	/**
+	 * Enter on a list item writes the next item's marker; Enter on a block quote
+	 * writes the quote (#700); Enter on either with a marker and no text takes
+	 * the marker away instead, which is how the block ends — except on a nested
+	 * list item, where it takes one level away (#856). What the next line
+	 * should say is decided by `blockEnter` in utils/listEditing.ts, where it can
+	 * be tested without a browser.
+	 *
+	 * Only a single collapsed caret is claimed. A selection, or several carets,
+	 * gets the ordinary Enter: replacing a multi-cursor edit with one edit at
+	 * the primary selection would silently drop the others' work.
+	 */
+	const continueListOnEnter = () => {
+		// The key's ordinary meaning, re-sent. `type` with a newline is what the
+		// keyboard itself delivers, so auto-indent and the model's own EOL still
+		// apply — this handler is a detour, never a replacement.
+		const plainEnter = () => editor.trigger("keyboard", "type", { text: "\n" });
+		const caret = soleCaret();
+		if (!caret) return plainEnter();
+
+		const { model, line, column } = caret;
+		const next = blockEnter(model.getLineContent(line), column);
+		if (!next) return plainEnter();
+
+		// An empty item below the margin gives up one level, as Shift+Tab would
+		// (#856); only an item with no level left ends the list.
+		if (next.kind === "clear") {
+			const level = shiftListItem(model, line, column, true);
+			if (level) return applyLineEdit(level, "list-outdent");
+		}
+
+		// Its own undo step, so one Ctrl+Z gives back the marker this took away
+		// rather than unwinding the sentence typed before it.
+		editor.pushUndoStop();
+
+		if (next.kind === "clear") {
+			editor.executeEdits(
+				"list-continuation",
+				[{ range: new monaco.Range(line, 1, line, model.getLineMaxColumn(line)), text: next.line }],
+				[new monaco.Selection(line, next.line.length + 1, line, next.line.length + 1)],
+			);
+			return;
+		}
+
+		const after = next.text.length + 1;
+		editor.executeEdits(
+			"list-continuation",
+			[{ range: new monaco.Range(line, column, line, column), text: `${model.getEOL()}${next.text}` }],
+			[new monaco.Selection(line + 1, after, line + 1, after)],
+		);
+	};
+
+	/**
+	 * The single collapsed caret these keys claim, or null.
+	 *
+	 * A selection, or several carets, is handed back to the key's ordinary
+	 * meaning everywhere below: one edit at the primary selection would silently
+	 * drop what the other carets were about to do, and Monaco's own Tab already
+	 * indents every line of a multi-line selection.
+	 *
+	 * So is a caret inside a fenced code block. `1. a` or `|a|b|` there is code,
+	 * and renumbering or re-aligning it rewrites the code; Enter, Tab and the
+	 * table keys all ask here, so none of them can forget.
+	 */
+	const soleCaret = () => {
+		const model = editor.getModel();
+		const selections = editor.getSelections();
+		if (!model || selections?.length !== 1 || !selections[0].isEmpty()) return null;
+		const line = selections[0].startLineNumber;
+		if (isInFencedCode(model, line)) return null;
+		return { model, line, column: selections[0].startColumn };
+	};
+
+	/**
+	 * Replace a run of lines with what a Markdown edit says they should be, and
+	 * put the caret where it says. Every table operation ends here, because every
+	 * one of them changes a column's width and therefore has to redraw the pipes;
+	 * so does every list level change (#711), which renumbers the items the moved
+	 * one left behind and is therefore a run of lines rather than one line.
+	 *
+	 * An edit that changes nothing but the caret — Shift+Tab in the first cell of
+	 * an already-aligned table — moves the caret WITHOUT an edit, so it does not
+	 * push an undo step that undoes nothing.
+	 */
+	const applyLineEdit = (edit: TableEdit | ListEdit, source: string) => {
+		const model = editor.getModel();
+		if (!model) return;
+
+		const range = new monaco.Range(
+			edit.startLine,
+			1,
+			edit.endLine,
+			model.getLineMaxColumn(edit.endLine),
+		);
+		const text = edit.lines.join(model.getEOL());
+		const caret = new monaco.Selection(
+			edit.caretLine,
+			edit.caretColumn,
+			edit.caretLine,
+			edit.caretColumn,
+		);
+
+		if (model.getValueInRange(range) === text) {
+			editor.setSelection(caret);
+			return;
+		}
+		editor.pushUndoStop();
+		editor.executeEdits(source, [{ range, text }], [caret]);
+	};
+
+	/** Tab / Shift+Tab inside a table. False when the caret is not in one. */
+	const stepTableCell = (back: boolean) => {
+		const caret = soleCaret();
+		if (!caret) return false;
+		const step = tableStep(caret.model, caret.line, caret.column, back);
+		if (!step) return false;
+		applyLineEdit(step, "table-step");
+		return true;
+	};
+
+	/**
+	 * The row and column commands, which are the same edit one level up. False
+	 * when the caret is not in a table, or when the table refuses the edit — which
+	 * is what lets the two Enter keys hand themselves back to Monaco.
+	 */
+	const editTable = (operation: TableOperation) => {
+		const caret = soleCaret();
+		if (!caret) return false;
+		const edit = tableOperation(caret.model, caret.line, caret.column, operation);
+		if (!edit) return false;
+		applyLineEdit(edit, `table-${operation}`);
+		return true;
+	};
+
+	/**
+	 * Tab / Shift+Tab on a list item: the level, decided by `shiftListItem` in
+	 * utils/listEditing.ts, where it can be tested without a browser.
+	 *
+	 * A LIST ITEM'S TAB NEVER FALLS THROUGH, not even when the edit is refused.
+	 * On a list item this key means the level and only the level, and the two
+	 * refusals are both "there is no other level": Tab on the first item of a
+	 * list, which has nothing to nest under, and Shift+Tab on an item already at
+	 * the margin. Handing those to `indentLines` or `outdent` would move the line
+	 * by `tabSize` into a column that nests under nothing — which is half of
+	 * #711 — so the key does nothing instead, as it does in every outliner.
+	 */
+	const shiftListLevel = (back: boolean) => {
+		const caret = soleCaret();
+		if (!caret || !parseListItem(caret.model.getLineContent(caret.line))) return false;
+		const edit = shiftListItem(caret.model, caret.line, caret.column, back);
+		if (edit) applyLineEdit(edit, back ? "list-outdent" : "list-indent");
+		return true;
+	};
+
+	/** Tab: the next cell of a table, else a list item's nesting level, else a Tab. */
+	const handleTabKey = () => {
+		if (stepTableCell(false)) return;
+		if (shiftListLevel(false)) return;
+		editor.trigger("keyboard", "tab", null);
+	};
+
+	/**
+	 * Shift+Tab: the previous cell of a table, else a list item's level, else
+	 * Monaco's own `outdent`.
+	 *
+	 * IT USED TO BE A PURE FALL-THROUGH, and the reason it no longer is, is #711.
+	 * `outdent` takes `tabSize` columns off the line wherever the caret sits on
+	 * it, which was close enough to right while nothing renumbered — but a level
+	 * is not a `tabSize`, and an item that leaves a sub-list has to take the
+	 * number of the list it rejoins. Both are `shiftListItem`'s, in the same
+	 * function as Tab's, because they are the same edit with the sign flipped.
+	 *
+	 * `outdent` remains what the chord means on every line that is not a list
+	 * item, which is what the third line preserves.
+	 */
+	const handleShiftTabKey = () => {
+		if (stepTableCell(true)) return;
+		if (shiftListLevel(true)) return;
+		editor.trigger("keyboard", "outdent", null);
+	};
+
+	/**
+	 * Mod+Enter: a row below in a table, else Monaco's own "Insert Line Below".
+	 *
+	 * THE KEY IS NOT BEING TAKEN, IT IS BEING SPECIALISED. Monaco already binds
+	 * `Mod+Enter` to `editor.action.insertLineAfter` and `Mod+Shift+Enter` to
+	 * `insertLineBefore`, and inside a table "the line below" IS "the row below" —
+	 * so these two handlers are the same shape as Shift+Tab's above: take the key,
+	 * and hand it straight back everywhere the table branch declines.
+	 *
+	 * The rows used to be on `Mod+K R`, and a two-key chord for the commonest edit
+	 * a table gets is a chord nobody presses. Columns keep theirs: they are rarer,
+	 * and no unmodified key means "insert a column" in any editor.
+	 */
+	const handleModEnterKey = () => {
+		if (editTable("insert-row")) return;
+		editor.trigger("keyboard", "editor.action.insertLineAfter", null);
+	};
+
+	/** Mod+Shift+Enter: a row above in a table, else "Insert Line Above". */
+	const handleModShiftEnterKey = () => {
+		if (editTable("insert-row-above")) return;
+		editor.trigger("keyboard", "editor.action.insertLineBefore", null);
+	};
+
+	return {
+		continueListOnEnter,
+		editTable,
+		handleTabKey,
+		handleShiftTabKey,
+		handleModEnterKey,
+		handleModShiftEnterKey,
+	};
+}
diff --git a/src/lib/utils/editorLocalizedActions.svelte.ts b/src/lib/utils/editorLocalizedActions.svelte.ts
new file mode 100644
index 00000000..c3e9db85
--- /dev/null
+++ b/src/lib/utils/editorLocalizedActions.svelte.ts
@@ -0,0 +1,50 @@
+import type * as Monaco from 'monaco-editor';
+import type { LanguageCode } from './i18n.js';
+
+export type LocalizedActionsDeps = {
+	/** The UI language; read first, so the effect tracks it before the editor exists. */
+	language: () => LanguageCode;
+	/** The component's `editorReady`. */
+	ready: () => boolean;
+	editor: () => Pick<Monaco.editor.IStandaloneCodeEditor, 'addAction'>;
+	/** Every action whose label comes from `t()`, in `lang`. */
+	descriptors: (lang: LanguageCode) => Monaco.editor.IActionDescriptor[];
+};
+
+/**
+ * A Monaco action captures its label when it is registered, so actions built
+ * once at mount keep whatever language they were built with — switching the
+ * UI language used to leave the editor's context menu in the old one until
+ * the app was restarted. `addAction` returns an `IDisposable` for exactly
+ * this case: the registration below is re-run on every language change, and
+ * the previous disposables are released first so ids are never registered
+ * twice (a duplicate id leaves a duplicate context-menu entry behind).
+ *
+ * Call during component init. Returns the release, for `onDestroy`.
+ */
+export function localizedEditorActions(deps: LocalizedActionsDeps): () => void {
+	let localizedActions: Monaco.IDisposable[] = [];
+
+	function disposeLocalizedActions() {
+		for (const action of localizedActions) action.dispose();
+		localizedActions = [];
+	}
+
+	function registerLocalizedActions(lang: LanguageCode) {
+		// Belt and braces: Svelte runs the effect cleanup before a re-run, but
+		// re-registering an id without disposing the old action would leave a
+		// duplicate entry in the context menu, so never assume it happened.
+		disposeLocalizedActions();
+		localizedActions = deps.descriptors(lang).map((descriptor) => deps.editor().addAction(descriptor));
+	}
+
+	$effect(() => {
+		const lang = deps.language();
+		if (!deps.ready()) return;
+
+		registerLocalizedActions(lang);
+		return disposeLocalizedActions;
+	});
+
+	return disposeLocalizedActions;
+}
diff --git a/src/lib/utils/editorMount.ts b/src/lib/utils/editorMount.ts
new file mode 100644
index 00000000..c70d1b87
--- /dev/null
+++ b/src/lib/utils/editorMount.ts
@@ -0,0 +1,27 @@
+/**
+ * Mount an editor whose module has to be fetched first: `load` it, then
+ * `create` the editor, and hand back the unmount cleanup *synchronously*.
+ *
+ * Svelte only treats a synchronously returned function as the unmount
+ * cleanup, so an `async` `onMount` callback would hand it a promise and
+ * silently leak the editor, its listeners and the `window.open` patch. The
+ * await lives in this inner task instead, and the returned cleanup closes over
+ * both the cancel flag (the component can be destroyed while the chunk is
+ * still in flight — Ctrl+E then Ctrl+E again) and whatever cleanup `create`
+ * produced.
+ */
+export function mountAfterLoad(load: () => Promise<unknown>, create: () => () => void): () => void {
+	let cancelled = false;
+	let teardown: (() => void) | null = null;
+
+	void (async () => {
+		await load();
+		if (cancelled) return;
+		teardown = create();
+	})();
+
+	return () => {
+		cancelled = true;
+		teardown?.();
+	};
+}
diff --git a/src/lib/utils/editorOptions.ts b/src/lib/utils/editorOptions.ts
index d947a687..0145322a 100644
--- a/src/lib/utils/editorOptions.ts
+++ b/src/lib/utils/editorOptions.ts
@@ -102,6 +102,166 @@ export function editorOptionsFromSettings(
 	};
 }
 
+/**
+ * The options `monaco.editor.create()` gets, minus the model and the theme.
+ *
+ * Everything outside `editorOptionsFromSettings` is set once here and never
+ * re-applied.
+ */
+export function createdEditorOptions(
+	settings: EditorOptionSettings,
+	zoomPercent: number,
+	readOnly: boolean,
+): MonacoEditor.IStandaloneEditorConstructionOptions {
+	return {
+		dragAndDrop: true,
+		automaticLayout: true,
+		// Off by default, and `'configuredByTheme'` cannot turn it on here:
+		// `StandaloneTheme.semanticHighlighting` is hard-coded false, so the
+		// switch has to be explicit or the semantic tokens provider is never asked.
+		'semanticHighlighting.enabled': true,
+		...editorOptionsFromSettings(settings, zoomPercent),
+		readOnly,
+		scrollBeyondLastLine: true,
+		wordBasedSuggestions: "off",
+		quickSuggestions: false,
+		// Monaco's Unicode highlighter is built for source code, where a
+		// character that looks like ASCII but is not is an attack vector. In
+		// prose it fires on the punctuation CJK authors type all day: `，`
+		// `！` `？` `（` `）` `；` `：` are all confusables of an ASCII
+		// counterpart, so Monaco outlines each one (#186, #94).
+		//
+		// It only fires when the confusable shares a word with basic ASCII —
+		// shouldHighlightNonBasicASCII() suppresses the box when the
+		// surrounding word is entirely non-ASCII — which is why pure CJK
+		// looks fine and `使用 Monaco，然后保存。` or `安装依赖（npm ci）` does
+		// not. Latin technical terms inside CJK prose are the normal case,
+		// and `**粗体**，` triggers it with no Latin word at all.
+		//
+		// invisibleCharacters stays on, but not for the reason first written
+		// here. That comment claimed it "never fires on something typed on
+		// purpose"; measured against this Monaco build, U+3000 IDEOGRAPHIC
+		// SPACE — the space bar under every CJK IME — is in the invisible
+		// set and gets outlined, which is the same complaint as #186/#94 one
+		// option over. The set is the flattened union of every locale bucket
+		// (`strings.js` getData()), 465 code points, so `allowedLocales`
+		// cannot exclude it; only `allowedCharacters` can.
+		//
+		// The rest stays on because the NBSP hazard is real: an NBSP after
+		// `-` stops a list from parsing. Worth recording that the other
+		// stated hazard does NOT hold — a zero-width space inside CJK text
+		// is not flagged at all, because shouldHighlightNonBasicASCII()
+		// suppresses it when the surrounding word has no basic ASCII.
+		//
+		// nonBasicASCII needs no setting — it defaults to
+		// `inUntrustedWorkspace` and standalone Monaco's workspace-trust
+		// service returns true unconditionally, so it is already off; were it
+		// on, every ideograph would be boxed rather than the punctuation.
+		unicodeHighlight: {
+			ambiguousCharacters: false,
+			allowedCharacters: { "　": true },
+		},
+		// Word-wise navigation — ⌥←/→, double-click-to-select, ⌥⌫ — splits on
+		// `wordSeparators`, and a language that does not put spaces between
+		// its words has none. So a whole Chinese clause counts as one word:
+		// ⌥→ jumps the sentence, double-click selects it, ⌥⌫ deletes it.
+		//
+		// A non-empty list switches on `Intl.Segmenter` (see
+		// `wordCharacterClassifier.js`), which knows where the words are.
+		//
+		// It is closer to a switch than to a whitelist, and the naming hides
+		// that: ICU dispatches its dictionary breaking by SCRIPT, not by this
+		// list. Thai, Khmer, Lao, Burmese and Tibetan get segmented too and
+		// none of them are named here, while `['zh']`, `['ja']` and
+		// `['zh','ja']` all produce identical output — even on Han text,
+		// where the two dictionaries might have been expected to disagree.
+		// Written as the two the app has locales for, rather than a longer
+		// list that would read as a claim about coverage it does not make.
+		//
+		// Nothing is taken from space-delimited languages: Korean,
+		// Vietnamese, Russian and English segment word-for-word identically
+		// to splitting on whitespace. An unsupported tag is dropped by
+		// Monaco's own `validate()`, so this cannot fail closed.
+		wordSegmenterLocales: ['zh', 'ja'],
+		// Markpad draws the editor's context menu itself, in
+		// MarkdownViewer.svelte, beside the one the preview already had.
+		//
+		// Not a style choice. Monaco's menu offers Cut, Copy and Paste, and
+		// its Paste cannot work here: it reads the clipboard through the
+		// webview, which wry leaves switched off and which Tauri has no
+		// answer for (tauri-apps/tauri#12007). Everything else Monaco would
+		// contribute to that menu — Go to Definition, Go to References,
+		// inlay hints — needs a language provider this app does not
+		// register, so nothing is lost by drawing our own.
+		contextmenu: false,
+		// Monaco writes a styled `text/html` flavour beside the plain text on a
+		// copy. Everything Markpad produces IS plain text, so pasting into Word
+		// or Outlook gave coloured monospace instead of the Markdown that was
+		// copied — the styled flavour has no audience here (#393).
+		//
+		// Still needed after cut/copy/paste were collapsed onto three functions
+		// of our own, which is easy to get wrong: those cover ⌘C and the context
+		// menu, and macOS has a third way in. Edit > Copy in the menu bar is a
+		// predefined Copy item (#527), which asks the webview to perform
+		// its own copy — Monaco's, not ours. Without this the menu bar would put
+		// a different clipboard on the pasteboard than the other two routes.
+		copyWithSyntaxHighlighting: false,
+		// The same argument one option over. U+2028 (LINE SEPARATOR) and
+		// U+2029 (PARAGRAPH SEPARATOR) break a JavaScript string literal,
+		// which is what Monaco's guard is for; in Markdown they are just
+		// characters, and they arrive by ordinary means — several word
+		// processors and PDF text extractors emit U+2028 for a soft line
+		// break, so pasting one in is normal here.
+		//
+		// The default is 'prompt', and in standalone Monaco that prompt is
+		// `StandaloneDialogService.doConfirm`, i.e. a bare
+		// `mainWindow.confirm()`: an unstyled browser dialog inside a Tauri
+		// window, carrying Monaco's English string in an app translated
+		// into 26 locales, offering to rewrite the user's bytes. 'auto'
+		// would rewrite them without asking, which is worse.
+		//
+		// 'off' loses no visibility: the line renderer substitutes U+FFFD
+		// for LINE_SEPARATOR and PARAGRAPH_SEPARATOR unconditionally, so
+		// they stay as visible as they ever were. Only the dialog goes.
+		unusualLineTerminators: "off",
+		padding: { top: 20 },
+		// The overview ruler sits under the vertical scrollbar, and its
+		// border drew a 1px line down the track's left edge.
+		overviewRulerBorder: false,
+		scrollbar: {
+			vertical: "visible",
+			horizontal: "visible",
+			useShadows: false,
+			verticalHasArrows: false,
+			horizontalHasArrows: false,
+			// Same track and thumb as the preview's ::-webkit-scrollbar in styles.css.
+			verticalScrollbarSize: 14,
+			horizontalScrollbarSize: 14,
+			verticalSliderSize: 8,
+			horizontalSliderSize: 8,
+		},
+	};
+}
+
+/** What the update effect re-applies: the settings-derived options, and `readOnly`. */
+export function updatedEditorOptions(
+	settings: EditorOptionSettings,
+	zoomPercent: number,
+	fontIsMonospace: boolean,
+	readOnly: boolean,
+): MonacoEditor.IEditorOptions {
+	return { ...editorOptionsFromSettings(settings, zoomPercent, fontIsMonospace), readOnly };
+}
+
+/**
+ * Whether the editor on `tab` refuses typing. An unread or unreadable tab in
+ * edit mode shows a buffer that is not the whole file, and no save will ever
+ * accept it: read-only at the keyboard, not a toast at the save.
+ */
+export function editorReadOnly(tab: { isTruncated?: boolean }): boolean {
+	return tab.isTruncated === true;
+}
+
 /** The slice of the settings store the options above are derived from. */
 export type EditorOptionSettings = {
 	minimap: boolean;
diff --git a/src/lib/utils/editorTheme.ts b/src/lib/utils/editorTheme.ts
index f539d388..e23a8541 100644
--- a/src/lib/utils/editorTheme.ts
+++ b/src/lib/utils/editorTheme.ts
@@ -1,3 +1,5 @@
+import type { editor as MonacoEditor } from 'monaco-editor';
+
 /**
  * What the editor paints Markdown with.
  *
@@ -182,6 +184,9 @@ export function semanticTokenRules(appearance: 'light' | 'dark'): EditorTokenRul
 	);
 }
 
+/** The name `utils/theme.ts` defines an imported VS Code theme under. */
+export const VSCODE_THEME_NAME = 'vscode-custom';
+
 /**
  * The name of the Monaco theme a settings value asks for.
  *
@@ -210,7 +215,48 @@ export function semanticTokenRules(appearance: 'light' | 'dark'): EditorTokenRul
  * and leaves the theme-change write to whoever did the defining.
  */
 export function monacoThemeName(theme: string, systemPrefersDark: boolean): string {
-	if (theme.startsWith('vscode:')) return 'vscode-custom';
+	if (theme.startsWith('vscode:')) return VSCODE_THEME_NAME;
 	const dark = theme === 'system' ? systemPrefersDark : theme === 'dark';
 	return dark ? 'app-theme-dark' : 'app-theme-light';
 }
+
+/** Defines the two themes the app ships, the ones `monacoThemeName` names for light and dark. */
+export function defineAppThemes(monaco: { editor: { defineTheme: typeof MonacoEditor.defineTheme } }): void {
+	monaco.editor.defineTheme("app-theme-dark", {
+		base: "vs-dark",
+		inherit: true,
+		rules: [...markdownTokenRules('dark'), ...semanticTokenRules('dark')],
+		colors: {
+			"editor.background": "#181818",
+			"menu.background": "#181818",
+			"menu.foreground": "#cccccc",
+			"menu.selectionBackground": "#2a2d2e",
+			"menu.selectionForeground": "#ffffff",
+			"menu.separatorBackground": "#454545",
+			"editorWidget.background": "#181818",
+			"editorWidget.border": "#454545",
+			"scrollbarSlider.background": "#78787859",
+			"scrollbarSlider.hoverBackground": "#7878788c",
+			"scrollbarSlider.activeBackground": "#7878788c",
+		},
+	});
+
+	monaco.editor.defineTheme("app-theme-light", {
+		base: "vs",
+		inherit: true,
+		rules: [...markdownTokenRules('light'), ...semanticTokenRules('light')],
+		colors: {
+			"editor.background": "#FDFDFD",
+			"menu.background": "#FDFDFD",
+			"menu.foreground": "#333333",
+			"menu.selectionBackground": "#eeeeee",
+			"menu.selectionForeground": "#000000",
+			"menu.separatorBackground": "#cccccc",
+			"editorWidget.background": "#FDFDFD",
+			"editorWidget.border": "#cccccc",
+			"scrollbarSlider.background": "#78787859",
+			"scrollbarSlider.hoverBackground": "#7878788c",
+			"scrollbarSlider.activeBackground": "#7878788c",
+		},
+	});
+}
diff --git a/src/lib/utils/fileDrop.ts b/src/lib/utils/fileDrop.ts
index 69af6810..5063aead 100644
--- a/src/lib/utils/fileDrop.ts
+++ b/src/lib/utils/fileDrop.ts
@@ -66,3 +66,26 @@ export function routeDroppedFile(path: string, pane: DropPane): DropAction {
 export function dropZoneLabel(paths: readonly string[], pane: DropPane): 'embed' | 'open' {
 	return paths.some((path) => routeDroppedFile(path, pane) === 'insert') ? 'embed' : 'open';
 }
+
+export interface DropActions {
+	insert(path: string): void;
+	open(path: string): void;
+	unsupported(path: string): void;
+}
+
+/**
+ * Act on a drop: every path is routed through `routeDroppedFile` for the pane
+ * the drop resolves to, and each of the three answers is acted on. The editor's
+ * branch used to look for an image and silently discard everything else, so a
+ * `.md` dropped there did nothing at all while the same drop on the preview
+ * opened it.
+ */
+export function handleDrop(
+	paths: readonly string[],
+	target: DropPane | null,
+	hasEditor: boolean,
+	actions: DropActions,
+): void {
+	const pane = dropPaneFor(target, hasEditor);
+	for (const path of paths) actions[routeDroppedFile(path, pane)](path);
+}
diff --git a/src/lib/utils/findSeed.ts b/src/lib/utils/findSeed.ts
index 60833680..ee94b744 100644
--- a/src/lib/utils/findSeed.ts
+++ b/src/lib/utils/findSeed.ts
@@ -19,3 +19,12 @@ export function findSeedFromSelection(selection: Selection | null, root: Node |
 	const text = selection.toString().trim();
 	return text.includes('\n') ? '' : text;
 }
+
+/**
+ * Seed the find bar BEFORE opening it, so the bar that appears already holds
+ * the query. Nothing to seed leaves the previous query alone.
+ */
+export function seedFindBar(bar: { setQuery(value: string): void } | null, selection: Selection | null, root: Node | null): void {
+	const seed = findSeedFromSelection(selection, root);
+	if (seed) bar?.setQuery(seed);
+}
diff --git a/src/lib/utils/foldLayout.ts b/src/lib/utils/foldLayout.ts
index 3f602116..fcc782aa 100644
--- a/src/lib/utils/foldLayout.ts
+++ b/src/lib/utils/foldLayout.ts
@@ -67,6 +67,13 @@ function updateFoldHeights(root: HTMLElement) {
 	}
 }
 
+/**
+ * How long a caller waits for a fold to finish opening before it measures or
+ * scrolls into it. styles.css animates the fold height for 0.25s; a wait shorter
+ * than that lands on a target that is still moving.
+ */
+export const FOLD_TRANSITION_MS = 300;
+
 export interface FoldLayoutObservation {
 	/**
 	 * Start watching the fold contents inside newly rendered markup.
diff --git a/src/lib/utils/foldLayoutEffect.svelte.ts b/src/lib/utils/foldLayoutEffect.svelte.ts
new file mode 100644
index 00000000..3a6d7d48
--- /dev/null
+++ b/src/lib/utils/foldLayoutEffect.svelte.ts
@@ -0,0 +1,35 @@
+import { observeFoldLayout, type FoldLayoutObservation } from './foldLayout.js';
+
+/** The preview pane is on screen outside edit mode, and in split view. */
+export function previewPaneShown(isEditing: boolean, isSplit: boolean): boolean {
+	return !isEditing || isSplit;
+}
+
+/**
+ * Keeps one fold-layout observation on the visible preview host, published in
+ * `holder.current` for the patch to hand its new blocks to. Call during
+ * component init.
+ *
+ * Keyed on the visible host only. A keystroke must not re-observe: a fresh
+ * `observe` reports at once and would re-measure every fold. The patch observes
+ * new blocks itself. A hidden host is not observed at all, because its boxes
+ * measure 0.
+ */
+export function followFoldLayout(
+	holder: { current: FoldLayoutObservation | null },
+	getHost: () => HTMLElement | null | undefined,
+	isShown: () => boolean,
+): void {
+	$effect(() => {
+		const host = getHost();
+		if (!host || !isShown()) return;
+
+		const observation = observeFoldLayout(host);
+		holder.current = observation;
+
+		return () => {
+			observation.stop();
+			if (holder.current === observation) holder.current = null;
+		};
+	});
+}
diff --git a/src/lib/utils/frontMatterFieldState.svelte.ts b/src/lib/utils/frontMatterFieldState.svelte.ts
new file mode 100644
index 00000000..111fd397
--- /dev/null
+++ b/src/lib/utils/frontMatterFieldState.svelte.ts
@@ -0,0 +1,73 @@
+import type { FrontMatterField } from './frontMatter.js';
+
+/**
+ * The front-matter panel's per-field state. Every table is keyed by document
+ * *and* field: a bare field name carried a `date` error from one document into
+ * every other document's `date` field.
+ */
+export class FrontMatterFieldState {
+	#panelKey: () => string;
+	#editErrors = $state<Record<string, string>>({});
+	#tagDrafts = $state<Record<string, string>>({});
+	#tagEditIndexes = $state<Record<string, number | null>>({});
+	#tagEditDrafts = $state<Record<string, string>>({});
+
+	constructor(panelKey: () => string) {
+		this.#panelKey = panelKey;
+	}
+
+	#key(field: FrontMatterField) {
+		return `${this.#panelKey()}:${field.key}`;
+	}
+
+	editError(field: FrontMatterField): string | undefined {
+		return this.#editErrors[this.#key(field)];
+	}
+
+	setEditError(field: FrontMatterField, error: unknown) {
+		this.#editErrors[this.#key(field)] = String(error);
+	}
+
+	clearEditError(field: FrontMatterField) {
+		delete this.#editErrors[this.#key(field)];
+	}
+
+	tagDraft(field: FrontMatterField) {
+		return this.#tagDrafts[this.#key(field)] ?? '';
+	}
+
+	setTagDraft(field: FrontMatterField, value: string) {
+		this.#tagDrafts[this.#key(field)] = value;
+		this.clearEditError(field);
+	}
+
+	clearTagDraft(field: FrontMatterField) {
+		delete this.#tagDrafts[this.#key(field)];
+	}
+
+	tagEditIndex(field: FrontMatterField) {
+		return this.#tagEditIndexes[this.#key(field)] ?? null;
+	}
+
+	tagEditDraft(field: FrontMatterField, fallback: string) {
+		return this.#tagEditDrafts[this.#key(field)] ?? fallback;
+	}
+
+	setTagEditDraft(field: FrontMatterField, value: string) {
+		this.#tagEditDrafts[this.#key(field)] = value;
+		this.clearEditError(field);
+	}
+
+	startTagEdit(field: FrontMatterField, index: number, value: string) {
+		const key = this.#key(field);
+		this.#tagEditIndexes[key] = index;
+		this.#tagEditDrafts[key] = value;
+		this.clearEditError(field);
+	}
+
+	clearTagEdit(field: FrontMatterField) {
+		const key = this.#key(field);
+		delete this.#tagEditIndexes[key];
+		delete this.#tagEditDrafts[key];
+	}
+}
diff --git a/src/lib/utils/headingReference.ts b/src/lib/utils/headingReference.ts
index 68b17dad..9d7746d6 100644
--- a/src/lib/utils/headingReference.ts
+++ b/src/lib/utils/headingReference.ts
@@ -107,3 +107,31 @@ export function headingReference({ text, slug, fileName, style }: HeadingReferen
 	const destination = fileName ? `${fileName}#${slug}` : `#${slug}`;
 	return `[${linkLabel(text)}](${linkDestination(destination)})`;
 }
+
+/**
+ * The reference for a heading of `tab`'s document, in the spelling that
+ * document is written in. The style is read from the buffer, so an unsaved
+ * edit already counts.
+ */
+export function referenceForTab(
+	text: string,
+	slug: string,
+	tab: { path?: string | null; rawContent?: string } | null | undefined,
+): string {
+	const fileName = tab?.path ? tab.path.split(/[/\\]/).pop() || null : null;
+	return headingReference({
+		text,
+		slug,
+		fileName,
+		style: preferredReferenceStyle(tab?.rawContent ?? ''),
+	});
+}
+
+/**
+ * A rendered heading's id, straight off the element: comrak wrote it, and the
+ * outline reads it the same way. It can be on an anchor comrak nests inside the
+ * heading rather than on the heading itself.
+ */
+export function headingSlug(heading: Element): string {
+	return heading.id || heading.querySelector('a.anchor')?.id || '';
+}
diff --git a/src/lib/utils/homeTab.ts b/src/lib/utils/homeTab.ts
index fed30519..a5f02035 100644
--- a/src/lib/utils/homeTab.ts
+++ b/src/lib/utils/homeTab.ts
@@ -27,3 +27,17 @@ export const HOME_TAB_PATH = 'HOME';
 export function isHomePath(path: string): boolean {
 	return path === HOME_TAB_PATH;
 }
+
+/**
+ * Whether the window draws the home screen instead of a document: an empty
+ * window, the home tab, or the Home button's overlay over any tab. Decided by
+ * tab kind, never by the localised title (#392).
+ *
+ * `activeTab` is a getter, read only when `showHome` is false: an effect that
+ * calls this must not re-run on a tab switch while the Home overlay is up.
+ */
+export function showsHomeScreen(activeTab: () => { path: string } | undefined, showHome: boolean): boolean {
+	if (showHome) return true;
+	const tab = activeTab();
+	return !tab || isHomePath(tab.path);
+}
diff --git a/src/lib/utils/markdownCompletion.ts b/src/lib/utils/markdownCompletion.ts
new file mode 100644
index 00000000..0b0c6490
--- /dev/null
+++ b/src/lib/utils/markdownCompletion.ts
@@ -0,0 +1,172 @@
+import type * as Monaco from 'monaco-editor';
+
+import { frontMatterFenceLines } from './frontMatter.js';
+import { headingLinkContext, headingQueryStart, type HeadingAnchor } from './headingCompletion.js';
+import { resolveImageDirectory } from './imageEmbed.js';
+
+type Invoke = (command: string, args?: Record<string, unknown>) => Promise<unknown>;
+type OutlineModel = Pick<Monaco.editor.ITextModel, 'getVersionId' | 'getValue'>;
+
+/**
+ * This document's headings, from the Rust side that renders them.
+ *
+ * Cached on the model's version, which changes on every edit: a completion
+ * fires per keystroke once the dropdown is open, and re-parsing a
+ * 3,000-line document for each of them would be paid for nothing — the
+ * headings cannot have moved between two keystrokes of the same edit.
+ *
+ * Asked of Rust rather than derived here: the ids come out of comrak's
+ * anchorizer, and a second implementation in TypeScript would drift from
+ * it silently, producing links that look right and land nowhere.
+ *
+ * Keyed on the model as well: each tab has its own, and version ids are
+ * counted per model, so two tabs can stand at the same one.
+ *
+ * The block folds come with them, from the same parse: the folding provider
+ * wants both for every version. The promise is what is cached, so the
+ * folding and symbol providers asking at once share one call.
+ */
+export type Outline = { anchors: HeadingAnchor[]; folds: Monaco.languages.FoldingRange[] };
+export function createDocumentOutline(invoke: Invoke) {
+	let outlineCache: { model: OutlineModel; version: number; outline: Promise<Outline> } | null = null;
+
+	function documentOutline(model: OutlineModel): Promise<Outline> {
+		const version = model.getVersionId();
+		if (outlineCache?.model === model && outlineCache.version === version) return outlineCache.outline;
+
+		const markdown = model.getValue();
+		const outline = (
+			invoke("markdown_outline", {
+				markdown,
+				frontMatterLines: frontMatterFenceLines(markdown),
+			}) as Promise<Outline>
+		).catch(() => ({ anchors: [], folds: [] }));
+		outlineCache = { model, version, outline };
+		return outline;
+	}
+
+	async function headingAnchors(model: OutlineModel): Promise<HeadingAnchor[]> {
+		return (await documentOutline(model)).anchors;
+	}
+
+	return { documentOutline, headingAnchors };
+}
+
+/** The characters that open the editor's link-target completion; `#` asks for headings. */
+export const MARKDOWN_COMPLETION_TRIGGERS = ["(", "/", "\\", '"', "#"];
+
+export type MarkdownCompletionDeps = {
+	monaco: Pick<typeof Monaco, 'Range'> & { languages: Pick<typeof Monaco.languages, 'CompletionItemKind'> };
+	headingAnchors: (model: Monaco.editor.ITextModel) => Promise<HeadingAnchor[]>;
+	invoke: Invoke;
+	/** The active tab's path, if it has one. */
+	activeTabPath: () => string | null | undefined;
+	/** The image-directory setting. */
+	imageDirectory: () => string;
+};
+
+/**
+ * The Markdown completion provider: this document's headings after `](#` or
+ * `[[#`, else file paths after a link, image or `src=` opener.
+ */
+export async function provideMarkdownCompletionItems(
+	model: Monaco.editor.ITextModel,
+	position: Monaco.Position,
+	deps: MarkdownCompletionDeps,
+): Promise<Monaco.languages.CompletionList> {
+	const lineContent = model.getLineContent(position.lineNumber);
+	const prefix = lineContent.substring(0, position.column - 1);
+
+	// #200: this document's headings, as link targets. Asked
+	// first because `](#` is also the tail of the embed context
+	// below — once a `#` is typed the answer is headings, not
+	// files.
+	const headingContext = headingLinkContext(prefix);
+	if (headingContext) {
+		const anchors = await deps.headingAnchors(model);
+		const range = new deps.monaco.Range(
+			position.lineNumber,
+			headingQueryStart(prefix) + 1,
+			position.lineNumber,
+			position.column,
+		);
+
+		return {
+			suggestions: anchors.map((anchor, index) => ({
+				// Labelled by what it reads as, inserted as
+				// whatever that context needs. Monaco filters on
+				// the label, so typing "mermaid" finds
+				// "11. Mermaid Diagrams" and writes the slug.
+				label: anchor.text,
+				detail: `#${anchor.slug}`,
+				kind: deps.monaco.languages.CompletionItemKind.Reference,
+				insertText:
+					headingContext === "slug" ? anchor.slug : anchor.text,
+				// Document order, not alphabetical: a heading's
+				// neighbours are what the writer is thinking in.
+				sortText: String(index).padStart(5, "0"),
+				range,
+			})),
+		};
+	}
+
+	const isEmbedContext = /(!?\[.*\]\(|<img.*src=["']|src=["'])$/.test(
+		prefix,
+	);
+	if (!isEmbedContext) return { suggestions: [] };
+
+	const path = deps.activeTabPath();
+	if (!path) return { suggestions: [] };
+
+	const lastSlash = Math.max(
+		path.lastIndexOf("\\"),
+		path.lastIndexOf("/"),
+	);
+	const parentDir = path.substring(0, lastSlash);
+	const imgDirName = resolveImageDirectory(
+		deps.imageDirectory(),
+		path,
+	);
+
+	try {
+		const [currentEntries, imgEntries] = await Promise.all([
+			deps.invoke("list_directory_contents", { path: parentDir })
+				.then((r) => r as string[])
+				.catch(() => []),
+			deps.invoke("list_directory_contents", { path: `${parentDir}/${imgDirName}` })
+				.then((r) => r as string[])
+				.catch(() => []),
+		]);
+
+		const word = model.getWordUntilPosition(position);
+		const range = new deps.monaco.Range(
+			position.lineNumber,
+			word.startColumn,
+			position.lineNumber,
+			word.endColumn,
+		);
+
+		const suggestions: Monaco.languages.CompletionItem[] = [
+			...currentEntries.map((e) => ({
+				label: e,
+				kind: e.endsWith("/")
+					? deps.monaco.languages.CompletionItemKind.Folder
+					: deps.monaco.languages.CompletionItemKind.File,
+				insertText: e,
+				range,
+			})),
+			...imgEntries.map((e) => ({
+				label: `${imgDirName}/${e}`,
+				kind: e.endsWith("/")
+					? deps.monaco.languages.CompletionItemKind.Folder
+					: deps.monaco.languages.CompletionItemKind.File,
+				insertText: `${imgDirName}/${e}`,
+				range,
+			})),
+		];
+
+		return { suggestions };
+	} catch (err) {
+		return { suggestions: [] };
+	}
+}
diff --git a/src/lib/utils/markdownLinks.ts b/src/lib/utils/markdownLinks.ts
index ea52c586..74e86b2e 100644
--- a/src/lib/utils/markdownLinks.ts
+++ b/src/lib/utils/markdownLinks.ts
@@ -17,6 +17,17 @@ export type MarkdownLinkTarget = {
 // matches markdownLinks.ts` in scripts/editing.test.ts.
 export const MARKDOWN_LINK_EXTENSIONS = ['md', 'markdown', 'mdown', 'mkd', 'txt'];
 
+/**
+ * The Open dialog's filters: the one list every other part of the app already
+ * treats as a Markpad document — including `.txt`, which loads, renders and
+ * saves like any other note (#535). Hardcoding a shorter list here only hid
+ * those files behind "All Files".
+ */
+export const MARKDOWN_OPEN_FILTERS = [
+	{ name: 'Markdown', extensions: MARKDOWN_LINK_EXTENSIONS },
+	{ name: 'All Files', extensions: ['*'] },
+];
+
 /** `.md`, `.markdown`, … anchored at the end of a path. Also used to replace it. */
 export const MARKDOWN_LINK_EXTENSION_PATTERN = new RegExp(
 	`\\.(?:${MARKDOWN_LINK_EXTENSIONS.map((ext) => ext.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')})$`,
diff --git a/src/lib/utils/modalContextMenu.ts b/src/lib/utils/modalContextMenu.ts
new file mode 100644
index 00000000..7821edca
--- /dev/null
+++ b/src/lib/utils/modalContextMenu.ts
@@ -0,0 +1,9 @@
+/**
+ * The dialog backdrop's right-click: no webview menu over a dialog, except in
+ * a text field, where the prompt input needs the webview's Cut/Copy/Paste.
+ */
+export function handleModalBackdropContextMenu(e: MouseEvent) {
+	if ((e.target as HTMLElement).closest('input, textarea')) return;
+	e.preventDefault();
+	e.stopPropagation();
+}
diff --git a/src/lib/utils/motion.ts b/src/lib/utils/motion.ts
index 29078e6b..7ba94530 100644
--- a/src/lib/utils/motion.ts
+++ b/src/lib/utils/motion.ts
@@ -10,3 +10,16 @@
 export function jumpScrollBehavior(animate: boolean): ScrollBehavior {
 	return animate ? 'smooth' : 'auto';
 }
+
+/**
+ * Commit `el`'s current style without animating it: add `tab-switching`
+ * (transitions off, see styles.css), force a style recompute, remove it. The
+ * forced read between the two is the mechanism, not a formality: without it
+ * the class is added and removed within one style computation and suppresses
+ * nothing.
+ */
+export function commitWithoutTransitions(el: Pick<HTMLElement, 'classList' | 'offsetHeight'>): void {
+	el.classList.add('tab-switching');
+	void el.offsetHeight;
+	el.classList.remove('tab-switching');
+}
diff --git a/src/lib/utils/mountEditor.ts b/src/lib/utils/mountEditor.ts
new file mode 100644
index 00000000..b01ba783
--- /dev/null
+++ b/src/lib/utils/mountEditor.ts
@@ -0,0 +1,311 @@
+import type * as Monaco from 'monaco-editor';
+import { openUrl } from '@tauri-apps/plugin-opener';
+import { invoke } from '@tauri-apps/api/core';
+import { wheelZoomFactor, type settings as SettingsStore } from '../stores/settings.svelte.js';
+import { MARKDOWN_LANGUAGE_ID } from './pasteContext.js';
+import { isAltGraphChord } from './viewerKeymap.js';
+import { createdEditorOptions } from './editorOptions.js';
+import { defineAppThemes, monacoThemeName } from './editorTheme.js';
+import { createMarkdownSemanticTokensProvider } from './semanticTokens.js';
+import type { Tab } from '../stores/tabs.svelte.js';
+import type { EditorDocument } from './editorDocument.svelte.js';
+import type { EditorJumps } from './editorJumps.js';
+import {
+	createDocumentOutline,
+	MARKDOWN_COMPLETION_TRIGGERS,
+	provideMarkdownCompletionItems,
+} from './markdownCompletion.js';
+import { headingFoldRanges, headingSymbols } from './headingSymbols.js';
+import { asBufferLine, editorTopLineForTabAnchor, lineCoordinates, type BufferLine } from './lineCoordinates.js';
+import { editorKeyCommands, type EditorKeyHandler } from './editorActions.js';
+
+type MountedTab = Pick<Tab, 'editorViewState' | 'anchorLine' | 'scrollPercentage' | 'path'>;
+
+/**
+ * What Editor.svelte's mount reaches: the loaded Monaco module and the host
+ * element, the component's document and jump queue, the props as they are
+ * at mount (`theme` and `oncursor` are read later, hence functions), and a
+ * setter for each piece of component state the mount writes.
+ */
+export type MountEditorDeps = {
+	monaco: typeof Monaco;
+	container: HTMLElement;
+	doc: EditorDocument;
+	jumps: Pick<EditorJumps, 'spendPending'>;
+	tabs: { readonly activeTabId: string | null; readonly activeTab: MountedTab | null | undefined };
+	settings: typeof SettingsStore;
+	value: string;
+	language: string;
+	theme: () => string;
+	zoomLevel: number;
+	readOnly: boolean;
+	sharedCursor: { line: number; column: number } | null;
+	oncursor: (line: BufferLine, column: number) => void;
+	keyHandlers: Record<EditorKeyHandler, () => unknown>;
+	applySettingsOptions: () => void;
+	setEditor: (editor: Monaco.editor.IStandaloneCodeEditor) => void;
+	setFontIsMonospace: (monospace: boolean) => void;
+	setCursorPosition: (position: Monaco.Position) => void;
+	setSelectionCount: (count: number) => void;
+	setCursorCount: (count: number) => void;
+	setEditorReady: (ready: boolean) => void;
+};
+
+/** Build the editor, place it, wire it up; returns the unmount cleanup. */
+export function mountEditor(deps: MountEditorDeps): () => void {
+	const {
+		monaco,
+		container,
+		doc,
+		jumps,
+		tabs: tabManager,
+		settings,
+		value,
+		language,
+		zoomLevel,
+		readOnly,
+		sharedCursor,
+		oncursor,
+		keyHandlers,
+		applySettingsOptions,
+	} = deps;
+
+	const originalOpen = window.open;
+	window.open = function (
+		url?: string | URL,
+		target?: string,
+		features?: string,
+	) {
+		if (
+			typeof url === "string" &&
+			(url.startsWith("http://") || url.startsWith("https://"))
+		) {
+			openUrl(url);
+			return null;
+		}
+		return originalOpen.apply(this, arguments as any);
+	};
+
+	defineAppThemes(monaco);
+
+	// The active tab can change while the Monaco chunk is downloading (open a
+	// document in edit mode, then Ctrl+Tab before it lands). The effect that
+	// normally handles a tab switch bailed out on the missing editor, so
+	// re-read the id here: the view state saved on unmount has to be filed
+	// against the tab the editor is really showing, not the one that was
+	// active when this component was created.
+	doc.currentTabId = tabManager.activeTabId;
+
+	const getTheme = () =>
+		monacoThemeName(
+			deps.theme(),
+			window.matchMedia("(prefers-color-scheme: dark)").matches,
+		);
+
+	// The editor is a VIEW; the document it shows is the active tab's model.
+	// Passing `model` rather than `value`/`language` also settles ownership:
+	// `StandaloneEditor` only sets `_ownsModel` when it had to build the
+	// model itself, and `_postDetachModelCleanup` disposes the model on
+	// `editor.dispose()` only when it owns it. So a model handed in here
+	// SURVIVES the editor — which is the point, because this component is
+	// unmounted every time the user switches a tab to reading mode.
+	//
+	// With no active tab there is nothing to key a model by, so the editor
+	// builds and owns a throwaway one, exactly as it did before. That state
+	// is not reachable from the markup (the pane renders under
+	// `tabManager.activeTab`); it is the honest fallback for the window
+	// between the Monaco chunk resolving and this function running.
+	const documentOptions = doc.currentTabId
+		? { model: doc.acquireTabModel(doc.currentTabId, value, language) }
+		: { value, language };
+
+	const editor = monaco.editor.create(container, {
+		...documentOptions,
+		theme: getTheme(),
+		// The real zoom, not 100: the view state, the anchor line and a
+		// pending sync are all placed before the update effect runs, and a
+		// font size changed under them afterwards keeps the pixel offset, not
+		// the line (#799).
+		...createdEditorOptions(settings, zoomLevel, readOnly),
+	});
+	deps.setEditor(editor);
+
+	// Feeds the wrapping strategy in `editorOptionsFromSettings`. `fontInfo`
+	// changes with the font setting and when Monaco remeasures after a font
+	// finishes loading. Read before anything is placed, for the same
+	// reason as the zoom above: a proportional font rewraps every line.
+	const fontIsMonospace = editor.getOption(monaco.editor.EditorOption.fontInfo).isMonospace;
+	deps.setFontIsMonospace(fontIsMonospace);
+	if (!fontIsMonospace) applySettingsOptions();
+
+	if (tabManager.activeTab?.editorViewState) {
+		editor.restoreViewState(tabManager.activeTab.editorViewState);
+	} else if (tabManager.activeTab) {
+		let scrolled = false;
+		if (tabManager.activeTab.anchorLine > 0) {
+			// The anchor is a RENDERER line, whoever recorded it — this pane
+			// or the preview — and Monaco can only be aimed with a buffer
+			// line. The conversion is the whole point of the crossing: a tab
+			// last scrolled in the preview used to open here the height of
+			// its front matter too far up the document.
+			editor.revealLineNearTop(
+				editorTopLineForTabAnchor(lineCoordinates(value), tabManager.activeTab.anchorLine),
+				monaco.editor.ScrollType.Immediate,
+			);
+			scrolled = true;
+		}
+
+		if (!scrolled) {
+			const scrollHeight = editor.getScrollHeight();
+			const clientHeight = editor.getLayoutInfo().height;
+			if (scrollHeight > clientHeight) {
+				const targetScroll =
+					tabManager.activeTab.scrollPercentage *
+					(scrollHeight - clientHeight);
+				editor.setScrollTop(targetScroll);
+			}
+		}
+	}
+
+	const updateTheme = () => {
+		monaco.editor.setTheme(getTheme());
+	};
+
+	const mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
+	mediaQuery.addEventListener("change", updateTheme);
+
+	editor.focus();
+
+	editor.onDidChangeModelContent(() => doc.contentChanged());
+
+	editor.onDidChangeCursorPosition((e) => {
+		deps.setCursorPosition(e.position);
+		oncursor(asBufferLine(e.position.lineNumber), e.position.column);
+	});
+	// The view state above put the cursor back without an event, and a
+	// Ctrl+E into the editor wants the outline on it straight away.
+	if (sharedCursor) editor.setPosition({ lineNumber: sharedCursor.line, column: sharedCursor.column });
+	const mounted = editor.getPosition();
+	oncursor(asBufferLine(mounted?.lineNumber ?? 1), mounted?.column ?? 1);
+
+	editor.onDidChangeCursorSelection((e) => {
+		const selections = editor.getSelections() || [];
+		deps.setCursorCount(selections.length);
+		const model = editor.getModel();
+
+		if (model && selections.length > 0) {
+			deps.setSelectionCount(
+				selections.reduce(
+					(acc: number, selection: Monaco.Selection) => {
+						return acc + model.getValueInRange(selection).length;
+					},
+					0,
+				),
+			);
+		} else {
+			deps.setSelectionCount(0);
+		}
+	});
+
+	editor.onDidChangeConfiguration((e) => {
+		if (e.hasChanged(monaco.editor.EditorOption.fontInfo)) {
+			deps.setFontIsMonospace(editor.getOption(monaco.editor.EditorOption.fontInfo).isMonospace);
+		}
+	});
+
+	doc.syncStatus();
+
+	const wheelListener = (e: WheelEvent) => {
+		if (e.ctrlKey || e.metaKey) {
+			e.preventDefault();
+			e.stopPropagation();
+			settings.zoomBy(wheelZoomFactor(e.deltaY));
+		}
+	};
+
+	container.addEventListener("wheel", wheelListener, { capture: true });
+
+	// This document's headings and block folds, from Rust, cached per model
+	// version: utils/markdownCompletion.ts.
+	const { documentOutline, headingAnchors } = createDocumentOutline(invoke);
+
+	// The colours that come from the renderer rather than from the grammar's
+	// regexes (`utils/semanticTokens.ts`). Registered once per editor, beside the
+	// completion provider, and disposed with it.
+	const { provider: semanticTokensProvider } = createMarkdownSemanticTokensProvider(monaco);
+	const semanticTokens = monaco.languages.registerDocumentSemanticTokensProvider(
+	MARKDOWN_LANGUAGE_ID,
+	semanticTokensProvider,
+	);
+
+	// What sticky scroll pins (#759), from the same heading list link completion
+	// uses.
+	const documentSymbols = monaco.languages.registerDocumentSymbolProvider(MARKDOWN_LANGUAGE_ID, {
+	provideDocumentSymbols: async (model) => {
+		const lineCount = model.getLineCount();
+		return headingSymbols(await headingAnchors(model), lineCount, monaco.languages.SymbolKind.String);
+	},
+	});
+
+	// Headings, plus the list items, code blocks, quotes and tables that
+	// indentation folding covered: registering this turns that fallback off (#777).
+	const foldingRanges = monaco.languages.registerFoldingRangeProvider(MARKDOWN_LANGUAGE_ID, {
+	provideFoldingRanges: async (model) => {
+		const { anchors, folds } = await documentOutline(model);
+		return [...headingFoldRanges(anchors, model.getLineCount(), (n) => model.getLineContent(n)), ...folds];
+	},
+	});
+
+	const completionProvider = monaco.languages.registerCompletionItemProvider(
+		"markdown",
+		{
+			triggerCharacters: MARKDOWN_COMPLETION_TRIGGERS,
+			provideCompletionItems: (model, position) =>
+				provideMarkdownCompletionItems(model, position, {
+					monaco,
+					headingAnchors,
+					invoke,
+					activeTabPath: () => tabManager.activeTab?.path,
+					imageDirectory: () => settings.imageDirectory,
+				}),
+		},
+	);
+
+	// The nameless key commands (clipboard, and Enter/Tab/Shift+Tab/Mod+Enter
+	// in lists and tables): which key, which handler, behind which `when`
+	// clause, is `editorKeyCommands` in utils/editorActions.ts.
+	for (const command of editorKeyCommands(monaco)) {
+		editor.addCommand(command.binding, keyHandlers[command.handler], command.when);
+	}
+
+	// AltGr on Windows arrives as Ctrl+Alt, and Monaco resolves a keystroke
+	// from Ctrl/Alt and the key code without looking at AltGraph, so Polish
+	// AltGr+Z matched Ctrl+Alt+Z and ż was never typed. The editor's own
+	// keydown fires before the keybinding service dispatches (see the vim
+	// note in Editor.svelte), so this key is set in time for the Ctrl+Alt actions'
+	// `keybindingContext` to refuse it. `editor.spec.ts` shows both.
+	const altGraphChord = editor.createContextKey<boolean>("altGraphChord", false);
+	editor.onKeyDown((e) => altGraphChord.set(isAltGraphChord(e.browserEvent)));
+
+	deps.setEditorReady(true);
+
+	// After the view-state / anchor-line restore above, deliberately: an
+	// explicit "edit this fragment" beats the position the tab was left at.
+	jumps.spendPending();
+
+	return () => {
+		deps.setEditorReady(false);
+		doc.cancelPendingWordCount();
+		window.open = originalOpen;
+		mediaQuery.removeEventListener("change", updateTheme);
+		container.removeEventListener("wheel", wheelListener, { capture: true });
+		completionProvider.dispose();
+		semanticTokens.dispose();
+		documentSymbols.dispose();
+		foldingRanges.dispose();
+
+		if (editor && doc.currentTabId) doc.writePosition(doc.currentTabId);
+
+		editor.dispose();
+	};
+}
diff --git a/src/lib/utils/openFileMode.ts b/src/lib/utils/openFileMode.ts
index 01c3ea7f..4f83fe6f 100644
--- a/src/lib/utils/openFileMode.ts
+++ b/src/lib/utils/openFileMode.ts
@@ -16,6 +16,13 @@ export type OpenFileMode = 'preview' | 'editor' | 'split';
 
 export const DEFAULT_OPEN_FILE_MODE: OpenFileMode = 'preview';
 
+/** The Settings select, in order: the one control, with its three answers. */
+export const OPEN_FILE_MODE_OPTIONS: readonly { value: OpenFileMode; labelKey: string }[] = [
+	{ value: 'preview', labelKey: 'settings.preview' },
+	{ value: 'editor', labelKey: 'settings.editor' },
+	{ value: 'split', labelKey: 'menu.splitView' },
+];
+
 export function isOpenFileMode(value: unknown): value is OpenFileMode {
 	return value === 'preview' || value === 'editor' || value === 'split';
 }
diff --git a/src/lib/utils/pasteContext.ts b/src/lib/utils/pasteContext.ts
index bbb4e33d..b3844d84 100644
--- a/src/lib/utils/pasteContext.ts
+++ b/src/lib/utils/pasteContext.ts
@@ -155,3 +155,27 @@ export function shouldLinkifyPastedUrl(context: PasteCaretContext): boolean {
 	const tokens = context.tokenize(probe.text);
 	return !isCodeAtOffset(tokens[probe.lineIndex] ?? [], probe.offset);
 }
+
+/**
+ * Pasting a URL only turns into `[label](url)` where markdown links mean
+ * something. Inside a fenced or indented code block, inside inline code, or
+ * inside YAML front matter, the user wants the bare URL they copied.
+ *
+ * The decision is taken once per paste, from the primary selection: a paste
+ * is a single user action, and re-tokenizing for every cursor of a large
+ * multi-cursor selection would cost far more than the edge case is worth.
+ * `monacoEditor` is `monaco.editor`, whose `tokenize` runs the grammar.
+ */
+export function isLinkifyPasteTarget(
+	model: { getLanguageId(): string; getValue(): string; getLinesContent(): string[] },
+	selection: { startLineNumber: number; startColumn: number },
+	monacoEditor: { tokenize(text: string, languageId: string): readonly (readonly PasteContextToken[])[] },
+): boolean {
+	return shouldLinkifyPastedUrl({
+		languageId: model.getLanguageId(),
+		content: model.getValue(),
+		linesUpToCaret: model.getLinesContent().slice(0, selection.startLineNumber),
+		column: selection.startColumn,
+		tokenize: (text) => monacoEditor.tokenize(text, MARKDOWN_LANGUAGE_ID),
+	});
+}
diff --git a/src/lib/utils/previewCopy.ts b/src/lib/utils/previewCopy.ts
index 3b016e66..b13d7282 100644
--- a/src/lib/utils/previewCopy.ts
+++ b/src/lib/utils/previewCopy.ts
@@ -132,3 +132,21 @@ export function copyableFlavours(selection: Selection, tabPath: string): { text:
 		html: copyableHtml(fragment, tabPath, dropSoftBreaks),
 	};
 }
+
+/**
+ * The document's `copy` handler: ⌘C in the preview and Edit ▸ Copy both land
+ * here (#549). It writes the clipboard itself and cancels the native copy, so
+ * the flavours on the clipboard are exactly these two and WebKit adds none.
+ */
+export function handleCopy(e: ClipboardEvent, tabPath: string) {
+	const active = document.activeElement;
+	if (active instanceof HTMLInputElement || active instanceof HTMLTextAreaElement) return;
+	const selection = window.getSelection();
+	if (!selection || selection.isCollapsed || !selection.rangeCount || !e.clipboardData) return;
+	// Rendered content keeps its formatting when copied (#674), as in a
+	// browser or VS Code's Markdown preview.
+	const { text, html } = copyableFlavours(selection, tabPath);
+	e.clipboardData.setData('text/plain', text);
+	e.clipboardData.setData('text/html', html);
+	e.preventDefault();
+}
diff --git a/src/lib/utils/previewLayout.ts b/src/lib/utils/previewLayout.ts
new file mode 100644
index 00000000..54193e44
--- /dev/null
+++ b/src/lib/utils/previewLayout.ts
@@ -0,0 +1,90 @@
+import type { ExportAppearance, ExportContext } from './export';
+import { fontFamilyValue } from './fontFamily.js';
+import { t, type LanguageCode } from './i18n.js';
+import { getPreviewContentWidth } from './previewWidth.js';
+import type { SplitEditorSide } from './splitPanes.js';
+import { isTocOverhanging, type TocSide } from './tocOverlay.js';
+
+const HIGHLIGHT_COLORS: Record<string, string> = {
+	default: 'color-mix(in srgb, var(--color-accent-fg) 40%, transparent)',
+	yellow: 'rgba(255, 208, 0, 0.4)',
+	orange: 'rgba(255, 140, 0, 0.4)',
+	red: 'rgba(255, 60, 60, 0.4)',
+	pink: 'rgba(255, 105, 180, 0.4)',
+	purple: 'rgba(164, 108, 244, 0.4)',
+	blue: 'rgba(67, 138, 243, 0.4)',
+	cyan: 'rgba(43, 185, 178, 0.4)',
+	green: 'rgba(77, 177, 88, 0.4)',
+};
+
+/** The slice of the settings store the preview's look is derived from. */
+export type PreviewAppearanceSettings = {
+	previewFont: string;
+	previewFontSize: number;
+	codeFont: string;
+	codeFontSize: number;
+	highlightColor: string;
+};
+
+/** The preview's fonts and highlight, which the exports carry as well. */
+export function previewAppearanceFrom(settings: PreviewAppearanceSettings): ExportAppearance {
+	return {
+		fontFamily: fontFamilyValue(settings.previewFont, 'sans-serif'),
+		fontSize: settings.previewFontSize,
+		codeFontFamily: fontFamilyValue(settings.codeFont, 'monospace'),
+		codeFontSize: settings.codeFontSize,
+		highlightColor: HIGHLIGHT_COLORS[settings.highlightColor] || HIGHLIGHT_COLORS.yellow,
+	};
+}
+
+export type PreviewLayoutSettings = {
+	previewMaxWidth: unknown;
+	previewFullWidth: boolean;
+	tocSide: TocSide;
+	splitEditorSide: SplitEditorSide;
+	tocWidth: number;
+};
+
+export type PreviewView = { isEditing: boolean; isSplit: boolean; viewerWidth: number };
+
+/**
+ * The preview's measure and whether the outline covers it. Both come from the
+ * one content width, so the outline cannot think there is a gutter the preview
+ * does not leave.
+ */
+export function previewLayout(settings: PreviewLayoutSettings, view: PreviewView) {
+	const contentWidth = getPreviewContentWidth(settings.previewMaxWidth, settings.previewFullWidth);
+	return {
+		contentWidth,
+		/** The live `.markdown-body`'s `--preview-max-width`. */
+		maxWidthCss: contentWidth === null ? '100%' : `${contentWidth}px`,
+		isOverhanging: isTocOverhanging({
+			...view,
+			tocSide: settings.tocSide,
+			splitEditorSide: settings.splitEditorSide,
+			isFullWidth: settings.previewFullWidth,
+			previewContentWidth: contentWidth,
+			tocWidth: settings.tocWidth,
+		}),
+	};
+}
+
+export type ExportSettings = PreviewLayoutSettings &
+	PreviewAppearanceSettings & { previewNewlineBreaks: boolean; language: LanguageCode };
+
+/**
+ * What both export routes are handed. The width is the preview's own, so the
+ * exported file is read at the measure it was written at.
+ */
+export function exportContextFrom(
+	settings: ExportSettings,
+	doc: { rawContent: string; tabTitle: string; tabPath: string; mermaidTheme: string },
+): ExportContext {
+	return {
+		...doc,
+		contentWidth: getPreviewContentWidth(settings.previewMaxWidth, settings.previewFullWidth),
+		appearance: previewAppearanceFrom(settings),
+		newlineBreaks: settings.previewNewlineBreaks,
+		frontMatterTitle: t('frontMatter.properties', settings.language),
+	};
+}
diff --git a/src/lib/utils/previewLinks.ts b/src/lib/utils/previewLinks.ts
new file mode 100644
index 00000000..ba9ac15b
--- /dev/null
+++ b/src/lib/utils/previewLinks.ts
@@ -0,0 +1,258 @@
+import { getMarkdownLinkTarget, resolveMarkdownTargetPath, type MarkdownLinkTarget } from './markdownLinks.js';
+import { resolveLocalFileLinkPath } from './localFileLinks.js';
+import { isSameFilePath } from './pathIdentity.js';
+
+export interface PreviewClickDeps {
+	hideTooltip(): void;
+	toggleFold(target: HTMLElement): boolean;
+	scrollToAnchor(id: string): Promise<unknown>;
+	opensInNewTab(e: MouseEvent): boolean;
+	openInNewTab(target: MarkdownLinkTarget): Promise<void>;
+	openHere(target: MarkdownLinkTarget): Promise<void>;
+	zoom(data: { src?: string; html?: string }): void;
+	placeCursor(e: MouseEvent): void;
+}
+
+/** The preview `<article>`'s click handler. */
+export async function handlePreviewClick(e: MouseEvent, deps: PreviewClickDeps) {
+	const target = e.target as HTMLElement;
+
+	// The hover preview describes the element under the cursor, and only
+	// `mouseout` takes it down. A click that replaces the document removes
+	// that element while the cursor is still on it, and removing a node
+	// dispatches no `mouseout` — so the box was left on screen until the
+	// pointer happened to cross another link. Dropping it here, before any
+	// branch, is the same thing a browser does with its own link preview:
+	// the click is the moment the description stops being about anything.
+	deps.hideTooltip();
+
+	// Fold toggle: the heading's chevron, or a foldable callout's whole title
+	// bar. One branch for both, because they are one feature — the callout's
+	// own branch used to toggle the classes and stop there, so a folded
+	// callout re-opened on the next render while a folded heading did not.
+	if (deps.toggleFold(target)) {
+		if (e.detail > 1) e.preventDefault(); // prevent double-click selection
+		e.stopPropagation();
+		return;
+	}
+
+	const a = target.closest('a');
+	if (a) {
+		const href = a.getAttribute('href');
+		if (href?.startsWith('#') && href.length > 1) {
+			e.preventDefault();
+			await deps.scrollToAnchor(href.substring(1));
+			return;
+		}
+
+		const relativeMarkdownTarget = href ? getMarkdownLinkTarget(href) : null;
+		if (relativeMarkdownTarget) {
+			e.preventDefault();
+			e.stopPropagation();
+			// Which of the two this is depends on the setting and the chord
+			// together — the chord means "the other one". Opening a tab goes
+			// through `addTab`, which already resolves a file that is open to
+			// the tab holding it, so one gesture answers both halves of #661:
+			// a new tab, or the one that already has the file.
+			if (deps.opensInNewTab(e)) {
+				await deps.openInNewTab(relativeMarkdownTarget);
+			} else {
+				await deps.openHere(relativeMarkdownTarget);
+			}
+			return;
+		}
+
+		// Every other link is opened by `handleDocumentClick` on `document`,
+		// and SvelteKit's router sits in between (on
+		// `document.documentElement`), claiming any same-origin href whose
+		// click nobody else has: `[a](Files/a.pdf)` became a client-side
+		// navigation to a route that does not exist, and its 404 page
+		// replaced the app — including the title bar it draws, which on
+		// Windows is the only way to close the window (#772). The router
+		// bails on `event.defaultPrevented`.
+		e.preventDefault();
+		return;
+	}
+
+	// media zoom handling
+	const img = target.closest('img');
+	if (img) {
+		deps.zoom({ src: img.src });
+		return;
+	}
+
+	const mermaidDiv = target.closest('.mermaid-diagram');
+	if (mermaidDiv) {
+		const svg = mermaidDiv.querySelector('svg');
+		if (svg) {
+			// clone and strip fixed dimensions so viewBox governs scaling
+			const clone = svg.cloneNode(true) as SVGElement;
+			clone.removeAttribute('width');
+			clone.removeAttribute('height');
+			clone.style.width = '';
+			clone.style.height = '';
+			deps.zoom({ html: clone.outerHTML });
+			return;
+		}
+	}
+
+	deps.placeCursor(e);
+}
+
+export interface DocumentLinkDeps {
+	currentFile: string;
+	openHere(target: MarkdownLinkTarget): Promise<void>;
+	openWithSystem(path: string): Promise<void>;
+	openUrl(url: string): Promise<void>;
+	/** Reports a link that could not be opened, named as the document wrote it. */
+	openFailed(rawHref: string): void;
+}
+
+/** What a click on a link anywhere in the document opens, once the preview declined it. */
+export async function followDocumentLink(event: MouseEvent, anchor: HTMLAnchorElement, deps: DocumentLinkDeps) {
+	const rawHref = anchor.getAttribute('href');
+	if (!rawHref) return;
+
+	if (rawHref.startsWith('#')) return;
+
+	const relativeMarkdownTarget = getMarkdownLinkTarget(rawHref);
+	if (relativeMarkdownTarget) {
+		event.preventDefault();
+		await deps.openHere(relativeMarkdownTarget);
+		return;
+	}
+
+	// A link to a local non-markdown file (`[data](./data.csv)`) is a
+	// path, and `anchor.href` is not: the DOM resolved it against the
+	// webview origin. Hand the OS the resolved disk path instead.
+	const localFilePath = resolveLocalFileLinkPath(rawHref, deps.currentFile);
+	if (localFilePath) {
+		event.preventDefault();
+		await deps.openWithSystem(localFilePath);
+		return;
+	}
+
+	if (anchor.href) {
+		event.preventDefault();
+		// `openUrl` rejects anything outside the opener plugin's scope
+		// (`mailto:`, `tel:`, `http://*`, `https://*`). Without this the
+		// rejection was unhandled: the click did nothing, said nothing,
+		// and left an uncaught promise rejection behind.
+		try {
+			await deps.openUrl(anchor.href);
+		} catch (error) {
+			console.error('Failed to open link', anchor.href, error);
+			deps.openFailed(rawHref);
+		}
+	}
+}
+
+export interface SystemOpenDeps {
+	isLaunchable(path: string): Promise<boolean>;
+	reveal(path: string): Promise<unknown>;
+	openPath(path: string): Promise<void>;
+	revealed(path: string): void;
+	openFailed(path: string): void;
+}
+
+/**
+ * Hands a file Markpad does not edit to the OS: a document link to
+ * `data.csv`, or a non-Markdown file clicked in the folder sidebar.
+ */
+export async function openWithSystem(path: string, deps: SystemOpenDeps) {
+	try {
+		// The OS default handler runs a program (`./setup.command`,
+		// `Calculator.app`, `x.exe`) rather than showing it, so one
+		// click on a document's link would launch it. Reveal it instead.
+		if (await deps.isLaunchable(path)) {
+			await deps.reveal(path);
+			deps.revealed(path);
+			return;
+		}
+		await deps.openPath(path);
+	} catch (error) {
+		console.error('Failed to open local file', path, error);
+		deps.openFailed(path);
+	}
+}
+
+export interface RelativeTargetDeps {
+	currentFile: string;
+	canonicalizePath(path: string): Promise<string | undefined>;
+	scrollToAnchorWhenReady(anchor: string, options?: { pushHistory?: boolean }, expectedFile?: string): Promise<unknown>;
+	scrollToTop(): void;
+	activeTabId: string | null;
+	canCloseTab(tabId: string): Promise<boolean>;
+	loadMarkdown(path: string): Promise<unknown>;
+}
+
+export async function openRelativeMarkdownTarget(target: MarkdownLinkTarget, deps: RelativeTargetDeps) {
+	const from = deps.currentFile;
+	const resolved = resolveMarkdownTargetPath(from, target);
+	if (!resolved) return;
+	// The same file, not the same string: `readme.md#a` inside `Readme.md`
+	// on macOS, or a link through a symlink, is a jump within this document,
+	// not a reload that asks to discard its unsaved edits.
+	const [resolvedKey, fromKey] = await Promise.all([deps.canonicalizePath(resolved), deps.canonicalizePath(from)]);
+	if (isSameFilePath({ path: resolved, pathKey: resolvedKey }, { path: from, pathKey: fromKey })) {
+		if (target.hash) {
+			await deps.scrollToAnchorWhenReady(target.hash);
+		} else {
+			deps.scrollToTop();
+		}
+		return;
+	}
+	if (deps.activeTabId && !(await deps.canCloseTab(deps.activeTabId))) return;
+	await deps.loadMarkdown(resolved);
+	if (target.hash) {
+		await deps.scrollToAnchorWhenReady(target.hash, { pushHistory: false }, resolved);
+	}
+}
+
+export interface LinkTooltip {
+	text: string;
+	html: string;
+	isFootnote: boolean;
+}
+
+/**
+ * What the hover preview says about a link: the target heading's text, the
+ * footnote's body, or the href as the document wrote it. `null` shows nothing.
+ */
+export function linkTooltipFor(
+	anchor: HTMLAnchorElement,
+	deps: { findAnchorTarget(id: string): Element | null; footnoteRoot: ParentNode | null | undefined },
+): LinkTooltip | null {
+	const rawHref = anchor.getAttribute('href') || '';
+
+	// tooltip for same-page anchor links: show text of target header
+	if (rawHref.startsWith('#')) {
+		const el = deps.findAnchorTarget(rawHref.substring(1));
+		if (el) {
+			// Use data-label if it's a block anchor, otherwise use textContent
+			let text = el.getAttribute('data-label') || el.textContent || '';
+			text = text.replace(/↩.*$/, '').trim(); // remove backrefs if any
+			if (text) return { text, html: '', isFootnote: false };
+		}
+		return null;
+	}
+
+	// footnote references: show footnote content instead of URL
+	if (anchor.hasAttribute('data-footnote-ref') || anchor.closest('[data-footnote-ref]') || rawHref.match(/#fn-|#fnref-|#user-content-fn/)) {
+		const fnId = rawHref.replace(/^#/, '');
+		const fnLi = deps.footnoteRoot?.querySelector(`#${CSS.escape(fnId)}`) ||
+		              deps.footnoteRoot?.querySelector(`li#${CSS.escape(fnId)}`);
+		if (fnLi) {
+			// clone to remove backref arrow from tooltip
+			const clone = fnLi.cloneNode(true) as HTMLElement;
+			const backrefs = clone.querySelectorAll('.footnote-backref, a[href^="#fnref-"]');
+			backrefs.forEach(b => b.remove());
+
+			let fnHtml = clone.innerHTML.trim();
+			if (fnHtml) return { text: '', html: fnHtml, isFootnote: true };
+		}
+	}
+
+	// The raw href. The DOM-resolved one starts with `tauri://localhost`.
+	return rawHref ? { text: rawHref, html: '', isFootnote: false } : null;
+}
diff --git a/src/lib/utils/previewPatch.ts b/src/lib/utils/previewPatch.ts
index 6ad9b4d6..b93471d6 100644
--- a/src/lib/utils/previewPatch.ts
+++ b/src/lib/utils/previewPatch.ts
@@ -1,3 +1,5 @@
+import { untrack } from 'svelte';
+
 import { applyFolds, processBlockMarkup, wrapHeadings, type FoldIds } from './markdown.js';
 import { invalidateAnchorMemos } from './previewAnchor.js';
 import { replacedBy } from './richContent.js';
@@ -366,3 +368,42 @@ function insertBlock(host: HTMLElement, els: Element[][], index: number, nodes:
 	}
 	host.prepend(...nodes);
 }
+
+const patchedHtml = new WeakMap<HTMLElement, string>();
+
+/**
+ * `patchPreview` for the viewer's hosts, once per document.
+ *
+ * A host that already holds `html` — a tab being re-activated — is not
+ * sanitized and diffed again: every block would compare equal. The switch did
+ * change which host is displayed, which the anchor memos read, and the patch is
+ * what would have invalidated them.
+ *
+ * Only the new blocks go to `observe`. `ResizeObserver.observe` on a target it
+ * is already watching re-registers it rather than doing nothing, and a fresh
+ * registration delivers an initial observation — so handing it the whole host
+ * would put back the per-keystroke re-measure of every fold that keeping the
+ * observation alive removed.
+ *
+ * The patch runs untracked, `readTab` included: a fold toggle or a rename is
+ * not a new document, so nothing it reads may re-run the caller's effect.
+ */
+export function patchHost(
+	host: HTMLElement,
+	html: string,
+	readTab: () => { filePath: string; foldOverrides: Set<string> },
+	observe: (scope: Element) => void,
+): Pick<PreviewPatch, 'inserted' | 'wrappers'> {
+	const unchanged = patchedHtml.get(host) === html;
+	patchedHtml.set(host, html);
+	if (unchanged) invalidateAnchorMemos();
+	const patch = unchanged
+		? { inserted: [], wrappers: [] }
+		: untrack(() => {
+				const { filePath, foldOverrides } = readTab();
+				return patchPreview(host, html, filePath, foldOverrides);
+			});
+	for (const block of patch.inserted) observe(block);
+	for (const wrapper of patch.wrappers) observe(wrapper);
+	return patch;
+}
diff --git a/src/lib/utils/previewPatchEffect.svelte.ts b/src/lib/utils/previewPatchEffect.svelte.ts
new file mode 100644
index 00000000..78cf9016
--- /dev/null
+++ b/src/lib/utils/previewPatchEffect.svelte.ts
@@ -0,0 +1,50 @@
+/**
+ * How many documents the preview DOM has been given, as a number anything
+ * downstream of the render can wait on.
+ *
+ * `htmlContent` looks like the same signal and is not. It says a document
+ * has been *rendered*, and the outline used to take it as saying the article
+ * now *holds* that document — which is true only if the patch has
+ * already run. On a mount it has not: Svelte runs a child component's
+ * effects before its parent's, so `<Toc>` scanned the article in the same
+ * flush, one step ahead of the patch that fills it, and found nothing. The
+ * string does not change again, so nothing asked it to look twice and the
+ * outline stayed empty until it was unmounted and remounted.
+ *
+ * A pinned outline is the one that never gets that remount, which is why it
+ * was the only place the bug was visible: an overhanging floating outline
+ * closes itself, and reopening it builds a new component against a DOM that
+ * is by then complete.
+ *
+ * The counter is kept twice on purpose — `patches` is the plain one
+ * this effect increments, so the `$state` is only ever written here and
+ * never read, and the effect cannot schedule itself.
+ *
+ * Patches the visible preview host with each rendered document (`patch` is the
+ * viewer's patch-and-enrich step) and publishes `revision` after every patch.
+ * Call during component init.
+ */
+export function followPreviewPatch(
+	getHost: () => HTMLElement | null,
+	getHtml: () => string,
+	patch: (host: HTMLElement, html: string) => void,
+): { readonly revision: number } {
+	let revision = $state(0);
+	let patches = 0;
+	$effect(() => {
+		const host = getHost();
+		if (!host) {
+			// Still a read, so a document that lands before the element exists
+			// re-runs this rather than being missed.
+			void getHtml();
+			return;
+		}
+		patch(host, getHtml());
+		revision = ++patches;
+	});
+	return {
+		get revision() {
+			return revision;
+		},
+	};
+}
diff --git a/src/lib/utils/previewRefresh.ts b/src/lib/utils/previewRefresh.ts
new file mode 100644
index 00000000..ae4e17ee
--- /dev/null
+++ b/src/lib/utils/previewRefresh.ts
@@ -0,0 +1,16 @@
+/**
+ * Whether the viewer keeps `tab.content` (the rendered preview HTML) current
+ * while the tab is being edited: only when a preview is on screen to need it —
+ * split view, or the outline open beside the editor. Otherwise `tab.content`
+ * goes stale while editing, so nothing may read it as "the document".
+ *
+ * `isEditing` and `showToc` are getters, read only when `isSplit` is false:
+ * an effect that calls this must not re-run on an outline toggle in split view.
+ */
+export function refreshesPreviewCache(
+	tab: { isSplit: boolean; rawContent?: string },
+	isEditing: () => boolean,
+	showToc: () => boolean,
+): boolean {
+	return (tab.isSplit || (isEditing() && showToc())) && tab.rawContent !== undefined;
+}
diff --git a/src/lib/utils/previewScrollSync.ts b/src/lib/utils/previewScrollSync.ts
new file mode 100644
index 00000000..799e0e56
--- /dev/null
+++ b/src/lib/utils/previewScrollSync.ts
@@ -0,0 +1,113 @@
+import { asRendererLine, type LineCoordinates, type RendererLine } from './lineCoordinates.js';
+import { getSourceLineAtPreviewOffset, PREVIEW_ANCHOR_OFFSET, type AnchorNode, type MeasureAnchorBox } from './previewAnchor.js';
+import { getScrollSyncPositionFromPixels, getScrollTopForSyncPosition, type ScrollSyncPosition } from './scrollSync.js';
+
+/**
+ * The preview's scrolling element, as these functions read it. Its scroll
+ * extent (`scrollMax`) is the caller's measurement.
+ */
+export type PreviewScroller = AnchorNode & {
+	readonly scrollTop: number;
+	querySelector(selector: string): AnchorNode | null;
+};
+
+function getPreviewFrontMatterScrollEnd(target: PreviewScroller, scrollMax: number, measure: MeasureAnchorBox) {
+	const panel = target.querySelector('.frontmatter-panel');
+	if (!panel) return 0;
+
+	// In the same space as `target.scrollTop`, which is what it is compared
+	// against — see `measurePreviewBox`.
+	const box = measure(panel);
+	return Math.max(0, Math.min(scrollMax, box.top + box.height));
+}
+
+export function getPreviewScrollSyncPosition(
+	target: PreviewScroller,
+	scrollMax: number,
+	lineCoords: LineCoordinates,
+	measure: MeasureAnchorBox,
+): ScrollSyncPosition {
+	const position = getScrollSyncPositionFromPixels(
+		target.scrollTop,
+		scrollMax,
+		getPreviewFrontMatterScrollEnd(target, scrollMax, measure),
+	);
+
+	// Front matter is a rendered panel with no source range, so there is no
+	// line to send and the section ratio is the only thing that can carry it.
+	// This is the carve-out `scrollSync.ts` exists for, unchanged.
+	if (position.section !== 'body') return position;
+
+	const line = lineCoords.bufferLineAtPreviewOffset(target, target.scrollTop, measure);
+
+	return line === null ? position : { ...position, line };
+}
+
+/**
+ * Where the preview has to scroll to show `position`, or null when it is
+ * already within 5px of it.
+ */
+export function getPreviewScrollTopForSyncPosition(
+	target: PreviewScroller,
+	scrollMax: number,
+	position: ScrollSyncPosition,
+	lineCoords: LineCoordinates,
+	measure: MeasureAnchorBox,
+): number | null {
+	let targetScroll: number | null = null;
+
+	if (position.section === 'body' && position.line !== undefined) {
+		const offset = lineCoords.previewOffsetForBufferLine(
+			target,
+			position.line,
+			measure,
+		);
+		if (offset !== null) targetScroll = offset;
+	}
+
+	if (targetScroll === null) {
+		targetScroll = getScrollTopForSyncPosition(
+			position,
+			scrollMax,
+			getPreviewFrontMatterScrollEnd(target, scrollMax, measure),
+		);
+	}
+
+	// The line mapping can point past either end — the last block interpolates
+	// beyond the bottom of a preview that has no room left to scroll. Clamping
+	// before the threshold check is what keeps `isProgrammaticScroll` honest:
+	// an unreachable target fires no scroll event, and the flag would then be
+	// spent swallowing the reader's next real scroll instead.
+	targetScroll = Math.max(0, Math.min(scrollMax, targetScroll));
+
+	if (Math.abs(target.scrollTop - targetScroll) <= 5) return null;
+	return targetScroll;
+}
+
+/**
+ * The source line to save as this tab's reading position: the one rendered
+ * `PREVIEW_ANCHOR_OFFSET` below the top of the viewport, which is where the
+ * restore puts it back.
+ *
+ * This used to be its own scan — `querySelectorAll('[data-sourcepos]')` over
+ * the whole preview, then `offsetTop` and `offsetHeight` on every element it
+ * returned, on every scroll event. Two things were wrong with that beyond the
+ * cost (8.3ms per event on a 13,000-line document, measured in Chrome). It
+ * took the FIRST element covering the offset in document order, which is the
+ * outermost, while the restore's `findAnchorElement` takes the narrowest — so
+ * capture and restore disagreed about which block a position belonged to. And
+ * it had no opinion about `<br>`, which carries a source range and no box, so
+ * an anchor at the top of the document could resolve to one (#464).
+ */
+export function getPreviewScrollAnchor(target: PreviewScroller, measure: MeasureAnchorBox): RendererLine | null {
+	const line = getSourceLineAtPreviewOffset(
+		target,
+		target.scrollTop + PREVIEW_ANCHOR_OFFSET,
+		measure,
+	);
+
+	// Straight off `data-sourcepos`, so it is already a renderer line: the
+	// two consumers — the tab's saved reading position and the outline —
+	// both count from the first line of the body.
+	return line === null ? null : asRendererLine(Math.round(line));
+}
diff --git a/src/lib/utils/recentFiles.ts b/src/lib/utils/recentFiles.ts
index d49719fc..63b0fee2 100644
--- a/src/lib/utils/recentFiles.ts
+++ b/src/lib/utils/recentFiles.ts
@@ -143,3 +143,26 @@ export function isRecentFilesStorageEvent(event: Pick<StorageEvent, 'key' | 'sto
 	if (typeof localStorage !== 'undefined' && typeof localStorage.getItem === 'function' && event.storageArea && event.storageArea !== localStorage) return false;
 	return event.key === null || event.key === RECENT_FILES_KEY;
 }
+
+/**
+ * A window's view of the list. Every change is a change to the stored list
+ * (through {@link updateStoredRecentFiles}) and `publish` gets what landed;
+ * `listen` folds in what sibling windows did, since localStorage fires
+ * `storage` only in the *other* same-origin documents.
+ */
+export function createRecentFiles(publish: (files: string[]) => void) {
+	return {
+		load: () => publish(readStoredRecentFiles()),
+		save: (path: string) => publish(updateStoredRecentFiles((current) => promoteRecentFile(current, path))),
+		remove: (path: string) => publish(updateStoredRecentFiles((current) => dropRecentFile(current, path))),
+		rename: (oldPath: string, newPath: string) =>
+			publish(updateStoredRecentFiles((current) => renameRecentFile(current, oldPath, newPath))),
+		listen(target: Pick<Window, 'addEventListener' | 'removeEventListener'>): () => void {
+			const onStorage = (event: Event) => {
+				if (isRecentFilesStorageEvent(event as StorageEvent)) publish(readStoredRecentFiles());
+			};
+			target.addEventListener('storage', onStorage);
+			return () => target.removeEventListener('storage', onStorage);
+		},
+	};
+}
diff --git a/src/lib/utils/settingsOpen.svelte.ts b/src/lib/utils/settingsOpen.svelte.ts
new file mode 100644
index 00000000..5494e24e
--- /dev/null
+++ b/src/lib/utils/settingsOpen.svelte.ts
@@ -0,0 +1,79 @@
+import { invoke } from '@tauri-apps/api/core';
+import { getVersion } from '@tauri-apps/api/app';
+
+/**
+ * What the Settings dialog does each time it opens and closes: load the system
+ * fonts (once) and the app version (once), run `onOpen`, take focus from
+ * whatever opened it, and hand focus back on close.
+ *
+ * Call it during component setup: it installs its own `$effect`.
+ */
+export function createSettingsOpen(options: {
+	isOpen: () => boolean;
+	modal: () => HTMLElement | undefined;
+	onOpen: () => void;
+}) {
+	const view = $state({ systemFonts: [] as string[], appVersion: '' });
+	// Plain variables on purpose: neither is rendered, and both are read *and*
+	// written by the open-effect below. As `$state` they made that effect
+	// re-enter itself — `loadFonts()` reads `loaded` synchronously and sets it
+	// after its await, which re-ran the effect and clobbered the saved
+	// `previousActiveElement` with a control inside the dialog.
+	let loaded = false;
+	let previousActiveElement: HTMLElement | null = null;
+
+	async function loadFonts() {
+		if (loaded) return;
+		try {
+			view.systemFonts = await invoke<string[]>('get_system_fonts');
+			loaded = true;
+		} catch (e) {
+			console.error('Failed to load system fonts:', e);
+			view.systemFonts = ['Consolas', 'Courier New', 'Monaco', 'Menlo', 'Segoe UI'];
+		}
+	}
+
+	// Guarded by a plain (non-reactive) flag rather than by `if (!appVersion)`.
+	// The old form made the open-effect below *read* `appVersion` and the
+	// resolved promise *write* it, so the whole effect re-ran once the version
+	// arrived — and the re-run re-captured `previousActiveElement`, which by then
+	// was a button inside the dialog. Closing settings then returned focus into
+	// the dialog instead of to the control that opened it.
+	let versionRequested = false;
+	function ensureAppVersion() {
+		if (versionRequested) return;
+		versionRequested = true;
+		getVersion()
+			.then((v) => (view.appVersion = v))
+			.catch(console.error);
+	}
+
+	$effect(() => {
+		if (options.isOpen()) {
+			loadFonts();
+			ensureAppVersion();
+			options.onOpen();
+			previousActiveElement = document.activeElement as HTMLElement;
+			setTimeout(() => {
+				const settingsModal = options.modal();
+				const firstFocusable = settingsModal?.querySelector('button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])') as HTMLElement | null;
+				if (firstFocusable) {
+					firstFocusable.focus();
+				} else {
+					settingsModal?.focus();
+				}
+			}, 50);
+		} else if (previousActiveElement) {
+			previousActiveElement.focus();
+		}
+	});
+
+	return {
+		get systemFonts() {
+			return view.systemFonts;
+		},
+		get appVersion() {
+			return view.appVersion;
+		},
+	};
+}
diff --git a/src/lib/utils/settingsPanes.ts b/src/lib/utils/settingsPanes.ts
new file mode 100644
index 00000000..31de5b7d
--- /dev/null
+++ b/src/lib/utils/settingsPanes.ts
@@ -0,0 +1,290 @@
+import {
+	CODE_FONT_SIZE_RANGE,
+	EDITOR_FONT_SIZE_RANGE,
+	EDITOR_MAX_WIDTH_RANGE,
+	PREVIEW_FONT_SIZE_RANGE,
+	TAB_POSITION_OPTIONS,
+	clampToRange,
+	isWithinRange,
+	parseStoredNumber,
+	type NumericSettingRange,
+	type SettingsStore,
+} from '../stores/settings.svelte.js';
+import { OPEN_FILE_MODE_OPTIONS } from './openFileMode.js';
+import {
+	DEFAULT_PREVIEW_MAX_WIDTH,
+	MAX_PREVIEW_MAX_WIDTH,
+	MIN_PREVIEW_MAX_WIDTH,
+} from './previewWidth.js';
+
+/**
+ * The rows of the Settings panes, in the order the panes show them.
+ *
+ * Settings.svelte renders each pane by walking its `rows`: one markup per row
+ * kind, plus a `custom` branch for the rows whose control is one of a kind
+ * (the theme picker, the highlight swatches, …). The row's `id` is its
+ * control's DOM id and the `for` of its label.
+ */
+type BooleanKey = { [K in keyof SettingsStore]: SettingsStore[K] extends boolean ? K : never }[keyof SettingsStore];
+type NumberKey = 'editorFontSize' | 'editorMaxWidth' | 'previewFontSize' | 'codeFontSize';
+type FontKey = 'editorFont' | 'previewFont' | 'codeFont';
+type SelectKey = 'wordWrap' | 'tabPosition' | 'folderSide' | 'sidebarStackOrder' | 'tocFollows' | 'openFileMode';
+
+type RowBase = {
+	id: string;
+	labelKey: string;
+	/** Second line under the label. */
+	hintKey?: string;
+	/** The label's tooltip. */
+	titleKey?: string;
+	/** The label's tooltip while the row is inactive. */
+	inactiveTitleKey?: string;
+	/** Dims the row and disables its control: the setting does nothing in this state. */
+	inactive?: (s: SettingsStore) => boolean;
+};
+
+export type SelectOption = { value: string; labelKey: string };
+
+export type FontRow = RowBase & { kind: 'font'; key: FontKey };
+export type NumberRow = RowBase & { kind: 'number'; key: NumberKey; range: NumericSettingRange; unit: string };
+export type PreviewWidthRow = RowBase & { kind: 'previewWidth'; key: 'previewMaxWidth'; range: NumericSettingRange };
+export type SelectRow = RowBase & { kind: 'select'; key: SelectKey; options: readonly SelectOption[] };
+/** A switch bound to `key`, or one read through `checked` and flipped through `toggle`. */
+export type ToggleRow = RowBase & {
+	kind: 'toggle';
+	key?: BooleanKey;
+	checked?: (s: SettingsStore) => boolean;
+	toggle?: (s: SettingsStore) => void;
+};
+export type CustomRow = RowBase & { kind: 'custom' };
+
+export type SettingsRow = FontRow | NumberRow | PreviewWidthRow | SelectRow | ToggleRow | CustomRow;
+
+export type SettingsPane = {
+	rows: readonly SettingsRow[];
+	/** The pane's "Reset … settings" button. */
+	reset?: (s: SettingsStore) => void;
+};
+
+// With the tabs in a side column, the folder stacks into that column and this choice does not apply.
+export function folderSideFollowsTabs(s: SettingsStore): boolean {
+	return s.tabPlacement === 'left' || s.tabPlacement === 'right';
+}
+
+export const SETTINGS_PANES: Record<'editor' | 'preview' | 'appearance' | 'files', SettingsPane> = {
+	editor: {
+		reset: (s) => {
+			s.resetEditorFont();
+			s.resetEditorMaxWidth();
+		},
+		rows: [
+			{ kind: 'font', id: 'editor-font', labelKey: 'settings.font', key: 'editorFont' },
+			{ kind: 'number', id: 'editor-font-size', labelKey: 'settings.fontSize', key: 'editorFontSize', range: EDITOR_FONT_SIZE_RANGE, unit: 'px' },
+			{
+				kind: 'select',
+				id: 'editor-word-wrap',
+				labelKey: 'settings.wordWrap',
+				key: 'wordWrap',
+				options: [
+					{ value: 'off', labelKey: 'menu.wordWrapOff' },
+					{ value: 'on', labelKey: 'menu.wordWrapOn' },
+					{ value: 'wordWrapColumn', labelKey: 'menu.wordWrapColumn' },
+				],
+			},
+			// Monaco reads `wordWrapColumn` only in that wrap mode, so the row sits
+			// under it and is inert in the other two.
+			{
+				kind: 'number',
+				id: 'editor-max-width',
+				labelKey: 'settings.wrapColumn',
+				key: 'editorMaxWidth',
+				range: EDITOR_MAX_WIDTH_RANGE,
+				unit: 'chars',
+				inactive: (s) => s.wordWrap !== 'wordWrapColumn',
+			},
+			{
+				kind: 'toggle',
+				id: 'editor-line-numbers',
+				labelKey: 'settings.lineNumbers',
+				checked: (s) => s.lineNumbers === 'on',
+				toggle: (s) => s.toggleLineNumbers(),
+			},
+			{ kind: 'toggle', id: 'editor-minimap', labelKey: 'settings.minimap', key: 'minimap' },
+			{ kind: 'toggle', id: 'editor-vim-mode', labelKey: 'settings.vimMode', key: 'vimMode' },
+			{ kind: 'toggle', id: 'editor-status-bar', labelKey: 'settings.statusBar', key: 'statusBar' },
+			// The word count is drawn in the status bar: without one it shows nothing.
+			{ kind: 'toggle', id: 'editor-word-count', labelKey: 'settings.wordCount', key: 'wordCount', inactive: (s) => !s.statusBar },
+			{ kind: 'toggle', id: 'editor-show-whitespace', labelKey: 'settings.showWhitespace', key: 'showWhitespace' },
+			{ kind: 'toggle', id: 'editor-sticky-scroll', labelKey: 'settings.stickyScroll', key: 'stickyScroll' },
+			{
+				kind: 'toggle',
+				id: 'editor-line-highlight',
+				labelKey: 'settings.lineHighlight',
+				checked: (s) => s.renderLineHighlight === 'line',
+				toggle: (s) => s.toggleLineHighlight(),
+			},
+		],
+	},
+	preview: {
+		reset: (s) => {
+			s.resetPreviewFont();
+			s.resetPreviewMaxWidth();
+		},
+		rows: [
+			{
+				kind: 'previewWidth',
+				id: 'preview-max-width',
+				labelKey: 'settings.previewMaxWidth',
+				key: 'previewMaxWidth',
+				range: { min: MIN_PREVIEW_MAX_WIDTH, max: MAX_PREVIEW_MAX_WIDTH, step: 40, default: DEFAULT_PREVIEW_MAX_WIDTH },
+			},
+			{ kind: 'font', id: 'preview-font', labelKey: 'settings.previewBodyFont', key: 'previewFont' },
+			{ kind: 'number', id: 'preview-font-size', labelKey: 'settings.previewBodyFontSize', key: 'previewFontSize', range: PREVIEW_FONT_SIZE_RANGE, unit: 'px' },
+			{ kind: 'font', id: 'code-font', labelKey: 'settings.previewCodeFont', key: 'codeFont' },
+			{ kind: 'number', id: 'code-font-size', labelKey: 'settings.previewCodeFontSize', key: 'codeFontSize', range: CODE_FONT_SIZE_RANGE, unit: 'px' },
+			{ kind: 'toggle', id: 'preview-cursor', labelKey: 'settings.previewCursor', key: 'previewCursor' },
+			{ kind: 'toggle', id: 'preview-occurrences', labelKey: 'settings.previewOccurrences', key: 'previewOccurrences' },
+			{ kind: 'toggle', id: 'preview-annotations', labelKey: 'settings.previewAnnotations', key: 'previewAnnotations' },
+			{ kind: 'toggle', id: 'preview-table-breakout', labelKey: 'settings.previewTableBreakout', hintKey: 'settings.previewTableBreakoutHint', key: 'previewTableBreakout' },
+			{ kind: 'toggle', id: 'preview-table-scroll', labelKey: 'settings.previewTableScroll', hintKey: 'settings.previewTableScrollHint', key: 'previewTableScroll' },
+			{ kind: 'toggle', id: 'preview-newline-breaks', labelKey: 'settings.previewNewlineBreaks', hintKey: 'settings.previewNewlineBreaksHint', key: 'previewNewlineBreaks' },
+		],
+	},
+	appearance: {
+		rows: [
+			{ kind: 'custom', id: 'appearance-language', labelKey: 'settings.language' },
+			{ kind: 'custom', id: 'appearance-theme', labelKey: 'settings.theme' },
+			{ kind: 'custom', id: 'theme-import', labelKey: 'settings.importVSCodeTheme' },
+			{ kind: 'toggle', id: 'appearance-tabs', labelKey: 'settings.showTabs', key: 'showTabs' },
+			{
+				kind: 'select',
+				id: 'appearance-tab-position',
+				labelKey: 'settings.tabPosition',
+				key: 'tabPosition',
+				options: TAB_POSITION_OPTIONS,
+				inactive: (s) => !s.showTabs,
+			},
+			{
+				kind: 'select',
+				id: 'appearance-folder-side',
+				labelKey: 'settings.folderSide',
+				inactiveTitleKey: 'settings.folderSideFollowsTabs',
+				key: 'folderSide',
+				options: [
+					{ value: 'left', labelKey: 'settings.folderSideLeft' },
+					{ value: 'right', labelKey: 'settings.folderSideRight' },
+				],
+				inactive: folderSideFollowsTabs,
+			},
+			{
+				kind: 'select',
+				id: 'appearance-sidebar-stack',
+				labelKey: 'settings.sidebarStackOrder',
+				key: 'sidebarStackOrder',
+				options: [
+					{ value: 'openFilesTop', labelKey: 'settings.sidebarStackOpenFilesTop' },
+					{ value: 'folderTop', labelKey: 'settings.sidebarStackFolderTop' },
+				],
+			},
+			{ kind: 'toggle', id: 'appearance-folder-all-files', labelKey: 'settings.folderShowAllFiles', titleKey: 'settings.folderShowAllFilesHint', key: 'folderShowAllFiles' },
+			{
+				kind: 'toggle',
+				id: 'appearance-duplicate-name-folder',
+				labelKey: 'settings.showFolderForDuplicateNames',
+				key: 'showFolderForDuplicateNames',
+				inactive: (s) => !s.showTabs,
+			},
+			{ kind: 'toggle', id: 'appearance-toc', labelKey: 'settings.showTableOfContents', key: 'showToc' },
+			{
+				kind: 'select',
+				id: 'appearance-toc-follows',
+				labelKey: 'settings.tocFollows',
+				key: 'tocFollows',
+				options: [
+					{ value: 'scroll', labelKey: 'settings.tocFollowsScroll' },
+					{ value: 'cursor', labelKey: 'settings.tocFollowsCursor' },
+				],
+			},
+			{ kind: 'toggle', id: 'appearance-animate-jump', labelKey: 'settings.animateJumpScroll', key: 'animateJumpScroll' },
+			{ kind: 'toggle', id: 'appearance-animate-cursor', labelKey: 'settings.animateCursor', key: 'animateCursor' },
+			{ kind: 'custom', id: 'appearance-highlight-color', labelKey: 'settings.highlightColor' },
+			{
+				kind: 'toggle',
+				id: 'appearance-zen-mode',
+				labelKey: 'settings.zenMode',
+				hintKey: 'settings.zenModeHint',
+				checked: (s) => s.zenMode,
+				toggle: (s) => s.toggleZenMode(),
+			},
+			{ kind: 'toggle', id: 'appearance-focus-mode', labelKey: 'settings.focusMode', hintKey: 'settings.focusModeHint', key: 'focusMode' },
+			{ kind: 'toggle', id: 'appearance-typewriter-mode', labelKey: 'settings.typewriterMode', hintKey: 'settings.typewriterModeHint', key: 'typewriterMode' },
+		],
+	},
+	files: {
+		rows: [
+			{ kind: 'select', id: 'files-open-file-mode', labelKey: 'settings.openFileMode', key: 'openFileMode', options: OPEN_FILE_MODE_OPTIONS },
+			{ kind: 'toggle', id: 'files-new-file-mode', labelKey: 'settings.newFileDefaultMode', key: 'newFileDefaultMode' },
+			{ kind: 'toggle', id: 'files-links-new-tab', labelKey: 'settings.linksOpenInNewTab', key: 'linksOpenInNewTab' },
+			{ kind: 'toggle', id: 'files-recent-files', labelKey: 'settings.showRecentFiles', key: 'showRecentFiles' },
+			{ kind: 'toggle', id: 'files-auto-save', labelKey: 'settings.autoSave', key: 'autoSave' },
+			{ kind: 'toggle', id: 'files-restore-state', labelKey: 'settings.restoreStateOnReopen', titleKey: 'settings.restoreStateOnReopenHint', key: 'restoreStateOnReopen' },
+			{ kind: 'toggle', id: 'files-recovery', labelKey: 'settings.persistOpenEditors', titleKey: 'settings.persistOpenEditorsHint', key: 'persistOpenEditors' },
+			{ kind: 'custom', id: 'image-directory', labelKey: 'settings.imageDirectory' },
+			{ kind: 'custom', id: 'macos-image-scaling', labelKey: 'settings.scaleMacOSScreenshots' },
+			{ kind: 'toggle', id: 'files-close-window-last-tab', labelKey: 'settings.closeWindowWithLastTab', key: 'closeWindowWithLastTab' },
+			{ kind: 'custom', id: 'settings-file-import', labelKey: 'settings.settingsFile' },
+		],
+	},
+};
+
+/** Writes a numeric row's setting, clamped to the row's range. */
+export function setNumberSetting(s: SettingsStore, row: NumberRow, value: number) {
+	s[row.key] = clampToRange(value, row.range);
+}
+
+/**
+ * The event handlers of a numeric setting input.
+ *
+ * `min`/`max` on `<input type="number">` only drive validation styling and
+ * the spin buttons; they do not stop typing, and Svelte's `bind:value`
+ * assigns `null` for an empty field — which used to reach the store and
+ * render as `font-size: nullpx` before being persisted as the string
+ * "null". So the binding is one-way and every commit goes through the
+ * shared range.
+ *
+ * While typing we accept only values that already fall inside the range and
+ * ignore everything else, rather than clamping eagerly: clamping on each
+ * keystroke would turn the intermediate "1" of "18" into "10" and leave the
+ * caret stranded. Out-of-range or empty input is settled on commit instead.
+ */
+export function numberInputHandlers(range: NumericSettingRange, assign: (value: number) => void) {
+	/**
+	 * Commit (change / blur / Enter). Clamps, falls back to the range default for
+	 * an empty or unparseable field, and writes the result back to the DOM —
+	 * the element needs that explicitly, because when the clamped value equals
+	 * the value already in the store there is no state change for Svelte to
+	 * re-render from and the input would keep showing the rejected text.
+	 */
+	function commit(event: Event) {
+		const input = event.currentTarget as HTMLInputElement;
+		const next = parseStoredNumber(input.value, range);
+		assign(next);
+		input.value = String(next);
+	}
+
+	return {
+		oninput(event: Event) {
+			const input = event.currentTarget as HTMLInputElement;
+			if (input.value.trim() === '') return;
+			const parsed = Number(input.value);
+			if (!isWithinRange(parsed, range)) return;
+			assign(Math.round(parsed));
+		},
+		onchange: commit,
+		onblur: commit,
+		onkeydown(event: KeyboardEvent) {
+			if (event.key !== 'Enter') return;
+			commit(event);
+		},
+	};
+}
diff --git a/src/lib/utils/shortcuts.ts b/src/lib/utils/shortcuts.ts
index 19a48d50..216205cf 100644
--- a/src/lib/utils/shortcuts.ts
+++ b/src/lib/utils/shortcuts.ts
@@ -256,7 +256,7 @@ export const SHORTCUTS: readonly ShortcutEntry[] = [
 		//
 		// Taking it means Mod+K stops being a chord PREFIX, which is what
 		// `insert-table-simple` and `table-insert-column` used to hang off. What
-		// that costs on Monaco's side is argued in editor.checks.spec.ts.
+		// that costs on Monaco's side is argued in editor.chords.spec.ts.
 		chords: ['Mod+K'],
 		group: 'edit',
 		editorAction: true,
@@ -279,7 +279,7 @@ export const SHORTCUTS: readonly ShortcutEntry[] = [
 		//
 		// NOT `Mod+Alt+C`, which was the obvious pick and is not available — on macOS
 		// that is Monaco's `toggleFindCaseSensitive`. The reason it cannot be taken is
-		// recorded in editor.checks.spec.ts, where the next person hunting for
+		// recorded in editor.chords.spec.ts, where the next person hunting for
 		// a free chord will be.
 		chords: ['Mod+Shift+C'],
 		group: 'edit',
diff --git a/src/lib/utils/splitPanes.ts b/src/lib/utils/splitPanes.ts
index c2699e9c..32e0a532 100644
--- a/src/lib/utils/splitPanes.ts
+++ b/src/lib/utils/splitPanes.ts
@@ -28,3 +28,24 @@ export function splitRatioAfterMove(
 ): number {
 	return startRatio + (editorSide === 'left' ? fraction : -fraction);
 }
+
+/**
+ * The arrow keys' route: one 5% step, the same units the drag moves in. `null`
+ * for any other key.
+ */
+export function splitRatioAfterKey(ratio: number, key: string, editorSide: SplitEditorSide): number | null {
+	const step = key === 'ArrowLeft' ? -0.05 : key === 'ArrowRight' ? 0.05 : 0;
+	if (step === 0) return null;
+	return splitRatioAfterMove(ratio, step, editorSide);
+}
+
+/** The pointer's route: travel from `startX` as a share of the window. */
+export function splitRatioAfterDrag(
+	startRatio: number,
+	startX: number,
+	clientX: number,
+	containerWidth: number,
+	editorSide: SplitEditorSide,
+): number {
+	return splitRatioAfterMove(startRatio, (clientX - startX) / containerWidth, editorSide);
+}
diff --git a/src/lib/utils/tabContextMenu.ts b/src/lib/utils/tabContextMenu.ts
new file mode 100644
index 00000000..50f9e870
--- /dev/null
+++ b/src/lib/utils/tabContextMenu.ts
@@ -0,0 +1,61 @@
+import type { ContextMenuItem } from '../components/ContextMenu.svelte';
+import { isHomePath } from './homeTab.js';
+import { type LanguageCode, t } from './i18n.js';
+import { modifierFor, shortcutLabel } from './shortcuts.js';
+import { hasRealFilePath } from './tabFileActions.js';
+
+/** Sends a tab-menu event to this window. */
+type Emit = (event: string, payload?: unknown) => void;
+
+// ContextMenu prints `shortcut` into the same `<span class="menu-shortcut">`
+// the app menu uses, so a literal here sits a keystroke away from the app
+// menu's registry-derived chord and disagrees with it on macOS.
+
+/** The menu on the empty part of the tab strip. */
+export function tabListMenuItems(language: LanguageCode, osType: string, emit: Emit): ContextMenuItem[] {
+	const modifier = modifierFor(osType);
+	return [
+		{ label: t('menu.newFile', language), shortcut: shortcutLabel('file-new', modifier), onClick: () => emit('menu-tab-new') },
+		{ label: t('menu.undoCloseTab', language), shortcut: shortcutLabel('tab-undo-close', modifier), onClick: () => emit('menu-tab-undo') },
+	];
+}
+
+/** The menu on one tab. */
+export function tabMenuItems(menu: {
+	tab: { id: string; path: string };
+	language: LanguageCode;
+	osType: string;
+	tabCount: number;
+	fileActionItems: ContextMenuItem[];
+	moveToWindowItems: ContextMenuItem[];
+	emit: Emit;
+}): ContextMenuItem[] {
+	const { tab, language: currentLang, emit } = menu;
+	const modifier = modifierFor(menu.osType);
+	return [
+		{ label: t('menu.newFile', currentLang), shortcut: shortcutLabel('file-new', modifier), onClick: () => emit('menu-tab-new') },
+		{ label: t('menu.undoCloseTab', currentLang), shortcut: shortcutLabel('tab-undo-close', modifier), onClick: () => emit('menu-tab-undo') },
+		{
+			label: t('menu.rename', currentLang),
+			// Rename renames the file on disk; untitled and home tabs have
+			// no file.
+			disabled: !hasRealFilePath(tab.path),
+			onClick: () => emit('menu-tab-rename', tab.id),
+		},
+		{ separator: true },
+		...menu.fileActionItems,
+		{ separator: true },
+		{
+			label: t('menu.moveToNewWindow', currentLang),
+			// Moving the only tab would just churn windows, and the home
+			// tab is recreatable anywhere; both stay in place.
+			disabled: isHomePath(tab.path) || menu.tabCount < 2,
+			onClick: () => emit('menu-tab-detach', tab.id),
+		},
+		...menu.moveToWindowItems,
+		{ separator: true },
+		{ label: t('menu.closeFile', currentLang), shortcut: shortcutLabel('file-close', modifier), onClick: () => emit('menu-tab-close', tab.id) },
+		{ label: t('menu.closeOtherTabs', currentLang), onClick: () => emit('menu-tab-close-others', tab.id) },
+		{ label: t('menu.closeTabsToRight', currentLang), onClick: () => emit('menu-tab-close-right', tab.id) },
+	];
+}
diff --git a/src/lib/utils/tabFileActions.ts b/src/lib/utils/tabFileActions.ts
index a484ade7..cfb1d12f 100644
--- a/src/lib/utils/tabFileActions.ts
+++ b/src/lib/utils/tabFileActions.ts
@@ -31,6 +31,17 @@ export function hasExportableDocument(rawContent: string | undefined): boolean {
 	return !!rawContent;
 }
 
+/**
+ * The Home menu's export gate for a tab. It reads the Markdown buffer, not
+ * `content`: that is the rendered-preview HTML, refreshed only while the
+ * preview is on screen, so in plain edit mode with the TOC closed — the
+ * default state of a new file — it is still empty for a buffer that exports
+ * fine.
+ */
+export function canExportTab(tab: { rawContent: string } | null | undefined): boolean {
+	return hasExportableDocument(tab?.rawContent);
+}
+
 export function getTabFileActions(path: string): TabFileAction[] {
 	const disabled = !hasRealFilePath(path);
 
diff --git a/src/lib/utils/theme.ts b/src/lib/utils/theme.ts
index 3388c9ce..228848ea 100644
--- a/src/lib/utils/theme.ts
+++ b/src/lib/utils/theme.ts
@@ -1,4 +1,4 @@
-import { semanticTokenRules } from './editorTheme.js';
+import { semanticTokenRules, VSCODE_THEME_NAME } from './editorTheme.js';
 
 // Values taken from an imported VS Code theme end up concatenated into a global
 // `<style>` block. Anything that is not a colour literal could close the rule and
@@ -371,14 +371,14 @@ export async function parseAndApplyVscodeTheme(themeJsonStr: string, name: strin
 				if (isHexColor(value)) monacoColors[key] = value;
 			}
 
-			monaco.editor.defineTheme('vscode-custom', {
+			monaco.editor.defineTheme(VSCODE_THEME_NAME, {
 				base: isDark ? 'vs-dark' : 'vs',
 				inherit: true,
 				rules: rules,
 				colors: monacoColors,
 			});
 
-			monaco.editor.setTheme('vscode-custom');
+			monaco.editor.setTheme(VSCODE_THEME_NAME);
 		}
 	} catch (e) {
 		console.error('Monaco theme application failed:', e);
diff --git a/src/lib/utils/themeEffect.svelte.ts b/src/lib/utils/themeEffect.svelte.ts
new file mode 100644
index 00000000..9ef84517
--- /dev/null
+++ b/src/lib/utils/themeEffect.svelte.ts
@@ -0,0 +1,71 @@
+import { untrack } from 'svelte';
+import { clearVscodeTheme, loadVscodeTheme } from './theme.js';
+
+export interface ThemeEffectDeps {
+	/** What Rust paints the next window's background from: the appearance, never a theme name. */
+	saveStartupAppearance(appearance: 'system' | 'light' | 'dark'): void;
+	readVscodeTheme(name: string): Promise<string>;
+	/** Re-draws the diagrams. Run untracked: see below. */
+	recolourDiagrams(): void;
+	onLoadFailed(error: unknown): void;
+}
+
+/**
+ * Applies the theme setting to the document whenever it changes. Call during
+ * component init. Persistence and cross-window sync belong to the settings
+ * store; this is only the part that cannot: applying the theme to the document.
+ */
+export function followTheme(getTheme: () => string, deps: ThemeEffectDeps): void {
+	$effect(() => {
+		const theme = getTheme();
+
+		// Mermaid bakes its colours into the SVG it produces, so the diagrams have
+		// to be drawn again; `renderRichContent` finds the ones drawn for another
+		// theme. No `roots`, because the whole article is what changed appearance
+		// — including the hosts of tabs that are not on screen, which the reader
+		// switches back to without anything else re-rendering them.
+		//
+		// Called from each branch rather than once at the end, because the
+		// `vscode:` branch does not know its own appearance until
+		// `parseAndApplyVscodeTheme` has published `dataset.themeType`, and that
+		// is what `currentMermaidTheme` reads. Calling here would have re-drawn
+		// every diagram in the theme being replaced.
+		//
+		// `untrack` for the reason #740 established: `renderRichContent` reads
+		// reactive state before its first `await`, so a tracked call makes this
+		// effect re-run on unrelated changes — re-enriching every open tab's
+		// host on top of the pass the patch effect owns.
+		const recolourDiagrams = () => untrack(() => deps.recolourDiagrams());
+
+		if (theme === 'system' || theme === 'light' || theme === 'dark') {
+			if (theme === 'system') {
+				delete document.documentElement.dataset.theme;
+				delete document.documentElement.dataset.themeType;
+			} else {
+				document.documentElement.dataset.theme = theme;
+				document.documentElement.dataset.themeType = theme;
+			}
+			clearVscodeTheme();
+			deps.saveStartupAppearance(theme);
+			recolourDiagrams();
+			// No Monaco write here. It used to set `vs`/`vs-dark` through the
+			// `monaco` global, and because a child's effects run before its
+			// parent's it landed AFTER `Editor`'s own — stripping the editor of
+			// `app-theme-*` on every theme change. `editorTheme.ts`'s
+			// `monacoThemeName` is the one answer now, and `Editor` is the only
+			// pane that asks it; with no editor mounted there is nothing to
+			// paint, and a later mount reads the theme from the same seam.
+		} else {
+			const name = theme.replace('vscode:', '');
+			loadVscodeTheme(name, deps.readVscodeTheme).then((applied) => {
+				// A later choice replaced this one while it loaded; that choice
+				// owns the window now.
+				if (!applied) return;
+				// `parseAndApplyVscodeTheme` decides dark vs. light from the theme's
+				// own `type` field and publishes it here.
+				deps.saveStartupAppearance(document.documentElement.dataset.themeType === 'dark' ? 'dark' : 'light');
+				recolourDiagrams();
+			}).catch(deps.onLoadFailed);
+		}
+	});
+}
diff --git a/src/lib/utils/tocEntries.ts b/src/lib/utils/tocEntries.ts
new file mode 100644
index 00000000..63edc85a
--- /dev/null
+++ b/src/lib/utils/tocEntries.ts
@@ -0,0 +1,84 @@
+import { foldKeyOf } from './foldState.js';
+import { headingText } from './headingReference.js';
+import type { RendererLine } from './lineCoordinates.js';
+import { sourceLineOf } from './tocFollow.js';
+
+export interface TocItem {
+	id: string;
+	text: string;
+	level: number;
+	isBlock: boolean;
+	hasChildren?: boolean;
+	/**
+	 * How the fold state names this heading — read off the rendered heading,
+	 * never recomputed, so the outline and the renderer cannot disagree about
+	 * it. `''` for a block anchor, which is not a fold.
+	 */
+	foldKey: string;
+	/** Where this entry starts in the source, for following the editor. */
+	line: RendererLine | null;
+}
+
+/**
+ * Everything the outline can show, in the order the document holds it.
+ *
+ * One query rather than three. `querySelectorAll` returns document order,
+ * so asking for the headings and the block anchors together IS the
+ * interleaving — this used to ask for each separately and then sort the two
+ * lists back together against a third walk (`[id]`, which matches every
+ * element in the document carrying one) built into a position map.
+ *
+ * That cost is per render, and a render is a keystroke. #632 stopped the
+ * preview rebuilding its article for one character; an outline that walks
+ * the whole of it three times regardless spends a good part of that back,
+ * and on the documents where the patch matters most — 7819 elements in
+ * `samples/stress-test.md` — it is the largest remaining full-document pass
+ * in the render.
+ */
+const ENTRY_SELECTOR = 'h1, h2, h3, h4, h5, h6, a[id].block-id-anchor, span[id].block-id-anchor';
+
+/** The outline's entries, scanned out of the active tab's `.markdown-blocks`. */
+export function buildTocEntries(contentRoot: ParentNode): TocItem[] {
+	const result: TocItem[] = [];
+
+	const entries = contentRoot.querySelectorAll(ENTRY_SELECTOR) as NodeListOf<HTMLElement>;
+	for (const el of Array.from(entries)) {
+		if (el.classList.contains('block-id-anchor')) {
+			result.push({ id: el.id, text: el.getAttribute('data-label') || el.id, foldKey: '', level: 0, isBlock: true, line: sourceLineOf(el.dataset.sourcepos) });
+			continue;
+		}
+
+		// Everything the selector matches that is not a block anchor is a
+		// heading, which is the only other thing it asks for.
+		const h = el;
+		const text = headingText(h);
+		const anchor = h.querySelector('a.anchor') as HTMLElement | null;
+		const id = h.id || (anchor ? anchor.id : '');
+		if (id) {
+			result.push({ id, text, foldKey: foldKeyOf(h), level: parseInt(h.tagName[1], 10), isBlock: false, line: sourceLineOf(h.dataset.sourcepos) });
+		}
+	}
+
+	for (let i = 0; i < result.length; i++) {
+		const item = result[i];
+		if (item.isBlock) continue;
+		item.hasChildren = false;
+		
+		if (i + 1 < result.length) {
+			const next = result[i+1];
+			if (next.isBlock || next.level > item.level) {
+				item.hasChildren = true;
+			}
+		}
+	}
+	return result;
+}
+
+/**
+ * Decides whether a re-render replaces the items. The line is in it: an edit
+ * that only moves a heading changes nothing else about it, and without it the
+ * outline would keep answering with the old positions.
+ */
+export function tocFingerprint(result: readonly TocItem[]): string {
+	return result.map(i => `${i.id}-${i.text}-${i.level}-${i.line}`).join('|');
+}
diff --git a/src/lib/utils/tocOverlay.ts b/src/lib/utils/tocOverlay.ts
index 7c2c9ae8..a4bb18a3 100644
--- a/src/lib/utils/tocOverlay.ts
+++ b/src/lib/utils/tocOverlay.ts
@@ -72,3 +72,29 @@ export function isTocOverhanging(input: TocOverhangInput): boolean {
 	const gutter = (input.viewerWidth - input.previewContentWidth) / 2;
 	return input.tocWidth > Math.max(MIN_GUTTER, gutter);
 }
+
+/**
+ * A floating outline gets out of the way (an outside click, a picked entry)
+ * only while it IS covering something: pinned it is a sidebar, and one sitting
+ * in the margin is not in anybody's way.
+ *
+ * `isOverhanging` is a getter, read only when not pinned: an effect that calls
+ * this must not re-run on a layout change while the outline is pinned.
+ */
+export function tocAutoCollapses(isOverhanging: () => boolean, isPinned: boolean): boolean {
+	return !isPinned && isOverhanging();
+}
+
+/**
+ * Does this pointerdown dismiss the floating outline? The toggle button owns
+ * its own click; closing here as well would open and shut the panel in one
+ * gesture. Anything inside the panel, the resize handle included, is use.
+ */
+export function dismissesToc(
+	target: Node | null,
+	panel: Node | null | undefined,
+	toggle: Node | null | undefined,
+): boolean {
+	if (!target) return false;
+	return !(panel?.contains(target) || toggle?.contains(target));
+}
diff --git a/src/lib/utils/viewerCommands.ts b/src/lib/utils/viewerCommands.ts
new file mode 100644
index 00000000..76f2bee6
--- /dev/null
+++ b/src/lib/utils/viewerCommands.ts
@@ -0,0 +1,88 @@
+import { adjustPreviewMaxWidth } from './previewWidth.js';
+import type { ViewerCommand } from './viewerKeymap.js';
+
+/**
+ * What the viewer hands the command table: the settings and tabs it mutates,
+ * and the component's own functions for everything else. Read at run time, so
+ * `tabManager.activeTabId` is the active tab when the key is pressed.
+ */
+export type ViewerCommandHost = {
+	settings: {
+		previewFullWidth: boolean;
+		previewMaxWidth: number;
+		showTabs: boolean;
+		toggleZenMode(): void;
+		zoomIn(): void;
+		zoomOut(): void;
+		resetZoom(): void;
+	};
+	tabManager: { readonly activeTabId: string | null; cycleTab(direction: 'next' | 'prev'): void };
+	reloadFromDisk(): unknown;
+	carryActiveTabToNextWindow(): unknown;
+	closeFile(): unknown;
+	handleNewFile(): unknown;
+	openNewWindow(): Promise<unknown>;
+	selectFile(): unknown;
+	appExit(): unknown;
+	toggleSplitView(tabId: string): unknown;
+	toggleLiveMode(): unknown;
+	toggleEditView(): unknown;
+	saveContentAs(): unknown;
+	saveActiveTab(): unknown;
+	handleUndoCloseTab(): unknown;
+	navigateFileHistory(direction: 'back' | 'forward'): unknown;
+	openSettings(): void;
+	toggleHome(): void;
+	exportAsPdf(): unknown;
+	openFileLocation(): unknown;
+	triggerFindAction(): void;
+};
+
+/**
+ * `viewerKeymap.ts` decides which command a keystroke means. This maps each
+ * command to what runs it. A `Record` over the union, so a command with no
+ * entry does not compile.
+ */
+export function viewerCommandTable(host: ViewerCommandHost): Record<ViewerCommand, () => void> {
+	const { settings, tabManager } = host;
+	const previewWidth = (delta: number) => () => {
+		settings.previewFullWidth = false;
+		settings.previewMaxWidth = adjustPreviewMaxWidth(settings.previewMaxWidth, delta);
+	};
+	return {
+		'preview-width-narrower': previewWidth(-40),
+		'preview-width-wider': previewWidth(40),
+		'reload-from-disk': () => void host.reloadFromDisk(),
+		'move-tab-to-next-window': () => void host.carryActiveTabToNextWindow(),
+		'close-file': () => void host.closeFile(),
+		'new-file': () => void host.handleNewFile(),
+		'new-window': () => void host.openNewWindow().catch(console.error),
+		'open-file': () => void host.selectFile(),
+		'app-exit': () => void host.appExit(),
+		'toggle-split-view': () => {
+			if (tabManager.activeTabId) host.toggleSplitView(tabManager.activeTabId);
+		},
+		'toggle-live-mode': () => void host.toggleLiveMode(),
+		'toggle-zen-mode': () => settings.toggleZenMode(),
+		'toggle-tabs': () => {
+			settings.showTabs = !settings.showTabs;
+		},
+		'toggle-edit-view': () => void host.toggleEditView(),
+		'save-as': () => void host.saveContentAs(),
+		// Save from any mode; see `saveActiveTab`.
+		save: () => void host.saveActiveTab(),
+		'undo-close-tab': () => void host.handleUndoCloseTab(),
+		'next-tab': () => tabManager.cycleTab('next'),
+		'previous-tab': () => tabManager.cycleTab('prev'),
+		'history-back': () => void host.navigateFileHistory('back'),
+		'history-forward': () => void host.navigateFileHistory('forward'),
+		'zoom-in': () => settings.zoomIn(),
+		'zoom-out': () => settings.zoomOut(),
+		'zoom-reset': () => settings.resetZoom(),
+		'open-settings': () => host.openSettings(),
+		'toggle-home': () => host.toggleHome(),
+		'export-pdf': () => void host.exportAsPdf(),
+		'reveal-file': () => void host.openFileLocation(),
+		find: () => host.triggerFindAction(),
+	};
+}
diff --git a/src/lib/utils/viewerContextMenu.ts b/src/lib/utils/viewerContextMenu.ts
new file mode 100644
index 00000000..e3e69610
--- /dev/null
+++ b/src/lib/utils/viewerContextMenu.ts
@@ -0,0 +1,128 @@
+import type { ContextMenuItem } from '../components/ContextMenu.svelte';
+import { t, type LanguageCode } from './i18n.js';
+import { normalizeAssetPath } from './exportHtml.js';
+import { formatChord, modifierFor } from './shortcuts.js';
+
+/**
+ * Which menu a right-click opens: none while a dialog is up or outside the app
+ * view, the editor's own, the webview's native one for a text field, or the
+ * document menu.
+ */
+export function contextMenuFor(target: Element, state: { modalOpen: boolean; inApp: boolean }): 'none' | 'editor' | 'native' | 'document' {
+	if (state.modalOpen) return 'none';
+	if (!state.inApp) return 'none';
+	// The editor gets its own menu, and this branch has to come first:
+	// Monaco takes input through a hidden `<textarea>`, so the text-field
+	// carve-out below would otherwise claim every right-click in it.
+	if (target.closest('.editor-container')) return 'editor';
+	// Text fields keep the webview's own editing menu (Cut/Copy/Paste);
+	// the document menu is about the rendered preview and has no edit
+	// items, so swallowing the native one leaves no way to paste.
+	if (target.closest('input, textarea, [contenteditable="true"]')) return 'native';
+	return 'document';
+}
+
+/** What the editor menu calls on the editor pane: the functions its shortcuts run. */
+export interface EditorMenuPane {
+	undo(): void;
+	redo(): void;
+	cutToClipboard(): void;
+	copyToClipboard(): void;
+	pasteFromClipboard(): void;
+	selectAll(): void;
+	runEditorAction(actionId: string): void;
+}
+
+/**
+ * The editor pane's context menu. `pane` is read when an item is clicked,
+ * not when the menu is drawn.
+ */
+export function editorContextMenuItems(
+	pane: () => EditorMenuPane | null | undefined,
+	language: LanguageCode,
+	osType: string,
+): ContextMenuItem[] {
+	// Chords only for the items people learn the shortcut from. Undo is
+	// listed because Windows has no menu bar to find it in (#997).
+	const modifier = modifierFor(osType);
+	const chord = (c: string) => formatChord(c, modifier);
+	return [
+		{ label: t('menu.undo', language), shortcut: chord('Mod+Z'), onClick: () => pane()?.undo() },
+		{
+			label: t('menu.redo', language),
+			shortcut: chord(modifier === 'Cmd' ? 'Mod+Shift+Z' : 'Mod+Y'),
+			onClick: () => pane()?.redo(),
+		},
+		{ separator: true },
+		{ label: t('menu.cut', language), onClick: () => pane()?.cutToClipboard() },
+		{ label: t('menu.copy', language), onClick: () => pane()?.copyToClipboard() },
+		{ label: t('menu.paste', language), onClick: () => pane()?.pasteFromClipboard() },
+		{ label: t('menu.selectAll', language), onClick: () => pane()?.selectAll() },
+		{ separator: true },
+		// Monaco's other items need a language provider Markdown lacks.
+		{
+			label: t('menu.commandPalette', language),
+			shortcut: 'F1',
+			onClick: () => pane()?.runEditorAction('editor.action.quickCommand'),
+		},
+		{
+			label: t('menu.changeAllOccurrences', language),
+			shortcut: chord('Mod+F2'),
+			onClick: () => pane()?.runEditorAction('editor.action.changeAll'),
+		},
+	];
+}
+
+export interface SaveImageDeps {
+	save(options: { defaultPath: string; filters: { name: string; extensions: string[] }[] }): Promise<string | null>;
+	copyFile(src: string, dest: string): Promise<unknown>;
+	toast(message: string, type?: 'info' | 'error'): void;
+	/** Read when the toast is shown, after the Save dialog closes. */
+	language(): LanguageCode;
+}
+
+/**
+ * `src` is an asset URL, a remote URL or a `data:` URL.
+ * `normalizeAssetPath` recognises both asset URL forms (Windows
+ * `http://asset.localhost/…`, others `asset://localhost/…`) and rejects
+ * lookalike hosts (#363).
+ */
+export async function saveImageAs(src: string, deps: SaveImageDeps): Promise<void> {
+	const realPath = normalizeAssetPath(src) ?? '';
+
+	if (!realPath) {
+		// The webview cannot fetch the bytes of a remote image at all: the
+		// app's CSP is `connect-src 'self'`, so a cross-origin `fetch` is
+		// refused before it leaves the page. (`img-src ... https:` is a
+		// different directive; it only governs what an `<img>` may
+		// display.) The download has to happen in Rust, and there is no
+		// command for it yet, so say that rather than reporting a network
+		// failure that never happened.
+		deps.toast(t('toast.remoteImageNotSupported', deps.language()), 'error');
+		return;
+	}
+
+	const ext = realPath.split('.').pop() || 'png';
+	const dest = await deps.save({
+		defaultPath: `image.${ext}`,
+		filters: [{ name: 'Images', extensions: ['png', 'jpg', 'jpeg', 'webp', 'gif', 'svg'] }]
+	});
+	if (dest) {
+		try {
+			await deps.copyFile(realPath, dest);
+			deps.toast(t('toast.imageSavedSuccessfully', deps.language()));
+		} catch (e) {
+			deps.toast(`${t('toast.failedToSaveImage', deps.language())}: ${e}`, 'error');
+		}
+	}
+}
+
+/** Save Image As, for a right-click on a local image. Only a local file can be saved: see `saveImageAs`. */
+export function imageMenuItems(target: Element, language: LanguageCode, saveImage: (src: string) => void): ContextMenuItem[] {
+	const img = target.closest('img');
+	if (!img || !normalizeAssetPath(img.src)) return [];
+	return [
+		{ label: t('menu.saveImageAs', language), onClick: () => saveImage(img.src) },
+		{ separator: true }
+	];
+}
diff --git a/src/lib/utils/viewerKeymap.ts b/src/lib/utils/viewerKeymap.ts
index 7bb03001..6bf190f3 100644
--- a/src/lib/utils/viewerKeymap.ts
+++ b/src/lib/utils/viewerKeymap.ts
@@ -322,3 +322,20 @@ export function viewerCommandFor(e: KeyStroke, context: KeyContext): ViewerComma
 
 	return null;
 }
+
+/**
+ * The viewer's keydown handler: a keystroke that means a command is prevented
+ * before the command runs, in every mode. Reading mode would otherwise surface
+ * the webview's own Save Page dialog on Ctrl+S. A chord that means nothing is
+ * left alone.
+ */
+export function dispatchViewerKey(
+	e: KeyStroke & { preventDefault: () => void },
+	context: KeyContext,
+	run: (command: ViewerCommand) => void,
+): void {
+	const command = viewerCommandFor(e, context);
+	if (!command) return;
+	e.preventDefault();
+	run(command);
+}
diff --git a/src/lib/utils/vimAttach.ts b/src/lib/utils/vimAttach.ts
new file mode 100644
index 00000000..8f16990b
--- /dev/null
+++ b/src/lib/utils/vimAttach.ts
@@ -0,0 +1,27 @@
+import { installVimClipboardRegisters } from './vimClipboardRegisters.js';
+import { installVimScrollCommands } from './vimScrollCommands.js';
+
+/**
+ * Attach Vim mode from the `monaco-vim` module just imported, or return null
+ * when the effect that asked for it was `disposed()` meanwhile.
+ *
+ * The commands go on before the adapter is attached, and unconditionally: they
+ * patch monaco-vim's own module-level command tables, which outlive this
+ * effect, and they are idempotent. See vimScrollCommands.ts for what 0.4.4
+ * does to `zz`, `zt`, `zb`, `z.`, `z-` and `z<CR>` (#104), and
+ * vimClipboardRegisters.ts for `"+` and `"*` (#775).
+ */
+export function attachVimMode<Editor, Node, Adapter>(
+	{ initVimMode, VimMode }: { initVimMode: (editor: Editor, statusNode: Node) => Adapter; VimMode: unknown },
+	editor: Editor,
+	statusNode: Node,
+	invoke: (command: string, args: { text: string }) => Promise<unknown>,
+	disposed: () => boolean,
+): Adapter | null {
+	installVimScrollCommands(VimMode);
+	installVimClipboardRegisters(VimMode, (text) => {
+		invoke('clipboard_write_text', { text }).catch(console.error);
+	});
+	if (disposed()) return null;
+	return initVimMode(editor, statusNode);
+}