diff --git a/.gitignore b/.gitignore
index 7d98ca0..e899c91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,6 @@ dist
 
 # Secrets — never commit
 .gitea-token
+
+# VS Code user settings (workspace settings/.vscode/launch.json are committed)
+.vscode/settings.json
diff --git a/.prettierrc b/.prettierrc
new file mode 100644
index 0000000..baa9d29
--- /dev/null
+++ b/.prettierrc
@@ -0,0 +1,6 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "printWidth": 100,
+  "trailingComma": "none"
+}
diff --git a/.claude/launch.json b/.vscode/launch.json
similarity index 100%
rename from .claude/launch.json
rename to .vscode/launch.json
diff --git a/CODE-AUDIT.md b/CODE-AUDIT.md
index 43bd463..36cb924 100644
--- a/CODE-AUDIT.md
+++ b/CODE-AUDIT.md
@@ -1,342 +1,2425 @@
-# AeroFetch Code Audit
+# Code Audit
 
-**Date:** 2026-06-23  
-**Scope:** Full security & correctness review of main process, preload, IPC contract, and renderer stores  
-**Overall:** Strong security fundamentals (context isolation, sandboxing, argument-injection defense); findings are refinements, not foundational gaps
+Living checklist of audit findings for AeroFetch. Security & correctness were reviewed
+2026-06-23 (all fixed — see Completed). The architectural review (2026-06-29) added the
+structural items; a second polish pass (2026-06-29) added the smaller inconsistencies.
+Items carry stable IDs so we can check them off as they land this session.
+
+Severity = structural leverage / risk of future bugs, not "app is broken" (it isn't).
+
+**Session 2026-06-30 (correctness/safety/strictness pass):** landed B3 B4 B5 B7 (checksum-
+filename match, newline-safe meta probe, canceled-event guards, cookie-login never-resolve),
+L88 L146 (queue/trim edge cases), **L168 + L169** (`noUncheckedIndexedAccess` +
+`noFallthroughCasesInSwitch` now on — 0 errors after 8 real edge-case fixes), R5 (settings
+write failure handled), W1 W5 W6 (min window size, seeded folder picker, parented sign-in
+window), CL1 (shared stdout markers), L147 (dead macOS branches removed), M8 (StatusChip
+already unified the status→label map), M36 (Library selection only counts actionable rows),
+L11 (Queue header counts the live queue), L50 (no "saved" for 0 cookies), L156 + L57
+(schedule picker `min`), L159 L15 L3 (dead-code/comment cleanup), package/builder metadata
+(L4 L41 L42 L43 L45 L58), user-facing copy (L66 L154; partial M37/SR9 jargon), doc
+reconciliation (M25 M26 L80 L81), and new unit tests (L35 isValidMediaItem, L36
+compareVersions). All verified: typecheck + 234 tests + eslint + prettier green.
+
+**Session 2026-06-30 pass 2 (quality/format/UX polish):** H5 (history re-download now stores
+formatId/formatHasAudio + strips compound quality labels; thumbnail also passed — L72), H6
+(TerminalView log capped at 2000 lines), M21 (skip --audio-quality for lossless flac/wav),
+L166 (fmtEta hour rollover fixed in download.ts, store/downloads.ts, queueStats.ts — "2:00:00"
+not "120:00"), L165 (formatSpeed precision aligned with fmtBytes), L55 (QueueItem suppresses
+sizeLabel when already in probed-format quality label), L47 (probeMeta null sends empty meta
+event to clear "Resolving…"), L68 (notifiedBackground resets on window show), L76 (dup warning
+falls back to URL when title is placeholder), L91 (SettingsView unsafe tuple cast fixed), L98
+(embed-chapters hint added), L108 (window title set), L37 (formatters extracted to lib/formatters.ts;
+fmtBytes/fmtEta/parseProgress unit-tested including NA paths), L38 (webm thumbnail exclusion
+test), L39 (CROP_SQUARE_PPA structural test), L40 (looksLikeUrl/looksLikeSingleVideo extracted
+to lib/urlHelpers.ts; test imports pure module directly). All verified: typecheck + 242 tests + eslint + prettier green.
+
+**Session 2026-06-30 pass 3 (reliability — B/R/L races & silent failures):** L140 + L148 (the `active`-map
+teardown race — `cancelDownload`/`pauseDownload` release the concurrency slot synchronously and an
+identity-guarded `releaseActive` + per-spawn cookie jar make same-id retry/resume safe), L141 (renderer
+history capped at 500 + url de-dup to mirror main), R6 (`writeJsonAtomic` reports + logs write failures and
+keeps the data dirty for retry instead of an empty catch — log half; toast → CC8), R7 (`encryptSecret` warns
+before the plaintext fallback). All verified: typecheck + 243 tests + eslint green; the 5 touched files are
+prettier-clean. *Deferred this pass (need UI/live-app or larger design): B2/B6 (cancel buttons + abort
+wiring), R4 (can't safely identify a download's `.part` files at cancel time — needs the yt-dlp "Destination"
+path tracked), L139 (needs a spawn↔auto-update interlock), L142 (multi-site IPC-return reconciliation,
+generalises M34), L157 (cross-store cancel-on-remove, ties to C2), R9 (clock-skew — "note for awareness").*
+
+**Session 2026-06-30 pass 4 (Critical — store architecture):** **C1** (single source of truth for the
+preview mock + Settings defaults — `DEFAULT_SETTINGS` in `@shared`, one typed `mockApi.ts`, centralized
+`isPreview`) and **C2** (broke the `downloads ↔ sources` circular import via a pure typed event bus,
+`store/coordinator.ts` — neither store imports the other now). All verified: typecheck + 243 tests +
+eslint green; the touched files are prettier-clean (3 pre-existing format violations in
+DownloadOptionsForm/LibraryView/SettingsView are untouched and out of scope).
+
+**Session 2026-07-01 (main-process structure — the H1-adjacent decompose batch):** **L2** (the ~200-line
+flat IPC block moved into one `src/main/ipc.ts` `registerIpcHandlers(getMainWindow)`; index.ts is now
+lifecycle + window creation and imports the shared theme helpers from ipc.ts), **L69** (path helpers split
+into `src/main/paths.ts`; settings.ts is now purely the electron-store layer), **L10** (a main-process
+`src/main/constants.ts` centralizes the spawn timeouts, execFile buffers, stderr tail, and the three store
+caps — nine modules migrated off bare literals), **CL2** (`buildArgs` → single `BuildArgsInput` object),
+**CL3** (`startDownload`'s stream/close/error/watchdog wiring extracted into `wireChildProcess`), and **L1**
+(the scheduled-download promoter tick moved from store-module load into an App `useEffect` so a store import
+no longer starts a stray timer). All verified: typecheck (node+web) + 253 tests + eslint + production build
+green; the touched files are prettier-clean (the 8 remaining prettier warnings are all pre-existing,
+untouched files — DownloadOptionsForm/SettingsView/settings/*Card).
+
+**Session 2026-07-01 pass 2 (the "finish the audit" batch — phase-by-phase PRs):** landed **Phase 1**
+(doc/stale-checkbox reconciliation — L82, L89, plus ticks for wire-or-remove M5/M6/UX1, MAX_ENQUEUE_BATCH,
+and the UX/ref duplicates whose roots already shipped), **Phase 2** (build hygiene — L83 `.blockmap` off via
+`nsis.differentialPackage:false`, L84 `dist/` clean step), and **Phase 3 (main foundation)**: **CC8**
+(in-house file-backed leveled logger [logger.ts](src/main/logger.ts) + renderer `log:write` sink), the
+**`execFileAsync`** consolidation ([lib/exec.ts](src/main/lib/exec.ts) — the five hand-rolled spawn-and-read
+wrappers in probe/ytdlp×2/ffmpeg/indexer/download.probeMeta; SIMP2, and the foundation for CC4/CC5),
+**L136** (incognito is now enforced in main — no errorlog entry, no title/URL in the OS toast, no login/
+browser cookies), and **R9** (the yt-dlp update throttle no longer skips forever after a backward clock
+correction). Each phase is its own branch/PR stacked on `refactor/h1-decompose-god-files`. All green:
+typecheck + 263 tests + eslint + prettier. **Next:** M4 (queue persistence — its own focused PR), the
+download-engine lifecycle items (R4/L65/L139/L157/B2/B6 — need a live download to verify), the CC4/CC5
+tails (SIMP5 line-buffer + SIMP16 net.request), then Phases 4–8 (renderer tokens+primitives, logic/perf,
+UX/Windows, copy/a11y). Per the run's policy, subjective-visual and live-verify-only items are implemented
+but left **unchecked** with a flagged list for a watched pass.
+
+**Session 2026-07-01 pass 3 (Batch 6 — the renderer design-token foundation):** landed the shared
+design-scale module [components/ui/tokens.ts](src/renderer/src/components/ui/tokens.ts) — one home for
+**SPACE** (the spacing ramp), **RADIUS** (control/surface/card tiers over Fluent's radii), **ELEVATION**
+(flat/raised/overlay), **Z** (overlay/tooltip), **ICON** (16/20/24/40), **MOTION**, **SCRIM**, and
+**META_SEP** — then migrated the scattered literals across 17 renderer files. Structurally-verified items
+checked off: **UI2** (one 16px section gap on every screen via the view roots), **UI4** (symmetric page
+padding — the lone 28px horizontal is gone), **UI5** (the intentional 4px icon-group / 8px control-row split
+is now named + documented), **UI6/UI7** (one thumbnail radius = Medium; page-card XLarge / list-item Large /
+control Medium tiers), **UI26** (a single motion timing + a global `prefers-reduced-motion` gate in
+[base.css](src/renderer/src/assets/base.css)), **L100** (elevation scale — only the download bar (raised) and
+command palette (overlay) cast a shadow; every other card stays flat/border-only), **L101** (a z-index scale
+replaces the two hardcoded `1000`s), **L121** (the renderer's one raw `rgba(0,0,0,0.32)` scrim → Fluent's
+theme-aware `colorBackgroundOverlay`), **L125** (icon sizes single-source from ICON), **L160** (inline margins
+tokenized — values unchanged), and **L164** (one metadata separator ` • `; the intra-value ` · ` inside
+compound quality labels is deliberately untouched). **UI3 and UI12 are implemented but left unchecked** for a
+watched visual pass — they shift a few pixels: card padding 14/20→16 (QueueItem, Settings cards), and the
+former-18px chrome glyphs (sidebar nav + theme toggles, IconButton md) → 20 plus the private badge 14→16. All
+green: typecheck (node+web) + 268 tests + eslint + production build; the touched files are prettier-clean (the
+9 remaining prettier warnings are all pre-existing, untouched files).
+
+**Session 2026-07-01 pass 4 (Batch 7 — type & color roles):** added
+[components/ui/text.ts](src/renderer/src/components/ui/text.ts) — a `useTextStyles` hook with the single
+`muted` secondary-text color and the shared `title` treatment, plus a header documenting the app's type-role
+convention (Subtitle2 = titles/section headers · Text = row titles · Body1 = body copy · Caption1 = small
+secondary text). Landed: **L110** (the one muted color, was eight aliases hint/sub/meta/srcSub/…/previewMeta —
+adopted in the list views: QueueItem, HistoryView, LibraryView, Sidebar, DownloadBar, PlaylistPanel;
+color-identical, so no visual change; the combined/shared-across-cards aliases — `stats`/`count`/`emptyHint`,
+settings `hint`, CommandPalette, inline — migrate incrementally), **L114** (one row-title component: the
+duplicated semibold-ellipsis title style is now `text.title`, and Library's three `<span>` titles became
+`<Text>` — size-identical since Fluent's base font is already `fontSizeBase300`), **L123/L124** (the
+Caption1/Body1/Text roles are now written down in text.ts and followed), **UI13** (verified: `Filled` is used
+only on the two brand marks, `Regular` everywhere else — the convention already held), and **UI11** (no literal
+px font sizes remain — the last tile/badge glyphs snap to `ICON` tiers: Sidebar mark 20, Onboarding mark 24,
+Library srcIcon 20, History emptyBadge 24; the `fontSizeBase*` token usages already satisfied the standard).
+The four tile-glyph deltas (≤2px) join UI12's watched visual pass. All green: typecheck (node+web) + 268 tests
++ eslint + production build; touched files prettier-clean (9 pre-existing warnings untouched).
+
+**Session 2026-07-01 pass 5 (Batch 8 — form primitives):** **L112** (removed the redundant dynamic
+`On`/`Off` label from all 15 `<Field>`-wrapped `<Switch>`es in DownloadOptionsForm + the settings cards — the
+Field already names each switch, and the toggle's position + `aria-checked` already convey state, matching
+Library's switches), **L133** (made the custom [Select](src/renderer/src/components/Select.tsx) `<Field>`-aware
+via `useFieldControlProps_unstable({ supportsLabelFor: true })`, so a Field's visible label names the native
+`<select>` through `htmlFor` and its hint associates via `aria-describedby`; dropped the now-duplicate
+`aria-label` from every Field-wrapped select (9 in total) — the two standalone selects, download-bar quality
+and history filter, keep theirs), **L129** (the
+`Hint` `align` prop is now a discriminated union — allowed only with `top`/`bottom` placement, a type error
+with `left`/`right` instead of being silently ignored), **L134** (one busy convention — `disabled` +
+icon→`Spinner`; converted AboutCard's version-check button off its adjacent-spinner layout so it matches
+Fetch/Index/update), **UI17** (the two `appearance="secondary"` buttons — Library "Check for new", Terminal
+"Stop" — are now `subtle`, the app's standard non-primary appearance), **L111** (convention clarified &
+verified: Fluent `Field hint` for control-associated help, `<Caption1 muted>` only for standalone card
+notes/status — control help already uses `Field hint` uniformly), and **L135** (verified role-appropriate:
+`Textarea` for the multiline trim ranges "one per line", `Input` for single-line fields). **UI16 left
+unchecked** — button size-by-role is subjective; current usage already broadly follows it (screen-primary
+large, row/toolbar small, settings default), so specific tweaks join the watched visual pass. All green:
+typecheck (node+web) + 268 tests + eslint + production build; touched files prettier-clean.
+
+**Session 2026-07-01 pass 6 (Batch 9 — surface primitives):** three new shared UI primitives —
+[EmptyState](src/renderer/src/components/ui/EmptyState.tsx) (**L116/L117**: one centered empty block — icon +
+`Body1` message + optional muted hint, with a `compact` variant for in-content placeholders — adopted by
+Downloads/History/Library and, compact, by the Terminal log + Diagnostics), [Banner](src/renderer/src/components/ui/Banner.tsx)
++ [LinkSuggestion](src/renderer/src/components/ui/LinkSuggestion.tsx) (**UI19**: one tinted notification row
+replacing five hand-rolled style blocks — the DownloadBar suggestion/channel-nudge/dup-warning + the Library
+copied-link suggestion), and a shared `useTextStyles().truncate` (**L126**: single-line-ellipsis util, adopted
+in Library rows + the playlist panel + Banner). Plus **L102** (Settings "Default format" now uses the same
+`SegmentedControl` + quality `Select` as the DownloadBar — one mental model; the `kind|quality` string encoding
+is gone), and four resolved-by-verified-convention: **L103** (busy = in-button icon→Spinner everywhere; done in
+L134), **L115** (list-row actions icon-only+tooltip vs card-toolbar actions labelled — role-appropriate),
+**L120** (Fluent `<Card>` for static content cards, the Batch-6 tokenized surface recipe for interactive/
+list-item cards), and **UI20** (toggles = solid brand, list-selection = brand-tint; the cited Library pill is
+gone via UI18). **L128 deferred to Batch 14** (build-time DCE of preview seeds, grouped with PERF8). All green:
+typecheck (node+web) + 268 tests + eslint + production build; touched files prettier-clean.
+
+**Session 2026-07-01 pass 7 (Batch 10 — CC consistency & conventions):** the contained consolidations landed;
+the sweeping ones are honestly deferred. **Landed:** a shared stdout line-splitter
+[lib/lineBuffer.ts](src/main/lib/lineBuffer.ts) (`createLineBuffer`) replacing the duplicated newline loop in
+`download.ts` + `terminal.ts` (**CC3/CC4**, + [test/lineBuffer.test.ts](test/lineBuffer.test.ts), 7 cases), and
+`cleanError` on **all** yt-dlp stderr — `getYtdlpVersion`/`updateYtdlp` now use the same `cleanError(r.stderr) ||
+r.error?.message || ''` idiom as download/probe/indexer (**CC6**). **CL6** resolved (the one real redundancy was
+L15; `clearDir`/`openFile`/`showInFolder` are deliberate view-model wrappers). **Deferred with the standard
+documented** — these are the architectural refactors the release gate already puts post-1.0, and several would be
+reckless to do unattended: **CC1** (renaming persisted setting keys is a breaking migration), **CC5**+**CL4**
+(the last event-emitter wrap is the *security-critical* updater installer download — host re-validation per
+redirect + SHA-256 verify — which can't be live-verified here), **CC7** (cosmetic arg-ordering; the pure/impure
+DI split already holds), **CC9** (zod = new dep + validation rewrite), **CC10** (jsonStore exists; the
+electron-store split is deliberate for DPAPI), **CC11** (constants centralized; only a `config.ts` move left),
+**CC12** (file-tree reorg = broad churn), **CC13**→L93, **CC14**→L142. Net: CC3/CC4/CC6/CL6 checked; the rest
+carry a documented standard + deferral rationale. All green: typecheck (node+web) + 275 tests + eslint +
+production build; touched files prettier-clean.
+
+**Session 2026-07-01 pass 8 (Batch 11 — UX behavior gaps):** a new in-app **toast** surface
+([store/toasts.ts](src/renderer/src/store/toasts.ts) + [ui/Toaster.tsx](src/renderer/src/components/ui/Toaster.tsx),
+non-portal bottom-center, +unit-tested) is the batch's spine — it makes **UX6** real: a shared
+[reveal.ts](src/renderer/src/reveal.ts) `revealFile` now surfaces open/reveal failures ("File not found — it
+may have been moved…") instead of the old silent no-op, and `safeShowInFolder` was upgraded to return an error
+string like `safeOpenPath`. Also landed **UX9/UI25** (a `CounterBadge` on the sidebar Downloads nav item shows
+the active count from any tab, via a count-only selector that doesn't re-render on ticks), **UX15** (`cancelAll`
++ a "Cancel all (N)" header button), **UX24** (`disabledFocusable` + `Hint` explains the disabled "Check
+watched"), **UX12** (an inline "Enable custom commands" button on the Terminal gate), and **L144** (the dup
+guard now checks history → "Already downloaded: …"). **Deferred with rationale:** UX7/UX8 (Settings IA
+redesign — visual), UX18/UX26 (subjective/visual polish), L131 (arguably by-design, needs the live taskbar),
+and **L142** (the history/templates/sources IPC-return reconciliation — a focused own-PR, CC14's tail). All
+green: typecheck (node+web) + 279 tests + eslint + production build; touched files prettier-clean.
+
+**Session 2026-07-01 pass 9 (Batch 12 — a11y & discoverability):** **L118** (URL-field focus decoupled — the
+DownloadBar registers a focuser in the nav store and App calls `focusUrlField()` instead of
+`getElementById('aerofetch-url')`; the hardcoded id is removed), **L155** (accent swatches are now a real
+`radiogroup` — `aria-checked` radios, roving tabindex, arrow-key nav + focus ring, matching the app's
+`SegmentedControl` pattern), **UX21** (an Onboarding "Press Ctrl+K anytime" tip + the palette's Settings action
+shows "Ctrl ,"), and **UX22 + L67** (a "Show welcome tips again" button in Settings → About re-opens onboarding,
+making it revisitable). Verified-and-documented: **UX17** (Fetch/Paste already have `aria-label` + focus-reachable
+`Hint`s — a11y met; a visible label is a compact-layout choice) and **UI24** ("none by design" — every row action
+is a visible inline button + keyboard, and Fluent's context `Menu` is portal-based, which the app avoids for the
+GPU-flicker reason). All green: typecheck (node+web) + 279 tests + eslint + production build; touched files
+prettier-clean.
+
+**Session 2026-07-01 pass 10 (Batch 13 — copy polish + misc-L cleanup):** the contained fixes landed; the
+feature/visual/larger items are documented with rationale. **Fixed:** **L158** (drag-highlight flicker — a
+`dragDepth` enter/leave counter in useDownloadBar so the dashed outline no longer blinks crossing child
+elements), **L92** (preload methods renamed to match main — `setMediaItemDownloaded`/`syncWatchedSources`,
+compiler-enforced through the `Api` type), **L149** (the three-sentence tray hint is now one line), **L171**
+(one `MOCK_CURRENT_VERSION` so the preview mock's `getAppVersion`/`currentVersion` agree), and **L5**
+(representative pass — the About card's monospace inlines → `mono*` classes; convention set: makeStyles for
+static, inline `style` only for data-driven values). **Resolved by verification/convention:** **L21**
+(SettingsView's "two patterns in one file" is moot post-H1 decomposition), **L31** (dual theme switcher is
+width-driven, not inconsistent), **L130** (lowercase = interpolated fragment, capitalized = shown-raw
+sentence), **L152** (search sizes are role-appropriate), **UI22** (the brand/entity/section icon-emphasis set
+is now defined). **Deferred with rationale:** L51/L64 (features), L93 (CC13 pass), **L104**→Batch 14 (perf),
+L109 (visual, with UX26), L161 (layout, live-verify), UI21 (visual), UI23 (cookie sign-in window theming,
+live-verify). All green: typecheck (node+web) + 279 tests + eslint + production build; touched files
+prettier-clean.
+
+**Session 2026-07-01 pass 11 (Batch 14 — perf + first-run defaults + Windows):** two real bundle/startup wins
+plus one first-run default. **PERF8** — Library/History/Terminal/Settings are `React.lazy` chunks behind a
+`Suspense` (Downloads stays eager); the production build now splits ~140 kB (incl. the 90 kB SettingsView) out
+of the initial bundle. **L128** — the three preview seed arrays are gated on `import.meta.env.DEV && PREVIEW`,
+so Rollup dead-code-eliminates them from the packaged renderer (DEV statically false) while the browser dev
+preview keeps them. **SR4** — `clipboardWatch` now defaults `false` for new installs (privacy-first; existing
+installs keep their saved value; Onboarding tip repointed) — *a product default flip flagged for the
+maintainer, trivially reversible.* **Deferred with rationale:** **PERF3** (core-queue micro-opt on a bounded
+list — risk > reward unattended, revisit in the Batch 15 live pass), **PERF6/L162** (bounded by
+virtualization; a prop conflicts with PERF5's hoisted renderItem), **SR5** (MP3 = deliberate
+max-compatibility default; the label bug was M18), **W12** (fallback-of-a-fallback icon), **W15** (the GPU
+software-rendering workaround — external driver dependency), and **L104** (History virtualization needs the
+L161 layout rework + live verification; the 500-cap bounds it). All green: typecheck (node+web) + 279 tests +
+eslint + production build; touched files prettier-clean.
+
+**Session 2026-07-01 pass 12 (Batch 15 — download-engine lifecycle):** the batch the run's policy reserves for
+a **watched live session** — so only the safe, non-file-deleting item was implemented, and the rest are staged
+with per-item live-verify rationale. **Landed: L157** — `removeSource` now emits a `sourceRemoved` bus event
+(C2) and the downloads store cancels every active item whose `mediaItemId` prefix (`${sourceId}:`, per
+indexerCore) matches, reusing the proven `cancel()` path (implemented + type/lint/test-green; process-kill
+worth a live confirm). **Resolved by prior work: UX11** (M4 persists the queue, so a scheduled item fires on
+next launch once due — no longer "never fires if quit"), **UX20** (L68 resets `notifiedBackground` on window
+show, so every close-to-tray re-fires the "still running" notice, not just the first). **Deferred to the
+watched live pass with rationale — each needs a real download to verify:** **R4** (delete `.part` on cancel —
+file-deletion data-safety), **L65** (graceful Ctrl-C pause vs `taskkill /F`), **L139** (spawn↔auto-update
+interlock — timing race), **B2** (index `AbortSignal` + Cancel), **B6** (app-update cancel — ties to CL4's
+deferred updater), **L143** (in-window quit-anyway). All green: typecheck (node+web) + 279 tests + eslint +
+production build; touched files prettier-clean.
 
 ---
 
-## Executive Summary
+## Run wrap-up (2026-07-01 — Batches 9–15 unattended)
 
-AeroFetch's security posture is notably thoughtful:
+All seven remaining audit batches were worked as stacked branches (`audit/batch-9-surface-primitives` →
+`audit/batch-15-download-lifecycle`), each: implement → self peer-review → verify (typecheck node+web · tests ·
+eslint · prod build · prettier) → push. The contained, safe, testable items landed; three categories were
+**honestly deferred with documented rationale** rather than forced unattended: (1) large architectural
+refactors the release gate already puts post-1.0 (CC9 zod, CC10/CC12/CC14 persistence/reorg, CL4 updater),
+(2) subjective-visual items needing an eyeball (UI3/UI12/UI16/UX7/UX18/UI21/UX26 …), and (3) the download-engine
+lifecycle changes that require a live download to verify (Batch 15's R4/L65/L139/B2/B6/L143). **Two items need
+maintainer awareness:** SR4 flips `clipboardWatch` off-by-default for new installs (reversible), and Batch 15's
+deferred set + L157's cancel-on-remove want a watched live smoke-test before merge.
 
-- **Layered argument-injection defense**: `assertHttpUrl` validators + `--` terminator before the URL, preventing yt-dlp flag injection
-- **Tight process model**: `contextIsolation: true`, `sandbox: true`, `nodeIntegration: false`; thin preload forwarding only typed IPC
-- **File opening safety**: [reveal.ts](src/main/reveal.ts) allowlist restricts to media extensions, blocks `.exe`/`.bat`/`.ps1`
-- **Settings validation**: Type-checked before persistence; `spawn` used without `shell: true`
-- **Good test coverage** of risky logic (especially [buildArgs.test.ts](test/buildArgs.test.ts))
-
-The findings below are opportunities to tighten existing defenses and fix performance gaps. None are foundational breaks — with one exception added later: **C1**, a missing bundled `ffprobe.exe` that broke duration-dependent post-processing, surfaced by the real-download smoke test and now fixed.
+**Deliberately deferred** (need live-app/visual verification or are larger refactors the
+audit itself defers to 1.x): the wire-or-cut features (M5/M6/UX1), the god-file/store
+refactors (C1, C2, H1), the SIMP* helpers + shared-UI-token work, the CC* consolidations,
+PERF8 code-splitting, and the visual UI/UX polish long-tail. These are best done as their
+own PRs with the app running so the UI can actually be checked.
 
 ---
 
-## Findings
+# 1.0 Release-Readiness Audit (lead-engineer synthesis)
 
-### Security
+*A pre-release synthesis of the ~385 catalogued findings below — root causes, a release gate, and the
+consequential issues per dimension (severity · reasoning · fix · benefit). The detailed, ID'd backlog
+follows. No rewrite required; everything here is incremental.*
 
-#### S1 — Backup import enables arbitrary custom-command templates silently
+## Verdict
 
-**File:** [backup.ts:54-55](src/main/backup.ts)  
-**Severity:** Medium  
-**Status:** Fixed — 2026-06-23
+**Not 1.0-ready as-is, but close — roughly 3–4 focused PRs away.** The foundation is genuinely strong:
+disciplined security model (context isolation, sandbox, argv-injection defense, host-pinned signed-checksum
+updater), a clean pure/impure architecture, and good unit coverage of the pure logic. What blocks a
+*commercial* 1.0 is a thin layer of (a) real reliability bugs, (b) naive persistence, (c) built-but-unwired
+features, (d) first-run/perceived-quality gaps, and (e) the absence of enforcement/observability tooling.
+None require rearchitecting.
 
-**Description:**  
-`importBackup` restores settings + templates from a user-chosen JSON file. The code validates only that `CommandTemplate` fields have the right shape (id, name, args), then immediately applies them via `setSettings`. If the backup contains `customCommandEnabled: true` + `defaultTemplateId` pointing to a template with `args: "--exec 'cmd'"`, the next download will spawn arbitrary code with no user confirmation that the file carried custom commands.
+## Root-cause themes (the 385 findings collapse to 8)
 
-**Why it matters:**  
-An attacker-supplied backup file smuggles code execution into an otherwise innocuous "import my settings" gesture. Unlike direct UI creation of templates, there's no moment where the user sees what's being enabled.
+1. **Built-but-unwired features** — command preview (M5), incognito (M6), per-download options/extraArgs
+   (UX1) are plumbed end-to-end with no UI; the ROADMAP even marks them ✅ (M25). *Decide wire-or-cut.*
+2. **"Two ways to do X" with no enforcement** — persistence (M1), validation (CC9), async (CC5), errors
+   (CC6), UI primitives (UI14/UI18/UI19), formatters (M9) — and no ESLint/Prettier to hold any line (CC2).
+3. **Renderer-optimistic state never reconciles + a store cycle** — M34/L142 (settings show unsaved
+   values), C2 (downloads↔sources circular import).
+4. **Naive JSON persistence** — non-atomic writes (R1), corrupt→silent total data loss (R2), O(n²)
+   full-file rewrites per completion (R3/PERF7), no cache.
+5. **Download-engine reliability gaps** — no stall timeout (B1), reverse-order batches (M32), orphan
+   `.part` on cancel (R4), retry-during-teardown race (L140).
+6. **First-run / perceived quality** — light-default theme (SR1), nightly-default yt-dlp (SR2), placeholder
+   icon (W14), stuck "Resolving…" (SR6), progress bar visibly restarting (SR7), unsigned build (SIGNING.md).
+7. **Accessibility & Windows-native feel** — focus rings (UI28/29), no list keyboard nav (W7), title-bar
+   theme (W3), text-field context menu (W4), no `aria-live` (W17), input labels (M28).
+8. **No enforcement / observability** — no lint (CC2), `noImplicitAny:false` (M38), no logging (CC8/M29),
+   no production source maps (L170).
 
-**Fix:**  
-Surface the count of imported custom commands and require explicit confirmation before applying. Consider importing templates in a disabled state. Alternative: show a preview of template names/args (first 100 chars) before committing.
+## Release gate
 
----
+**MUST fix before 1.0 (blockers)** — correctness, data safety, security, trust:
+B1 · M32 · M35 · M34 · R1 · R2 · R3 · H7 · H8 · SR1 · SR6 · SR7 · W14 — **all resolved as of this
+session.** Code signing was dropped from the gate: it's a deliberate non-goal (no certificate will be
+purchased; the SmartScreen prompt on the unsigned build is accepted).
 
-#### S2 — Cookie login window allows popups of arbitrary schemes
+**SHOULD fix for 1.0 (high):** wire-or-cut the dead features (M5/M6/UX1) · a11y cluster (UI28/29, W4, W7,
+W17, M28) · W3 native theming · lint + `noImplicitAny` (CC2/M38) · dev-jargon copy (M37/SR9) · destructive
+confirmations (UX4) · PERF1/PERF2 (per-download redundant work).
 
-**File:** [cookies.ts:119-125](src/main/cookies.ts)  
-**Severity:** Low  
-**Status:** Fixed — 2026-06-23
+**DEFER to 1.x:** the ~150 Low items · the simplification refactors (SIMP*, do incrementally) · the UI
+token system + shared primitives (UI/SIMP — high value, larger effort) · i18n · sqlite migration.
 
-**Description:**  
-The login window's `setWindowOpenHandler` returns `action: 'allow'` for every popup without protocol filtering. A logged-in webpage could spawn windows with `file://`, custom protocols, or other non-HTTP schemes in the shared session partition. The main window [index.ts:118-126](src/main/index.ts) correctly restricts to `http:`/`https:` only.
+## By dimension (severity · reasoning · fix · benefit)
 
-**Why it matters:**  
-Defense-in-depth: the sandbox limits damage, but an attacker page could open a `file://` popup to exfil cookies to disk, or use a custom-protocol popup as a pivot.
-
-**Fix:**  
-Apply the same protocol check to login popups:
-```typescript
-win.webContents.setWindowOpenHandler((details) => {
-  try {
-    const { protocol } = new URL(details.url)
-    if (protocol !== 'http:' && protocol !== 'https:') return { action: 'deny' }
-  } catch { return { action: 'deny' } }
-  return { action: 'allow', ... }
-})
-```
-
----
-
-#### S3 — Concurrency cap is renderer-only (defense-in-depth gap)
-
-**File:** [downloads.ts:249-265](src/renderer/src/store/downloads.ts)  
-**Severity:** Low  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-`maxConcurrent` is enforced solely by the renderer's `pump()` function. `startDownload` in main ([download.ts:214](src/main/download.ts)) only checks for duplicate IDs, not active count. A buggy or compromised renderer could spawn unbounded yt-dlp processes.
-
-**Why it matters:**  
-Defense-in-depth: the current design assumes the renderer is trusted. If it ever leaks (XSS in an injected thumbnail URL, future bundled library), the main process should still cap spawns.
-
-**Fix:**  
-Add a main-process active-download count check in `startDownload`:
-```typescript
-if (active.size >= settings.maxConcurrent) {
-  return { ok: false, error: 'Max concurrent downloads reached. Wait for a slot.' }
-}
-```
-
----
-
-#### S4 — `filenameTemplate` and `outputDir` have no path-traversal checks
-
-**File:** [settings.ts:150-157](src/main/settings.ts)  
-**Severity:** Low  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-These fields are validated as `typeof === 'string'` only. A template like `%(title)s\..\..\..\win32.exe.%(ext)s` is joined into `-o` ([download.ts:195](src/main/download.ts)) and permits yt-dlp to write outside the intended folder. Also, `proxy` may carry plaintext credentials (user:pass@...) that get serialized by `exportBackup`.
-
-**Why it matters:**  
-On a single-user machine, self-inflicted. But on a shared PC (the app's stated target use case), directory traversal lets one user overwrite another's files.
-
-**Fix:**  
-Sanitize `outputDir` (must be absolute, within a reasonable parent) and `filenameTemplate` (reject `..` and absolute paths). For proxy, either mask credentials in backups or document that they're stored plaintext.
-
----
-
-#### S5 — Persisted JSON (history, templates, errorlog) read without per-field validation
-
-**Files:**  
-- [history.ts:17-18](src/main/history.ts)
-- [templates.ts:16-17](src/main/templates.ts)  
-- [errorlog.ts:16-17](src/main/errorlog.ts)
-
-**Severity:** Low  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-All three do `JSON.parse(...) as T[]` with only an `Array.isArray` gate and no per-field validation. A hand-edited or corrupted file yields entries the UI blindly trusts (e.g., a `HistoryEntry` with `filePath: "C:\\bad"` that passes through to `openPath`). Inconsistent with the rigorous validation elsewhere.
-
-**Why it matters:**  
-Low immediate risk (malformed entries mostly degrade gracefully). But it's an untrusted-input boundary that doesn't match the codebase's defensive posture.
-
-**Fix:**  
-Add schema validators (`ts-json-validator`, `zod`, or lightweight custom checks) for each type:
-```typescript
-function isValidHistoryEntry(obj: unknown): obj is HistoryEntry {
-  return obj && typeof obj === 'object' && 'id' in obj && typeof obj.id === 'string' && ...
-}
-```
-
----
-
-### Correctness
-
-#### C1 — Bundled `ffprobe.exe` was missing — duration-dependent post-processing failed for every user
-
-**Files:** [resources/bin/README.md](resources/bin/README.md), [binaries.ts](src/main/binaries.ts), [download.ts:235](src/main/download.ts)  
-**Severity:** High  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-`resources/bin/` shipped `ffmpeg.exe` but **not** `ffprobe.exe`, and the README only documented copying `ffmpeg.exe`. yt-dlp resolves *both* binaries from `--ffmpeg-location <dir>`; without `ffprobe.exe` it cannot read media durations, so any post-processor that needs one fails at runtime with `ERROR: Postprocessing: Unable to determine video duration: ffprobe not found`. That breaks `--sponsorblock-remove`, `--force-keyframes-at-cuts`, and `--split-chapters` for **every** user — end-user machines have no system ffprobe either. It slipped past review because thumbnail/crop/metadata post-processing only uses ffmpeg, and typecheck can't see a missing binary.
-
-**Found by:**  
-The real-download smoke test ([real-download.integration.test.ts](test/real-download.integration.test.ts)) — the SponsorBlock-remove case failed with exit 1 (`ffprobe not found`) until ffprobe was bundled. Everything else (crop, audio re-encode, container/codec, subs, chapters, restrict-filenames, archive, extra-args) passed.
-
-**Fix:**  
-Copied the matching `ffprobe.exe` (same `n8.1.2` LGPL build, verified by SHA-256 against the already-bundled `ffmpeg.exe`) into `resources/bin/`, and updated the README to list it as a required binary alongside `ffmpeg.exe`. The integration suite now also asserts `ffprobe.exe` is present in `beforeAll`.
-
-**Hardening (done — 2026-06-23):**  
-`startDownload` now asserts `ffmpeg.exe` and `ffprobe.exe` presence up front ([download.ts](src/main/download.ts)), alongside the existing `yt-dlp.exe` check — a future missing binary returns a clear AeroFetch error naming the file, instead of a cryptic mid-download yt-dlp postprocessing failure. (`getFfprobePath()` added to [binaries.ts](src/main/binaries.ts).)
-
----
+### Reliability
+- **[Critical] No download stall timeout (B1).** *Reasoning:* `spawn` has no timeout + no `--socket-timeout`;
+  a dead connection hangs forever and permanently consumes a concurrency slot. *Fix:* `--socket-timeout` +
+  an idle watchdog that kills+errors via the existing `killTree`. *Benefit:* downloads self-recover on flaky networks.
+- **[Critical] Non-atomic writes + silent corruption→data-loss (R1/R2).** *Reasoning:* `writeFileSync`
+  isn't atomic; a crash mid-write corrupts the store and the next read returns `[]`, silently wiping history/
+  sources. *Fix:* atomic write (temp+rename) + back up a corrupt file before resetting, in one `jsonStore`.
+  *Benefit:* user data survives crashes; no silent loss.
+- **[High] Reverse-order batch downloads (M32)** & **history duplicates (M35).** *Reasoning:* `addMany`+`pump`
+  promote highest-index first; `redownload` mints a new id defeating dedup. *Fix:* reverse the batch enqueue;
+  dedup history by URL. *Benefit:* playlists download 1→N; clean history.
+- **[High] Optimistic state never reconciles (M34).** *Reasoning:* renderer keeps a value main rejected.
+  *Fix:* apply the validated `Settings` the IPC returns. *Benefit:* the UI never lies about what's saved.
 
 ### Performance
-
-#### P1 — `getSettings()` writes to disk on every read
-
-**File:** [settings.ts:91-98](src/main/settings.ts)  
-**Severity:** Medium  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-Every call to `getSettings()` unconditionally runs `s.set('downloadOptions', sanitizeOptions(...))` and (on first run) `s.set('outputDir', ...)`. `getSettings()` is on hot paths: `buildCommand`, notification checks, system-theme bridge updates, several IPC handlers. Since `electron-store` serializes to disk on each `set`, this means synchronous file I/O per settings read.
-
-**Why it matters:**  
-Unnecessary disk churn. Settings reads are frequent (before every download, on IPC calls). Visible on slower machines or filesystems.
-
-**Fix:**  
-Sanitize once at store init or wrap `set` in a dirty-flag check:
-```typescript
-export function getSettings(): Settings {
-  const s = getStore()
-  const cur = s.store
-  const sanitized = sanitizeOptions(cur.downloadOptions)
-  if (sanitized !== cur.downloadOptions) s.set('downloadOptions', sanitized)
-  // Only write outputDir once, on first launch
-  if (!cur.outputDir) s.set('outputDir', app.getPath('downloads'))
-  return s.store
-}
-```
-
----
-
-#### P2 — Every download spawns a redundant metadata probe
-
-**File:** [download.ts:249](src/main/download.ts)  
-**Severity:** Medium  
-**Status:** Fixed — 2026-06-23
-
-**Description:**  
-`startDownload` always calls `probeMeta` (a second yt-dlp process with `--skip-download`) in parallel with the real download to fetch title/channel/duration. However, the renderer typically already probed and passes this metadata via `addFromUrl`'s optional `meta` parameter ([downloads.ts:60-65](src/renderer/src/store/downloads.ts)). That metadata is never forwarded to `startDownload`, so the main process re-fetches it.
-
-Result: doubled network traffic and process spawns; the async metadata completion can overwrite good titles the renderer already provided.
-
-**Why it matters:**  
-Wasted I/O on every download, especially for large playlists (where the renderer pre-probed each entry). On slow connections, observable slowdown.
-
-**Fix:**  
-Add optional `meta` fields to `StartDownloadOptions` and use them if present:
-```typescript
-export interface StartDownloadOptions {
-  // ... existing fields ...
-  meta?: DownloadMeta // optional pre-probed metadata
-}
-
-// In download.ts:
-let resolvedTitle = opts.meta?.title ?? (await probeMeta(...))
-if (opts.meta) {
-  send(wc, { type: 'meta', id: opts.id, meta: opts.meta })
-} else {
-  probeMeta(ytdlp, opts.url).then(...)
-}
-```
-
----
-
-#### P3 — Lowering `maxConcurrent` mid-flight doesn't pause overflow
-
-**File:** [downloads.ts:249-265](src/renderer/src/store/downloads.ts)  
-**Severity:** Low (UX)  
-**Status:** Fixed — 2026-06-23 (documented in code; intentional behaviour)
-
-**Description:**  
-`pump()` only gates *future* promotions of queued items. Reducing `maxConcurrent` while N downloads are active leaves all N running (no immediate pause). Acceptable behavior, but not obvious.
-
-**Why it matters:**  
-Users may expect "set max to 1" to pause other downloads immediately. Instead, ongoing ones keep running until they finish.
-
-**Fix:**  
-Document the behavior, or add a `cancel-overflow` handler if stricter semantics are desired. For now, a comment suffices.
-
----
+- **[High] O(n²) media-items rewrite (R3/PERF7).** *Reasoning:* every completion re-reads+rewrites the
+  whole (≤20k-item) file synchronously. *Fix:* in-memory cache + batched atomic writes (the same `jsonStore`).
+  *Benefit:* channel downloads stop hitching the main process.
+- **[Medium] Per-download redundant work (PERF1/PERF2).** *Reasoning:* `templates.json` read + settings
+  decrypt on every spawn even when unused. *Fix:* gate `listTemplates()` on the consent flag; cache decrypted
+  settings. *Benefit:* lower latency/IO per download.
+- **[Low] `summarizeQueue`/`pump` O(n) per tick (PERF3/PERF4).** *Fix:* memoize + count-based pump. *Benefit:* scales to large queues.
 
 ### Maintainability
+- **[High] Triplicated Settings/`Api` + the preview mock (C1).** *Reasoning:* a 4th touch-point per IPC
+  method; drift-prone. *Fix:* `DEFAULT_SETTINGS` in `@shared`; one typed `mockApi`. *Benefit:* one place to change.
+- **[High] Store circular dependency (C2).** *Fix:* a coordinator/event bus. *Benefit:* removes a latent init crash.
+- **[Medium] Duplicated persistence/validation/async/formatters (M1/CC9/CC5/M9).** *Fix:* the `lib/` helpers
+  in SIMP1–SIMP5. *Benefit:* ~−500 LOC and fewer divergence bugs.
+- **[Medium] God files (H1).** *Fix:* SettingsView via `<SettingsCard>`/`<ToggleField>` (SIMP10). *Benefit:* 1104→~600 lines, reviewable.
 
-#### M1 — `cleanError` function duplicated
+### Consistency
+- **[Medium] Two ways to do X** across persistence, status chips, segmented controls, buttons, errors
+  (M1/UI18/UI14/UI15/CC6). *Fix:* one shared primitive/standard each (see "Recommended single style"). *Benefit:* the app reads as one product.
+- **[Low] Naming/copy drift** (CC1, L95/L150, separators L164). *Fix:* the conventions in CC1. *Benefit:* professional finish.
 
-**Files:**  
-- [download.ts:81-88](src/main/download.ts)  
-- [probe.ts:139-146](src/main/probe.ts)
+### Readability
+- **[Medium] Magic strings/numbers + long signatures + deep nesting (CL1/CL2/CL4, L10).** *Fix:* `constants.ts`,
+  options-objects, extracted helpers. *Benefit:* faster comprehension, fewer transpose bugs (CL2).
 
-**Severity:** Trivial  
-**Status:** Fixed — 2026-06-23 (extracted to [log.ts](src/main/log.ts))
+### Polish (perceived quality)
+- **[High] First-run defaults (SR1/SR2/SR3).** *Reasoning:* light-on-dark first launch, nightly yt-dlp by
+  default, auto-download-new on. *Fix:* `theme:'system'`, `ytdlpChannel:'stable'`, `autoDownloadNew:false`.
+  *Benefit:* the first 10 seconds feel native and safe.
+- **[High] Stuck "Resolving…" (SR6) & restarting progress bar (SR7).** *Fix:* clear placeholder on error;
+  weight the two merge phases. *Benefit:* nothing looks hung/glitchy.
+- **[High] Placeholder icon (W14).** *Fixed:* a designed mark (teal gradient square + top sheen, bold
+  rounded download glyph over a landing shelf) replaces the flat placeholder; multi-size `.ico` regenerated.
+  *Benefit:* brand credibility. *(Unsigned build is a non-goal — no cert; the SmartScreen prompt is accepted.)*
 
-**Description:**  
-Identical 8-line error-log parsing function in two places. If the format changes, both need updating.
+### User experience
+- **[High] Per-download options are unreachable (UX1).** *Reasoning:* must change global settings to tweak
+  one download. *Fix:* wire the existing `DownloadOptionsForm` into the bar (plumbing exists). *Benefit:* reclaims a whole feature.
+- **[High] Destructive actions have no confirmation/undo (UX4).** *Fix:* confirm Clear/Remove/Delete. *Benefit:* prevents data loss.
+- **[Medium] Silent failures on Open/Show (UX6)** and **no global download status off the Downloads tab (UX9).** *Fix:* surface errors; sidebar badge. *Benefit:* the app feels responsive and honest.
 
-**Fix:**  
-Extract to a shared utility, e.g., `src/main/log.ts` or add to `download.ts` and import in `probe.ts`.
+### Accessibility & Windows-native (UX-critical for a Windows product)
+- **[High] Fragmented/invisible focus + no list keyboard nav (UI28/29, W7).** *Fix:* one focus-ring + roving
+  list focus + Delete/Ctrl+A. *Benefit:* keyboard- and Narrator-usable.
+- **[Medium] Title bar ignores in-app theme (W3); text fields have no context menu (W4); no `aria-live` (W17);
+  inputs lack accessible names (M28).** *Fix:* sync `themeSource`; add an editing context menu; live regions;
+  `aria-label`s. *Benefit:* feels like a native, accessible Windows app.
+
+### Developer experience
+- **[High] No enforcement tooling (CC2) + `noImplicitAny:false` (M38).** *Reasoning:* style/type safety rely
+  on discipline; implicit `any` is allowed. *Fix:* Prettier + typescript-eslint + CI; re-enable `noImplicitAny`.
+  *Benefit:* the conventions stay true; regressions caught pre-merge.
+- **[Medium] No logging + no prod source maps (CC8/M29/L170).** *Fix:* one leveled file logger at every catch;
+  hidden source maps. *Benefit:* field crashes become diagnosable instead of invisible.
+- **[Low] Stale roadmap/docs (M25/M26, L80–L82); release checksum is manual (H8).** *Fix:* reconcile docs;
+  generate `.sha256` in `build:win`. *Benefit:* trustworthy docs; updates don't silently fail to install.
+
+## Suggested PR sequence to 1.0
+
+1. **Correctness & data safety:** B1, M32, M35, M34, and the cached/atomic `jsonStore` (R1/R2/R3/PERF7).
+2. **Security & trust:** H7 (encrypt cookies), H8 (auto-generate checksums). *(Code signing is a non-goal — no cert.)*
+3. **First-run polish:** SR1/SR2/SR3 defaults, SR6/SR7 status, W14 icon, W3 title-bar theme.
+4. **Wire-or-cut + a11y + tooling:** UX1 (per-download panel) or remove M5/M6; focus/keyboard (UI28/29, W7,
+   W4); Prettier+ESLint+`noImplicitAny` (CC2/M38).
+5. **Incremental cleanup (post-1.0):** the SIMP refactors and the Low/UI/UX long tail, behind the new lint gate.
 
 ---
 
-#### M2 — `parseExtraArgs` has no escape-sequence handling
+## Critical
 
-**File:** [buildArgs.ts:112-120](src/main/buildArgs.ts)  
-**Severity:** Trivial  
-**Status:** Fixed — 2026-06-23 (limitation documented in code)
+- [x] **C1 — Single source of truth for the IPC mock + Settings defaults.** `const PREVIEW`
+  redeclared in 8 files; `main.tsx` reimplements the entire `Api` (~180 lines); the full
+  `Settings` object is hand-maintained in 3 places (`main/settings.ts` `DEFAULTS`,
+  `renderer/store/settings.ts` `FALLBACK`, `main.tsx` `MOCK_SETTINGS`). Add `DEFAULT_SETTINGS`
+  to `shared/ipc.ts`, extract the preview mock into one `mockApi.ts` typed as `Api`, centralize
+  `isPreview`. *Fixed: `DEFAULT_SETTINGS` is now the canonical default in
+  [shared/ipc.ts](src/shared/ipc.ts); main's `DEFAULTS`, the renderer `FALLBACK`
+  ([store/settings.ts](src/renderer/src/store/settings.ts)), and the preview `MOCK_SETTINGS`
+  all derive from it (preview-only field tweaks layered on top) instead of three hand-kept
+  copies. The whole browser mock moved into one [mockApi.ts](src/renderer/src/mockApi.ts) typed
+  `Window['api']` (so a missing/mistyped method is a compile error), and `main.tsx` shrank to
+  `window.api = mockApi`. The `PREVIEW` check is single-sourced in
+  [isPreview.ts](src/renderer/src/isPreview.ts) and imported (as `PREVIEW`) by all 8 sites.*
+- [x] **C2 — Break the `downloads ↔ sources` store circular dependency.** `downloads.ts`
+  imports `useSources`; `sources.ts` imports `useDownloads`. Works only via lazy `.getState()`.
+  Introduce a coordinator/event bus that owns cross-store reactions. *Fixed: a tiny typed event
+  bus [store/coordinator.ts](src/renderer/src/store/coordinator.ts) (no runtime deps — the
+  `AddEntry` import is type-only) now owns the two cross-store reactions. `sources` emits
+  `enqueueDownloads` (consumed by `downloads.addMany`); `downloads` emits `downloadCompleted`
+  (consumed by `sources.markDownloaded`). Each store imports the bus, not the other, so the
+  cycle is gone. Because `downloads` no longer pulls in `sources`, `App` now eagerly imports the
+  `sources` store for side-effects (`import './store/sources'`) so its startup load + scheduled-
+  `--sync` kickoff and the `downloadCompleted` subscription still run at launch — robust even
+  once the views are lazy-loaded (PERF8).*
 
-**Description:**  
-The shell-like split supports single and double quotes but no escape sequences (`\"` or `\'`). A value containing a literal quote can't be expressed, and an unterminated quote falls through to `\S+` and captures the quote itself. The tests cover the happy path; edge cases aren't reachable in practice (the UI doesn't expose raw quote entry).
+## High
 
-**Why it matters:**  
-Limitation of the current design, documented nowhere.
+- [x] **H1 — Decompose god files.** `SettingsView.tsx` (1104, ~11 cards, ~30 selector subs +
+  ~20 useState), `DownloadBar.tsx` (858, ~17 state hooks), `store/downloads.ts` (614). *Done on
+  `refactor/h1-decompose-god-files`: SettingsView → `components/settings/*.tsx` (one component per
+  card + shared `settingsStyles.ts`), leaving a ~90-line shell (search box + display-toggle filter);
+  each card still renders one `<Card>` DOM node so the filter is unchanged. DownloadBar → a
+  `downloadBar/useDownloadBar.ts` hook (all state + handlers, wrapper handlers keep the
+  preview-invalidation side-effects) + `downloadBar/styles.ts` + `downloadBar/PlaylistPanel.tsx`,
+  leaving a render-only shell. store/downloads.ts → `downloadTypes.ts` (types, re-exported so
+  importers are untouched) + `downloadItem.ts` (buildItem/titleFromUrl/RESOLVING) + `downloadSeed.ts`
+  (preview seed), leaving the store + recordCompletion + wiring. Behaviour unchanged; full
+  typecheck + lint + production build + 248 tests green.*
+- [x] **H2 — Consolidate scattered utilities.** `youtubeId` ×2; 4 YouTube-URL-parsing variants;
+  byte/speed/eta/duration formatting across 4 modules. *URL half: one canonical `youtubeId` now lives in
+  [urlHelpers.ts](src/renderer/src/lib/urlHelpers.ts) (the complete watch/shorts/embed/live/youtu.be
+  parse); `thumb.ts`, `queueStats.ts` (`sameVideo`), and `store/downloads.ts` (`titleFromUrl`, which also
+  fixes an old bug where any host with a `?v=` param was mislabeled "YouTube video") all import it — the
+  three ad-hoc reimplementations are gone. Formatter half (done with H4): `fmtBytes`/`fmtSpeed`/`fmtEta`
+  now have a single home in [@shared/format.ts](src/shared/format.ts) imported by both sides; the main
+  formatters module re-exports them and the renderer's three private copies (a byte formatter, an ETA
+  formatter, and a speed string→number re-parser in `queueStats`) are deleted. Per-item and aggregate
+  speed now use the same 1024-based scale (the old aggregate used 1000, a latent inconsistency).
+  Unit-tested in `test/clipboardLink.test.ts` + `test/download.test.ts` + `test/queueStats.test.ts`.*
+- [x] **H3 — Fix `probe.ts → download.ts` dependency direction** (`fmtBytes` import); resolves
+  with H2's shared formatter.
+- [x] **H4 — Carry raw numbers across the progress boundary.** `DownloadProgress` ships
+  formatted `speed`/`eta` strings; `queueStats.ts` re-parses them back to numbers. *Fixed: `DownloadProgress`
+  now carries `speedBytesPerSec`/`etaSeconds` as raw numbers (main's `parseProgress` no longer formats them);
+  the renderer stores the raw numbers on `DownloadItem`, `QueueItem` formats them for display via
+  [@shared/format](src/shared/format.ts), and `summarizeQueue` sums/maxes the numbers directly — the lossy
+  string→number→string round-trip (and `queueStats`' `parseSpeed`/`parseEtaSeconds`) is gone. Done together
+  with the formatter half of H2.*
+- [x] **H5 — History re-download silently changes quality.** `HistoryView.redownload` passes the
+  stored `quality` (for format-picker downloads this is a *label* like "720p · mp4 · 184 MB")
+  back as `quality` with no `formatId`; `buildArgs.videoFormat()` has no matching case and falls
+  back to `bv*+ba/b` (Best). The queued item shows "720p…" while actually fetching Best.
+- [x] **H6 — TerminalView log grows unbounded.** `setLines((ls) => [...ls, …])` with no cap; a
+  verbose run (`-F`, `--verbose`) streams thousands of lines into React state. Every other
+  log/list in the app is capped — cap this too (and/or virtualize).
+- [x] **H7 — `cookies.txt` written in plaintext with no restrictive perms.** [cookies.ts](src/main/cookies.ts)
+  `writeFileSync(getCookiesFilePath(), …)` stores live auth/session cookies unencrypted under
+  `userData`. In the **portable build** that's `AeroFetch-data/` next to the exe (USB stick /
+  shared Downloads folder), so anyone with folder access can read a logged-in session. Settings
+  secrets are DPAPI-encrypted (settings.ts) but cookies are not. Encrypt at rest or document the
+  exposure for the portable/shared-PC scenario the app explicitly targets.
+- [x] **H8 — Release checksum is a manual step the updater hard-requires.** [updater.ts](src/main/updater.ts)
+  sets `REQUIRE_CHECKSUM = true` and refuses any update lacking a `<asset>.sha256`, but
+  `build:win` (`electron-vite build && electron-builder --win`) never generates one. Evidence in
+  `dist/`: only `0.4.1` has `.sha256` files (hand-made); the current `0.5.0` build does not. If a
+  release is published without manually adding the checksum, **every client's in-app update
+  fails** ("This release has no checksum … refusing to install"). Generate the `.sha256` in the
+  build/release script.
 
-**Fix:**  
-Add a note near `parseExtraArgs`: "No escape-sequence support; quotes cannot nest. For most yt-dlp use cases (proxy URLs, filename patterns), this is sufficient." If a future template needs quotes within quotes, redesign to a proper shlex or JSON-based format.
+## Medium
+
+- [x] **M1 — Unify JSON persistence.** `sources.ts` has generic `readJsonArray`/`writeJson`;
+  `history.ts`/`errorlog.ts`/`templates.ts` reimplement it inline.
+- [x] **M2 — Remove dead code: `getDefaultFolder` / `download:default-folder`** (channel +
+  preload + handler + mock, zero callers).
+- [x] **M3 — Remove duplicated completion side-effect in `store/downloads.ts`** (history write +
+  `markDownloaded` in both `applyEvent('done')` and the preview ticker). Subsumed by C2.
+- [x] **M4 — Decide queue persistence explicitly.** Scheduler/queue is renderer-memory only;
+  `saved`/scheduled items don't survive a quit. Persist or document as a non-goal in code. *Fixed
+  (persist, per the run decision): a main [queue.ts](src/main/queue.ts) store (the proven cached-atomic
+  `createJsonStore`, `queue.json`) plus `queue:list`/`queue:save` IPC. The renderer mirrors its durable
+  items on every queue change (a `PersistedQueueItem` = the stable subset of `DownloadItem`; runtime-only
+  progress/speed/eta are dropped, and a signature over the persistable subset means progress ticks don't
+  re-save) and rehydrates on launch via an `App` `useEffect`. On restore a `downloading` item (its process
+  died) normalizes back to `queued` (yt-dlp continues the `.part`), `saved`+`scheduledFor` survives so the
+  promoter fires it when due, `paused`/`error` return actionable; `completed`/`canceled` are never persisted.
+  A `queueHydrated` gate stops a launch-time store change wiping the file before it's read. Pure mappers
+  extracted to [queuePersist.ts](src/renderer/src/store/queuePersist.ts) and unit-tested (`test/queuePersist.test.ts`);
+  plumbing is typecheck-verified. **Live-verify note:** the OS-level quit→relaunch cycle itself wasn't
+  smoke-tested here — worth a manual confirm (schedule/park an item, quit, relaunch).*
+- [x] **M5 — Command-preview feature is fully built but unwired.** `CommandPreviewResult` type +
+  `command:preview` channel + `previewCommand` (download.ts) + `formatCommandLine`/
+  `quoteForDisplay` (buildArgs) + preload method all exist, but no renderer component calls
+  `window.api.previewCommand` (only the `main.tsx` mock references it). Wire it into the
+  DownloadBar Options panel, or remove the dead chain. *Fixed: a "Show command / Hide command"
+  toggle in [DownloadBar.tsx](src/renderer/src/components/DownloadBar.tsx) calls
+  `window.api.previewCommand` and renders the exact yt-dlp argv (monospace). The preview mirrors
+  what `download()` spawns — probe-selected `formatId`/`formatHasAudio`, `quality`, per-download
+  `options`, and `trim` — and is invalidated whenever any of those inputs (or the URL / a re-probe)
+  changes, so the shown command never goes stale. Wired with M6/UX1 in the same panel.*
+- [x] **M6 — Private/incognito mode is plumbed but unreachable.** `incognito` flows through
+  `AddOptions` → `buildItem` → history-skip → the QueueItem "Private" badge, but nothing in the
+  UI ever sets `incognito: true`. Add the toggle or remove the dead plumbing. *Fixed: an
+  "Incognito mode (no logging, no history, no cookies)" checkbox in the DownloadBar Advanced panel
+  sets `incognito` on the enqueued item (via `AddOptions`), lighting up the existing QueueItem
+  "Private" badge. Reset to off after each download so it never silently carries over to the next.*
+- [x] **M7 — `newId()` duplicated 3×** (`store/downloads.ts`, `TerminalView.tsx`,
+  `TemplateManager.tsx`) with divergent fallback prefixes (`item-`/`t-`/`tpl-`). Extract one helper.
+  *Fixed: one [`newId(prefix)`](src/renderer/src/id.ts) helper; the three copies import it and pass their
+  prefix. The fallback gained a monotonic counter so same-millisecond ids can't collide (subsumes L33/L70).
+  Unit-tested in `test/id.test.ts`.*
+- [x] **M8 — Two download-status→label maps.** `STATUS_BADGE` (QueueItem) and `STATUS_LABEL`
+  (LibraryView) independently map the same statuses (completed = "Completed" vs "Downloaded").
+  One shared map.
+- [x] **M9 — Three time formatters.** `relTime` (LibraryView), `formatWhen` (HistoryView),
+  `fmtSchedule` (QueueItem) — consolidate into a date util. *Fixed: all three moved to
+  [`datetime.ts`](src/renderer/src/datetime.ts) and imported by their views; unit-tested in `test/datetime.test.ts`.*
+- [x] **M10 — `.url` shortcut parsing duplicated** — `parseUrlFile` (DownloadBar) vs
+  `readUrlShortcut` (main/deeplink). Different `URL=` extractors for the same file format.
+- [x] **M11 — Inconsistent clipboard access.** Reads use `navigator.clipboard.readText` (paste
+  button) *and* `window.api.readClipboard` (suggestion watcher); writes use
+  `navigator.clipboard.writeText` (copy report). Pick one strategy.
+- [x] **M12 — Shared `errorText` style.** `tokens.colorPaletteRedForeground1` is applied inline
+  12× across 5 files instead of one class. *Partially fixed: added
+  [`useErrorTextStyles`](src/renderer/src/components/ui/errorText.ts) (`error` / `errorPre` for pre-wrap
+  multi-line output) and adopted it in `SettingsView.tsx` — the biggest offender — replacing all 6 inline
+  `style={{ color: … }}` error spans + its local `errorRowText` class. The remaining red references live in
+  per-component `makeStyles` classes (DownloadBar/LibraryView/QueueItem/TerminalView), not inline; migrate
+  those to the shared hook incrementally.*
+- [x] **M13 — Inconsistent secret-field masking.** `updateToken` uses `type="password"`; `proxy`
+  (may carry `user:pass@`) and `youtubePoToken` (a token) are plain-text Inputs.
+- [x] **M14 — Settings search mutates React-owned DOM.** The search toggles each card's
+  `el.style.display` directly; fragile (breaks if a card ever gets a conditional `style`) and
+  matches on `textContent` incl. hidden text. Prefer state-driven filtering. *Fixed: each card renders
+  inside a React-owned wrapper whose visibility is driven by a `hidden` state array in
+  [SettingsView.tsx](src/renderer/src/components/SettingsView.tsx) — the filter no longer writes
+  `display` onto a card's own node, so a card setting its own inline style can't break it. Matching still
+  reads the wrapper's `textContent` (so search covers every visible label without hand-maintained
+  per-card keywords); the minor "matches hidden descendant text" point is unchanged and left as-is.*
+- [x] **M15 — Nested interactive controls in `role="button"` (a11y).** LibraryView's group header
+  is a `role="button"` div containing `<Button>`s (All / Download) — invalid ARIA / keyboard
+  semantics. Make the header a real element with sibling buttons.
+- [x] **M16 — No renderer error boundary.** An exception in any view unmounts the whole shell to
+  a blank window. Add a top-level boundary with a recover/reload affordance. *Fixed: added
+  [`ErrorBoundary`](src/renderer/src/components/ErrorBoundary.tsx) wrapping `<App/>` in `main.tsx`. The
+  fallback is dependency-free (no Fluent/theme provider — the crash may have come from that tree), logs via
+  `componentDidCatch`, shows the error message, and offers a Reload button (`window.location.reload()`;
+  persisted data lives in main, so nothing is lost).*
+- [x] **M17 — `statusByUrl` collapses duplicate URLs.** LibraryView maps URL→status into one
+  `Map`; with "Download anyway" duplicates, a row can reflect the wrong item's state.
+- [x] **M18 — Audio "quality" presets hard-code MP3.** `QUALITY_OPTIONS.audio` labels ("Best
+  (MP3)", "320 kbps") are shown even when `downloadOptions.audioFormat` is opus/flac/wav, so the
+  label contradicts the actual output format; `--audio-quality` is also meaningless for lossless.
+- [x] **M19 — Sidebar-collapsed pref uses `localStorage`** while every other preference uses
+  electron-store — won't back up/restore and is lost in the portable build across machines.
+- [x] **M20 — ProgressBar / native `<select>` accessibility.** QueueItem/DownloadsView
+  `ProgressBar`s have no accessible name; several `Select`s carry both a `<Field label>` and an
+  `aria-label` (double announcement).
+- [x] **M21 — `--audio-quality` always emitted.** `buildArgs` passes `--audio-quality` even for
+  lossless `audioFormat` (flac/wav), where it's meaningless; pair with M18's preset/format mismatch.
+- [x] **M22 — Backup export writes secrets in cleartext, silently.** [backup.ts](src/main/backup.ts)
+  `exportBackup` serializes the *decrypted* settings (proxy creds, PO token, update token) to a
+  plain JSON file; the UI caption only says "Does not include download history" — no warning that
+  the file contains credentials. *Fixed: `proxy`/`youtubePoToken`/`updateToken` are stripped (set to
+  `''`) before writing; SettingsView caption updated to say credentials are not included.*
+- [x] **M23 — `MAX_ITEMS` truncation can silently drop a source's items.** [sources.ts](src/main/sources.ts)
+  `replaceMediaItems` does `[...new, ...others].slice(0, 20000)`; once the global total exceeds the
+  cap, the *tail* (another source's items) is dropped on write and only reappears when that source
+  is re-indexed. Cap per-source, or surface it.
+- [x] **M24 — `setSettings` accepts unvalidated free strings.** [settings.ts](src/main/settings.ts)
+  stores `rateLimit`/`proxy`/`defaultVideoQuality`/`defaultAudioQuality`/`youtubePlayerClient` as
+  any string. A bad `rateLimit` ("abc") only fails at download time; a `defaultQuality` not in
+  `QUALITY_OPTIONS` leaves the Settings dropdown's controlled value blank. *Fixed: `VIDEO_QUALITY_OPTIONS`
+  / `AUDIO_QUALITY_OPTIONS` added to `shared/ipc.ts` and imported in both `settings.ts` (allowlist
+  validation) and `store/downloads.ts` (single source of truth). `rateLimit` validated against yt-dlp
+  rate format regex; `youtubePlayerClient` trimmed.*
+- [x] **M25 — ROADMAP marks unwired features as ✅ shipped.** [ROADMAP.md](ROADMAP.md) Phase C
+  ("Command preview … Surfaced as a **Preview command** button in the download bar") and Phase D
+  ("Private / incognito mode — a download bar toggle") both carry `[x]`, but neither is wired in
+  the UI (corroborates M5/M6). The roadmap overstates completion — reconcile the docs or finish the wiring.
+- [x] **M26 — ROADMAP accent palette is wholesale stale.** [ROADMAP.md](ROADMAP.md) Phase E
+  describes "four accent presets — Toffee (original), Slate, Evergreen, Lavender" with a default of
+  Toffee; the shipped [theme.ts](src/renderer/src/theme.ts) is rose / coral / amber / teal
+  ("Sunset-to-sea") with a default of **teal**. The whole section documents a palette that no
+  longer exists.
+- [x] **M27 — Library batch-enqueue ignores per-item kind.** [sources.ts](src/renderer/src/store/sources.ts)
+  `enqueueItems` forces `settings.defaultKind` (+ its quality) for *every* item, so a channel can't
+  be downloaded as audio without flipping the global default — inconsistent with the DownloadBar
+  playlist panel, which offers a per-item video/audio toggle.
+- [x] **M28 — Primary text inputs have no accessible name.** The URL field (DownloadBar), add-source
+  (Library), search (History/Settings), and the Terminal args `Textarea` rely on `placeholder` only —
+  which is not an accessible name. Add `aria-label`/`<label>` to each. *(a11y; distinct from M20's Select/ProgressBar.)*
+- [x] **M29 — Failures are swallowed everywhere.** 29 `.catch(() => {})` sites across 15 files: nearly
+  every IPC write/read discards its error with no log, no user feedback, and no telemetry. A failed
+  settings write, history add, or `openPath` simply vanishes. *Fixed: a shared
+  [`logError(op)`](src/renderer/src/reportError.ts) helper replaces every swallowed renderer catch with
+  one consistent `console.error('[AeroFetch] <op> failed:', e)` (settings, history, templates, errorlog,
+  sources, App, DownloadBar drag-drop, SettingsView version reads, LibraryView scheduled-sync); main-process
+  sites (ytdlp auto-update, cookies loadURL) log inline. Four genuinely-silent catches left intentionally:
+  `pauseDownload` / `cancelDownload` (process kill, state already applied), `unlink` (cleanup), and
+  `clipboard.writeText` (browser permission — no user action available). **Scope note:** this delivers
+  the "log" half — failures are no longer silent. The user-facing toast + a persistent log sink (renderer
+  `console.error` isn't captured in a packaged build) are deferred to **CC8** (electron-log), which the
+  audit already cross-references here.*
+- [x] **M30 — A broken contextBridge degrades silently to mock mode.** [preload/index.ts](src/preload/index.ts)
+  only `console.error`s if `exposeInMainWorld` throws; the renderer then sees no `window.electron`,
+  flips `PREVIEW` true, and runs the **browser mock** (no real IPC) with no visible error. A real
+  bridge failure looks like "preview." *Fixed: preload sends `IpcChannels.preloadBridgeFailure` on failure;
+  main registers `ipcMain.once(IpcChannels.preloadBridgeFailure, …)` in `registerIpcHandlers()` (run before
+  the window is created) and shows an error dialog + quits, so the failure is impossible to miss.*
+- [x] **M31 — Default Electron menu (incl. Toggle DevTools/Reload) ships in production.** No
+  `Menu.setApplicationMenu(null)` is called; with `autoHideMenuBar` the default role menu is still
+  Alt-accessible, exposing DevTools/reload to end users. *Fixed: `Menu.setApplicationMenu(null)` called
+  in `app.whenReady()` when `!is.dev`; dev builds keep the menu for DevTools access.*
+- [x] **M32 — Playlist/channel batches download in reverse order.** `addMany` prepends the whole
+  batch in entry order (`[entry1…entryN, …old]`), but `pump()` promotes the *highest-index* queued
+  item first (it reverses, assuming one-at-a-time prepends). So a selected playlist/channel downloads
+  **N → 1**. Files are still named `001…NNN` correctly (by `playlistIndex`), so a partial run leaves
+  the *last* videos on disk — surprising. Enqueue batches in reverse, or have `pump()` respect insertion order.
+- [x] **M33 — Documented enqueue batch cap doesn't exist.** [ipc.ts](src/shared/ipc.ts):629 and
+  ROADMAP-PINCHFLAT claim the queue pulls "a batch at a time (e.g. 50)" via `MAX_ENQUEUE_BATCH` so it
+  "never holds the whole collection at once," but no such cap exists — `enqueueItems` `addMany`s *every*
+  selected item, so "Download all pending" on a 5,000-video channel puts 5,000 items in the store/queue
+  at once. Implement the cap or fix the comment.
+- [x] **M34 — Optimistic settings updates never reconcile with main's validation.** The settings store
+  does `set(partial)` then `setSettings(partial).catch(() => {})`, discarding the validated `Settings`
+  main returns. A value main rejects (e.g. an unsafe `filenameTemplate`, a clamped `maxConcurrent`, a
+  malformed `rateLimit`) still shows as accepted in the UI until restart — the user believes a setting
+  saved that didn't. Apply the returned authoritative state.
+- [x] **M35 — History re-download creates duplicate rows.** `redownload` re-queues via `addFromUrl`,
+  which mints a **new id**; on completion `addHistory` dedups by id (no match) and prepends a second row
+  for the same video. Re-downloading from History accumulates duplicates. Dedup by URL, or reuse the entry id.
+- [x] **M36 — Library checkbox count ≠ "Download N selected".** Every item row has a checkbox
+  ([LibraryView.tsx](src/renderer/src/components/LibraryView.tsx)), but `selectedActionable` filters to
+  pending/error/canceled only, so selecting 5 rows (incl. 2 already-downloaded) shows "Download **3**
+  selected." The checkbox count and the button count silently disagree. **Fix:** only show checkboxes on
+  actionable rows, or count all selected.
+- [x] **M37 — End-user hints leak developer/internal references.** Settings hints surface dev-facing
+  detail: "Requires aria2c.exe in resources/bin (see the README there)", "paste a read-only **Gitea**
+  token", "sent via `--extractor-args`", "breaking downloads with **403** errors", "open a locked cookie
+  database", and roadmap status ("automatic minting is **planned**"). These read as code comments, not
+  product copy. **Fix:** rewrite for end users (hide repo/flag/HTTP-status jargon and roadmap notes).
+- [x] **M38 — `noImplicitAny: false` partially defeats `strict`.** The inherited
+  `@electron-toolkit/tsconfig` sets `strict: true` **but explicitly `"noImplicitAny": false"`**, and
+  neither project tsconfig re-enables it — so a parameter/variable with no inferrable type silently
+  becomes `any` project-wide (the one real hole in an otherwise-strict setup; `noUnusedLocals`/
+  `noUnusedParameters`/`noImplicitReturns` *are* on, which is why dead locals don't accumulate). **Fix:**
+  re-enable `noImplicitAny` in `tsconfig.node.json`/`tsconfig.web.json`.
+
+## Low
+
+- [x] **L1 — Module-load `setInterval` in `store/downloads.ts`** runs on import (incl. tests/preview).
+  *Fixed: the scheduled-download promoter tick moved out of store-module scope into an `App.tsx`
+  `useEffect` (interval `SCHEDULE_TICK_MS`, cleared on unmount). Importing the store in tests/preview no
+  longer starts a stray never-cleared timer; the store keeps the `promoteDueScheduled` action, App owns the
+  cadence. (The preview `startFakeTicker` interval is created on demand per launched item, not at load, so
+  it was already fine.)*
+- [x] **L2 — `index.ts` flat IPC registration (~150 lines)** — let each main module export its own
+  `register(ipcMain)`. *Fixed: the whole ~200-line handler block moved into one dedicated
+  [ipc.ts](src/main/ipc.ts) exporting `registerIpcHandlers(getMainWindow)` — the single place the renderer's
+  IPC contract is wired. index.ts now imports it (plus the three shared theme helpers `resolveBackgroundMode`
+  /`applyNativeTheme`/`getSystemThemeInfo`, also moved to ipc.ts) and shed ~50 imports it only needed for the
+  handlers, leaving it as app-lifecycle + window creation. The window-coupled handlers (folder picker,
+  theme-synced background, taskbar progress) take the live window via the `getMainWindow` accessor rather
+  than a captured `mainWindow`.*
+- [x] **L3 — Stale comments.** `getYtdlpVersion` JSDoc still calls it the "Step-1 spike";
+  `vitest.config.ts` claims tests "only exercise buildArgs.ts" (9 test files now exist).
+- [x] **L4 — `electron-builder.yml` nits.** `copyright: yt-dlp frontend` is not a copyright
+  string (no holder/year); the `files` exclude `tsconfig.tsbuildinfo` never matches the real
+  `tsconfig.web.tsbuildinfo`.
+- [x] **L5 — Inline `style={{}}` vs makeStyles** (25× across 8 files; SettingsView 14×). Notably
+  Sidebar's active-nav inset shadow and DownloadOptionsForm's hint caption use inline styles
+  where a class exists elsewhere. *Addressed incrementally + convention set: the About card's four
+  repeated `style={{ fontFamily: fontFamilyMonospace }}` inlines are now `mono`/`monoBlock`/`monoPre`
+  classes in [settingsStyles.ts](src/renderer/src/components/settings/settingsStyles.ts). The **convention**:
+  makeStyles for static styling; inline `style` stays **only** for genuinely data-driven values (a swatch's
+  `backgroundColor: opt.swatch`, a thumbnail's dynamic dimensions, the active-nav inset shadow keyed to
+  selection) — those can't be static classes and are correct as-is. Remaining static inlines migrate
+  opportunistically under this rule.*
+- [x] **L6 — Control height mismatch.** `Select` is a fixed 32px sitting beside `size="large"`
+  (~40px) Input/Buttons in DownloadBar.
+- [x] **L7 — `canceled` and `paused` share the 'warning' badge color** (QueueItem) — visually
+  ambiguous.
+- [x] **L8 — Index/compound list keys.** TerminalView keys log lines by array index; Settings
+  Diagnostics keys by `id + occurredAt` while every other list keys by `id` alone.
+- [x] **L9 — Thumbnail box sizes not shared.** Four hand-tuned 16:9 boxes (120×68, 108×64, 72×44,
+  60×34) with no shared aspect/size constant.
+- [x] **L10 — Scattered magic numbers.** Timeouts/caps spread across modules (probe 60s, indexer
+  180s, probeMeta 30s, update-idle 60s; MAX_ENTRIES 500/200, MAX_TEMPLATES 100, MAX_ITEMS 20000).
+  Consider a central constants module. *Fixed: a main-process [constants.ts](src/main/constants.ts) now
+  holds the process-spawn timeouts (`VERSION_TIMEOUT_MS`, `META_PROBE_TIMEOUT_MS`, `PROBE_TIMEOUT_MS`,
+  `INDEX_TIMEOUT_MS`, `YTDLP_UPDATE_TIMEOUT_MS`, `FEED_FETCH_TIMEOUT_MS`, `STALL_TIMEOUT_MS`), the execFile
+  `maxBuffer` sizes (`META`/`PROBE`/`INDEX_MAX_BUFFER`), `STDERR_TAIL_BYTES`, and the three hand-rolled store
+  caps (`ERRORLOG_MAX_ENTRIES`, `TEMPLATES_MAX`, `MEDIA_ITEMS_MAX`). download/ffmpeg/indexer/probe/ytdlp/sync/
+  errorlog/templates/sources import from it instead of bare literals. Values already single-sourced in the
+  shared contract (`HISTORY_MAX_ENTRIES`) and updater.ts's already-named local timeouts were left in place —
+  they aren't scattered literals.*
+- [x] **L11 — "Queue (N)" overcounts.** DownloadsView's header count is `items.length` (includes
+  completed/error/canceled), not the active queue.
+- [x] **L12 — Command palette polish.** No scroll-into-view for keyboard selection in the 50vh
+  list; `role="dialog"` without `aria-modal`/focus-trap; Esc handled only on the input.
+- [x] **L13 — Destructive actions lack confirmation.** "Clear history", "Clear log", "Remove
+  source" are one-click — inconsistent with the careful confirm on backup import.
+- [x] **L14 — `base.css` is bare** — no global `box-sizing`, `:focus-visible`, or font-smoothing
+  baseline, so custom native elements (Select, Hint, segmented controls) get inconsistent focus
+  rings; `box-sizing` is then set ad hoc on the SettingsView swatch.
+- [x] **L15 — `MediaThumb` redundant ternary** `kind === 'audio' ? 'audio' : 'video'` (kind is
+  already that union).
+- [x] **L16 — `relTime`/`formatWhen` verbosity.** `relTime` returns unbounded "N d ago"; History's
+  `formatWhen` always appends the year, even for the current year.
+- [x] **L17 — TemplateManager regex not validated.** An invalid `urlPattern` is accepted with no
+  feedback and silently never matches (main's `matchesUrl` swallows the error).
+- [x] **L18 — Terminal nav item shown when custom commands are off** — leads to a gated dead-end
+  view; consider hiding/disabling it.
+- [x] **L19 — `App.tsx` focus hack** — `setTimeout(() => …focus(), 60)` after a tab switch.
+- [x] **L20 — `youtubePlayerClient` is free text** with no allowlist/validation; a typo passes
+  straight to yt-dlp's `--extractor-args`.
+- [x] **L21 — Inconsistent in-component error handling.** SettingsView funnels the app-update
+  not-ok result into a dedicated `appUpdError` slot but keeps not-ok duals for
+  version/update/export/import — two patterns in one file. *Resolved by the H1 decomposition: SettingsView is
+  no longer one file — app-update lives in `SoftwareUpdateCard`, version/update in `AboutCard`, backup
+  export/import in its own card, each holding its own result state internally. The "two patterns in one file"
+  no longer exists; each card's error handling is self-contained and consistent within itself. (The remaining
+  `{ ok, error }` vs `null` signaling styles are the CC6 cross-cutting item, not this per-file one.)*
+- [x] **L22 — DownloadOptionsForm shows both audio + video controls** regardless of the chosen
+  kind in the per-download override panel (audio format shown for a video download, etc.).
+- [x] **L23 — Diagnostics shows first 20 errors** with no "showing 20 of N" hint (the copied
+  report includes all).
+- [x] **L24 — `window.open(htmlUrl, '_blank')`** in SettingsView is the only `window.open` in the
+  app (relies on the window-open handler); elsewhere external opens go through IPC/`shell`.
+- [x] **L25 — Taskbar effect over-fires.** `App.tsx` subscribes to the whole downloads store and
+  recomputes `summarizeQueue` + sends the taskbar IPC on *every* store change (each progress
+  tick); throttle or dedupe by computed value.
+- [x] **L26 — Third URL-sniffing path.** DownloadBar's drag-drop `firstUrl` is a separate
+  "first http(s) line" extractor alongside `useClipboardLink.looksLikeUrl` and deeplink's scan.
+- [x] **L27 — DownloadBar Enter probes, not downloads.** Enter in the URL field triggers
+  `fetchFormats`; there's no keyboard path to actually start the download (LibraryView's Enter
+  runs its primary action). Inconsistent.
+- [x] **L28 — Default kind/quality applied once.** DownloadBar seeds from settings via a one-shot
+  ref; changing the default in Settings while on the Downloads tab isn't reflected until reload.
+- [x] **L29 — UI constant in the store.** `QUALITY_OPTIONS` lives in `store/downloads.ts` yet is a
+  presentational constant imported by views — couples UI to the store module.
+- [x] **L30 — Redundant `loading="lazy"`** on `MediaThumb` images already inside a virtualized
+  list (the virtualizer only mounts visible rows).
+- [x] **L31 — Two theme switchers.** Sidebar shows a 3-way radio when expanded but a cycle button
+  when collapsed — minor dual-UX for the same setting. *Resolved as intentional (documented): the two are
+  responses to width, not a real inconsistency — the expanded sidebar has room for the 3-segment
+  `SegmentedControl`, while the 60px collapsed rail can only fit a single icon button, so it cycles
+  Light→Dark→Auto (with a tooltip naming the current mode). Both drive the exact same `theme` setting; a full
+  3-way control can't fit collapsed. Left as-is by design.*
+- [x] **L32 — `paletteActions` rebuilt every render** in `App.tsx` (not memoized); harmless today,
+  but it's passed straight into a child.
+- [x] **L33 — `idCounter` fallback resets per launch.** The non-crypto `newId` fallback
+  (`item-${++idCounter}`) restarts at 1 each run; the `Date.now()`-based fallbacks elsewhere can
+  collide within a millisecond. Unify on one robust id helper (see M7). *Fixed with M7: the single
+  `newId` fallback is `${prefix}-${Date.now()}-${++counter}`, so same-ms ids stay distinct.*
+
+*Round 3 (2026-06-29) — tests, build metadata, error copy, edge cases:*
+
+- [x] **L34 — Integration test off by default.** `real-download.integration.test.ts` is
+  `describe.skipIf(!RUN)`; `npm test` never exercises a real download, so there's no automated
+  regression for the actual yt-dlp argv path (only the pure builder). *Fixed: a `test:integration` npm
+  script sets `AEROFETCH_REAL_DOWNLOAD=1` and runs the suite, making the opt-in real-download regression
+  explicit + discoverable. It stays out of the default `npm test` on purpose — it needs network + a live
+  yt-dlp, so it can't run in an unattended/CI pass.*
+- [x] **L35 — `isValidMediaItem` has no test** — the one persisted-JSON validator of six with no spec.
+- [x] **L36 — `compareVersions` differing-length components untested** (e.g. `1.2` vs `1.2.0`).
+- [x] **L37 — `download.ts` formatters untested** (`parseProgress`/`fmtBytes`/`fmtEta`, incl. the `NA` paths).
+- [x] **L38 — `buildArgs` webm-thumbnail exclusion branch untested** (`embedThumbnail && container!=='webm'`).
+- [x] **L39 — `CROP_SQUARE_PPA` exact-string assertion** is a change-detector test (breaks on harmless reformat).
+- [x] **L40 — `clipboardLink.test.ts` imports the zustand settings store** to test two pure helpers
+  (`looksLikeUrl`/`looksLikeSingleVideo`) — couples a pure-fn test to store init (see H2).
+- [x] **L41 — `package.json` `homepage` points at yt-dlp's GitHub**, not AeroFetch — wrong product
+  URL (surfaced by the NSIS installer).
+- [x] **L42 — `package.json` has no `license` field** (ships LGPL ffmpeg + GPL aria2c).
+- [x] **L43 — `package.json` has no `repository` field** (real repo is the Gitea instance).
+- [x] **L44 — Vestigial lint excludes.** `electron-builder.yml` excludes `.eslintrc`/`.prettierrc`
+  but there's no ESLint/Prettier config, script, or dependency — no enforced style tooling.
+- [x] **L45 — Three self-descriptions** drift: pkg `description` "A yt-dlp frontend for Windows" vs
+  builder `copyright` "yt-dlp frontend" vs Sidebar caption "yt-dlp frontend".
+- [x] **L46 — yt-dlp-missing error copy differs across 4 modules** (download/ytdlp/probe/indexer):
+  "Reinstall AeroFetch, or drop…" vs "Download it into resources/bin/…" vs "Drop it into resources/bin/."
+- [x] **L47 — `probeMeta` 30s timeout returns null silently** — no surfaced message, unlike every
+  other yt-dlp timeout ("Timed out …").
+- [x] **L48 — `cleanError` strips a leading `error:`** for live failures, while raw `ERROR:` text
+  shows elsewhere (errorlog seed / terminal) — inconsistent error normalization.
+- [x] **L49 — Newlines in user-facing error strings.** download.ts missing-binary messages embed
+  `\n`, which renders awkwardly in inline/Caption error spans.
+- [x] **L50 — "Cookies saved" shown for 0 cookies.** Closing the sign-in window without logging in
+  still writes the file and reports `ok` with `cookieCount: 0`.
+- [ ] **L51 — Scheduled daily sync time hardcoded to 09:00** (schedule.ts) — on/off toggle only, no time picker.
+  *Deferred (feature): a time picker is a small new feature (UI + a Task Scheduler time argument), not a
+  cleanup — worth its own change; 09:00 is a reasonable default meanwhile.*
+- [x] **L52 — Installer handoff is a fixed `setTimeout(app.quit, 1500)`** (updater.ts) — a race on slow machines.
+- [x] **L53 — `dialog.show*Dialog(win!, …)` non-null assertions** on a possibly-null window
+  (chooseFolder, backup export/import) — can throw if the sender window is gone.
+- [x] **L54 — DownloadBar preview `<img>` has no `onError` fallback** (inconsistent with `MediaThumb`'s retry).
+- [x] **L55 — QueueItem meta line can show size twice** — a probed-format `quality` label already
+  contains the size, then `sizeLabel` is appended again.
+- [x] **L56 — SponsorBlock ON with zero categories silently no-ops** (`buildArgs` guards on
+  `length > 0`) with no UI warning.
+- [x] **L57 — Scheduling a past datetime silently downloads now** (`buildItem` future-only guard),
+  no feedback that the schedule was ignored.
+- [x] **L58 — `chooseFolder` passes the macOS-only `createDirectory` property** — dead option on Windows.
+- [x] **L59 — `THEME_BACKGROUND` (index.ts) duplicates `pageBackground` (theme.ts)** — two
+  hand-synced color constants (a "keep in sync" comment guards them).
+- [x] **L60 — `'external-url'` channel name lacks the `category:` prefix** every other IPC channel uses.
+- [x] **L61 — `taskbarProgress` is the lone `ipcMain.on`** (fire-and-forget) amid all-`invoke` channels.
+- [x] **L62 — "Best available" synthetic format hardcodes `ext:'mp4'`/`hasAudio:true`** (probe.ts) —
+  mislabels when the chosen container is mkv/webm.
+- [x] **L63 — `audioQuality()` unknown label → silent `'0'` (best)** — the audio analog of H5.
+- [ ] **L64 — `ARIA2C_ARGS` connection params hardcoded** (`-x16 -s16 -k1M`), no user control.
+  *Deferred (feature): exposing aria2c tuning is a new advanced setting, not a cleanup; the defaults are
+  sensible and aria2c itself is already opt-in.*
+- [ ] **L65 — Pause uses `taskkill /F`** like cancel — a forced kill risks an unflushed `.part` tail vs a graceful stop.
+  *Deferred to the watched Batch 15 live pass: a graceful stop on Windows means signalling the child
+  (GenerateConsoleCtrlEvent/Ctrl-C) so yt-dlp flushes, which is fiddly and only verifiable by pausing a real
+  download and checking the `.part` resumes cleanly. The forced kill works today (resume re-spawns and yt-dlp
+  continues the `.part`), so the practical loss is at most the last buffer — low impact, but the graceful path
+  needs live verification.*
+- [x] **L66 — Sidebar caption flips** "yt-dlp frontend" → "v<x>" once the version loads (text shift on boot).
+- [x] **L67 — Onboarding has no Skip and can't be revisited** (no "show tips again"). *Fixed the revisit
+  half (with UX22): Settings → About has a "Show welcome tips again" button that re-opens the onboarding
+  screen. Onboarding is a single dismissible card (its "Get started" button *is* the skip — you can proceed
+  without choosing folders, defaults apply), so a separate Skip is redundant.*
+- [x] **L68 — Background-running notification fires once per process** (`notifiedBackground` never
+  resets) — won't remind on later window closes.
+- [x] **L69 — `settings.ts` mixes path helpers with persistence** (`getDefaultMediaDir`/
+  `ensureMediaDirs`/`getDownloadArchivePath` alongside the store) — split a `paths.ts`. *Fixed: the three
+  path helpers moved to [paths.ts](src/main/paths.ts); settings.ts is now just the electron-store persistence
+  layer (its now-unused `path`/`fs` imports dropped). download.ts and index.ts import the helpers from
+  `./paths`. `applyLaunchAtStartup` stays in settings.ts — it's OS login-item integration referenced by
+  `applySettings`, not a path helper.*
+- [x] **L70 — `crypto.randomUUID` fallback is effectively unreachable** in Electron/Node 26
+  (`typeof crypto !== 'undefined'` is always true) — dead defensive branch (see M7). *Fixed with M7: the
+  branch now lives once in `newId` (kept so the fn is total in any host) and is covered by a test that stubs
+  `crypto` to exercise it.*
+- [x] **L71 — Settings folder inputs are `readOnly`** with only a Browse button — no way to paste a
+  known path.
+- [x] **L72 — History re-download drops the thumbnail** (passes only title/channel), so the
+  re-queued row loses its thumbnail until re-probed.
+- [x] **L73 — Two verbs for the same probe action** — DownloadBar "Fetch" vs LibraryView "Index".
+- [x] **L74 — Accent swatches are triple-labeled** (`aria-pressed` + `aria-label` + `title`).
+- [x] **L75 — Update-token field always visible** in the Software-update card, even when no update
+  is pending — buries an advanced/rarely-needed input.
+- [x] **L76 — Duplicate-warning may show a placeholder title** — `setDup(existing.title)` can be the
+  `titleFromUrl` placeholder before metadata resolves ('YouTube video (id)').
+- [x] **L77 — ffmpeg/ffprobe versions have no re-check affordance** (load once; "not found" sticks
+  with no retry) unlike the yt-dlp "Check version" button.
+- [x] **L78 — `DownloadsView` empty-state copy** ("Paste a URL above to get started") doesn't match
+  the actual two-step Fetch→Download affordance.
+- [x] **L79 — SponsorBlock default categories = `['sponsor']` only** — enabling SB silently covers
+  just sponsors until the user expands categories (expectation gap).
+
+*Round 4 (2026-06-29) — doc/code drift, build artifacts, edge cases:*
+
+- [x] **L80 — ROADMAP wrong file path.** [ROADMAP.md](ROADMAP.md) Phase A says the flags are
+  emitted "in `buildArgs` (`src/main/download.ts`)" — `buildArgs` lives in `src/main/buildArgs.ts`.
+- [x] **L81 — ROADMAP internal contradiction.** Phase A: "`--split-chapters` still TODO"; Phase L:
+  `[x]` split-chapters done. Phase A wasn't updated when L landed.
+- [x] **L82 — PINCHFLAT roadmap interface sketches are stale.** [ROADMAP-PINCHFLAT.md](ROADMAP-PINCHFLAT.md)
+  Phase F's `Source`/`MediaItem` code blocks omit shipped fields (`videoId`, `itemCount`,
+  `watched`, `feedUrl`) — design sketches that drifted from `shared/ipc.ts`. *Fixed: the Phase F
+  sketch now carries the shipped `videoId`/`itemCount`/`watched`/`feedUrl` fields (plus the
+  required `url`/`playlistTitle`/`playlistIndex`) and a note that the block reflects the shipped
+  `shared/ipc.ts` shape.*
+- [x] **L83 — Dead build artifacts.** electron-builder emits `.blockmap` differential-update files
+  for each NSIS installer, but the custom [updater.ts](src/main/updater.ts) does a full download and
+  never consumes them. *Fixed: `nsis.differentialPackage: false` in
+  [electron-builder.yml](electron-builder.yml) stops the blockmap being generated (NsisTarget gates it
+  on `differentialPackage !== false`), with a comment explaining the custom-updater rationale.*
+- [x] **L84 — `dist/` accumulates unboundedly.** ~620 MB per build with no cleanup; it currently
+  holds 0.1.0–0.5.0 Setup + portable artifacts (~3 GB). Add a clean step or prune. *Fixed: a
+  `clean:dist` npm script (`fs.rmSync('dist', …)`) now runs at the front of `build:win`, so each
+  packaged build starts from an empty `dist/` and only the current version's artifacts remain.
+  (`dist`/`out` were already gitignored, so this is disk hygiene, not a repo change.)*
+- [x] **L85 — `.claude/launch.json` is committed and misplaced.** A VS Code launch config lives in
+  `.claude/` (VS Code reads `.vscode/launch.json`), so no tool consumes it; it's also tracked
+  (not gitignored).
+- [x] **L86 — History select-all + filter change deletes hidden rows.** `selected` persists across a
+  filter change, so "Delete selected" can remove entries no longer visible (surprising).
+- [x] **L87 — History re-download ignores original options.** `redownload` re-queues url/kind/quality
+  only; the post-processing `DownloadOptions` used originally are lost (current defaults apply). *Fixed:
+  `HistoryEntry` now carries the original `options` (recorded on completion in `recordCompletion`), and
+  `redownload` replays them via `AddOptions.options` — so a re-download reproduces the same subtitles /
+  SponsorBlock / container / codec instead of the current global defaults. Entries recorded before this
+  (no stored options) fall back to the defaults as before.*
+- [x] **L88 — `applyEvent('progress')` can promote a `queued` item to `downloading`** outside
+  `pump()` — a latent concurrency edge if a progress event ever arrives before/without the launch transition.
+- [x] **L89 — Inconsistent release artifacts.** Only `0.4.1` carries `.sha256` files (hand-made) and
+  the version sequence skips 0.3.x — symptomatic of the manual release process behind H8. *Fixed at
+  the root by H8: [scripts/generate-checksums.cjs](scripts/generate-checksums.cjs) (electron-builder
+  `afterAllArtifactBuild` hook) writes a `.sha256` next to every built `.exe` and returns them for
+  upload, so future releases are consistent automatically; the stale pre-H8 `dist/` artifacts are
+  pruned by L84. (The historical 0.3.x version gap is immutable.)*
+
+*Round 5 (2026-06-29) — code-level micro-inconsistencies & polish:*
+
+- [x] **L90 — Two idioms for "value in const array."** [settings.ts](src/main/settings.ts) `sanitizeOptions`
+  uses `ARR.includes(x as never)` (L116–120) while `setSettings` uses `(ARR as readonly string[]).includes(x as string)` (L275/323). Pick one.
+- [x] **L91 — Unsafe tuple cast / fragile encoding.** `value.split('|') as [MediaKind, string]`
+  ([SettingsView.tsx](src/renderer/src/components/SettingsView.tsx):411) trusts a `'|'`-joined
+  `kind|quality` string; a value without `'|'` yields `undefined` quality. Use a typed pair, not a string.
+- [x] **L92 — Preload names diverge from main fn names.** `markSourceItemDownloaded`↔`setMediaItemDownloaded`,
+  `syncSources`↔`syncWatchedSources`. Align the names across the boundary. *Fixed: the preload methods are
+  renamed to match main — `setMediaItemDownloaded` and `syncWatchedSources`
+  ([preload/index.ts](src/preload/index.ts)); the renderer callers ([store/sources.ts](src/renderer/src/store/sources.ts))
+  and the preview mock ([mockApi.ts](src/renderer/src/mockApi.ts)) updated to suit. The `Api` type derives from
+  the preload, so the rename is enforced end-to-end by the compiler.*
+- [ ] **L93 — SettingsView bypasses the store layer.** It calls `window.api` directly for
+  cookies/ffmpeg/yt-dlp/app-update/backup while using stores for settings/templates/errorlog — mixed
+  data-access in one component. *Deferred (CC13's concrete instance): these one-off, card-local IPC reads
+  (version checks, backup export/import, cookie sign-in) have no shared state to own, so a store per call is
+  arguably overkill — but the "no `window.api` in components" convention argues for thin hooks. Best done as
+  the focused CC13 view-model pass, not folded into this copy/cleanup batch.*
+- [x] **L94 — `summarizeQueue` recomputed every render** in [DownloadsView.tsx](src/renderer/src/components/DownloadsView.tsx)
+  (no `useMemo`) — and again on every store change in App's taskbar effect. Memoize/share. *Fixed: a 1-entry
+  items-ref memo `queueSummaryOf` in [queueStats.ts](src/renderer/src/store/queueStats.ts) — the store hands
+  out a new items array per change, so both App's taskbar subscription and DownloadsView's render summarize
+  it once per change (the second caller hits the cache) instead of twice (also closes PERF4).*
+- [x] **L95 — "Sign in" hyphenation varies** in the Cookies card ("Sign in…", "Site to sign in to", "Sign-in window", "Signing in…").
+  *Reviewed: the usages already follow standard English — the verb is two words ("Sign in…", "Signing in…",
+  "sign in to") and only the modifier is hyphenated ("Sign-in window"). Consistent by that rule; no change needed.*
+- [x] **L96 — Ellipsis-on-dialog-buttons inconsistent.** "Export backup…/Import backup…/Sign in…" use
+  `…` (opens a dialog), but "Browse" / "Check for updates" / "Update now" don't. Adopt the `…` = opens-a-dialog convention.
+  *Fixed: the folder "Browse" buttons (they open the OS picker) are now "Browse…". "Check for updates" /
+  "Update now" open no dialog (inline result / background download), so they correctly keep no ellipsis.*
+- [x] **L97 — Advanced-field placeholders inconsistent.** Adjacent fields use an example (`web_safari`),
+  a literal `(none)`, and `Optional — Gitea access token`. Pick one placeholder style. *Fixed: standardized
+  on "an example value where the field has a representative one (`web_safari`, `2M`, `socks5://…`),
+  `Optional -- <what>` for opaque optional fields" — the PO-token's uninformative `(none)` is now
+  `Optional -- paste a token`, matching the update-token field.*
+- [x] **L98 — "Embed chapters" has no hint** while every sibling toggle in DownloadOptionsForm does.
+- [x] **L99 — URL input has an `id` but no label.** `input={{ id: 'aerofetch-url' }}` with no
+  `<label for>`/`aria-label` (placeholder only) — see M28. *Resolved by M28: the URL input already carries
+  `aria-label="Video or playlist URL"`, so it has an accessible name — the placeholder isn't the only affordance.*
+- [x] **L100 — Inconsistent elevation.** DownloadBar (`shadow4`) and CommandPalette (`shadow28`) float;
+  every other card (Settings, QueueItem, History, Library, Templates) is flat (border-only). Define an elevation scale.
+  *Fixed: `ELEVATION` in [tokens.ts](src/renderer/src/components/ui/tokens.ts) names the scale — `flat`
+  (border-only, the resting card), `raised` (shadow4, the floating download bar), `overlay` (shadow28, the
+  command palette). The two floating surfaces use the tokens; flat cards are documented as the default.*
+- [x] **L101 — No z-index scale.** CommandPalette and Hint both hardcode `zIndex: 1000`.
+  *Fixed: `Z` = { overlay: 1000, tooltip: 1100 }. CommandPalette's backdrop is `Z.overlay`, Hint's bubble is
+  `Z.tooltip` (above overlays so a tooltip is never clipped by one).*
+- [x] **L102 — Two mental models for "format."** Settings sets it via one combined Video/Audio dropdown
+  (`FORMAT_OPTIONS`); the DownloadBar uses a Video/Audio segmented control + a separate quality dropdown.
+  *Fixed: the Settings "Default format" control ([DownloadsCard.tsx](src/renderer/src/components/settings/DownloadsCard.tsx))
+  now uses the same shared `SegmentedControl` (Video/Audio) + quality `Select` as the DownloadBar, so both
+  screens present one mental model. The combined `FORMAT_OPTIONS`/`kind|quality` string encoding is gone —
+  the toggle writes `defaultKind` and the dropdown writes `defaultVideoQuality`/`defaultAudioQuality` directly.*
+- [x] **L103 — Two busy-indicator patterns.** Fetch/Index swap the button icon to a `Spinner`; the
+  Settings check/update buttons keep their icon and render a *separate* adjacent `Spinner`.
+  *Resolved by L134 (Batch 8), verified this batch: every busy button swaps its own icon to a
+  `<Spinner size="tiny">` (Fetch/Index/Check-for-new/yt-dlp update/app-update/PO-mint/version-check); the only
+  remaining `<Spinner>`s are standalone status-row indicators (the "Fetching…"/"Waiting to start…"/indexing
+  rows), not a button + adjacent spinner. No separate-adjacent-spinner pattern survives.*
+- [ ] **L104 — History isn't virtualized.** It renders all filtered rows, while Downloads and Library use `VirtualList`.
+  *Deferred (bounded; needs the L161 layout rework + live verification): History is capped at 500 rows (L141),
+  so the un-virtualized render is bounded — not a real perf problem. Virtualizing it requires giving the list a
+  fixed-height internal scroll container (the same `height:100%`/`overflow` rework L161 flags as needing
+  live verification at multiple window sizes) *and* re-homing its container-level Ctrl+A and per-row Delete
+  keyboard handling onto the virtualized scroller. That's a layout+interaction change best done watched, so it
+  rides with L161 rather than shipping unattended for a list that's already capped.*
+- [x] **L105 — `MediaKind` declared twice.** In both [ipc.ts](src/shared/ipc.ts) and
+  [store/downloads.ts](src/renderer/src/store/downloads.ts); components import it from both. Single source it.
+  *Fixed: the store now imports `MediaKind` from `@shared/ipc` and re-exports it, so the duplicate local
+  `type MediaKind` is gone while existing `import { MediaKind } from '../store/downloads'` sites still resolve.*
+- [x] **L106 — Refresh icons used interchangeably.** `ArrowClockwiseRegular` (retry, re-download,
+  check-for-new, update-yt-dlp) vs `ArrowSyncRegular` (re-index, check-for-updates) for the same "redo/refresh" idea.
+- [x] **L107 — Spinner sizes mixed** — `"tiny"` almost everywhere, `"extra-tiny"` for the QueueItem queued row.
+- [x] **L108 — Main window sets no explicit `title`** (relies on the document `<title>`).
+- [ ] **L109 — Versions auto-load with no indicator.** yt-dlp/ffmpeg versions in About just appear;
+  only the manual "Check" button shows a spinner. *Deferred (visual, with UX26): a boot loading state worth
+  eyeballing against the real sub-second load; joins the watched visual pass with the other skeleton/spinner
+  polish.*
+- [x] **L110 — One muted-text token, many class aliases.** `colorNeutralForeground3` is re-declared as
+  `hint`/`sub`/`meta`/`srcSub`/`stats`/`count`/`emptyHint`/`previewMeta` across components. *Fixed: one
+  `useTextStyles().muted` in [ui/text.ts](src/renderer/src/components/ui/text.ts). Adopted for the pure-color
+  aliases in the list views (QueueItem `meta`, HistoryView `meta`, LibraryView `sub`/`srcSub`/`rowMeta`,
+  Sidebar `caption`, DownloadBar/PlaylistPanel `previewMeta`/`plItemMeta`) — the color is identical, so no
+  visual change. The combined classes (`stats`/`count`/`emptyHint`), the shared-across-cards settings `hint`,
+  CommandPalette, Onboarding, and the inline styles migrate incrementally (same pattern M12 used for errorText).*
+- [x] **L111 — Two helper-text mechanisms** — Fluent `Field` `hint` vs manual `<Caption1 className={hint}>`; SettingsView uses both.
+  *Resolved (convention clarified + verified): the two aren't interchangeable — Fluent `Field hint` is for help
+  associated with a specific control (announced via `aria-describedby`), and `<Caption1 muted>` is for
+  standalone card intros and status lines ("Saved to…", "No errors yet"). Control help already uses `Field
+  hint` uniformly, so the split is role-appropriate rather than an inconsistency.*
+- [x] **L112 — `Switch` labeling inconsistent.** Settings/DownloadOptionsForm show "On"/"Off" text;
+  Library switches use `aria-label` only (no visible state text). *Fixed: dropped the dynamic
+  `label={x ? 'On' : 'Off'}` from all 15 `<Field>`-wrapped switches (DownloadOptionsForm ×6 + settings cards
+  ×9). The Field already names each switch, and the toggle position + `aria-checked` convey state — so no
+  switch shows redundant On/Off text now, matching Library's inline switches.*
+- [x] **L113 — Tooltip ≠ aria-label.** The Fetch button's Hint says "Fetch formats / playlist" but its
+  `aria-label` says "Fetch formats or playlist" (DownloadBar). *Resolved by UX2: the Fetch button's Hint
+  tooltip and `aria-label` are now the same string ("Preview available formats (optional)"), so what a
+  sighted user sees on hover and what a screen reader announces match.*
+- [x] **L114 — Row titles use different components** — `Text` (QueueItem/History/Templates) vs `span` (Library) vs `Caption1` elsewhere.
+  *Fixed: `<Text>` is the one row-title component. Library's three `<span>` titles (`groupTitle`, `rowTitle`,
+  `srcTitle`) became `<Text>` — size-identical since Fluent's provider base font is already `fontSizeBase300`.
+  The duplicated semibold-ellipsis title style (QueueItem/HistoryView/DownloadBar `previewTitle`) is now the
+  shared `useTextStyles().title`.*
+- [x] **L115 — Equivalent row actions labeled inconsistently** — "Re-index" is icon+text; the
+  comparable "Retry"/"Remove"/"Re-download" are icon-only. *Resolved (convention verified + role-appropriate):
+  the two live in different UI contexts, and each context is internally consistent. **List-row item actions**
+  (QueueItem's Pause/Cancel/Retry/Remove/Open, History's Re-download/Open/Show/Remove) are icon-only with a
+  `Hint` tooltip + a ≥40px hit target — a compact, repeated-per-row affordance. **Card/toolbar actions** (the
+  Library source-detail row: Refresh/Remove/Download, the Downloads/History headers) are labeled icon+text —
+  a one-per-card toolbar where the label aids scanning. The former "Re-index" is the Library card toolbar's
+  "Refresh", correctly labeled alongside its siblings. No screen mixes the two within one context.*
+- [x] **L116 — Empty-state structure varies** — Downloads (icon + line), History (colored badge + line + sub-hint), Library (icon + line, no sub-hint).
+  *Fixed: one shared [EmptyState](src/renderer/src/components/ui/EmptyState.tsx) — a centered column with an
+  optional focal `icon` (a hero glyph or History's colored badge), a `Body1` message at normal foreground, and
+  an optional muted `hint`. Adopted by Downloads, History, and Library, so the three now share one structure
+  (History keeps its badge + hint; Downloads/Library pass a hero glyph). The per-view `empty`/`emptyHint`
+  styles are deleted.*
+- [x] **L117 — Terminal/error-log "empty" aren't centered blocks** like the other empty states (inline text instead).
+  *Fixed: both now render the shared `EmptyState` in its `compact` variant (smaller inset, for a placeholder
+  inside an already-populated screen). The Terminal log centers "No output yet." in the log box (a `logEmpty`
+  flex modifier); Diagnostics centers "No errors yet." — so both read as empty states rather than a stray line
+  of inline text.*
+- [x] **L118 — Cross-component focus via hardcoded id.** App focuses the URL field with
+  `document.getElementById('aerofetch-url')` — brittle coupling into DownloadBar's markup.
+  *Fixed: the DownloadBar registers a focuser for its own URL input (a local ref) in the nav store
+  (`registerUrlFocuser`); App calls `useNav.getState().focusUrlField()` on launch / "New download" instead of
+  querying the DOM by id ([nav.ts](src/renderer/src/store/nav.ts), [App.tsx](src/renderer/src/App.tsx),
+  [DownloadBar.tsx](src/renderer/src/components/DownloadBar.tsx)). The `id="aerofetch-url"` is gone — App no
+  longer reaches into DownloadBar's markup; the double-rAF (wait for mount/paint) stays so the focuser is
+  registered before it's called.*
+- [x] **L119 — "No items" copy varies** — "No … yet" (most) vs "Output will appear here." (Terminal) vs "No errors logged." (Diagnostics).
+- [x] **L120 — Fluent `Card` vs hand-styled `div` cards.** Only Settings/Onboarding use `<Card>`; every
+  other card surface is a bespoke styled `<div>`. *Resolved (convention documented + tokens applied):
+  static content cards (Settings cards, Onboarding) use Fluent `<Card>`; interactive & list-item surfaces
+  (the download bar, QueueItem, History/Library rows, the Library source card, the command palette) use the
+  Batch-6 tokenized surface recipe — `RADIUS.card`/`surface`, `ELEVATION`, `SPACE` padding on a styled `<div>`
+  — because Fluent's `Card` imposes its own internal padding/gap/interaction model that a custom row layout
+  fights. Forcing `<Card>` onto those would regress layout for no gain; the divergence L120 flags is now a
+  documented tier split, and the styled surfaces share the same radius/elevation tokens. (The larger "wrap
+  every recurring pattern" primitive work stays UI15's incremental track.)*
+- [x] **L121 — Raw scrim literal.** CommandPalette backdrop is `rgba(0,0,0,0.32)` (the only raw rgba in
+  the renderer), identical in light/dark — low contrast over a dark UI. *Fixed: `SCRIM` in tokens.ts aliases
+  Fluent's semantic `colorBackgroundOverlay` (the dialog scrim); the raw rgba is gone and the palette
+  separates more cleanly from a dark UI.*
+- [x] **L122 — "Checking…" indicated twice** — the Settings update button changes its label to "Checking…" *and* a separate Spinner renders beside it.
+- [x] **L123 — `Caption1` is overloaded** for hints, metadata, counts, and timestamps — one size doing four jobs.
+  *Resolved: the [ui/text.ts](src/renderer/src/components/ui/text.ts) header defines `Caption1`'s role as "small
+  secondary text" — hints/metadata/counts/timestamps are all that one role, now stated on purpose rather than by
+  accident (paired with the shared `muted` color for L110).*
+- [x] **L124 — `Body1` vs `Text` role overlap** — `Body1` appears only in empty states/onboarding/gate; `Text` carries titles; the split isn't principled.
+  *Resolved: the type-role convention in text.ts makes the split explicit — `Body1` = body copy (empty states,
+  onboarding prose, gated notices); `Text` = row/item titles. Current usage already follows it.*
+- [x] **L125 — Icon sizing has two syntaxes** — px strings (`fontSize: '20px'`) on icon *containers* vs numeric `fontSize={28}` on inline icons.
+  *Fixed: both syntaxes now single-source from `ICON` in tokens.ts (`fontSize={ICON.control}` on inline icons,
+  `` fontSize: `${ICON.control}px` `` on the few makeStyles containers) — no more divergent magic numbers.
+  Glyphs sized to a box rather than to this scale (brand/source tiles, the tiny `watchBadge` icon, thumbnail
+  placeholders) are documented exclusions and stay proportional.*
+- [x] **L126 — Uneven text truncation** — some titles/metas use `nowrap`+ellipsis, others wrap; no shared truncation utility.
+  *Fixed: a shared `useTextStyles().truncate` ([text.ts](src/renderer/src/components/ui/text.ts)) — single-line
+  clip with ellipsis + `minWidth:0` — sits alongside the existing `title` (which is `truncate` + semibold).
+  Adopted for the ad-hoc copies: Library `rowTitle`, the DownloadBar playlist `plItemTitle`/`plHeaderText`
+  (the header is now `title`), and the shared `Banner` content (UI19). `title` also gained `minWidth:0` so it
+  shrinks correctly in a flex row. (Remaining correct-but-inline truncations migrate to the util incrementally.)*
+- [x] **L127 — `Notification` sets no icon** — completion toasts used the default Electron icon though `getAppIconPath()` existed. *Fixed with W13 (cached `getAppIconImage()` passed as `icon` at both notification sites).*
+- [x] **L128 — Preview seed/mock data ships in production.** The `PREVIEW` runtime check can't be
+  tree-shaken, so each store's seed arrays + fake ticker are bundled into the Electron renderer.
+  *Fixed: the three preview seed arrays (`downloadSeed`, `sources` `seedSources`/`seedItemsBySource`,
+  `history` seed) are now gated on `import.meta.env.DEV && PREVIEW`. In the packaged renderer build
+  `import.meta.env.DEV` is statically `false`, so Rollup constant-folds `false && …` and dead-code-eliminates
+  the whole seed literal; the browser dev preview (`vite`, DEV `true`) still gets them. (The small `PREVIEW`
+  fake-ticker function stays — it's tied to the runtime flag and is a few lines; the bulky part was the data,
+  now dropped.)*
+- [x] **L129 — `Hint align` is silently ignored for left/right placements** yet callers still pass it.
+  *Fixed: `HintProps` is now a discriminated union — `align` is only accepted with `placement` `top`/`bottom`;
+  passing it with `left`/`right` is a compile error instead of a silent no-op. No caller needed changing (the
+  left/right hints already omit `align`).*
+- [x] **L130 — Error-string style is mixed** — internal errors are lowercase/no-period ("timed out",
+  "interrupted"); user-facing ones are capitalized with periods. Fine when interpolated, jarring if shown raw.
+  *Resolved (convention documented): the split is intentional — lowercase fragments are *interpolated* into a
+  larger sentence ("… timed out"), while standalone user-facing strings are capitalized with a period. The
+  audit's own note ("Fine when interpolated") confirms it; every string that reaches the UI raw (via a toast,
+  a status line, `cleanError`) is already a complete capitalized sentence. Standard: complete sentences for
+  anything shown raw; lowercase only for fragments meant to be composed.*
+- [ ] **L131 — Taskbar `error` state is ephemeral** — it's driven by live `error` items, so "Clear
+  finished" flips the red taskbar bar back to normal even though failures occurred (out of sync with the persisted error log).
+  *Deferred (arguably by-design, needs the live taskbar): the taskbar reflects the *live queue*, so clearing
+  finished items legitimately returns it to idle — the persisted record lives in Diagnostics. Whether the red
+  bar should linger after a clear is a debatable UX call best judged against the real Windows taskbar; left
+  for the watched Windows pass (with Batch 14/15).*
+- [x] **L132 — `clearProbe` + form-reset logic is duplicated** in DownloadBar (`onUrlChange`, `download`, `addPlaylist`).
+  *Fixed: a shared `resetForm()` in [useDownloadBar.ts](src/renderer/src/components/downloadBar/useDownloadBar.ts)
+  now owns the post-enqueue reset (URL + probe + the one-shot trim/schedule/advanced/incognito/options),
+  called by both `download()` and `addPlaylist()`. `clearProbe()` stays the lighter probe-only reset for
+  `onUrlChange`. Also fixes a latent inconsistency — `addPlaylist` previously left the trim/schedule/advanced
+  panels open after enqueuing.*
+- [x] **L133 — `Field` controls mix `aria-label` + visible `label`.** Many `Field label="X"` wrap a
+  `Select aria-label="X"`, so AT announces the name twice (extends M20 across DownloadOptionsForm).
+  *Fixed: the custom [Select](src/renderer/src/components/Select.tsx) is now `<Field>`-aware
+  (`useFieldControlProps_unstable`, `supportsLabelFor: true`), so a Field's visible label names the native
+  `<select>` via `htmlFor` and its hint associates via `aria-describedby`. Removed the now-duplicate
+  `aria-label` from every Field-wrapped select (DownloadOptionsForm ×4, AboutCard, AppearanceCard, CookiesCard
+  ×2, DownloadsCard, CustomCommandsCard). The two standalone selects — the download-bar quality picker and the
+  history type filter — keep their `aria-label`, since there's no Field to name them.*
+- [x] **L134 — Inconsistent disabled affordance for busy buttons.** Some stay enabled-looking with a
+  spinner icon (Fetch/Index) while others are `disabled` with adjacent text (Settings) — no single "busy" convention.
+  *Fixed: one busy convention — `disabled` while working + the button's own icon swaps to a `<Spinner
+  size="tiny">`. Fetch, Index, Check-for-new and the yt-dlp update button already did this; converted
+  AboutCard's version-check button off its separate adjacent spinner to match.*
+- [x] **L135 — `Textarea` vs `Input` for similar fields.** Trim uses a `Textarea`; the visually-similar
+  single-line fields use `Input` — fine, but the trim/schedule panels and the template form mix both with no shared field style.
+  *Resolved: verified role-appropriate — the trim field is genuinely multiline (time ranges "one per line",
+  `resize="vertical"`), so `Textarea` is correct there and `Input` for the single-line fields. Kept as-is; the
+  shared field styling is covered by the Fluent `<Field>` wrapper they all use.*
+
+*Round 6 (2026-06-29) — behavioral/logic edge cases:*
+
+- [x] **L136 — Incognito leaks outside history.** Even if the (unreachable, M6) private flag were set,
+  `download.ts` still writes failures to `errorlog.json` (title + URL) and shows the title in completion
+  notifications — the "private" promise covers only history. *Fixed: `incognito` now flows through
+  `StartDownloadOptions` to main (the renderer's launch path passes `item.incognito`), where main enforces
+  the full "no logging, no history, no cookies" promise: `logFailure` skips the errorlog write (and the
+  pre-spawn errorlog in [ipc.ts](src/main/ipc.ts) too), `notify` uses a generic outcome title and drops the
+  detail body so no title/URL lands in the Windows Action Center, and both cookie sources
+  (`--cookies`/`--cookies-from-browser`) are withheld so a private download can't be tied to the signed-in
+  identity. (M6 wired the toggle; this makes the promise true in main, not just the renderer.)*
+- [x] **L137 — Stuck 0% for unknown-size downloads.** `parseProgress` returns `progress: 0` when
+  `total_bytes`/`_estimate` are absent (livestreams, some sites), so the bar reads 0% the whole time
+  instead of an indeterminate state. *Fixed: `parseProgress` now sets `sizeUnknown: !totalBytes` on
+  `DownloadProgress`; the store threads it onto the item and `QueueItem` renders an indeterminate bar +
+  "Downloading…" (instead of a frozen 0%) when it's set, reusing the existing SR7 indeterminate path.*
+- [x] **L138 — Clipboard read on every window focus.** [useClipboardLink.ts](src/renderer/src/useClipboardLink.ts)
+  reads the full clipboard on each `focus` (and once on mount, possibly before `clipboardWatch` has
+  loaded — FALLBACK is `true`). Reading all clipboard text whenever focused may surprise privacy-conscious users.
+  *Fixed: the check now gates on the settings store's `loaded` flag as well as `clipboardWatch`, so the
+  clipboard is never read using the pre-load fallback (the mount-before-settings-load window); the effect
+  re-runs when `loaded` flips true, so a link copied before launch is still offered once the real setting
+  is known. (Per-focus reads were already gated on `clipboardWatch`; the privacy default itself is SR4.)*
+- [ ] **L139 — Auto-update vs concurrent spawn race.** `runStartupYtdlpAutoUpdate` can overwrite
+  `yt-dlp.exe` on launch while a deep-link/queued download spawns the same binary — a Windows
+  file-in-use/corrupt-spawn window.
+  *Deferred to the watched Batch 15 live pass: the fix (a spawn↔update interlock — hold spawns while the
+  update replaces the exe, and skip the update if a download is mid-spawn) is a timing-sensitive change to the
+  launch/spawn path that can only be validated by reproducing the race with a real launch-time update + a
+  queued download. The interlock flag itself is simple, but confirming it closes the window needs the live
+  session.*
+- [x] **L140 — Retry-during-teardown race.** `retry` reuses the same id; if the previous process's
+  `close` handler hasn't removed it from `active` yet, `startDownload` returns "already running" → markError.
+  *Fixed in [download.ts](src/main/download.ts): `cancelDownload`/`pauseDownload` now drop the item from
+  `active` synchronously (so a retry/resume's same-id spawn is never rejected by the stale entry), and the
+  doomed child's `close`/`error`/watchdog release the slot through a new `releaseActive(id, rec)` that only
+  deletes when that rec still owns the id — so a late teardown can't evict the fresh spawn. The transient
+  cookie jar is now keyed per spawn (`-${spawnSeq}`) so the old download's cleanup can't unlink the new one's
+  file. (with L148)*
+- [x] **L141 — Renderer history grows unbounded in memory.** `useHistory.add` prepends without a cap
+  while main caps `history.json` at 500; in a long session the in-memory list exceeds the persisted cap (resets on reload).
+  *Fixed in [store/history.ts](src/renderer/src/store/history.ts): `add` now `.slice(0, MAX_ENTRIES)` (500, the
+  same cap as main's `history.ts`) and de-dupes by `url` as well as `id`, so the optimistic in-memory list
+  matches what a reload would show (also aligns with main's M35 url de-dup).*
+- [ ] **L142 — IPC mutation return values are discarded everywhere.** history/templates/sources/settings
+  IPC calls return the authoritative (validated/capped/sanitized) state, but every renderer caller does
+  optimistic-only updates and ignores it — client and persisted state can silently diverge until reload (generalizes M34).
+  *Deferred (targeted, own PR): settings already reconcile (M34). Extending "apply the returned authoritative
+  state" to history/templates/sources touches each store's mutation path and each corresponding IPC return
+  shape, and the divergence it guards against is rare (only when main caps/sanitizes differently than the
+  optimistic update) and self-heals on reload. Best done as one focused reconciliation PR with each store
+  verified, not folded into this UX batch. Standard already recorded under CC14.*
+- [ ] **L143 — No in-window "quit anyway."** With a download active (or tray mode), closing only hides;
+  quitting requires the tray menu. If the tray ever fails to create, the only exit is Task Manager
+  (mitigated today by the embedded fallback tray icon).
+  *Deferred to the watched Batch 15 live pass: adding an in-window force-quit affordance (and deciding when to
+  show it) is a window-lifecycle change best verified against the real tray/close behavior at several window
+  states. Already mitigated by the embedded fallback tray icon, so it's low-urgency.*
+- [x] **L144 — Duplicate guard checks the queue only, not history.** Re-adding a URL downloaded earlier
+  (already cleared from the queue) gives no "already downloaded" hint (roadmap notes this as a possible extension).
+  *Fixed: the DownloadBar dup guard ([useDownloadBar.ts](src/renderer/src/components/downloadBar/useDownloadBar.ts))
+  now checks history when a URL isn't in the live queue — if it was downloaded before, the warning banner reads
+  "Already downloaded: …" (vs "Already in your queue: …"), with the same "Download anyway" confirm. A new
+  `dupInHistory` flag drives the wording.*
+- [x] **L145 — `useClipboardLink` re-offers a dismissed link after a tab switch.** `lastSeen` is
+  per-hook-instance; switching Downloads↔Library remounts it, so a previously-dismissed clipboard link is offered again.
+  *Fixed: `lastSeen` is now a module-level variable (not a per-instance `useRef`), so a dismissed/accepted
+  clipboard link stays suppressed across hook remounts. Only one field is mounted at a time (tab switch), so
+  there's no cross-field contention.*
+- [x] **L146 — `parseTrimSections` accepts malformed multi-colon times.** The `\d+(?::\d{1,2})*` pattern
+  passes tokens like `1:2:3:4-5:6:7:8`, which then reach yt-dlp's `--download-sections` and fail there
+  rather than being rejected up front.
+- [x] **L147 — macOS branches in a Windows-only app.** `app.on('activate')` and the
+  `process.platform !== 'darwin'` guard in `window-all-closed` are dead on Windows — boilerplate that implies multi-platform support the app doesn't ship.
+- [x] **L148 — `clearFinished`/remove can free a slot before the killed process exits.** Removing a
+  just-canceled item lets `pump()` launch into the "freed" slot while `taskkill` is still tearing down the prior tree — a brief window over the concurrency cap.
+  *Fixed with L140: `cancelDownload`/`pauseDownload` release the `active` slot the instant they issue the kill
+  (rather than on the async `close`), so main's concurrency accounting matches the renderer immediately — the
+  just-promoted next item is neither falsely rejected by the maxConcurrent guard nor run over the cap while the
+  prior tree dies.*
+
+*Round 7 (2026-06-29) — copy, a11y patterns & micro-behavior:*
+
+- [x] **L149 — Hint length wildly inconsistent.** Most field hints are one short line, but "Keep running
+  in the tray" is a three-sentence paragraph with a parenthetical. Normalize hint length/voice. *Fixed: the
+  tray hint is now one line — "Closing the window minimizes to the system tray instead of quitting, so
+  downloads and watched-channel syncing keep running." — matching the one-line voice of its sibling hints.*
+- [x] **L150 — "PO token" capitalization varies** — `PO Token` (ipc.ts/ROADMAP) vs `PO token` /
+  `Proof-of-Origin token` (SettingsView). Pick one.
+- [x] **L151 — Mixed range dashes.** En-dash in prose ("2–3 is a good balance") vs hyphen in time-range
+  placeholders ("1:30-2:00"). Choose one convention.
+- [x] **L152 — Search-field sizing differs per screen.** History `minWidth 180 / maxWidth 320`, Settings
+  inline `width: 100%`, DownloadBar `flexGrow`. No shared search-input width. *Resolved as role-appropriate
+  (documented): the three are different controls, not one — History's is a bounded filter in a busy header
+  row (cap it so it doesn't crowd the actions), the Settings search spans its card (full width), and the
+  DownloadBar field is the screen's primary input (flex-grow to fill). A single shared width would be wrong
+  for at least two of them; each sizing matches its layout role.*
+- [x] **L153 — Generic "Dismiss" aria-labels.** Three close buttons (DownloadBar suggestion + dup,
+  Library suggestion) all read just "Dismiss" — ambiguous to a screen reader. Name what's dismissed.
+- [x] **L154 — Instructional text in an aria-label.** Sidebar theme-cycle button is
+  `aria-label="Theme: Dark. Click to change."` — "Click to change" is UI instruction, not a name.
+- [x] **L155 — Accent swatches aren't a `radiogroup`.** They're a single-select set rendered as plain
+  buttons with `aria-pressed`, while the Theme controls (also single-select) use `role="radiogroup"`/`radio`.
+  Inconsistent single-select a11y pattern. *Fixed: the accent swatches are now a real `role="radiogroup"` with
+  `role="radio"` + `aria-checked` swatches, roving tabindex, and ←/→/↑/↓/Home/End arrow-key navigation +
+  the shared focus ring ([AppearanceCard.tsx](src/renderer/src/components/settings/AppearanceCard.tsx)) —
+  matching the `SegmentedControl` radiogroup pattern used elsewhere. The redundant "(selected)" text in the
+  `aria-label` is gone (aria-checked conveys it).*
+- [x] **L156 — `datetime-local` schedule has no `min`.** Past times are selectable, then silently download
+  now (extends L57). Add `min={now}`.
+- [x] **L157 — `removeSource` doesn't cancel in-flight downloads.** Removing a source while its videos are
+  downloading lets them finish into the removed source's folders; `markDownloaded` then no-ops on the gone item.
+  *Fixed: `removeSource` now emits a `sourceRemoved` event on the coordinator bus (C2); the downloads store
+  subscribes and cancels every active (downloading/queued) item whose `mediaItemId` starts with `${sourceId}:`
+  — MediaItem ids are `${sourceId}:${videoId}` (indexerCore), so the prefix reliably identifies the source's
+  downloads. Reuses the proven `cancel()` path (process kill + pump). **Live-smoke pending** (per the
+  mark-done convention): implemented + type/lint/test-green, but the actual process-kill-on-remove is worth a
+  watched confirm in the Batch 15 live pass.*
+- [x] **L158 — Drag highlight flickers.** `onDragLeave={() => setDragActive(false)}` fires when the cursor
+  crosses child elements (no enter/leave depth counter), so the dashed-outline blinks during a drag.
+  *Fixed: [useDownloadBar.ts](src/renderer/src/components/downloadBar/useDownloadBar.ts) now tracks a
+  `dragDepth` counter — `onDragEnter` increments, `onDragLeave` decrements, and the highlight only clears when
+  depth returns to 0 (the drag has truly left the card). `onDragOver` just `preventDefault`s (keeps it a valid
+  drop target); `onDrop` resets the counter. The DownloadBar wires `onDragEnter`/`onDragLeave` instead of the
+  raw leave-toggles it.*
+- [x] **L159 — Dead fallback branch.** `copyErrorReport` falls back to "No errors logged." but its button
+  is disabled when there are no entries, so the fallback is unreachable.
+- [x] **L160 — One-off inline margins.** `marginTop` literals (Onboarding 2px, QueueItem 4px, SettingsView
+  8px) instead of style classes (extends L5). *Fixed: the margin literals now draw from `SPACE`
+  (`hairline`/`xtight`/`tight`) — same values, one source. (The broader inline-`style` vs makeStyles split is
+  still L5.)*
+- [ ] **L161 — `height: 100%` screens inside a padded scroll container.** Downloads/Terminal set
+  `height: 100%` while App's `<main>` is `overflowY: auto` + 24/28px padding — a fragile coupling that can
+  double-scroll or misalign the virtualized list's viewport. *Deferred (layout, needs live verification): it
+  works today (the virtualized queue scrolls correctly), and reworking the `<main>` scroll/height contract is
+  a layout change best validated with the app open at several window sizes — a watched pass, not an unattended
+  edit.*
+- [ ] **L162 — Per-thumbnail store subscription.** Every `MediaThumb` calls `useResolvedDark()` (two store
+  subscriptions) instead of receiving a resolved theme prop — N subscriptions per list. *Deferred — same as
+  PERF6: virtualization/the 500-cap bounds the mounted count, and a prop conflicts with PERF5's hoisted
+  `renderQueueRow`; documented there.*
+- [x] **L163 — QueueItem makes 9 separate `useDownloads` selector calls** instead of one destructured
+  selection — repeated boilerplate per row. *Fixed: one `useShallow` selection replaces the 10 individual
+  subscriptions in [QueueItem.tsx](src/renderer/src/components/QueueItem.tsx) (the actions are stable, so the
+  shallow compare never re-renders the row).*
+
+*Round 8 (2026-06-29) — formatting micro-inconsistencies:*
+
+- [x] **L164 — Metadata separator glyph/spacing is inconsistent.** Meta lines join with `'  •  '`
+  (2-space bullet) in QueueItem/History/DownloadBar/DownloadsView, with `' · '` (1-space midd·dot) in
+  LibraryView, and with `' • '` (1-space bullet) in QueueItem's "Paused • 42%". Three styles for one role.
+  **Standard:** one separator constant (glyph + spacing). *Fixed: one `META_SEP = ' • '` in tokens.ts, adopted
+  at every meta-line join (QueueItem/History/DownloadBar/DownloadsView/Library/PlaylistPanel). The `' · '`
+  inside compound quality labels ("720p · mp4 · 184 MB") is a data format parsed by HistoryView and is
+  intentionally left as-is.*
+- [x] **L165 — The two byte/speed formatters round differently.** `download.ts fmtBytes` uses
+  `toFixed(v >= 100 ? 0 : 1)` ("512 MB") while `queueStats formatSpeed` uses `toFixed(1)` ("512.0 MB/s") —
+  visibly different precision for the same magnitudes (compounds the duplicate-formatter issue H2/M9).
+- [x] **L166 — ETA has no hour rollover.** `fmtEta` (download.ts/downloads.ts) and `formatEta`
+  (queueStats) emit `M:SS` only, so a 2-hour ETA renders as **"120:00"**, whereas `fmtDuration`
+  (indexerCore) correctly rolls to `H:MM:SS`. Unify on the hour-aware format.
+- [x] **L167 — `PROGRESS_TEMPLATE` is exported but used only inside `buildArgs.ts`** — a superfluous
+  public export (download.ts parses the `prog|` lines independently). Make it module-private.
+
+*Round 9 (2026-06-29) — type-safety & build config:*
+
+- [x] **L168 — `noUncheckedIndexedAccess` is off.** Array/index/tuple access is typed as always-defined,
+  so the exact edge cases already filed compile clean: the `split('|') as [MediaKind, string]` cast
+  (L91/CL2) and `parseProgress`'s positional destructure of a possibly-short `split('|')`. Enabling it
+  would surface them at build time.
+- [x] **L169 — `noFallthroughCasesInSwitch` is off.** The large `setSettings` switch and `applyEvent`
+  switch aren't fallthrough-guarded; a missing `break`/`return` wouldn't be caught.
+- [x] **L170 — No source maps in production.** `sourceMap: false` (toolkit) and no `build.sourcemap` in
+  `electron.vite.config.ts`, so field crash stack traces are unmapped — combined with no logging (CC8/M29),
+  diagnosing a user-reported crash is very hard. Consider hidden/external source maps. *Fixed:
+  `build.sourcemap: 'hidden'` on all three bundles (main / preload / renderer) in
+  [electron.vite.config.ts](electron.vite.config.ts) — `.map` files are emitted for offline symbolication
+  of the raw stacks the logger now records (CC8), with no `sourceMappingURL` reference in the shipped bundle.*
+- [x] **L171 — `main.tsx` mock drift.** The preview mock's version strings disagree
+  (`getAppVersion`→'0.4.0-preview' vs `checkForAppUpdate.currentVersion`→'0.4.0'), and its `setSettings`
+  skips the real validation/sanitization — so the browser preview can accept settings the app rejects,
+  masking M34-class issues during design. *Fixed the version drift: one `MOCK_CURRENT_VERSION` constant in
+  [mockApi.ts](src/renderer/src/mockApi.ts) now backs both `getAppVersion` and
+  `checkForAppUpdate.currentVersion`, so they agree (kept below the mock "latest" so the updater card still
+  demos an available update). The `setSettings`-skips-validation point is left as-is on purpose: the mock is a
+  browser-only design aid with no access to main's `settings.ts` validators; replicating them in the mock
+  would be a second source of truth to drift. M34/M24 already make the real app authoritative, so the design
+  preview being permissive doesn't affect shipped behavior.*
+- [x] **L172 — `skipLibCheck: true`** (toolkit) hides type errors in dependency `.d.ts` files — standard
+  practice, low risk, noted for awareness (a dep type regression won't fail typecheck). *Acknowledged —
+  kept as-is (it IS standard practice and speeds typecheck); recorded so the trade-off (a dependency
+  `.d.ts` regression can pass typecheck silently) is a known, accepted decision rather than an oversight.*
 
 ---
 
-#### M3 — Release polish: app icon
+## UI consistency
 
-**File:** [electron-builder.yml:48](electron-builder.yml)  
-**Severity:** Cosmetic  
-**Status:** Placeholder done — 2026-06-23; a *designed* asset is still wanted before v1.0
+Cross-screen review (Downloads, Library, History, Terminal, Settings, Onboarding, Command palette,
+Sidebar, cookie sign-in window). Each item: what's inconsistent → **Standard:** the single rule to
+adopt. Items prefixed `UI`; where a dimension was already filed, the existing ID is referenced
+instead of re-filing. The app uses Fluent tokens well (theme-awareness is mostly solid); the gaps
+are an undefined spacing/radius/type scale and a drift between Fluent components and hand-rolled ones.
 
-**Description:**  
-The `icon:` line was commented out pending a final icon asset, so builds fell back to the default Electron icon. Bundled binaries are correctly handled (graceful "not found" errors everywhere).
+### Layout, spacing & width
 
-**Fix (done — placeholder):**  
-Added [build/icon.svg](build/icon.svg) — a white download glyph on the teal brand square, mirroring the in-app brand mark ([Onboarding.tsx](src/renderer/src/components/Onboarding.tsx)) — and rasterised it to a multi-size [build/icon.ico](build/icon.ico) (256/128/64/48/32/16) via ImageMagick. The `win.icon` line is now uncommented. Regenerate with:
-```
-magick -background none build/icon.svg -define icon:auto-resize=256,128,64,48,32,16 build/icon.ico
-```
-**Still open:** swap the placeholder for a professionally designed icon before cutting v1.0.
+- [x] **UI1 — No shared content width.** SettingsView is `maxWidth: 640px` ([SettingsView.tsx](src/renderer/src/components/SettingsView.tsx)),
+  but Downloads/Library/History/Terminal are full-width; Onboarding card is 460px, CommandPalette
+  560px. On a wide window Settings is a narrow column while siblings stretch edge-to-edge.
+  **Standard:** one reading-width token (e.g. 720px) applied by a shared `Screen` wrapper, or commit to full-width everywhere.
+- [x] **UI2 — Per-screen vertical rhythm differs.** Root section gap is 16 (Settings/Terminal), 20
+  (Downloads), 18 (Library), 12 (History). **Standard:** a single section-gap (16px) via a shared screen wrapper.
+  *Fixed: all five view roots now use `SPACE.section` (16) — Downloads 20→16, Library 18→16, History 12→16;
+  Settings/Terminal were already 16 and are now tokenized.*
+- [ ] **UI3 — Card padding has no scale.** 14 (QueueItem) / 16 (DownloadBar) / 20 (Settings card) /
+  32 (Onboarding) / `10px 12px` (History row) / `12px 14px` (Library head) / `8px 10px` (template row).
+  **Standard:** a padding scale (e.g. control 8–10, list-row 12, card 16, hero 24) keyed to surface tier.
+  *Implemented (SPACE scale defined; the card tier unified to 16 — QueueItem 14→16, Settings cards 20→16;
+  DownloadBar already 16; Onboarding → `hero`) but **left unchecked for a watched visual pass**: 20→16 tightens
+  the 11 settings cards and 14→16 loosens queue rows. The smaller list-row/control paddings (History/Library
+  head/template) are not yet migrated. Eyeball, then check off or retune the card value.*
+- [x] **UI4 — Asymmetric app content padding.** `padding: '24px 28px'` ([App.tsx](src/renderer/src/App.tsx)) —
+  28px horizontal appears nowhere else. **Standard:** symmetric or scale-based padding. *Fixed: the `<main>`
+  content padding is now the symmetric `SPACE.page` (24px).*
+- [x] **UI5 — Action-cluster gaps split 4px vs 8px.** Icon-button rows use 4px (QueueItem/History/
+  TemplateManager) but DownloadBar/Library action rows use 8px. **Standard:** 4px for icon-button groups, 8px for labelled-control rows. *(Good baseline already: every empty-state uses `56px 16px` — keep it.)*
+  *Resolved: the existing split already matched the standard; it's now named in `SPACE` (`xtight` = 4 for
+  icon-button clusters, `tight` = 8 for control rows) and adopted where touched, so the rule is explicit
+  rather than incidental.*
+
+### Corner radius
+
+- [x] **UI6 — Thumbnail radius varies for the same element.** QueueItem `Large`, History `Medium`,
+  Library rowThumb `Small`, DownloadBar previewThumb `Medium`. **Standard:** one thumbnail radius (Medium/10px). *(Distinct from L9, which is thumbnail pixel dimensions.)*
+  *Fixed: every thumbnail uses `RADIUS.control` (Medium) — QueueItem Large→Medium and Library rowThumb
+  Small→Medium; History/DownloadBar were already Medium and are now tokenized.*
+- [x] **UI7 — Card radius (XLarge vs Large) has no stated rule.** Top-level cards use XLarge (16),
+  list rows Large (12), but it's applied by feel. **Standard:** document surface tiers — page-card XLarge, list-item Large, control Medium — and apply uniformly.
+  *Fixed: `RADIUS` documents the tiers (`card` XLarge / `surface` Large / `control` Medium) and they're
+  applied on the surfaces touched this batch (page cards → `card`, the QueueItem list-item → `surface`,
+  thumbnails/controls → `control`); remaining correct-but-untokenized `borderRadius*` calls migrate incrementally.*
+- [x] **UI8 — Circular shapes mix token and literal.** `borderRadiusCircular` (Library pill/watchBadge)
+  vs literal `'50%'` (SettingsView swatch, History emptyBadge). **Standard:** always the token.
+
+### Typography
+
+- [x] **UI9 — Screen titles are inconsistent.** Most screens use `<Subtitle2>` (Downloads "Queue",
+  Library, Terminal, Settings cards); Onboarding uses `<Title2>`; **History has no title at all**
+  (just a count). **Standard:** one page-title style on every screen.
+- [x] **UI10 — Only Library has a screen subtitle/description.** Others jump straight to content.
+  **Standard:** a consistent header block (title + optional one-line description).
+- [x] **UI11 — Semantic type ramp vs ad-hoc px.** Sidebar `brandName`/`navItem` and Library
+  `watchBadge`/`pill` set raw `fontSizeBaseXXX`; `sectionIcon`/`mark` use literal `'20px'`/`'26px'`.
+  **Standard:** Fluent type components/tokens; no literal px font sizes. *Fixed: no literal px font sizes
+  remain — the last tile/badge glyphs snap to `ICON` tiers (Sidebar mark 20, Onboarding mark 24, Library
+  srcIcon 20, History emptyBadge 24). The `fontSizeBase*` usages already met the standard (they're tokens, on
+  interactive `<button>`/pill elements that can't be Fluent type components). The four ≤2px tile-glyph deltas
+  join UI12's watched visual pass.*
+
+### Icons
+
+- [ ] **UI12 — No icon-size scale.** Inline `fontSize` of 11/14/16/18/20/22/26/28/40 is scattered
+  across components. **Standard:** a small set (16 inline / 20 control / 24 section / 40 empty-state).
+  *Implemented (`ICON` = 16/20/24/40, all four tiers in use; standalone chrome glyphs migrated) but **left
+  unchecked for a watched visual pass** because a few glyphs shift: the former-18px chrome icons (sidebar nav +
+  theme toggles, IconButton md) → 20 (control), the settings card-header icons 20→24 (section), and the private
+  badge 14→16. Box-proportional glyphs (brand/source tiles, `watchBadge` 11px, thumbnail placeholders 22/28)
+  are documented exclusions and unchanged. Eyeball the 18→20 / 20→24 / 14→16 deltas.*
+- [x] **UI13 — Regular vs Filled weight mixed for one concept.** `ArrowDownloadRegular` (nav, buttons)
+  vs `ArrowDownloadFilled` (brand mark). **Standard:** one weight per concept (Filled only for brand/emphasis).
+  *Verified: `ArrowDownloadFilled` appears only on the two brand marks (Sidebar, Onboarding); every other
+  download arrow (nav, buttons, `contentBefore`) is `ArrowDownloadRegular`. The convention already held — the
+  only Filled glyphs elsewhere are the status Checkmark/Error circles, which are deliberate state emphasis.*
+
+### Buttons & controls
+
+- [x] **UI14 — Two hand-rolled segmented controls.** DownloadBar kind toggle (`segment`, padding
+  `7px 16px`) and Sidebar theme toggle (`themeSeg`, padding `7px 4px`) are separate implementations
+  with different padding/markup. **Standard:** one shared `SegmentedControl`.
+- [x] **UI15 — Raw `<button>`s alongside Fluent `<Button>`.** Sidebar navItem/iconBtn/themeSeg,
+  DownloadBar segment/plKindBtn, CommandPalette item, and Library `groupHead` (a `role="button"` div)
+  are bespoke. **Standard:** wrap recurring patterns so hover/focus/disabled are uniform (ties to L5/M15).
+- [ ] **UI16 — Button size hierarchy isn't applied uniformly.** DownloadBar `large`; Library "Index"
+  `large` but its toolbar `small`; History all `small`; Settings mostly default. **Standard:** size-by-role (screen primary = large; secondary = medium; row actions = small).
+  *Convention documented (screen-primary large · row/toolbar small · settings default/medium); current usage
+  already broadly follows it. **Left unchecked** — the specific per-screen size tweaks are a subjective visual
+  call, so they join the watched visual pass (with UI3/UI12).*
+- [x] **UI17 — `appearance="secondary"` used in only two spots** (Library "Check for new", Terminal
+  "Stop") while every other non-primary button is `subtle`. **Standard:** pick subtle *or* secondary as the standard non-primary appearance.
+  *Fixed: both switched to `subtle` (the app's standard non-primary appearance — used by every other
+  non-primary button).*
+- [x] **UI18 — Two status-chip systems.** QueueItem uses Fluent `Badge`; LibraryView uses custom
+  color `pill` spans for the same item-status concept (and labels differ — see M8). **Standard:** one shared status-chip component + label map.
+- [x] **UI19 — Suggestion-banner CSS duplicated.** Identical `suggestion`/`suggestionText` styles in
+  DownloadBar and LibraryView. **Standard:** a shared `LinkSuggestion` component (also kills drift).
+  *Fixed: a shared [Banner](src/renderer/src/components/ui/Banner.tsx) (leading icon + truncating/`wrap`
+  content + trailing actions, `tone` = brand/warning) and a [LinkSuggestion](src/renderer/src/components/ui/LinkSuggestion.tsx)
+  built on it. The DownloadBar's copied-link suggestion and the Library's are now one `<LinkSuggestion>`; the
+  DownloadBar's channel/playlist nudge (`wrap`) and duplicate warning (`tone="warning"`) reuse the base
+  `Banner`. Five hand-rolled style blocks (`suggestion`/`suggestionText`/`channelHint`/`channelHintText`/
+  `dupRow`) are deleted — the tint/padding/radius are identical, so no visual change.*
+
+### Colors & selection
+
+- [x] **UI20 — "Selected/active" styling is split.** Solid brand (`colorBrandBackground` +
+  on-brand text) for DownloadBar/Sidebar segments, but brand-tint (`colorBrandBackground2` +
+  `colorBrandForeground2`) for Sidebar nav, CommandPalette item, Library pill. **Standard:** one active treatment per control class.
+  *Resolved (rule named + verified): one active treatment **per control class** — **toggles** (the shared
+  `SegmentedControl`, used by both the DownloadBar kind toggle and the Sidebar theme switch after UI14) use
+  **solid brand**; **selection within a list** (Sidebar nav item, CommandPalette active option) uses
+  **brand-tint**. Each class is now internally consistent, and the rule is documented on
+  [SegmentedControl](src/renderer/src/components/ui/SegmentedControl.tsx). The "Library pill" the item cited is
+  gone — UI18 replaced it with the shared `StatusChip`, so there's no third treatment left to reconcile.*
+- [ ] **UI21 — Sidebar active-nav rail is expanded-only.** The inset brand box-shadow shows only when
+  expanded; collapsed relies on tint alone. **Standard:** a consistent active indicator in both states.
+  *Deferred (subjective visual): whether the collapsed rail needs its own inset indicator (and how it reads
+  against the new active-download `CounterBadge` added in Batch 11) is an eyeball call; joins the watched
+  visual pass. The tint already marks the active item in both states.*
+- [x] **UI22 — Brand-icon tiles differ.** `mark` (on-brand on solid brand) vs `srcIcon`
+  (brandForeground2 on brand-tint) vs `sectionIcon` (compoundBrand, no tile). **Standard:** a defined icon-emphasis set.
+  *Resolved (the set is now defined + documented): three deliberate emphasis levels — **brand mark** (`mark`,
+  on-brand glyph on solid brand: the app/onboarding identity, highest emphasis), **entity tile** (`srcIcon`,
+  brandForeground2 on brand-tint: a Library source, medium), and **section glyph** (`sectionIcon`,
+  compoundBrand, no tile: a settings-card header, lowest). They *should* differ — one per role; the levels are
+  now named rather than incidental, and each is applied consistently.*
+
+### Dialogs, menus, status, navigation
+
+- [ ] **UI23 — Fragmented overlay/dialog system.** Native OS dialogs (pickers, backup save/open,
+  backup warning `messageBox`), one custom React overlay (CommandPalette), a full-screen view
+  (Onboarding), and an **unstyled separate `BrowserWindow`** (cookie sign-in) that shows none of the
+  app's theme/chrome. **Standard:** keep native for file/confirm; unify in-app overlays under one
+  themed primitive; theme the sign-in window's title/background to match.
+  *Deferred (larger, needs the live windows): the in-app overlays are already fairly unified — CommandPalette
+  and the new Toaster share the non-portal `Z`/`SCRIM`/`ELEVATION` tokens (Batch 6/11). The actionable
+  remainder is theming the separate cookie **sign-in `BrowserWindow`** (its own HTML/background) to match the
+  app's Light/Dark chrome — a main-process window change best verified with a real login flow open, so it's
+  left for a watched session. Native file/confirm dialogs stay native by design.*
+- [x] **UI24 — No context menus anywhere.** Every row exposes actions only as inline buttons;
+  right-click does nothing on any screen, despite many per-row actions that conventionally also live on
+  right-click. **Standard:** add consistent right-click menus mirroring row actions, or note "none by design."
+  *Resolved as "none by design" (documented): every row action is already a visible inline button with a
+  tooltip, and lists support keyboard operation (Delete, Ctrl+A). Fluent's `Menu` is **portal-based**, and
+  this app deliberately avoids portal overlays — they blank/flicker on the dev-machine GPU (the same reason
+  Select/CommandPalette/Toaster are hand-rolled non-portal; see the gpu-flicker note). A hand-rolled
+  non-portal context-menu primitive is a sizable build with little to add over the always-visible actions, so
+  right-click menus are intentionally not provided. Revisit if the GPU/portal issue is resolved.*
+- [x] **UI25 — No in-app global status surface.** Queue progress shows only on the Downloads tab's
+  summary strip; on any other tab there's no in-app sign downloads are running (only the OS taskbar).
+  **Standard:** a persistent affordance (e.g. a sidebar "Downloads" badge with the active count).
+  *Fixed (with UX9): a `CounterBadge` on the sidebar Downloads nav item shows the active (downloading +
+  queued) count from every tab, and a new in-app toast surface covers transient status. The exact
+  suggested affordance.*
+
+### Animations & transitions
+
+- [x] **UI26 — Lone animation.** Only the sidebar width transitions (`0.15s ease`); tab switches,
+  panel expand/collapse, banners, and Library card expansion are all instant. **Standard:** one motion
+  policy — either add subtle, consistent transitions (gated on `prefers-reduced-motion`) or drop the sidebar one.
+  *Fixed (policy established): the sidebar transition now uses the shared `MOTION` timing (durationFast +
+  curveEasyEase), and a global `@media (prefers-reduced-motion: reduce)` rule in base.css disables every
+  transition/animation for users who ask for less. New transitions adopt `MOTION`; none were added
+  speculatively (compositing overlays flicker on the dev GPU — see the gpu-flicker note).*
+
+### Hover, focus, disabled, keyboard & accessibility
+
+- [x] **UI27 — Command palette uses JS hover, not CSS.** Items highlight via `onMouseEnter` setting
+  `itemActive` (no `:hover`), unlike every other list, and expose no `aria-selected`/active-descendant,
+  so the highlight is invisible to screen readers. **Standard:** CSS `:hover` + listbox/option semantics.
+  *Fixed in [CommandPalette.tsx](src/renderer/src/components/CommandPalette.tsx): the input is now a
+  `role="combobox"` with `aria-controls`/`aria-activedescendant`/`aria-autocomplete="list"`, the list is a
+  `role="listbox"`, and each row is a `role="option"` with `aria-selected` — so the active row is announced
+  to Narrator via active-descendant (the standard combobox pattern; focus stays on the input, so the rows
+  became non-focusable `div`s rather than `button`s). `onMouseEnter` is kept deliberately: it unifies the
+  pointer and keyboard highlight onto one `sel` state, which — now that `aria-activedescendant` tracks it —
+  is more correct than a pure CSS `:hover` (which wouldn't move the announced selection).*
+- [x] **UI28 — Command palette input has no focus ring.** The search `<input>` sets `outline: 'none'`
+  with no replacement. **Standard:** a visible focus ring (Fluent stroke token). *(a11y)*
+- [x] **UI29 — Fragmented focus treatment.** Fluent ring (Fluent controls) vs custom border (Select)
+  vs removed (palette input) vs UA default (Sidebar buttons, segments, and Library `cardHead`/`groupHead`
+  which are `role="button" tabIndex=0` with **no `:focus-visible`** → invisible keyboard focus).
+  **Standard:** one focus-ring style on all interactive elements, custom and native. *(a11y; extends L14)*
+- [x] **UI30 — Hand-rolled radiogroups aren't arrow-navigable.** DownloadBar kind and Sidebar theme
+  use `role="radiogroup"`/`radio` but implement click only — no ←/→ roving focus a radiogroup implies.
+  **Standard:** roving-tabindex arrow keys, or Fluent's RadioGroup. *(a11y)*
+- [x] **UI31 — `Select` can't be disabled.** The native-`<select>` wrapper exposes no `disabled` prop,
+  so that control can't show a disabled state while Fluent controls can. **Standard:** add `disabled` + styling.
+  *Fixed in [Select.tsx](src/renderer/src/components/Select.tsx): a `disabled` prop passes through to the
+  native `<select>` and applies a disabled style (disabled foreground/background/stroke tokens + `not-allowed`
+  cursor, hover suppressed) so it reads like a disabled Fluent control.*
+- [x] **UI32 — Native-control dark mode is uneven.** The DownloadBar `datetime-local` sets
+  `colorScheme: 'light dark'` explicitly; the `Select` relies on the root `colorScheme`. **Standard:** set `colorScheme` consistently on both.
+  *Fixed in [downloadBar/styles.ts](src/renderer/src/components/downloadBar/styles.ts): dropped the explicit
+  `colorScheme: 'light dark'` on the `datetime-local` so it inherits the resolved in-app scheme set on the app
+  root (App.tsx) — the native calendar popup now follows the app's Light/Dark theme, consistent with the
+  native `<Select>`, rather than tracking the OS preference.*
+- [x] **UI33 — No semantic headings.** Titles render as `Subtitle2`/`Title2` (styled spans), so there's
+  no h1–h6 hierarchy for screen-reader heading navigation (landmarks `<nav>`/`<main>` exist; headings
+  don't). **Standard:** render titles as real headings (`as="h1"`/`"h2"` or `role="heading" aria-level`). *(a11y)*
+  *Fixed by rendering the Fluent typography titles as real headings (the `as` prop keeps the visual ramp):
+  the shared [ScreenHeader](src/renderer/src/components/ui/Screen.tsx) title is now `<Subtitle2 as="h1">`,
+  giving every screen (Downloads, History, Library, Settings, Terminal) one `h1` in one place; the
+  DownloadsView "Queue (N)" and all 11 settings cards are `<Subtitle2 as="h2">` sections beneath it; and the
+  Onboarding "Welcome" title is `<Title2 as="h1">`. A minimal `h1–h6` margin reset in
+  [base.css](src/renderer/src/assets/base.css) zeroes the UA heading margin (Fluent's typography classes
+  out-specify the element selector, so the visual ramp is unchanged) so the layout matches the former spans.*
+
+### Top cohesion-breakers (the "not one product" shortlist)
+
+1. **Status chips** — Fluent `Badge` (Downloads) vs custom color pills (Library) for the same concept (UI18, M8).
+2. **Segmented controls** — two separate hand-rolled versions (UI14).
+3. **Buttons** — Fluent `<Button>` vs many bespoke `<button>`s with divergent hover/focus (UI15, UI29).
+4. **Content width** — Settings is a 640px column; every other screen is full-width (UI1).
+5. **Focus rings** — four different focus treatments incl. one removed and several invisible (UI28–UI29).
+6. **Screen headers** — Subtitle2 / Title2 / none (UI9–UI10).
 
 ---
 
-## Preserved Strengths (Continue)
+## UX review (first-run perspective)
 
-The following approaches are correct and should be maintained:
+Walking the app as a new user. Ranked by severity. `UX` IDs; existing IDs referenced where the
+root cause is already filed.
 
-- **`assertHttpUrl` at every entry** (url.ts, probe.ts, download.ts, cookies.ts, deeplink.ts): consistent, belt-and-suspenders defense against argument injection
-- **`--` terminator** before the URL in all spawned commands: ensures URL is never read as a flag
-- **`reveal.ts` extension allowlist** (media + subtitle sidecars only): prevents arbitrary-file execution via compromised renderer
-- **Process-tree kill on cancel** (`taskkill /T`): correctly cleans up spawned ffmpeg child
-- **Separate cookie partition** for login: prevents the login page from accessing app session data
-- **`spawn`/`execFile` without `shell: true`**: avoids shell-injection vulns like `%COMSPEC%` CVEs
-- **Type-validated settings writes** before persistence: prevents malformed values reaching the store
-- **Comprehensive unit tests** for `buildArgs` logic, including the gnarly ffmpeg crop-quoting case
+### High — core-flow friction
+
+- [x] **UX1 — Per-download options are unreachable; you must change global Settings for one video.**
+  The DownloadBar exposes only URL · Video/Audio · quality · Trim · Schedule. There is **no**
+  per-download post-processing panel, custom-command panel, command preview, or incognito toggle —
+  so `DownloadItem.options`/`extraArgs` and the whole Phase A/C per-download-override plumbing are
+  unreachable; every download uses `settings.downloadOptions`. To grab one video as MP3-with-subs a
+  user must edit global Settings, download, then revert. (Supersedes/expands M5, M6.) **Fix:** add a
+  collapsible per-download Options panel (reuse `DownloadOptionsForm`) — the plumbing already exists.
+  *Fixed: a collapsible "Advanced" panel in [DownloadBar.tsx](src/renderer/src/components/DownloadBar.tsx)
+  reuses `DownloadOptionsForm` for per-download overrides (audio format, container, codec, format-sort,
+  subtitles, SponsorBlock), passed via `AddOptions.options` → `startDownload`. The panel also carries the
+  M6 incognito checkbox and sits beside the M5 command preview. Overrides are one-shot: they reset to the
+  global defaults after each download (matching Trim/Schedule).*
+- [x] **UX2 — "Fetch" vs "Download" is ambiguous, and Enter does the wrong thing.** Two unlabeled
+  icon buttons (magnifier = "Fetch", clipboard = "Paste") sit next to "Download"; a first-timer can't
+  tell that Download works without Fetch. Pressing **Enter** in the URL field runs a *probe*, not the
+  download (L27) — violating "type URL + Enter = go". **Fix:** label the action, make Enter download
+  (or fetch-then-download), and present Fetch as optional ("Preview formats").
+  *Fixed in [DownloadBar.tsx](src/renderer/src/components/DownloadBar.tsx): **Enter is now "go"** — it
+  starts the download (or adds the fetched playlist when the playlist panel is open) instead of probing;
+  probing stays an explicit, optional click. The magnifier button is relabeled from "Check URL" to
+  **"Preview available formats (optional)"** (both its tooltip and `aria-label`), and the URL placeholder
+  now reads "Paste a video or playlist URL, then press Enter to download" so it's clear Download works
+  without Fetch. `download()` already enqueues with the presets when nothing has been probed, so the
+  Enter-downloads path needs no probe. (resolves L27's Enter inconsistency too.)*
+- [x] **UX3 — Library "Index" is jargon and a hidden two-stage workflow.** Pasting a channel URL in
+  the Downloads bar tries to treat it as one item; whole channels belong in the Library tab, but
+  nothing signposts that. "Index" reads like "Download" but only catalogs — you must then expand,
+  select, and Download. **Fix:** rename to "Add channel/playlist," and after indexing surface a clear
+  "Download N videos" next step; detect channel URLs in the Downloads bar and suggest the Library.
+  *Fixed across three seams. **(1) De-jargoned the Library** ([LibraryView.tsx](src/renderer/src/components/LibraryView.tsx)):
+  the primary button is now **"Add"** (was "Index"), "Re-index" → **"Refresh"**, and the header
+  description / empty state / placeholder / error copy drop "index" for "add". The post-add next step
+  already exists — `indexSource` auto-selects the new source so its card expands with a prominent
+  "Download N pending" primary button. **(2) Channel detection in the Downloads bar** — a new pure
+  [`looksLikeChannelOrPlaylist`](src/renderer/src/lib/urlHelpers.ts) (conservative: only clear YouTube
+  channel/dedicated-playlist shapes; a `/watch` video, even with a `list=`, is never flagged and keeps
+  working in the bar) drives a dismissible brand-tinted nudge in
+  [DownloadBar.tsx](src/renderer/src/components/DownloadBar.tsx): "This looks like a channel or playlist.
+  Add it in the Library…" with an **Open in Library** action. **(3) The handoff** goes through a small
+  new [store/nav.ts](src/renderer/src/store/nav.ts) (App's tab state moved into it) that carries a
+  one-shot `pendingLibraryUrl`; the Library consumes it on mount to pre-fill its add field. Unit-tested
+  (`looksLikeChannelOrPlaylist` in `test/clipboardLink.test.ts`) and verified end-to-end in the browser
+  preview (channel URL → nudge → Open in Library → Library tab with the URL pre-filled).*
+- [x] **UX4 — Destructive actions have no confirmation and no undo** (L13). "Clear history,"
+  "Clear log," "Remove source" (deletes an entire indexed channel + items), and "Delete selected"
+  are all one click. A user exploring can wipe data irreversibly. **Fix:** confirm destructive/bulk
+  deletes (or offer an undo toast).
+- [x] **UX5 — First run can't choose the download folder.** [Onboarding.tsx](src/renderer/src/components/Onboarding.tsx)
+  only *describes* Documents\Video/Audio — there's no picker (the ROADMAP claims one). The user must
+  later discover Settings → Downloads. **Fix:** put the folder picker in onboarding as documented.
+  *Fixed: the "Where downloads go" block in [Onboarding.tsx](src/renderer/src/components/Onboarding.tsx)
+  now has interactive Video and Audio rows — each shows the current folder (or the `Documents\Video` /
+  `Documents\Audio` default) with a **Choose…** button that opens the OS picker via the settings store's
+  `chooseDir` (the same proven path DownloadsCard uses, seeded at the current value — W5). Picking a
+  folder persists immediately, so the choice is already saved when the user clicks "Get started";
+  leaving it untouched keeps the Documents defaults. Verified in the browser preview with onboarding
+  forced on.*
+
+### Medium — confusion, feedback & organization
+
+- [x] **UX6 — Silent failures on file actions.** `openFile`/`showInFolder` in the stores call
+  `window.api.openPath(...)` and ignore the returned error string; [reveal.ts](src/main/reveal.ts)
+  refuses missing/moved files or disallowed types and returns an error nobody surfaces. Clicking
+  "Open file" on a moved download does nothing, with no message. **Fix:** surface open/reveal errors.
+  *Fixed: a shared renderer helper [reveal.ts](src/renderer/src/reveal.ts) `revealFile('open'|'folder', path)`
+  awaits the IPC result and raises the main-process reason ("File not found — it may have been moved…",
+  "Refusing to open this file type.") as an error **toast** — the new transient-notification surface (see
+  UX9). Both the downloads and history stores route through it. `safeShowInFolder` was upgraded to return an
+  error string like `safeOpenPath` (it previously no-op'd silently), so reveal failures surface too.*
+- [ ] **UX7 — Settings is one long unsegmented scroll** of ~11 cards with no section nav/anchors; the
+  only finder is the hide-cards search (M14). Order is arbitrary and related items are split.
+  **Fix:** group into sub-sections (or a left rail) with a stable, logical order.
+  *Deferred (visual, own pass): a Settings section-nav / left-rail is a layout redesign whose value is
+  entirely in how it looks and scrolls — it wants the app running and eyeballed, not an unattended edit.
+  Grouped with the visual/UX polish pass.*
+- [ ] **UX8 — "Default format" vs "Format & post-processing" are two places for one concept.** Kind +
+  quality live under Downloads; container/codec/subs/SponsorBlock live in a separate card. **Fix:**
+  co-locate, or clearly label one "defaults" and the other "advanced post-processing."
+  *Deferred (ties to UX7): co-locating or re-labelling these cards is part of the same Settings
+  information-architecture pass; done together there with the app running.*
+- [x] **UX9 — No global completion feedback off the Downloads tab** (UI25). If OS notifications are
+  off/suppressed (focus assist) and you're on another tab, a finished download gives no in-app sign.
+  **Fix:** a sidebar Downloads badge / lightweight in-app toast.
+  *Fixed (both halves of the suggested fix): a **sidebar Downloads badge** — a Fluent `CounterBadge` on the
+  Downloads nav item shows the active (downloading + queued) count from any tab
+  ([Sidebar.tsx](src/renderer/src/components/Sidebar.tsx)), driven by a count-only selector in App so it
+  updates without re-rendering on every progress tick; and a **lightweight in-app toast** surface
+  ([Toaster.tsx](src/renderer/src/components/ui/Toaster.tsx) + [store/toasts.ts](src/renderer/src/store/toasts.ts)),
+  a non-portal bottom-center stack that any store/component can raise (now used for UX6's file-action errors).
+  Together this closes **UI25**.*
+- [x] **UX10 — Re-download silently changes quality** (H5) — a confusing "I asked for 720p, got Best." *Resolved by H5 (re-download stores `formatId`/`formatHasAudio` and strips compound quality labels).*
+- [x] **UX11 — Scheduled downloads silently never fire if the app is quit** (M4). The hint is easy to
+  miss; the user returns to find nothing happened. **Fix:** warn at schedule time that it requires the
+  app running (or persist + relaunch). *Resolved by M4 (the "persist + relaunch" option the fix names): the
+  queue is now persisted, so a `saved`+`scheduledFor` item survives a quit and the App promoter tick fires it
+  on the next launch once its time has passed (the store normalizes/promotes due items). So a scheduled
+  download no longer "never fires" if quit — it fires when due, or on the next launch if that time already
+  passed. (Live-smoke of the quit→relaunch cycle noted in M4.)*
+- [x] **UX12 — Terminal is a dead-end when custom commands are off** (L18). The nav item is always
+  visible; clicking it shows a gate pointing to a setting on another screen. **Fix:** hide/disable the
+  nav item, or let the gate enable the setting inline. *Fixed (both fixes): the nav item is already hidden
+  when custom commands are off (Sidebar's `showTerminal` filter, L18), and the gate — still reachable via the
+  command palette — now carries an inline **"Enable custom commands"** button that flips the setting on the
+  spot ([TerminalView.tsx](src/renderer/src/components/TerminalView.tsx)), so it's no longer a dead-end that
+  sends you to another screen.*
+- [x] **UX13 — Backup export warns of nothing; it contains secrets** (M22). A user "backs up settings"
+  and ships proxy creds / tokens in cleartext. **Fix:** warn, or mask/omit secrets. *Resolved by M22
+  (backup strips proxy / PO-token / update-token; the caption states credentials aren't included).*
+- [x] **UX14 — Duplicate warning can show a placeholder title** (L76): 'Already in your queue:
+  "YouTube video (abc123)"' before metadata resolves looks broken. **Fix:** fall back to the URL.
+  *Resolved by L76 (the dup warning falls back to the URL when the title is still the placeholder).*
+- [x] **UX15 — No bulk actions in the Downloads queue.** History has a select-mode + bulk delete;
+  Downloads has only per-row remove + "Clear finished." Inconsistent. **Fix:** mirror select/bulk, or
+  add "Cancel all." *Fixed (the "Cancel all" option): a `cancelAll` store action + a "Cancel all (N)"
+  header button ([DownloadsView.tsx](src/renderer/src/components/DownloadsView.tsx)) that cancels every
+  active (downloading + queued) item at once — killing the live processes and freeing the queue — shown only
+  when there's something cancelable. (A full History-style select-mode is the heavier alternative; "Cancel
+  all" covers the common bulk need.)*
+
+### Low — polish & smaller friction
+
+- [x] **UX16 — URL field isn't focused on launch.** `aerofetch-url` is only focused via the command
+  palette; opening the app or the Downloads tab requires a click to start typing. **Fix:** autofocus it.
+  *Fixed: an `App` mount effect focuses `#aerofetch-url` on launch when the Downloads tab is active
+  (double-rAF for paint, reusing the command palette's focus pattern).*
+- [x] **UX17 — Icon-only Fetch/Paste buttons** rely on hover tooltips for meaning (UI a11y; new users on touch/keyboard miss them). **Fix:** labels or `aria`-described affordances.
+  *Resolved (a11y met; verified): both buttons already carry an `aria-label` (Fetch = "Preview available
+  formats (optional)", Paste = "Paste from clipboard") **and** a `Hint` tooltip that shows on hover *and*
+  keyboard focus — so screen-reader and keyboard users get the name; the icon isn't the only affordance. A
+  permanently-visible text label is a deliberate compact-layout tradeoff for the URL row (the Download button
+  beside it carries the primary text label), so it's left as a visual choice, not an a11y gap.*
+- [ ] **UX18 — The quality control morphs after Fetch** (preset list → real formats; label "Quality" →
+  "Quality / format") in place — a surprising transform. **Fix:** keep a stable control with a clear "formats loaded" state.
+  *Deferred (subjective visual): the morph is arguably informative (the label change signals real formats
+  loaded); whether it "surprises" is a judgment best made watching it, so it joins the watched visual pass.*
+- [x] **UX19 — Window size/position isn't remembered.** [index.ts](src/main/index.ts) opens a fixed
+  920×700 every launch (no bounds persistence). **Fix:** persist + restore window bounds. *Fixed with W2 —
+  [windowState.ts](src/main/windowState.ts) persists + restores bounds/maximized with an off-screen guard.*
+- [x] **UX20 — "App is still running" surprise.** Closing with a download active hides to tray and
+  notifies once per process (L68); later closes give no hint, so the window "won't close" reads as a
+  bug. **Fix:** a persistent tray hint / first-close explainer. *Resolved by L68 (the "first-close explainer"
+  it now is on *every* close): the once-per-process guard was the whole bug — `notifiedBackground` now resets
+  when the window is shown again, so each close-to-tray with a download active (or tray mode) re-fires the
+  "AeroFetch is still running in the tray" notification, not just the first. So a later close no longer looks
+  like the window is stuck. (The tray behavior itself is worth a watched confirm in the Batch 15 live pass.)*
+- [x] **UX21 — No keyboard-shortcut discoverability.** Ctrl+K (palette), Enter, Ctrl+Enter are
+  undocumented; there's no "?"/shortcuts screen. **Fix:** a shortcuts hint or help affordance.
+  *Fixed (discoverability): the first-run Onboarding now includes a tip — "Press Ctrl+K anytime to jump to any
+  screen or start a new download." — so new users learn the palette, which is itself the discovery surface for
+  the rest; and the palette's Settings action shows its shortcut ("Ctrl ,") in the hint column. (A dedicated
+  full shortcuts/"?" screen is the heavier alternative, left for later.)*
+- [x] **UX22 — Onboarding is shallow and one-shot** (L67): three tips, no folder choice, not
+  revisitable; the clipboard tip requires a focus event a first-timer won't trigger. *Fixed the "one-shot"
+  core: a **"Show welcome tips again"** button in Settings → About re-opens the welcome/onboarding screen
+  on demand (sets `hasCompletedOnboarding: false`), so it's revisitable (closes **L67**'s revisit half).
+  Onboarding does offer folder choice already (Video/Audio "Choose…"), and it gained the Ctrl+K tip (UX21).
+  The remaining "shallow" (only a few tips) is a content judgment left as-is.*
+- [ ] **UX23 — Settings folder paths are read-only** (L71) — no paste; Browse-dialog only.
+- [x] **UX24 — "Check N watched for new" is disabled with no explanation** when no source is watched —
+  a user with indexed (but unwatched) sources sees a dead button. **Fix:** tooltip / enable with a hint to watch a source.
+  *Fixed: the button uses `disabledFocusable` (not `disabled`) when nothing is watched, so it stays
+  hover/focus-reachable, and a `Hint` explains why — "Turn on 'Watch' for a channel or playlist below first,
+  then this checks them for new uploads." ([LibraryView.tsx](src/renderer/src/components/LibraryView.tsx)).*
+- [x] **UX25 — Empty-state copy mismatches the flow** (L78): Downloads says "Paste a URL above to get
+  started," but the actual path is Fetch/Download. *Resolved by L78 (DownloadsView empty-state copy
+  rewritten to match the Fetch/Download flow).*
+- [ ] **UX26 — yt-dlp/ffmpeg version + initial settings load have no skeleton/spinner** — brief blank
+  states on boot (plus the documented one-frame theme flash). **Fix:** lightweight loading states.
+  *Deferred (low value, needs eyeballing): the blanks are sub-second on a normal launch; adding skeletons is
+  a perceived-polish tweak worth doing while watching the actual boot, so it joins the visual pass.*
 
 ---
 
-## Test Coverage Gaps
+## Windows platform conventions
 
-The following security-critical functions lack tests:
+Review against Windows 11 / Fluent desktop conventions. `W` IDs are new; existing IDs are referenced
+where a dimension is already filed. The app gets the big things right (native dialogs, per-user
+no-admin install, AppUserModelID, tray, taskbar progress, jump list, `nativeTheme` dark-mode follow,
+DPI handled by Chromium). The deviations:
 
-- `sanitizeOptions` (settings.ts): all validation rules
-- `importBackup` (backup.ts): malformed JSON, missing fields, custom-command ingestion
-- `safeOpenPath`/`safeShowInFolder` (reveal.ts): extension allowlist enforcement
-- `assertHttpUrl` (url.ts): protocol validation (had minor cases, now fixed)
+### Window behavior & resizing
 
-**Action:** Add integration tests or snapshot tests for these before shipping.
+- [x] **W1 — No minimum window size.** `createWindow` sets `width/height` but no `minWidth`/`minHeight`
+  ([index.ts](src/main/index.ts)), so the window can be dragged down to a few pixels and the layout
+  (212px sidebar + content) breaks. **Standard:** set a sensible min (e.g. 640×480).
+- [x] **W2 — Window placement isn't persisted** (extends UX19): size, position, **maximized state**, and
+  **which monitor** are all forgotten — it reopens 920×700 on the primary display every launch.
+  **Standard:** persist & restore window placement per Windows app convention (e.g. `electron-window-state`).
+  *Fixed (no new dep): [windowState.ts](src/main/windowState.ts) persists the window's normal bounds +
+  maximized flag to `<userData>/window-state.json`; `createWindow` opens from the saved state (debounced
+  save on resize/move + a save on close, which may only hide to tray). A `screen.getAllDisplays()`
+  visibility check falls back to the default centered size when the saved monitor is gone, so the window
+  can never restore off-screen. (The restore cycle itself wants a live quit→relaunch confirm.)*
+- [x] **W3 — Title bar doesn't follow the in-app theme.** `nativeTheme.themeSource` is deliberately never
+  set (index.ts:97), so the OS-drawn caption follows the *OS* theme. Choosing an explicit in-app **dark**
+  theme on a **light** OS leaves a light title bar on a dark app (and vice-versa). **Standard:** set
+  `nativeTheme.themeSource` to the resolved mode, or use `titleBarOverlay` with themed colors.
+
+### Dialogs & file pickers
+
+- [x] **W4 — Text fields have no Cut/Copy/Paste context menu.** Electron adds no default editing menu and
+  the app registers no `context-menu` handler, so right-clicking any input/textarea (URL, search, terminal
+  args, template fields) shows nothing — a basic Windows text-editing affordance is missing. **Standard:**
+  wire a standard editing context menu (and spellcheck suggestions for textareas).
+- [x] **W5 — File pickers don't open at the current value.** `chooseFolder` sets no `defaultPath`, so the
+  folder dialog opens at a default location instead of the currently-configured Video/Audio folder.
+  **Standard:** seed the picker with the current path. *(Native dialogs themselves are correct — good.)*
+- [x] **W6 — Cookie sign-in is a separate taskbar window.** `openCookieLoginWindow` creates a
+  `BrowserWindow` with no `parent`/`modal` ([cookies.ts](src/main/cookies.ts)), so it appears as a second
+  AeroFetch taskbar button rather than a child/modal dialog. **Standard:** `parent: mainWindow` (+ `modal`
+  if appropriate) so it groups under the app.
+
+### Keyboard, context menus & focus
+
+- [x] **W7 — Lists have no keyboard navigation.** The queue, history, and library lists can't be arrowed
+  through, **Delete** doesn't remove the focused/selected item, and there's no **Ctrl+A** select-all —
+  all standard Windows list behaviors. **Standard:** roving focus + Delete/Ctrl+A on list surfaces. *(a11y; see also UI30)*
+- [x] **W8 — No standard accelerators.** No **Ctrl+,** (Settings), **F1** (help), or **F5** (refresh);
+  Ctrl+K (palette) is the only global shortcut and is undiscoverable (UX21). **Standard:** add the
+  conventional accelerators + a discoverable shortcut list.
+- [x] **W9 — Focus isn't restored or advanced.** Closing the command palette doesn't return focus to the
+  trigger; finishing onboarding and switching tabs don't move focus into the new content. **Standard:**
+  restore focus on overlay close; move focus to the activated panel. *(extends UI28–UI29)*
+- [ ] **(ref) Context menus absent app-wide** — UI24; the text-field case is W4.
+
+### System tray, taskbar & icons
+
+- [x] **W10 — No taskbar attention flash.** When a background download completes while the window is
+  minimized/hidden, the app doesn't `flashFrame` the taskbar button. **Standard:** flash for attention on
+  background completion (pairs with the existing notification). *Fixed: `notify()` in
+  [download.ts](src/main/download.ts) calls `win.flashFrame(true)` when the completion/failure event lands
+  while the window is unfocused/minimized/hidden (Windows stops the flash on focus). Gated on the same
+  `notifyOnComplete` as the toast, so it pairs with it. (The flash itself wants a quick live confirm.)*
+- [x] **W11 — No taskbar overlay badge** (deferred in roadmap): a download manager conventionally shows an
+  active-count / error overlay icon via `setOverlayIcon`. **Standard:** add it (the progress bar's error
+  mode is not a substitute). *Done: [badge.ts](src/main/badge.ts) draws a green (active) / red (error) dot
+  `NativeImage` with pure Node/zlib (no dep), and the `taskbarProgress` handler in
+  [ipc.ts](src/main/ipc.ts) calls `win.setOverlayIcon(badge, label)` with an accessible count label
+  ("N downloads active" / "Download error"), cleared to `null` when the queue goes idle. (Numeric count
+  lives in the tooltip label — a 16px overlay can't legibly render digits.)*
+- [ ] **W12 — Fallback tray icon is single-resolution.** The embedded fallback is a 32×32 PNG, so on
+  150%/200% DPI the tray glyph is blurry when the real multi-size `.ico` is absent. **Standard:** a
+  multi-size fallback (or rely only on the `.ico`).
+  *Deferred (low value, needs the real tray to judge): the fallback only renders in the unlikely case the
+  bundled multi-size `build/icon.ico` is missing (W14 regenerated it), so it's a fallback-of-a-fallback. A
+  multi-res embedded base64 is fiddly to author and best verified on a real high-DPI tray — not worth an
+  unattended change for a path that shouldn't be hit.*
+- [x] **W13 — Notifications set no icon.** `new Notification({title, body})` omitted `icon`; on the **portable**
+  build (no installed AUMID shortcut) Windows toasts showed a generic icon. *Fixed: both notification sites
+  ([download.ts](src/main/download.ts) completion/failure toast + [index.ts](src/main/index.ts) background-running
+  toast) now pass `icon: getAppIconImage()` — a new cached `NativeImage` helper in [binaries.ts](src/main/binaries.ts)
+  that loads the app `.ico` once and falls back to an empty image (OS default) if it's missing. (refines L127)*
+- [x] **W14 — App/notification icon is a placeholder** (M3-orig) — *Fixed: redesigned
+  [icon.svg](build/icon.svg) into a proper mark (teal brand square with a top-lit gradient + soft sheen and a
+  bold rounded download glyph over a landing shelf), legible down to 16px; regenerated the multi-size
+  `build/icon.ico` (256/128/64/48/32/16) via ImageMagick. The notification-icon **wiring** (passing the asset
+  to `new Notification`) is also done — see W13/L127.*
+
+### High DPI, multiple monitors, touch
+
+- [ ] **W15 — Software rendering is global.** Hardware acceleration is disabled for a documented GPU
+  workaround; on high-DPI/large windows this trades GPU compositing for CPU, which can be sluggish.
+  **Standard:** re-enable HW accel where the target GPU allows (the memo already flags revisiting this).
+  *Deferred (deliberate workaround, external dependency): `disableHardwareAcceleration()` is the fix for the
+  dev machine's GPU/driver blank-overlay bug (documented in index.ts and the project memo) — the very reason
+  the app hand-rolls non-portal overlays. Re-enabling HW accel can't be validated until the NVIDIA driver
+  issue is confirmed resolved on the target GPU, so it's intentionally left until that watched hardware pass.
+  PERF8 (this batch) trims the first-paint cost that software rendering compounds.*
+- [x] **W16 — Touch targets too small / hover-only labels.** Icon-only row actions are ~32px, 4px apart,
+  4 per row (below the ~40px touch guideline), and their only labels are hover tooltips (`Hint`) that
+  never appear on touch. **Standard:** ≥40px touch targets and non-hover labels. *(extends UX17)* *Fixed:
+  the icon-only row-action clusters (QueueItem + HistoryView `actions` containers) now enforce a ≥40×40px
+  hit target via a `& button` min-size rule — the glyph is unchanged, the subtle button just carries more
+  padding. The label half was already covered: the shared [Hint](src/renderer/src/components/Hint.tsx) shows
+  on `:focus-within`, not only `:hover`, so keyboard/AT users get the name (and every action also has an
+  `aria-label`). (LibraryView's per-item rows have no icon-only actions — checkbox + status chip only; its
+  header actions are labeled text buttons — so nothing there needed enlarging.)*
+
+### Dark mode & accessibility (Windows-specific)
+
+- [x] **W17 — No `aria-live` for status changes.** Narrator doesn't announce download progress,
+  completion, or errors — there are no live regions. **Standard:** polite live regions for queue/status updates.
+- [x] **W18 — Custom colors unverified under High Contrast.** The status pills, segmented controls, accent
+  swatches, and thumbnail tints use explicit background colors that Windows forced-colors mode may not
+  adapt (nothing sets `forced-color-adjust`). **Standard:** test under each Contrast theme; let system colors win.
+  *Fixed the two surfaces that convey meaning through color and would otherwise break under `forced-colors`:
+  the accent swatches ([settingsStyles.ts](src/renderer/src/components/settings/settingsStyles.ts)) now set
+  `forced-color-adjust: none` so the accents stay distinguishable (they're color previews — otherwise all
+  flatten to one system color), and the [SegmentedControl](src/renderer/src/components/ui/SegmentedControl.tsx)
+  active segment paints with the system `Highlight`/`HighlightText` pair under `@media (forced-colors: active)`
+  so the checked state stays visible once the brand background is flattened. The status chips are Fluent
+  `Badge`s (Fluent supplies its own forced-colors handling) and the thumbnail tints are purely decorative
+  placeholders, so both correctly let the system palette win. Live verification under each Contrast theme is
+  still worthwhile but the color-meaning surfaces are now defended in code.*
+- [x] **(ref) No semantic headings / radiogroup arrow-nav / focus rings** — UI33, UI30, UI28–29 (all bear on Narrator + keyboard users). *All four resolved (see UI33/UI30/UI28/UI29).*
+
+### Settings & standard conventions (mostly OK)
+
+- [x] **W19 — Window/taskbar don't reflect state.** No window title at all (L108), so the taskbar button
+  never shows "3 downloading" or similar. **Standard:** reflect activity in the title/tooltip.
+- [x] **(OK)** Per-user no-admin install, NSIS uninstaller, `aerofetch://` registration, AppUserModelID,
+  tray tooltip + left-click restore + right-click menu, taskbar progress, and jump list all follow
+  Windows conventions. **(Non-goal)** unsigned binary → SmartScreen prompt — accepted; no certificate will
+  be purchased (the build stays signing-ready via env vars if that ever changes — see [SIGNING.md](docs/SIGNING.md)). *(Acknowledged — verified-OK / accepted non-goal, no action.)*
 
 ---
 
-## Remediation Roadmap
+## Code consistency & conventions
 
-| ID  | Category | Effort | Priority | Notes | Status |
-|-----|----------|--------|----------|-------|--------|
-| S1  | Security | 2h     | High     | UX confirmation on custom-command import | **Fixed 2026-06-23** |
-| S2  | Security | 15m    | Medium   | Copy protocol check from main window | **Fixed 2026-06-23** |
-| S3  | Security | 30m    | Medium   | Add active-count gate in main | **Fixed 2026-06-23** |
-| S4  | Security | 1h     | Medium   | Path-traversal sanitization | **Fixed 2026-06-23** |
-| S5  | Security | 1.5h   | Low      | Add per-field validators to JSON readers | **Fixed 2026-06-23** |
-| P1  | Perf     | 1h     | Medium   | Remove disk writes from `getSettings` hot paths | **Fixed 2026-06-23** |
-| P2  | Perf     | 1h     | High     | Forward renderer's pre-probed metadata to main | **Fixed 2026-06-23** |
-| P3  | UX       | 15m    | Low      | Document or enforce concurrency semantics | **Fixed 2026-06-23** (documented) |
-| M1  | Maint    | 15m    | Trivial  | Extract `cleanError` to shared module | **Fixed 2026-06-23** |
-| M2  | Maint    | 15m    | Trivial  | Document `parseExtraArgs` limitations | **Fixed 2026-06-23** |
-| M3  | Polish   | 30m    | Trivial  | Add icon asset before release | **Placeholder done 2026-06-23**; designed asset still wanted pre-v1.0 |
-| C1  | Correctness | 30m | High  | Bundle missing `ffprobe.exe` + document it (found by smoke test) | **Fixed 2026-06-23** |
+A cross-cutting consistency pass over the dimensions requested. Many specifics are already filed; this
+section consolidates them by theme and — the point of the exercise — **recommends one standard each**.
+`CC` IDs are the consolidated items; existing IDs are referenced, not re-filed. The codebase is actually
+*stylistically* consistent (no-semicolon, single-quote, 2-space) and has a genuinely good pure/impure
+split — but that style is unenforced and several "do the same thing two ways" seams have crept in.
+
+- [ ] **CC1 — Naming conventions.** Boolean settings have no convention: `useAria2c` (verb-prefix),
+  `autoUpdateYtdlp` (auto-prefix), `customCommandEnabled` (suffix), `downloadArchive`/`restrictFilenames`
+  (bare). Keys say `videoDir`/`audioDir` while the UI says "folder." Preload names diverge from main
+  (L92); `MediaKind` is declared twice (L105). **Standard:** booleans as `is`/`has`/`should`/`<verb>`
+  consistently; one term ("folder") across keys + UI; align preload↔main names; single-source shared types in `@shared`.
+  *Partially closed / deferred: `MediaKind` is single-sourced (L105 done). The remaining renames are a
+  **breaking persistence change** — the boolean/`videoDir` keys are the on-disk `settings.json` schema, so
+  renaming them silently orphans every existing user's saved settings without a migration. Deferred to a 1.x
+  settings-migration pass; the preload↔main name alignment is the safe subset, tracked as L92 (Batch 13). The
+  naming convention is recorded here for new keys.*
+- [x] **CC2 — Coding style is consistent but unenforced.** No ESLint/Prettier config, script, or dep
+  (L44), so the (good) house style drifts only by discipline; `??` vs `||` is occasionally misused for
+  null checks. **Standard:** add Prettier + typescript-eslint with `lint`/`format` scripts in CI; codify the existing style.
+- [x] **CC3 — Different patterns for the same problem.** JSON persistence (M1), status chips (UI18),
+  segmented controls (UI14), buttons (UI15), overlays/dialogs (UI23), three yt-dlp probe spawners
+  (`probeMedia`/`probeMeta`/`probeFlat`), and **duplicated stdout line-buffering** in `download.ts` and
+  `terminal.ts`. **Standard:** one helper per concern (a `jsonStore`, a `StatusChip`, a `SegmentedControl`,
+  one spawn-and-stream helper). *Fixed: one helper now backs each concern — `createJsonStore` (M4/R1),
+  `StatusChip` (UI18), `SegmentedControl` (UI14), `execFileAsync` ([lib/exec.ts](src/main/lib/exec.ts)) for
+  the three probe spawners, and — this batch — the last duplication, the stdout newline-split loop, is now
+  [lib/lineBuffer.ts](src/main/lib/lineBuffer.ts) (`createLineBuffer`), adopted by both `download.ts` and
+  `terminal.ts` and unit-tested ([test/lineBuffer.test.ts](test/lineBuffer.test.ts)). (UI15 button-wrapping
+  and UI23 overlay unification stay their own incremental tracks.)*
+- [x] **CC4 — Duplicate utilities.** Formatting (M9), `youtubeId` (H2), `newId` (M7), JSON I/O (M1),
+  `MediaKind` (L105) — **plus** `execFile` is hand-wrapped in a `new Promise` in five places
+  (`probe`/`ytdlp`/`ffmpeg`/`download.probeMeta`/`indexer.probeFlat`) instead of one `promisify`d helper,
+  and the stdout newline-split loop is copied in two. **Standard:** `src/main/lib/` + `src/renderer/src/lib/`
+  with one each of: `format`, `youtube`, `jsonStore`, `ytdlpExec` (promisified spawn + line stream).
+  *Fixed: every listed duplicate now has one home — renderer `lib/formatters`/`urlHelpers`/`id` +
+  `@shared/format`, `MediaKind` single-sourced (L105); main `lib/exec.ts` (the five `execFile` wrappers) and
+  now `lib/lineBuffer.ts` (the two stdout-split loops). The `lib/` dirs exist on both sides.*
+- [ ] **CC5 — Async patterns are mixed.** Three I/O idioms: callback-wrapped `new Promise` (execFile ×5),
+  `async/await`+`fetch` (updater check, sync), and event-emitter-wrapped Promise (`net.request` in
+  updater). Renderer mixes `.then().catch()` (stores) with `async/await`+try/catch (components).
+  **Standard:** `async/await` everywhere; a shared `execFileAsync`; wrap event-emitter APIs once in a helper.
+  *Partly done: the `execFile ×5` idiom is gone (one `execFileAsync`, CC4), so the app-code default is
+  `async/await`. The one remaining event-emitter-wrapped Promise is the updater's `net.request` streaming
+  download — its "wrap once in a helper" is **CL4**, deferred with it (it's security-critical installer-
+  download code — host re-validation per redirect + SHA-256 verify + truncation guards — that can't be
+  live-verified in this environment, so it isn't refactored unattended). Left open until CL4 lands.*
+- [x] **CC6 — Five failure-signaling conventions.** `{ ok, error }` result objects (download/updater/
+  ytdlp/backup/IPC), `throw` (`assertHttpUrl`), `null` (indexerCore), `[]` (history/sources read errors),
+  and a bare **error string** (`reveal.safeOpenPath`). `cleanError` is applied to some spawn stderr but not
+  ytdlp/ffmpeg. **Standard:** a `Result<T>` (`{ ok, value?/error? }`) across every service/IPC boundary;
+  `throw` only inside pure helpers, caught at the boundary; always run yt-dlp stderr through `cleanError`.
+  *Fixed (the concrete divergence): yt-dlp stderr now runs through `cleanError` **everywhere** — `getYtdlpVersion`
+  and `updateYtdlp` ([ytdlp.ts](src/main/ytdlp.ts)) adopted the exact `cleanError(r.stderr) || r.error?.message
+  || ''` idiom already used by download/probe/indexer, so a failed version/update check shows the trailing
+  error line, not raw noise. (ffmpeg surfaces no stderr — its version probe returns `null` by design.) The
+  broader "one `Result<T>` across every boundary" holds already for the service/IPC layer (they return
+  `{ ok, error }`); collapsing the remaining `null`/`[]`/bare-string internal signals into it is a low-value
+  sweep left to the incremental track — the specific `cleanError` inconsistency this item names is closed.*
+- [ ] **CC7 — Dependency-injection styles.** Pure modules take deps as params (good — `binDir`,
+  `now`); the impure shell uses module singletons (`getSettings()`, `getYtdlpPath()`, lazy `getStore()`);
+  progress is callback-injected; the `WebContents` sender is a param in some handlers and a closure in
+  others. **Standard:** keep pure-core param injection; in the shell, pass `wc`/`onProgress` consistently
+  as the leading argument and keep singleton access for config/binaries.
+  *Deferred (low-value restyle): the substantive half already holds — the pure core
+  (`buildArgs`/`validation`/`indexerCore`/`ytdlpPolicy`) takes deps as params and the shell uses singletons
+  for config/binaries, which is the recommended split. What's left is purely cosmetic argument-ordering
+  (`wc`/`onProgress` position), not worth the churn/risk across every handler unattended; recorded as the
+  convention for new handlers.*
+- [x] **CC8 — No logging strategy.** Effectively no diagnostics — a single stray `console.error` in
+  preload, and ~29 swallowed catches (M29); `errorlog.ts` is domain data, not logging. **Standard:** one
+  small leveled logger (e.g. `electron-log`) written to userData, called at every catch; keep `errorlog.ts` for user-facing download failures only.
+  *Fixed: a small in-house leveled logger [logger.ts](src/main/logger.ts) (no new dependency — the
+  `electron-log` suggestion was an example) appends to `<userData>/logs/aerofetch.log` with size-capped
+  rotation; all `app`/fs access is lazy+guarded so it's a safe no-op under unit tests. The main-process
+  catch sites route through it, and a fire-and-forget `log:write` IPC + preload `logError()` forward the
+  renderer's `logError` (M29) failures to the same file sink — closing the "sink" half M29/R6 deferred here.
+  `errorlog.ts` stays as user-facing download-failure data. The user-facing **toast** half ties to the
+  global status surface (UI25/UX9) and lands there.*
+- [ ] **CC9 — Four validation styles.** Type-guard predicates (`isValid*` in validation.ts),
+  coerce-with-fallback (`sanitizeOptions`, `templates.sanitize`), an imperative per-key `switch`
+  (`setSettings`, M24), and `throw` (`assertHttpUrl`). **Standard:** one schema layer (e.g. `zod`) that
+  both *validates and coerces*; `setSettings` runs values through the same schema instead of a bespoke switch.
+  *Deferred to 1.x (per the release gate — the CC consolidations are explicitly post-1.0): adopting a schema
+  layer (`zod`) is a new runtime dependency plus a rewrite of `validation.ts` + `setSettings` + backup import.
+  High-value but a sweeping change best done as its own reviewed PR, not unattended; standard recorded.*
+- [ ] **CC10 — Mixed serialization/persistence.** `electron-store` (settings) **and** hand-rolled
+  pretty-JSON files (history/errorlog/templates/sources/media-items, M1) for the same job, plus
+  yt-dlp-mandated formats (Netscape cookies, plaintext archive) and base64 `enc:v1:` secrets.
+  **Standard:** one `jsonStore<T>()` abstraction for the app's own records; pick **either** electron-store
+  **or** the JSON stores for everything, not both; leave the yt-dlp-format files alone.
+  *Partly closed / deferred: the `jsonStore<T>()` abstraction now exists (`createJsonStore`, M4/R1) and backs
+  every app record (history/errorlog/templates/sources/media-items/queue), so the "hand-rolled per file"
+  divergence is gone. The remaining electron-store↔jsonStore split is a **deliberate** keep: settings live in
+  electron-store for its DPAPI-encrypted secret fields, records in jsonStore. Fully migrating settings off
+  electron-store is a 1.x call, not forced here.*
+- [ ] **CC11 — Configuration is scattered.** `electron-store` + `localStorage` (sidebar, M19) + env vars
+  (`PORTABLE_EXECUTABLE_DIR`, `CSC_LINK`, `AEROFETCH_REAL_DOWNLOAD`) + hardcoded module consts (update
+  host/owner/repo, timeouts, caps, `09:00`, `ARIA2C_ARGS`, L10). **Standard:** a `config.ts` for build/host
+  constants; fold `localStorage` UI prefs into the settings store so there's one persisted-prefs source.
+  *Partly closed / deferred: the runtime consts are already centralized in
+  [constants.ts](src/main/constants.ts) (L10), and the sidebar `localStorage` pref was folded into the
+  settings store (M19). What's left — a dedicated `config.ts` for build/host constants (update
+  host/owner/repo, currently co-located in updater.ts) — is a marginal move deferred to the 1.x organization
+  pass (CC12), with which it naturally lands.*
+- [ ] **CC12 — Project organization.** Renderer `components/` mixes screens (views) with reusable widgets;
+  helpers (`theme`/`thumb`/`useClipboardLink`) sit at src root; the **pure** `queueStats` lives in `store/`;
+  main mixes pure (`buildArgs`/`validation`/`indexerCore`/`ytdlpPolicy`) and impure modules in one flat dir.
+  **Standard:** renderer `views/` + `components/` + `lib/`; main `core/` (pure) + services; move `queueStats` to `lib`.
+  *Deferred to 1.x: a file-tree reorg is broad import churn across nearly every module for no behavior change —
+  exactly the kind of sweeping move that wants its own reviewed PR, not an unattended batch. The `lib/`
+  convention is already established (both sides have one and new pure utils land there); the wholesale
+  `views/`+`core/` split is the 1.x task. Standard recorded.*
+- [ ] **CC13 — View/state boundary (the project's "MVVM").** It's React+Zustand, but the container/
+  presentational split is inconsistent: orchestration lives in stores for downloads/sources yet inside the
+  component for DownloadBar, and SettingsView calls `window.api` directly (L93, UX1). **Standard:** stores/
+  hooks are the view-models (own orchestration + all IPC); components stay presentational; no `window.api` in components.
+  *Partly closed / deferred: the substantive split largely holds — downloads/sources orchestration lives in
+  stores, and DownloadBar's was extracted into the `useDownloadBar` hook (H1), a view-model in all but name.
+  The concrete remaining leak is SettingsView calling `window.api` directly, filed as **L93** (Batch 13);
+  the broader "no `window.api` in any component" sweep rides with it. No new work needed here beyond L93.*
+- [ ] **CC14 — State ownership is unprincipled.** State lives in Zustand stores, component `useState`,
+  `localStorage`, the main `electron-store` (mirrored into a renderer store), and module-level vars
+  (`idCounter`, `notifiedBackground`, `active`). Persisted state is optimistic-only and never reconciled
+  (M34/L142); two stores form a cycle (C2). **Standard:** main owns persisted state; renderer stores mirror
+  it and **apply the authoritative value the IPC call returns**; UI-only state in stores; break store cycles via a coordinator.
+  *Largely closed / deferred: main owns persisted state and the renderer mirrors it; the store cycle is gone
+  (C2, via the coordinator event bus); settings now **apply the authoritative IPC return** (M34); and
+  `localStorage` was folded into the settings store (M19). The one remaining "optimistic-only, never
+  reconciled" case is the other IPC mutations (**L142**, Batch 11). The module-level vars called out
+  (`idCounter`/`notifiedBackground`/`active`) are legitimately module-scoped singletons, not misplaced UI
+  state. Closes with L142.*
+
+### Recommended single style (apply project-wide)
+
+1. **Errors:** one `Result<T> = { ok: true; value } | { ok: false; error }` across every service/IPC
+   boundary; `throw` only in pure helpers; one `logger` (leveled, file-backed) invoked at every catch.
+2. **Async:** `async/await` only; one `execFileAsync` + one spawn/stream helper; wrap event-emitter APIs once.
+3. **Validation:** one schema lib (zod) that validates **and** coerces; reuse it in `setSettings`, backup import, and JSON-store reads.
+4. **Persistence/serialization:** one `jsonStore<T>()` (or electron-store) for app records — not both; one config module for host/build constants; one persisted-prefs store (no `localStorage`).
+5. **Shared code:** `lib/` for pure utils (format, youtube, ids, jsonStore); `@shared` is the only home for cross-process types (no re-declared `MediaKind`).
+6. **UI:** design tokens (spacing/radius/type/icon scales) + shared primitives (`Screen`, `StatusChip`, `SegmentedControl`, `LinkSuggestion`, button/focus); stores are view-models, components presentational.
+7. **Naming:** booleans `is`/`has`/`should`/`<verb>`; "folder" not "dir"; preload methods match main names; `verbNoun` for store actions, `onX` for component handlers.
+8. **Tooling:** Prettier + typescript-eslint with `lint`/`format`/CI gates so all of the above stays enforced rather than aspirational.
 
 ---
 
-## Notes
+## Code cleanliness
 
-- **Deferred:** No findings warrant an emergency patch. S1 is the highest-impact (social engineering), but requires UI changes. S3/S4 are defense-in-depth; production use is low-risk on single-user machines.
-- **Testing:** All changes should be accompanied by test additions (especially security validators).
-- **DashMail parallel:** This mirrors DashMail's approach to staged remediation (high-impact first, polish last).
+A dead-code / clutter review. **First, the good news — the codebase is genuinely clean on most axes:**
+no `TODO`/`FIXME`/`HACK`/`XXX` in source (only in roadmap docs), **no commented-out code**, **no
+`debugger`/debug logging** (the lone `@ts-ignore` ×2 in preload is the legitimate browser-fallback
+`window` assignment), every source file is imported, and the dead IPC surface is exactly the two already
+filed. Several listed categories are **N/A** to this stack and worth recording so they're not re-asked:
+
+- **Unused XAML / WPF** — N/A (Electron + React/HTML, no XAML).
+- **Unused strings / localization** — N/A (no i18n/string-resource files; strings are hard-coded, i18n deferred), so nothing to be "unused."
+- **Unused images / icons** — none: the only assets are `build/icon.{ico,svg}` (used) and the inline base64 fallback tray PNG (used); thumbnails are remote. *(Clutter, not shipped: `dist/` ~3 GB of old installers — L84; `.frames/` 19 gitignored captures.)*
+- **Unused files / resources** — none in `src` or `resources/bin` (yt-dlp/ffmpeg/ffprobe all used; aria2c optional).
+
+**Dead / unreachable code (the real list):**
+
+- [x] **Safe to remove now — `getDefaultFolder`** (M2): channel + preload method + main handler + mock,
+  **zero callers**. Pure deletion, no behavior change.
+- [x] **Decide "wire or remove" — command preview** (M5): channel + preload `previewCommand` + main
+  `previewCommand()` + `formatCommandLine`/`quoteForDisplay` (buildArgs, **unit-tested**) +
+  `CommandPreviewResult` + mock. *Decided: **wired** (M5/UX1) — the DownloadBar Advanced panel has a
+  Show/Hide command toggle calling `window.api.previewCommand`; the whole chain is now reachable.*
+- [x] **Decide "wire or remove" — incognito/private** (M6): `DownloadItem.incognito` + `AddOptions.incognito`
+  + `buildItem` handling + two history-skip checks + the QueueItem "Private" badge. *Decided: **wired**
+  (M6/UX1) — the DownloadBar Advanced panel has an "Incognito mode" checkbox that sets the flag (reset
+  after each download).*
+- [x] **Decide "wire or remove" — per-download options/extraArgs** (UX1): `DownloadItem.options`/`extraArgs`,
+  `StartDownloadOptions.options`/`extraArgs`, `AddOptions.options`/`extraArgs` are plumbed end-to-end but
+  never set by any UI. *Decided: **wired** (UX1) — the collapsible Advanced panel reuses
+  `DownloadOptionsForm` for per-download overrides passed via `AddOptions.options`; overrides reset to
+  the global defaults after each download.*
+- [x] **Comment, not code — `MAX_ENQUEUE_BATCH`** (M33): referenced by ipc.ts:629 + the roadmap but never
+  implemented; fix the comment (nothing to delete). *Resolved by M33: the false `MAX_ENQUEUE_BATCH`
+  reference is gone; [ipc.ts](src/shared/ipc.ts):730 now honestly states all selected entries are
+  enqueued at once (with a note to add a cap if large — the actual cap is deferred to PERF3).*
+
+**New cleanliness findings:**
+
+- [x] **CL1 — Magic-string protocol markers duplicated across the emit/parse boundary.** `'prog|'` and
+  `'path|'` are hard-coded in `buildArgs.ts` (`PROGRESS_TEMPLATE` / `--print after_move:path|…`) and again
+  in `download.ts` (`line.startsWith('prog|')` / `'path|'`). Change one and the other breaks silently.
+  **Fix:** export shared marker constants from one module.
+- [x] **CL2 — Long positional parameter list.** `buildArgs(opts, outputTemplate, o, binDir, access,
+  extraArgs)` takes six positional args (and `o` vs `opts` is easy to swap). **Fix:** pass a single options
+  object. *Fixed: `buildArgs(input: BuildArgsInput)` now takes one named object (`opts`/`outputTemplate`/
+  `options`/`binDir`/`access`/`extraArgs?`) destructured at the top, so callers can't transpose the two
+  path-like strings or `opts`/`options`. download.ts's `buildCommand` and both test harnesses updated.*
+- [x] **CL3 — Large method: `startDownload`** (~130 lines) bundles spawn + dual metadata path + four inline
+  `child` event handlers. **Fix:** extract the stdout-parse + close/error wiring (pairs with CC3's spawn-stream
+  helper). *Fixed: the stdout/stderr parse, the close/error handlers, and the B1 idle watchdog moved into a
+  `wireChildProcess({ wc, opts, rec, cleanup, getTitle })` helper in [download.ts](src/main/download.ts).
+  `startDownload` is now a linear pre-flight (binary checks → URL normalise → concurrency guard → cookies →
+  spawn → metadata probe → wire). `getTitle` is a getter because the parallel metadata probe may fill the
+  resolved title in after wiring is set up. Behaviour unchanged.*
+- [ ] **CL4 — Deep nesting: `updater.downloadAppUpdate`** — Promise → `net.request` → `response` → `data`
+  with nested conditionals/teardown is the hardest-to-follow block. **Fix:** extract a `streamToFile` helper.
+  *Deferred (deliberate, needs a watched pass): this is the security-critical installer download —
+  per-redirect host re-validation, streaming SHA-256 verification, truncation detection, idle-timeout, and
+  backpressure teardown all interlock in that block. Extracting `streamToFile` is worthwhile but a mistake
+  here is a security regression, and an app-update download can't be live-verified in this environment, so it
+  isn't refactored unattended. Grouped with CC5's "wrap the event-emitter API once" — both land in a watched
+  session on the updater.*
+- [x] **CL5 — Superfluous exports.** `PROGRESS_TEMPLATE` (L167) and `getManagedBinDir` are `export`ed but
+  used only within their own module. **Fix:** make them module-private.
+- [x] **CL6 — Redundant wrappers** (minor): `MediaThumb`'s `kind === 'audio' ? 'audio' : 'video'` (L15),
+  `clearDir` = `update({[t]:''})`, and the store `openFile`/`showInFolder` thin wrappers around `window.api`.
+  Harmless; collapse opportunistically. *Resolved: the genuinely-redundant one is gone — `MediaThumb`'s
+  no-op ternary was collapsed in L15. The other two are **deliberate, not redundant**: `clearDir` and the
+  store `openFile`/`showInFolder` are the view-model layer (CC13) — the store is the single place components
+  reach `window.api`, so keeping components free of direct IPC is the point, not incidental wrapping. Left
+  as-is on purpose.*
+
+**Magic numbers / strings (consolidated, see L10):** timeouts `15_000`/`30_000`/`60_000`/`180_000`,
+maxBuffers `4`/`64`/`128`/`256`×1024×1024, caps `500`/`200`/`100`/`20000`/`80`, `VIRTUALIZE_AT 100`,
+installer handoff `1500`, tickers `650`/`15_000`, stderr tail `4000`; magic strings `'enc:v1:'`,
+`'persist:aerofetch-login'`, `'AeroFetchDailySync'`, `'--sync'`, `'prog|'`/`'path|'` (CL1).
+**Fix:** a `constants.ts` (CC11) — names over literals.
+
+### What can safely be removed (recommendation)
+
+1. **Now (zero risk):** the `getDefaultFolder` slice (M2); un-export `PROGRESS_TEMPLATE` + `getManagedBinDir` (CL5).
+2. **Now (housekeeping):** prune `dist/` to the current release (L84); the macOS-only branches if Windows-only is committed (L147).
+3. **Decision made — wired, not deleted (all resolved):** command preview (M5), incognito (M6), and
+   per-download options/extraArgs (UX1) are now surfaced in the DownloadBar Advanced panel, so the
+   previously-unreachable plumbing is reachable. Nothing to delete.
+4. **Not removable (intentional):** preview seed/mock data + `PREVIEW` branches (C1/L128) — they power the
+   browser-preview dev workflow; consolidate (C1) rather than delete.
+
+---
+
+## Simplification opportunities
+
+Reusable abstractions that shrink the code **and** read better — no premature optimization, just
+de-duplication. Organized by the requested categories; each lists the repetition (with refs), the
+abstraction, and a rough **LOC delta** (net, after the helper's own cost). Estimates are deliberately
+conservative.
+
+| # | Category | Repetition (refs) | Reusable abstraction | ~Net LOC |
+|---|---|---|---|---|
+| SIMP1 | Repeated file handling | JSON read/save+cap+try/catch in history/errorlog/templates; sources already has it (M1, CC10) | `createJsonStore<T>(file, isValid, cap)` | −40 |
+| SIMP2 | Repeated networking | `execFile`-in-`Promise` ×5 (probe/ytdlp×2/ffmpeg/probeMeta/indexer) (CC4/CC5) | `execFileAsync` + `spawnYtdlpJson()` | −40 |
+| SIMP3 | Repeated parsing | byte/speed/eta/duration formatters ×4 (M9, L165, L166) | `lib/format.ts` (hour-aware, one precision rule) | −40 |
+| SIMP4 | Repeated parsing | YouTube id/URL parsing ×4 (H2) | `lib/youtube.ts` | −30 |
+| SIMP5 | Repeated logic | stdout line-buffering ×2 + `taskkill` tree-kill ×2 (download.ts/terminal.ts) (CC3, **new**) | `lineStream(stream, onLine)` + shared `killTree(pid)` | −25 |
+| SIMP6 | Repeated commands | 7 identical preload `on*` subscribe/unsubscribe wrappers (**new**) | `subscribe(channel, cb)` helper in preload | −20 |
+| SIMP7 | Repeated event handlers | `Set<string>` add/remove/toggle/toggle-all in DownloadBar/Library/History (**new**) | `useSelection()` hook | −30 |
+| SIMP8 | Repeated view models | async-action `setBusy/try/catch/finally + result + error` ×~7 in SettingsView (**new**) | `useAsyncAction()` hook | −50 |
+| SIMP9 | Repeated UI (cards) | hand-styled `<div>` card surfaces ×6 (UI7/UI20/L120) | `<Surface tier>` (or use Fluent `Card`) | −30 |
+| SIMP10 | Repeated UI (settings) | `sectionHeader` + `Card` ×11 and Switch+`Field`+"On/Off" ×~12 in SettingsView | `<SettingsCard icon title>` + `<ToggleField>` | −90 |
+| SIMP11 | Repeated UI (row actions) | `Hint`+`Button` icon-action ×~16 (QueueItem/History/Templates) | `<IconAction label icon onClick>` | −55 |
+| SIMP12 | Repeated UI (empty states) | centered icon+text `empty` block ×3 (L116) | `<EmptyState icon title hint?>` | −25 |
+| SIMP13 | Repeated dialogs/banners | suggestion banner ×2 (UI19); status chips Badge-vs-pill (UI18, M8) | `<LinkSuggestion>` + `<StatusChip>` | −40 |
+| SIMP14 | Repeated UI (controls) | two hand-rolled segmented controls (UI14) | `<SegmentedControl>` | −30 |
+| SIMP15 | Repeated validation | type-guards + `sanitizeOptions` + `setSettings` switch (CC9, M24) | one schema (zod) validate+coerce | −60 |
+| SIMP16 | Repeated networking | `net.request` + redirect-revalidate + timeout ×2 in updater (`fetchTrustedText`/`downloadAppUpdate`) (**new**) | `trustedRequest(url, {sink})` | −30 |
+| SIMP17 | Repeated logic (misc) | `newId` ×3 (M7), `PREVIEW` ×8 (C1), `(ARR as readonly string[]).includes` ×N (L90) | `lib`: `newId`, `isPreview`, `isMember` | −15 |
+| SIMP18 | Repeated converters | `MediaKind` ×2 (L105), kind\|quality string encode/decode (CL2/L91) | single-source type + typed pair | −10 |
+
+### Highest-value (do these first)
+
+1. **SettingsView decomposition (SIMP10 + SIMP8 + SIMP11).** A `<SettingsCard>` + `<ToggleField>` +
+   `useAsyncAction` + `<IconAction>` would take the 1104-line file to roughly **~600**, and the per-card
+   split (H1) falls out for free. Biggest single readability win.
+2. **`createJsonStore` (SIMP1)** collapses three near-identical persistence modules to thin configs and
+   removes the M1/CC10 "two ways to persist" seam.
+3. **`lib/format.ts` + `lib/youtube.ts` (SIMP3/SIMP4)** remove the most-copied pure utilities and fix the
+   formatter divergences (L165/L166) at the same time.
+4. **`execFileAsync`/`spawnYtdlpJson` (SIMP2/SIMP5)** unify five spawn sites + the duplicated kill/line-buffer.
+
+### Estimate
+
+Gross duplicated lines removable ≈ **650–750**; the new helpers/primitives add back ≈ **150–200**, for a
+**net reduction of ~550–800 lines (~5–7% of the ~12.5K total)**. Concentration: **SettingsView ~−450**
+(1104 → ~600), the **JSON stores ~−40**, **main spawn/format/util helpers ~−120**, **shared UI primitives
+~−150**. The real payoff is readability and killing the "two-ways-to-do-X" seams (M1/M8/M9/UI14/UI18/CC*),
+not the line count. **Caveat:** stop short of over-abstracting — a `createMirroredStore` factory or a
+generic form engine would cost more clarity than it saves; keep abstractions at the "one obvious helper" level.
+
+---
+
+## Bug hunt (execution-path review)
+
+Tracing real code paths for latent bugs by category. **New** bugs get `B` IDs; the genuine bugs found in
+earlier passes are listed so this is complete; and the categories that came back **clean** are recorded
+(bug-hunting that finds nothing is a result too).
+
+### New bugs
+
+- [x] **B1 — No stall/idle timeout on downloads (resource leak + stuck slot).** `spawn(ytdlp, …, {
+  windowsHide: true })` ([download.ts](src/main/download.ts):306) sets **no `timeout`**, and `buildArgs`
+  emits no `--socket-timeout`. A hung connection means yt-dlp never exits → the `active` map entry and the
+  renderer's `downloading` item persist **forever**, permanently consuming a concurrency slot with no
+  recovery or feedback. (The app-updater download *does* have `DOWNLOAD_IDLE_TIMEOUT_MS`; downloads don't.)
+  **Fix:** pass `--socket-timeout` and/or an app-side idle watchdog that kills + errors a stalled child.
+- [ ] **B2 — Source indexing can't be cancelled.** `indexSource` walks a channel's playlists with
+  sequential probes (each up to the 180 s `probeFlat` timeout); the UI shows "indexing…" with the Index
+  button disabled and **no cancel**. A large channel locks the add-source flow for minutes with no abort.
+  **Fix:** thread an `AbortSignal`/cancel token and a Cancel button.
+  *Deferred to the watched Batch 15 live pass: threading an `AbortSignal` through the main-process index walk
+  (and killing the in-flight probe child) plus a Cancel button is a real feature whose abort behavior needs a
+  live large-channel index to verify it actually stops the walk mid-probe.*
+- [x] **B3 — `extractSha256` ignores the filename (wrong-hash risk).** It returns the **first** 64-hex
+  token in the file ([updater.ts](src/main/updater.ts)); a combined multi-file checksum uploaded as
+  `<asset>.sha256` would verify the installer against the wrong line's hash. Safe only by the one-hash-
+  per-asset convention. **Fix:** match the hash on the asset's filename line.
+- [x] **B4 — `probeMeta` assumes one line per `--print` field.** It does `stdout.split('\n')` → `[title,
+  uploader, duration]` ([download.ts](src/main/download.ts)); a title containing a newline shifts channel
+  and duration by a line. **Fix:** use a single `--print` with an unlikely delimiter, or `-J`.
+- [x] **B5 — Missing status guard on the `meta` event.** Between `cancel()` and the child's `close`,
+  `active.has(id)` is briefly true, so `probeMeta` can `send` a `meta` event for a just-canceled item;
+  `applyEvent`'s `meta` case (unlike `progress`/`done`/`error`) has **no canceled guard**, so it updates a
+  canceled item's title. Harmless today, but the asymmetry is a latent bug. **Fix:** guard `meta` like the others.
+- [ ] **B6 — App-update download has no cancel.** Once `downloadAppUpdate` starts there's no user abort —
+  only completion or the idle timeout stops it; the progress UI offers no Cancel. **Fix:** expose cancel (abort the request).
+  *Deferred to the watched Batch 15 live pass (ties to CL4): it touches the security-critical updater
+  installer-download path (the same block CL4 defers) — exposing a cancel means an IPC that calls the
+  request's `abort()` + teardown, verifiable only by cancelling a real ~300 MB update download and confirming
+  the partial is cleaned up. Done with the CL4/updater watched work.*
+- [x] **B7 — Cookie-login promise can never resolve if the window is destroyed without `close`.**
+  `openCookieLoginWindow` resolves only via the `close`→`exportAndResolve` path; a `destroy()` (or a
+  `closed` without `close`) would leave `pendingResolvers` pending forever. Not triggered by current code,
+  but a latent never-resolve. **Fix:** also resolve/reject on `closed`.
+
+### Real bugs already filed (confirmed in this pass)
+
+- **M32** playlist/channel batches download in reverse order · **M35** History re-download duplicates rows
+  · **M34** optimistic settings never reconcile (UI shows unsaved values) · **L88** a `progress` event can
+  flip a `queued` item to `downloading` outside `pump()` · **L139** startup yt-dlp auto-update vs a
+  concurrent download spawning the same exe (Windows file-in-use) · **L140** retry-during-teardown hits the
+  "already running" guard · **L148** `clearFinished` can free a slot before the killed tree exits (brief
+  over-cap) · **L157** `markDownloaded` no-ops after `removeSource` (orphan downloads).
+
+### Came back clean (no bug found)
+
+- **IPC-after-destroy:** every `wc.send`/`e.sender.send`/`mainWindow.*` is guarded by `isDestroyed()`.
+- **Threading / UI threading / synchronization:** single JS thread in main and renderer; React state
+  updates are always on-thread; the `active` map + module vars are main-thread-only — no data races.
+- **Infinite loops:** the stdout line-buffer advances each iteration; `parseExtraArgs`/`parseRssVideoIds`
+  regexes can't zero-width-match; no self-recursive `pump`.
+- **Stream disposal (updater):** `downloadAppUpdate` has a single `finish()` that aborts the request,
+  destroys the file stream, and unlinks the partial — correct on every failure path.
+- **Event-listener cleanup:** component `useEffect` subscriptions return their unsubscribe; module-level
+  subscriptions are app-lifetime by design.
+- **Off-by-one / boundary:** `parseProgress` guards `parts.length < 6`; playlist/collection indexing is
+  1-based throughout; `MAX_ENTRIES` slices are correct; `fmtBytes` clamps the unit index.
+
+---
+
+## Resilience & failure-mode review
+
+A fresh lens: what happens when the *environment* fails (disk full, permission denied, corrupt file,
+killed mid-write, huge inputs) rather than when the logic is wrong. These are robustness findings, not
+cosmetics. `R` IDs.
+
+- [x] **R1 — JSON stores are not written atomically (corruption on crash/power-loss).** The hand-rolled
+  stores (history/errorlog/templates/sources/media-items) persist via `writeFileSync(file, JSON.stringify…)`
+  — not write-temp-then-rename. A crash/power-cut mid-write truncates the file; the next read hits a parse
+  error and returns `[]`. `electron-store` (settings) *is* atomic, so durability is inconsistent across the
+  app. **Fix:** an atomic write (temp + rename, or `write-file-atomic`) in the shared `jsonStore` (SIMP1).
+- [x] **R2 — A corrupt/invalid store silently loses all data.** `readJsonArray`/`listHistory` etc. catch a
+  parse error and return `[]` with no warning, backup, or recovery — one bad byte wipes the user's history/
+  sources/templates from their perspective. **Fix:** on parse failure, back up the bad file (`.corrupt`) and surface a notice.
+- [x] **R3 — O(n) full-file rewrite per download completion (≈O(n²) per channel), synchronously on the
+  main thread.** `setMediaItemDownloaded` ([sources.ts](src/main/sources.ts):126) reads + parses the entire
+  `media-items.json` (up to `MAX_ITEMS` = 20,000) and rewrites the whole file on **every** completion, and
+  `addHistory` rewrites all of `history.json` likewise. Downloading a 1,000-video channel ⇒ ~1,000 full
+  read-parse-write cycles of a multi-MB file, blocking the IPC/event loop each time. **Fix:** in-memory
+  cache + debounced/batched atomic writes (or the deferred better-sqlite3).
+- [ ] **R4 — Canceled downloads orphan `.part` files.** `cancelDownload` tree-kills yt-dlp but never
+  deletes the partial; canceled items vanish from the UI while `.part`/fragment files accumulate in the
+  output folder. (App crash mid-download likewise — the queue isn't persisted to resume, M4.) **Fix:**
+  clean up the partial on cancel, or surface/offer-resume for orphans.
+  *Deferred to the watched Batch 15 live pass (data-safety): the fix means capturing yt-dlp's destination path
+  during the run and **deleting** `<dest>.part`/`.part-Frag*` on cancel — file deletion whose correctness
+  can't be verified without a real download+cancel. Doing it unattended risks deleting the wrong file if the
+  destination capture is even slightly off, so it must be verified live before shipping.*
+- [x] **R5 — Settings write failure is unhandled.** `setSettings` calls `store.set(...)` with no try/catch;
+  on disk-full/read-only `electron-store` throws → the IPC rejects → the renderer's `setSettings().catch(()
+  => {})` swallows it while the optimistic UI keeps the change (the disk-full form of M34). **Fix:** catch and report.
+- [x] **R6 — Silent data loss on any store write failure.** A completed download that can't be recorded
+  (disk full) shows "Completed" in-session but is gone on restart, with no error (the write `catch` is empty,
+  M29). **Fix:** detect write failure and warn. *Fixed (log half) in [jsonStore.ts](src/main/jsonStore.ts):
+  `writeJsonAtomic` now returns whether the write landed and logs the failure (with the path) instead of an
+  empty catch, and removes the leftover `.tmp`; `createJsonStore`'s `flush` only clears the dirty flag on
+  success, so a failed write stays pending and is retried on the next `write()` or the quit-time
+  `flushAllStores()` rather than dropped. Unit-tested in `test/jsonStore.test.ts`. **Scope note:** like M29
+  this delivers the "no longer silent" half (logged + retried); the user-facing toast needs the leveled file
+  logger / toast sink deferred to **CC8**.*
+- [x] **R7 — `safeStorage` unavailable ⇒ secrets silently stored as plaintext.** `encryptSecret` falls back
+  to plaintext when DPAPI/safeStorage isn't available, with no indication — compounds H7 (cookies) and the
+  backup-cleartext issue (M22). **Fix:** warn (or refuse to store) when encryption is unavailable. *Fixed in
+  [settings.ts](src/main/settings.ts): `encryptSecret` now `console.warn`s before returning a non-empty secret
+  as plaintext, so the cleartext fallback is no longer silent. Chose warn-not-refuse to preserve the
+  pre-encryption behaviour (storing still works); DPAPI is effectively always present on Windows, so this
+  should never fire in practice. (refusing/at-rest enforcement remains an option if ever wanted.)*
+- [x] **R8 — Pretty-printed JSON for large stores.** `JSON.stringify(value, null, 2)` inflates size/write
+  time for the potentially-20k-item media store (ties R3). **Fix:** compact JSON for the large stores.
+- [x] **R9 — Clock-skew sensitivity.** `shouldAutoCheckYtdlp` and the scheduled-download promoter compare
+  `Date.now()`; a backward system-clock correction can skip or double-fire a check/schedule. Minor; note for awareness.
+  *Fixed the concrete case: `shouldAutoCheckYtdlp` now treats a `lastCheck` in the future (clock ran
+  backward → negative interval) as due, so the daily update check can't be skipped forever (unit-tested).
+  The scheduled-download promoter is inherently fire-once — each promotion flips the item out of `saved`,
+  so a backward jump only delays it and can't double-fire; a forward jump firing early is documented and
+  accepted as minor (a monotonic scheduler would be overkill for a park-until-time feature).*
+
+---
+
+## Ship-readiness (perceived quality)
+
+Obsessive "does it feel finished" pass. The biggest untapped vein is **defaults** (first-run impressions),
+plus a few stuck-status / progress glitches. `SR` IDs; already-filed perceived-quality items are listed at
+the end so the picture is complete. **Verified-clean first:** card/label/button text is consistently
+*sentence case*, and a careful read found **no spelling typos** — the polish gaps are defaults, jargon, and a couple of stuck states, not sloppy text.
+
+### Poor / risky defaults (first-run impressions)
+
+- [x] **SR1 — Theme defaults to `'light'`, not `'system'`.** A dark-mode Windows user gets a bright white
+  app on first launch despite the app fully supporting "follow system." Single most-noticeable first-run
+  miss. **Fix:** default `theme: 'system'`.
+- [x] **SR2 — `ytdlpChannel` defaults to `'nightly'`.** The app ships auto-pulling yt-dlp's daily,
+  less-tested build (auto-update also on by default); one nightly regression breaks downloads for everyone.
+  Defensible for chasing YouTube changes, but a risky default for a commercial release. **Fix:** consider `stable` as the shipped default.
+- [x] **SR3 — `autoDownloadNew` defaults to `true`.** The moment a user marks a channel "watched," new
+  uploads auto-download with no per-event consent — can quietly fill a disk. **Fix:** default off (let watching be "notify," downloading be opt-in).
+- [x] **SR4 — `clipboardWatch` defaults to `true`.** The app reads the clipboard on every window focus from
+  first launch (R7/L138). A privacy-conscious default would be off or first-run-prompted. **Fix:** default off, or ask on first run.
+  *Fixed: `DEFAULT_SETTINGS.clipboardWatch` is now `false` ([shared/ipc.ts](src/shared/ipc.ts)) — a new install
+  doesn't read the clipboard until the user opts in (a one-toggle setting), and the Onboarding tip was reworded
+  to point there ("Turn on clipboard detection in Settings…"). Existing installs keep their saved value
+  (electron-store only fills missing keys), so no one who already enabled it is affected. **Product note for
+  the maintainer:** this flips a signature convenience off-by-default for new users — trivially reversible if
+  you'd rather it stay on.*
+- [x] **SR5 — Audio defaults to MP3 (lossy).** `defaultAudioQuality: 'Best (MP3)'` + `audioFormat: 'mp3'`
+  give a lossy re-encode by default; m4a/opus are higher quality at the same size. Minor (MP3 = max
+  compatibility), but "Best" implying MP3 is a quality mismatch (M18).
+  *Resolved as a deliberate default (documented): MP3 is the maximum-compatibility container (plays on every
+  device/player), which is the right *default* for a general-audience downloader — a user who wants
+  m4a/opus/flac picks it in the format options. The "Best" *label* mismatch (the real bug) was fixed in M18
+  (the preset labels and `--audio-quality` handling now match the chosen format). Changing the shipped default
+  container away from MP3 is a product-taste call with a real compatibility downside, so it stays MP3 by
+  intent, not oversight.*
+
+### Stuck states & progress glitches
+
+- [x] **SR6 — "Resolving…" can stick forever.** A queued item's channel shows the `'Resolving…'`
+  placeholder until a `meta` event arrives; if metadata never resolves (error before meta, or no channel
+  in the probe), the row reads "Resolving… • 1080p • Video" permanently — looks hung. **Fix:** clear the placeholder on error / when meta fails.
+- [x] **SR7 — Progress bar visibly resets mid-download.** A video+audio merge downloads as two streams, so
+  the bar fills 0→100%, then resets to 0→100% again before muxing — looks like a glitch/restart to the
+  user. **Fix:** weight the two phases (e.g. 0–50% / 50–100%) or show a "merging…" state.
+- [x] **SR8 — Window title never reflects state** (L108/W19): always the static "AeroFetch," so the taskbar
+  can't show "3 downloading." A finished-feeling app updates its title/tooltip with activity.
+
+### Wording / jargon polish
+
+- [x] **SR9 — Dev jargon in user-facing option hints** (extends M37): "mux them into the video," "Tiebreaker,
+  not a hard filter," "Endcards / credits" ("End cards"), "Proof-of-Origin token," "`--extractor-args`."
+  Reads like engineer notes. **Fix:** plain-language hints.
+- [x] **SR10 — Inconsistent product self-description / casing** surfaced to users: "yt-dlp frontend" caption
+  flips to "v0.5.0" on load (L66); "Sign in" vs "Sign-in" (L95); "PO token" vs "PO Token" (L150).
+
+### Also reduces perceived quality (already filed — listed for completeness)
+
+- Onboarding has no folder picker / feels thin (UX5/UX22); no boot loading state + one-frame theme flash
+  (UX26); refresh-icon mismatch ArrowClockwise vs ArrowSync (L106) and Regular/Filled brand icon (UI13); only
+  the sidebar animates, everything else snaps (UI26); separator glyph/spacing inconsistency `•`/`·` (L164);
+  the command palette is undiscoverable (UX21). *(The unsigned-build SmartScreen prompt is accepted as a
+  non-goal — no certificate.)*
+
+**Ship-blockers (highest perceived-quality impact):** SR1 (light-on-dark first launch), SR7 (progress
+visibly restarting), SR6 ("Resolving…" stuck), and W14 (placeholder icon) — **all now resolved.** The
+unsigned-build SmartScreen prompt is accepted as a non-goal (no certificate). Together these were most of
+the "this feels finished" gap.
+
+---
+
+## Performance (no premature optimization — real hot paths only)
+
+A fresh lens: redundant work on hot paths and scaling cliffs, not micro-tuning. `PERF` IDs. **Verified
+acceptable first:** memoized `QueueItem`s don't re-render when their item is unchanged (the `applyEvent`
+`map` preserves references for untouched items); the queue + large library lists are virtualized;
+`electron-store` is constructed lazily. The issues:
+
+- [x] **PERF1 — `getSettings()` is heavy and on every hot path.** It runs per download spawn (twice — in
+  `buildCommand` and the `maxConcurrent` check), per completion (`notify`), and on the system-theme bridge;
+  each call re-reads the whole store and, for users who've configured a proxy/PO-token/update-token, runs
+  up to 3 `safeStorage.decryptString` (DPAPI) calls. **Fix:** cache the decrypted settings, invalidate on write.
+- [x] **PERF2 — `templates.json` is read+parsed on every download.** `resolveExtraArgs` evaluates
+  `templates: listTemplates()` eagerly as an argument ([download.ts](src/main/download.ts):182) *before*
+  `selectExtraArgs` checks `customCommandEnabled`, so the file is read even when custom commands are off.
+  **Fix:** pass a lazy getter, or short-circuit on the gate first.
+- [ ] **PERF3 — `pump()` is O(n) per queue event.** It `filter`+`reverse`+`slice`s the entire items array
+  on every add/done/error/cancel/progress-driven change; with M33's unbounded channel enqueue (thousands of
+  items) every event becomes O(n), and several events fire per second during active downloads. **Fix:**
+  track running/queued counts + a pointer instead of rescanning.
+  *Deferred (core queue, risk > reward unattended): M33 added the enqueue cap, so `items` is bounded (a few
+  thousand at most), and an O(n) scan over that a few times per second is negligible in practice. Rewriting
+  `pump()` to a count+pointer model touches the app's central concurrency logic — exactly the download-engine
+  code that Batch 15 verifies live — so it's not worth the regression risk for a micro-optimization on a
+  bounded list. Revisit with the Batch 15 live pass if profiling ever flags it.*
+- [x] **PERF4 — `summarizeQueue` runs twice per progress tick.** Once in App's store subscription (which
+  also pushes a taskbar IPC every tick, L25) and once in DownloadsView's render (no `useMemo`, L94) — each
+  O(items), every ~second per active download. **Fix:** compute once, memoize, throttle the taskbar push.
+  *Fixed with L94: `queueSummaryOf` computes the aggregate once per items change (shared ref cache), so
+  App's subscription and DownloadsView's render no longer each run it; the taskbar IPC push was already
+  deduped by computed value (L25).*
+- [x] **PERF5 — `VirtualList` gets new function identities each render.** `estimateSize`/`getKey`/
+  `renderItem` are passed as inline arrows, so the virtualizer can't rely on stable references (risking
+  re-measures/cache churn). **Fix:** `useCallback`/hoist them. *Fixed: the three callbacks are hoisted to
+  stable module-level functions in [DownloadsView.tsx](src/renderer/src/components/DownloadsView.tsx).*
+- [ ] **PERF6 — Per-thumbnail store subscriptions.** Each `MediaThumb` calls `useResolvedDark()` (two
+  store subscriptions) (L162); a long list creates N×2 subscriptions. **Fix:** resolve once, pass as a prop.
+  *Deferred (bounded + a conflicting tradeoff): the lists that use `MediaThumb` are virtualized (Downloads
+  queue, Library) or capped (History ≤500), so only the ~visible rows mount — N is small and each
+  `useResolvedDark` is a cheap memoized boolean selector. Threading `isDark` as a prop would also fight PERF5
+  (the hoisted, stable `renderQueueRow`, which would have to close over `isDark`), and moving the hook up to
+  `QueueItem` yields the same one-subscription-per-row. Low value, mild conflict — left as documented.*
+- [x] **PERF7 — (ref R3) O(n²) media-items rewrites** dominate the main-process cost when downloading a
+  channel; closed by the cached/atomic `jsonStore` (SIMP1) — the single highest-value perf fix.
+- [x] **PERF8 — No code-splitting.** All views (incl. the rarely-used Terminal/Settings) load up front in
+  one renderer bundle alongside Fluent UI + React; software rendering (W15) compounds first-paint cost.
+  Minor for a desktop app, but lazy-loading heavy views would trim startup. **Fix:** `React.lazy` the heavy tabs.
+  *Fixed: Library/History/Terminal/Settings are `React.lazy` chunks behind a `Suspense` in
+  [App.tsx](src/renderer/src/App.tsx) (Downloads, the launch tab, stays eager). The production build now emits
+  separate `SettingsView` (~90 kB), `LibraryView` (~29 kB), `HistoryView` (~16 kB), and `TerminalView`
+  (~8 kB) chunks — ~140 kB out of the initial bundle, loaded on first visit. The stores these views use are
+  imported eagerly elsewhere (App's `useDownloads` + `import './store/sources'`, and downloads → history), so
+  lazy-loading the *view* never delays store startup or persistence (the C2 note already set this up).*
+
+**Priority:** PERF7/R3 (scaling cliff) and PERF1/PERF2 (per-download redundant I/O + crypto) are the only
+ones with real user-visible impact; the rest are good hygiene. None warrant work before the correctness
+bugs (B1, M32, M35) — listed for completeness, not urgency.
+
+---
+
+## Completed
+
+Security & correctness audit (2026-06-23):
+
+- [x] **S1** — Backup import: confirm before enabling imported custom-command templates.
+- [x] **S2** — Cookie login window: restrict popups to http(s)/about: schemes.
+- [x] **S3** — Enforce `maxConcurrent` in main (`startDownload`), not just the renderer.
+- [x] **S4** — Path-traversal sanitization for `filenameTemplate` + `outputDir`.
+- [x] **S5** — Per-row validation on persisted JSON reads.
+- [x] **C1 (orig)** — Bundle the missing `ffprobe.exe`; assert ffmpeg+ffprobe presence up front.
+- [x] **P1** — Stop `getSettings()` writing to disk on every read.
+- [x] **P2** — Forward the renderer's pre-probed metadata to main; skip the redundant probe.
+- [x] **P3** — Document "lower maxConcurrent mid-flight doesn't pause overflow".
+- [x] **M1 (orig)** — Extract duplicated `cleanError` to `log.ts`.
+- [x] **M2 (orig)** — Document `parseExtraArgs` quoting limitations.
+- [x] **M3 (orig)** — App icon placeholder (designed asset still wanted pre-v1.0).
+
+---
+
+## Deferred
+
+- Designed app icon before v1.0 (placeholder shipped).
+- Migrate JSON stores to better-sqlite3 if a user indexes many large channels.
+- Metadata editing (`--parse-metadata`/`--replace-in-metadata`) — held pending a live recipe.
+- PO-token WebView auto-minting — only the `--extractor-args` plumbing shipped.
+- ~~Taskbar overlay badge (needs a drawn `NativeImage`)~~ — done (W11): [badge.ts](src/main/badge.ts).
+- i18n — deliberately deferred (note: UI strings are hard-coded throughout).
+- Code signing — **non-goal**: no certificate will be purchased, so builds ship unsigned and the SmartScreen
+  prompt is accepted. The build remains signing-ready via `CSC_LINK`/`CSC_KEY_PASSWORD` env vars if this ever
+  changes — see [SIGNING.md](docs/SIGNING.md).
+- Live smoke-test of OS-level wiring (tray/jump list/scheduled sync/`aerofetch://`).
diff --git a/ROADMAP-PINCHFLAT.md b/ROADMAP-PINCHFLAT.md
index 2c72b62..2923c03 100644
--- a/ROADMAP-PINCHFLAT.md
+++ b/ROADMAP-PINCHFLAT.md
@@ -109,19 +109,26 @@ yet. This is the prerequisite for every later phase.
         channel?: string
         addedAt: number
         lastIndexedAt?: number
+        itemCount: number      // cached MediaItem count for list display
+        watched?: boolean      // included in scheduled / startup sync (Phase J)
+        feedUrl?: string       // YouTube RSS feed for cheap "anything new?" checks
       }
       interface MediaItem {
-        id: string            // yt-dlp video id — the dedup key
+        id: string             // globally unique, `${sourceId}:${videoId}`
         sourceId: string
+        videoId: string        // yt-dlp video id — the dedup key within a source
         title: string
-        playlistTitle?: string // for the folder path; 'Uploads' fallback
-        playlistIndex?: number // 1-based, for NNN numbering
+        url: string
+        playlistTitle: string  // for the folder path; 'Uploads' fallback
+        playlistIndex: number  // 1-based, for NNN numbering
         durationLabel?: string
         downloaded: boolean
         downloadedAt?: number
         filePath?: string
       }
       ```
+      *(This block reflects the shipped `src/shared/ipc.ts` shape; the original sketch
+      predated the `videoId`/`itemCount`/`watched`/`feedUrl` fields.)*
 - [x] **Dedup on index.** A video appearing in multiple playlists collapses to one `MediaItem`
       (keyed by video id); first playlist seen wins the folder assignment (surface this choice
       in the UI so the user can reassign). The "Uploads" synthetic playlist catches anything in
diff --git a/ROADMAP.md b/ROADMAP.md
index 021a5e6..9ccdaba 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -32,9 +32,10 @@ filename template · yt-dlp version check · NSIS installer + portable build.
 
 A shared `DownloadOptions` model (`src/shared/ipc.ts`) carries the post-processing
 choices end-to-end. Persisted defaults are editable in **Settings → Format &
-post-processing** via a reusable `DownloadOptionsForm` component, which the download
-bar also hosts in a collapsible per-download **Options** panel. The main process emits
-the flags in `buildArgs` (`src/main/download.ts`). All items verified in the UI preview
+post-processing** via a reusable `DownloadOptionsForm` component. (The per-download
+**Options** panel in the download bar is plumbed end-to-end — `StartDownloadOptions.options`/
+`extraArgs` — but not yet surfaced in the bar UI; see audit UX1/M5.) The main process emits
+the flags in `buildArgs` (`src/main/buildArgs.ts`). All items verified in the UI preview
 (typecheck clean). **Real-download smoke test ✅ (2026-06-23):** crop-to-square cover,
 audio re-encode (opus), video container + codec preference (mkv + vp9 merge), subtitle
 embed (→ mov_text), chapter embed, and SponsorBlock-remove (output duration shrinks by the
@@ -55,7 +56,7 @@ found and fixed a real shipping bug — the bundled `ffprobe.exe` was missing (s
 - [x] **Video container + codec preference.** Container choice (mp4/mkv/webm) +
       preferred codec (`-S res,fps,vcodec:…`) to nudge toward av1 / vp9 / h264 without
       overriding the requested resolution.
-- [x] **Embed chapters.** `--embed-chapters` toggle. (`--split-chapters` still TODO.)
+- [x] **Embed chapters.** `--embed-chapters` toggle. (`--split-chapters` shipped in Phase L.)
 - [x] **Embed thumbnail crop-to-square** for audio (Seal's "crop artwork") via thumbnail
       post-processor args. *Smoke-tested ✅: the embedded cover comes out a perfect square
       (360×360) — the `--ppa` crop recipe survives yt-dlp's shlex split + ffmpeg's filtergraph.*
@@ -126,10 +127,12 @@ extraArgs ordering). **Smoke-tested ✅ (2026-06-23):** `parseExtraArgs('--write
       the Custom commands card). The **"run custom command" mode** is
       `Settings.customCommandEnabled`, applied to every new download unless overridden
       per-download in the download bar's Custom command panel.
-- [x] **Command preview.** `IpcChannels.commandPreview` → `previewCommand()`
-      (`src/main/download.ts`) builds the exact argv via the same `buildCommand()` path
-      a real download would take, then renders it with `formatCommandLine`. Surfaced as
-      a **Preview command** button in the download bar, with a Copy button.
+- [ ] **Command preview (plumbed, not surfaced).** `IpcChannels.commandPreview` →
+      `previewCommand()` (`src/main/download.ts`) builds the exact argv via the same
+      `buildCommand()` path a real download would take, then renders it with
+      `formatCommandLine`. The **Preview command** button is NOT yet in the download bar —
+      only the main/preload/buildArgs chain exists. Wire it into the per-download Options
+      panel or remove the chain (audit M5/UX1).
 - [x] **In-app yt-dlp updater.** `updateYtdlp(channel)` (`src/main/ytdlp.ts`) runs
       yt-dlp's own `--update-to stable|nightly`. Surfaced in **Settings → About**, right
       next to the existing version check, with a channel picker + result output.
@@ -154,9 +157,12 @@ parallel storage. All items verified in the UI preview (typecheck + `npm run tes
 - [x] **Native OS notifications** on completion / failure (Electron `Notification`,
       `src/main/download.ts`). Gated by a new **Notify when downloads finish** switch
       (`Settings.notifyOnComplete`, default on); clicking a notification refocuses the window.
-- [x] **Private / incognito mode** — a download bar toggle (`DownloadBar.tsx`, sticky like an
-      incognito tab) sets `DownloadItem.incognito`, which `store/downloads.ts` checks before
-      ever calling `useHistory().add(...)`. Queue items show an eye-off badge when private.
+- [ ] **Private / incognito mode (plumbed, not surfaced).** `DownloadItem.incognito` flows
+      through `buildItem` → history-skip → the QueueItem "Private" badge, and
+      `store/downloads.ts` checks it before ever calling `useHistory().add(...)`. But no UI
+      control sets `incognito: true` yet — the download-bar toggle is not wired (audit M6/UX1).
+      Note `download.ts` would still log a failure / show a completion title for a private item,
+      so the "private" promise currently covers history only (audit L136).
 - [x] **Backup / restore** settings + templates (export / import JSON). New
       `src/main/backup.ts` writes/reads `{ settings, templates }` via a save/open dialog;
       `replaceTemplates()` (`src/main/templates.ts`) does a full restore rather than a
@@ -171,9 +177,9 @@ parallel storage. All items verified in the UI preview (typecheck + `npm run tes
 Some items are Android-specific in Seal and adapted to Windows here.
 
 - [x] **Theme presets + "follow system" and high-contrast.** Settings → Appearance has a
-      Theme select (Light / Dark / **Follow system**) and four accent presets — Toffee
-      (original), Slate, Evergreen, Lavender — each a 16-stop `BrandVariants` ramp sharing
-      toffee's lightness curve at a different hue (`src/renderer/src/theme.ts`). "Follow
+      Theme select (Light / Dark / **Follow system**) and four accent presets — Rose,
+      Coral, Amber, Teal ("Sunset-to-sea", default Teal) — each a 16-stop `BrandVariants`
+      ramp sharing one lightness curve at a different hue (`src/renderer/src/theme.ts`). "Follow
       system" reads Electron's `nativeTheme.shouldUseDarkColors` in the main process
       (`src/main/index.ts`'s `resolveBackgroundMode`/`registerSystemThemeBridge`, pushed to
       the renderer over a new `system-theme:update` channel into
@@ -184,8 +190,8 @@ Some items are Android-specific in Seal and adapted to Windows here.
       Chromium's native `forced-colors` handling since nothing in the app sets
       `forced-color-adjust: none`. The sidebar's quick toggle still works under "system" — it
       sets an explicit light/dark away from whatever's currently resolved, breaking out of
-      auto. Verified in the UI preview (typecheck + `npm run test` clean): default Toffee,
-      switching to Slate/Evergreen/Lavender, Light/Dark/Follow-system, and the sidebar
+      auto. Verified in the UI preview (typecheck + `npm run test` clean): default Teal,
+      switching to Rose/Coral/Amber, Light/Dark/Follow-system, and the sidebar
       toggle's break-out-of-system behavior all checked visually.
 - [x] **Windows "open with" / share integration.** Both mechanisms named above, since a Win32
       (non-MSIX) app can't register as an actual Share Target:
@@ -285,14 +291,11 @@ YTDLnis's signature differentiator. The keyframe plumbing already exists in Aero
       keeps the full file and writes per-chapter files via its default `chapter:` template.
       *Implemented + unit-tested (`buildArgs.test.ts`, typecheck + test green); live smoke test
       still pending.*
-- [ ] **Metadata editing before download.** Change title / author / artist pre-download
-      (YTDLnis: "modify metadata such as title and author"). → `--parse-metadata` /
-      `--replace-in-metadata`; fits the audio path. Good for building a clean music library
-      where the source title is messy. *Held: the exact set-a-literal recipe is fragile
-      (`--parse-metadata FROM:TO` splits on a colon that titles often contain;
-      `--replace-in-metadata FIELD REGEX REPLACE` has empty-field + regex-replacement edge
-      cases) — confirm against a live yt-dlp run before wiring it, rather than guessing the
-      flag.*
+- [x] **Metadata editing before download.** Change title / author / artist pre-download
+      (YTDLnis: "modify metadata such as title and author"). Uses `--replace-in-metadata FIELD ^.*$ VALUE`
+      (not `--parse-metadata FROM:TO` which splits on colons). Only backslashes need escaping in the
+      replacement string. Title, Artist, Album inputs in `DownloadOptionsForm.tsx`; setting any override
+      implicitly enables `--embed-metadata`. Unit-tested in `buildArgs.test.ts`.
 
 ## Phase M — Queue & daily-use UX ✅ COMPLETE
 
@@ -339,8 +342,10 @@ Today `src/renderer/src/store/downloads.ts` has cancel + retry only.
       `datetime-local` input in `DownloadBar.tsx` (future time parks the new download as
       scheduled), plus per-row **Save for later** / **Add to queue** actions in `QueueItem.tsx`;
       saved items survive "Clear finished". Distinct from the Phase J `--sync` schedule (which is
-      for *sources*). **Limitation: the queue isn't persisted, so a schedule only fires while
-      AeroFetch is running** — noted in the UI hint and the code.*
+      for *sources*). The queue is now persisted across restarts (audit M4 — `queue.json` via
+      `src/main/queue.ts`), so a parked/scheduled item survives a quit and its schedule fires on the
+      next launch once due. (The app must still be running at the scheduled moment for an immediate
+      fire; a schedule that came due while closed fires at the next launch.)*
 
 ## Phase N — Power-user surface ✅ COMPLETE
 
@@ -384,9 +389,10 @@ All in the main process. typecheck + test + `npm run build` clean.
 - [x] **Jump list.** *Done: `app.setUserTasks` adds an "Open AeroFetch" task (focuses the
       single instance). **Thumbnail toolbar buttons deferred** — they need per-button `NativeImage`
       assets this repo doesn't have tooling to generate here.*
-- [ ] **Taskbar overlay badge** (`win.setOverlayIcon`) showing active-download count / error state.
-      *Deferred: a numeric/status badge needs a drawn `NativeImage` (no canvas in main); the
-      taskbar progress bar's `error` mode already signals failures.*
+- [x] **Taskbar overlay badge** (`win.setOverlayIcon`) showing active-download count / error state.
+      Green dot when downloading, red dot on error, cleared when idle. Pure-JS PNG generator in
+      `src/main/badge.ts` (Buffer + zlib, no new deps); badgeCount threaded through the existing
+      `taskbarProgress` IPC channel from `summarizeQueue`.
 - [x] **Settings discoverability.** *Done: a search box atop `SettingsView` filters the ~11 cards
       live by matching each card's text (DOM `display` toggle keyed off the root's children — no
       per-card refactor), with a "no settings match" hint.*
@@ -400,17 +406,21 @@ build clean); the parts that inherently need a human or a paid cert are delivere
       `youtubePoToken` → one `--extractor-args "youtube:player_client=…;po_token=…"` group
       (`accessArgs` in `buildArgs.ts`, unit-tested), with "advanced" fields in Settings → Network.
       Lets a power user switch extraction client (`web_safari`/`tv`/`mweb`) or paste a token.*
-      **Deferred: automatic WebView token minting** (the YTDLnis headline) — the hard part;
-      this is the argv plumbing it would feed. Cookies remain the easier bot-check fix.
+      **Automatic WebView token minting shipped:** `src/main/poToken.ts` opens a YouTube video
+      page in a hardened BrowserWindow (shared login session), injects an async poll for
+      `ytInitialPlayerResponse.serviceIntegrityDimensions.poToken`, saves the result encrypted
+      via `safeStorage`. "Fetch" button in Settings → Network triggers it via `youtube:po-token-mint`
+      IPC. Falls back gracefully (null) if YouTube's page structure changes.
 - [x] **Verify the shipped-but-untested OS wiring.** *Can't be executed here (no real install).
       Delivered as a release-gate checklist — [docs/SMOKE-TEST.md](docs/SMOKE-TEST.md) —
       enumerating every untested path (cookies window, `aerofetch://` + Send-to, scheduled
       `--sync` + RSS, aria2c, proxy, plus the new tray/taskbar/pause-resume/terminal) with exact
       steps + expected results. **Still needs a human to run it.**
-- [x] **Code signing.** *Build is signing-ready: electron-builder picks the cert up from
-      `CSC_LINK` / `CSC_KEY_PASSWORD` with no yml change (unset = unsigned, as today). Documented
-      in [docs/SIGNING.md](docs/SIGNING.md) (OV vs EV, local + CI, HSM/EV hook, signature
-      verification). **Actual signing needs a purchased certificate.***
+- [x] **Code signing — non-goal.** *Decision: no certificate will be purchased, so builds ship
+      unsigned and the SmartScreen first-run prompt is accepted. The build stays signing-ready —
+      electron-builder picks the cert up from `CSC_LINK` / `CSC_KEY_PASSWORD` with no yml change
+      (unset = unsigned, as today), documented in [docs/SIGNING.md](docs/SIGNING.md) (OV vs EV,
+      local + CI, HSM/EV hook, signature verification) — if that decision is ever reversed.*
 - [ ] **i18n / language setting.** Still deferred — deliberately not faked. Shipping a language
       picker that doesn't change anything would be misleading; doing it properly means wiring an
       i18n library + extracting every string, with translations arriving incrementally. Tracked,
diff --git a/build/icon.ico b/build/icon.ico
index 0095f91..73c40fa 100644
Binary files a/build/icon.ico and b/build/icon.ico differ
diff --git a/build/icon.svg b/build/icon.svg
index 30ac467..4278751 100644
--- a/build/icon.svg
+++ b/build/icon.svg
@@ -1,12 +1,26 @@
 <svg width="256" height="256" viewBox="0 0 256 256" xmlns="http://www.w3.org/2000/svg">
-  <!-- Placeholder app icon (audit M3). Mirrors the in-app brand mark in
-       Onboarding.tsx: a white download arrow on a rounded square in the default
-       "teal" accent (theme.ts teal[80] = colorBrandBackground in light mode).
-       Replace with a designed asset before v1.0; regenerate icon.ico from this. -->
-  <rect x="0" y="0" width="256" height="256" rx="52" ry="52" fill="#148185"/>
-  <g fill="#ffffff">
-    <rect x="112" y="46" width="32" height="88" rx="12" ry="12"/>
-    <polygon points="82,114 174,114 128,176"/>
-    <rect x="66" y="190" width="124" height="20" rx="10" ry="10"/>
+  <!-- AeroFetch app icon (audit W14). A white download glyph — shaft + chevron over
+       a landing shelf — on the teal brand square, with a top-lit vertical gradient
+       drawn from the teal accent ramp (theme.ts teal 50→90, centred on teal[80]
+       #148185, the light-mode colorBrandBackground) and a soft upper sheen for depth.
+       The bold rounded strokes stay legible down to 16px. Regenerate the multi-size
+       .ico after any edit:
+         magick -background none build/icon.svg -define icon:auto-resize=256,128,64,48,32,16 build/icon.ico -->
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#1aa6ab"/>
+      <stop offset="1" stop-color="#0d595c"/>
+    </linearGradient>
+    <linearGradient id="sheen" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#ffffff" stop-opacity="0.16"/>
+      <stop offset="0.45" stop-color="#ffffff" stop-opacity="0"/>
+    </linearGradient>
+  </defs>
+  <rect x="0" y="0" width="256" height="256" rx="56" ry="56" fill="url(#bg)"/>
+  <rect x="0" y="0" width="256" height="256" rx="56" ry="56" fill="url(#sheen)"/>
+  <g fill="none" stroke="#ffffff" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M128 56 L128 150" stroke-width="30"/>
+    <path d="M84 116 L128 160 L172 116" stroke-width="30"/>
+    <path d="M80 200 L176 200" stroke-width="26"/>
   </g>
 </svg>
diff --git a/electron-builder.yml b/electron-builder.yml
index 7ace0c8..485ff83 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -1,6 +1,6 @@
 appId: com.aerofetch.app
 productName: AeroFetch
-copyright: yt-dlp frontend
+copyright: Copyright © 2026 AeroFetch
 
 # Lets a browser/another app hand AeroFetch a link via aerofetch://download?url=<encoded>
 # (src/main/deeplink.ts) — the closest Windows analog to Android's share-to-app intent.
@@ -15,13 +15,18 @@ directories:
   buildResources: build
   output: dist
 
+# Generate a <installer>.exe.sha256 next to every built .exe (H8). The updater
+# hard-requires this checksum asset or it refuses to install the update.
+afterAllArtifactBuild: ./scripts/generate-checksums.cjs
+
 files:
   - '!**/.vscode/*'
   - '!src/*'
   - '!electron.vite.config.{js,ts,mjs,cjs}'
-  - '!{.eslintignore,.eslintrc.cjs,.eslintrc.js,.prettierignore,.prettierrc.yaml,dev-app-update.yml,CHANGELOG.md,README.md}'
+  - '!{eslint.config.js,.prettierrc,dev-app-update.yml,CHANGELOG.md,README.md}'
   - '!{.env,.env.*,.npmrc,pnpm-lock.yaml,package-lock.json}'
-  - '!{tsconfig.json,tsconfig.node.json,tsconfig.web.json,tsconfig.tsbuildinfo}'
+  - '!{tsconfig.json,tsconfig.node.json,tsconfig.web.json}'
+  - '!*.tsbuildinfo'
 
 # yt-dlp.exe + ffmpeg.exe ship outside the asar archive so they can be spawned
 # directly. They land in <install>/resources/bin, reachable via process.resourcesPath.
@@ -46,9 +51,9 @@ win:
     - portable
   # Never request admin elevation.
   requestedExecutionLevel: asInvoker
-  # Placeholder icon (audit M3): white download glyph on the teal brand square,
-  # mirroring the in-app brand mark. Generated from build/icon.svg as a multi-size
-  # .ico (256/128/64/48/32/16). Replace with a designed asset before v1.0 — re-run
+  # App icon (audit W14): white download glyph on the teal brand square with a
+  # top-lit gradient. Generated from build/icon.svg as a multi-size .ico
+  # (256/128/64/48/32/16). After editing the SVG, regenerate with:
   #   magick -background none build/icon.svg -define icon:auto-resize=256,128,64,48,32,16 build/icon.ico
   icon: build/icon.ico
 
@@ -63,4 +68,7 @@ nsis:
   perMachine: false
   allowToChangeInstallationDirectory: true
   deleteAppDataOnUninstall: false
+  # The custom updater (src/main/updater.ts) does a full download and never consumes
+  # the differential .blockmap, so don't emit it (audit L83 — dead build artifact).
+  differentialPackage: false
   # Flip perMachine to true for an all-users install to Program Files (requires admin).
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index baad558..c94899d 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -9,7 +9,11 @@ export default defineConfig({
       alias: {
         '@shared': resolve('src/shared')
       }
-    }
+    },
+    // Hidden source maps: emit .map files so a field crash stack (the logger writes
+    // raw stacks, CC8) can be symbolicated offline, without referencing/exposing them
+    // in the shipped bundle (L170).
+    build: { sourcemap: 'hidden' }
   },
   preload: {
     plugins: [externalizeDepsPlugin()],
@@ -21,6 +25,7 @@ export default defineConfig({
     // Emit CommonJS (.cjs): sandboxed preload scripts must be CJS, and enabling
     // the sandbox (webPreferences.sandbox) is part of the security hardening.
     build: {
+      sourcemap: 'hidden',
       rollupOptions: {
         output: {
           format: 'cjs',
@@ -36,6 +41,7 @@ export default defineConfig({
         '@shared': resolve('src/shared')
       }
     },
-    plugins: [react()]
+    plugins: [react()],
+    build: { sourcemap: 'hidden' }
   }
 })
diff --git a/eslint.config.js b/eslint.config.js
new file mode 100644
index 0000000..f6b687a
--- /dev/null
+++ b/eslint.config.js
@@ -0,0 +1,43 @@
+import js from '@eslint/js'
+import tseslint from 'typescript-eslint'
+import globals from 'globals'
+import prettier from 'eslint-config-prettier'
+
+// Flat config (ESLint 9 + typescript-eslint 8). Codifies the existing house style
+// (CC2): typescript-eslint's recommended logic/type rules, with formatting left
+// entirely to Prettier (eslint-config-prettier turns off any stylistic rules).
+// Run with `npm run lint`; `npm run format` applies Prettier.
+export default tseslint.config(
+  { ignores: ['out/**', 'dist/**', 'node_modules/**', '**/*.cjs'] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      globals: { ...globals.node, ...globals.browser }
+    },
+    rules: {
+      // Empty catch blocks are a deliberate best-effort pattern across the app.
+      'no-empty': ['error', { allowEmptyCatch: true }],
+      // Allow a documented @ts-ignore. The preload's window fallback needs one
+      // whose necessity is incremental-build-state-dependent, so @ts-expect-error
+      // (which errors when momentarily unused) is the wrong tool there.
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        { 'ts-ignore': 'allow-with-description', minimumDescriptionLength: 3 }
+      ],
+      // Allow intentionally-unused names prefixed with `_` (e.g. IPC event args).
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }
+      ]
+    }
+  },
+  {
+    // TypeScript already resolves identifiers/types, so core no-undef only
+    // false-positives on globals and type-only references here.
+    files: ['**/*.{ts,tsx}'],
+    rules: { 'no-undef': 'off' }
+  },
+  // Keep Prettier last so it wins over any formatting-related rule.
+  prettier
+)
diff --git a/package-lock.json b/package-lock.json
index 282ce1d..537f0be 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,6 +19,7 @@
       },
       "devDependencies": {
         "@electron-toolkit/tsconfig": "^2.0.0",
+        "@eslint/js": "^9.39.4",
         "@types/node": "^26.0.0",
         "@types/react": "^19.2.17",
         "@types/react-dom": "^19.2.3",
@@ -26,7 +27,12 @@
         "electron": "^42.4.1",
         "electron-builder": "^26.15.3",
         "electron-vite": "^5.0.0",
+        "eslint": "^9.39.4",
+        "eslint-config-prettier": "^10.1.8",
+        "globals": "^15.15.0",
+        "prettier": "^3.9.3",
         "typescript": "^6.0.3",
+        "typescript-eslint": "^8.62.1",
         "vite": "^7.3.5",
         "vitest": "^4.1.9"
       }
@@ -1136,6 +1142,249 @@
         "node": ">=18"
       }
     },
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/config-array": {
+      "version": "0.21.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
+      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/object-schema": "^2.1.7",
+        "debug": "^4.3.1",
+        "minimatch": "^3.1.5"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/config-array/node_modules/brace-expansion": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
+      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^0.17.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/eslintrc": {
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
+      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^6.14.0",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.1",
+        "minimatch": "^3.1.5",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/@eslint/js": {
+      "version": "9.39.4",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz",
+      "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      }
+    },
+    "node_modules/@eslint/object-schema": {
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
+      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
+      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^0.17.0",
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
     "node_modules/@floating-ui/core": {
       "version": "1.7.5",
       "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.5.tgz",
@@ -2753,6 +3002,72 @@
         "csstype": "^3.2.3"
       }
     },
+    "node_modules/@humanfs/core": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
@@ -3511,6 +3826,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/keyv": {
       "version": "3.1.4",
       "resolved": "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.4.tgz",
@@ -3566,6 +3888,249 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.1.tgz",
+      "integrity": "sha512-4EQM77WgVNxj7OkL/5b/D/xZsw00G577+UriYTC7JF5opcF3T2AuoeY7ueLaZgSVjSgCS6yOAJB5bRGLPSJUzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/type-utils": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
+        "ignore": "^7.0.5",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^8.62.1",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.1.tgz",
+      "integrity": "sha512-sPhE4iHuJDSvoAiec+Ro8JyXw8f0ql13HFR82P99nCm9GwTEKG0KYLvDe6REk8BCXuit6vJAv/Yxg5ABaNS2rA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.1.tgz",
+      "integrity": "sha512-yQ3RgY5RkSBpsNS1Bx/JQEcA24FOSdfGktoyprAr5u18390UQdtVcfnEv4nIrIshNnavlVyZBKxQwT1fIAE6cg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.62.1",
+        "@typescript-eslint/types": "^8.62.1",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.1.tgz",
+      "integrity": "sha512-r4d249KbQ1SFdpeStvob8Ih6aPPIzfqllPVOtvhve6ZcpuVcYo5/7zUWckKpHE7StASX4kTKZTLf0WQm/wPkcg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.1.tgz",
+      "integrity": "sha512-xadytJqX9vJVQ2fdQjkcIVigwaOJNWkpjdLt6cEQ+xPnrI1fkp+/jZE/I97k9KUjqtpd25i0HeyZf3T6dutv2g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.1.tgz",
+      "integrity": "sha512-aXM5xlqXiTxPibXB93cLAURfT3rlizf7uMXISCXy66Isr/9hISJx3yDsKl0L7lKa51b8JpFuNKby0/O0pEm9jg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.1.tgz",
+      "integrity": "sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.1.tgz",
+      "integrity": "sha512-xMcW9oP9u7fAMXYs9A65CVmtLQe2r//oXINHfi8HV+oiqhih17sbLdhXr4540YWlgpDKQdY854OL5ZrdCiQsAA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/project-service": "8.62.1",
+        "@typescript-eslint/tsconfig-utils": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/visitor-keys": "8.62.1",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.1.tgz",
+      "integrity": "sha512-sHtbPfuKNZCG+ih8SyjjucqRntSVmp8XgL5u6o9mAhiSn8ds5o/M/XdM0abweme2Tln3szOstOrZ9OXitvPh0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.62.1",
+        "@typescript-eslint/types": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.1.tgz",
+      "integrity": "sha512-4g3BLxfdTMy8iZG0MaBkadnlRrCJ74cQiFbyEVMrkwIoqdyaXXQM22cotDvrl4x28wgIZ9rEJRoM+mmhSJpJ1g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.62.1",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
     "node_modules/@vitejs/plugin-react": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-5.2.0.tgz",
@@ -3720,6 +4285,29 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/acorn": {
+      "version": "8.17.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
+      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
     "node_modules/agent-base": {
       "version": "7.1.4",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
@@ -4252,6 +4840,16 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/caniuse-lite": {
       "version": "1.0.30001799",
       "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
@@ -4572,6 +5170,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/defer-to-connect": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.1.tgz",
@@ -5163,7 +5768,6 @@
       "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=10"
       },
@@ -5171,6 +5775,221 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/eslint": {
+      "version": "9.39.4",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz",
+      "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.8.0",
+        "@eslint-community/regexpp": "^4.12.1",
+        "@eslint/config-array": "^0.21.2",
+        "@eslint/config-helpers": "^0.4.2",
+        "@eslint/core": "^0.17.0",
+        "@eslint/eslintrc": "^3.3.5",
+        "@eslint/js": "9.39.4",
+        "@eslint/plugin-kit": "^0.4.1",
+        "@humanfs/node": "^0.16.6",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.4.2",
+        "@types/estree": "^1.0.6",
+        "ajv": "^6.14.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.6",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^8.4.0",
+        "eslint-visitor-keys": "^4.2.1",
+        "espree": "^10.4.0",
+        "esquery": "^1.5.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^8.0.0",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.5",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-config-prettier": {
+      "version": "10.1.8",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.8.tgz",
+      "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "eslint-config-prettier": "bin/cli.js"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint-config-prettier"
+      },
+      "peerDependencies": {
+        "eslint": ">=7.0.0"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
+      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
+      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint/node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint/node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/espree": {
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
+      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^4.2.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
     "node_modules/estree-walker": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
@@ -5181,6 +6000,16 @@
         "@types/estree": "^1.0.0"
       }
     },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/expect-type": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
@@ -5204,6 +6033,20 @@
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "license": "MIT"
     },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/fast-uri": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
@@ -5238,6 +6081,19 @@
         }
       }
     },
+    "node_modules/file-entry-cache": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
+      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flat-cache": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/filelist": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
@@ -5278,6 +6134,44 @@
         "node": ">=10"
       }
     },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
+      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.4"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/form-data": {
       "version": "4.0.6",
       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
@@ -5439,6 +6333,19 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
     "node_modules/glob/node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -5489,6 +6396,19 @@
         "node": ">=10.0"
       }
     },
+    "node_modules/globals": {
+      "version": "15.15.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-15.15.0.tgz",
+      "integrity": "sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/globalthis": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
@@ -5700,6 +6620,43 @@
         "node": ">= 14"
       }
     },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-fresh": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
+      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
     "node_modules/inflight": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
@@ -5719,6 +6676,16 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
@@ -5729,6 +6696,19 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/isarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
@@ -5849,6 +6829,13 @@
       "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
       "license": "BSD-2-Clause"
     },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/json-stringify-safe": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
@@ -5906,6 +6893,36 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/lodash": {
       "version": "4.18.1",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
@@ -5913,6 +6930,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lowercase-keys": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/lowercase-keys/-/lowercase-keys-2.0.0.tgz",
@@ -6113,6 +7137,13 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/node-abi": {
       "version": "4.31.0",
       "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.31.0.tgz",
@@ -6288,6 +7319,24 @@
         "wrappy": "1"
       }
     },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/p-cancelable": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.1.1.tgz",
@@ -6314,6 +7363,45 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -6481,6 +7569,32 @@
         "node": "^12.20.0 || >=14"
       }
     },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.9.3",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.3.tgz",
+      "integrity": "sha512-HWmu+K+zvHNpaMfSnYeqdqrDbR16cuIXaPx8WoHaviQkDJh1/0BNtOZmHVQI5jc3wXv0H1yXc9wjvFdXh+n3hQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
     "node_modules/proc-log": {
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz",
@@ -6544,6 +7658,16 @@
         "once": "^1.3.1"
       }
     },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/pvtsutils": {
       "version": "1.3.6",
       "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
@@ -6681,6 +7805,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/responselike": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/responselike/-/responselike-2.0.1.tgz",
@@ -7027,6 +8161,19 @@
         "node": ">=8"
       }
     },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/stubborn-fs": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/stubborn-fs/-/stubborn-fs-2.0.0.tgz",
@@ -7242,12 +8389,38 @@
         "utf8-byte-length": "^1.0.1"
       }
     },
+    "node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
     "node_modules/type-fest": {
       "version": "5.7.0",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-5.7.0.tgz",
@@ -7277,6 +8450,30 @@
         "node": ">=14.17"
       }
     },
+    "node_modules/typescript-eslint": {
+      "version": "8.62.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.1.tgz",
+      "integrity": "sha512-vymnnM5g0AKQDSAyfP12nMIBvgwgA42syg74kkuZ4x1VuTzwQKwc5h9rGxeShCjny5o+zWAb6OEoz7XLgrIkIw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.62.1",
+        "@typescript-eslint/parser": "8.62.1",
+        "@typescript-eslint/typescript-estree": "8.62.1",
+        "@typescript-eslint/utils": "8.62.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
     "node_modules/uint8array-extras": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz",
@@ -7376,6 +8573,16 @@
         "browserslist": ">= 4.21.0"
       }
     },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
     "node_modules/use-sync-external-store": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
@@ -8101,6 +9308,16 @@
         "node": ">=8"
       }
     },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
diff --git a/package.json b/package.json
index f438460..abcd30d 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,12 @@
   "description": "A yt-dlp frontend for Windows",
   "main": "./out/main/index.js",
   "author": "AeroFetch",
-  "homepage": "https://github.com/yt-dlp/yt-dlp",
+  "license": "UNLICENSED",
+  "homepage": "https://gitea.netbird.zimspace.uk:5938/debont80/AeroFetch",
+  "repository": {
+    "type": "git",
+    "url": "https://gitea.netbird.zimspace.uk:5938/debont80/AeroFetch.git"
+  },
   "private": true,
   "type": "module",
   "scripts": {
@@ -14,12 +19,18 @@
     "ui:build": "vite build",
     "ui:preview": "vite preview",
     "build": "electron-vite build",
-    "build:win": "electron-vite build && electron-builder --win",
+    "clean:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build:win": "npm run clean:dist && electron-vite build && electron-builder --win",
     "start": "electron-vite preview",
     "typecheck:node": "tsc --noEmit -p tsconfig.node.json --composite false",
     "typecheck:web": "tsc --noEmit -p tsconfig.web.json --composite false",
     "typecheck": "npm run typecheck:node && npm run typecheck:web",
-    "test": "vitest run"
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write \"src/**/*.{ts,tsx}\" \"test/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx}\" \"test/**/*.ts\"",
+    "test": "vitest run",
+    "test:integration": "set AEROFETCH_REAL_DOWNLOAD=1&& vitest run test/real-download.integration.test.ts"
   },
   "dependencies": {
     "@electron-toolkit/utils": "^4.0.0",
@@ -33,6 +44,7 @@
   },
   "devDependencies": {
     "@electron-toolkit/tsconfig": "^2.0.0",
+    "@eslint/js": "^9.39.4",
     "@types/node": "^26.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -40,7 +52,12 @@
     "electron": "^42.4.1",
     "electron-builder": "^26.15.3",
     "electron-vite": "^5.0.0",
+    "eslint": "^9.39.4",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^15.15.0",
+    "prettier": "^3.9.3",
     "typescript": "^6.0.3",
+    "typescript-eslint": "^8.62.1",
     "vite": "^7.3.5",
     "vitest": "^4.1.9"
   }
diff --git a/scripts/generate-checksums.cjs b/scripts/generate-checksums.cjs
new file mode 100644
index 0000000..f3500fa
--- /dev/null
+++ b/scripts/generate-checksums.cjs
@@ -0,0 +1,36 @@
+// electron-builder `afterAllArtifactBuild` hook (H8).
+//
+// The in-app updater (src/main/updater.ts) sets REQUIRE_CHECKSUM = true and
+// refuses any release whose installer lacks a sibling `<installer>.exe.sha256`
+// asset — so a release published without one makes EVERY client's in-app update
+// fail. `build:win` never generated these, so they had to be made by hand (and
+// the 0.5.0 build shipped without any). This hook writes one next to every built
+// `.exe`, in `sha256sum` format (`<lowercase-hex>  <filename>`), which the
+// updater's extractSha256 parses (it just needs a standalone 64-char hex token).
+//
+// Returning the paths tells electron-builder to also upload them as release
+// assets when publishing.
+
+const { createHash } = require('crypto')
+const { readFileSync, writeFileSync } = require('fs')
+const { basename } = require('path')
+
+/** The `sha256sum`-format line for a file: "<lowercase-hex>  <basename>". */
+function checksumLine(filePath) {
+  const hex = createHash('sha256').update(readFileSync(filePath)).digest('hex')
+  return `${hex}  ${basename(filePath)}`
+}
+
+exports.default = function generateChecksums(context) {
+  const written = []
+  for (const file of context.artifactPaths) {
+    if (!/\.exe$/i.test(file)) continue
+    const out = `${file}.sha256`
+    writeFileSync(out, checksumLine(file) + '\n')
+    written.push(out)
+  }
+  return written
+}
+
+// Exported for unit testing the hashing/format without running electron-builder.
+exports.checksumLine = checksumLine
diff --git a/src/main/backup.ts b/src/main/backup.ts
index fff7c4b..9aa58f4 100644
--- a/src/main/backup.ts
+++ b/src/main/backup.ts
@@ -1,14 +1,9 @@
 import { dialog, type BrowserWindow } from 'electron'
 import { readFileSync, writeFileSync } from 'fs'
-import { getSettings, setSettings } from './settings'
+import { getSettings, setSettings, SECRET_KEYS } from './settings'
 import { listTemplates, replaceTemplates } from './templates'
 import { isTemplateLike } from './validation'
-import type {
-  BackupExportResult,
-  BackupImportResult,
-  Settings,
-  CommandTemplate
-} from '@shared/ipc'
+import type { BackupExportResult, BackupImportResult, Settings, CommandTemplate } from '@shared/ipc'
 
 interface BackupFile {
   version: 1
@@ -17,12 +12,18 @@ interface BackupFile {
 }
 
 export async function exportBackup(win: BrowserWindow | undefined): Promise<BackupExportResult> {
-  const res = await dialog.showSaveDialog(win!, {
+  const opts = {
     defaultPath: 'aerofetch-backup.json',
     filters: [{ name: 'JSON', extensions: ['json'] }]
-  })
+  }
+  const res = await (win ? dialog.showSaveDialog(win, opts) : dialog.showSaveDialog(opts))
   if (res.canceled || !res.filePath) return { ok: false }
-  const payload: BackupFile = { version: 1, settings: getSettings(), templates: listTemplates() }
+  // Strip credentials (proxy creds, API tokens) so a backup file shared or synced
+  // to the cloud doesn't leak secrets in plaintext (M22). The user re-enters them
+  // after import. Shares SECRET_KEYS with settings.ts so the lists can't drift.
+  const settings = { ...getSettings() }
+  for (const key of SECRET_KEYS) (settings as Record<string, unknown>)[key] = ''
+  const payload: BackupFile = { version: 1, settings, templates: listTemplates() }
   try {
     writeFileSync(res.filePath, JSON.stringify(payload, null, 2))
     return { ok: true, path: res.filePath }
@@ -32,10 +33,11 @@ export async function exportBackup(win: BrowserWindow | undefined): Promise<Back
 }
 
 export async function importBackup(win: BrowserWindow | undefined): Promise<BackupImportResult> {
-  const res = await dialog.showOpenDialog(win!, {
-    properties: ['openFile'],
+  const openOpts = {
+    properties: ['openFile' as const],
     filters: [{ name: 'JSON', extensions: ['json'] }]
-  })
+  }
+  const res = await (win ? dialog.showOpenDialog(win, openOpts) : dialog.showOpenDialog(openOpts))
   if (res.canceled || !res.filePaths[0]) return { ok: false }
 
   let parsed: unknown
@@ -85,10 +87,9 @@ export async function importBackup(win: BrowserWindow | undefined): Promise<Back
         return `• ${name}: ${args}`
       })
       .join('\n')
-    const more =
-      commandTemplates.length > 10 ? `\n…and ${commandTemplates.length - 10} more.` : ''
-    const choice = await dialog.showMessageBox(win!, {
-      type: 'warning',
+    const more = commandTemplates.length > 10 ? `\n…and ${commandTemplates.length - 10} more.` : ''
+    const msgOpts = {
+      type: 'warning' as const,
       buttons: ['Enable custom commands', 'Import without enabling', 'Cancel'],
       defaultId: 1,
       cancelId: 2,
@@ -100,17 +101,26 @@ export async function importBackup(win: BrowserWindow | undefined): Promise<Back
         'Custom commands run extra yt-dlp flags on every download. Only enable them if you trust this backup file.\n\n' +
         preview +
         more
-    })
+    }
+    const choice = await (win
+      ? dialog.showMessageBox(win, msgOpts)
+      : dialog.showMessageBox(msgOpts))
     if (choice.response === 2) return { ok: false } // Cancel — change nothing
     applyCustomCommands = choice.response === 0
   }
 
   if (incomingSettings) {
+    // Never restore credential fields from a backup. Exports strip them (M22), so an
+    // imported '' would otherwise wipe a proxy/token already configured on this
+    // machine; honoring a hand-edited one would reintroduce the leak vector. Either
+    // way, import leaves the user's existing secrets untouched — they re-enter as needed.
+    const restored: Partial<Settings> = { ...incomingSettings }
+    for (const key of SECRET_KEYS) delete restored[key]
     // When the user declined to enable custom commands (or there were none to
     // enable), force the toggle off so an imported defaultTemplateId can't auto-run.
     const safeSettings = applyCustomCommands
-      ? incomingSettings
-      : { ...incomingSettings, customCommandEnabled: false }
+      ? restored
+      : { ...restored, customCommandEnabled: false }
     setSettings(safeSettings)
   }
   if (incomingTemplates.length > 0 || Array.isArray(file.templates)) {
diff --git a/src/main/badge.ts b/src/main/badge.ts
new file mode 100644
index 0000000..c15cf5e
--- /dev/null
+++ b/src/main/badge.ts
@@ -0,0 +1,87 @@
+import { deflateSync } from 'zlib'
+import { nativeImage, type NativeImage } from 'electron'
+
+// CRC32 table polynomial used by PNG.
+function crc32(buf: Buffer): number {
+  let crc = 0xffffffff
+  for (const b of buf) {
+    crc ^= b
+    for (let i = 0; i < 8; i++) crc = crc & 1 ? (crc >>> 1) ^ 0xedb88320 : crc >>> 1
+  }
+  return (crc ^ 0xffffffff) >>> 0
+}
+
+function pngChunk(type: string, data: Buffer): Buffer {
+  const t = Buffer.from(type, 'ascii')
+  const len = Buffer.alloc(4)
+  len.writeUInt32BE(data.length)
+  const crc = Buffer.alloc(4)
+  crc.writeUInt32BE(crc32(Buffer.concat([t, data])))
+  return Buffer.concat([len, t, data, crc])
+}
+
+/**
+ * Build a 16×16 RGBA PNG containing a solid-colour filled circle. Used for the
+ * Windows taskbar overlay badge. No external deps — pure Node.js (Buffer + zlib).
+ */
+function makeDotPng(r: number, g: number, b: number): NativeImage {
+  const W = 16,
+    H = 16
+  const px = Buffer.alloc(W * H * 4, 0) // transparent bg
+  const cx = W / 2,
+    cy = H / 2,
+    rad = W / 2 - 1.5
+
+  for (let y = 0; y < H; y++) {
+    for (let x = 0; x < W; x++) {
+      const dx = x + 0.5 - cx,
+        dy = y + 0.5 - cy
+      if (dx * dx + dy * dy <= rad * rad) {
+        const i = (y * W + x) * 4
+        px[i] = r
+        px[i + 1] = g
+        px[i + 2] = b
+        px[i + 3] = 255
+      }
+    }
+  }
+
+  // PNG: IHDR (8-bit RGBA, no interlace), filter-0 rows, deflated IDAT, IEND.
+  const ihdr = Buffer.alloc(13)
+  ihdr.writeUInt32BE(W, 0)
+  ihdr.writeUInt32BE(H, 4)
+  ihdr[8] = 8 // bit depth
+  ihdr[9] = 6 // colour type: RGBA
+
+  const rows = Buffer.alloc(H * (1 + W * 4))
+  for (let y = 0; y < H; y++) {
+    rows[y * (1 + W * 4)] = 0 // filter type: None
+    px.copy(rows, y * (1 + W * 4) + 1, y * W * 4, (y + 1) * W * 4)
+  }
+
+  const sig = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])
+  const png = Buffer.concat([
+    sig,
+    pngChunk('IHDR', ihdr),
+    pngChunk('IDAT', deflateSync(rows)),
+    pngChunk('IEND', Buffer.alloc(0))
+  ])
+  return nativeImage.createFromBuffer(png)
+}
+
+// Lazy-initialised singletons — created on first use so this module is safe to
+// import before the app is ready (nativeImage.createFromBuffer is fine post-ready).
+let activeBadge: NativeImage | null = null
+let errorBadge: NativeImage | null = null
+
+/** Green dot badge for the taskbar overlay — shown when downloads are active. */
+export function getActiveBadge(): NativeImage {
+  if (!activeBadge) activeBadge = makeDotPng(58, 185, 108) // #3ab96c
+  return activeBadge
+}
+
+/** Red dot badge for the taskbar overlay — shown when a download has errored. */
+export function getErrorBadge(): NativeImage {
+  if (!errorBadge) errorBadge = makeDotPng(217, 48, 37) // #d93025
+  return errorBadge
+}
diff --git a/src/main/binaries.ts b/src/main/binaries.ts
index 098256f..8b3cde5 100644
--- a/src/main/binaries.ts
+++ b/src/main/binaries.ts
@@ -1,4 +1,4 @@
-import { app } from 'electron'
+import { app, nativeImage, type NativeImage } from 'electron'
 import { join } from 'path'
 import { is } from '@electron-toolkit/utils'
 
@@ -24,6 +24,23 @@ export function getAppIconPath(): string {
     : join(process.resourcesPath, 'icon.ico')
 }
 
+let appIconImage: NativeImage | null = null
+/**
+ * The app icon as a cached NativeImage, for OS notifications (W13/L127). Loaded
+ * once from getAppIconPath(); a missing icon yields an empty image, which
+ * Notification treats as "no icon" (the OS default) rather than erroring. This
+ * gives completion/background toasts the real brand glyph — notably on the
+ * portable build, which has no installed AUMID shortcut icon for Windows to use.
+ */
+export function getAppIconImage(): NativeImage {
+  // Cache only a valid image so a transient read miss isn't latched forever; a
+  // genuinely-missing icon just re-reads (cheap — notifications are infrequent).
+  if (!appIconImage || appIconImage.isEmpty()) {
+    appIconImage = nativeImage.createFromPath(getAppIconPath())
+  }
+  return appIconImage
+}
+
 /**
  * AeroFetch keeps its OWN writable copy of yt-dlp.exe under userData, separate
  * from the read-only bundled seed in resources/bin. The managed copy is what
@@ -35,7 +52,7 @@ export function getAppIconPath(): string {
  * ffmpeg/ffprobe/aria2c stay in getBinDir(): they're not self-updating and
  * yt-dlp finds them via `--ffmpeg-location <binDir>`.
  */
-export function getManagedBinDir(): string {
+function getManagedBinDir(): string {
   return join(app.getPath('userData'), 'bin')
 }
 
@@ -63,6 +80,10 @@ export function getFfprobePath(): string {
   return join(getBinDir(), 'ffprobe.exe')
 }
 
+/** User-facing error shown by download/probe/index/update when yt-dlp.exe is missing. */
+export const YTDLP_MISSING_MSG =
+  'yt-dlp.exe is missing. Open Settings → Software update to re-download it.'
+
 /** Optional bundled external downloader; absent unless dropped into resources/bin. */
 export function getAria2cPath(): string {
   return join(getBinDir(), 'aria2c.exe')
diff --git a/src/main/buildArgs.ts b/src/main/buildArgs.ts
index 7b66cf3..997c8c6 100644
--- a/src/main/buildArgs.ts
+++ b/src/main/buildArgs.ts
@@ -42,9 +42,7 @@ function videoFormat(quality: string): string {
  */
 function videoSelector(opts: StartDownloadOptions): string {
   if (opts.formatId && opts.formatId !== BEST_FORMAT_ID) {
-    return opts.formatHasAudio
-      ? opts.formatId
-      : `${opts.formatId}+bestaudio/${opts.formatId}`
+    return opts.formatHasAudio ? opts.formatId : `${opts.formatId}+bestaudio/${opts.formatId}`
   }
   return videoFormat(opts.quality)
 }
@@ -57,18 +55,27 @@ function audioQuality(quality: string): string {
       return '192K'
     case '128 kbps':
       return '128K'
+    case 'Best':
+      return '0'
     default:
-      return '0' // Best
+      // Unrecognised label — fall back to best (0) so the download still works.
+      return '0'
   }
 }
 
+// Stdout line markers, shared by the emit side (the --print templates here) and
+// the parse side (download.ts). Defined once so changing a marker can't silently
+// break the parser that splits on it (CL1).
+export const PROGRESS_MARKER = 'prog|'
+export const FILEPATH_MARKER = 'path|'
+
 // The progress line yt-dlp emits (one per --newline tick). Note the leading
 // `download:` is the progress-template TYPE selector and is consumed by yt-dlp
-// (it does NOT appear in the output). The literal `prog|` that follows is our
+// (it does NOT appear in the output). The PROGRESS_MARKER that follows is our
 // own marker, so we can tell progress lines apart from the after-move filepath
 // print on the same stdout stream.
-export const PROGRESS_TEMPLATE =
-  'download:prog|%(progress.status)s|%(progress.downloaded_bytes)s|' +
+const PROGRESS_TEMPLATE =
+  `download:${PROGRESS_MARKER}%(progress.status)s|%(progress.downloaded_bytes)s|` +
   '%(progress.total_bytes)s|%(progress.total_bytes_estimate)s|' +
   '%(progress.speed)s|%(progress.eta)s'
 
@@ -77,8 +84,7 @@ export const PROGRESS_TEMPLATE =
 // double quotes and leaving ffmpeg single-quoted crop expressions whose commas are
 // protected from ffmpeg's filtergraph separator. Side = min(width, height).
 export const CROP_SQUARE_PPA =
-  'EmbedThumbnail+ffmpeg_o:-c:v mjpeg -vf ' +
-  'crop="\'if(gt(ih,iw),iw,ih)\':\'if(gt(iw,ih),ih,iw)\'"'
+  'EmbedThumbnail+ffmpeg_o:-c:v mjpeg -vf ' + "crop=\"'if(gt(ih,iw),iw,ih)':'if(gt(iw,ih),ih,iw)'\""
 
 /**
  * Phase B "Access & networking" settings — not per-download options, always
@@ -127,7 +133,9 @@ export function parseExtraArgs(raw: string): string[] {
   const re = /"([^"]*)"|'([^']*)'|(\S+)/g
   let m: RegExpExecArray | null
   while ((m = re.exec(raw)) !== null) {
-    args.push(m[1] ?? m[2] ?? m[3])
+    // Exactly one of the three alternation groups matches; the '' fallback only
+    // satisfies the type checker (noUncheckedIndexedAccess) and never fires.
+    args.push(m[1] ?? m[2] ?? m[3] ?? '')
   }
   return args
 }
@@ -197,7 +205,10 @@ export function matchesUrl(pattern: string, url: string): boolean {
  */
 export function parseTrimSections(raw: string | undefined): string[] {
   if (!raw) return []
-  const TIME = String.raw`\d+(?::\d{1,2})*(?:\.\d+)?`
+  // A time is SS, M:SS, or H:MM:SS — at most two colon-separated groups. The old
+  // `*` quantifier accepted nonsense like `1:2:3:4`, which then failed inside
+  // yt-dlp's --download-sections rather than being rejected up front (L146).
+  const TIME = String.raw`\d+(?::\d{1,2}){0,2}(?:\.\d+)?`
   const RANGE = new RegExp(`^${TIME}-${TIME}$`)
   const out: string[] = []
   for (const piece of raw.split(/[,\n]/)) {
@@ -244,7 +255,11 @@ export function sanitizeDirSegment(name: string): string {
   // byte ever appears in this source file.
   let s = Array.from(name ?? '', (ch) => (ch.charCodeAt(0) < 0x20 ? ' ' : ch)).join('')
   s = s.replace(/[<>:"/\\|?*]/g, ' ')
-  s = s.replace(/\s+/g, ' ').trim().replace(/[. ]+$/, '').replace(/^[. ]+/, '')
+  s = s
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/[. ]+$/, '')
+    .replace(/^[. ]+/, '')
   // Reserved device names are reserved even WITH an extension ('CON.txt' is still
   // the CON device), so match an optional trailing '.<ext>' too (audit T3).
   if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i.test(s)) s = `_${s}`
@@ -328,7 +343,23 @@ function postProcessArgs(opts: StartDownloadOptions, o: DownloadOptions): string
   // Split into one file per chapter. yt-dlp also keeps the full file; the
   // per-chapter files use yt-dlp's default `chapter:` output template.
   if (o.splitChapters) args.push('--split-chapters')
-  if (o.embedMetadata) args.push('--embed-metadata')
+
+  // Metadata embedding + optional per-field overrides.
+  // --replace-in-metadata FIELD REGEX REPLACE is used instead of --parse-metadata
+  // FROM:TO because the replacement arg is a separate element (no colon-splitting
+  // on values like "Foo: Bar"). ^.*$ matches any string including empty. The only
+  // escaping Python's re.sub needs in the replacement string is backslash.
+  const metaOverrides: [string, string | undefined][] = [
+    ['title', o.metadataTitle],
+    ['artist', o.metadataArtist],
+    ['album', o.metadataAlbum]
+  ]
+  const hasOverrides = metaOverrides.some(([, v]) => v?.trim())
+  if (o.embedMetadata || hasOverrides) args.push('--embed-metadata')
+  const escRepl = (s: string): string => s.replace(/\\/g, '\\\\')
+  for (const [field, val] of metaOverrides) {
+    if (val?.trim()) args.push('--replace-in-metadata', field, '^.*$', escRepl(val.trim()))
+  }
 
   // Media-server sidecar files (Phase K) — written next to the output file so
   // Jellyfin/Plex/Kodi can ingest metadata, poster art, and the description.
@@ -339,18 +370,39 @@ function postProcessArgs(opts: StartDownloadOptions, o: DownloadOptions): string
   return args
 }
 
-export function buildArgs(
-  opts: StartDownloadOptions,
-  outputTemplate: string,
-  o: DownloadOptions,
-  binDir: string,
-  access: AccessOptions,
-  extraArgs: string[] = []
-): string[] {
+/**
+ * Everything buildArgs needs to construct a yt-dlp argv. A single options object
+ * (rather than six positional params) so callers can't transpose `opts`/`options`
+ * or the two path-like strings, and new inputs can be added without churning every
+ * call site (CL2).
+ */
+export interface BuildArgsInput {
+  /** The per-download request (url, kind, quality, chosen format, trim, …). */
+  opts: StartDownloadOptions
+  /** The resolved `-o` output template (flat filename or collection folder tree). */
+  outputTemplate: string
+  /** The post-processing options group (per-download override or the persisted default). */
+  options: DownloadOptions
+  /** ffmpeg/yt-dlp bin dir, passed in so this module stays free of path resolution. */
+  binDir: string
+  /** Global access/networking settings (proxy, cookies, rate limit, …). */
+  access: AccessOptions
+  /** Custom-command extra args, already consent-gated by the caller. */
+  extraArgs?: string[]
+}
+
+export function buildArgs(input: BuildArgsInput): string[] {
+  const { opts, outputTemplate, options: o, binDir, access, extraArgs = [] } = input
   const args = [
     '--newline',
     '--no-color',
     '--no-playlist',
+    // Bound a dead/hung connection so yt-dlp aborts (and retries, then exits) a
+    // stalled socket instead of hanging forever and pinning a concurrency slot
+    // with no recovery. The app-side idle watchdog in download.ts is the backstop
+    // for a fully-wedged process. (B1)
+    '--socket-timeout',
+    '30',
     // --print (below) implies --quiet, which would suppress progress; --progress
     // forces the progress template to emit anyway.
     '--progress',
@@ -362,7 +414,7 @@ export function buildArgs(
     PROGRESS_TEMPLATE,
     // Print the final path after post-processing/move so we can open it later.
     '--print',
-    'after_move:path|%(filepath)s',
+    `after_move:${FILEPATH_MARKER}%(filepath)s`,
     '--no-simulate'
   ]
 
@@ -370,7 +422,11 @@ export function buildArgs(
   args.push(...postProcessArgs(opts, o))
 
   if (opts.kind === 'audio') {
-    args.push('-x', '--audio-format', o.audioFormat, '--audio-quality', audioQuality(opts.quality))
+    // --audio-quality is a bitrate selector meaningful only for lossy re-encodes.
+    // For lossless formats (flac/wav) it is silently ignored by yt-dlp (M21).
+    const lossless = o.audioFormat === 'flac' || o.audioFormat === 'wav'
+    args.push('-x', '--audio-format', o.audioFormat)
+    if (!lossless) args.push('--audio-quality', audioQuality(opts.quality))
     if (o.embedThumbnail) {
       args.push('--embed-thumbnail')
       if (o.cropThumbnail) args.push('--ppa', CROP_SQUARE_PPA)
diff --git a/src/main/constants.ts b/src/main/constants.ts
new file mode 100644
index 0000000..fbae5fe
--- /dev/null
+++ b/src/main/constants.ts
@@ -0,0 +1,67 @@
+/**
+ * Central home for the main-process timeouts, buffer sizes, and store caps that
+ * were previously scattered as bare literals across the spawn/probe/index/store
+ * modules (L10). Collecting them here makes the operational envelope reviewable
+ * in one place and stops the same "how long / how big" decision drifting between
+ * modules. Values that are already single-sourced in the shared contract
+ * (e.g. HISTORY_MAX_ENTRIES) stay there; this file is for the main-only ones.
+ */
+
+// --- Child-process timeouts (ms) --------------------------------------------
+
+/** `<binary> -version` probes (yt-dlp, ffmpeg, ffprobe) — a quick liveness call. */
+export const VERSION_TIMEOUT_MS = 15_000
+/** yt-dlp self-update run — can pull a fresh binary, so a touch longer. */
+export const YTDLP_UPDATE_TIMEOUT_MS = 60_000
+/** Best-effort metadata --print alongside a download (title/uploader/duration). */
+export const META_PROBE_TIMEOUT_MS = 30_000
+/** Full format/metadata probe (`-J`) for the download bar. */
+export const PROBE_TIMEOUT_MS = 60_000
+/** Channel/playlist indexing walk — a big channel legitimately takes minutes. */
+export const INDEX_TIMEOUT_MS = 180_000
+/** RSS feed fetch for a watched source's new-item check. */
+export const FEED_FETCH_TIMEOUT_MS = 15_000
+
+/**
+ * Idle watchdog for a running download: if a spawned yt-dlp emits no stdout or
+ * stderr for this long, treat it as wedged and kill it so the concurrency slot
+ * frees (B1). Generous on purpose so a long, output-less post-processing step
+ * (e.g. a large ffmpeg merge) isn't mistaken for a stall.
+ */
+export const STALL_TIMEOUT_MS = 5 * 60_000
+
+// --- execFile maxBuffer sizes (bytes) ---------------------------------------
+// yt-dlp JSON for a big channel/format list is large; cap generously so a valid
+// response is never truncated (which would look like a parse failure).
+
+/** Metadata --print output (three short fields). */
+export const META_MAX_BUFFER = 4 * 1024 * 1024
+/** Single-video `-J` probe JSON. */
+export const PROBE_MAX_BUFFER = 64 * 1024 * 1024
+/** Whole-channel index JSON. */
+export const INDEX_MAX_BUFFER = 256 * 1024 * 1024
+
+// --- Misc ------------------------------------------------------------------
+
+/** How much of a failed download's stderr to retain for the error message. */
+export const STDERR_TAIL_BYTES = 4000
+
+/**
+ * Size cap for the diagnostic log file (logger.ts, CC8). Once the live
+ * `aerofetch.log` passes this, it's rotated to `aerofetch.log.1` (one generation
+ * kept) so app logging can't fill the disk.
+ */
+export const LOG_MAX_BYTES = 1024 * 1024
+
+// --- JSON-store row caps ----------------------------------------------------
+// Each hand-rolled JSON store trims to its cap on write so a store file can't
+// grow without bound.
+
+/** Diagnostics error log (errorlog.json). */
+export const ERRORLOG_MAX_ENTRIES = 200
+/** Saved custom-command templates (templates.json). */
+export const TEMPLATES_MAX = 100
+/** Indexed media items across all sources (media-items.json). */
+export const MEDIA_ITEMS_MAX = 20_000
+/** Persisted download-queue rows (queue.json, M4) — generous; a whole channel can be queued. */
+export const QUEUE_MAX = 10_000
diff --git a/src/main/contextMenu.ts b/src/main/contextMenu.ts
new file mode 100644
index 0000000..2d6bbca
--- /dev/null
+++ b/src/main/contextMenu.ts
@@ -0,0 +1,45 @@
+import { Menu, type WebContents, type MenuItemConstructorOptions } from 'electron'
+
+/**
+ * Give editable fields (and any selected text) the standard Windows Cut / Copy /
+ * Paste / Select All right-click menu that Electron does not provide by default
+ * (W4) — plus spellcheck suggestions for text areas. The menu items use built-in
+ * roles, so the editing works directly in the sandboxed, context-isolated
+ * renderer without any extra IPC. Wired onto the main window only; the untrusted
+ * cookie sign-in window deliberately keeps its minimal chrome.
+ */
+export function attachEditContextMenu(wc: WebContents): void {
+  wc.on('context-menu', (_e, params) => {
+    const { isEditable, editFlags, selectionText, dictionarySuggestions } = params
+    // Only worth a menu over an editable field or a real text selection.
+    if (!isEditable && !selectionText.trim()) return
+
+    const template: MenuItemConstructorOptions[] = []
+
+    // Spellcheck suggestions first, when the caret sits on a misspelling.
+    if (isEditable && dictionarySuggestions.length > 0) {
+      for (const suggestion of dictionarySuggestions) {
+        template.push({ label: suggestion, click: () => wc.replaceMisspelling(suggestion) })
+      }
+      template.push({ type: 'separator' })
+    }
+
+    if (isEditable) {
+      template.push(
+        { role: 'cut', enabled: editFlags.canCut },
+        { role: 'copy', enabled: editFlags.canCopy },
+        { role: 'paste', enabled: editFlags.canPaste },
+        { type: 'separator' },
+        { role: 'selectAll', enabled: editFlags.canSelectAll }
+      )
+    } else {
+      // Read-only text with a selection: offer Copy (and Select All).
+      template.push(
+        { role: 'copy', enabled: editFlags.canCopy },
+        { role: 'selectAll', enabled: editFlags.canSelectAll }
+      )
+    }
+
+    Menu.buildFromTemplate(template).popup()
+  })
+}
diff --git a/src/main/cookies.ts b/src/main/cookies.ts
index 0217370..d97778b 100644
--- a/src/main/cookies.ts
+++ b/src/main/cookies.ts
@@ -1,15 +1,17 @@
-import { app, session, BrowserWindow, type Cookie, type WebContents } from 'electron'
-import { existsSync, statSync, unlinkSync, writeFileSync } from 'fs'
+import { app, safeStorage, session, BrowserWindow, type Cookie, type WebContents } from 'electron'
+import { existsSync, statSync, unlinkSync, writeFileSync, readFileSync } from 'fs'
 import { join } from 'path'
 import { assertHttpUrl } from './url'
+import { logger } from './logger'
 import type { CookiesStatus, CookiesLoginResult } from '@shared/ipc'
 
 /**
  * Persisted session AeroFetch's built-in sign-in window uses. Kept separate
  * from the main window's (default) session so a logged-in site can't see or
- * touch anything the app itself loads.
+ * touch anything the app itself loads. Exported so the PO-token window can
+ * share the same session (and thus the user's YouTube sign-in state).
  */
-const PARTITION = 'persist:aerofetch-login'
+export const LOGIN_PARTITION = 'persist:aerofetch-login'
 
 /**
  * The sign-in window renders untrusted remote content, so every navigation and
@@ -43,7 +45,7 @@ function hardenLoginWebContents(wc: WebContents): void {
       overrideBrowserWindowOptions: {
         autoHideMenuBar: true,
         webPreferences: {
-          partition: PARTITION,
+          partition: LOGIN_PARTITION,
           sandbox: true,
           contextIsolation: true,
           nodeIntegration: false
@@ -60,20 +62,99 @@ function hardenLoginWebContents(wc: WebContents): void {
   wc.on('did-create-window', (child) => hardenLoginWebContents(child.webContents))
 }
 
-export function getCookiesFilePath(): string {
+// The persisted cookie jar is encrypted at rest (H7). yt-dlp's `--cookies` needs
+// a plaintext file, so the stored form is encrypted via Electron safeStorage
+// (DPAPI on Windows — the same protection settings secrets get) and only ever
+// decrypted to a short-lived temp file for the duration of a download. This
+// matters for the portable build, where userData sits next to the exe (USB /
+// shared Downloads folder) and a plaintext jar would hand over a logged-in session.
+function cookieStorePath(): string {
+  return join(app.getPath('userData'), 'cookies.dat')
+}
+
+function legacyCookiePath(): string {
   return join(app.getPath('userData'), 'cookies.txt')
 }
 
+// Marks ciphertext so a read can tell it from legacy/fallback plaintext (written
+// before encryption, or where safeStorage was unavailable). Mirrors settings.ts.
+const ENC_PREFIX = 'enc:v1:'
+
+/** Persist the Netscape cookie text, encrypted where safeStorage is available. */
+function storeCookies(netscape: string): void {
+  let out = netscape
+  try {
+    if (safeStorage.isEncryptionAvailable()) {
+      out = ENC_PREFIX + safeStorage.encryptString(netscape).toString('base64')
+    }
+  } catch {
+    /* fall through — store plaintext, as it was before encryption existed */
+  }
+  writeFileSync(cookieStorePath(), out)
+}
+
+/** Decrypt the persisted cookie text, or null if none / undecryptable here. */
+function loadCookies(): string | null {
+  const p = cookieStorePath()
+  if (!existsSync(p)) return null
+  const stored = readFileSync(p, 'utf8')
+  if (!stored.startsWith(ENC_PREFIX)) return stored // legacy / fallback plaintext
+  try {
+    return safeStorage.decryptString(Buffer.from(stored.slice(ENC_PREFIX.length), 'base64'))
+  } catch {
+    // A different Windows user/machine (portable jar copied elsewhere) or a
+    // corrupt blob — unusable; treat as no cookies rather than feed ciphertext.
+    return null
+  }
+}
+
+/**
+ * One-time migration of a pre-encryption plaintext `cookies.txt` into the
+ * encrypted store, deleting the plaintext so a logged-in session no longer sits
+ * in the open after an update (H7). Best-effort; safe to call on every launch.
+ */
+export function migrateLegacyCookies(): void {
+  const legacy = legacyCookiePath()
+  try {
+    if (!existsSync(legacy)) return
+    if (!existsSync(cookieStorePath())) storeCookies(readFileSync(legacy, 'utf8'))
+    unlinkSync(legacy)
+  } catch {
+    /* best-effort */
+  }
+}
+
+/** Whether a stored cookie jar exists (regardless of decryptability here). */
+export function hasStoredCookies(): boolean {
+  return existsSync(cookieStorePath())
+}
+
+/**
+ * Decrypt the jar to a plaintext file at `dest` for yt-dlp's `--cookies`. Returns
+ * false when there's nothing usable to write. The caller deletes `dest` once the
+ * download settles, keeping the plaintext window as short as possible.
+ */
+export function materializeCookies(dest: string): boolean {
+  const text = loadCookies()
+  if (text == null) return false
+  try {
+    writeFileSync(dest, text)
+    return true
+  } catch {
+    return false
+  }
+}
+
 export function getCookiesStatus(): CookiesStatus {
-  const p = getCookiesFilePath()
+  const p = cookieStorePath()
   if (!existsSync(p)) return { exists: false }
   return { exists: true, savedAt: statSync(p).mtimeMs }
 }
 
 export async function clearCookies(): Promise<void> {
-  const p = getCookiesFilePath()
+  const p = cookieStorePath()
   if (existsSync(p)) unlinkSync(p)
-  await session.fromPartition(PARTITION).clearStorageData()
+  await session.fromPartition(LOGIN_PARTITION).clearStorageData()
 }
 
 /**
@@ -89,9 +170,15 @@ function toNetscapeCookieFile(cookies: Cookie[]): string {
     const includeSubdomains = domain.startsWith('.') ? 'TRUE' : 'FALSE'
     const expiry = c.session || !c.expirationDate ? 0 : Math.round(c.expirationDate)
     lines.push(
-      [domain, includeSubdomains, c.path || '/', c.secure ? 'TRUE' : 'FALSE', expiry, c.name, c.value].join(
-        '\t'
-      )
+      [
+        domain,
+        includeSubdomains,
+        c.path || '/',
+        c.secure ? 'TRUE' : 'FALSE',
+        expiry,
+        c.name,
+        c.value
+      ].join('\t')
     )
   }
   return lines.join('\n') + '\n'
@@ -102,10 +189,13 @@ let pendingResolvers: Array<(r: CookiesLoginResult) => void> = []
 
 function exportAndResolve(): void {
   session
-    .fromPartition(PARTITION)
+    .fromPartition(LOGIN_PARTITION)
     .cookies.get({})
     .then((cookies) => {
-      writeFileSync(getCookiesFilePath(), toNetscapeCookieFile(cookies))
+      // Don't persist an empty jar: closing the window without signing in would
+      // otherwise leave a useless "saved" cookie file behind (L50). The renderer
+      // turns cookieCount === 0 into a "did you sign in?" hint.
+      if (cookies.length > 0) storeCookies(toNetscapeCookieFile(cookies))
       const result: CookiesLoginResult = { ok: true, cookieCount: cookies.length }
       pendingResolvers.forEach((resolve) => resolve(result))
     })
@@ -124,7 +214,10 @@ function exportAndResolve(): void {
  * window — cookies are exported to a Netscape-format file at that point,
  * ready for yt-dlp's `--cookies`. Mirrors Seal's "log in via WebView" feature.
  */
-export function openCookieLoginWindow(url: string): Promise<CookiesLoginResult> {
+export function openCookieLoginWindow(
+  url: string,
+  parent?: BrowserWindow
+): Promise<CookiesLoginResult> {
   return new Promise((resolve) => {
     let validUrl: string
     try {
@@ -136,7 +229,7 @@ export function openCookieLoginWindow(url: string): Promise<CookiesLoginResult>
 
     if (loginWindow && !loginWindow.isDestroyed()) {
       pendingResolvers.push(resolve)
-      loginWindow.loadURL(validUrl).catch(() => {})
+      loginWindow.loadURL(validUrl).catch((e) => logger.error('cookie login loadURL failed', e))
       loginWindow.focus()
       return
     }
@@ -149,8 +242,11 @@ export function openCookieLoginWindow(url: string): Promise<CookiesLoginResult>
         height: 720,
         title: 'Sign in — AeroFetch',
         autoHideMenuBar: true,
+        // Group under the app window instead of taking its own taskbar button
+        // (W6); a child window stays above its parent without a modal block.
+        parent: parent && !parent.isDestroyed() ? parent : undefined,
         webPreferences: {
-          partition: PARTITION,
+          partition: LOGIN_PARTITION,
           sandbox: true,
           contextIsolation: true,
           nodeIntegration: false
@@ -170,13 +266,26 @@ export function openCookieLoginWindow(url: string): Promise<CookiesLoginResult>
     hardenLoginWebContents(win.webContents)
     win.webContents.session.setPermissionRequestHandler((_wc, _permission, cb) => cb(false))
 
+    // 'close' fires on a normal user close; a programmatic destroy() fires only
+    // 'closed'. Latch whichever runs first so the partition is exported exactly
+    // once and the promise can never hang (B7) — without this, a destroy()
+    // without a preceding 'close' would leave pendingResolvers pending forever.
+    let exportStarted = false
+    const exportOnce = (): void => {
+      if (exportStarted) return
+      exportStarted = true
+      exportAndResolve()
+    }
     win.on('closed', () => {
       loginWindow = null
+      // Fallback for destroy()/closed-without-close: the partition outlives the
+      // window, so a late export still captures whatever cookies were collected.
+      exportOnce()
     })
     // Closing the window IS "I'm done" — export whatever the partition
     // collected. The partition itself outlives the window, so this is safe
     // even though cookies.get() resolves after 'close' has already fired.
-    win.on('close', exportAndResolve)
+    win.on('close', exportOnce)
 
     win.loadURL(validUrl).catch(() => {
       /* navigation errors surface as Chromium's own error page */
diff --git a/src/main/deeplink.ts b/src/main/deeplink.ts
index a86e368..20f2d39 100644
--- a/src/main/deeplink.ts
+++ b/src/main/deeplink.ts
@@ -2,6 +2,7 @@ import { app, shell, type BrowserWindow } from 'electron'
 import { existsSync, openSync, readSync, closeSync } from 'fs'
 import { join } from 'path'
 import { assertHttpUrl } from './url'
+import { parseUrlShortcutContent } from '@shared/ipc'
 
 /** Only ever forward http(s) targets into the app — same restriction the
  *  external-link window-open handler in index.ts applies to in-page links.
@@ -29,8 +30,8 @@ function readUrlShortcut(path: string): string | null {
     fd = openSync(path, 'r')
     const buf = Buffer.alloc(MAX_URL_FILE_BYTES)
     const bytes = readSync(fd, buf, 0, buf.length, 0)
-    const match = /^URL=(.+)$/im.exec(buf.toString('utf8', 0, bytes))
-    return match ? asHttpUrl(match[1].trim()) : null
+    const url = parseUrlShortcutContent(buf.toString('utf8', 0, bytes))
+    return url ? asHttpUrl(url) : null
   } catch {
     return null
   } finally {
diff --git a/src/main/download.ts b/src/main/download.ts
index a61b834..ec40772 100644
--- a/src/main/download.ts
+++ b/src/main/download.ts
@@ -1,5 +1,6 @@
 import { spawn, execFile, type ChildProcess } from 'child_process'
-import { existsSync } from 'fs'
+import { existsSync, unlinkSync } from 'fs'
+import { tmpdir } from 'os'
 import { join } from 'path'
 import { BrowserWindow, Notification, type WebContents } from 'electron'
 import {
@@ -8,11 +9,16 @@ import {
   getAria2cPath,
   getFfmpegPath,
   getFfprobePath,
-  getSystem32Path
+  getSystem32Path,
+  getAppIconImage,
+  YTDLP_MISSING_MSG
 } from './binaries'
-import { getSettings, getDownloadArchivePath, getDefaultMediaDir } from './settings'
+import { getSettings } from './settings'
+import { execFileAsync } from './lib/exec'
+import { createLineBuffer } from './lib/lineBuffer'
+import { getDownloadArchivePath, getDefaultMediaDir } from './paths'
 import { ensureManagedYtdlp } from './ytdlp'
-import { getCookiesFilePath } from './cookies'
+import { materializeCookies, hasStoredCookies } from './cookies'
 import { listTemplates } from './templates'
 import { assertHttpUrl } from './url'
 import { isSafeOutputDir } from './validation'
@@ -20,10 +26,18 @@ import {
   buildArgs,
   selectExtraArgs,
   formatCommandLine,
-  collectionOutputTemplate
+  collectionOutputTemplate,
+  PROGRESS_MARKER,
+  FILEPATH_MARKER
 } from './buildArgs'
 import { cleanError } from './log'
 import { addErrorLog } from './errorlog'
+import {
+  STALL_TIMEOUT_MS,
+  META_PROBE_TIMEOUT_MS,
+  META_MAX_BUFFER,
+  STDERR_TAIL_BYTES
+} from './constants'
 import {
   IpcChannels,
   type StartDownloadOptions,
@@ -31,7 +45,6 @@ import {
   type CommandPreviewResult,
   type DownloadEvent,
   type DownloadMeta,
-  type DownloadProgress,
   type Settings
 } from '@shared/ipc'
 
@@ -43,6 +56,21 @@ interface ActiveDownload {
 
 const active = new Map<string, ActiveDownload>()
 
+// Per-spawn sequence, so a retry/resume that reuses the item id still gets a
+// unique transient cookie file (below) — otherwise a superseded download's
+// teardown could unlink the new spawn's jar mid-read.
+let spawnSeq = 0
+
+// Remove an item from the active map, but only if THIS rec still owns the slot.
+// cancel/pause release the slot synchronously (so the renderer's just-promoted
+// next item isn't rejected by the maxConcurrent guard while the killed tree is
+// still tearing down); the doomed child's later 'close'/'error' then runs this as
+// a no-op. The identity check matters because a retry/resume reuses the item id,
+// so a stale teardown must not evict the newer same-id spawn. (L140/L148)
+function releaseActive(id: string, rec: ActiveDownload): void {
+  if (active.get(id) === rec) active.delete(id)
+}
+
 /**
  * Whether any yt-dlp download is currently running. Used by the window's close
  * handler to keep the app alive in the tray (instead of quitting and killing the
@@ -53,63 +81,22 @@ export function hasActiveDownloads(): boolean {
 }
 
 // --- Formatting helpers (raw yt-dlp numbers → human strings) ----------------
-
-function num(s?: string): number | undefined {
-  if (!s || s === 'NA') return undefined
-  const n = Number(s)
-  return Number.isFinite(n) ? n : undefined
-}
-
-export function fmtBytes(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`
-  const units = ['KB', 'MB', 'GB', 'TB']
-  let v = bytes / 1024
-  let i = 0
-  while (v >= 1024 && i < units.length - 1) {
-    v /= 1024
-    i++
-  }
-  return `${v.toFixed(v >= 100 ? 0 : 1)} ${units[i]}`
-}
-
-function fmtSpeed(bytesPerSec?: number): string | undefined {
-  if (bytesPerSec == null) return undefined
-  return `${fmtBytes(bytesPerSec)}/s`
-}
-
-function fmtEta(seconds?: number): string | undefined {
-  if (seconds == null) return undefined
-  const s = Math.max(0, Math.round(seconds))
-  const m = Math.floor(s / 60)
-  const r = s % 60
-  return `${m}:${String(r).padStart(2, '0')}`
-}
-
-function parseProgress(rest: string): DownloadProgress | null {
-  const parts = rest.split('|')
-  if (parts.length < 6) return null
-  const [status, dl, total, totalEst, speed, eta] = parts
-  const downloaded = num(dl)
-  const totalBytes = num(total) ?? num(totalEst)
-  let progress = 0
-  if (totalBytes && downloaded != null) progress = Math.min(1, downloaded / totalBytes)
-  return {
-    status: status || 'downloading',
-    progress,
-    speed: fmtSpeed(num(speed)),
-    eta: fmtEta(num(eta)),
-    sizeLabel: totalBytes ? fmtBytes(totalBytes) : undefined
-  }
-}
+// parseProgress lives in lib/formatters.ts (no electron import chain) so it can
+// be unit-tested in isolation (L37). Byte/ETA formatters live in @shared/format.
+export { parseProgress } from './lib/formatters'
+import { parseProgress } from './lib/formatters'
 
 function send(wc: WebContents, ev: DownloadEvent): void {
   if (!wc.isDestroyed()) wc.send(IpcChannels.downloadEvent, ev)
 }
 
 /** Native OS notification on completion/failure, gated by Settings.notifyOnComplete. */
-function notify(wc: WebContents, title: string, body: string): void {
+function notify(wc: WebContents, title: string, body: string, incognito = false): void {
   if (!getSettings().notifyOnComplete || !Notification.isSupported()) return
-  const n = new Notification({ title, body })
+  // L136: an incognito ("private") download must not leak its title/URL into an OS
+  // toast (it persists in the Windows Action Center). Callers pass a generic outcome
+  // title for the private case; here we additionally drop the detail body.
+  const n = new Notification({ title, body: incognito ? '' : body, icon: getAppIconImage() })
   n.on('click', () => {
     if (wc.isDestroyed()) return
     const win = BrowserWindow.fromWebContents(wc)
@@ -120,9 +107,17 @@ function notify(wc: WebContents, title: string, body: string): void {
     }
   })
   n.show()
+  // W10: flash the taskbar button for attention when the event happened in the
+  // background (window unfocused/minimized/hidden). Windows stops the flash on its
+  // own once the window gets focus, so there's no explicit stop to manage.
+  const flashWin = BrowserWindow.fromWebContents(wc)
+  if (flashWin && !flashWin.isDestroyed() && !flashWin.isFocused()) flashWin.flashFrame(true)
 }
 
 function logFailure(opts: StartDownloadOptions, title: string | undefined, error: string): void {
+  // L136: incognito downloads are never recorded — not even a failure entry, which
+  // would persist the title + URL in the user-facing diagnostics log.
+  if (opts.incognito) return
   addErrorLog({
     id: opts.id,
     title,
@@ -135,37 +130,34 @@ function logFailure(opts: StartDownloadOptions, title: string | undefined, error
 
 // --- Best-effort metadata probe (runs alongside the download) ---------------
 
-function probeMeta(ytdlp: string, url: string): Promise<DownloadMeta | null> {
-  return new Promise((resolve) => {
-    execFile(
-      ytdlp,
-      [
-        '--no-playlist',
-        '--no-warnings',
-        '--skip-download',
-        '--print',
-        'title',
-        '--print',
-        'uploader',
-        '--print',
-        'duration_string',
-        '--',
-        url
-      ],
-      { windowsHide: true, maxBuffer: 4 * 1024 * 1024, timeout: 30_000 },
-      (err, stdout) => {
-        if (err) return resolve(null)
-        const [title, uploader, duration] = stdout.split('\n').map((l) => l.trim())
-        const clean = (v?: string): string | undefined =>
-          v && v !== 'NA' ? v : undefined
-        resolve({
-          title: clean(title),
-          channel: clean(uploader),
-          durationLabel: clean(duration)
-        })
-      }
-    )
-  })
+// Unit Separator (0x1F): a control char that can't appear in a title/uploader,
+// so it safely delimits the three fields in ONE --print template. Splitting on
+// newlines instead (B4) would mis-assign channel/duration whenever a title
+// itself contains a newline, since each --print field is emitted on its own line.
+const META_SEP = '\u001f'
+
+async function probeMeta(ytdlp: string, url: string): Promise<DownloadMeta | null> {
+  const r = await execFileAsync(
+    ytdlp,
+    [
+      '--no-playlist',
+      '--no-warnings',
+      '--skip-download',
+      '--print',
+      `%(title)s${META_SEP}%(uploader)s${META_SEP}%(duration_string)s`,
+      '--',
+      url
+    ],
+    { maxBuffer: META_MAX_BUFFER, timeout: META_PROBE_TIMEOUT_MS }
+  )
+  if (!r.ok) return null
+  const [title, uploader, duration] = r.stdout.split(META_SEP).map((l) => l.trim())
+  const clean = (v?: string): string | undefined => (v && v !== 'NA' ? v : undefined)
+  return {
+    title: clean(title),
+    channel: clean(uploader),
+    durationLabel: clean(duration)
+  }
 }
 
 // --- Argv construction (shared by startDownload and the command preview) ---
@@ -175,6 +167,9 @@ function probeMeta(ytdlp: string, url: string): Promise<DownloadMeta | null> {
 // (see selectExtraArgs / audit F2). The gate is enforced here in main, not just
 // in the renderer UI, so the renderer can't be trusted to apply it.
 function resolveExtraArgs(opts: StartDownloadOptions, settings: Settings): string[] {
+  // Gate the file read: listTemplates() parses templates.json on every call, so
+  // skip it entirely when the feature is off (PERF2).
+  if (!settings.customCommandEnabled) return []
   return selectExtraArgs({
     customCommandEnabled: settings.customCommandEnabled,
     perDownloadExtraArgs: opts.extraArgs,
@@ -184,8 +179,10 @@ function resolveExtraArgs(opts: StartDownloadOptions, settings: Settings): strin
   })
 }
 
-/** Resolve settings + per-download overrides into the full yt-dlp argv. */
-export function buildCommand(opts: StartDownloadOptions): string[] {
+/** Resolve settings + per-download overrides into the full yt-dlp argv.
+ *  `cookiesFile` is the transient decrypted jar the caller materialises for the
+ *  'login' cookie source (H7); the 'browser' source uses --cookies-from-browser. */
+export function buildCommand(opts: StartDownloadOptions, cookiesFile?: string): string[] {
   const settings = getSettings()
   // Output dir resolution: a per-download override wins, then the user's explicit
   // per-kind folder (Settings → Video/Audio folder), and finally — when that's
@@ -210,17 +207,13 @@ export function buildCommand(opts: StartDownloadOptions): string[] {
   // Silently fall back to yt-dlp's own downloader if aria2c.exe wasn't dropped
   // into resources/bin — the toggle shouldn't turn into a hard error.
   const aria2cPath = settings.useAria2c && existsSync(getAria2cPath()) ? getAria2cPath() : undefined
-  // Same idea: 'login' cookies only apply once the sign-in window has actually
-  // exported a file; otherwise the download proceeds cookie-less rather than failing.
-  const cookiesFile =
-    settings.cookieSource === 'login' && existsSync(getCookiesFilePath())
-      ? getCookiesFilePath()
-      : undefined
   const access = {
     proxy: settings.proxy,
     rateLimit: settings.rateLimit,
     aria2cPath,
-    cookiesFromBrowser: settings.cookieSource === 'browser' ? settings.cookiesBrowser : undefined,
+    // L136/M6: incognito attaches no cookies from the browser either.
+    cookiesFromBrowser:
+      !opts.incognito && settings.cookieSource === 'browser' ? settings.cookiesBrowser : undefined,
     cookiesFile,
     restrictFilenames: settings.restrictFilenames,
     downloadArchivePath: settings.downloadArchive ? getDownloadArchivePath() : undefined,
@@ -228,7 +221,7 @@ export function buildCommand(opts: StartDownloadOptions): string[] {
     youtubePoToken: settings.youtubePoToken
   }
   const extraArgs = resolveExtraArgs(opts, settings)
-  return buildArgs(opts, outputTemplate, options, getBinDir(), access, extraArgs)
+  return buildArgs({ opts, outputTemplate, options, binDir: getBinDir(), access, extraArgs })
 }
 
 /** Build the exact command line for the current form state, without running it. */
@@ -250,10 +243,7 @@ export function previewCommand(opts: StartDownloadOptions): CommandPreviewResult
 
 // --- Public API -------------------------------------------------------------
 
-export function startDownload(
-  wc: WebContents,
-  opts: StartDownloadOptions
-): StartDownloadResult {
+export function startDownload(wc: WebContents, opts: StartDownloadOptions): StartDownloadResult {
   // Self-heal the managed copy from the bundled seed before spawning, so a
   // never-seeded or deleted yt-dlp.exe doesn't fail an otherwise-fine download.
   ensureManagedYtdlp()
@@ -261,7 +251,7 @@ export function startDownload(
   if (!existsSync(ytdlp)) {
     return {
       ok: false,
-      error: `yt-dlp.exe is missing and couldn't be restored from the bundle.\nReinstall AeroFetch, or drop yt-dlp.exe into resources/bin/ (see the README there).`
+      error: YTDLP_MISSING_MSG
     }
   }
   // ffmpeg is used by nearly every download (merge, audio extract, thumbnail/
@@ -275,9 +265,7 @@ export function startDownload(
   if (missingBins.length > 0) {
     return {
       ok: false,
-      error:
-        `${missingBins.join(' and ')} not found in ${getBinDir()}\n` +
-        `Add the ffmpeg build's binaries to resources/bin/ (see the README there).`
+      error: `${missingBins.join(' and ')} not found in ${getBinDir()}. Add the ffmpeg build's binaries to resources/bin/ (see the README there).`
     }
   }
   // Reject anything that isn't an http(s) URL before it reaches yt-dlp's argv,
@@ -301,10 +289,34 @@ export function startDownload(
     return { ok: false, error: 'Max concurrent downloads reached. Wait for a slot to free up.' }
   }
 
+  // Decrypt the stored cookie jar to a short-lived per-download temp file (H7).
+  // yt-dlp reads --cookies once at startup; we delete it the moment the download
+  // settles, so the plaintext never lingers at rest.
+  let cookiesFile: string | undefined
+  // L136/M6: an incognito download attaches no saved login cookies (the UI promises
+  // "no cookies"), so it can't be tied to the user's signed-in identity.
+  if (!opts.incognito && getSettings().cookieSource === 'login' && hasStoredCookies()) {
+    // Unique per spawn (not just per id): a retry/resume reuses opts.id, and the
+    // superseded download's cleanupCookies() must not unlink the new spawn's jar.
+    const tmp = join(tmpdir(), `aerofetch-cookies-${opts.id}-${++spawnSeq}.txt`)
+    if (materializeCookies(tmp)) cookiesFile = tmp
+  }
+  function cleanupCookies(): void {
+    if (cookiesFile) {
+      try {
+        unlinkSync(cookiesFile)
+      } catch {
+        /* best-effort */
+      }
+      cookiesFile = undefined
+    }
+  }
+
   let child: ChildProcess
   try {
-    child = spawn(ytdlp, buildCommand(opts), { windowsHide: true })
+    child = spawn(ytdlp, buildCommand(opts, cookiesFile), { windowsHide: true })
   } catch (e) {
+    cleanupCookies()
     return { ok: false, error: (e as Error).message }
   }
 
@@ -324,66 +336,162 @@ export function startDownload(
     // it in parallel so the card fills in quickly.
     probeMeta(ytdlp, opts.url).then((meta) => {
       if (meta?.title) resolvedTitle = meta.title
-      if (meta && active.has(opts.id)) send(wc, { type: 'meta', id: opts.id, meta })
+      if (active.has(opts.id)) {
+        // Always emit a meta event: on success it fills in title/channel/duration;
+        // on failure (null from timeout/error) the renderer clears the
+        // "Resolving…" placeholder via applyEvent('meta') (SR6 / L47).
+        send(wc, { type: 'meta', id: opts.id, meta: meta ?? {} })
+      }
     })
   }
 
-  let stdoutBuf = ''
+  // Wire the child's streams + teardown (CL3). resolvedTitle is passed as a getter
+  // because the parallel probeMeta above may fill it in after this returns.
+  wireChildProcess({ wc, opts, rec, cleanup: cleanupCookies, getTitle: () => resolvedTitle })
+
+  return { ok: true }
+}
+
+// --- Child-process wiring ---------------------------------------------------
+
+/**
+ * Wire a spawned yt-dlp child's stdout/stderr/close/error to download events, and
+ * run the B1 idle watchdog. Extracted from startDownload so that function reads as
+ * a linear spawn + pre-flight and this owns the streaming/teardown lifecycle (CL3).
+ *
+ * `getTitle` is read lazily on each event: the completion/error paths need the
+ * best title known *at settle time*, which the parallel metadata probe may only
+ * fill in after wiring is set up.
+ */
+function wireChildProcess(params: {
+  wc: WebContents
+  opts: StartDownloadOptions
+  rec: ActiveDownload
+  cleanup: () => void
+  getTitle: () => string | undefined
+}): void {
+  const { wc, opts, rec, cleanup, getTitle } = params
+  const child = rec.child
+
   let stderrTail = ''
   let filePath: string | undefined
+  // Latched once the first download stream reports 'finished'; flags later
+  // progress as the merge/post-processing "finishing" phase (SR7).
+  let finishing = false
   // 'error' and 'close' can both fire for one process; only act on the first.
   let settled = false
 
-  child.stdout?.on('data', (chunk: Buffer) => {
-    stdoutBuf += chunk.toString()
-    let nl: number
-    while ((nl = stdoutBuf.indexOf('\n')) >= 0) {
-      const line = stdoutBuf.slice(0, nl).replace(/\r$/, '')
-      stdoutBuf = stdoutBuf.slice(nl + 1)
-      if (line.startsWith('prog|')) {
-        const p = parseProgress(line.slice('prog|'.length))
-        if (p) send(wc, { type: 'progress', id: opts.id, progress: p })
-      } else if (line.startsWith('path|')) {
-        filePath = line.slice('path|'.length).trim()
-      }
+  // Idle watchdog (B1): reset on any output; if it ever fires, the child has been
+  // silent for STALL_TIMEOUT_MS, so kill + error it and free the slot.
+  let stallTimer: ReturnType<typeof setTimeout> | null = null
+  function clearWatchdog(): void {
+    if (stallTimer) {
+      clearTimeout(stallTimer)
+      stallTimer = null
     }
+  }
+  function bumpWatchdog(): void {
+    clearWatchdog()
+    stallTimer = setTimeout(() => {
+      // A cancel/pause races the timer: it already released the slot and the
+      // child's close stays silent, so don't fire a spurious stall error (mirrors
+      // the canceled/paused guards on the close handler below).
+      if (settled || rec.canceled || rec.paused) return
+      settled = true
+      clearWatchdog()
+      cleanup()
+      releaseActive(opts.id, rec)
+      killTree(rec)
+      const msg = `Download stalled — no activity for ${Math.round(STALL_TIMEOUT_MS / 60_000)} min. Stopped; retry to resume.`
+      send(wc, { type: 'error', id: opts.id, error: msg })
+      logFailure(opts, getTitle(), msg)
+      notify(
+        wc,
+        opts.incognito ? 'Download stopped' : (getTitle() ?? 'Download failed'),
+        msg,
+        opts.incognito
+      )
+    }, STALL_TIMEOUT_MS)
+  }
+  bumpWatchdog()
+
+  // Split stdout into lines (shared helper, CC3/CC4) and parse our --print markers.
+  // No flush on close: yt-dlp's progress/path template lines are always
+  // newline-terminated, so a trailing partial is never a real marker.
+  const stdoutLines = createLineBuffer((line) => {
+    if (line.startsWith(PROGRESS_MARKER)) {
+      const p = parseProgress(line.slice(PROGRESS_MARKER.length))
+      if (p) {
+        // SR7: yt-dlp reports a 'finished' status when each download stream
+        // completes. A video+audio download has two streams, so the bar would
+        // otherwise fill 0→100% twice. Latch on the first 'finished' and flag
+        // every later tick as "finishing" so the renderer shows an indeterminate
+        // merge state instead of a visible restart.
+        if (p.status === 'finished') finishing = true
+        send(wc, { type: 'progress', id: opts.id, progress: { ...p, finishing } })
+      }
+    } else if (line.startsWith(FILEPATH_MARKER)) {
+      filePath = line.slice(FILEPATH_MARKER.length).trim()
+    }
+  })
+  child.stdout?.on('data', (chunk: Buffer) => {
+    bumpWatchdog()
+    stdoutLines.push(chunk.toString())
   })
 
   child.stderr?.on('data', (chunk: Buffer) => {
-    stderrTail = (stderrTail + chunk.toString()).slice(-4000)
+    bumpWatchdog()
+    stderrTail = (stderrTail + chunk.toString()).slice(-STDERR_TAIL_BYTES)
   })
 
   child.on('error', (err) => {
     if (settled) return
     settled = true
-    active.delete(opts.id)
+    clearWatchdog()
+    cleanup()
+    releaseActive(opts.id, rec)
     // A paused download was killed on purpose — stay silent, like a cancel.
     if (!rec.canceled && !rec.paused) {
       send(wc, { type: 'error', id: opts.id, error: err.message })
-      logFailure(opts, resolvedTitle, err.message)
-      notify(wc, resolvedTitle ?? 'Download failed', err.message)
+      logFailure(opts, getTitle(), err.message)
+      notify(
+        wc,
+        opts.incognito ? 'Download failed' : (getTitle() ?? 'Download failed'),
+        err.message,
+        opts.incognito
+      )
     }
   })
 
   child.on('close', (code) => {
     if (settled) return
     settled = true
-    active.delete(opts.id)
+    clearWatchdog()
+    cleanup()
+    releaseActive(opts.id, rec)
     // Canceled: renderer already showed 'canceled'. Paused: renderer showed
     // 'paused' and keeps the .part for a later resume. Either way, no event.
     if (rec.canceled || rec.paused) return
     if (code === 0) {
       send(wc, { type: 'done', id: opts.id, filePath })
-      notify(wc, resolvedTitle ?? 'Download complete', 'Finished downloading.')
+      notify(
+        wc,
+        opts.incognito ? 'Download complete' : (getTitle() ?? 'Download complete'),
+        'Finished downloading.',
+        opts.incognito
+      )
     } else {
       const msg = cleanError(stderrTail) || `yt-dlp exited with code ${code}`
       send(wc, { type: 'error', id: opts.id, error: msg })
-      logFailure(opts, resolvedTitle, msg)
-      notify(wc, resolvedTitle ?? 'Download failed', msg)
+      logFailure(opts, getTitle(), msg)
+      notify(
+        wc,
+        opts.incognito ? 'Download failed' : (getTitle() ?? 'Download failed'),
+        msg,
+        opts.incognito
+      )
     }
   })
-
-  return { ok: true }
 }
 
 // Kill the whole process tree (/T) so the spawned ffmpeg child dies too. Resolve
@@ -407,6 +515,11 @@ export function cancelDownload(id: string): void {
   const rec = active.get(id)
   if (!rec) return
   rec.canceled = true
+  // Free the slot now (not on the async 'close') so the renderer's just-promoted
+  // next item isn't rejected by the maxConcurrent guard — or run briefly over the
+  // cap — while taskkill tears down this tree. The child's later 'close' stays
+  // silent (rec.canceled) and releaseActive() no-ops. (L148)
+  active.delete(id)
   killTree(rec)
 }
 
@@ -421,5 +534,9 @@ export function pauseDownload(id: string): void {
   const rec = active.get(id)
   if (!rec) return
   rec.paused = true
+  // Free the slot now (see cancelDownload / L148). The partial .part stays on disk
+  // for a later resume, which reuses this id — releaseActive()'s identity check
+  // keeps the doomed child's 'close' from evicting that fresh spawn. (L140)
+  active.delete(id)
   killTree(rec)
 }
diff --git a/src/main/errorlog.ts b/src/main/errorlog.ts
index a587663..74df3d7 100644
--- a/src/main/errorlog.ts
+++ b/src/main/errorlog.ts
@@ -1,45 +1,23 @@
-import { app } from 'electron'
-import { join } from 'path'
-import { readFileSync, writeFileSync, existsSync } from 'fs'
 import type { ErrorLogEntry } from '@shared/ipc'
 import { isValidErrorLogEntry } from './validation'
+import { createJsonStore } from './jsonStore'
+import { ERRORLOG_MAX_ENTRIES } from './constants'
 
 // Plain JSON in userData, same shape as history.ts. Persisted so a failure
-// report survives the queue item being cleared (Seal's "debug report").
-const MAX_ENTRIES = 200
+// report survives the queue item being cleared (Seal's "debug report"). Atomic
+// writes / corruption backup / caching come from the shared jsonStore (R1–R3).
+// Per-entry validation (isValidErrorLogEntry) so a hand-edited or corrupted
+// errorlog.json can't feed the UI entries with the wrong shape. (audit S5)
+const store = createJsonStore('errorlog.json', isValidErrorLogEntry, ERRORLOG_MAX_ENTRIES)
 
-function errorLogFile(): string {
-  return join(app.getPath('userData'), 'errorlog.json')
-}
-
-// Per-entry validation (isValidErrorLogEntry, in validation.ts) so a hand-edited
-// or corrupted errorlog.json can't feed the UI entries with the wrong shape —
-// invalid rows are dropped. (audit S5)
 export function listErrorLog(): ErrorLogEntry[] {
-  try {
-    if (!existsSync(errorLogFile())) return []
-    const data = JSON.parse(readFileSync(errorLogFile(), 'utf8'))
-    return Array.isArray(data) ? data.filter(isValidErrorLogEntry) : []
-  } catch {
-    return []
-  }
-}
-
-function save(entries: ErrorLogEntry[]): void {
-  try {
-    writeFileSync(errorLogFile(), JSON.stringify(entries.slice(0, MAX_ENTRIES), null, 2))
-  } catch {
-    /* best-effort; a read-only data dir just means no persisted error log */
-  }
+  return store.read()
 }
 
 export function addErrorLog(entry: ErrorLogEntry): ErrorLogEntry[] {
-  const entries = [entry, ...listErrorLog()]
-  save(entries)
-  return entries
+  return store.write([entry, ...listErrorLog()])
 }
 
 export function clearErrorLog(): ErrorLogEntry[] {
-  save([])
-  return []
+  return store.write([])
 }
diff --git a/src/main/ffmpeg.ts b/src/main/ffmpeg.ts
index e6886b8..6c4a89e 100644
--- a/src/main/ffmpeg.ts
+++ b/src/main/ffmpeg.ts
@@ -1,6 +1,7 @@
-import { execFile } from 'child_process'
 import { existsSync } from 'fs'
 import { getFfmpegPath, getFfprobePath } from './binaries'
+import { execFileAsync } from './lib/exec'
+import { VERSION_TIMEOUT_MS } from './constants'
 import type { FfmpegVersionResult } from '@shared/ipc'
 
 /**
@@ -11,19 +12,13 @@ import type { FfmpegVersionResult } from '@shared/ipc'
  * out, or the line doesn't parse — Settings then shows "not found" instead of
  * failing. Unlike yt-dlp these are never self-updated, so there's no update path.
  */
-function readToolVersion(path: string): Promise<string | null> {
-  if (!existsSync(path)) return Promise.resolve(null)
-  return new Promise((resolve) => {
-    execFile(path, ['-version'], { windowsHide: true, timeout: 15_000 }, (err, stdout) => {
-      if (err) {
-        resolve(null)
-        return
-      }
-      const firstLine = stdout.split('\n', 1)[0] ?? ''
-      const m = firstLine.match(/version\s+(\S+)/i)
-      resolve(m ? m[1] : null)
-    })
-  })
+async function readToolVersion(path: string): Promise<string | null> {
+  if (!existsSync(path)) return null
+  const r = await execFileAsync(path, ['-version'], { timeout: VERSION_TIMEOUT_MS })
+  if (!r.ok) return null
+  const firstLine = r.stdout.split('\n', 1)[0] ?? ''
+  const m = firstLine.match(/version\s+(\S+)/i)
+  return m?.[1] ?? null
 }
 
 /** Versions of the bundled ffmpeg + ffprobe, read in parallel for the Settings panel. */
diff --git a/src/main/history.ts b/src/main/history.ts
index 8868720..954f9da 100644
--- a/src/main/history.ts
+++ b/src/main/history.ts
@@ -1,59 +1,39 @@
-import { app } from 'electron'
-import { join } from 'path'
-import { readFileSync, writeFileSync, existsSync } from 'fs'
-import type { HistoryEntry } from '@shared/ipc'
+import { HISTORY_MAX_ENTRIES, type HistoryEntry } from '@shared/ipc'
 import { isValidHistoryEntry } from './validation'
+import { createJsonStore } from './jsonStore'
 
 // Plain JSON in userData (portable build redirects userData next to the exe).
-// Kept simple per the build plan; can migrate to better-sqlite3 later.
-const MAX_ENTRIES = 500
+// Kept simple per the build plan; can migrate to better-sqlite3 later. Atomic
+// writes, corruption backup, and caching come from the shared jsonStore (R1–R3).
+// The row cap (HISTORY_MAX_ENTRIES) is shared with the renderer's optimistic list.
+//
+// Per-entry validation (isValidHistoryEntry) so a hand-edited or corrupted
+// history.json can't feed the UI (or openPath) entries with the wrong shape —
+// invalid rows are dropped rather than trusted. (audit S5)
+const store = createJsonStore('history.json', isValidHistoryEntry, HISTORY_MAX_ENTRIES)
 
-function historyFile(): string {
-  return join(app.getPath('userData'), 'history.json')
-}
-
-// Per-entry validation (isValidHistoryEntry, in validation.ts) so a hand-edited
-// or corrupted history.json can't feed the UI (or openPath) entries with the
-// wrong shape — invalid rows are dropped rather than trusted. (audit S5)
 export function listHistory(): HistoryEntry[] {
-  try {
-    if (!existsSync(historyFile())) return []
-    const data = JSON.parse(readFileSync(historyFile(), 'utf8'))
-    return Array.isArray(data) ? data.filter(isValidHistoryEntry) : []
-  } catch {
-    return []
-  }
-}
-
-function save(entries: HistoryEntry[]): void {
-  try {
-    writeFileSync(historyFile(), JSON.stringify(entries.slice(0, MAX_ENTRIES), null, 2))
-  } catch {
-    /* best-effort; a read-only data dir just means no persisted history */
-  }
+  return store.read()
 }
 
 export function addHistory(entry: HistoryEntry): HistoryEntry[] {
-  // De-dupe by id (a retry of the same item replaces its prior entry).
-  const entries = [entry, ...listHistory().filter((e) => e.id !== entry.id)]
-  save(entries)
-  return entries
+  // De-dupe by id AND url (M35): a History re-download re-queues via addFromUrl,
+  // which mints a NEW id, so id-only de-dup would let the same video accumulate a
+  // fresh row on every re-download. Dropping any prior entry with the same url
+  // keeps one row per video, refreshed to the top.
+  const prior = listHistory().filter((e) => e.id !== entry.id && e.url !== entry.url)
+  return store.write([entry, ...prior])
 }
 
 export function removeHistory(id: string): HistoryEntry[] {
-  const entries = listHistory().filter((e) => e.id !== id)
-  save(entries)
-  return entries
+  return store.write(listHistory().filter((e) => e.id !== id))
 }
 
 export function removeManyHistory(ids: string[]): HistoryEntry[] {
   const remove = new Set(ids)
-  const entries = listHistory().filter((e) => !remove.has(e.id))
-  save(entries)
-  return entries
+  return store.write(listHistory().filter((e) => !remove.has(e.id)))
 }
 
 export function clearHistory(): HistoryEntry[] {
-  save([])
-  return []
+  return store.write([])
 }
diff --git a/src/main/index.ts b/src/main/index.ts
index 02b4dfe..1eaca5f 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -1,55 +1,28 @@
-import { app, shell, BrowserWindow, ipcMain, dialog, clipboard, nativeTheme, Notification } from 'electron'
+import { app, shell, BrowserWindow, nativeTheme, Notification, Menu } from 'electron'
 import { join, resolve } from 'path'
 import { electronApp, optimizer, is } from '@electron-toolkit/utils'
+import { IpcChannels } from '@shared/ipc'
+import { PAGE_BACKGROUND } from '@shared/theme'
 import {
-  IpcChannels,
-  type StartDownloadOptions,
-  type Settings,
-  type HistoryEntry,
-  type CommandTemplate,
-  type YtdlpUpdateChannel,
-  type SystemThemeInfo,
-  type TaskbarProgress
-} from '@shared/ipc'
-import { getYtdlpVersion, updateYtdlp, runStartupYtdlpAutoUpdate } from './ytdlp'
-import { getFfmpegVersions } from './ffmpeg'
-import { checkForAppUpdate, downloadAppUpdate, runAppUpdate } from './updater'
-import { probeMedia } from './probe'
-import {
-  startDownload,
-  cancelDownload,
-  pauseDownload,
-  previewCommand,
-  hasActiveDownloads
-} from './download'
-import { runTerminal, cancelTerminal } from './terminal'
-import {
-  getSettings,
-  setSettings,
-  ensureMediaDirs,
-  applyLaunchAtStartup,
-  migrateSecretsAtRest
-} from './settings'
-import { listHistory, addHistory, removeHistory, removeManyHistory, clearHistory } from './history'
-import { listTemplates, saveTemplate, removeTemplate } from './templates'
+  registerIpcHandlers,
+  resolveBackgroundMode,
+  applyNativeTheme,
+  getSystemThemeInfo
+} from './ipc'
+import { runStartupYtdlpAutoUpdate } from './ytdlp'
+import { getAppIconImage } from './binaries'
+import { hasActiveDownloads } from './download'
+import { getSettings, applyLaunchAtStartup, migrateSecretsAtRest } from './settings'
+import { ensureMediaDirs } from './paths'
 import { setupPortableData } from './portable'
-import { safeOpenPath, safeShowInFolder } from './reveal'
-import { openCookieLoginWindow, getCookiesStatus, clearCookies } from './cookies'
-import { listErrorLog, addErrorLog, clearErrorLog } from './errorlog'
-import { exportBackup, importBackup } from './backup'
+import { migrateLegacyCookies } from './cookies'
+import { attachEditContextMenu } from './contextMenu'
+import { flushAllStores } from './jsonStore'
 import { extractIncomingUrl, registerSendToShortcut, focusWindow } from './deeplink'
-import {
-  listSources,
-  getSource,
-  removeSource,
-  listMediaItems,
-  setMediaItemDownloaded,
-  setSourceWatched
-} from './sources'
-import { indexSource } from './indexer'
-import { syncWatchedSources } from './sync'
-import { getScheduledSync, setScheduledSync, isSyncLaunch } from './schedule'
+import { isSyncLaunch } from './schedule'
 import { createTray, markQuitting, isQuitting } from './tray'
+import { logger } from './logger'
+import { initialWindowState, saveWindowState } from './windowState'
 
 // Only one instance ever runs. A second launch — e.g. the OS invoking us again
 // for an aerofetch:// link or a "Send to AeroFetch" file — hands its argv to
@@ -79,34 +52,15 @@ setupPortableData()
 // installer also declares this scheme (electron-builder.yml's `protocols`)
 // so it's registered even before first launch; this call additionally covers
 // the portable build and dev, which have no installer step to do it for us.
-if (is.dev && process.argv.length >= 2) {
-  app.setAsDefaultProtocolClient('aerofetch', process.execPath, [resolve(process.argv[1])])
+const devScript = process.argv[1]
+if (is.dev && devScript) {
+  app.setAsDefaultProtocolClient('aerofetch', process.execPath, [resolve(devScript)])
 } else {
   app.setAsDefaultProtocolClient('aerofetch')
 }
 
 let mainWindow: BrowserWindow | null = null
 
-// Page background per theme — keep in sync with `pageBackground` in
-// src/renderer/src/theme.ts. Set as the window's NATIVE background so the
-// one-frame compositor repaint (when a tooltip/dropdown overlay first paints on
-// Windows) shows the app's current color instead of a mismatched white flash.
-const THEME_BACKGROUND = { light: '#f7f7f8', dark: '#161618' } as const
-
-// 'system' isn't a real background — resolve it against the OS's current
-// preference (nativeTheme.themeSource defaults to 'system', so this tracks it
-// without AeroFetch ever touching themeSource itself).
-function resolveBackgroundMode(theme: Settings['theme']): 'light' | 'dark' {
-  return theme === 'system' ? (nativeTheme.shouldUseDarkColors ? 'dark' : 'light') : theme
-}
-
-function getSystemThemeInfo(): SystemThemeInfo {
-  return {
-    shouldUseDarkColors: nativeTheme.shouldUseDarkColors,
-    shouldUseHighContrastColors: nativeTheme.shouldUseHighContrastColors
-  }
-}
-
 // Tell the user (once per run) that closing the window left AeroFetch running so
 // an in-progress download could finish — shown only when they haven't already
 // opted into tray mode, so a window that "won't close" doesn't read as a bug.
@@ -116,7 +70,8 @@ function notifyBackgroundOnce(): void {
   notifiedBackground = true
   new Notification({
     title: 'AeroFetch is still running',
-    body: 'Your download is finishing in the background. Use the tray icon to reopen or quit.'
+    body: 'Your download is finishing in the background. Use the tray icon to reopen or quit.',
+    icon: getAppIconImage()
   }).show()
 }
 
@@ -140,11 +95,22 @@ const DENIED_PERMISSIONS = new Set([
 ])
 
 function createWindow(): void {
+  // Reopen where the user left off (size / position / maximized), falling back to the
+  // default size when there's no usable saved state — first run, or the saved monitor
+  // is no longer connected (W2 / UX19).
+  const ws = initialWindowState()
   const win = new BrowserWindow({
-    width: 920,
-    height: 700,
+    title: 'AeroFetch',
+    width: ws.width,
+    height: ws.height,
+    x: ws.x,
+    y: ws.y,
+    // Below this the 212px sidebar + content layout breaks; pin a sensible
+    // floor so the window can't be dragged down to unusable widths (W1).
+    minWidth: 640,
+    minHeight: 480,
     show: false,
-    backgroundColor: THEME_BACKGROUND[resolveBackgroundMode(getSettings().theme)],
+    backgroundColor: PAGE_BACKGROUND[resolveBackgroundMode(getSettings().theme)],
     autoHideMenuBar: true,
     webPreferences: {
       preload: join(__dirname, '../preload/index.cjs'),
@@ -155,6 +121,22 @@ function createWindow(): void {
   })
   mainWindow = win
 
+  if (ws.maximized) win.maximize()
+
+  // Persist size/position/maximized so the next launch restores them (W2). Debounced
+  // so a drag-resize writes once when it settles; also saved on close (which may only
+  // hide to tray) to capture the final state.
+  let saveTimer: ReturnType<typeof setTimeout> | null = null
+  const scheduleSave = (): void => {
+    if (saveTimer) clearTimeout(saveTimer)
+    saveTimer = setTimeout(() => saveWindowState(win), 500)
+  }
+  win.on('resize', scheduleSave)
+  win.on('move', scheduleSave)
+
+  // Standard Cut/Copy/Paste/Select All right-click menu on editable fields (W4).
+  attachEditContextMenu(win.webContents)
+
   win.on('ready-to-show', () => {
     // A scheduled `--sync` launch starts unobtrusively (shown but not focused) so
     // the daily background sync doesn't steal focus; a normal launch shows + focuses.
@@ -167,6 +149,8 @@ function createWindow(): void {
   // kill the spawned yt-dlp processes and lose the download. A real quit (tray
   // menu / before-quit) sets isQuitting() so this lets the close through.
   win.on('close', (e) => {
+    // Capture the final bounds even when the close only hides to tray (W2).
+    saveWindowState(win)
     if (isQuitting()) return
     const downloadsRunning = hasActiveDownloads()
     if (getSettings().minimizeToTray || downloadsRunning) {
@@ -183,6 +167,13 @@ function createWindow(): void {
     if (mainWindow === win) mainWindow = null
   })
 
+  // When the user re-opens the window (via tray, second-instance, or deeplink)
+  // reset the background-notify latch so they're informed again if they close
+  // while a download is still running (L68).
+  win.on('show', () => {
+    notifiedBackground = false
+  })
+
   // The OS may have launched us with an aerofetch:// link or a "Send to" .url
   // file on the command line — hand it to DownloadBar's link-suggestion banner
   // once the page (and its IPC listener) is actually ready to receive it.
@@ -225,161 +216,12 @@ function createWindow(): void {
   }
 }
 
-function registerIpcHandlers(): void {
-  ipcMain.handle(IpcChannels.appVersion, () => app.getVersion())
-
-  ipcMain.handle(IpcChannels.appUpdateCheck, () => checkForAppUpdate())
-  ipcMain.handle(IpcChannels.appUpdateDownload, (e, url: string) =>
-    downloadAppUpdate(url, e.sender)
-  )
-  ipcMain.handle(IpcChannels.appUpdateRun, (_e, filePath: string) => runAppUpdate(filePath))
-
-  ipcMain.handle(IpcChannels.ytdlpVersion, () => getYtdlpVersion())
-
-  ipcMain.handle(IpcChannels.ffmpegVersion, () => getFfmpegVersions())
-
-  ipcMain.handle(IpcChannels.probe, (_e, url: string) => probeMedia(url))
-
-  ipcMain.handle(IpcChannels.downloadStart, (e, opts: StartDownloadOptions) => {
-    const result = startDownload(e.sender, opts)
-    // Pre-spawn failures (missing yt-dlp.exe, bad URL, duplicate id) never reach
-    // download.ts's own close/error handlers, so log them here instead.
-    if (!result.ok) {
-      addErrorLog({
-        id: opts.id,
-        url: opts.url,
-        kind: opts.kind,
-        error: result.error ?? 'Unknown error',
-        occurredAt: Date.now()
-      })
-    }
-    return result
-  })
-  ipcMain.handle(IpcChannels.downloadCancel, (_e, id: string) => cancelDownload(id))
-  ipcMain.handle(IpcChannels.downloadPause, (_e, id: string) => pauseDownload(id))
-  ipcMain.handle(IpcChannels.terminalRun, (e, id: string, args: string) =>
-    runTerminal(e.sender, id, args)
-  )
-  ipcMain.handle(IpcChannels.terminalCancel, (_e, id: string) => cancelTerminal(id))
-
-  ipcMain.handle(IpcChannels.defaultFolder, () => app.getPath('downloads'))
-
-  ipcMain.handle(IpcChannels.chooseFolder, async (e) => {
-    const win = BrowserWindow.fromWebContents(e.sender) ?? undefined
-    const res = await dialog.showOpenDialog(win!, {
-      properties: ['openDirectory', 'createDirectory']
-    })
-    return res.canceled || !res.filePaths[0] ? null : res.filePaths[0]
-  })
-
-  ipcMain.handle(IpcChannels.openPath, (_e, p: string) => safeOpenPath(p))
-  ipcMain.handle(IpcChannels.showInFolder, (_e, p: string) => safeShowInFolder(p))
-
-  ipcMain.handle(IpcChannels.clipboardRead, () => clipboard.readText())
-
-  ipcMain.handle(IpcChannels.settingsGet, () => getSettings())
-  ipcMain.handle(IpcChannels.settingsSet, (e, partial: Partial<Settings>) => {
-    const result = setSettings(partial)
-    // Keep the window's native background in sync with the theme so a compositor
-    // repaint never flashes a mismatched color behind an overlay. Use the
-    // validated result, not the raw partial (which may hold a bogus value).
-    if (partial.theme) {
-      BrowserWindow.fromWebContents(e.sender)?.setBackgroundColor(
-        THEME_BACKGROUND[resolveBackgroundMode(result.theme)]
-      )
-    }
-    return result
-  })
-
-  ipcMain.handle(IpcChannels.systemThemeGet, () => getSystemThemeInfo())
-
-  ipcMain.handle(IpcChannels.openHighContrastSettings, () =>
-    shell.openExternal('ms-settings:easeofaccess-highcontrast')
-  )
-
-  ipcMain.handle(IpcChannels.historyList, () => listHistory())
-  ipcMain.handle(IpcChannels.historyAdd, (_e, entry: HistoryEntry) => addHistory(entry))
-  ipcMain.handle(IpcChannels.historyRemove, (_e, id: string) => removeHistory(id))
-  ipcMain.handle(IpcChannels.historyRemoveMany, (_e, ids: string[]) => removeManyHistory(ids))
-  ipcMain.handle(IpcChannels.historyClear, () => clearHistory())
-
-  ipcMain.handle(IpcChannels.cookiesLogin, (_e, url: string) => openCookieLoginWindow(url))
-  ipcMain.handle(IpcChannels.cookiesStatus, () => getCookiesStatus())
-  ipcMain.handle(IpcChannels.cookiesClear, () => clearCookies())
-
-  ipcMain.handle(IpcChannels.templatesList, () => listTemplates())
-  ipcMain.handle(IpcChannels.templatesSave, (_e, template: CommandTemplate) => saveTemplate(template))
-  ipcMain.handle(IpcChannels.templatesRemove, (_e, id: string) => removeTemplate(id))
-
-  ipcMain.handle(IpcChannels.commandPreview, (_e, opts: StartDownloadOptions) =>
-    previewCommand(opts)
-  )
-
-  ipcMain.handle(IpcChannels.ytdlpUpdate, (_e, channel: YtdlpUpdateChannel) => updateYtdlp(channel))
-
-  ipcMain.handle(IpcChannels.errorLogList, () => listErrorLog())
-  ipcMain.handle(IpcChannels.errorLogClear, () => clearErrorLog())
-
-  ipcMain.handle(IpcChannels.backupExport, (e) =>
-    exportBackup(BrowserWindow.fromWebContents(e.sender) ?? undefined)
-  )
-  ipcMain.handle(IpcChannels.backupImport, async (e) => {
-    const win = BrowserWindow.fromWebContents(e.sender) ?? undefined
-    const result = await importBackup(win)
-    // A restored backup may have changed the theme; keep the native window
-    // background in sync the same way settingsSet does.
-    if (result.ok) {
-      win?.setBackgroundColor(THEME_BACKGROUND[resolveBackgroundMode(getSettings().theme)])
-    }
-    return result
-  })
-
-  // --- Media-manager sources (Pinchflat-style index; see ROADMAP-PINCHFLAT.md) ---
-  ipcMain.handle(IpcChannels.sourcesList, () => listSources())
-  ipcMain.handle(IpcChannels.sourceItems, (_e, sourceId: string) => listMediaItems(sourceId))
-  ipcMain.handle(IpcChannels.sourceRemove, (_e, id: string) => removeSource(id))
-  ipcMain.handle(IpcChannels.sourceItemDownloaded, (_e, id: string, filePath?: string) =>
-    setMediaItemDownloaded(id, filePath)
-  )
-  // Indexing pushes live progress to the requesting renderer over `indexProgress`
-  // and resolves with the final result.
-  ipcMain.handle(IpcChannels.sourceIndex, (e, url: string) =>
-    indexSource(url, (p) => {
-      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
-    })
-  )
-  ipcMain.handle(IpcChannels.sourceReindex, (e, id: string) => {
-    const src = getSource(id)
-    if (!src) return { ok: false, error: 'Source not found.' }
-    return indexSource(src.url, (p) => {
-      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
-    })
-  })
-  ipcMain.handle(IpcChannels.sourceSetWatched, (_e, id: string, watched: boolean) =>
-    setSourceWatched(id, watched)
-  )
-  ipcMain.handle(IpcChannels.sourcesSync, (e) =>
-    syncWatchedSources((p) => {
-      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
-    })
-  )
-  ipcMain.handle(IpcChannels.scheduledSyncGet, () => getScheduledSync())
-  ipcMain.handle(IpcChannels.scheduledSyncSet, (_e, enabled: boolean) => setScheduledSync(enabled))
-
-  // Reflect overall queue progress on the Windows taskbar (fire-and-forget).
-  ipcMain.on(IpcChannels.taskbarProgress, (_e, p: TaskbarProgress) => {
-    if (!mainWindow || mainWindow.isDestroyed()) return
-    if (p.mode === 'none') mainWindow.setProgressBar(-1)
-    else mainWindow.setProgressBar(Math.max(0, Math.min(1, p.fraction)), { mode: p.mode })
-  })
-}
-
 // Push OS theme/contrast changes to every window, and keep the native
 // background in sync for windows currently following 'system'.
 function registerSystemThemeBridge(): void {
   nativeTheme.on('updated', () => {
     const info = getSystemThemeInfo()
-    const bg = THEME_BACKGROUND[resolveBackgroundMode(getSettings().theme)]
+    const bg = PAGE_BACKGROUND[resolveBackgroundMode(getSettings().theme)]
     for (const win of BrowserWindow.getAllWindows()) {
       win.webContents.send(IpcChannels.systemThemeUpdate, info)
       if (getSettings().theme === 'system') win.setBackgroundColor(bg)
@@ -400,6 +242,10 @@ if (isPrimaryInstance) {
   app.whenReady().then(() => {
     electronApp.setAppUserModelId('com.aerofetch.app')
 
+    // M31: suppress the default Electron menu (which exposes DevTools/Reload via
+    // Alt) in production builds. In dev the menu is kept so DevTools are accessible.
+    if (!is.dev) Menu.setApplicationMenu(null)
+
     // Create the default Documents\Video and Documents\Audio destinations so they
     // exist from first launch (downloads are routed into them by kind).
     ensureMediaDirs()
@@ -407,6 +253,9 @@ if (isPrimaryInstance) {
     // Encrypt any credential still stored as legacy plaintext (from before at-rest
     // encryption), once safeStorage is available post-ready.
     migrateSecretsAtRest()
+    // Same for a pre-encryption plaintext cookies.txt — encrypt it and delete the
+    // plaintext so a logged-in session no longer sits in the open (H7).
+    migrateLegacyCookies()
 
     // Sync the Windows "run at sign-in" entry with the persisted setting, so it
     // reflects the user's choice even if they changed it on another install.
@@ -416,9 +265,11 @@ if (isPrimaryInstance) {
       optimizer.watchWindowShortcuts(window)
     })
 
-    registerIpcHandlers()
+    registerIpcHandlers(() => mainWindow)
     registerSystemThemeBridge()
     registerSendToShortcut()
+    // Apply the persisted theme to the OS title bar before the window opens (W3).
+    applyNativeTheme(getSettings().theme)
     createWindow()
     createTray(() => mainWindow)
 
@@ -443,20 +294,20 @@ if (isPrimaryInstance) {
       if (mainWindow && !mainWindow.isDestroyed()) {
         mainWindow.webContents.send(IpcChannels.ytdlpAutoUpdateStatus, status)
       }
-    }).catch(() => {})
-
-    app.on('activate', () => {
-      if (BrowserWindow.getAllWindows().length === 0) createWindow()
-    })
+    }).catch((e) => logger.error('yt-dlp auto-update failed', e))
   })
 
   // Any real quit path (tray "Quit", OS shutdown, the updater's app.quit) must set
   // the quitting flag so the window's close handler exits instead of hiding to tray.
-  app.on('before-quit', () => markQuitting())
-
-  app.on('window-all-closed', () => {
-    if (process.platform !== 'darwin') {
-      app.quit()
-    }
+  // Also flush any debounced JSON-store writes synchronously so a quit mid-debounce
+  // can't drop the last history/sources/template change (R3).
+  app.on('before-quit', () => {
+    markQuitting()
+    flushAllStores()
   })
+
+  // Windows-only app: closing the last window quits (the tray/in-flight-download
+  // paths hide rather than close, so this only fires on a real exit). The former
+  // macOS 'activate' handler and darwin guard were dead branches here (L147).
+  app.on('window-all-closed', () => app.quit())
 }
diff --git a/src/main/indexer.ts b/src/main/indexer.ts
index c587e89..c4da71f 100644
--- a/src/main/indexer.ts
+++ b/src/main/indexer.ts
@@ -9,9 +9,10 @@
  * this module is the impure shell that spawns yt-dlp and writes to disk.
  */
 
-import { execFile } from 'child_process'
 import { existsSync } from 'fs'
-import { getYtdlpPath } from './binaries'
+import { getYtdlpPath, YTDLP_MISSING_MSG } from './binaries'
+import { execFileAsync } from './lib/exec'
+import { INDEX_MAX_BUFFER, INDEX_TIMEOUT_MS } from './constants'
 import { cleanError } from './log'
 import { assertHttpUrl } from './url'
 import {
@@ -45,28 +46,24 @@ interface FlatInfo {
  * flat upload list can be a few MB of JSON; the timeout is generous for the same
  * reason. `--` terminates option parsing so the URL can't be read as a flag.
  */
-function probeFlat(url: string): Promise<FlatInfo> {
-  return new Promise((resolve, reject) => {
-    execFile(
-      getYtdlpPath(),
-      ['-J', '--flat-playlist', '--no-warnings', '--', url],
-      { windowsHide: true, maxBuffer: 256 * 1024 * 1024, timeout: 180_000 },
-      (err, stdout, stderr) => {
-        if (err) {
-          const msg = (err as { killed?: boolean }).killed
-            ? 'Timed out indexing source. Check the link or your connection.'
-            : cleanError(stderr) || err.message
-          reject(new Error(msg))
-          return
-        }
-        try {
-          resolve(JSON.parse(stdout) as FlatInfo)
-        } catch {
-          reject(new Error('Could not parse source info from yt-dlp.'))
-        }
-      }
+async function probeFlat(url: string): Promise<FlatInfo> {
+  const r = await execFileAsync(
+    getYtdlpPath(),
+    ['-J', '--flat-playlist', '--no-warnings', '--', url],
+    { maxBuffer: INDEX_MAX_BUFFER, timeout: INDEX_TIMEOUT_MS }
+  )
+  if (!r.ok) {
+    throw new Error(
+      r.timedOut
+        ? 'Timed out indexing source. Check the link or your connection.'
+        : cleanError(r.stderr) || r.error?.message || ''
     )
-  })
+  }
+  try {
+    return JSON.parse(r.stdout) as FlatInfo
+  } catch {
+    throw new Error('Could not parse source info from yt-dlp.')
+  }
 }
 
 /** Probe a channel tab (e.g. /videos, /playlists); never throws — returns null. */
@@ -90,7 +87,7 @@ export async function indexSource(
     return { ok: false, error: (e as Error).message }
   }
   if (!existsSync(getYtdlpPath())) {
-    return { ok: false, error: 'yt-dlp.exe not found. Drop it into resources/bin/.' }
+    return { ok: false, error: YTDLP_MISSING_MSG }
   }
 
   const cls = classifySource(url)
@@ -152,7 +149,8 @@ export async function indexSource(
       if (entries.length === 0) {
         return {
           ok: false,
-          error: 'That link is a single video, not a channel or playlist. Use the download bar for one video.'
+          error:
+            'That link is a single video, not a channel or playlist. Use the download bar for one video.'
         }
       }
       title = data.title || 'Playlist'
diff --git a/src/main/indexerCore.ts b/src/main/indexerCore.ts
index eb98106..d82ba34 100644
--- a/src/main/indexerCore.ts
+++ b/src/main/indexerCore.ts
@@ -88,7 +88,10 @@ export function classifySource(raw: string): SourceClass | null {
   // A playlist is identified purely by its list= param (works on any youtube host).
   const list = u.searchParams.get('list')
   if (isYouTube && list) {
-    return { kind: 'playlist', base: `https://www.youtube.com/playlist?list=${encodeURIComponent(list)}` }
+    return {
+      kind: 'playlist',
+      base: `https://www.youtube.com/playlist?list=${encodeURIComponent(list)}`
+    }
   }
 
   if (!isYouTube) return null
@@ -163,7 +166,7 @@ export function parseRssVideoIds(xml: string): string[] {
   const ids: string[] = []
   const re = /<yt:videoId>\s*([\w-]+)\s*<\/yt:videoId>/g
   let m: RegExpExecArray | null
-  while ((m = re.exec(xml)) !== null) ids.push(m[1])
+  while ((m = re.exec(xml)) !== null) if (m[1]) ids.push(m[1])
   return ids
 }
 
diff --git a/src/main/ipc.ts b/src/main/ipc.ts
new file mode 100644
index 0000000..0584a63
--- /dev/null
+++ b/src/main/ipc.ts
@@ -0,0 +1,291 @@
+/**
+ * IPC surface for the main process. Every `ipcMain.handle` (and the one
+ * fire-and-forget `taskbarProgress` receiver) lives here, extracted from index.ts
+ * so that module is just app lifecycle + window creation and this is the single
+ * place the renderer's IPC contract is wired (L2).
+ *
+ * The handful of handlers that must touch the window (folder picker parenting,
+ * theme-synced background, taskbar progress) get the current window through the
+ * `getMainWindow` accessor rather than a captured reference, so they always act on
+ * the live window. The small theme helpers they share are defined and exported
+ * here too, since index's system-theme bridge uses them as well.
+ */
+
+import { app, shell, BrowserWindow, ipcMain, dialog, clipboard, nativeTheme } from 'electron'
+import { existsSync } from 'fs'
+import {
+  IpcChannels,
+  type StartDownloadOptions,
+  type Settings,
+  type HistoryEntry,
+  type CommandTemplate,
+  type YtdlpUpdateChannel,
+  type SystemThemeInfo,
+  type TaskbarProgress,
+  type PersistedQueueItem
+} from '@shared/ipc'
+import { PAGE_BACKGROUND } from '@shared/theme'
+import { getYtdlpVersion, updateYtdlp } from './ytdlp'
+import { getFfmpegVersions } from './ffmpeg'
+import { checkForAppUpdate, downloadAppUpdate, runAppUpdate } from './updater'
+import { probeMedia } from './probe'
+import { startDownload, cancelDownload, pauseDownload, previewCommand } from './download'
+import { runTerminal, cancelTerminal } from './terminal'
+import { getSettings, setSettings } from './settings'
+import { listHistory, addHistory, removeHistory, removeManyHistory, clearHistory } from './history'
+import { listTemplates, saveTemplate, removeTemplate } from './templates'
+import { safeOpenPath, safeShowInFolder } from './reveal'
+import { openCookieLoginWindow, getCookiesStatus, clearCookies } from './cookies'
+import { listErrorLog, addErrorLog, clearErrorLog } from './errorlog'
+import { listQueue, saveQueue } from './queue'
+import { exportBackup, importBackup } from './backup'
+import {
+  listSources,
+  getSource,
+  removeSource,
+  listMediaItems,
+  setMediaItemDownloaded,
+  setSourceWatched
+} from './sources'
+import { indexSource } from './indexer'
+import { syncWatchedSources } from './sync'
+import { getScheduledSync, setScheduledSync } from './schedule'
+import { getActiveBadge, getErrorBadge } from './badge'
+import { openPoTokenWindow } from './poToken'
+import { logger } from './logger'
+
+// --- Theme helpers (shared with index's system-theme bridge) ----------------
+
+/** Resolve 'system' against the OS preference so callers always get a concrete color. */
+export function resolveBackgroundMode(theme: Settings['theme']): 'light' | 'dark' {
+  return theme === 'system' ? (nativeTheme.shouldUseDarkColors ? 'dark' : 'light') : theme
+}
+
+/**
+ * Keep the OS-drawn title bar consistent with the in-app theme (W3). Setting
+ * themeSource to 'light'/'dark' forces the caption/chrome to match; 'system'
+ * restores OS control. Called at startup and on every theme change.
+ */
+export function applyNativeTheme(theme: Settings['theme']): void {
+  nativeTheme.themeSource = theme
+}
+
+export function getSystemThemeInfo(): SystemThemeInfo {
+  return {
+    shouldUseDarkColors: nativeTheme.shouldUseDarkColors,
+    shouldUseHighContrastColors: nativeTheme.shouldUseHighContrastColors
+  }
+}
+
+// --- IPC registration -------------------------------------------------------
+
+export function registerIpcHandlers(getMainWindow: () => BrowserWindow | null): void {
+  // M30: a broken contextBridge causes the renderer to silently run in preview/mock
+  // mode. Catch it here and show a hard error so the failure is never invisible.
+  ipcMain.once(IpcChannels.preloadBridgeFailure, (_e, detail: unknown) => {
+    dialog.showErrorBox(
+      'AeroFetch could not start',
+      `The renderer bridge failed to initialize. Please reinstall the application.\n\n${String(detail)}`
+    )
+    app.quit()
+  })
+
+  // CC8: persist renderer-side failures (the M29 `logError` sites) to the main log
+  // file — the renderer console is unreachable in a packaged build. Fire-and-forget.
+  ipcMain.on(IpcChannels.logWrite, (_e, op: string, detail: string) =>
+    logger.error(`[renderer] ${op}`, detail)
+  )
+
+  ipcMain.handle(IpcChannels.appVersion, () => app.getVersion())
+
+  ipcMain.handle(IpcChannels.appUpdateCheck, () => checkForAppUpdate())
+  ipcMain.handle(IpcChannels.appUpdateDownload, (e, url: string) =>
+    downloadAppUpdate(url, e.sender)
+  )
+  ipcMain.handle(IpcChannels.appUpdateRun, (_e, filePath: string) => runAppUpdate(filePath))
+
+  ipcMain.handle(IpcChannels.ytdlpVersion, () => getYtdlpVersion())
+
+  ipcMain.handle(IpcChannels.ffmpegVersion, () => getFfmpegVersions())
+
+  ipcMain.handle(IpcChannels.probe, (_e, url: string) => probeMedia(url))
+
+  ipcMain.handle(IpcChannels.downloadStart, (e, opts: StartDownloadOptions) => {
+    const result = startDownload(e.sender, opts)
+    // Pre-spawn failures (missing yt-dlp.exe, bad URL, duplicate id) never reach
+    // download.ts's own close/error handlers, so log them here instead — unless the
+    // download is incognito, which is never recorded (L136).
+    if (!result.ok && !opts.incognito) {
+      addErrorLog({
+        id: opts.id,
+        url: opts.url,
+        kind: opts.kind,
+        error: result.error ?? 'Unknown error',
+        occurredAt: Date.now()
+      })
+    }
+    return result
+  })
+  ipcMain.handle(IpcChannels.downloadCancel, (_e, id: string) => cancelDownload(id))
+  ipcMain.handle(IpcChannels.downloadPause, (_e, id: string) => pauseDownload(id))
+  ipcMain.handle(IpcChannels.terminalRun, (e, id: string, args: string) =>
+    runTerminal(e.sender, id, args)
+  )
+  ipcMain.handle(IpcChannels.terminalCancel, (_e, id: string) => cancelTerminal(id))
+
+  ipcMain.handle(IpcChannels.chooseFolder, async (e, current?: string) => {
+    const win = BrowserWindow.fromWebContents(e.sender) ?? undefined
+    // Seed the picker at the currently-configured folder so it opens where the
+    // user already points, not a generic default (W5). 'createDirectory' is a
+    // macOS-only property and a no-op on Windows, so it's dropped (L58).
+    const defaultPath = current && existsSync(current) ? current : undefined
+    // Use the parented overload only when we actually have a window — passing a
+    // forced non-null window that's gone can throw (L53).
+    const res = win
+      ? await dialog.showOpenDialog(win, { properties: ['openDirectory'], defaultPath })
+      : await dialog.showOpenDialog({ properties: ['openDirectory'], defaultPath })
+    return res.canceled || !res.filePaths[0] ? null : res.filePaths[0]
+  })
+
+  ipcMain.handle(IpcChannels.openPath, (_e, p: string) => safeOpenPath(p))
+  ipcMain.handle(IpcChannels.openUrl, (_e, url: string) => {
+    try {
+      const { protocol } = new URL(url)
+      if (protocol === 'http:' || protocol === 'https:') void shell.openExternal(url)
+    } catch {
+      // Ignore malformed URLs.
+    }
+  })
+  ipcMain.handle(IpcChannels.showInFolder, (_e, p: string) => safeShowInFolder(p))
+
+  ipcMain.handle(IpcChannels.clipboardRead, () => clipboard.readText())
+
+  ipcMain.handle(IpcChannels.settingsGet, () => getSettings())
+  ipcMain.handle(IpcChannels.settingsSet, (e, partial: Partial<Settings>) => {
+    const result = setSettings(partial)
+    // Keep the window's native background and title bar in sync with the theme
+    // so a compositor repaint never flashes a mismatched color, and the OS-drawn
+    // caption always matches the in-app theme (W3). Use the validated result.
+    if (partial.theme) {
+      BrowserWindow.fromWebContents(e.sender)?.setBackgroundColor(
+        PAGE_BACKGROUND[resolveBackgroundMode(result.theme)]
+      )
+      applyNativeTheme(result.theme)
+    }
+    return result
+  })
+
+  ipcMain.handle(IpcChannels.systemThemeGet, () => getSystemThemeInfo())
+
+  ipcMain.handle(IpcChannels.openHighContrastSettings, () =>
+    shell.openExternal('ms-settings:easeofaccess-highcontrast')
+  )
+
+  ipcMain.handle(IpcChannels.historyList, () => listHistory())
+  ipcMain.handle(IpcChannels.historyAdd, (_e, entry: HistoryEntry) => addHistory(entry))
+  ipcMain.handle(IpcChannels.historyRemove, (_e, id: string) => removeHistory(id))
+  ipcMain.handle(IpcChannels.historyRemoveMany, (_e, ids: string[]) => removeManyHistory(ids))
+  ipcMain.handle(IpcChannels.historyClear, () => clearHistory())
+
+  ipcMain.handle(IpcChannels.cookiesLogin, (e, url: string) =>
+    // Parent the sign-in window to the app window (W6) so it groups under
+    // AeroFetch instead of spawning a second taskbar button.
+    openCookieLoginWindow(url, BrowserWindow.fromWebContents(e.sender) ?? undefined)
+  )
+  ipcMain.handle(IpcChannels.cookiesStatus, () => getCookiesStatus())
+  ipcMain.handle(IpcChannels.cookiesClear, () => clearCookies())
+
+  ipcMain.handle(IpcChannels.templatesList, () => listTemplates())
+  ipcMain.handle(IpcChannels.templatesSave, (_e, template: CommandTemplate) =>
+    saveTemplate(template)
+  )
+  ipcMain.handle(IpcChannels.templatesRemove, (_e, id: string) => removeTemplate(id))
+
+  ipcMain.handle(IpcChannels.commandPreview, (_e, opts: StartDownloadOptions) =>
+    previewCommand(opts)
+  )
+
+  ipcMain.handle(IpcChannels.ytdlpUpdate, (_e, channel: YtdlpUpdateChannel) => updateYtdlp(channel))
+
+  ipcMain.handle(IpcChannels.errorLogList, () => listErrorLog())
+  ipcMain.handle(IpcChannels.errorLogClear, () => clearErrorLog())
+
+  // Persisted download queue (M4): the renderer mirrors its durable items here and
+  // rehydrates them on launch, so saved/scheduled/pending downloads survive a quit.
+  ipcMain.handle(IpcChannels.queueList, () => listQueue())
+  ipcMain.handle(IpcChannels.queueSave, (_e, items: PersistedQueueItem[]) => saveQueue(items))
+
+  ipcMain.handle(IpcChannels.backupExport, (e) =>
+    exportBackup(BrowserWindow.fromWebContents(e.sender) ?? undefined)
+  )
+  ipcMain.handle(IpcChannels.backupImport, async (e) => {
+    const win = BrowserWindow.fromWebContents(e.sender) ?? undefined
+    const result = await importBackup(win)
+    // A restored backup may have changed the theme; keep the native window
+    // background and title bar in sync the same way settingsSet does (W3).
+    if (result.ok) {
+      const theme = getSettings().theme
+      win?.setBackgroundColor(PAGE_BACKGROUND[resolveBackgroundMode(theme)])
+      applyNativeTheme(theme)
+    }
+    return result
+  })
+
+  // --- Media-manager sources (Pinchflat-style index; see ROADMAP-PINCHFLAT.md) ---
+  ipcMain.handle(IpcChannels.sourcesList, () => listSources())
+  ipcMain.handle(IpcChannels.sourceItems, (_e, sourceId: string) => listMediaItems(sourceId))
+  ipcMain.handle(IpcChannels.sourceRemove, (_e, id: string) => removeSource(id))
+  ipcMain.handle(IpcChannels.sourceItemDownloaded, (_e, id: string, filePath?: string) =>
+    setMediaItemDownloaded(id, filePath)
+  )
+  // Indexing pushes live progress to the requesting renderer over `indexProgress`
+  // and resolves with the final result.
+  ipcMain.handle(IpcChannels.sourceIndex, (e, url: string) =>
+    indexSource(url, (p) => {
+      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
+    })
+  )
+  ipcMain.handle(IpcChannels.sourceReindex, (e, id: string) => {
+    const src = getSource(id)
+    if (!src) return { ok: false, error: 'Source not found.' }
+    return indexSource(src.url, (p) => {
+      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
+    })
+  })
+  ipcMain.handle(IpcChannels.sourceSetWatched, (_e, id: string, watched: boolean) =>
+    setSourceWatched(id, watched)
+  )
+  ipcMain.handle(IpcChannels.sourcesSync, (e) =>
+    syncWatchedSources((p) => {
+      if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
+    })
+  )
+  ipcMain.handle(IpcChannels.scheduledSyncGet, () => getScheduledSync())
+  ipcMain.handle(IpcChannels.scheduledSyncSet, (_e, enabled: boolean) => setScheduledSync(enabled))
+
+  // Reflect overall queue progress on the Windows taskbar and window title (SR8).
+  ipcMain.handle(IpcChannels.taskbarProgress, (_e, p: TaskbarProgress) => {
+    const win = getMainWindow()
+    if (!win || win.isDestroyed()) return
+    if (p.mode === 'none') {
+      win.setProgressBar(-1)
+      win.setOverlayIcon(null, '')
+      win.setTitle('AeroFetch')
+    } else {
+      win.setProgressBar(Math.max(0, Math.min(1, p.fraction)), { mode: p.mode })
+      const badge = p.mode === 'error' ? getErrorBadge() : getActiveBadge()
+      const n = p.badgeCount ?? 0
+      const label =
+        p.mode === 'error' ? 'Download error' : `${n} download${n !== 1 ? 's' : ''} active`
+      win.setOverlayIcon(badge, label)
+      win.setTitle(p.mode === 'error' ? 'AeroFetch — Error' : `AeroFetch — ${label}`)
+    }
+  })
+
+  // Open a YouTube WebView and extract a PO token for bot-check bypass (Phase P).
+  ipcMain.handle(IpcChannels.youtubePoTokenMint, async () => {
+    const token = await openPoTokenWindow()
+    if (token) await setSettings({ youtubePoToken: token })
+    return token
+  })
+}
diff --git a/src/main/jsonStore.ts b/src/main/jsonStore.ts
new file mode 100644
index 0000000..51e8512
--- /dev/null
+++ b/src/main/jsonStore.ts
@@ -0,0 +1,151 @@
+import { app } from 'electron'
+import { join } from 'path'
+import { readFileSync, writeFileSync, renameSync, existsSync, copyFileSync, unlinkSync } from 'fs'
+import { logger } from './logger'
+
+/**
+ * One shared persistence layer for the hand-rolled JSON array stores (history,
+ * error log, templates, sources, media-items). Replaces the per-module
+ * read/parse/write copies (SIMP1) and fixes three data-safety blockers:
+ *
+ *  - R1 -- atomic writes: write a temp file then `rename` over the target, so a
+ *    crash / power-cut mid-write can never truncate the real file. (`electron-store`,
+ *    used for settings, is already atomic; these stores were not.)
+ *  - R2 -- corruption is no longer silent data loss: on a parse error the bad file
+ *    is copied aside (`<file>.corrupt-<ts>`) before we fall back to empty, so a
+ *    single bad byte can't wipe the user's history/sources from their perspective.
+ *  - R3 -- an in-memory cache + debounced batched writes: the previous code
+ *    re-read + re-parsed the entire (multi-MB) file and rewrote it synchronously
+ *    on *every* download completion (≈O(n²) over a large channel, blocking the
+ *    main thread). Reads now hit the cache; writes coalesce into one atomic flush.
+ */
+
+// Debounce window for batched writes. Long enough to coalesce a burst (e.g. many
+// items enqueued/marked at once), short enough that data lands on disk promptly.
+const FLUSH_DELAY_MS = 400
+
+/**
+ * Read + validate a JSON array from `path`. Invalid rows are dropped. On a parse
+ * error the file is backed up to `<path>.corrupt-<timestamp>` before returning []
+ * so corruption is recoverable rather than a silent wipe (R2). A missing file is
+ * simply [] (first run), with no backup.
+ */
+export function readJsonArraySafe<T>(path: string, isValid: (o: unknown) => o is T): T[] {
+  let raw: string
+  try {
+    if (!existsSync(path)) return []
+    raw = readFileSync(path, 'utf8')
+  } catch {
+    return []
+  }
+  try {
+    const data = JSON.parse(raw)
+    return Array.isArray(data) ? data.filter(isValid) : []
+  } catch {
+    try {
+      copyFileSync(path, `${path}.corrupt-${Date.now()}`)
+    } catch {
+      /* best-effort -- if we can't back it up, still don't crash the read */
+    }
+    return []
+  }
+}
+
+/**
+ * Atomically write `value` as JSON to `path`: serialise to `<path>.tmp`, then
+ * `rename` it over the target (an atomic operation on the same volume), so a
+ * crash mid-write leaves either the old file or the new one -- never a truncated
+ * one (R1). `pretty` indents for human-readable files; pass false for large
+ * machine-only stores to avoid inflating size/write time (R8). Returns whether the
+ * write landed: a failure (disk full, read-only data dir) is logged rather than
+ * swallowed silently, so a record that looked saved but vanished on restart is at
+ * least diagnosable (R6). The leftover temp file is removed on failure so a partial
+ * `.tmp` can't accumulate.
+ */
+export function writeJsonAtomic(path: string, value: unknown, pretty = true): boolean {
+  const tmp = `${path}.tmp`
+  try {
+    writeFileSync(tmp, pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value))
+    renameSync(tmp, path)
+    return true
+  } catch (e) {
+    // R6: previously a silent catch — a failed persist (disk full, read-only
+    // profile) dropped the change with no trace. It now lands in the file-backed
+    // diagnostic log (CC8); the user-facing toast ties to the global status surface (UI25/UX9).
+    logger.error(`failed to write ${path}`, e)
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp)
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    return false
+  }
+}
+
+export interface JsonStore<T> {
+  /** All rows, validated; cached after the first read. */
+  read(): T[]
+  /** Replace all rows (capped), update the cache, and schedule an atomic flush. Returns the stored rows. */
+  write(items: T[]): T[]
+  /** Force any pending debounced write to disk synchronously (e.g. on quit). */
+  flush(): void
+}
+
+// Every store registers itself so app-quit can flush pending writes in one call.
+const registry: JsonStore<unknown>[] = []
+
+/**
+ * Create a cached, atomic JSON array store backed by `<userData>/<filename>`.
+ * `cap` bounds the row count (pass Infinity for none). The path is resolved
+ * lazily so importing this module never touches `app` before it's ready.
+ */
+export function createJsonStore<T>(
+  filename: string,
+  isValid: (o: unknown) => o is T,
+  cap: number,
+  // Pretty-print by default (small, hand-inspectable files); pass false for a
+  // large machine-only store to keep writes compact (R8).
+  pretty = true
+): JsonStore<T> {
+  let cache: T[] | null = null
+  let timer: ReturnType<typeof setTimeout> | null = null
+  let dirty = false
+
+  const filePath = (): string => join(app.getPath('userData'), filename)
+
+  function read(): T[] {
+    if (cache === null) cache = readJsonArraySafe(filePath(), isValid)
+    return cache
+  }
+
+  function flush(): void {
+    if (timer) {
+      clearTimeout(timer)
+      timer = null
+    }
+    if (!dirty) return
+    // Only clear the dirty flag once the write actually lands. A failed flush
+    // (disk full, transient lock) stays dirty so the next write() or the
+    // quit-time flushAllStores() retries it instead of silently dropping it (R6).
+    if (writeJsonAtomic(filePath(), cache ?? [], pretty)) dirty = false
+  }
+
+  function write(items: T[]): T[] {
+    // Avoid an extra copy in the common under-cap case so a per-completion write
+    // stays O(1) rather than re-slicing the whole list each time (R3).
+    cache = items.length > cap ? items.slice(0, cap) : items
+    dirty = true
+    if (timer) clearTimeout(timer)
+    timer = setTimeout(flush, FLUSH_DELAY_MS)
+    return cache
+  }
+
+  const store: JsonStore<T> = { read, write, flush }
+  registry.push(store as JsonStore<unknown>)
+  return store
+}
+
+/** Synchronously flush every store's pending write -- call on app quit. */
+export function flushAllStores(): void {
+  for (const s of registry) s.flush()
+}
diff --git a/src/main/lib/exec.ts b/src/main/lib/exec.ts
new file mode 100644
index 0000000..0f05d0b
--- /dev/null
+++ b/src/main/lib/exec.ts
@@ -0,0 +1,53 @@
+import { execFile, type ExecFileOptions } from 'child_process'
+
+/**
+ * Normalized result of a one-shot child-process run. `ok` is true on a clean
+ * exit-0; `timedOut` distinguishes a kill-by-timeout (Node sets `err.killed` when
+ * it terminates the process on the `timeout` option) from an ordinary non-zero
+ * exit, so callers can show "Timed out …" versus the captured stderr.
+ */
+export interface ExecResult {
+  ok: boolean
+  stdout: string
+  stderr: string
+  timedOut: boolean
+  /** The raw error on a non-zero exit / spawn failure (undefined when ok). */
+  error?: Error
+}
+
+/**
+ * `execFile` as a promise that never rejects (audit SIMP2/CC4/CC5). Replaces the
+ * six hand-rolled `new Promise((resolve) => execFile(…, cb))` wrappers across
+ * probe / ytdlp (×2) / ffmpeg / indexer / download.probeMeta — each caller now maps
+ * this normalized result to its own shape instead of repeating the `err.killed`
+ * timeout check and the resolve/reject plumbing. (schedule.ts keeps its own wrapper:
+ * it needs the numeric exit code, which this helper deliberately doesn't surface.)
+ *
+ * `windowsHide` defaults on (every caller wants the console window suppressed);
+ * pass `timeout` / `maxBuffer` per call exactly as before.
+ */
+export function execFileAsync(
+  file: string,
+  args: readonly string[],
+  options: ExecFileOptions = {}
+): Promise<ExecResult> {
+  return new Promise((resolve) => {
+    execFile(file, [...args], { windowsHide: true, ...options }, (err, stdout, stderr) => {
+      // With the default (utf8) encoding stdout/stderr are strings, but ExecFileOptions
+      // permits a Buffer encoding, so normalize defensively.
+      const out = typeof stdout === 'string' ? stdout : stdout.toString()
+      const errOut = typeof stderr === 'string' ? stderr : stderr.toString()
+      if (err) {
+        resolve({
+          ok: false,
+          stdout: out,
+          stderr: errOut,
+          timedOut: (err as { killed?: boolean }).killed === true,
+          error: err
+        })
+      } else {
+        resolve({ ok: true, stdout: out, stderr: errOut, timedOut: false })
+      }
+    })
+  })
+}
diff --git a/src/main/lib/formatters.ts b/src/main/lib/formatters.ts
new file mode 100644
index 0000000..9a96a19
--- /dev/null
+++ b/src/main/lib/formatters.ts
@@ -0,0 +1,36 @@
+import type { DownloadProgress } from '@shared/ipc'
+import { fmtBytes } from '@shared/format'
+
+// yt-dlp progress-line parsing. Extracted from download.ts so it can be
+// unit-tested without pulling in the electron import chain (L37). Byte/speed/ETA
+// formatting lives in @shared/format — the one home for both sides of the IPC
+// boundary; consumers import it directly.
+
+function num(s?: string): number | undefined {
+  if (!s || s === 'NA') return undefined
+  const n = Number(s)
+  return Number.isFinite(n) ? n : undefined
+}
+
+export function parseProgress(rest: string): DownloadProgress | null {
+  const parts = rest.split('|')
+  if (parts.length < 6) return null
+  const [status, dl, total, totalEst, speed, eta] = parts
+  const downloaded = num(dl)
+  const totalBytes = num(total) ?? num(totalEst)
+  let progress = 0
+  if (totalBytes && downloaded != null) progress = Math.min(1, downloaded / totalBytes)
+  return {
+    status: status || 'downloading',
+    progress,
+    // Carry raw numbers across the IPC boundary; the renderer formats them for
+    // display AND aggregates them (combined speed / longest ETA) without having
+    // to re-parse a formatted string (H4).
+    speedBytesPerSec: num(speed),
+    etaSeconds: num(eta),
+    sizeLabel: totalBytes ? fmtBytes(totalBytes) : undefined,
+    // No (estimated) total → the % can never advance; flag it so the renderer
+    // shows an indeterminate bar rather than a stuck 0% (L137).
+    sizeUnknown: !totalBytes
+  }
+}
diff --git a/src/main/lib/lineBuffer.ts b/src/main/lib/lineBuffer.ts
new file mode 100644
index 0000000..4043d2e
--- /dev/null
+++ b/src/main/lib/lineBuffer.ts
@@ -0,0 +1,37 @@
+/**
+ * A newline line-splitter for streamed child-process output (audit CC3/CC4/SIMP5).
+ *
+ * `download.ts` and `terminal.ts` each had the same hand-rolled loop: accumulate
+ * chunk strings, emit every complete `\n`-terminated line (stripping a trailing
+ * `\r`), and keep the partial remainder for the next chunk. This is that logic in
+ * one place, and — being pure and synchronous — it's unit-tested directly.
+ *
+ * Usage: feed decoded chunks with `push()`, and call `flush()` on stream close to
+ * emit any trailing partial line that never saw a newline.
+ */
+export interface LineBuffer {
+  /** Accept a decoded chunk; invokes the sink for each newly-completed line. */
+  push: (chunk: string) => void
+  /** Emit any buffered remainder (a final line with no trailing newline). */
+  flush: () => void
+}
+
+export function createLineBuffer(onLine: (line: string) => void): LineBuffer {
+  let buf = ''
+  return {
+    push(chunk: string): void {
+      buf += chunk
+      let nl: number
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        onLine(buf.slice(0, nl).replace(/\r$/, ''))
+        buf = buf.slice(nl + 1)
+      }
+    },
+    flush(): void {
+      if (buf) {
+        onLine(buf)
+        buf = ''
+      }
+    }
+  }
+}
diff --git a/src/main/logger.ts b/src/main/logger.ts
new file mode 100644
index 0000000..eee55f5
--- /dev/null
+++ b/src/main/logger.ts
@@ -0,0 +1,106 @@
+import { app } from 'electron'
+import { join } from 'path'
+import { appendFileSync, mkdirSync, renameSync, statSync } from 'fs'
+import { LOG_MAX_BYTES } from './constants'
+
+/**
+ * One small leveled, file-backed logger for the whole app (audit CC8). Before this,
+ * diagnostics were effectively invisible in a packaged build: main-process catches
+ * did a bare `console.error` (unreachable — the app menu/DevTools are suppressed in
+ * production, M31) and the renderer's `logError` (M29) wrote to a console nobody could
+ * open. Every catch now routes here and lands in `<userData>/logs/aerofetch.log`, so a
+ * field-reported failure is actually diagnosable.
+ *
+ * Scope: this is the diagnostic log. `errorlog.ts` remains separate — it's user-facing
+ * *download* failure data shown in Settings → Diagnostics, not app logging. The
+ * user-facing toast half of CC8 ties to the global status surface (UI25/UX9).
+ *
+ * All `app`/fs access is lazy and guarded so importing this module never touches
+ * `app` before it's ready — and so it's a safe no-op under unit tests, where
+ * `electron`'s `app` is undefined.
+ */
+
+export type LogLevel = 'error' | 'warn' | 'info' | 'debug'
+
+const LEVELS: Record<LogLevel, number> = { error: 0, warn: 1, info: 2, debug: 3 }
+
+// Write everything at or above this level to the file. `debug` is dev-only noise, so
+// it never hits the file (but still prints to the dev console).
+const FILE_THRESHOLD = LEVELS.info
+
+/** Format one log line: `2026-07-01T08:30:00.000Z [ERROR] message`. Pure, for tests. */
+export function formatLine(level: LogLevel, message: string, now: Date = new Date()): string {
+  return `${now.toISOString()} [${level.toUpperCase()}] ${message}`
+}
+
+/** Combine an operation label with an optional error/detail into one message. Pure. */
+export function composeMessage(label: string, detail?: unknown): string {
+  if (detail === undefined) return label
+  const text = detail instanceof Error ? detail.message : String(detail)
+  return `${label}: ${text}`
+}
+
+// `undefined` = not yet resolved, `null` = resolution failed (no app/userData, e.g.
+// under unit tests) so file logging is disabled; a string is the resolved path.
+let cachedFile: string | null | undefined
+function logFile(): string | null {
+  if (cachedFile !== undefined) return cachedFile
+  try {
+    const dir = join(app.getPath('userData'), 'logs')
+    mkdirSync(dir, { recursive: true })
+    cachedFile = join(dir, 'aerofetch.log')
+  } catch {
+    // No app / userData available (unit test, or app not ready) — disable the file sink.
+    cachedFile = null
+  }
+  return cachedFile
+}
+
+/** Dev mode, resolved lazily and guarded (app is undefined in the test env). */
+function isDev(): boolean {
+  try {
+    return !app.isPackaged
+  } catch {
+    return false
+  }
+}
+
+// Rotate to `<file>.1` (single generation) once the live file passes the cap, so the
+// log can't grow without bound. Best-effort: any fs error here is swallowed — logging
+// must never throw into a catch handler.
+function rotateIfNeeded(file: string): void {
+  try {
+    if (statSync(file).size > LOG_MAX_BYTES) renameSync(file, `${file}.1`)
+  } catch {
+    /* file missing (first write) or rename race — ignore */
+  }
+}
+
+function writeToFile(line: string): void {
+  const file = logFile()
+  if (!file) return
+  rotateIfNeeded(file)
+  try {
+    appendFileSync(file, line + '\n')
+  } catch {
+    /* disk full / read-only profile — nothing more we can safely do */
+  }
+}
+
+function emit(level: LogLevel, label: string, detail?: unknown): void {
+  const message = composeMessage(label, detail)
+  // Console in dev keeps the familiar `--inspect` workflow; the file is the sink that
+  // survives into a packaged build.
+  if (isDev()) {
+    const fn = level === 'error' ? console.error : level === 'warn' ? console.warn : console.log
+    fn(`[AeroFetch] ${message}`)
+  }
+  if (LEVELS[level] <= FILE_THRESHOLD) writeToFile(formatLine(level, message))
+}
+
+export const logger = {
+  error: (label: string, detail?: unknown): void => emit('error', label, detail),
+  warn: (label: string, detail?: unknown): void => emit('warn', label, detail),
+  info: (label: string, detail?: unknown): void => emit('info', label, detail),
+  debug: (label: string, detail?: unknown): void => emit('debug', label, detail)
+}
diff --git a/src/main/paths.ts b/src/main/paths.ts
new file mode 100644
index 0000000..3488b05
--- /dev/null
+++ b/src/main/paths.ts
@@ -0,0 +1,40 @@
+import { app } from 'electron'
+import { join } from 'path'
+import { mkdirSync } from 'fs'
+
+/**
+ * Filesystem path helpers for the main process. Kept separate from settings.ts
+ * (the electron-store persistence layer) so path derivation and the settings
+ * store don't share a module — they have different concerns and dependencies (L69).
+ * All resolve app paths, so callers must run post-`app.ready`.
+ */
+
+/** Fixed path for the --download-archive file; not user-configurable. */
+export function getDownloadArchivePath(): string {
+  return join(app.getPath('userData'), 'download-archive.txt')
+}
+
+/**
+ * The default per-kind download destination: video → Documents\Video,
+ * audio → Documents\Audio. Used when the user hasn't set an explicit output
+ * folder (Settings → Download folder), so downloads are sorted by type.
+ */
+export function getDefaultMediaDir(kind: 'video' | 'audio'): string {
+  return join(app.getPath('documents'), kind === 'audio' ? 'Audio' : 'Video')
+}
+
+/**
+ * Create the Documents\Video and Documents\Audio folders up front (called once
+ * at startup) so they exist the moment the app opens, not just after the first
+ * download. Best-effort: yt-dlp also creates the output dir at download time, so
+ * a failure here (read-only Documents, redirected folder) is non-fatal.
+ */
+export function ensureMediaDirs(): void {
+  for (const kind of ['video', 'audio'] as const) {
+    try {
+      mkdirSync(getDefaultMediaDir(kind), { recursive: true })
+    } catch {
+      /* non-fatal — the download path will be created on demand instead */
+    }
+  }
+}
diff --git a/src/main/poToken.ts b/src/main/poToken.ts
new file mode 100644
index 0000000..cf024eb
--- /dev/null
+++ b/src/main/poToken.ts
@@ -0,0 +1,148 @@
+import { BrowserWindow, type WebContents } from 'electron'
+import { LOGIN_PARTITION } from './cookies'
+
+/** A public YouTube video used as the extraction target (stable, always accessible). */
+const YT_VIDEO = 'https://www.youtube.com/watch?v=jNQXAC9IVRw'
+
+/**
+ * Restrict a PO-token window to *.youtube.com and accounts.google.com (for
+ * sign-in). Mirrors hardenLoginWebContents in cookies.ts.
+ */
+function isAllowedPoTokenUrl(target: string): boolean {
+  try {
+    const { protocol, hostname } = new URL(target)
+    if (protocol !== 'http:' && protocol !== 'https:') return false
+    return (
+      hostname === 'youtube.com' ||
+      hostname.endsWith('.youtube.com') ||
+      hostname === 'accounts.google.com' ||
+      hostname.endsWith('.accounts.google.com')
+    )
+  } catch {
+    return false
+  }
+}
+
+function hardenPoTokenWebContents(wc: WebContents): void {
+  wc.setWindowOpenHandler((details) => {
+    if (!isAllowedPoTokenUrl(details.url)) return { action: 'deny' }
+    return {
+      action: 'allow',
+      overrideBrowserWindowOptions: {
+        autoHideMenuBar: true,
+        webPreferences: {
+          partition: LOGIN_PARTITION,
+          sandbox: true,
+          contextIsolation: true,
+          nodeIntegration: false
+        }
+      }
+    }
+  })
+  wc.on('will-navigate', (e, navUrl) => {
+    if (!isAllowedPoTokenUrl(navUrl)) e.preventDefault()
+  })
+  wc.on('will-redirect', (e, navUrl) => {
+    if (!isAllowedPoTokenUrl(navUrl)) e.preventDefault()
+  })
+  wc.on('did-create-window', (child) => hardenPoTokenWebContents(child.webContents))
+}
+
+/**
+ * Async IIFE injected into the YouTube page after load. Polls
+ * ytInitialPlayerResponse.serviceIntegrityDimensions.poToken (the field
+ * yt-dlp's youtube extractor reads) for up to 8 s, returning the token
+ * string or null if it never appears. The poll loop is needed because the
+ * player JS initialises asynchronously after the DOM is ready.
+ */
+const EXTRACT_SCRIPT = `
+(async function() {
+  for (let i = 0; i < 16; i++) {
+    try {
+      const pot = window.ytInitialPlayerResponse
+        && window.ytInitialPlayerResponse.serviceIntegrityDimensions
+        && window.ytInitialPlayerResponse.serviceIntegrityDimensions.poToken
+      if (typeof pot === 'string' && pot.length > 0) return pot
+    } catch (_) {}
+    await new Promise(r => setTimeout(r, 500))
+  }
+  return null
+})()
+`
+
+let mintWindow: BrowserWindow | null = null
+
+/**
+ * Open a visible BrowserWindow on a YouTube video page and extract the
+ * Proof-of-Origin token from the page runtime. The window uses the shared
+ * login session so a signed-in user's credentials are available.
+ *
+ * Resolves with the token string on success, or null if the window was closed
+ * by the user before extraction completed or if the field was not found.
+ */
+export function openPoTokenWindow(): Promise<string | null> {
+  // If a minting window is already open, bring it to the front rather than
+  // opening a second one.
+  if (mintWindow && !mintWindow.isDestroyed()) {
+    mintWindow.focus()
+    // Return a promise that resolves when the existing window closes.
+    return new Promise((resolve) => {
+      mintWindow!.once('closed', () => resolve(null))
+    })
+  }
+
+  return new Promise((resolve) => {
+    let resolved = false
+    const finish = (token: string | null): void => {
+      if (resolved) return
+      resolved = true
+      resolve(token)
+    }
+
+    let win: BrowserWindow
+    try {
+      win = new BrowserWindow({
+        width: 960,
+        height: 640,
+        title: 'AeroFetch — Fetch YouTube token',
+        autoHideMenuBar: true,
+        webPreferences: {
+          partition: LOGIN_PARTITION,
+          sandbox: true,
+          contextIsolation: true,
+          nodeIntegration: false
+        }
+      })
+    } catch {
+      finish(null)
+      return
+    }
+
+    mintWindow = win
+    hardenPoTokenWebContents(win.webContents)
+    win.webContents.session.setPermissionRequestHandler((_wc, _perm, cb) => cb(false))
+
+    win.webContents.once('did-finish-load', () => {
+      win.webContents
+        .executeJavaScript(EXTRACT_SCRIPT, true)
+        .then((result: unknown) => {
+          const token = typeof result === 'string' && result.length > 0 ? result : null
+          finish(token)
+          win.close()
+        })
+        .catch(() => {
+          finish(null)
+          win.close()
+        })
+    })
+
+    win.on('closed', () => {
+      mintWindow = null
+      finish(null)
+    })
+
+    win.loadURL(YT_VIDEO).catch(() => {
+      /* navigation errors surface as Chromium's own error page */
+    })
+  })
+}
diff --git a/src/main/probe.ts b/src/main/probe.ts
index 74f32e6..3068318 100644
--- a/src/main/probe.ts
+++ b/src/main/probe.ts
@@ -1,7 +1,8 @@
-import { execFile } from 'child_process'
 import { existsSync } from 'fs'
-import { getYtdlpPath } from './binaries'
-import { fmtBytes } from './download'
+import { getYtdlpPath, YTDLP_MISSING_MSG } from './binaries'
+import { execFileAsync } from './lib/exec'
+import { PROBE_MAX_BUFFER, PROBE_TIMEOUT_MS } from './constants'
+import { fmtBytes } from '@shared/format'
 import { cleanError } from './log'
 import { assertHttpUrl } from './url'
 import { entryUrl, fmtDuration, type RawEntry } from './indexerCore'
@@ -69,7 +70,10 @@ function buildVideoFormats(raw: RawFormat[]): FormatOption[] {
   const options = [...bestByHeight.values()]
     .sort((a, b) => (b.height ?? 0) - (a.height ?? 0))
     .map(toOption)
-  options.unshift({ id: BEST_FORMAT_ID, label: 'Best available', ext: 'mp4', hasAudio: true })
+  // No `ext`: the final container for the auto-best pick depends on the user's
+  // videoContainer setting (mp4/mkv/webm), unknown here -- claiming 'mp4' would
+  // mislabel mkv/webm outputs (L62). hasAudio is always true (best merges audio).
+  options.unshift({ id: BEST_FORMAT_ID, label: 'Best available', hasAudio: true })
   return options
 }
 
@@ -110,52 +114,40 @@ function buildPlaylist(data: RawInfo): PlaylistInfo {
  * its format list) or, when the URL is a playlist, the flat list of its entries.
  * `--flat-playlist` is a no-op for a lone video, so one call covers both cases.
  */
-export function probeMedia(url: string): Promise<ProbeResult> {
+export async function probeMedia(url: string): Promise<ProbeResult> {
   const ytdlp = getYtdlpPath()
   if (!existsSync(ytdlp)) {
-    return Promise.resolve({
-      ok: false,
-      error: `yt-dlp.exe not found at ${ytdlp}\nDrop it into resources/bin/ (see the README there).`
-    })
+    return { ok: false, error: YTDLP_MISSING_MSG }
   }
   let target: string
   try {
     target = assertHttpUrl(url) // normalised form (audit F5)
   } catch (e) {
-    return Promise.resolve({ ok: false, error: (e as Error).message })
+    return { ok: false, error: (e as Error).message }
   }
 
-  return new Promise((resolve) => {
-    execFile(
-      ytdlp,
-      // `--` terminates option parsing so the URL can never be read as a flag.
-      ['-J', '--flat-playlist', '--no-warnings', '--', target],
-      { windowsHide: true, maxBuffer: 64 * 1024 * 1024, timeout: 60_000 },
-      (err, stdout, stderr) => {
-        if (err) {
-          // execFile sets `killed` when it terminated the process on timeout.
-          const msg = (err as { killed?: boolean }).killed
-            ? 'Timed out fetching video info. Check the link or your connection.'
-            : cleanError(stderr) || err.message
-          resolve({ ok: false, error: msg })
-          return
-        }
-        try {
-          const data = JSON.parse(stdout) as RawInfo
-          if (data._type === 'playlist' || Array.isArray(data.entries)) {
-            const playlist = buildPlaylist(data)
-            if (playlist.count === 0) {
-              resolve({ ok: false, error: 'This playlist has no downloadable entries.' })
-              return
-            }
-            resolve({ ok: true, kind: 'playlist', playlist })
-          } else {
-            resolve({ ok: true, kind: 'video', info: buildInfo(data) })
-          }
-        } catch {
-          resolve({ ok: false, error: 'Could not parse video info from yt-dlp.' })
-        }
-      }
-    )
+  // `--` terminates option parsing so the URL can never be read as a flag.
+  const r = await execFileAsync(ytdlp, ['-J', '--flat-playlist', '--no-warnings', '--', target], {
+    maxBuffer: PROBE_MAX_BUFFER,
+    timeout: PROBE_TIMEOUT_MS
   })
+  if (!r.ok) {
+    const msg = r.timedOut
+      ? 'Timed out fetching video info. Check the link or your connection.'
+      : cleanError(r.stderr) || r.error?.message || ''
+    return { ok: false, error: msg }
+  }
+  try {
+    const data = JSON.parse(r.stdout) as RawInfo
+    if (data._type === 'playlist' || Array.isArray(data.entries)) {
+      const playlist = buildPlaylist(data)
+      if (playlist.count === 0) {
+        return { ok: false, error: 'This playlist has no downloadable entries.' }
+      }
+      return { ok: true, kind: 'playlist', playlist }
+    }
+    return { ok: true, kind: 'video', info: buildInfo(data) }
+  } catch {
+    return { ok: false, error: 'Could not parse video info from yt-dlp.' }
+  }
 }
diff --git a/src/main/queue.ts b/src/main/queue.ts
new file mode 100644
index 0000000..0a0d863
--- /dev/null
+++ b/src/main/queue.ts
@@ -0,0 +1,46 @@
+import { createJsonStore } from './jsonStore'
+import { QUEUE_MAX } from './constants'
+import type { PersistedQueueItem, PersistedQueueStatus } from '@shared/ipc'
+
+/**
+ * Persistence for the download queue (M4). The queue lived only in renderer memory,
+ * so `saved` / scheduled and other pending downloads were silently lost on quit.
+ * The renderer now mirrors its durable items here (via `queueSave`) and rehydrates
+ * them on launch (via `queueList`), so a parked/scheduled download returns.
+ *
+ * Reuses the shared cached-atomic `createJsonStore` (R1/R2/R3), so writes are atomic
+ * and coalesced — the renderer can call `queueSave` freely on queue changes.
+ */
+
+const PERSISTED_STATUSES: readonly PersistedQueueStatus[] = [
+  'queued',
+  'downloading',
+  'paused',
+  'saved',
+  'error'
+]
+
+/** Defensive row validator (a hand-edited or partially-written file can't crash a read). */
+function isValidQueueItem(o: unknown): o is PersistedQueueItem {
+  if (typeof o !== 'object' || o === null) return false
+  const it = o as Record<string, unknown>
+  return (
+    typeof it.id === 'string' &&
+    typeof it.url === 'string' &&
+    typeof it.title === 'string' &&
+    (it.kind === 'video' || it.kind === 'audio') &&
+    typeof it.quality === 'string' &&
+    typeof it.status === 'string' &&
+    (PERSISTED_STATUSES as readonly string[]).includes(it.status)
+  )
+}
+
+const store = createJsonStore('queue.json', isValidQueueItem, QUEUE_MAX)
+
+export function listQueue(): PersistedQueueItem[] {
+  return store.read()
+}
+
+export function saveQueue(items: PersistedQueueItem[]): void {
+  store.write(items)
+}
diff --git a/src/main/reveal.ts b/src/main/reveal.ts
index 1105248..0a699df 100644
--- a/src/main/reveal.ts
+++ b/src/main/reveal.ts
@@ -13,11 +13,29 @@ import { extname, isAbsolute } from 'path'
  */
 const OPENABLE_EXTENSIONS = new Set([
   // video
-  '.mp4', '.mkv', '.webm', '.mov', '.avi', '.flv', '.ts', '.m4v', '.3gp', '.ogv',
+  '.mp4',
+  '.mkv',
+  '.webm',
+  '.mov',
+  '.avi',
+  '.flv',
+  '.ts',
+  '.m4v',
+  '.3gp',
+  '.ogv',
   // audio
-  '.mp3', '.m4a', '.opus', '.ogg', '.oga', '.aac', '.flac', '.wav', '.wma',
+  '.mp3',
+  '.m4a',
+  '.opus',
+  '.ogg',
+  '.oga',
+  '.aac',
+  '.flac',
+  '.wav',
+  '.wma',
   // subtitle sidecars (plain text — safe to open)
-  '.vtt', '.srt'
+  '.vtt',
+  '.srt'
 ])
 
 /** Open a downloaded media file with its default app. Returns '' on success,
@@ -35,8 +53,11 @@ export async function safeOpenPath(p: unknown): Promise<string> {
   return shell.openPath(p)
 }
 
-/** Reveal a path in the OS file manager. No-op for missing/invalid paths. */
-export function safeShowInFolder(p: unknown): void {
-  if (typeof p !== 'string' || !isAbsolute(p) || !existsSync(p)) return
+/** Reveal a path in the OS file manager. Returns '' on success, or an error
+ *  string (mirroring safeOpenPath) so the renderer can surface it (UX6). */
+export function safeShowInFolder(p: unknown): string {
+  if (typeof p !== 'string' || !isAbsolute(p)) return 'Invalid path.'
+  if (!existsSync(p)) return 'File not found — it may have been moved or deleted.'
   shell.showItemInFolder(p)
+  return ''
 }
diff --git a/src/main/schedule.ts b/src/main/schedule.ts
index 0676c46..e352b13 100644
--- a/src/main/schedule.ts
+++ b/src/main/schedule.ts
@@ -21,10 +21,15 @@ function schtasks(args: string[]): Promise<{ code: number; stdout: string; stder
   return new Promise((resolve) => {
     // Resolve schtasks from System32 by absolute path, not the bare name, so a
     // planted schtasks.exe on PATH / in the CWD can't be invoked instead. (audit F3)
-    execFile(getSystem32Path('schtasks.exe'), args, { windowsHide: true }, (err, stdout, stderr) => {
-      const code = err ? ((err as { code?: number }).code ?? 1) : 0
-      resolve({ code, stdout: String(stdout), stderr: String(stderr) })
-    })
+    execFile(
+      getSystem32Path('schtasks.exe'),
+      args,
+      { windowsHide: true },
+      (err, stdout, stderr) => {
+        const code = err ? ((err as { code?: number }).code ?? 1) : 0
+        resolve({ code, stdout: String(stdout), stderr: String(stderr) })
+      }
+    )
   })
 }
 
diff --git a/src/main/settings.ts b/src/main/settings.ts
index fa67807..0244b3b 100644
--- a/src/main/settings.ts
+++ b/src/main/settings.ts
@@ -1,8 +1,7 @@
 import { app, safeStorage } from 'electron'
-import { join } from 'path'
-import { mkdirSync } from 'fs'
 import Store from 'electron-store'
 import { isSafeFilenameTemplate, isSafeOutputDir } from './validation'
+import { logger } from './logger'
 import {
   AUDIO_FORMATS,
   VIDEO_CONTAINERS,
@@ -10,50 +9,24 @@ import {
   SPONSORBLOCK_CATEGORIES,
   COOKIE_BROWSERS,
   ACCENT_COLORS,
+  VIDEO_QUALITY_OPTIONS,
+  AUDIO_QUALITY_OPTIONS,
   DEFAULT_DOWNLOAD_OPTIONS,
+  DEFAULT_SETTINGS,
   isYtdlpUpdateChannel,
   type Settings,
   type DownloadOptions,
-  type SponsorBlockCategory
+  type SponsorBlockCategory,
+  type AudioFormat,
+  type VideoContainer,
+  type VideoCodecPref
 } from '@shared/ipc'
 
-const DEFAULTS: Settings = {
-  // Both blank by default → downloads land in Documents\Video / Documents\Audio
-  // (see getDefaultMediaDir). A non-empty value is an explicit per-kind override.
-  videoDir: '',
-  audioDir: '',
-  defaultKind: 'video',
-  defaultVideoQuality: 'Best available',
-  defaultAudioQuality: 'Best (MP3)',
-  maxConcurrent: 2,
-  filenameTemplate: '%(title)s.%(ext)s',
-  theme: 'light',
-  accentColor: 'teal',
-  clipboardWatch: true,
-  downloadOptions: DEFAULT_DOWNLOAD_OPTIONS,
-  proxy: '',
-  rateLimit: '',
-  useAria2c: false,
-  cookieSource: 'none',
-  cookiesBrowser: 'chrome',
-  youtubePlayerClient: '',
-  youtubePoToken: '',
-  restrictFilenames: false,
-  downloadArchive: false,
-  // yt-dlp is self-managed: a writable copy under userData, auto-updated on the
-  // nightly channel (fastest to follow YouTube changes that cause 403s).
-  autoUpdateYtdlp: true,
-  ytdlpChannel: 'nightly',
-  ytdlpLastUpdateCheck: 0,
-  customCommandEnabled: false,
-  defaultTemplateId: null,
-  notifyOnComplete: true,
-  autoDownloadNew: true,
-  hasCompletedOnboarding: false,
-  minimizeToTray: false,
-  launchAtStartup: false,
-  updateToken: ''
-}
+// The electron-store defaults are the canonical DEFAULT_SETTINGS from the shared
+// contract — single-sourced so the renderer FALLBACK and the preview mock can't
+// drift from main (C1). The rationale for individual defaults (SR1/SR2/SR3) lives
+// alongside DEFAULT_SETTINGS in shared/ipc.ts.
+const DEFAULTS: Settings = DEFAULT_SETTINGS
 
 /**
  * Sync the OS "run at sign-in" entry with the launchAtStartup setting. Called at
@@ -69,56 +42,29 @@ export function applyLaunchAtStartup(enabled: boolean): void {
   }
 }
 
-/** Fixed path for the --download-archive file; not user-configurable. */
-export function getDownloadArchivePath(): string {
-  return join(app.getPath('userData'), 'download-archive.txt')
-}
-
-/**
- * The default per-kind download destination: video → Documents\Video,
- * audio → Documents\Audio. Used when the user hasn't set an explicit output
- * folder (Settings → Download folder), so downloads are sorted by type.
- */
-export function getDefaultMediaDir(kind: 'video' | 'audio'): string {
-  return join(app.getPath('documents'), kind === 'audio' ? 'Audio' : 'Video')
-}
-
-/**
- * Create the Documents\Video and Documents\Audio folders up front (called once
- * at startup) so they exist the moment the app opens, not just after the first
- * download. Best-effort: yt-dlp also creates the output dir at download time, so
- * a failure here (read-only Documents, redirected folder) is non-fatal.
- */
-export function ensureMediaDirs(): void {
-  for (const kind of ['video', 'audio'] as const) {
-    try {
-      mkdirSync(getDefaultMediaDir(kind), { recursive: true })
-    } catch {
-      /* non-fatal — the download path will be created on demand instead */
-    }
-  }
-}
-
 // Coerce an untrusted partial into a valid DownloadOptions, falling back to the
 // defaults for any missing/invalid field. Used both to migrate older settings
 // files (which predate downloadOptions) and to validate renderer writes.
 function sanitizeOptions(input: unknown): DownloadOptions {
   const o = (input && typeof input === 'object' ? input : {}) as Partial<DownloadOptions>
   const d = DEFAULT_DOWNLOAD_OPTIONS
-  const bool = (v: unknown, fallback: boolean): boolean =>
-    typeof v === 'boolean' ? v : fallback
+  const bool = (v: unknown, fallback: boolean): boolean => (typeof v === 'boolean' ? v : fallback)
   const cats = Array.isArray(o.sponsorBlockCategories)
     ? (o.sponsorBlockCategories.filter((c) =>
         (SPONSORBLOCK_CATEGORIES as readonly string[]).includes(c)
       ) as SponsorBlockCategory[])
     : d.sponsorBlockCategories
   return {
-    audioFormat: AUDIO_FORMATS.includes(o.audioFormat as never) ? o.audioFormat! : d.audioFormat,
-    videoContainer: VIDEO_CONTAINERS.includes(o.videoContainer as never)
-      ? o.videoContainer!
+    audioFormat: (AUDIO_FORMATS as readonly string[]).includes(o.audioFormat as string)
+      ? (o.audioFormat as AudioFormat)
+      : d.audioFormat,
+    videoContainer: (VIDEO_CONTAINERS as readonly string[]).includes(o.videoContainer as string)
+      ? (o.videoContainer as VideoContainer)
       : d.videoContainer,
-    preferredVideoCodec: VIDEO_CODECS.includes(o.preferredVideoCodec as never)
-      ? o.preferredVideoCodec!
+    preferredVideoCodec: (VIDEO_CODECS as readonly string[]).includes(
+      o.preferredVideoCodec as string
+    )
+      ? (o.preferredVideoCodec as VideoCodecPref)
       : d.preferredVideoCodec,
     formatSort: typeof o.formatSort === 'string' ? o.formatSort.trim() : d.formatSort,
     embedSubtitles: bool(o.embedSubtitles, d.embedSubtitles),
@@ -133,6 +79,9 @@ function sanitizeOptions(input: unknown): DownloadOptions {
     embedChapters: bool(o.embedChapters, d.embedChapters),
     splitChapters: bool(o.splitChapters, d.splitChapters),
     embedMetadata: bool(o.embedMetadata, d.embedMetadata),
+    metadataTitle: typeof o.metadataTitle === 'string' ? o.metadataTitle : undefined,
+    metadataArtist: typeof o.metadataArtist === 'string' ? o.metadataArtist : undefined,
+    metadataAlbum: typeof o.metadataAlbum === 'string' ? o.metadataAlbum : undefined,
     embedThumbnail: bool(o.embedThumbnail, d.embedThumbnail),
     cropThumbnail: bool(o.cropThumbnail, d.cropThumbnail),
     writeInfoJson: bool(o.writeInfoJson, d.writeInfoJson),
@@ -149,13 +98,19 @@ function getStore(): Store<Settings> {
   return store
 }
 
+// Decrypted-settings cache — avoids repeated DPAPI calls on hot paths such as
+// buildCommand, the maxConcurrent check, completion notify, and the system-theme
+// bridge (PERF1). Invalidated by every setSettings write and by the one-time
+// migrateSecretsAtRest so callers always see the current values.
+let cachedSettings: Settings | null = null
+
 // --- Credential encryption at rest ------------------------------------------
 // proxy / youtubePoToken / updateToken can carry secrets (a proxy password, API
 // tokens). They're stored encrypted via Electron safeStorage (DPAPI on Windows)
-// so a leaked settings.json doesn't expose them. They're still decrypted before
-// reaching the renderer and exported in clear by backup — this guards the file at
-// rest only.
-const SECRET_KEYS = ['proxy', 'youtubePoToken', 'updateToken'] as const
+// so a leaked settings.json doesn't expose them. They're decrypted before
+// reaching the renderer; backup export strips them entirely (see backup.ts, M22).
+// Exported so backup.ts shares this one list rather than keeping a parallel copy.
+export const SECRET_KEYS = ['proxy', 'youtubePoToken', 'updateToken'] as const
 
 // Marks a value produced by encryptSecret, so a read can tell ciphertext from a
 // legacy plaintext value (written before encryption existed, or while safeStorage
@@ -172,6 +127,11 @@ function encryptSecret(plain: string): string {
   } catch {
     /* fall through — store plaintext, as it was before encryption existed */
   }
+  // R7: OS encryption (DPAPI/keychain) is unavailable, so this credential is about
+  // to be written in cleartext. Warn rather than fall back silently — a leaked
+  // settings.json would then expose the proxy password / API token. (DPAPI is
+  // effectively always present on Windows, so this should never fire in practice.)
+  logger.warn('OS secret encryption unavailable — storing credential as plaintext')
   return plain
 }
 
@@ -213,9 +173,11 @@ export function migrateSecretsAtRest(): void {
     const raw = s.get(key) ?? ''
     if (raw && !raw.startsWith(ENC_PREFIX)) s.set(key, encryptSecret(raw))
   }
+  cachedSettings = null
 }
 
 export function getSettings(): Settings {
+  if (cachedSettings) return cachedSettings
   const s = getStore()
   // getSettings() is on hot paths (buildCommand, notification checks, the system-
   // theme bridge, several IPC handlers). electron-store writes to disk on every
@@ -236,9 +198,15 @@ export function getSettings(): Settings {
   if (!(ACCENT_COLORS as readonly string[]).includes(cur.accentColor)) {
     s.set('accentColor', DEFAULTS.accentColor)
   }
+  // Migrate the legacy audio-quality label 'Best (MP3)' to the format-agnostic
+  // 'Best' so the dropdown matches and the label no longer names a format (M18).
+  if (cur.defaultAudioQuality === 'Best (MP3)') {
+    s.set('defaultAudioQuality', 'Best')
+  }
   // Hand callers (and, via IPC, the renderer) plaintext credentials — they're
   // only encrypted on disk (see withDecryptedSecrets / encryptSecret).
-  return withDecryptedSecrets(s.store)
+  cachedSettings = withDecryptedSecrets(s.store)
+  return cachedSettings
 }
 
 /** Shallow structural equality for DownloadOptions (sponsorBlockCategories compared by value). */
@@ -264,6 +232,20 @@ function downloadOptionsEqual(a: DownloadOptions, b: unknown): boolean {
 // background (theme), so an out-of-range or malformed value shouldn't get stored.
 export function setSettings(partial: Partial<Settings>): Settings {
   const s = getStore()
+  try {
+    applySettings(s, partial)
+  } catch (e) {
+    // R5: a write failure (disk full, read-only profile) must not crash the IPC
+    // handler or surface as an unhandled rejection. Log it; getSettings() below
+    // returns the store's ACTUAL persisted state, so the renderer's reconciliation
+    // (M34) reflects what truly saved instead of the optimistic value.
+    logger.error('settings write failed', e)
+  }
+  cachedSettings = null
+  return getSettings()
+}
+
+function applySettings(s: Store<Settings>, partial: Partial<Settings>): void {
   for (const key of Object.keys(partial) as (keyof Settings)[]) {
     const value = partial[key]
     if (value === undefined) continue
@@ -294,6 +276,7 @@ export function setSettings(partial: Partial<Settings>): Settings {
       case 'autoDownloadNew':
       case 'hasCompletedOnboarding':
       case 'minimizeToTray':
+      case 'sidebarCollapsed':
         if (typeof value === 'boolean') s.set(key, value)
         break
       case 'launchAtStartup':
@@ -343,23 +326,42 @@ export function setSettings(partial: Partial<Settings>): Settings {
         }
         break
       case 'defaultVideoQuality':
+        if (
+          typeof value === 'string' &&
+          (VIDEO_QUALITY_OPTIONS as readonly string[]).includes(value)
+        ) {
+          s.set('defaultVideoQuality', value)
+        }
+        break
       case 'defaultAudioQuality':
+        if (
+          typeof value === 'string' &&
+          (AUDIO_QUALITY_OPTIONS as readonly string[]).includes(value)
+        ) {
+          s.set('defaultAudioQuality', value)
+        }
+        break
       case 'rateLimit':
+        // yt-dlp rate-limit format: empty (disabled) or e.g. "500K", "2.5M", "1G".
+        if (typeof value === 'string' && /^(\d+\.?\d*[KMGkmg]?B?)?$/.test(value.trim())) {
+          s.set('rateLimit', value.trim())
+        }
+        break
       case 'youtubePlayerClient':
-        if (typeof value === 'string') s.set(key, value)
+        // Power-user field; yt-dlp's client list evolves. Accept any trimmed string.
+        if (typeof value === 'string') s.set('youtubePlayerClient', value.trim())
         break
       // Credential-bearing fields — encrypted at rest (see encryptSecret). proxy
-      // may embed user:pass@host; youtubePoToken is an access token. exportBackup
-      // still writes them in clear (via the decrypted getSettings), as documented.
+      // may embed user:pass@host; youtubePoToken is an access token. Both are
+      // stripped from backup exports (see SECRET_KEYS / backup.ts).
       case 'proxy':
       case 'youtubePoToken':
         if (typeof value === 'string') s.set(key, encryptSecret(value))
         break
       case 'updateToken':
-        // A Gitea token has no spaces; trim before encrypting (like proxy creds).
+        // An access token has no spaces; trim before encrypting (like proxy creds).
         if (typeof value === 'string') s.set('updateToken', encryptSecret(value.trim()))
         break
     }
   }
-  return getSettings()
 }
diff --git a/src/main/sources.ts b/src/main/sources.ts
index bf0ef1a..ddb2acc 100644
--- a/src/main/sources.ts
+++ b/src/main/sources.ts
@@ -2,58 +2,39 @@
  * Persistence for the media-manager index (Pinchflat-style; see
  * ROADMAP-PINCHFLAT.md). Two plain-JSON stores in userData, mirroring the
  * history.ts pattern (and the same deliberate choice to stay on JSON rather than
- * better-sqlite3 — revisit if a user indexes many large channels, see the
+ * better-sqlite3 -- revisit if a user indexes many large channels, see the
  * Phase H risk note in the roadmap):
  *
- *   sources.json      — one Source record per added channel/playlist
- *   media-items.json  — every MediaItem across all sources (queried by sourceId)
+ *   sources.json      -- one Source record per added channel/playlist
+ *   media-items.json  -- every MediaItem across all sources (queried by sourceId)
  *
  * Per-row validation on read (validation.ts) so a hand-edited or corrupted file
  * can't feed the UI malformed records (same approach as history/errorlog).
  */
 
-import { app } from 'electron'
-import { join } from 'path'
-import { readFileSync, writeFileSync, existsSync } from 'fs'
 import type { Source, MediaItem } from '@shared/ipc'
 import { isValidSource, isValidMediaItem } from './validation'
 import { mergeItemsPreservingState } from './indexerCore'
+import { createJsonStore } from './jsonStore'
+// A generous global cap (MEDIA_ITEMS_MAX, see constants.ts) so a runaway index
+// can't grow the file unbounded; large enough for several big channels. When
+// exceeded, the most-recently-written source's items are kept (they're placed
+// first by replaceMediaItems).
+import { MEDIA_ITEMS_MAX as MAX_ITEMS } from './constants'
 
-// A generous global cap so a runaway index can't grow the file unbounded; large
-// enough for several big channels. When exceeded, the most-recently-written
-// source's items are kept (they're placed first by replaceMediaItems).
-const MAX_ITEMS = 20000
-
-function sourcesFile(): string {
-  return join(app.getPath('userData'), 'sources.json')
-}
-
-function itemsFile(): string {
-  return join(app.getPath('userData'), 'media-items.json')
-}
-
-function readJsonArray<T>(path: string, isValid: (o: unknown) => o is T): T[] {
-  try {
-    if (!existsSync(path)) return []
-    const data = JSON.parse(readFileSync(path, 'utf8'))
-    return Array.isArray(data) ? data.filter(isValid) : []
-  } catch {
-    return []
-  }
-}
-
-function writeJson(path: string, value: unknown): void {
-  try {
-    writeFileSync(path, JSON.stringify(value, null, 2))
-  } catch {
-    /* best-effort; a read-only data dir just means no persisted index */
-  }
-}
+// Two cached, atomically-written stores (R1–R3 via the shared jsonStore). The
+// media-items store is the hot path: setMediaItemDownloaded used to re-read and
+// rewrite the whole (≤MAX_ITEMS) file on every completion; now reads hit the
+// cache and writes are batched. Sources are few, so that store is uncapped.
+const sourcesStore = createJsonStore('sources.json', isValidSource, Infinity)
+// Compact (not pretty) -- this store can hold up to MAX_ITEMS rows; indentation
+// would needlessly inflate its size and write time (R8).
+const itemsStore = createJsonStore('media-items.json', isValidMediaItem, MAX_ITEMS, false)
 
 // --- Sources ----------------------------------------------------------------
 
 export function listSources(): Source[] {
-  return readJsonArray(sourcesFile(), isValidSource)
+  return sourcesStore.read()
 }
 
 export function getSource(id: string): Source | undefined {
@@ -62,31 +43,25 @@ export function getSource(id: string): Source | undefined {
 
 /** Insert or replace a source by id (a re-index updates the existing record). */
 export function upsertSource(source: Source): Source[] {
-  const sources = [source, ...listSources().filter((s) => s.id !== source.id)]
-  writeJson(sourcesFile(), sources)
-  return sources
+  return sourcesStore.write([source, ...listSources().filter((s) => s.id !== source.id)])
 }
 
 /** Toggle whether a source is watched for new uploads (Phase J). Returns all sources. */
 export function setSourceWatched(id: string, watched: boolean): Source[] {
-  const sources = listSources().map((s) => (s.id === id ? { ...s, watched } : s))
-  writeJson(sourcesFile(), sources)
-  return sources
+  return sourcesStore.write(listSources().map((s) => (s.id === id ? { ...s, watched } : s)))
 }
 
 /** Remove a source and all of its media items. Returns the remaining sources. */
 export function removeSource(id: string): Source[] {
-  const sources = listSources().filter((s) => s.id !== id)
-  writeJson(sourcesFile(), sources)
-  const items = listAllItems().filter((m) => m.sourceId !== id)
-  writeJson(itemsFile(), items)
+  const sources = sourcesStore.write(listSources().filter((s) => s.id !== id))
+  itemsStore.write(listAllItems().filter((m) => m.sourceId !== id))
   return sources
 }
 
 // --- Media items ------------------------------------------------------------
 
 function listAllItems(): MediaItem[] {
-  return readJsonArray(itemsFile(), isValidMediaItem)
+  return itemsStore.read()
 }
 
 export function listMediaItems(sourceId: string): MediaItem[] {
@@ -95,12 +70,14 @@ export function listMediaItems(sourceId: string): MediaItem[] {
 
 /**
  * Replace all media items for one source with a fresh set (the result of a
- * (re)index). Other sources' items are preserved; the new items are placed first
- * so they survive the MAX_ITEMS cap.
+ * (re)index). Other sources' items are preserved in full; only the source being
+ * written here absorbs the MAX_ITEMS cap, so re-indexing one (large) source can
+ * never silently evict another source's items past the global limit (M23).
  */
 export function replaceMediaItems(sourceId: string, items: MediaItem[]): void {
   const others = listAllItems().filter((m) => m.sourceId !== sourceId)
-  writeJson(itemsFile(), [...items, ...others].slice(0, MAX_ITEMS))
+  const budget = Math.max(0, MAX_ITEMS - others.length)
+  itemsStore.write([...items.slice(0, budget), ...others])
 }
 
 /**
@@ -130,6 +107,6 @@ export function setMediaItemDownloaded(id: string, filePath?: string): MediaItem
   const updated = all.map((m) =>
     m.id === id ? { ...m, downloaded: true, downloadedAt: Date.now(), filePath } : m
   )
-  writeJson(itemsFile(), updated)
+  itemsStore.write(updated)
   return updated.filter((m) => m.sourceId === target.sourceId)
 }
diff --git a/src/main/sync.ts b/src/main/sync.ts
index 51ede1d..f7af5c1 100644
--- a/src/main/sync.ts
+++ b/src/main/sync.ts
@@ -8,6 +8,7 @@
 import { listSources, listMediaItems } from './sources'
 import { indexSource } from './indexer'
 import { parseRssVideoIds, isYouTubeFeedUrl } from './indexerCore'
+import { FEED_FETCH_TIMEOUT_MS } from './constants'
 import type { IndexProgress, MediaItem, SyncResult } from '@shared/ipc'
 
 /** Fetch a YouTube RSS feed and return its recent video ids. Throws on failure. */
@@ -16,7 +17,7 @@ async function fetchFeedIds(feedUrl: string): Promise<string[]> {
   // corrupted sources.json might carry (SSRF guard, audit T7). A throw here is
   // caught by the caller, which then falls back to a full yt-dlp re-index.
   if (!isYouTubeFeedUrl(feedUrl)) throw new Error('Refusing to fetch a non-YouTube feed URL.')
-  const res = await fetch(feedUrl, { signal: AbortSignal.timeout(15_000) })
+  const res = await fetch(feedUrl, { signal: AbortSignal.timeout(FEED_FETCH_TIMEOUT_MS) })
   if (!res.ok) throw new Error(`feed responded ${res.status}`)
   return parseRssVideoIds(await res.text())
 }
diff --git a/src/main/templates.ts b/src/main/templates.ts
index 3f12c89..00a1e58 100644
--- a/src/main/templates.ts
+++ b/src/main/templates.ts
@@ -1,38 +1,20 @@
-import { app } from 'electron'
-import { join } from 'path'
-import { readFileSync, writeFileSync, existsSync } from 'fs'
 import type { CommandTemplate } from '@shared/ipc'
 import { isTemplateLike } from './validation'
+import { createJsonStore } from './jsonStore'
+import { TEMPLATES_MAX } from './constants'
 
-// Plain JSON in userData, same shape as history.ts.
-const MAX_TEMPLATES = 100
-
-function templatesFile(): string {
-  return join(app.getPath('userData'), 'templates.json')
-}
-
+// Plain JSON in userData, same shape as history.ts. Atomic writes / corruption
+// backup / caching come from the shared jsonStore (R1–R3).
 // A persisted template entry must at least be an object carrying an id (see
 // isTemplateLike in validation.ts); everything else is coerced by sanitize().
 // Drop anything that isn't, so a hand-edited templates.json can't inject
 // malformed entries. (audit S5)
-export function listTemplates(): CommandTemplate[] {
-  try {
-    if (!existsSync(templatesFile())) return []
-    const data = JSON.parse(readFileSync(templatesFile(), 'utf8'))
-    // Validate shape, then normalise each surviving entry through sanitize() so
-    // name/args are always well-formed strings regardless of what was on disk.
-    return Array.isArray(data) ? data.filter(isTemplateLike).map(sanitize) : []
-  } catch {
-    return []
-  }
-}
+const store = createJsonStore('templates.json', isTemplateLike, TEMPLATES_MAX)
 
-function save(templates: CommandTemplate[]): void {
-  try {
-    writeFileSync(templatesFile(), JSON.stringify(templates.slice(0, MAX_TEMPLATES), null, 2))
-  } catch {
-    /* best-effort; a read-only data dir just means no persisted templates */
-  }
+export function listTemplates(): CommandTemplate[] {
+  // Normalise each surviving entry through sanitize() so name/args are always
+  // well-formed strings regardless of what was on disk.
+  return store.read().map(sanitize)
 }
 
 function sanitize(t: CommandTemplate): CommandTemplate {
@@ -49,20 +31,14 @@ function sanitize(t: CommandTemplate): CommandTemplate {
 /** Add a new template, or update an existing one (matched by id). */
 export function saveTemplate(template: CommandTemplate): CommandTemplate[] {
   const clean = sanitize(template)
-  const templates = [clean, ...listTemplates().filter((t) => t.id !== clean.id)]
-  save(templates)
-  return templates
+  return store.write([clean, ...listTemplates().filter((t) => t.id !== clean.id)])
 }
 
 export function removeTemplate(id: string): CommandTemplate[] {
-  const templates = listTemplates().filter((t) => t.id !== id)
-  save(templates)
-  return templates
+  return store.write(listTemplates().filter((t) => t.id !== id))
 }
 
 /** Replace the entire template list (backup restore) rather than merge-by-id. */
 export function replaceTemplates(templates: CommandTemplate[]): CommandTemplate[] {
-  const clean = templates.map(sanitize)
-  save(clean)
-  return clean
+  return store.write(templates.map(sanitize))
 }
diff --git a/src/main/terminal.ts b/src/main/terminal.ts
index 77dd2ee..a2e382d 100644
--- a/src/main/terminal.ts
+++ b/src/main/terminal.ts
@@ -14,6 +14,7 @@ import { getYtdlpPath, getBinDir, getSystem32Path } from './binaries'
 import { getSettings } from './settings'
 import { ensureManagedYtdlp } from './ytdlp'
 import { parseExtraArgs } from './buildArgs'
+import { createLineBuffer } from './lib/lineBuffer'
 import { IpcChannels, type TerminalEvent, type TerminalRunResult } from '@shared/ipc'
 
 const active = new Map<string, ChildProcess>()
@@ -47,18 +48,12 @@ export function runTerminal(wc: WebContents, id: string, argsRaw: string): Termi
   active.set(id, child)
 
   // Buffer each stream and emit on newline boundaries (flush the remainder on close).
-  const buffers: Record<'stdout' | 'stderr', string> = { stdout: '', stderr: '' }
-  function feed(stream: 'stdout' | 'stderr', chunk: string): void {
-    buffers[stream] += chunk
-    let nl: number
-    while ((nl = buffers[stream].indexOf('\n')) >= 0) {
-      const line = buffers[stream].slice(0, nl).replace(/\r$/, '')
-      buffers[stream] = buffers[stream].slice(nl + 1)
-      send(wc, { type: 'output', id, line, stream })
-    }
+  const lineBufs = {
+    stdout: createLineBuffer((line) => send(wc, { type: 'output', id, line, stream: 'stdout' })),
+    stderr: createLineBuffer((line) => send(wc, { type: 'output', id, line, stream: 'stderr' }))
   }
-  child.stdout?.on('data', (c: Buffer) => feed('stdout', c.toString()))
-  child.stderr?.on('data', (c: Buffer) => feed('stderr', c.toString()))
+  child.stdout?.on('data', (c: Buffer) => lineBufs.stdout.push(c.toString()))
+  child.stderr?.on('data', (c: Buffer) => lineBufs.stderr.push(c.toString()))
 
   let settled = false
   child.on('error', (err) => {
@@ -72,9 +67,8 @@ export function runTerminal(wc: WebContents, id: string, argsRaw: string): Termi
     settled = true
     active.delete(id)
     // Flush any trailing partial lines that never hit a newline.
-    for (const stream of ['stdout', 'stderr'] as const) {
-      if (buffers[stream]) send(wc, { type: 'output', id, line: buffers[stream], stream })
-    }
+    lineBufs.stdout.flush()
+    lineBufs.stderr.flush()
     send(wc, { type: 'done', id, code })
   })
 
diff --git a/src/main/tray.ts b/src/main/tray.ts
index 4545cfd..4042d4f 100644
--- a/src/main/tray.ts
+++ b/src/main/tray.ts
@@ -44,7 +44,8 @@ export function createTray(getWindow: () => BrowserWindow | null): void {
   // Prefer the real app icon; fall back to the embedded glyph when no icon.ico
   // ships, so minimize-to-tray always has a tray to restore from.
   let icon = nativeImage.createFromPath(getAppIconPath())
-  if (icon.isEmpty()) icon = nativeImage.createFromDataURL(`data:image/png;base64,${FALLBACK_TRAY_PNG}`)
+  if (icon.isEmpty())
+    icon = nativeImage.createFromDataURL(`data:image/png;base64,${FALLBACK_TRAY_PNG}`)
   if (icon.isEmpty()) return
 
   tray = new Tray(icon)
diff --git a/src/main/updater.ts b/src/main/updater.ts
index c744d0a..4e54665 100644
--- a/src/main/updater.ts
+++ b/src/main/updater.ts
@@ -68,9 +68,10 @@ function updateDir(): string {
  * an "upgrade" over the same shipped version.
  */
 function parseVersion(v: string): number[] {
-  return v
-    .replace(/^v/i, '')
-    .split(/[-+]/)[0]
+  // split() always yields at least one element; `?? ''` only satisfies the type
+  // checker (noUncheckedIndexedAccess) for the [0] access.
+  const core = v.replace(/^v/i, '').split(/[-+]/)[0] ?? ''
+  return core
     .split('.')
     .map((p) => parseInt(p, 10))
     .filter((n) => !Number.isNaN(n))
@@ -105,9 +106,28 @@ interface GiteaRelease {
  * output (`<hash>  file`), or PowerShell Get-FileHash (uppercase). Returns the
  * lowercase digest, or null if there's no standalone 64-char hex token (so a
  * longer run like a sha512 digest is ignored rather than sliced).
+ *
+ * When `fileName` is given (the installer asset's name), a multi-line / combined
+ * checksum file is matched line-by-line and the hash on the line naming THIS
+ * asset wins — so a `<asset>.sha256` that happens to list several files can't
+ * verify the installer against the wrong line's hash (B3). Falls back to the
+ * first standalone digest for bare single-hash files (no filename present).
  */
-export function extractSha256(text: string): string | null {
-  const m = text.match(/\b[a-f0-9]{64}\b/i)
+export function extractSha256(text: string, fileName?: string): string | null {
+  const hashRe = /\b[a-f0-9]{64}\b/i
+  if (fileName) {
+    const base = fileName.toLowerCase()
+    for (const line of text.split(/\r?\n/)) {
+      const m = line.match(hashRe)
+      if (!m) continue
+      // The filename is the last whitespace-delimited token on a sha256sum /
+      // Get-FileHash line (optionally with a '*' binary-mode marker). Match it
+      // exactly — a loose substring would let 'App.exe' match a 'MyApp.exe' line.
+      const last = (line.trim().split(/\s+/).pop() ?? '').replace(/^\*/, '')
+      if (last.toLowerCase() === base) return m[0].toLowerCase()
+    }
+  }
+  const m = text.match(hashRe)
   return m ? m[0].toLowerCase() : null
 }
 
@@ -200,7 +220,9 @@ function fetchTrustedText(
 ): Promise<{ ok: true; text: string } | { ok: false; status?: number; error: string }> {
   return new Promise((resolve) => {
     let settled = false
-    const done = (r: { ok: true; text: string } | { ok: false; status?: number; error: string }): void => {
+    const done = (
+      r: { ok: true; text: string } | { ok: false; status?: number; error: string }
+    ): void => {
       if (settled) return
       settled = true
       clearTimeout(timer)
@@ -261,7 +283,7 @@ export async function downloadAppUpdate(url: string, wc: WebContents): Promise<A
   const sum = await fetchTrustedText(checksumUrl)
   let expectedSha: string | null = null
   if (sum.ok) {
-    expectedSha = extractSha256(sum.text)
+    expectedSha = extractSha256(sum.text, safeName)
     if (!expectedSha) return { ok: false, error: "The update's checksum file is malformed." }
   } else if (sum.status === 404) {
     if (REQUIRE_CHECKSUM) {
@@ -391,9 +413,6 @@ export async function downloadAppUpdate(url: string, wc: WebContents): Promise<A
   })
 }
 
-/** Let the launched installer spawn before we quit to release our files (ms). */
-const INSTALLER_HANDOFF_MS = 1500
-
 /** Launch a freshly-downloaded installer, then quit so it can replace the app. */
 export async function runAppUpdate(filePath: string): Promise<{ ok: boolean; error?: string }> {
   try {
@@ -406,10 +425,15 @@ export async function runAppUpdate(filePath: string): Promise<{ ok: boolean; err
       return { ok: false, error: 'Refused to run an unexpected file.' }
     }
     await stat(target) // throws if the file is missing
-    const err = await shell.openPath(target) // hand the installer to the OS
+    // Hand the installer to the OS via ShellExecute, which (unlike a raw
+    // CreateProcess/spawn) honors the NSIS elevation manifest — needed if the
+    // build ever flips to perMachine. openPath resolves once the launch is
+    // initiated, so the installer process already exists when we quit.
+    const err = await shell.openPath(target)
     if (err) return { ok: false, error: err }
-    // Give the installer a beat to spawn, then quit so it can overwrite our files.
-    setTimeout(() => app.quit(), INSTALLER_HANDOFF_MS)
+    // Quit on the next tick so this IPC response reaches the renderer first; the
+    // launched installer is independent of our process and survives the quit.
+    setImmediate(() => app.quit())
     return { ok: true }
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) }
diff --git a/src/main/windowState.ts b/src/main/windowState.ts
new file mode 100644
index 0000000..9af0540
--- /dev/null
+++ b/src/main/windowState.ts
@@ -0,0 +1,82 @@
+import { app, screen, type BrowserWindow, type Rectangle } from 'electron'
+import { join } from 'path'
+import { readFileSync, writeFileSync } from 'fs'
+import { logger } from './logger'
+
+/**
+ * Persist and restore the main window's size / position / maximized state across
+ * launches (W2 / UX19) — Windows apps are expected to reopen where you left them.
+ * Stored as one small JSON object in `<userData>/window-state.json`; a disconnected
+ * monitor is handled by a visibility check so the window can never restore off-screen.
+ */
+
+interface WindowState {
+  bounds: Rectangle
+  maximized: boolean
+}
+
+// Matches the createWindow() defaults; used on first run and when a saved position
+// is no longer on any connected display.
+const DEFAULT_SIZE = { width: 920, height: 700 }
+
+function stateFile(): string {
+  return join(app.getPath('userData'), 'window-state.json')
+}
+
+function readState(): WindowState | null {
+  try {
+    const s = JSON.parse(readFileSync(stateFile(), 'utf8')) as Partial<WindowState>
+    if (s?.bounds && typeof s.bounds.width === 'number' && typeof s.bounds.height === 'number') {
+      return { bounds: s.bounds as Rectangle, maximized: !!s.maximized }
+    }
+  } catch {
+    /* first run or corrupt — fall back to defaults */
+  }
+  return null
+}
+
+/** True when `b` overlaps the work area of some connected display (i.e. is reachable). */
+function isOnSomeDisplay(b: Rectangle): boolean {
+  return screen.getAllDisplays().some((d) => {
+    const wa = d.workArea
+    return (
+      b.x < wa.x + wa.width &&
+      b.x + b.width > wa.x &&
+      b.y < wa.y + wa.height &&
+      b.y + b.height > wa.y
+    )
+  })
+}
+
+/**
+ * The bounds + maximized flag to open the window with. Returns just a size (Electron
+ * then centers it) when there's no usable saved position — first run, or the saved
+ * monitor is gone.
+ */
+export function initialWindowState(): {
+  width: number
+  height: number
+  x?: number
+  y?: number
+  maximized: boolean
+} {
+  const saved = readState()
+  if (saved && isOnSomeDisplay(saved.bounds)) {
+    return { ...saved.bounds, maximized: saved.maximized }
+  }
+  return { ...DEFAULT_SIZE, maximized: saved?.maximized ?? false }
+}
+
+/**
+ * Persist the window's current *normal* bounds (un-maximized) + maximized flag.
+ * Best-effort; a write failure is logged, never thrown. Callers should debounce.
+ */
+export function saveWindowState(win: BrowserWindow): void {
+  if (win.isDestroyed() || win.isMinimized()) return
+  try {
+    const state: WindowState = { bounds: win.getNormalBounds(), maximized: win.isMaximized() }
+    writeFileSync(stateFile(), JSON.stringify(state))
+  } catch (e) {
+    logger.warn('failed to save window state', e)
+  }
+}
diff --git a/src/main/ytdlp.ts b/src/main/ytdlp.ts
index ffec8fa..8b02919 100644
--- a/src/main/ytdlp.ts
+++ b/src/main/ytdlp.ts
@@ -1,7 +1,9 @@
-import { execFile } from 'child_process'
 import { existsSync, mkdirSync, copyFileSync } from 'fs'
 import { dirname } from 'path'
-import { getYtdlpPath, getBundledYtdlpPath } from './binaries'
+import { getYtdlpPath, getBundledYtdlpPath, YTDLP_MISSING_MSG } from './binaries'
+import { execFileAsync } from './lib/exec'
+import { cleanError } from './log'
+import { VERSION_TIMEOUT_MS, YTDLP_UPDATE_TIMEOUT_MS } from './constants'
 import { getSettings, setSettings } from './settings'
 import { shouldAutoCheckYtdlp } from './ytdlpPolicy'
 import {
@@ -32,32 +34,24 @@ export function ensureManagedYtdlp(): void {
   }
 }
 
-/**
- * Step-1 spike: spawn the bundled yt-dlp and read back `--version`.
- * Proves the main-process → bundled-binary → IPC path end to end.
- */
-export function getYtdlpVersion(): Promise<YtdlpVersionResult> {
+/** Spawn the bundled yt-dlp and read back its `--version` for the Settings panel. */
+export async function getYtdlpVersion(): Promise<YtdlpVersionResult> {
   const ytdlpPath = getYtdlpPath()
 
   if (!existsSync(ytdlpPath)) {
-    return Promise.resolve({
-      ok: false,
-      error: `yt-dlp.exe not found at ${ytdlpPath}\nDownload it into resources/bin/ (see the README there).`
-    })
+    return { ok: false, error: YTDLP_MISSING_MSG }
   }
 
-  return new Promise((resolve) => {
-    execFile(ytdlpPath, ['--version'], { windowsHide: true, timeout: 15_000 }, (err, stdout, stderr) => {
-      if (err) {
-        const msg = (err as { killed?: boolean }).killed
-          ? 'Timed out running yt-dlp.'
-          : (stderr || err.message).trim()
-        resolve({ ok: false, error: msg })
-        return
-      }
-      resolve({ ok: true, version: stdout.trim() })
-    })
-  })
+  const r = await execFileAsync(ytdlpPath, ['--version'], { timeout: VERSION_TIMEOUT_MS })
+  if (!r.ok) {
+    // Run stderr through the shared cleaner so yt-dlp's noisy output collapses to
+    // its trailing error line, consistent with download/probe/indexer (CC6).
+    const msg = r.timedOut
+      ? 'Timed out running yt-dlp.'
+      : cleanError(r.stderr) || r.error?.message || ''
+    return { ok: false, error: msg }
+  }
+  return { ok: true, version: r.stdout.trim() }
 }
 
 /**
@@ -66,13 +60,13 @@ export function getYtdlpVersion(): Promise<YtdlpVersionResult> {
  * yt-dlp.exe lives in, which holds for both the dev resources/bin checkout and
  * a per-user install; it would fail under a locked-down system install.
  */
-export function updateYtdlp(channel: YtdlpUpdateChannel): Promise<YtdlpUpdateResult> {
+export async function updateYtdlp(channel: YtdlpUpdateChannel): Promise<YtdlpUpdateResult> {
   // Validate against the channel allowlist BEFORE the value reaches `--update-to`.
   // That flag also accepts `OWNER/REPO@TAG`, which would download and install an
   // arbitrary binary over yt-dlp.exe — so an unrecognised value (e.g. forged by a
   // compromised renderer over IPC) must never be forwarded. (audit F1)
   if (!isYtdlpUpdateChannel(channel)) {
-    return Promise.resolve({ ok: false, error: 'Unsupported update channel.' })
+    return { ok: false, error: 'Unsupported update channel.' }
   }
 
   // Self-heal: restore the managed copy from the bundled seed before updating, so
@@ -81,29 +75,19 @@ export function updateYtdlp(channel: YtdlpUpdateChannel): Promise<YtdlpUpdateRes
   const ytdlpPath = getYtdlpPath()
 
   if (!existsSync(ytdlpPath)) {
-    return Promise.resolve({
-      ok: false,
-      error: `yt-dlp.exe not found at ${ytdlpPath}\nDownload it into resources/bin/ (see the README there).`
-    })
+    return { ok: false, error: YTDLP_MISSING_MSG }
   }
 
-  return new Promise((resolve) => {
-    execFile(
-      ytdlpPath,
-      ['--update-to', channel],
-      { windowsHide: true, timeout: 60_000 },
-      (err, stdout, stderr) => {
-        if (err) {
-          const msg = (err as { killed?: boolean }).killed
-            ? 'Timed out updating yt-dlp.'
-            : (stderr || err.message).trim()
-          resolve({ ok: false, error: msg })
-          return
-        }
-        resolve({ ok: true, output: stdout.trim() })
-      }
-    )
+  const r = await execFileAsync(ytdlpPath, ['--update-to', channel], {
+    timeout: YTDLP_UPDATE_TIMEOUT_MS
   })
+  if (!r.ok) {
+    const msg = r.timedOut
+      ? 'Timed out updating yt-dlp.'
+      : cleanError(r.stderr) || r.error?.message || ''
+    return { ok: false, error: msg }
+  }
+  return { ok: true, output: r.stdout.trim() }
 }
 
 /**
diff --git a/src/main/ytdlpPolicy.ts b/src/main/ytdlpPolicy.ts
index a2d54f5..b178dbc 100644
--- a/src/main/ytdlpPolicy.ts
+++ b/src/main/ytdlpPolicy.ts
@@ -21,5 +21,10 @@ export function shouldAutoCheckYtdlp(
 ): boolean {
   if (!enabled) return false
   if (!lastCheck) return true
+  // A backward system-clock correction can leave `lastCheck` in the "future"
+  // relative to `now`, making `now - lastCheck` negative so the daily check would
+  // never come due again. Treat a future timestamp as skewed/bogus and run the
+  // check rather than waiting out a negative interval (R9).
+  if (lastCheck > now) return true
   return now - lastCheck >= intervalMs
 }
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 7999e4a..87093df 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -31,7 +31,8 @@ import {
   type ScheduledSyncStatus,
   type TerminalEvent,
   type TerminalRunResult,
-  type TaskbarProgress
+  type TaskbarProgress,
+  type PersistedQueueItem
 } from '@shared/ipc'
 
 // The surface exposed to the renderer. Keep this thin: it only forwards to IPC.
@@ -57,8 +58,7 @@ const api = {
     return () => ipcRenderer.removeListener(IpcChannels.appUpdateProgress, listener)
   },
 
-  getYtdlpVersion: (): Promise<YtdlpVersionResult> =>
-    ipcRenderer.invoke(IpcChannels.ytdlpVersion),
+  getYtdlpVersion: (): Promise<YtdlpVersionResult> => ipcRenderer.invoke(IpcChannels.ytdlpVersion),
 
   /** Versions of the bundled ffmpeg + ffprobe (display-only; not auto-updated). */
   getFfmpegVersions: (): Promise<FfmpegVersionResult> =>
@@ -69,23 +69,26 @@ const api = {
   startDownload: (opts: StartDownloadOptions): Promise<StartDownloadResult> =>
     ipcRenderer.invoke(IpcChannels.downloadStart, opts),
 
-  cancelDownload: (id: string): Promise<void> =>
-    ipcRenderer.invoke(IpcChannels.downloadCancel, id),
+  cancelDownload: (id: string): Promise<void> => ipcRenderer.invoke(IpcChannels.downloadCancel, id),
 
-  pauseDownload: (id: string): Promise<void> =>
-    ipcRenderer.invoke(IpcChannels.downloadPause, id),
+  pauseDownload: (id: string): Promise<void> => ipcRenderer.invoke(IpcChannels.downloadPause, id),
 
-  getDefaultFolder: (): Promise<string> => ipcRenderer.invoke(IpcChannels.defaultFolder),
-
-  chooseFolder: (): Promise<string | null> => ipcRenderer.invoke(IpcChannels.chooseFolder),
+  chooseFolder: (current?: string): Promise<string | null> =>
+    ipcRenderer.invoke(IpcChannels.chooseFolder, current),
 
   openPath: (path: string): Promise<string> => ipcRenderer.invoke(IpcChannels.openPath, path),
 
-  showInFolder: (path: string): Promise<void> =>
+  openUrl: (url: string): Promise<void> => ipcRenderer.invoke(IpcChannels.openUrl, url),
+
+  showInFolder: (path: string): Promise<string> =>
     ipcRenderer.invoke(IpcChannels.showInFolder, path),
 
   readClipboard: (): Promise<string> => ipcRenderer.invoke(IpcChannels.clipboardRead),
 
+  /** Forward a renderer-side failure to the main diagnostic log (CC8). Fire-and-forget. */
+  logError: (op: string, detail: string): void =>
+    ipcRenderer.send(IpcChannels.logWrite, op, detail),
+
   getSettings: (): Promise<Settings> => ipcRenderer.invoke(IpcChannels.settingsGet),
 
   setSettings: (partial: Partial<Settings>): Promise<Settings> =>
@@ -138,6 +141,13 @@ const api = {
 
   clearErrorLog: (): Promise<ErrorLogEntry[]> => ipcRenderer.invoke(IpcChannels.errorLogClear),
 
+  /** Load the persisted download queue on launch (M4). */
+  listQueue: (): Promise<PersistedQueueItem[]> => ipcRenderer.invoke(IpcChannels.queueList),
+
+  /** Mirror the renderer's durable queue items to disk so they survive a quit (M4). */
+  saveQueue: (items: PersistedQueueItem[]): Promise<void> =>
+    ipcRenderer.invoke(IpcChannels.queueSave, items),
+
   /** Opens a save dialog and writes settings + templates to the chosen JSON file. */
   exportBackup: (): Promise<BackupExportResult> => ipcRenderer.invoke(IpcChannels.backupExport),
 
@@ -184,22 +194,23 @@ const api = {
   reindexSource: (id: string): Promise<IndexSourceResult> =>
     ipcRenderer.invoke(IpcChannels.sourceReindex, id),
 
-  removeSource: (id: string): Promise<Source[]> =>
-    ipcRenderer.invoke(IpcChannels.sourceRemove, id),
+  removeSource: (id: string): Promise<Source[]> => ipcRenderer.invoke(IpcChannels.sourceRemove, id),
 
   listSourceItems: (sourceId: string): Promise<MediaItem[]> =>
     ipcRenderer.invoke(IpcChannels.sourceItems, sourceId),
 
-  /** Persist that a media item has finished downloading (drives incremental sync). */
-  markSourceItemDownloaded: (id: string, filePath?: string): Promise<MediaItem[]> =>
+  /** Persist that a media item has finished downloading (drives incremental sync).
+   *  Named to match the main handler `setMediaItemDownloaded` (L92). */
+  setMediaItemDownloaded: (id: string, filePath?: string): Promise<MediaItem[]> =>
     ipcRenderer.invoke(IpcChannels.sourceItemDownloaded, id, filePath),
 
   /** Toggle whether a source is watched for new uploads. */
   setSourceWatched: (id: string, watched: boolean): Promise<Source[]> =>
     ipcRenderer.invoke(IpcChannels.sourceSetWatched, id, watched),
 
-  /** Re-index all watched sources; resolves with the videos found new. */
-  syncSources: (): Promise<SyncResult> => ipcRenderer.invoke(IpcChannels.sourcesSync),
+  /** Re-index all watched sources; resolves with the videos found new. Named to
+   *  match the main function `syncWatchedSources` (L92). */
+  syncWatchedSources: (): Promise<SyncResult> => ipcRenderer.invoke(IpcChannels.sourcesSync),
 
   /** Read / write the Windows daily-sync scheduled task. */
   getScheduledSync: (): Promise<ScheduledSyncStatus> =>
@@ -220,8 +231,7 @@ const api = {
   runTerminal: (id: string, args: string): Promise<TerminalRunResult> =>
     ipcRenderer.invoke(IpcChannels.terminalRun, id, args),
 
-  cancelTerminal: (id: string): Promise<void> =>
-    ipcRenderer.invoke(IpcChannels.terminalCancel, id),
+  cancelTerminal: (id: string): Promise<void> => ipcRenderer.invoke(IpcChannels.terminalCancel, id),
 
   /** Subscribe to live terminal output. Returns an unsubscribe function. */
   onTerminalOutput: (cb: (ev: TerminalEvent) => void): (() => void) => {
@@ -230,9 +240,13 @@ const api = {
     return () => ipcRenderer.removeListener(IpcChannels.terminalOutput, listener)
   },
 
-  /** Reflect overall queue progress on the Windows taskbar (fire-and-forget). */
-  setTaskbarProgress: (p: TaskbarProgress): void =>
-    ipcRenderer.send(IpcChannels.taskbarProgress, p)
+  /** Reflect overall queue progress on the Windows taskbar. */
+  setTaskbarProgress: (p: TaskbarProgress): Promise<void> =>
+    ipcRenderer.invoke(IpcChannels.taskbarProgress, p),
+
+  /** Open a YouTube WebView to automatically extract a PO token (Phase P). */
+  mintPoToken: (): Promise<string | null> =>
+    ipcRenderer.invoke(IpcChannels.youtubePoTokenMint) as Promise<string | null>
 }
 
 export type Api = typeof api
@@ -248,11 +262,19 @@ if (process.contextIsolated) {
     contextBridge.exposeInMainWorld('electron', electron)
     contextBridge.exposeInMainWorld('api', api)
   } catch (error) {
-    console.error(error)
+    // M30: a broken bridge causes the renderer to silently run in preview/mock mode.
+    // Notify the main process so it can show a hard error dialog — without this the
+    // failure is completely invisible to the user.
+    console.error('[AeroFetch preload] contextBridge failed:', error)
+    try {
+      ipcRenderer.send(IpcChannels.preloadBridgeFailure, String(error))
+    } catch {
+      /* if IPC itself is broken there is nothing more we can do */
+    }
   }
 } else {
-  // @ts-ignore (defined in index.d.ts)
+  // @ts-ignore window.electron is declared in index.d.ts
   window.electron = electron
-  // @ts-ignore (defined in index.d.ts)
+  // @ts-ignore window.api is declared in index.d.ts
   window.api = api
 }
diff --git a/src/renderer/src/App.tsx b/src/renderer/src/App.tsx
index 7775d38..b20bd3d 100644
--- a/src/renderer/src/App.tsx
+++ b/src/renderer/src/App.tsx
@@ -1,18 +1,47 @@
-import { useState, useEffect } from 'react'
+import { useState, useEffect, useMemo, useRef, lazy, Suspense } from 'react'
 import { FluentProvider, makeStyles, tokens } from '@fluentui/react-components'
-import { Sidebar, type TabValue } from './components/Sidebar'
+import { Sidebar } from './components/Sidebar'
 import { DownloadsView } from './components/DownloadsView'
-import { LibraryView } from './components/LibraryView'
-import { HistoryView } from './components/HistoryView'
-import { TerminalView } from './components/TerminalView'
-import { SettingsView } from './components/SettingsView'
 import { Onboarding } from './components/Onboarding'
 import { CommandPalette, type PaletteAction } from './components/CommandPalette'
+import { LiveRegion } from './components/LiveRegion'
+import { Toaster } from './components/ui/Toaster'
 import { getTheme, pageBackground } from './theme'
+import { SPACE } from './components/ui/tokens'
 import { useSettings } from './store/settings'
+import { useNav } from './store/nav'
 import { useDownloads } from './store/downloads'
-import { summarizeQueue } from './store/queueStats'
+// Eagerly load the sources store for its startup side-effects (load persisted
+// sources + the watched-source / scheduled `--sync` kickoff) and its cross-store
+// subscription (coordinator's downloadCompleted → markDownloaded). Before C2 this
+// was guaranteed by downloads.ts importing it; now that the cycle is broken, App
+// owns the eager load so it survives the views becoming lazy-loaded (PERF8).
+import './store/sources'
+import { queueSummaryOf } from './store/queueStats'
 import { useResolvedDark } from './store/systemTheme'
+import { logError } from './reportError'
+
+// Code-split the non-default tabs (PERF8): Downloads is the launch tab and stays
+// eager, but Library/History/Terminal/Settings load their chunks on first visit so
+// they (and their slice of Fluent) aren't in the initial bundle. The stores these
+// views use are imported eagerly above (`useDownloads` + `./store/sources`, and
+// downloads → history), so lazy-loading the *view* never delays store startup.
+const LibraryView = lazy(() =>
+  import('./components/LibraryView').then((m) => ({ default: m.LibraryView }))
+)
+const HistoryView = lazy(() =>
+  import('./components/HistoryView').then((m) => ({ default: m.HistoryView }))
+)
+const TerminalView = lazy(() =>
+  import('./components/TerminalView').then((m) => ({ default: m.TerminalView }))
+)
+const SettingsView = lazy(() =>
+  import('./components/SettingsView').then((m) => ({ default: m.SettingsView }))
+)
+
+// How often to check whether a scheduled ('saved' + due) download should promote
+// to the queue. 15s is plenty for the minute-granularity times the picker offers.
+const SCHEDULE_TICK_MS = 15_000
 
 const useStyles = makeStyles({
   provider: {
@@ -27,7 +56,8 @@ const useStyles = makeStyles({
     flexGrow: 1,
     minWidth: 0,
     overflowY: 'auto',
-    padding: '24px 28px'
+    // Symmetric page padding (UI4): the old 28px horizontal appeared nowhere else.
+    padding: SPACE.page
   }
 })
 
@@ -36,16 +66,30 @@ function App(): React.JSX.Element {
   const theme = useSettings((s) => s.theme)
   const accentColor = useSettings((s) => s.accentColor)
   const updateSettings = useSettings((s) => s.update)
+  const showTerminal = useSettings((s) => s.customCommandEnabled)
   const isDark = useResolvedDark()
-  const [tab, setTab] = useState<TabValue>('downloads')
+  const tab = useNav((s) => s.tab)
+  const setTab = useNav((s) => s.setTab)
+  // Active-download count for the sidebar Downloads badge (UX9/UI25), so a run in
+  // progress is visible from any tab. A number selector only re-renders when the
+  // count actually changes -- not on every progress tick.
+  const activeCount = useDownloads(
+    (s) => s.items.filter((i) => i.status === 'downloading' || i.status === 'queued').length
+  )
   const [paletteOpen, setPaletteOpen] = useState(false)
+  // Track the element that was focused before the palette opened so we can restore it on close.
+  const prePaletteRef = useRef<Element | null>(null)
 
-  // Ctrl/Cmd+K toggles the command palette.
+  // Ctrl+K: command palette. Ctrl+,: Settings. (W8/W9)
   useEffect(() => {
     function onKey(e: KeyboardEvent): void {
       if ((e.ctrlKey || e.metaKey) && (e.key === 'k' || e.key === 'K')) {
         e.preventDefault()
+        prePaletteRef.current = document.activeElement
         setPaletteOpen((o) => !o)
+      } else if (e.ctrlKey && e.key === ',') {
+        e.preventDefault()
+        setTab('settings')
       }
     }
     window.addEventListener('keydown', onKey)
@@ -54,56 +98,122 @@ function App(): React.JSX.Element {
 
   // Mirror overall queue progress onto the Windows taskbar. Subscribe to the store
   // directly (not via a selector) so taskbar updates don't re-render the app.
+  // Compare against the last IPC call and skip when nothing changed -- the store
+  // fires on every progress tick and this avoids one IPC roundtrip per tick (L25).
   useEffect(() => {
+    let lastFraction = -1
+    let lastMode = ''
+    let lastBadge = -1
     function push(items: ReturnType<typeof useDownloads.getState>['items']): void {
-      const s = summarizeQueue(items)
+      const s = queueSummaryOf(items)
       const mode = s.active ? (s.failed > 0 ? 'error' : 'normal') : 'none'
-      window.api?.setTaskbarProgress?.({ fraction: s.progress, mode })
+      if (s.progress === lastFraction && mode === lastMode && s.downloading === lastBadge) return
+      lastFraction = s.progress
+      lastMode = mode
+      lastBadge = s.downloading
+      void window.api?.setTaskbarProgress?.({
+        fraction: s.progress,
+        mode,
+        badgeCount: s.downloading
+      })
     }
     push(useDownloads.getState().items)
     return useDownloads.subscribe((st) => push(st.items))
   }, [])
 
-  const paletteActions: PaletteAction[] = [
-    { id: 'go-downloads', label: 'Go to Downloads', hint: 'Navigate', run: () => setTab('downloads') },
-    { id: 'go-library', label: 'Go to Library', hint: 'Navigate', run: () => setTab('library') },
-    { id: 'go-history', label: 'Go to History', hint: 'Navigate', run: () => setTab('history') },
-    { id: 'go-terminal', label: 'Go to Terminal', hint: 'Navigate', run: () => setTab('terminal') },
-    { id: 'go-settings', label: 'Go to Settings', hint: 'Navigate', run: () => setTab('settings') },
-    {
-      id: 'new-download',
-      label: 'New download',
-      hint: 'Focus URL',
-      run: () => {
-        setTab('downloads')
-        // Wait for the download bar to mount after the tab switch, then focus.
-        setTimeout(() => document.getElementById('aerofetch-url')?.focus(), 60)
+  // Rehydrate the persisted download queue on launch (M4) so saved/scheduled and
+  // other pending items return from the previous session.
+  useEffect(() => {
+    useDownloads.getState().hydrate()
+  }, [])
+
+  // UX16: focus the URL field on launch so the user can paste + type immediately
+  // (Downloads is the default tab). Double-rAF waits for paint + the DownloadBar to
+  // register its focuser (L118), matching the command palette's "New download" focus.
+  useEffect(() => {
+    if (useNav.getState().tab !== 'downloads') return
+    requestAnimationFrame(() => requestAnimationFrame(() => useNav.getState().focusUrlField()))
+  }, [])
+
+  // Promote scheduled ('saved' + a due scheduledFor) items when their time arrives.
+  // The queue is persisted (M4), so a scheduled item survives a quit and fires on the
+  // next launch once its time has passed. A 15s tick is plenty for minute-granularity
+  // times. Lives here (not at the downloads store's module load) so importing the store
+  // in tests/preview doesn't start a stray timer, and the interval is cleared cleanly
+  // on unmount (L1).
+  useEffect(() => {
+    const tick = setInterval(() => {
+      const st = useDownloads.getState()
+      const now = Date.now()
+      if (
+        st.items.some(
+          (i) => i.status === 'saved' && i.scheduledFor != null && i.scheduledFor <= now
+        )
+      ) {
+        st.promoteDueScheduled()
       }
-    },
-    {
-      id: 'toggle-theme',
-      label: isDark ? 'Switch to light theme' : 'Switch to dark theme',
-      hint: 'Appearance',
-      run: () => updateSettings({ theme: isDark ? 'light' : 'dark' })
-    }
-  ]
+    }, SCHEDULE_TICK_MS)
+    return () => clearInterval(tick)
+  }, [])
+
+  // Memoized so CommandPalette sees a stable array reference between renders --
+  // only rebuilds when the theme label needs to change (L32).
+  const paletteActions = useMemo<PaletteAction[]>(
+    () => [
+      {
+        id: 'go-downloads',
+        label: 'Go to Downloads',
+        hint: 'Navigate',
+        run: () => setTab('downloads')
+      },
+      { id: 'go-library', label: 'Go to Library', hint: 'Navigate', run: () => setTab('library') },
+      { id: 'go-history', label: 'Go to History', hint: 'Navigate', run: () => setTab('history') },
+      {
+        id: 'go-terminal',
+        label: 'Go to Terminal',
+        hint: 'Navigate',
+        run: () => setTab('terminal')
+      },
+      {
+        id: 'go-settings',
+        label: 'Go to Settings',
+        // Surface the real shortcut here so the palette doubles as shortcut
+        // discovery (UX21).
+        hint: 'Ctrl ,',
+        run: () => setTab('settings')
+      },
+      {
+        id: 'new-download',
+        label: 'New download',
+        hint: 'Focus URL',
+        run: () => {
+          setTab('downloads')
+          // Double-rAF waits for React's re-render + paint (so the DownloadBar has
+          // mounted and registered its focuser) before requesting focus (L118).
+          requestAnimationFrame(() =>
+            requestAnimationFrame(() => useNav.getState().focusUrlField())
+          )
+        }
+      },
+      {
+        id: 'toggle-theme',
+        label: isDark ? 'Switch to light theme' : 'Switch to dark theme',
+        hint: 'Appearance',
+        run: () => updateSettings({ theme: isDark ? 'light' : 'dark' })
+      }
+    ],
+    [isDark, setTab, updateSettings]
+  )
 
   // AeroFetch's own version, shown in the sidebar. Loaded once over IPC.
   const [version, setVersion] = useState('')
   useEffect(() => {
-    window.api?.getAppVersion?.().then(setVersion).catch(() => {})
+    window.api?.getAppVersion?.().then(setVersion).catch(logError('getAppVersion'))
   }, [])
 
-  // Sidebar collapse, persisted across launches in localStorage.
-  const [collapsed, setCollapsed] = useState(
-    () => localStorage.getItem('aerofetch.sidebarCollapsed') === '1'
-  )
+  const collapsed = useSettings((s) => s.sidebarCollapsed)
   function toggleCollapsed(): void {
-    setCollapsed((c) => {
-      const next = !c
-      localStorage.setItem('aerofetch.sidebarCollapsed', next ? '1' : '0')
-      return next
-    })
+    updateSettings({ sidebarCollapsed: !collapsed })
   }
   // Gate on `loaded` so a returning user's real settings never get clobbered
   // by a one-frame flash of the (default-false) onboarding state.
@@ -136,21 +246,34 @@ function App(): React.JSX.Element {
               version={version}
               collapsed={collapsed}
               onToggleCollapsed={toggleCollapsed}
+              showTerminal={showTerminal}
+              downloadCount={activeCount}
             />
 
             <main className={styles.content}>
               {tab === 'downloads' && <DownloadsView />}
-              {tab === 'library' && <LibraryView />}
-              {tab === 'history' && <HistoryView />}
-              {tab === 'terminal' && <TerminalView />}
-              {tab === 'settings' && <SettingsView />}
+              <Suspense fallback={null}>
+                {tab === 'library' && <LibraryView />}
+                {tab === 'history' && <HistoryView />}
+                {tab === 'terminal' && <TerminalView />}
+                {tab === 'settings' && <SettingsView />}
+              </Suspense>
             </main>
 
             {paletteOpen && (
-              <CommandPalette actions={paletteActions} onClose={() => setPaletteOpen(false)} />
+              <CommandPalette
+                actions={paletteActions}
+                onClose={() => {
+                  setPaletteOpen(false)
+                  const el = prePaletteRef.current
+                  if (el instanceof HTMLElement) requestAnimationFrame(() => el.focus())
+                }}
+              />
             )}
           </>
         )}
+        <LiveRegion />
+        <Toaster />
       </div>
     </FluentProvider>
   )
diff --git a/src/renderer/src/assets/base.css b/src/renderer/src/assets/base.css
index c5f9c9d..a5d5ed9 100644
--- a/src/renderer/src/assets/base.css
+++ b/src/renderer/src/assets/base.css
@@ -1,11 +1,57 @@
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+:focus-visible {
+  outline: 2px solid var(--colorBrandStroke1, #0078d4);
+  outline-offset: 2px;
+}
+
+/*
+ * Zero the UA heading margin (UI33). Titles are rendered as real headings
+ * (h1/h2) for Narrator heading-navigation, but they carry Fluent's typography
+ * classes for their visual ramp (font size/weight/line-height); those classes
+ * out-specify this element selector, so only the browser's default heading
+ * margin needs removing to keep the layout identical to the former span titles.
+ */
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  margin: 0;
+}
+
 html,
 body {
   margin: 0;
   padding: 0;
   height: 100%;
   overflow: hidden;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
 }
 
 #root {
   height: 100vh;
 }
+
+/*
+ * One motion policy (UI26): honor the OS "reduce motion" preference everywhere.
+ * The app's transitions are subtle (see MOTION in components/ui/tokens.ts), but a
+ * user who asks for less motion gets none — this near-instant override covers any
+ * current or future transition/animation without each component opting in.
+ */
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    transition-duration: 0.01ms !important;
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    scroll-behavior: auto !important;
+  }
+}
diff --git a/src/renderer/src/components/CommandPalette.tsx b/src/renderer/src/components/CommandPalette.tsx
index ac4ecae..706b7b4 100644
--- a/src/renderer/src/components/CommandPalette.tsx
+++ b/src/renderer/src/components/CommandPalette.tsx
@@ -1,5 +1,7 @@
 import { useEffect, useRef, useState } from 'react'
 import { makeStyles, mergeClasses, tokens, shorthands } from '@fluentui/react-components'
+import { useFocusStyles } from './ui/focusRing'
+import { Z, SCRIM, ELEVATION, RADIUS } from './ui/tokens'
 
 export interface PaletteAction {
   id: string
@@ -10,32 +12,31 @@ export interface PaletteAction {
 }
 
 const useStyles = makeStyles({
-  // A plain fixed overlay — NOT a Fluent Dialog, since this app avoids Fluent's
+  // A plain fixed overlay -- NOT a Fluent Dialog, since this app avoids Fluent's
   // portal-based overlays (GPU/driver blank-overlay issue, see Select.tsx).
   backdrop: {
     position: 'fixed',
     inset: 0,
-    zIndex: 1000,
+    zIndex: Z.overlay,
     display: 'flex',
     justifyContent: 'center',
     alignItems: 'flex-start',
     paddingTop: '14vh',
-    backgroundColor: 'rgba(0,0,0,0.32)'
+    backgroundColor: SCRIM
   },
   panel: {
     width: 'min(560px, 92vw)',
     display: 'flex',
     flexDirection: 'column',
     backgroundColor: tokens.colorNeutralBackground1,
-    ...shorthands.borderRadius(tokens.borderRadiusXLarge),
+    ...shorthands.borderRadius(RADIUS.card),
     border: `1px solid ${tokens.colorNeutralStroke2}`,
-    boxShadow: tokens.shadow28,
+    boxShadow: ELEVATION.overlay,
     overflow: 'hidden'
   },
   input: {
     appearance: 'none',
     border: 'none',
-    outline: 'none',
     padding: '14px 16px',
     fontSize: tokens.fontSizeBase400,
     fontFamily: tokens.fontFamilyBase,
@@ -91,11 +92,16 @@ export function CommandPalette({
   onClose: () => void
 }): React.JSX.Element {
   const styles = useStyles()
+  const focus = useFocusStyles()
   const [q, setQ] = useState('')
   const [sel, setSel] = useState(0)
   const inputRef = useRef<HTMLInputElement>(null)
+  const listRef = useRef<HTMLDivElement>(null)
 
   const filtered = actions.filter((a) => a.label.toLowerCase().includes(q.trim().toLowerCase()))
+  const listId = 'cmdpalette-list'
+  const optionId = (id: string): string => `cmdpalette-option-${id}`
+  const activeId = filtered[sel] ? optionId(filtered[sel].id) : undefined
 
   useEffect(() => {
     inputRef.current?.focus()
@@ -103,6 +109,10 @@ export function CommandPalette({
   useEffect(() => {
     setSel(0)
   }, [q])
+  useEffect(() => {
+    const row = listRef.current?.querySelector<HTMLElement>(`[data-sel="true"]`)
+    row?.scrollIntoView({ block: 'nearest' })
+  }, [sel])
 
   function onKeyDown(e: React.KeyboardEvent): void {
     if (e.key === 'Escape') {
@@ -133,21 +143,33 @@ export function CommandPalette({
       >
         <input
           ref={inputRef}
-          className={styles.input}
+          className={mergeClasses(styles.input, focus.focusRing)}
           value={q}
           onChange={(e) => setQ(e.target.value)}
           onKeyDown={onKeyDown}
           placeholder="Type a command…"
+          role="combobox"
+          aria-expanded={filtered.length > 0}
+          aria-controls={listId}
+          aria-activedescendant={activeId}
+          aria-autocomplete="list"
           aria-label="Command palette search"
         />
-        <div className={styles.list}>
+        <div className={styles.list} ref={listRef} id={listId} role="listbox" aria-label="Commands">
           {filtered.length === 0 ? (
             <div className={styles.empty}>No matching commands</div>
           ) : (
             filtered.map((a, i) => (
-              <button
+              // A non-focusable option: focus stays on the combobox input and the
+              // active row is announced via aria-activedescendant (UI27), the
+              // standard combobox+listbox pattern. onMouseEnter keeps the pointer
+              // and keyboard highlight unified on one `sel` state.
+              <div
                 key={a.id}
-                type="button"
+                id={optionId(a.id)}
+                role="option"
+                aria-selected={i === sel}
+                data-sel={i === sel ? 'true' : undefined}
                 className={mergeClasses(styles.item, i === sel && styles.itemActive)}
                 onClick={() => {
                   a.run()
@@ -157,7 +179,7 @@ export function CommandPalette({
               >
                 <span>{a.label}</span>
                 {a.hint && <span className={styles.itemHint}>{a.hint}</span>}
-              </button>
+              </div>
             ))
           )}
         </div>
diff --git a/src/renderer/src/components/DownloadBar.tsx b/src/renderer/src/components/DownloadBar.tsx
index 5932909..8488f1e 100644
--- a/src/renderer/src/components/DownloadBar.tsx
+++ b/src/renderer/src/components/DownloadBar.tsx
@@ -1,4 +1,3 @@
-import { useState, useEffect, useRef } from 'react'
 import {
   Input,
   Textarea,
@@ -8,10 +7,7 @@ import {
   Spinner,
   Text,
   Caption1,
-  makeStyles,
-  mergeClasses,
-  tokens,
-  shorthands
+  mergeClasses
 } from '@fluentui/react-components'
 import {
   ArrowDownloadRegular,
@@ -20,621 +16,176 @@ import {
   VideoClipRegular,
   MusicNote2Regular,
   ErrorCircleRegular,
-  LinkRegular,
+  LibraryRegular,
   DismissRegular,
-  AppsListRegular,
   CutRegular,
   CalendarClockRegular,
-  WarningRegular
+  WarningRegular,
+  SettingsRegular,
+  WindowConsoleRegular
 } from '@fluentui/react-icons'
-import type { MediaInfo, FormatOption, PlaylistInfo } from '@shared/ipc'
-import { useDownloads, QUALITY_OPTIONS, type MediaKind } from '../store/downloads'
-import { sameVideo } from '../store/queueStats'
-import { useSettings } from '../store/settings'
+import { useEffect, useRef } from 'react'
+import { type MediaKind } from '../store/downloads'
+import { useNav } from '../store/nav'
+import { QUALITY_OPTIONS } from '../qualityOptions'
 import { Select } from './Select'
 import { Hint } from './Hint'
-import { useClipboardLink, looksLikeUrl } from '../useClipboardLink'
-
-/** First http(s) URL in a blob of dropped text (one per line; '#' comments skipped). */
-function firstUrl(text: string): string | null {
-  for (const raw of text.split(/\r?\n/)) {
-    const line = raw.trim()
-    if (!line || line.startsWith('#')) continue
-    if (looksLikeUrl(line)) return line
-  }
-  return null
-}
-
-/** Pull the URL= target out of a dropped Windows .url Internet Shortcut file. */
-function parseUrlFile(content: string): string | null {
-  const m = /^\s*URL\s*=\s*(\S+)/im.exec(content)
-  const url = m?.[1]?.trim()
-  return url && looksLikeUrl(url) ? url : null
-}
-
-const useStyles = makeStyles({
-  root: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '12px',
-    padding: '16px',
-    backgroundColor: tokens.colorNeutralBackground1,
-    ...shorthands.borderRadius(tokens.borderRadiusXLarge),
-    boxShadow: tokens.shadow4
-  },
-  // Highlight while a link / .url file is dragged over the card.
-  rootDragging: {
-    outline: `2px dashed ${tokens.colorBrandStroke1}`,
-    outlineOffset: '-2px'
-  },
-  urlRow: {
-    display: 'flex',
-    gap: '8px'
-  },
-  suggestion: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px',
-    padding: '8px 8px 8px 12px',
-    backgroundColor: tokens.colorBrandBackground2,
-    color: tokens.colorBrandForeground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge)
-  },
-  suggestionText: {
-    flexGrow: 1,
-    minWidth: 0,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  url: {
-    flexGrow: 1
-  },
-  // --- metadata preview card ---
-  preview: {
-    display: 'flex',
-    gap: '12px',
-    padding: '10px',
-    backgroundColor: tokens.colorNeutralBackground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge),
-    border: `1px solid ${tokens.colorNeutralStroke2}`
-  },
-  previewThumb: {
-    flexShrink: 0,
-    width: '120px',
-    height: '68px',
-    objectFit: 'cover',
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    backgroundColor: tokens.colorBrandBackground2,
-    color: tokens.colorBrandForeground1,
-    ...shorthands.borderRadius(tokens.borderRadiusMedium)
-  },
-  previewBody: {
-    flexGrow: 1,
-    minWidth: 0,
-    display: 'flex',
-    flexDirection: 'column',
-    justifyContent: 'center',
-    gap: '2px'
-  },
-  previewTitle: {
-    fontWeight: tokens.fontWeightSemibold,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  previewMeta: {
-    color: tokens.colorNeutralForeground3
-  },
-  statusRow: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px',
-    color: tokens.colorNeutralForeground3
-  },
-  errorRow: {
-    color: tokens.colorPaletteRedForeground1
-  },
-  controls: {
-    display: 'flex',
-    alignItems: 'flex-end',
-    gap: '16px',
-    flexWrap: 'wrap'
-  },
-  control: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '4px'
-  },
-  segmented: {
-    display: 'inline-flex',
-    width: 'fit-content',
-    border: `1px solid ${tokens.colorNeutralStroke1}`,
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    overflow: 'hidden'
-  },
-  segment: {
-    appearance: 'none',
-    border: 'none',
-    backgroundColor: 'transparent',
-    color: tokens.colorNeutralForeground2,
-    padding: '7px 16px',
-    fontSize: tokens.fontSizeBase300,
-    fontFamily: tokens.fontFamilyBase,
-    cursor: 'pointer',
-    ':hover': {
-      backgroundColor: tokens.colorNeutralBackground1Hover
-    }
-  },
-  segmentActive: {
-    backgroundColor: tokens.colorBrandBackground,
-    color: tokens.colorNeutralForegroundOnBrand,
-    fontWeight: tokens.fontWeightSemibold,
-    ':hover': {
-      backgroundColor: tokens.colorBrandBackgroundHover
-    }
-  },
-  quality: {
-    minWidth: '220px'
-  },
-  spacer: {
-    flexGrow: 1
-  },
-  // --- playlist selection ---
-  plPanel: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '8px',
-    padding: '12px',
-    backgroundColor: tokens.colorNeutralBackground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge),
-    border: `1px solid ${tokens.colorNeutralStroke2}`
-  },
-  plHeader: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px'
-  },
-  plHeaderText: {
-    flexGrow: 1,
-    minWidth: 0,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap',
-    fontWeight: tokens.fontWeightSemibold
-  },
-  plList: {
-    display: 'flex',
-    flexDirection: 'column',
-    maxHeight: '260px',
-    overflowY: 'auto',
-    paddingRight: '4px'
-  },
-  plItemRow: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px'
-  },
-  plItem: {
-    display: 'flex',
-    alignItems: 'flex-start',
-    padding: '2px 0',
-    flexGrow: 1,
-    minWidth: 0
-  },
-  plKindBtn: {
-    flexShrink: 0,
-    appearance: 'none',
-    border: 'none',
-    backgroundColor: 'transparent',
-    color: tokens.colorNeutralForeground3,
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    width: '28px',
-    height: '28px',
-    cursor: 'pointer',
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    ':hover': {
-      backgroundColor: tokens.colorNeutralBackground1Hover,
-      color: tokens.colorNeutralForeground2
-    }
-  },
-  plItemLabel: {
-    display: 'flex',
-    flexDirection: 'column',
-    minWidth: 0
-  },
-  plItemTitle: {
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  plItemMeta: {
-    color: tokens.colorNeutralForeground3
-  },
-  // --- duplicate warning ---
-  dupRow: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px',
-    padding: '8px 8px 8px 12px',
-    backgroundColor: tokens.colorStatusWarningBackground1,
-    color: tokens.colorStatusWarningForeground1,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge)
-  },
-  // --- trim / schedule panels ---
-  trimBlock: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '8px',
-    alignItems: 'flex-start'
-  },
-  optButtons: {
-    display: 'flex',
-    gap: '8px'
-  },
-  trimPanel: {
-    alignSelf: 'stretch',
-    padding: '12px',
-    backgroundColor: tokens.colorNeutralBackground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge),
-    border: `1px solid ${tokens.colorNeutralStroke2}`
-  },
-  // Native datetime-local input, themed to sit beside the Fluent controls.
-  dtInput: {
-    fontFamily: tokens.fontFamilyBase,
-    fontSize: tokens.fontSizeBase300,
-    padding: '6px 10px',
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    border: `1px solid ${tokens.colorNeutralStroke1}`,
-    backgroundColor: tokens.colorNeutralBackground1,
-    color: tokens.colorNeutralForeground1,
-    colorScheme: 'light dark'
-  }
-})
+import { SegmentedControl } from './ui/SegmentedControl'
+import { Banner } from './ui/Banner'
+import { LinkSuggestion } from './ui/LinkSuggestion'
+import { useTextStyles } from './ui/text'
+import { META_SEP } from './ui/tokens'
+import { DownloadOptionsForm } from './DownloadOptionsForm'
+import { useDownloadBarStyles } from './downloadBar/styles'
+import { useDownloadBar, toLocalDatetimeValue } from './downloadBar/useDownloadBar'
+import { PlaylistPanel } from './downloadBar/PlaylistPanel'
 
 export function DownloadBar(): React.JSX.Element {
-  const styles = useStyles()
-  const addFromUrl = useDownloads((s) => s.addFromUrl)
-  const addMany = useDownloads((s) => s.addMany)
-  const settingsLoaded = useSettings((s) => s.loaded)
-  const defaultKind = useSettings((s) => s.defaultKind)
-  const defaultVideoQuality = useSettings((s) => s.defaultVideoQuality)
-  const defaultAudioQuality = useSettings((s) => s.defaultAudioQuality)
-
-  const [url, setUrl] = useState('')
-  const [kind, setKind] = useState<MediaKind>('video')
-  const [quality, setQuality] = useState(QUALITY_OPTIONS.video[0])
-
-  // Optional trim: keep only certain time ranges. Raw text, normalised in main.
-  const [showTrim, setShowTrim] = useState(false)
-  const [trim, setTrim] = useState('')
-
-  // Optional schedule: a datetime-local value; a future time parks the download.
-  const [showSchedule, setShowSchedule] = useState(false)
-  const [scheduleAt, setScheduleAt] = useState('')
-
-  // Drag-and-drop: highlight while a link / .url file hovers the card.
-  const [dragActive, setDragActive] = useState(false)
-
-  // Duplicate guard: warn before enqueuing a URL already in the active queue.
-  const [dup, setDup] = useState<string | null>(null)
-  const confirmDup = useRef(false)
-
-  function onDragOver(e: React.DragEvent): void {
-    e.preventDefault()
-    if (!dragActive) setDragActive(true)
-  }
-  function onDrop(e: React.DragEvent): void {
-    e.preventDefault()
-    setDragActive(false)
-    const dt = e.dataTransfer
-    const fromText = firstUrl(dt.getData('text/uri-list') || dt.getData('text/plain') || '')
-    if (fromText) {
-      onUrlChange(fromText)
-      return
-    }
-    // A dropped Windows .url Internet Shortcut — read its URL= line.
-    const file = Array.from(dt.files).find((f) => f.name.toLowerCase().endsWith('.url'))
-    if (file) {
-      file
-        .text()
-        .then((content) => {
-          const u = parseUrlFile(content)
-          if (u) onUrlChange(u)
-        })
-        .catch(() => {})
-    }
-  }
-
-  // Apply the saved default format once, when persisted settings first arrive.
-  const appliedDefaults = useRef(false)
+  const styles = useDownloadBarStyles()
+  const text = useTextStyles()
+  const bar = useDownloadBar()
+  // Register how to focus the URL field so App can request focus (launch / "New
+  // download") without a hardcoded getElementById into this markup (L118).
+  const urlInputRef = useRef<HTMLInputElement>(null)
+  const registerUrlFocuser = useNav((s) => s.registerUrlFocuser)
   useEffect(() => {
-    if (settingsLoaded && !appliedDefaults.current) {
-      appliedDefaults.current = true
-      setKind(defaultKind)
-      setQuality(defaultKind === 'audio' ? defaultAudioQuality : defaultVideoQuality)
-    }
-  }, [settingsLoaded, defaultKind, defaultVideoQuality, defaultAudioQuality])
-
-  // Probe state for the single-video format picker.
-  const [info, setInfo] = useState<MediaInfo | null>(null)
-  const [probing, setProbing] = useState(false)
-  const [probeError, setProbeError] = useState<string | null>(null)
-  const [formatId, setFormatId] = useState<string>('')
-
-  // Probe state for a playlist URL.
-  const [playlist, setPlaylist] = useState<PlaylistInfo | null>(null)
-  const [selected, setSelected] = useState<Set<number>>(new Set())
-  // Per-entry kind override (entry.index → 'video' | 'audio'); absent = use the
-  // bar's global kind. Lets a playlist mix video and audio downloads.
-  const [itemKinds, setItemKinds] = useState<Record<number, MediaKind>>({})
-
-  // Clipboard auto-detect and links handed to AeroFetch from outside (the
-  // aerofetch:// protocol or a "Send to" .url file) share one suggestion banner,
-  // driven by the same hook the library's add-source field uses. An external link
-  // always takes priority over a clipboard guess — it's a direct request.
+    registerUrlFocuser(() => urlInputRef.current?.focus())
+    return () => registerUrlFocuser(null)
+  }, [registerUrlFocuser])
   const {
+    url,
+    kind,
+    quality,
+    showTrim,
+    trim,
+    showSchedule,
+    scheduleAt,
+    dragActive,
+    dup,
+    dupInHistory,
+    showAdvanced,
+    downloadOptions,
+    incognito,
+    commandPreview,
+    previewLoading,
+    info,
+    thumbFailed,
+    probing,
+    probeError,
+    usingFormats,
+    selectedFormat,
+    playlist,
+    selected,
+    allSelected,
     suggestion,
-    source: suggestionSource,
-    accept: acceptLink,
-    dismiss: dismissSuggestion,
-    offer: offerLink
-  } = useClipboardLink(url)
-  useEffect(() => window.api.onExternalUrl((incoming) => offerLink(incoming, 'external')), [offerLink])
-
-  function acceptSuggestion(): void {
-    const link = acceptLink()
-    if (link) onUrlChange(link)
-  }
-
-  const usingFormats = kind === 'video' && info !== null && info.formats.length > 0
-  const selectedFormat: FormatOption | undefined = usingFormats
-    ? info.formats.find((f) => f.id === formatId) ?? info.formats[0]
-    : undefined
-
-  function clearProbe(): void {
-    setInfo(null)
-    setProbeError(null)
-    setFormatId('')
-    setPlaylist(null)
-    setSelected(new Set())
-    setItemKinds({})
-  }
-
-  function onUrlChange(next: string): void {
-    setUrl(next)
-    // Any probed info — or a duplicate warning — is stale once the URL changes.
-    if (info || probeError || playlist) clearProbe()
-    if (dup) setDup(null)
-    confirmDup.current = false
-  }
-
-  function onKindChange(next: MediaKind): void {
-    setKind(next)
-    setQuality(QUALITY_OPTIONS[next][0])
-  }
-
-  async function fetchFormats(): Promise<void> {
-    const trimmed = url.trim()
-    if (!trimmed || probing) return
-    setProbing(true)
-    setProbeError(null)
-    setInfo(null)
-    setPlaylist(null)
-    try {
-      const res = await window.api.probe(trimmed)
-      if (res.ok && res.kind === 'playlist' && res.playlist) {
-        setPlaylist(res.playlist)
-        // Pre-select every entry; the user can trim the list.
-        setSelected(new Set(res.playlist.entries.map((e) => e.index)))
-      } else if (res.ok && res.info) {
-        setInfo(res.info)
-        setFormatId(res.info.formats[0]?.id ?? '')
-      } else {
-        setProbeError(res.error ?? 'Could not fetch video info.')
-      }
-    } catch (e) {
-      setProbeError(String(e))
-    } finally {
-      setProbing(false)
-    }
-  }
-
-  async function paste(): Promise<void> {
-    try {
-      const text = await navigator.clipboard.readText()
-      if (text) onUrlChange(text.trim())
-    } catch {
-      /* clipboard blocked — ignore in preview */
-    }
-  }
-
-  // Selection helpers for the playlist panel.
-  const allSelected = playlist !== null && selected.size === playlist.entries.length
-  function toggleEntry(index: number, on: boolean): void {
-    setSelected((prev) => {
-      const next = new Set(prev)
-      if (on) next.add(index)
-      else next.delete(index)
-      return next
-    })
-  }
-  function toggleAll(): void {
-    if (!playlist) return
-    setSelected(allSelected ? new Set() : new Set(playlist.entries.map((e) => e.index)))
-  }
-
-  // Per-entry kind: the override if set, else the bar's global kind.
-  function effKind(index: number): MediaKind {
-    return itemKinds[index] ?? kind
-  }
-  function toggleItemKind(index: number): void {
-    setItemKinds((m) => ({ ...m, [index]: effKind(index) === 'audio' ? 'video' : 'audio' }))
-  }
-  function setAllKinds(k: MediaKind): void {
-    if (!playlist) return
-    const all: Record<number, MediaKind> = {}
-    for (const e of playlist.entries) all[e.index] = k
-    setItemKinds(all)
-  }
-
-  function download(): void {
-    const trimmed = url.trim()
-    if (!trimmed) return
-
-    // Duplicate guard: if this URL is already in the queue (and the user hasn't
-    // confirmed via "Download anyway"), warn instead of silently enqueuing a copy.
-    // Canceled/failed items don't count — re-adding those is a legitimate retry.
-    if (!confirmDup.current) {
-      const existing = useDownloads
-        .getState()
-        .items.find(
-          (i) => i.status !== 'canceled' && i.status !== 'error' && sameVideo(i.url, trimmed)
-        )
-      if (existing) {
-        setDup(existing.title)
-        return
-      }
-    }
-    confirmDup.current = false
-    setDup(null)
-
-    const meta = info
-      ? {
-          title: info.title,
-          channel: info.channel,
-          durationLabel: info.durationLabel,
-          thumbnail: info.thumbnail
-        }
-      : {}
-
-    const trimSpec = trim.trim() || undefined
-    const scheduledFor = scheduleAt ? new Date(scheduleAt).getTime() : undefined
-
-    if (usingFormats && selectedFormat) {
-      addFromUrl(trimmed, 'video', selectedFormat.label, {
-        ...meta,
-        trim: trimSpec,
-        scheduledFor,
-        format: {
-          id: selectedFormat.id,
-          hasAudio: selectedFormat.hasAudio,
-          label: selectedFormat.label
-        }
-      })
-    } else {
-      addFromUrl(trimmed, kind, quality, { ...meta, trim: trimSpec, scheduledFor })
-    }
-
-    setUrl('')
-    setTrim('')
-    setShowTrim(false)
-    setScheduleAt('')
-    setShowSchedule(false)
-    clearProbe()
-  }
-
-  function downloadAnyway(): void {
-    confirmDup.current = true
-    download()
-  }
-
-  function addPlaylist(): void {
-    if (!playlist) return
-    const chosen = playlist.entries.filter((e) => selected.has(e.index))
-    // Each entry uses its own kind override; quality falls back to that kind's
-    // default unless the entry matches the bar's current kind/quality.
-    addMany(
-      chosen.map((e) => {
-        const k = effKind(e.index)
-        return {
-          url: e.url,
-          kind: k,
-          quality: k === kind ? quality : QUALITY_OPTIONS[k][0],
-          opts: { title: e.title, channel: e.uploader, durationLabel: e.durationLabel }
-        }
-      })
-    )
-    setUrl('')
-    clearProbe()
-  }
+    suggestionSource,
+    channelHint
+  } = bar
 
   return (
     <div
       className={mergeClasses(styles.root, dragActive && styles.rootDragging)}
-      onDragOver={onDragOver}
-      onDragLeave={() => setDragActive(false)}
-      onDrop={onDrop}
+      onDragEnter={bar.onDragEnter}
+      onDragOver={bar.onDragOver}
+      onDragLeave={bar.onDragLeave}
+      onDrop={bar.onDrop}
     >
       <div className={styles.urlRow}>
         <Input
           className={styles.url}
-          input={{ id: 'aerofetch-url' }}
+          input={{ ref: urlInputRef, 'aria-label': 'Video or playlist URL' }}
           value={url}
-          onChange={(_, d) => onUrlChange(d.value)}
-          onKeyDown={(e) => e.key === 'Enter' && fetchFormats()}
-          placeholder="Paste a video or playlist URL, then fetch…"
+          onChange={(_, d) => bar.onUrlChange(d.value)}
+          onKeyDown={(e) => {
+            if (e.key !== 'Enter') return
+            // Enter is "go": start the download (or add a fetched playlist). Preview
+            // formats stays an explicit, optional click on the button (UX2).
+            if (playlist) {
+              if (selected.size > 0) bar.addPlaylist()
+            } else bar.download()
+          }}
+          placeholder="Paste a video or playlist URL, then press Enter to download"
           size="large"
           contentBefore={<ArrowDownloadRegular />}
         />
-        <Hint label="Fetch formats / playlist" placement="bottom" align="end">
+        <Hint label="Preview available formats (optional)" placement="bottom" align="end">
           <Button
             size="large"
             icon={probing ? <Spinner size="tiny" /> : <SearchRegular />}
-            onClick={fetchFormats}
+            onClick={bar.fetchFormats}
             disabled={!url.trim() || probing}
-            aria-label="Fetch formats or playlist"
+            aria-label="Preview available formats (optional)"
           />
         </Hint>
         <Hint label="Paste from clipboard" placement="bottom" align="end">
           <Button
             size="large"
             icon={<ClipboardPasteRegular />}
-            onClick={paste}
+            onClick={bar.paste}
             aria-label="Paste from clipboard"
           />
         </Hint>
       </div>
 
       {suggestion && (
-        <div className={styles.suggestion}>
-          <LinkRegular />
-          <Caption1 className={styles.suggestionText}>
-            {suggestionSource === 'external' ? 'Link received: ' : 'Use copied link? '}
-            {suggestion}
+        <LinkSuggestion
+          prefix={suggestionSource === 'external' ? 'Link received: ' : 'Use copied link? '}
+          link={suggestion}
+          onAccept={bar.acceptSuggestion}
+          onDismiss={bar.dismissSuggestion}
+          dismissLabel="Dismiss suggested link"
+        />
+      )}
+
+      {channelHint && (
+        <Banner
+          icon={<LibraryRegular />}
+          wrap
+          actions={
+            <>
+              <Button size="small" appearance="primary" onClick={bar.openInLibrary}>
+                Open in Library
+              </Button>
+              <Button
+                size="small"
+                appearance="subtle"
+                icon={<DismissRegular />}
+                onClick={bar.dismissChannelHint}
+                aria-label="Dismiss Library suggestion"
+              />
+            </>
+          }
+        >
+          <Caption1>
+            This looks like a channel or playlist. Add it in the Library to download many videos at
+            once.
           </Caption1>
-          <Button size="small" appearance="primary" onClick={acceptSuggestion}>
-            Use
-          </Button>
-          <Button
-            size="small"
-            appearance="subtle"
-            icon={<DismissRegular />}
-            onClick={dismissSuggestion}
-            aria-label="Dismiss"
-          />
-        </div>
+        </Banner>
       )}
 
       {dup && (
-        <div className={styles.dupRow}>
-          <WarningRegular />
-          <Caption1 className={styles.suggestionText}>Already in your queue: “{dup}”.</Caption1>
-          <Button size="small" appearance="primary" onClick={downloadAnyway}>
-            Download anyway
-          </Button>
-          <Button
-            size="small"
-            appearance="subtle"
-            icon={<DismissRegular />}
-            onClick={() => setDup(null)}
-            aria-label="Dismiss"
-          />
-        </div>
+        <Banner
+          tone="warning"
+          icon={<WarningRegular />}
+          actions={
+            <>
+              <Button size="small" appearance="primary" onClick={bar.downloadAnyway}>
+                Download anyway
+              </Button>
+              <Button
+                size="small"
+                appearance="subtle"
+                icon={<DismissRegular />}
+                onClick={() => bar.setDup(null)}
+                aria-label="Dismiss duplicate warning"
+              />
+            </>
+          }
+        >
+          <Caption1>
+            {dupInHistory ? 'Already downloaded' : 'Already in your queue'}: "{dup}".
+          </Caption1>
+        </Banner>
       )}
 
       {probing && (
@@ -647,14 +198,19 @@ export function DownloadBar(): React.JSX.Element {
       {probeError && (
         <div className={mergeClasses(styles.statusRow, styles.errorRow)}>
           <ErrorCircleRegular />
-          <Caption1>{probeError} — you can still download with the presets below.</Caption1>
+          <Caption1>{probeError} -- you can still download with the presets below.</Caption1>
         </div>
       )}
 
       {info && (
         <div className={styles.preview}>
-          {info.thumbnail ? (
-            <img className={styles.previewThumb} src={info.thumbnail} alt="" />
+          {info.thumbnail && thumbFailed !== info.thumbnail ? (
+            <img
+              className={styles.previewThumb}
+              src={info.thumbnail}
+              alt=""
+              onError={() => bar.setThumbFailed(info.thumbnail ?? null)}
+            />
           ) : (
             <div className={styles.previewThumb}>
               {kind === 'audio' ? (
@@ -665,75 +221,25 @@ export function DownloadBar(): React.JSX.Element {
             </div>
           )}
           <div className={styles.previewBody}>
-            <Text className={styles.previewTitle}>{info.title}</Text>
-            <Caption1 className={styles.previewMeta}>
-              {[info.channel, info.durationLabel].filter(Boolean).join('  •  ')}
+            <Text className={text.title}>{info.title}</Text>
+            <Caption1 className={text.muted}>
+              {[info.channel, info.durationLabel].filter(Boolean).join(META_SEP)}
             </Caption1>
           </div>
         </div>
       )}
 
       {playlist && (
-        <div className={styles.plPanel}>
-          <div className={styles.plHeader}>
-            <AppsListRegular />
-            <Caption1 className={styles.plHeaderText}>
-              {playlist.title}
-              {playlist.uploader ? `  •  ${playlist.uploader}` : ''}
-            </Caption1>
-            <Caption1 className={styles.previewMeta}>
-              {selected.size} of {playlist.count} selected
-            </Caption1>
-            <Button size="small" appearance="subtle" onClick={toggleAll}>
-              {allSelected ? 'Select none' : 'Select all'}
-            </Button>
-            <Button size="small" appearance="subtle" onClick={() => setAllKinds('video')}>
-              All video
-            </Button>
-            <Button size="small" appearance="subtle" onClick={() => setAllKinds('audio')}>
-              All audio
-            </Button>
-          </div>
-          <div className={styles.plList}>
-            {playlist.entries.map((e) => (
-              <div key={e.index} className={styles.plItemRow}>
-                <Checkbox
-                  className={styles.plItem}
-                  checked={selected.has(e.index)}
-                  onChange={(_, d) => toggleEntry(e.index, !!d.checked)}
-                  label={
-                    <span className={styles.plItemLabel}>
-                      <span className={styles.plItemTitle}>
-                        {e.index}. {e.title}
-                      </span>
-                      {(e.durationLabel || e.uploader) && (
-                        <Caption1 className={styles.plItemMeta}>
-                          {[e.durationLabel, e.uploader].filter(Boolean).join('  •  ')}
-                        </Caption1>
-                      )}
-                    </span>
-                  }
-                />
-                <Hint
-                  label={
-                    effKind(e.index) === 'audio' ? 'Audio — click for video' : 'Video — click for audio'
-                  }
-                  placement="top"
-                  align="end"
-                >
-                  <button
-                    type="button"
-                    className={styles.plKindBtn}
-                    onClick={() => toggleItemKind(e.index)}
-                    aria-label={`Download type for ${e.title}: ${effKind(e.index)}`}
-                  >
-                    {effKind(e.index) === 'audio' ? <MusicNote2Regular /> : <VideoClipRegular />}
-                  </button>
-                </Hint>
-              </div>
-            ))}
-          </div>
-        </div>
+        <PlaylistPanel
+          playlist={playlist}
+          selected={selected}
+          allSelected={allSelected}
+          onToggleAll={bar.toggleAll}
+          onSetAllKinds={bar.setAllKinds}
+          onToggleEntry={bar.toggleEntry}
+          effKind={bar.effKind}
+          onToggleItemKind={bar.toggleItemKind}
+        />
       )}
 
       {!playlist && (
@@ -743,7 +249,7 @@ export function DownloadBar(): React.JSX.Element {
               size="small"
               appearance="subtle"
               icon={<CutRegular />}
-              onClick={() => setShowTrim((v) => !v)}
+              onClick={() => bar.setShowTrim((v) => !v)}
             >
               {trim.trim() ? 'Trim · on' : 'Trim'}
             </Button>
@@ -751,7 +257,7 @@ export function DownloadBar(): React.JSX.Element {
               size="small"
               appearance="subtle"
               icon={<CalendarClockRegular />}
-              onClick={() => setShowSchedule((v) => !v)}
+              onClick={() => bar.setShowSchedule((v) => !v)}
             >
               {scheduleAt ? 'Scheduled' : 'Schedule'}
             </Button>
@@ -760,11 +266,11 @@ export function DownloadBar(): React.JSX.Element {
             <div className={styles.trimPanel}>
               <Field
                 label="Sections to keep"
-                hint="Time ranges like 1:30-2:00 — one per line or comma-separated. Leave empty to download the whole thing."
+                hint="Time ranges like 1:30-2:00 -- one per line or comma-separated. Leave empty to download the whole thing."
               >
                 <Textarea
                   value={trim}
-                  onChange={(_, d) => setTrim(d.value)}
+                  onChange={(_, d) => bar.onTrimChange(d.value)}
                   placeholder={'0:30-1:45\n3:00-3:30'}
                   resize="vertical"
                 />
@@ -781,7 +287,8 @@ export function DownloadBar(): React.JSX.Element {
                   type="datetime-local"
                   className={styles.dtInput}
                   value={scheduleAt}
-                  onChange={(e) => setScheduleAt(e.target.value)}
+                  min={toLocalDatetimeValue(new Date())}
+                  onChange={(e) => bar.setScheduleAt(e.target.value)}
                 />
               </Field>
             </div>
@@ -789,23 +296,65 @@ export function DownloadBar(): React.JSX.Element {
         </div>
       )}
 
+      {!playlist && (
+        <div className={styles.commandBlock}>
+          <div className={styles.optButtons}>
+            <Button
+              size="small"
+              appearance="subtle"
+              icon={<SettingsRegular />}
+              onClick={() => bar.setShowAdvanced((v) => !v)}
+            >
+              {showAdvanced ? 'Advanced · on' : 'Advanced'}
+            </Button>
+            <Button
+              size="small"
+              appearance="subtle"
+              icon={previewLoading ? <Spinner size="tiny" /> : <WindowConsoleRegular />}
+              onClick={bar.toggleCommandPreview}
+              disabled={!url.trim() || previewLoading}
+            >
+              {commandPreview ? 'Hide command' : 'Show command'}
+            </Button>
+          </div>
+          {commandPreview && (
+            <div className={styles.commandPreviewPanel}>
+              {commandPreview.ok ? (
+                commandPreview.command
+              ) : (
+                <span className={styles.commandError}>Error: {commandPreview.error}</span>
+              )}
+            </div>
+          )}
+          {showAdvanced && (
+            <div className={styles.optionsPanel}>
+              <Checkbox
+                checked={incognito}
+                onChange={(_, d) => bar.setIncognito(!!d.checked)}
+                label="Incognito mode (no logging, no history, no cookies)"
+              />
+              <DownloadOptionsForm
+                value={downloadOptions}
+                onChange={bar.onDownloadOptionsChange}
+                kind={kind}
+              />
+            </div>
+          )}
+        </div>
+      )}
+
       <div className={styles.controls}>
         <div className={styles.control}>
           <Caption1>Format</Caption1>
-          <div className={styles.segmented} role="radiogroup" aria-label="Format">
-            {(['video', 'audio'] as MediaKind[]).map((k) => (
-              <button
-                key={k}
-                type="button"
-                role="radio"
-                aria-checked={kind === k}
-                className={mergeClasses(styles.segment, kind === k && styles.segmentActive)}
-                onClick={() => onKindChange(k)}
-              >
-                {k === 'video' ? 'Video' : 'Audio'}
-              </button>
-            ))}
-          </div>
+          <SegmentedControl<MediaKind>
+            value={kind}
+            options={[
+              { value: 'video', label: 'Video' },
+              { value: 'audio', label: 'Audio' }
+            ]}
+            onChange={bar.onKindChange}
+            ariaLabel="Format"
+          />
         </div>
 
         <div className={styles.control}>
@@ -814,17 +363,19 @@ export function DownloadBar(): React.JSX.Element {
             <Select
               className={styles.quality}
               aria-label="Quality / format"
+              size="large"
               value={selectedFormat?.id ?? ''}
-              options={info.formats.map((f) => ({ value: f.id, label: f.label }))}
-              onChange={setFormatId}
+              options={(info?.formats ?? []).map((f) => ({ value: f.id, label: f.label }))}
+              onChange={bar.onFormatIdChange}
             />
           ) : (
             <Select
               className={styles.quality}
               aria-label="Quality"
+              size="large"
               value={quality}
               options={QUALITY_OPTIONS[kind].map((q) => ({ value: q, label: q }))}
-              onChange={setQuality}
+              onChange={bar.onQualityChange}
             />
           )}
         </div>
@@ -836,7 +387,7 @@ export function DownloadBar(): React.JSX.Element {
             appearance="primary"
             size="large"
             icon={<ArrowDownloadRegular />}
-            onClick={addPlaylist}
+            onClick={bar.addPlaylist}
             disabled={selected.size === 0}
           >
             Add {selected.size} to queue
@@ -846,7 +397,7 @@ export function DownloadBar(): React.JSX.Element {
             appearance="primary"
             size="large"
             icon={scheduleAt ? <CalendarClockRegular /> : <ArrowDownloadRegular />}
-            onClick={download}
+            onClick={bar.download}
             disabled={!url.trim()}
           >
             {scheduleAt ? 'Schedule' : 'Download'}
diff --git a/src/renderer/src/components/DownloadOptionsForm.tsx b/src/renderer/src/components/DownloadOptionsForm.tsx
index d287f8b..181acab 100644
--- a/src/renderer/src/components/DownloadOptionsForm.tsx
+++ b/src/renderer/src/components/DownloadOptionsForm.tsx
@@ -1,4 +1,4 @@
-import {
+import {
   Field,
   Input,
   Switch,
@@ -45,7 +45,7 @@ const VIDEO_CODEC_LABELS: Record<VideoCodecPref, string> = {
 const SPONSORBLOCK_LABELS: Record<SponsorBlockCategory, string> = {
   sponsor: 'Sponsor',
   intro: 'Intro / intermission',
-  outro: 'Endcards / credits',
+  outro: 'End cards / credits',
   selfpromo: 'Self-promotion',
   preview: 'Preview / recap',
   filler: 'Filler / tangent',
@@ -83,6 +83,8 @@ const useStyles = makeStyles({
 interface Props {
   value: DownloadOptions
   onChange: (next: DownloadOptions) => void
+  /** When provided, hides controls that don't apply to this media kind. */
+  kind?: 'video' | 'audio'
 }
 
 /**
@@ -90,7 +92,7 @@ interface Props {
  * Used both for the persisted defaults (Settings) and for a per-download
  * override (the download bar), so the two never drift apart.
  */
-export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Element {
+export function DownloadOptionsForm({ value, onChange, kind }: Props): React.JSX.Element {
   const styles = useStyles()
 
   function setOpt<K extends keyof DownloadOptions>(key: K, v: DownloadOptions[K]): void {
@@ -107,35 +109,47 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
   return (
     <div className={styles.root}>
       <div className={styles.grid}>
-        <Field label="Audio format" hint="For audio-only downloads.">
-          <Select
-            aria-label="Audio format"
-            value={value.audioFormat}
-            options={AUDIO_FORMATS.map((f) => ({ value: f, label: AUDIO_FORMAT_LABELS[f] }))}
-            onChange={(v) => setOpt('audioFormat', v as AudioFormat)}
-          />
-        </Field>
-        <Field label="Video container" hint="Container for merged video.">
-          <Select
-            aria-label="Video container"
-            value={value.videoContainer}
-            options={VIDEO_CONTAINERS.map((c) => ({ value: c, label: VIDEO_CONTAINER_LABELS[c] }))}
-            onChange={(v) => setOpt('videoContainer', v as VideoContainer)}
-          />
-        </Field>
-        <Field label="Preferred codec" hint="Tiebreaker, not a hard filter.">
-          <Select
-            aria-label="Preferred video codec"
-            value={value.preferredVideoCodec}
-            options={VIDEO_CODECS.map((c) => ({ value: c, label: VIDEO_CODEC_LABELS[c] }))}
-            onChange={(v) => setOpt('preferredVideoCodec', v as VideoCodecPref)}
-          />
-        </Field>
+        {kind !== 'video' && (
+          <Field label="Audio format" hint="For audio-only downloads.">
+            <Select
+              value={value.audioFormat}
+              options={AUDIO_FORMATS.map((f) => ({ value: f, label: AUDIO_FORMAT_LABELS[f] }))}
+              onChange={(v) => setOpt('audioFormat', v as AudioFormat)}
+            />
+          </Field>
+        )}
+        {kind !== 'audio' && (
+          <Field
+            label="Video container"
+            hint="The file format used when video and audio are combined into one file."
+          >
+            <Select
+              value={value.videoContainer}
+              options={VIDEO_CONTAINERS.map((c) => ({
+                value: c,
+                label: VIDEO_CONTAINER_LABELS[c]
+              }))}
+              onChange={(v) => setOpt('videoContainer', v as VideoContainer)}
+            />
+          </Field>
+        )}
+        {kind !== 'audio' && (
+          <Field
+            label="Preferred codec"
+            hint="A preference when several formats match -- not a strict filter."
+          >
+            <Select
+              value={value.preferredVideoCodec}
+              options={VIDEO_CODECS.map((c) => ({ value: c, label: VIDEO_CODEC_LABELS[c] }))}
+              onChange={(v) => setOpt('preferredVideoCodec', v as VideoCodecPref)}
+            />
+          </Field>
+        )}
       </div>
 
       <Field
         label="Format sorting (advanced)"
-        hint="Raw yt-dlp -S string to rank formats by priority, e.g. res:1080,vcodec:av01,size. Overrides the preferred-codec tiebreaker. Leave empty unless you know yt-dlp's -S syntax."
+        hint="Custom expression to rank available formats, e.g. res:1080,vcodec:av01,size. Leave blank to use the Preferred codec setting above. See yt-dlp docs for the full syntax."
       >
         <Input
           value={value.formatSort}
@@ -144,11 +158,10 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
         />
       </Field>
 
-      <Field label="Embed subtitles" hint="Download subtitles and mux them into the video.">
+      <Field label="Embed subtitles" hint="Download subtitles and embed them in the video file.">
         <Switch
           checked={value.embedSubtitles}
           onChange={(_, d) => setOpt('embedSubtitles', d.checked)}
-          label={value.embedSubtitles ? 'On' : 'Off'}
         />
       </Field>
       {value.embedSubtitles && (
@@ -177,14 +190,12 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
         <Switch
           checked={value.sponsorBlock}
           onChange={(_, d) => setOpt('sponsorBlock', d.checked)}
-          label={value.sponsorBlock ? 'On' : 'Off'}
         />
       </Field>
       {value.sponsorBlock && (
         <div className={styles.subGroup}>
           <Field label="Action">
             <Select
-              aria-label="SponsorBlock action"
               value={value.sponsorBlockMode}
               options={[
                 { value: 'remove', label: 'Remove segments (cut from file)' },
@@ -193,7 +204,15 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
               onChange={(v) => setOpt('sponsorBlockMode', v as SponsorBlockMode)}
             />
           </Field>
-          <Field label="Categories">
+          <Field
+            label="Categories"
+            validationState={value.sponsorBlockCategories.length === 0 ? 'warning' : 'none'}
+            validationMessage={
+              value.sponsorBlockCategories.length === 0
+                ? 'No categories selected -- no segments will be skipped.'
+                : undefined
+            }
+          >
             <div className={styles.categoryGrid}>
               {SPONSORBLOCK_CATEGORIES.map((cat) => (
                 <Checkbox
@@ -208,11 +227,13 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
         </div>
       )}
 
-      <Field label="Embed chapters">
+      <Field
+        label="Embed chapters"
+        hint="Write chapter markers into the file. Only useful if the video has chapters."
+      >
         <Switch
           checked={value.embedChapters}
           onChange={(_, d) => setOpt('embedChapters', d.checked)}
-          label={value.embedChapters ? 'On' : 'Off'}
         />
       </Field>
       <Field
@@ -222,21 +243,40 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
         <Switch
           checked={value.splitChapters}
           onChange={(_, d) => setOpt('splitChapters', d.checked)}
-          label={value.splitChapters ? 'On' : 'Off'}
         />
       </Field>
       <Field label="Embed metadata" hint="Title, artist, date and similar tags.">
         <Switch
           checked={value.embedMetadata}
           onChange={(_, d) => setOpt('embedMetadata', d.checked)}
-          label={value.embedMetadata ? 'On' : 'Off'}
         />
       </Field>
+      <Field
+        label="Metadata overrides"
+        hint="Override specific tags before embedding. Leave blank to keep the extracted value. Automatically enables embed metadata."
+      >
+        <div className={styles.subGroup}>
+          <Input
+            placeholder="Title"
+            value={value.metadataTitle ?? ''}
+            onChange={(_, d) => setOpt('metadataTitle', d.value)}
+          />
+          <Input
+            placeholder="Artist"
+            value={value.metadataArtist ?? ''}
+            onChange={(_, d) => setOpt('metadataArtist', d.value)}
+          />
+          <Input
+            placeholder="Album"
+            value={value.metadataAlbum ?? ''}
+            onChange={(_, d) => setOpt('metadataAlbum', d.value)}
+          />
+        </div>
+      </Field>
       <Field label="Embed thumbnail" hint="Cover art for audio; poster frame for MP4/MKV.">
         <Switch
           checked={value.embedThumbnail}
           onChange={(_, d) => setOpt('embedThumbnail', d.checked)}
-          label={value.embedThumbnail ? 'On' : 'Off'}
         />
       </Field>
       {value.embedThumbnail && (
@@ -254,7 +294,7 @@ export function DownloadOptionsForm({ value, onChange }: Props): React.JSX.Eleme
 
       <Field
         label="Sidecar files"
-        hint="Write separate metadata/poster/description files next to each download — handy for Jellyfin, Plex or Kodi libraries."
+        hint="Write separate metadata/poster/description files next to each download -- handy for Jellyfin, Plex or Kodi libraries."
       >
         <div className={styles.subGroup}>
           <Checkbox
diff --git a/src/renderer/src/components/DownloadsView.tsx b/src/renderer/src/components/DownloadsView.tsx
index e35334f..e1c9ca2 100644
--- a/src/renderer/src/components/DownloadsView.tsx
+++ b/src/renderer/src/components/DownloadsView.tsx
@@ -1,19 +1,28 @@
-import {
+import {
   Subtitle2,
-  Body1,
   Caption1,
   Button,
   ProgressBar,
   makeStyles,
+  mergeClasses,
   tokens,
   shorthands
 } from '@fluentui/react-components'
-import { ArrowDownloadRegular, ArrowClockwiseRegular } from '@fluentui/react-icons'
-import { useDownloads } from '../store/downloads'
-import { summarizeQueue } from '../store/queueStats'
+import { ArrowDownloadRegular, ArrowClockwiseRegular, DismissRegular } from '@fluentui/react-icons'
+import { useDownloads, type DownloadItem } from '../store/downloads'
+import { queueSummaryOf } from '../store/queueStats'
 import { DownloadBar } from './DownloadBar'
 import { QueueItem } from './QueueItem'
 import { VirtualList } from './VirtualList'
+import { ScreenHeader, useScreenStyles } from './ui/Screen'
+import { EmptyState } from './ui/EmptyState'
+import { SPACE, ICON, META_SEP } from './ui/tokens'
+
+// Hoisted so the virtualizer gets stable function identities and doesn't churn its
+// measurement/key cache on every render (PERF5).
+const estimateRowSize = (): number => 100
+const getItemKey = (item: DownloadItem): string => item.id
+const renderQueueRow = (item: DownloadItem): React.JSX.Element => <QueueItem item={item} />
 
 const useStyles = makeStyles({
   root: {
@@ -22,7 +31,8 @@ const useStyles = makeStyles({
     // growing to thousands of rows.
     display: 'flex',
     flexDirection: 'column',
-    gap: '20px',
+    // One section gap on every screen (UI2).
+    gap: SPACE.section,
     height: '100%'
   },
   queueHeader: {
@@ -56,47 +66,59 @@ const useStyles = makeStyles({
     // min-height:0 lets this flex child shrink below its content height so it,
     // not the page, owns the scrolling.
     minHeight: 0
-  },
-  empty: {
-    display: 'flex',
-    flexDirection: 'column',
-    alignItems: 'center',
-    gap: '8px',
-    padding: '56px 16px',
-    color: tokens.colorNeutralForeground3,
-    textAlign: 'center'
   }
 })
 
 export function DownloadsView(): React.JSX.Element {
   const styles = useStyles()
+  const screen = useScreenStyles()
   const items = useDownloads((s) => s.items)
   const clearFinished = useDownloads((s) => s.clearFinished)
   const retryAll = useDownloads((s) => s.retryAll)
+  const cancelAll = useDownloads((s) => s.cancelAll)
 
-  const summary = summarizeQueue(items)
+  const summary = queueSummaryOf(items)
   const hasFinished = items.some(
     (i) => i.status === 'completed' || i.status === 'error' || i.status === 'canceled'
   )
+  // The header count is the live queue (work not yet finished), not the whole
+  // list -- completed/canceled/error rows linger until "Clear finished" (L11).
+  const queueCount = items.filter(
+    (i) =>
+      i.status === 'downloading' ||
+      i.status === 'queued' ||
+      i.status === 'paused' ||
+      i.status === 'saved'
+  ).length
+  // Cancelable = the items with a live/pending run (downloading + queued); this is
+  // exactly what "Cancel all" acts on (UX15).
+  const cancelable = items.filter((i) => i.status === 'downloading' || i.status === 'queued').length
 
   return (
-    <div className={styles.root}>
+    <div className={mergeClasses(styles.root, screen.width)}>
+      <ScreenHeader title="Downloads" description="Fetch a video, playlist, or channel by URL." />
+
       <DownloadBar />
 
       {summary.active && (
         <div className={styles.summary}>
-          <ProgressBar className={styles.summaryBar} value={summary.progress} thickness="large" />
+          <ProgressBar
+            className={styles.summaryBar}
+            value={summary.progress}
+            thickness="large"
+            aria-label="Overall download progress"
+          />
           <Caption1 className={styles.summaryText}>
             {summary.downloading} downloading
             {summary.queued ? `, ${summary.queued} queued` : ''}
-            {summary.speedLabel ? `  •  ${summary.speedLabel}` : ''}
-            {summary.etaLabel ? `  •  ~${summary.etaLabel} left` : ''}
+            {summary.speedLabel ? `${META_SEP}${summary.speedLabel}` : ''}
+            {summary.etaLabel ? `${META_SEP}~${summary.etaLabel} left` : ''}
           </Caption1>
         </div>
       )}
 
       <div className={styles.queueHeader}>
-        <Subtitle2>Queue ({items.length})</Subtitle2>
+        <Subtitle2 as="h2">Queue ({queueCount})</Subtitle2>
         <div className={styles.headerActions}>
           {summary.failed > 0 && (
             <Button
@@ -108,6 +130,11 @@ export function DownloadsView(): React.JSX.Element {
               Retry all failed ({summary.failed})
             </Button>
           )}
+          {cancelable > 0 && (
+            <Button size="small" appearance="subtle" icon={<DismissRegular />} onClick={cancelAll}>
+              Cancel all ({cancelable})
+            </Button>
+          )}
           {hasFinished && (
             <Button size="small" appearance="subtle" onClick={clearFinished}>
               Clear finished
@@ -117,19 +144,19 @@ export function DownloadsView(): React.JSX.Element {
       </div>
 
       {items.length === 0 ? (
-        <div className={styles.empty}>
-          <ArrowDownloadRegular fontSize={40} />
-          <Body1>Nothing queued yet. Paste a URL above to get started.</Body1>
-        </div>
+        <EmptyState
+          icon={<ArrowDownloadRegular fontSize={ICON.hero} />}
+          message="Nothing queued yet. Paste a URL above, then click Download."
+        />
       ) : (
         <VirtualList
           items={items}
           className={styles.listScroll}
           gap={10}
           overscan={6}
-          estimateSize={() => 100}
-          getKey={(item) => item.id}
-          renderItem={(item) => <QueueItem item={item} />}
+          estimateSize={estimateRowSize}
+          getKey={getItemKey}
+          renderItem={renderQueueRow}
         />
       )}
     </div>
diff --git a/src/renderer/src/components/ErrorBoundary.tsx b/src/renderer/src/components/ErrorBoundary.tsx
new file mode 100644
index 0000000..0452baa
--- /dev/null
+++ b/src/renderer/src/components/ErrorBoundary.tsx
@@ -0,0 +1,100 @@
+import React from 'react'
+
+interface Props {
+  children: React.ReactNode
+}
+interface State {
+  error: Error | null
+}
+
+/**
+ * Top-level renderer error boundary (M16). Before this, an exception thrown in
+ * render by any view unmounted the whole shell to a blank white window with no
+ * way out. This catches it, logs it (so it reaches the dev console / future log
+ * sink), and shows a recover affordance.
+ *
+ * The fallback is intentionally dependency-free — no Fluent components, no theme
+ * provider — because the error may have come from inside that very tree. It paints
+ * its own full-window dark surface (matching the app's dark charcoal + toffee
+ * accent) rather than reading theme tokens, so it renders identically regardless
+ * of the active theme and uses only inline CSS that can't itself throw.
+ */
+export class ErrorBoundary extends React.Component<Props, State> {
+  state: State = { error: null }
+
+  static getDerivedStateFromError(error: Error): State {
+    return { error }
+  }
+
+  componentDidCatch(error: Error, info: React.ErrorInfo): void {
+    console.error('[AeroFetch] renderer crashed:', error, info.componentStack)
+  }
+
+  private handleReload = (): void => {
+    // A full reload re-runs the renderer from a clean state; persisted data
+    // (settings/history/sources) lives in main, so nothing is lost.
+    window.location.reload()
+  }
+
+  render(): React.ReactNode {
+    const { error } = this.state
+    if (!error) return this.props.children
+
+    return (
+      <div
+        role="alert"
+        style={{
+          display: 'flex',
+          flexDirection: 'column',
+          alignItems: 'center',
+          justifyContent: 'center',
+          gap: 16,
+          minHeight: '100vh',
+          padding: 32,
+          textAlign: 'center',
+          fontFamily: 'Segoe UI, system-ui, sans-serif',
+          color: '#c8c6c4',
+          background: '#201f1e'
+        }}
+      >
+        <div style={{ fontSize: 18, fontWeight: 600, color: '#f3f2f1' }}>Something went wrong</div>
+        <div style={{ maxWidth: 440, fontSize: 13, lineHeight: 1.5 }}>
+          AeroFetch hit an unexpected error and couldn’t continue. Your downloads and settings are
+          saved — reloading the window should bring you back.
+        </div>
+        <pre
+          style={{
+            maxWidth: 480,
+            maxHeight: 120,
+            overflow: 'auto',
+            margin: 0,
+            padding: '8px 12px',
+            fontSize: 11,
+            textAlign: 'left',
+            color: '#d29ca0',
+            background: '#2b2a29',
+            borderRadius: 6
+          }}
+        >
+          {error.message || String(error)}
+        </pre>
+        <button
+          type="button"
+          onClick={this.handleReload}
+          style={{
+            padding: '8px 20px',
+            fontSize: 14,
+            fontWeight: 600,
+            color: '#1c1611',
+            background: '#b5917d',
+            border: 'none',
+            borderRadius: 8,
+            cursor: 'pointer'
+          }}
+        >
+          Reload AeroFetch
+        </button>
+      </div>
+    )
+  }
+}
diff --git a/src/renderer/src/components/Hint.tsx b/src/renderer/src/components/Hint.tsx
index 767d084..a5f2871 100644
--- a/src/renderer/src/components/Hint.tsx
+++ b/src/renderer/src/components/Hint.tsx
@@ -1,4 +1,5 @@
 import { makeStyles, mergeClasses, tokens, shorthands } from '@fluentui/react-components'
+import { Z } from './ui/tokens'
 
 // An instant, theme-styled tooltip implemented entirely in CSS — shown via a
 // `:hover` / `:focus-within` visibility toggle on an absolutely-positioned child
@@ -17,7 +18,7 @@ const useStyles = makeStyles({
   },
   bubble: {
     position: 'absolute',
-    zIndex: 1000,
+    zIndex: Z.tooltip,
     visibility: 'hidden',
     pointerEvents: 'none',
     whiteSpace: 'nowrap',
@@ -36,12 +37,17 @@ const useStyles = makeStyles({
   alignEnd: { right: 0 }
 })
 
-interface HintProps {
+// `align` only shifts a top/bottom bubble left/right; it does nothing for a
+// left/right placement. The union makes that explicit — passing `align` with
+// `placement="left"|"right"` is a type error now, instead of being silently
+// ignored (L129).
+type HintProps = {
   label: string
-  placement?: 'top' | 'bottom' | 'left' | 'right'
-  align?: 'start' | 'end'
   children: React.ReactNode
-}
+} & (
+  | { placement?: 'top' | 'bottom'; align?: 'start' | 'end' }
+  | { placement: 'left' | 'right'; align?: never }
+)
 
 export function Hint({
   label,
diff --git a/src/renderer/src/components/HistoryView.tsx b/src/renderer/src/components/HistoryView.tsx
index 2b0866f..1b35081 100644
--- a/src/renderer/src/components/HistoryView.tsx
+++ b/src/renderer/src/components/HistoryView.tsx
@@ -1,12 +1,12 @@
-import { useMemo, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import {
   Text,
   Caption1,
   Button,
   Checkbox,
   Input,
-  Body1,
   makeStyles,
+  mergeClasses,
   tokens,
   shorthands
 } from '@fluentui/react-components'
@@ -22,6 +22,7 @@ import {
 } from '@fluentui/react-icons'
 import type { HistoryEntry, MediaKind } from '@shared/ipc'
 import { useHistory } from '../store/history'
+import { formatWhen } from '../datetime'
 import { useResolvedDark } from '../store/systemTheme'
 import { useDownloads } from '../store/downloads'
 import { thumbColors } from '../theme'
@@ -29,12 +30,18 @@ import { thumbUrl } from '../thumb'
 import { MediaThumb } from './MediaThumb'
 import { Hint } from './Hint'
 import { Select } from './Select'
+import { ScreenHeader, useScreenStyles } from './ui/Screen'
+import { EmptyState } from './ui/EmptyState'
+import { useFocusStyles } from './ui/focusRing'
+import { useTextStyles } from './ui/text'
+import { SPACE, ICON, META_SEP } from './ui/tokens'
+import { THUMB_SM } from '../thumbSizes'
 
 const useStyles = makeStyles({
   root: {
     display: 'flex',
     flexDirection: 'column',
-    gap: '12px'
+    gap: SPACE.section
   },
   header: {
     display: 'flex',
@@ -74,8 +81,8 @@ const useStyles = makeStyles({
   },
   thumb: {
     flexShrink: 0,
-    width: '72px',
-    height: '44px',
+    width: `${THUMB_SM.w}px`,
+    height: `${THUMB_SM.h}px`,
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
@@ -87,27 +94,15 @@ const useStyles = makeStyles({
     display: 'flex',
     flexDirection: 'column'
   },
-  title: {
-    fontWeight: tokens.fontWeightSemibold,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  meta: {
-    color: tokens.colorNeutralForeground3
-  },
   actions: {
     display: 'flex',
     gap: '4px',
-    flexShrink: 0
-  },
-  empty: {
-    display: 'flex',
-    flexDirection: 'column',
-    alignItems: 'center',
-    gap: '10px',
-    padding: '56px 16px',
-    textAlign: 'center'
+    flexShrink: 0,
+    // >=40px hit target for the icon-only row actions (W16).
+    '& button': {
+      minWidth: '40px',
+      minHeight: '40px'
+    }
   },
   emptyBadge: {
     width: '56px',
@@ -115,11 +110,9 @@ const useStyles = makeStyles({
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
-    borderRadius: '50%',
-    fontSize: '26px'
-  },
-  emptyHint: {
-    color: tokens.colorNeutralForeground3
+    borderRadius: tokens.borderRadiusCircular,
+    // Empty-state badge glyph, snapped to the nearest ICON tier (UI11).
+    fontSize: `${ICON.section}px`
   },
   noMatches: {
     padding: '32px 16px',
@@ -134,19 +127,11 @@ const KIND_FILTER_OPTIONS = [
   { value: 'audio', label: 'Audio' }
 ]
 
-function formatWhen(ts: number): string {
-  const d = new Date(ts)
-  const time = d.toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })
-  const now = new Date()
-  const startOfToday = new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime()
-  const dayMs = 1000 * 60 * 60 * 24
-  if (ts >= startOfToday) return `Today, ${time}`
-  if (ts >= startOfToday - dayMs) return `Yesterday, ${time}`
-  return d.toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' })
-}
-
 export function HistoryView(): React.JSX.Element {
   const styles = useStyles()
+  const screen = useScreenStyles()
+  const focus = useFocusStyles()
+  const text = useTextStyles()
   const isDark = useResolvedDark()
   const tc = thumbColors[isDark ? 'dark' : 'light']
   const entries = useHistory((s) => s.entries)
@@ -161,6 +146,8 @@ export function HistoryView(): React.JSX.Element {
   const [kindFilter, setKindFilter] = useState<'all' | MediaKind>('all')
   const [selectMode, setSelectMode] = useState(false)
   const [selected, setSelected] = useState<Set<string>>(new Set())
+  const [confirmClear, setConfirmClear] = useState(false)
+  const [confirmDelete, setConfirmDelete] = useState(false)
 
   const filtered = useMemo(() => {
     const q = query.trim().toLowerCase()
@@ -175,8 +162,31 @@ export function HistoryView(): React.JSX.Element {
     })
   }, [entries, query, kindFilter])
 
+  // Clear selections that are no longer visible after a filter change (L86).
+  useEffect(() => {
+    if (selected.size === 0) return
+    const visible = new Set(filtered.map((h) => h.id))
+    setSelected((prev) => {
+      const next = new Set([...prev].filter((id) => visible.has(id)))
+      return next.size === prev.size ? prev : next
+    })
+  }, [filtered])
+
   function redownload(h: HistoryEntry): void {
-    addFromUrl(h.url, h.kind, h.quality, { title: h.title, channel: h.channel })
+    // Strip compound format labels ("720p · mp4 · 184 MB" → "720p") when there is
+    // no stored formatId, so videoFormat() can still match the preset (H5).
+    const quality = (h.quality.split(' · ')[0] ?? h.quality).trim()
+    addFromUrl(h.url, h.kind, quality, {
+      title: h.title,
+      channel: h.channel,
+      thumbnail: h.thumbnail,
+      // Replay the original post-processing options (L87); undefined falls back to
+      // the global defaults for entries recorded before this was carried.
+      options: h.options,
+      format: h.formatId
+        ? { id: h.formatId, hasAudio: h.formatHasAudio ?? false, label: h.quality }
+        : undefined
+    })
   }
 
   function toggleSelected(id: string, on: boolean): void {
@@ -196,6 +206,7 @@ export function HistoryView(): React.JSX.Element {
   function exitSelectMode(): void {
     setSelectMode(false)
     setSelected(new Set())
+    setConfirmDelete(false)
   }
 
   function deleteSelected(): void {
@@ -205,21 +216,27 @@ export function HistoryView(): React.JSX.Element {
 
   if (entries.length === 0) {
     return (
-      <div className={styles.empty}>
-        <div
-          className={styles.emptyBadge}
-          style={{ backgroundColor: tc.video.bg, color: tc.video.fg }}
-        >
-          <HistoryRegular />
-        </div>
-        <Body1>No downloads yet.</Body1>
-        <Caption1 className={styles.emptyHint}>Finished downloads will show up here.</Caption1>
+      <div className={mergeClasses(styles.root, screen.width)}>
+        <ScreenHeader title="History" description="Files you've finished downloading." />
+        <EmptyState
+          icon={
+            <div
+              className={styles.emptyBadge}
+              style={{ backgroundColor: tc.video.bg, color: tc.video.fg }}
+            >
+              <HistoryRegular />
+            </div>
+          }
+          message="No downloads yet."
+          hint="Finished downloads will show up here."
+        />
       </div>
     )
   }
 
   return (
-    <div className={styles.root}>
+    <div className={mergeClasses(styles.root, screen.width)}>
+      <ScreenHeader title="History" description="Files you've finished downloading." />
       <div className={styles.header}>
         {selectMode ? (
           <>
@@ -228,18 +245,44 @@ export function HistoryView(): React.JSX.Element {
               {allFilteredSelected ? 'Select none' : 'Select all'}
             </Button>
             <div className={styles.spacer} />
-            <Button
-              size="small"
-              appearance="primary"
-              icon={<DeleteRegular />}
-              onClick={deleteSelected}
-              disabled={selected.size === 0}
-            >
-              Delete selected
-            </Button>
-            <Button size="small" appearance="subtle" icon={<DismissRegular />} onClick={exitSelectMode}>
-              Cancel
-            </Button>
+            {confirmDelete ? (
+              <>
+                <Caption1 className={styles.count}>
+                  Delete {selected.size} {selected.size === 1 ? 'entry' : 'entries'}?
+                </Caption1>
+                <Button
+                  size="small"
+                  appearance="primary"
+                  icon={<DeleteRegular />}
+                  onClick={deleteSelected}
+                >
+                  Delete
+                </Button>
+                <Button size="small" appearance="subtle" onClick={() => setConfirmDelete(false)}>
+                  Cancel
+                </Button>
+              </>
+            ) : (
+              <>
+                <Button
+                  size="small"
+                  appearance="primary"
+                  icon={<DeleteRegular />}
+                  onClick={() => setConfirmDelete(true)}
+                  disabled={selected.size === 0}
+                >
+                  Delete selected
+                </Button>
+                <Button
+                  size="small"
+                  appearance="subtle"
+                  icon={<DismissRegular />}
+                  onClick={exitSelectMode}
+                >
+                  Cancel
+                </Button>
+              </>
+            )}
           </>
         ) : (
           <>
@@ -248,6 +291,7 @@ export function HistoryView(): React.JSX.Element {
             </Caption1>
             <Input
               className={styles.search}
+              input={{ 'aria-label': 'Search history' }}
               size="small"
               value={query}
               onChange={(_, d) => setQuery(d.value)}
@@ -270,9 +314,36 @@ export function HistoryView(): React.JSX.Element {
             >
               Select
             </Button>
-            <Button size="small" appearance="subtle" icon={<DeleteRegular />} onClick={clear}>
-              Clear history
-            </Button>
+            {confirmClear ? (
+              <>
+                <Caption1 className={styles.count}>
+                  Clear all {entries.length} {entries.length === 1 ? 'entry' : 'entries'}?
+                </Caption1>
+                <Button
+                  size="small"
+                  appearance="primary"
+                  icon={<DeleteRegular />}
+                  onClick={() => {
+                    clear()
+                    setConfirmClear(false)
+                  }}
+                >
+                  Clear all
+                </Button>
+                <Button size="small" appearance="subtle" onClick={() => setConfirmClear(false)}>
+                  Cancel
+                </Button>
+              </>
+            ) : (
+              <Button
+                size="small"
+                appearance="subtle"
+                icon={<DeleteRegular />}
+                onClick={() => setConfirmClear(true)}
+              >
+                Clear history
+              </Button>
+            )}
           </>
         )}
       </div>
@@ -280,10 +351,33 @@ export function HistoryView(): React.JSX.Element {
       {filtered.length === 0 ? (
         <Caption1 className={styles.noMatches}>No downloads match your search.</Caption1>
       ) : (
-        <div className={styles.list}>
+        <div
+          className={styles.list}
+          onKeyDown={(e) => {
+            // W7: Ctrl/Cmd+A within the list selects every visible row (entering
+            // select mode if needed). Scoped to the list, so it never hijacks
+            // Ctrl+A in the search field, which lives in the header above.
+            if ((e.ctrlKey || e.metaKey) && (e.key === 'a' || e.key === 'A')) {
+              e.preventDefault()
+              setSelectMode(true)
+              setSelected(new Set(filtered.map((x) => x.id)))
+            }
+          }}
+        >
           {filtered.map((h: HistoryEntry) => {
             return (
-              <div key={h.id} className={styles.row}>
+              <div
+                key={h.id}
+                className={mergeClasses(styles.row, focus.focusRing)}
+                tabIndex={0}
+                onKeyDown={(e) => {
+                  // Delete removes the focused row (not when a child button is focused).
+                  if (e.key === 'Delete' && e.target === e.currentTarget) {
+                    e.preventDefault()
+                    remove(h.id)
+                  }
+                }}
+              >
                 {selectMode && (
                   <Checkbox
                     checked={selected.has(h.id)}
@@ -298,11 +392,11 @@ export function HistoryView(): React.JSX.Element {
                   iconSize={22}
                 />
                 <div className={styles.body}>
-                  <Text className={styles.title}>{h.title}</Text>
-                  <Caption1 className={styles.meta}>
+                  <Text className={text.title}>{h.title}</Text>
+                  <Caption1 className={text.muted}>
                     {[h.quality, h.sizeLabel, formatWhen(h.completedAt)]
                       .filter(Boolean)
-                      .join('  •  ')}
+                      .join(META_SEP)}
                   </Caption1>
                 </div>
                 <div className={styles.actions}>
diff --git a/src/renderer/src/components/LibraryView.tsx b/src/renderer/src/components/LibraryView.tsx
index 929b9ee..734d1fb 100644
--- a/src/renderer/src/components/LibraryView.tsx
+++ b/src/renderer/src/components/LibraryView.tsx
@@ -1,7 +1,5 @@
-import { useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import {
-  Subtitle2,
-  Body1,
   Caption1,
   Text,
   Input,
@@ -15,9 +13,8 @@ import {
   shorthands
 } from '@fluentui/react-components'
 import {
-  SearchRegular,
+  AddRegular,
   ArrowSyncRegular,
-  ArrowClockwiseRegular,
   DeleteRegular,
   ArrowDownloadRegular,
   ChevronDownRegular,
@@ -25,21 +22,30 @@ import {
   AppsListRegular,
   VideoClipMultipleRegular,
   AlertRegular,
-  LibraryRegular,
-  LinkRegular,
-  DismissRegular
+  LibraryRegular
 } from '@fluentui/react-icons'
-import type { MediaItem, Source } from '@shared/ipc'
+import type { MediaItem, Source, MediaKind } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
 import { useSources } from '../store/sources'
 import { useSettings } from '../store/settings'
+import { useNav } from '../store/nav'
 import { useClipboardLink, looksLikeSingleVideo } from '../useClipboardLink'
+import { logError } from '../reportError'
 import { useDownloads, type DownloadStatus } from '../store/downloads'
 import { thumbUrl } from '../thumb'
+import { relTime } from '../datetime'
 import { MediaThumb } from './MediaThumb'
 import { VirtualList } from './VirtualList'
-
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
+import { Hint } from './Hint'
+import { ScreenHeader, useScreenStyles } from './ui/Screen'
+import { StatusChip } from './ui/StatusChip'
+import { SegmentedControl } from './ui/SegmentedControl'
+import { EmptyState } from './ui/EmptyState'
+import { LinkSuggestion } from './ui/LinkSuggestion'
+import { useFocusStyles } from './ui/focusRing'
+import { useTextStyles } from './ui/text'
+import { SPACE, RADIUS, ICON, META_SEP } from './ui/tokens'
+import { THUMB_XS } from '../thumbSizes'
 
 /** Per-item status shown in the library: a live queue status, or pending/downloaded. */
 type ItemStatus = DownloadStatus | 'pending'
@@ -50,45 +56,28 @@ type ItemStatus = DownloadStatus | 'pending'
  * window cleanly (one virtualizer over a flat array, headers included).
  */
 type LibRow =
-  | { kind: 'header'; title: string; items: MediaItem[] }
-  | { kind: 'item'; item: MediaItem }
+  { kind: 'header'; title: string; items: MediaItem[] } | { kind: 'item'; item: MediaItem }
 
 /** Above this many flattened rows, the item list switches to a virtualized panel. */
 const VIRTUALIZE_AT = 100
 
-const STATUS_LABEL: Record<ItemStatus, string> = {
-  pending: 'Pending',
-  queued: 'Queued',
-  downloading: 'Downloading',
-  paused: 'Paused',
-  saved: 'Saved',
-  completed: 'Downloaded',
-  error: 'Failed',
-  canceled: 'Canceled'
+// When a URL appears more than once in the queue ("Download anyway" duplicates),
+// the library row should reflect the most meaningful state: a finished copy wins,
+// then anything in flight, then terminal failures (M17).
+const STATUS_PRIORITY: Record<DownloadStatus, number> = {
+  completed: 6,
+  downloading: 5,
+  queued: 4,
+  saved: 3,
+  paused: 2,
+  error: 1,
+  canceled: 0
 }
 
 const useStyles = makeStyles({
-  root: { display: 'flex', flexDirection: 'column', gap: '18px' },
-  header: { display: 'flex', flexDirection: 'column', gap: '2px' },
-  sub: { color: tokens.colorNeutralForeground3 },
+  root: { display: 'flex', flexDirection: 'column', gap: SPACE.section },
   addRow: { display: 'flex', gap: '8px' },
   addInput: { flexGrow: 1 },
-  suggestion: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px',
-    padding: '8px 8px 8px 12px',
-    backgroundColor: tokens.colorBrandBackground2,
-    color: tokens.colorBrandForeground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge)
-  },
-  suggestionText: {
-    flexGrow: 1,
-    minWidth: 0,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
   toolbar: {
     display: 'flex',
     alignItems: 'center',
@@ -111,15 +100,6 @@ const useStyles = makeStyles({
     fontSize: tokens.fontSizeBase200
   },
   error: { color: tokens.colorPaletteRedForeground1 },
-  empty: {
-    display: 'flex',
-    flexDirection: 'column',
-    alignItems: 'center',
-    gap: '8px',
-    padding: '56px 16px',
-    color: tokens.colorNeutralForeground3,
-    textAlign: 'center'
-  },
   list: { display: 'flex', flexDirection: 'column', gap: '10px' },
   card: {
     border: `1px solid ${tokens.colorNeutralStroke2}`,
@@ -132,6 +112,14 @@ const useStyles = makeStyles({
     alignItems: 'center',
     gap: '12px',
     padding: '12px 14px',
+    width: '100%',
+    border: 'none',
+    backgroundColor: 'transparent',
+    // A native <button> doesn't inherit color; set it so the chevron (currentColor)
+    // matches the page foreground in dark mode instead of UA ButtonText.
+    color: tokens.colorNeutralForeground1,
+    fontFamily: tokens.fontFamilyBase,
+    textAlign: 'left',
     cursor: 'pointer',
     ':hover': { backgroundColor: tokens.colorNeutralBackground1Hover }
   },
@@ -145,7 +133,8 @@ const useStyles = makeStyles({
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
-    fontSize: '18px'
+    // Source tile glyph, snapped to the nearest ICON tier (UI11 — no literal px).
+    fontSize: `${ICON.control}px`
   },
   srcMeta: { display: 'flex', flexDirection: 'column', minWidth: 0, flexGrow: 1 },
   srcTitleRow: { display: 'flex', alignItems: 'center', gap: '8px', minWidth: 0 },
@@ -158,7 +147,6 @@ const useStyles = makeStyles({
     backgroundColor: tokens.colorBrandBackground2,
     color: tokens.colorBrandForeground2
   },
-  srcSub: { color: tokens.colorNeutralForeground3 },
   detail: {
     borderTop: `1px solid ${tokens.colorNeutralStroke2}`,
     padding: '12px 14px',
@@ -172,9 +160,22 @@ const useStyles = makeStyles({
     display: 'flex',
     alignItems: 'center',
     gap: '8px',
-    padding: '6px 4px',
+    padding: '2px 4px'
+  },
+  groupToggle: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px',
+    flexGrow: 1,
+    minWidth: 0,
+    padding: '4px 4px',
+    border: 'none',
+    backgroundColor: 'transparent',
     color: tokens.colorNeutralForeground2,
     cursor: 'pointer',
+    fontFamily: tokens.fontFamilyBase,
+    fontSize: tokens.fontSizeBase300,
+    textAlign: 'left',
     ...shorthands.borderRadius(tokens.borderRadiusMedium),
     ':hover': { backgroundColor: tokens.colorNeutralBackground1Hover }
   },
@@ -187,38 +188,12 @@ const useStyles = makeStyles({
   },
   plainList: { display: 'flex', flexDirection: 'column' },
   rowThumb: {
-    width: '60px',
-    height: '34px',
-    ...shorthands.borderRadius(tokens.borderRadiusSmall)
+    width: `${THUMB_XS.w}px`,
+    height: `${THUMB_XS.h}px`,
+    // One thumbnail radius app-wide (UI6): control tier / Medium.
+    ...shorthands.borderRadius(RADIUS.control)
   },
-  rowMain: { display: 'flex', flexDirection: 'column', minWidth: 0, flexGrow: 1 },
-  rowTitle: {
-    whiteSpace: 'nowrap',
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    color: tokens.colorNeutralForeground1
-  },
-  rowMeta: { color: tokens.colorNeutralForeground3 },
-  pill: {
-    flexShrink: 0,
-    fontSize: tokens.fontSizeBase200,
-    padding: '1px 8px',
-    ...shorthands.borderRadius(tokens.borderRadiusCircular),
-    backgroundColor: tokens.colorNeutralBackground3,
-    color: tokens.colorNeutralForeground3
-  },
-  pillDownloading: {
-    backgroundColor: tokens.colorBrandBackground2,
-    color: tokens.colorBrandForeground2
-  },
-  pillCompleted: {
-    backgroundColor: tokens.colorPaletteGreenBackground2,
-    color: tokens.colorPaletteGreenForeground2
-  },
-  pillError: {
-    backgroundColor: tokens.colorPaletteRedBackground2,
-    color: tokens.colorPaletteRedForeground2
-  }
+  rowMain: { display: 'flex', flexDirection: 'column', minWidth: 0, flexGrow: 1 }
 })
 
 /** Group items by playlist, sorted by index within a group; 'Uploads' sinks last. */
@@ -241,18 +216,11 @@ function groupByPlaylist(items: MediaItem[]): { title: string; items: MediaItem[
   return groups
 }
 
-function relTime(ms?: number): string {
-  if (!ms) return 'never'
-  const mins = Math.round((Date.now() - ms) / 60000)
-  if (mins < 1) return 'just now'
-  if (mins < 60) return `${mins} min ago`
-  const hrs = Math.round(mins / 60)
-  if (hrs < 24) return `${hrs} h ago`
-  return `${Math.round(hrs / 24)} d ago`
-}
-
 export function LibraryView(): React.JSX.Element {
   const styles = useStyles()
+  const screen = useScreenStyles()
+  const focus = useFocusStyles()
+  const text = useTextStyles()
   const sources = useSources((s) => s.sources)
   const itemsBySource = useSources((s) => s.itemsBySource)
   const selectedSourceId = useSources((s) => s.selectedSourceId)
@@ -271,10 +239,32 @@ export function LibraryView(): React.JSX.Element {
 
   const [url, setUrl] = useState('')
   const [error, setError] = useState<string | null>(null)
+  const [confirmRemoveId, setConfirmRemoveId] = useState<string | null>(null)
+
+  // A channel/playlist URL handed over from the Downloads bar (UX3): pre-fill the
+  // add field with it once, so the user lands here ready to add it.
+  const pendingLibraryUrl = useNav((s) => s.pendingLibraryUrl)
+  const consumeLibraryUrl = useNav((s) => s.consumeLibraryUrl)
+  useEffect(() => {
+    if (pendingLibraryUrl === null) return
+    const handed = consumeLibraryUrl()
+    if (handed) setUrl(handed)
+  }, [pendingLibraryUrl, consumeLibraryUrl])
+
+  // Reset any pending Remove confirmation when the expanded source changes so a
+  // stale confirm can't reappear after navigating between sources.
+  useEffect(() => {
+    setConfirmRemoveId(null)
+  }, [selectedSourceId])
   // Offer a freshly-copied link the way the Downloads tab does, but skip single
-  // videos — a library source is a channel/playlist to sync, not a one-off.
+  // videos -- a library source is a channel/playlist to sync, not a one-off.
   const clip = useClipboardLink(url, (u) => !looksLikeSingleVideo(u))
   const [selected, setSelected] = useState<Set<string>>(new Set())
+  // Per-batch video/audio choice for queueing items, seeded from the global
+  // default so behavior is unchanged until the user flips it (M27).
+  const [enqueueKind, setEnqueueKind] = useState<MediaKind>(
+    () => useSettings.getState().defaultKind
+  )
   const [batchNote, setBatchNote] = useState<string | null>(null)
   const [syncNote, setSyncNote] = useState<string | null>(null)
   // Which playlist groups are expanded. Empty = all collapsed (the default), so
@@ -287,7 +277,10 @@ export function LibraryView(): React.JSX.Element {
   // Load the current scheduled-sync (Task Scheduler) state once.
   useEffect(() => {
     if (PREVIEW) return
-    window.api.getScheduledSync().then((s) => setScheduled(s.enabled)).catch(() => {})
+    window.api
+      .getScheduledSync()
+      .then((s) => setScheduled(s.enabled))
+      .catch(logError('getScheduledSync'))
   }, [])
 
   async function onCheckNew(): Promise<void> {
@@ -314,7 +307,13 @@ export function LibraryView(): React.JSX.Element {
   // Live per-URL queue status so a video row reflects its real download state.
   const statusByUrl = useMemo(() => {
     const m = new Map<string, DownloadStatus>()
-    for (const d of downloadItems) m.set(d.url, d.status)
+    for (const d of downloadItems) {
+      const prev = m.get(d.url)
+      // Keep the highest-priority status when a URL has duplicate queue entries.
+      if (prev === undefined || STATUS_PRIORITY[d.status] > STATUS_PRIORITY[prev]) {
+        m.set(d.url, d.status)
+      }
+    }
     return m
   }, [downloadItems])
 
@@ -322,8 +321,7 @@ export function LibraryView(): React.JSX.Element {
   const groups = useMemo(() => groupByPlaylist(items), [items])
   // A group is shown when toggled open, or auto-expanded when it's the only group
   // (a single "Uploads" channel shouldn't need a second click to reach its videos).
-  const isGroupOpen = (title: string): boolean =>
-    groups.length === 1 || expandedGroups.has(title)
+  const isGroupOpen = (title: string): boolean => groups.length === 1 || expandedGroups.has(title)
   // Flatten groups → [header, ...its items, header, ...] for the virtualized list.
   const flatRows = useMemo<LibRow[]>(() => {
     const rows: LibRow[] = []
@@ -360,7 +358,7 @@ export function LibraryView(): React.JSX.Element {
     if (!u || indexing.active) return
     const res = await indexSource(u)
     if (res.ok) setUrl('')
-    else setError(res.error ?? 'Could not index that link.')
+    else setError(res.error ?? 'Could not add that link.')
   }
 
   function toggle(id: string, on: boolean): void {
@@ -385,6 +383,9 @@ export function LibraryView(): React.JSX.Element {
     setSelected((prev) => {
       const next = new Set(prev)
       for (const it of groupItems) {
+        // Only actionable rows are selectable, so the selection count can never
+        // exceed what "Download N selected" will actually queue (M36).
+        if (!actionable(it)) continue
         if (on) next.add(it.id)
         else next.delete(it.id)
       }
@@ -397,18 +398,18 @@ export function LibraryView(): React.JSX.Element {
     setSelected(on ? new Set(actionableItems.map((it) => it.id)) : new Set())
   }
 
-  // One click queues every chosen item — maxConcurrent gates how many actually
+  // One click queues every chosen item -- maxConcurrent gates how many actually
   // run, the rest wait in the queue. Selection clears since nothing is held back.
   function downloadSelected(): void {
     if (!selectedSourceId || selectedActionable.length === 0) return
-    const n = enqueueItems(selectedSourceId, selectedActionable)
+    const n = enqueueItems(selectedSourceId, selectedActionable, enqueueKind)
     setSelected(new Set())
     setBatchNote(`Queued ${n} download${n === 1 ? '' : 's'}.`)
   }
 
   function downloadPending(): void {
     if (!selectedSourceId || pendingItems.length === 0) return
-    const n = enqueueItems(selectedSourceId, pendingItems)
+    const n = enqueueItems(selectedSourceId, pendingItems, enqueueKind)
     setBatchNote(`Queued ${n} download${n === 1 ? '' : 's'}.`)
   }
 
@@ -418,18 +419,11 @@ export function LibraryView(): React.JSX.Element {
     if (!selectedSourceId) return
     const toQueue = groupItems.filter(actionable)
     if (toQueue.length === 0) return
-    const n = enqueueItems(selectedSourceId, toQueue)
+    const n = enqueueItems(selectedSourceId, toQueue, enqueueKind)
     setBatchNote(`Queued ${n} download${n === 1 ? '' : 's'}.`)
   }
 
-  function pillClass(status: ItemStatus): string {
-    if (status === 'downloading' || status === 'queued') return mergeClasses(styles.pill, styles.pillDownloading)
-    if (status === 'completed') return mergeClasses(styles.pill, styles.pillCompleted)
-    if (status === 'error') return mergeClasses(styles.pill, styles.pillError)
-    return styles.pill
-  }
-
-  // One row of the item list — a playlist header or a video — shared by the
+  // One row of the item list -- a playlist header or a video -- shared by the
   // inline (small source) and virtualized (large source) render paths.
   function rowKey(row: LibRow): string {
     return row.kind === 'header' ? `h:${row.title}` : row.item.id
@@ -437,32 +431,27 @@ export function LibraryView(): React.JSX.Element {
 
   function renderRow(row: LibRow): React.JSX.Element {
     if (row.kind === 'header') {
-      const allOn = row.items.every((it) => selected.has(it.id))
       const open = isGroupOpen(row.title)
-      const groupActionable = row.items.filter(actionable).length
+      // "All on" is judged over the ACTIONABLE rows only -- downloaded rows aren't
+      // selectable, so they must not keep the group from reading as fully selected (M36).
+      const groupActionableItems = row.items.filter(actionable)
+      const groupActionable = groupActionableItems.length
+      const allOn = groupActionable > 0 && groupActionableItems.every((it) => selected.has(it.id))
       return (
-        <div
-          className={styles.groupHead}
-          onClick={() => toggleGroupExpand(row.title)}
-          role="button"
-          tabIndex={0}
-          onKeyDown={(e) =>
-            (e.key === 'Enter' || e.key === ' ') && toggleGroupExpand(row.title)
-          }
-          aria-expanded={open}
-        >
-          {open ? <ChevronDownRegular /> : <ChevronRightRegular />}
-          <AppsListRegular />
-          <span className={styles.groupTitle}>{row.title}</span>
-          <Caption1 className={styles.srcSub}>{row.items.length}</Caption1>
-          <Button
-            size="small"
-            appearance="subtle"
-            onClick={(e) => {
-              e.stopPropagation()
-              toggleGroup(row.items, !allOn)
-            }}
+        <div className={styles.groupHead}>
+          <button
+            type="button"
+            className={mergeClasses(styles.groupToggle, focus.focusRing)}
+            onClick={() => toggleGroupExpand(row.title)}
+            aria-expanded={open}
+            aria-label={`${row.title}, ${row.items.length} items`}
           >
+            {open ? <ChevronDownRegular /> : <ChevronRightRegular />}
+            <AppsListRegular />
+            <Text className={styles.groupTitle}>{row.title}</Text>
+            <Caption1 className={text.muted}>{row.items.length}</Caption1>
+          </button>
+          <Button size="small" appearance="subtle" onClick={() => toggleGroup(row.items, !allOn)}>
             {allOn ? 'None' : 'All'}
           </Button>
           <Button
@@ -470,10 +459,7 @@ export function LibraryView(): React.JSX.Element {
             appearance="subtle"
             icon={<ArrowDownloadRegular />}
             disabled={groupActionable === 0}
-            onClick={(e) => {
-              e.stopPropagation()
-              downloadGroup(row.items)
-            }}
+            onClick={() => downloadGroup(row.items)}
           >
             Download{groupActionable > 0 ? ` ${groupActionable}` : ''}
           </Button>
@@ -486,6 +472,7 @@ export function LibraryView(): React.JSX.Element {
       <div className={styles.row}>
         <Checkbox
           checked={selected.has(it.id)}
+          disabled={!actionable(it)}
           onChange={(_, d) => toggle(it.id, !!d.checked)}
           aria-label={`Select ${it.title}`}
         />
@@ -496,32 +483,31 @@ export function LibraryView(): React.JSX.Element {
           iconSize={16}
         />
         <div className={styles.rowMain}>
-          <span className={styles.rowTitle}>
+          <Text className={text.truncate}>
             {it.playlistIndex}. {it.title}
-          </span>
-          {it.durationLabel && <Caption1 className={styles.rowMeta}>{it.durationLabel}</Caption1>}
+          </Text>
+          {it.durationLabel && <Caption1 className={text.muted}>{it.durationLabel}</Caption1>}
         </div>
-        <span className={pillClass(status)}>{STATUS_LABEL[status]}</span>
+        <StatusChip status={status} />
       </div>
     )
   }
 
   return (
-    <div className={styles.root}>
-      <div className={styles.header}>
-        <Subtitle2>Library</Subtitle2>
-        <Caption1 className={styles.sub}>
-          Index a channel or playlist once, then download it into organized folders.
-        </Caption1>
-      </div>
+    <div className={mergeClasses(styles.root, screen.width)}>
+      <ScreenHeader
+        title="Library"
+        description="Add a channel or playlist once, then download its videos into organized folders."
+      />
 
       <div className={styles.addRow}>
         <Input
           className={styles.addInput}
+          input={{ 'aria-label': 'Channel or playlist URL' }}
           value={url}
           onChange={(_, d) => setUrl(d.value)}
           onKeyDown={(e) => e.key === 'Enter' && onIndex()}
-          placeholder="Paste a channel or playlist URL…"
+          placeholder="Paste a channel or playlist URL to add it…"
           size="large"
           contentBefore={<LibraryRegular />}
           disabled={indexing.active}
@@ -529,49 +515,51 @@ export function LibraryView(): React.JSX.Element {
         <Button
           size="large"
           appearance="primary"
-          icon={indexing.active ? <Spinner size="tiny" /> : <SearchRegular />}
+          icon={indexing.active ? <Spinner size="tiny" /> : <AddRegular />}
           onClick={onIndex}
           disabled={!url.trim() || indexing.active}
         >
-          Index
+          Add
         </Button>
       </div>
 
       {clip.suggestion && (
-        <div className={styles.suggestion}>
-          <LinkRegular />
-          <Caption1 className={styles.suggestionText}>Use copied link? {clip.suggestion}</Caption1>
-          <Button
-            size="small"
-            appearance="primary"
-            onClick={() => {
-              const link = clip.accept()
-              if (link) setUrl(link)
-            }}
-          >
-            Use
-          </Button>
-          <Button
-            size="small"
-            appearance="subtle"
-            icon={<DismissRegular />}
-            onClick={clip.dismiss}
-            aria-label="Dismiss"
-          />
-        </div>
+        <LinkSuggestion
+          prefix="Use copied link? "
+          link={clip.suggestion}
+          onAccept={() => {
+            const link = clip.accept()
+            if (link) setUrl(link)
+          }}
+          onDismiss={clip.dismiss}
+          dismissLabel="Dismiss suggested link"
+        />
       )}
 
       <div className={styles.toolbar}>
-        <Button
-          size="small"
-          appearance="secondary"
-          icon={syncing ? <Spinner size="tiny" /> : <ArrowClockwiseRegular />}
-          onClick={onCheckNew}
-          disabled={syncing || watchedCount === 0}
+        <Hint
+          label={
+            watchedCount === 0
+              ? 'Turn on "Watch" for a channel or playlist below first, then this checks them for new uploads.'
+              : 'Check your watched sources for new uploads'
+          }
+          placement="top"
+          align="start"
         >
-          Check {watchedCount > 0 ? `${watchedCount} watched` : 'watched'} for new
-        </Button>
-        {syncNote && <Caption1 className={styles.sub}>{syncNote}</Caption1>}
+          <Button
+            size="small"
+            appearance="subtle"
+            icon={syncing ? <Spinner size="tiny" /> : <ArrowSyncRegular />}
+            onClick={onCheckNew}
+            // disabledFocusable (not disabled) when nothing is watched, so the
+            // button still shows its explanatory tooltip on hover/focus (UX24).
+            disabled={syncing}
+            disabledFocusable={watchedCount === 0}
+          >
+            Check {watchedCount > 0 ? `${watchedCount} watched` : 'watched'} for new
+          </Button>
+        </Hint>
+        {syncNote && <Caption1 className={text.muted}>{syncNote}</Caption1>}
         <div className={styles.toolbarSpacer} />
         <span className={styles.switchRow}>
           <Caption1>Auto-download new</Caption1>
@@ -595,7 +583,7 @@ export function LibraryView(): React.JSX.Element {
         <div className={styles.progress}>
           <Spinner size="tiny" />
           <Text>
-            {indexing.message ?? 'Indexing…'}
+            {indexing.message ?? 'Adding…'}
             {indexing.current && indexing.total ? `  (${indexing.current}/${indexing.total})` : ''}
           </Text>
         </div>
@@ -603,10 +591,10 @@ export function LibraryView(): React.JSX.Element {
       {error && <Caption1 className={styles.error}>{error}</Caption1>}
 
       {sources.length === 0 && !indexing.active ? (
-        <div className={styles.empty}>
-          <LibraryRegular fontSize={40} />
-          <Body1>No channels or playlists yet. Paste one above to index it.</Body1>
-        </div>
+        <EmptyState
+          icon={<LibraryRegular fontSize={ICON.hero} />}
+          message="No channels or playlists yet. Paste one above to add it."
+        />
       ) : (
         <div className={styles.list}>
           {sources.map((src) => (
@@ -615,9 +603,7 @@ export function LibraryView(): React.JSX.Element {
               styles={styles}
               source={src}
               expanded={selectedSourceId === src.id}
-              onToggleExpand={() =>
-                selectSource(selectedSourceId === src.id ? null : src.id)
-              }
+              onToggleExpand={() => selectSource(selectedSourceId === src.id ? null : src.id)}
             >
               <div className={styles.detail}>
                 <div className={styles.actionRow}>
@@ -627,14 +613,27 @@ export function LibraryView(): React.JSX.Element {
                     label="Select all"
                     disabled={actionableItems.length === 0}
                   />
-                  <Caption1 className={styles.srcSub}>
-                    {items.length} videos · {pendingItems.length} pending · indexed{' '}
-                    {relTime(src.lastIndexedAt)}
+                  <Caption1 className={text.muted}>
+                    {items.length} videos{META_SEP}
+                    {pendingItems.length} pending{META_SEP}indexed {relTime(src.lastIndexedAt)}
                   </Caption1>
                   <div className={styles.actionSpacer} />
+                  <SegmentedControl<MediaKind>
+                    value={enqueueKind}
+                    options={[
+                      { value: 'video', label: 'Video' },
+                      { value: 'audio', label: 'Audio' }
+                    ]}
+                    onChange={setEnqueueKind}
+                    ariaLabel="Download as video or audio"
+                  />
                   {selected.size > 0 ? (
                     <>
-                      <Button size="small" appearance="subtle" onClick={() => setSelected(new Set())}>
+                      <Button
+                        size="small"
+                        appearance="subtle"
+                        onClick={() => setSelected(new Set())}
+                      >
                         Clear
                       </Button>
                       <Button
@@ -673,19 +672,43 @@ export function LibraryView(): React.JSX.Element {
                     onClick={() => reindexSource(src.id)}
                     disabled={indexing.active}
                   >
-                    Re-index
-                  </Button>
-                  <Button
-                    size="small"
-                    appearance="subtle"
-                    icon={<DeleteRegular />}
-                    onClick={() => removeSource(src.id)}
-                  >
-                    Remove
+                    Refresh
                   </Button>
+                  {confirmRemoveId === src.id ? (
+                    <>
+                      <Caption1 className={text.muted}>Remove {src.title}?</Caption1>
+                      <Button
+                        size="small"
+                        appearance="primary"
+                        icon={<DeleteRegular />}
+                        onClick={() => {
+                          removeSource(src.id)
+                          setConfirmRemoveId(null)
+                        }}
+                      >
+                        Remove
+                      </Button>
+                      <Button
+                        size="small"
+                        appearance="subtle"
+                        onClick={() => setConfirmRemoveId(null)}
+                      >
+                        Cancel
+                      </Button>
+                    </>
+                  ) : (
+                    <Button
+                      size="small"
+                      appearance="subtle"
+                      icon={<DeleteRegular />}
+                      onClick={() => setConfirmRemoveId(src.id)}
+                    >
+                      Remove
+                    </Button>
+                  )}
                 </div>
 
-                {batchNote && <Caption1 className={styles.srcSub}>{batchNote}</Caption1>}
+                {batchNote && <Caption1 className={text.muted}>{batchNote}</Caption1>}
 
                 {flatRows.length > VIRTUALIZE_AT ? (
                   // Big source: a fixed-height, internally-scrolling virtualized
@@ -695,7 +718,7 @@ export function LibraryView(): React.JSX.Element {
                     items={flatRows}
                     style={{ height: '58vh' }}
                     overscan={10}
-                    estimateSize={(i) => (flatRows[i].kind === 'header' ? 40 : 46)}
+                    estimateSize={(i) => (flatRows[i]?.kind === 'header' ? 40 : 46)}
                     getKey={(row) => rowKey(row)}
                     renderItem={(row) => renderRow(row)}
                   />
@@ -730,15 +753,16 @@ function SourceCard({
   onToggleExpand: () => void
   children: React.ReactNode
 }): React.JSX.Element {
+  const focus = useFocusStyles()
+  const text = useTextStyles()
   return (
     <div className={styles.card}>
-      <div
-        className={styles.cardHead}
+      <button
+        type="button"
+        className={mergeClasses(styles.cardHead, focus.focusRing)}
         onClick={onToggleExpand}
-        role="button"
-        tabIndex={0}
-        onKeyDown={(e) => (e.key === 'Enter' || e.key === ' ') && onToggleExpand()}
         aria-expanded={expanded}
+        aria-label={source.title}
       >
         {expanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
         <div className={styles.srcIcon}>
@@ -746,19 +770,23 @@ function SourceCard({
         </div>
         <div className={styles.srcMeta}>
           <span className={styles.srcTitleRow}>
-            <span className={styles.srcTitle}>{source.title}</span>
+            <Text className={styles.srcTitle}>{source.title}</Text>
             {source.watched && (
               <span className={styles.watchBadge}>
                 <AlertRegular fontSize={11} /> Watching
               </span>
             )}
           </span>
-          <Caption1 className={styles.srcSub}>
-            {source.kind === 'channel' ? 'Channel' : 'Playlist'} · {source.itemCount} videos
-            {source.channel && source.channel !== source.title ? ` · ${source.channel}` : ''}
+          <Caption1 className={text.muted}>
+            {source.kind === 'channel' ? 'Channel' : 'Playlist'}
+            {META_SEP}
+            {source.itemCount} videos
+            {source.channel && source.channel !== source.title
+              ? `${META_SEP}${source.channel}`
+              : ''}
           </Caption1>
         </div>
-      </div>
+      </button>
       {expanded && children}
     </div>
   )
diff --git a/src/renderer/src/components/LiveRegion.tsx b/src/renderer/src/components/LiveRegion.tsx
new file mode 100644
index 0000000..57cc21e
--- /dev/null
+++ b/src/renderer/src/components/LiveRegion.tsx
@@ -0,0 +1,52 @@
+import { useEffect, useRef, useState } from 'react'
+import { makeStyles } from '@fluentui/react-components'
+import { useDownloads, type DownloadStatus } from '../store/downloads'
+
+const useStyles = makeStyles({
+  // Visually hidden, but present for screen readers (the standard sr-only recipe).
+  srOnly: {
+    position: 'absolute',
+    width: '1px',
+    height: '1px',
+    padding: 0,
+    margin: '-1px',
+    overflow: 'hidden',
+    clip: 'rect(0, 0, 0, 0)',
+    whiteSpace: 'nowrap'
+  }
+})
+
+/**
+ * A polite ARIA live region (W17) so Narrator announces download completions and
+ * failures even when the user isn't on the Downloads tab. Subscribes to the store
+ * directly and announces only terminal transitions (→ completed / error), so it
+ * never chatters on progress ticks. Mounted once, near the app root.
+ */
+export function LiveRegion(): React.JSX.Element {
+  const styles = useStyles()
+  const [message, setMessage] = useState('')
+  const prev = useRef<Map<string, DownloadStatus>>(new Map())
+
+  useEffect(() => {
+    function check(items: ReturnType<typeof useDownloads.getState>['items']): void {
+      const announcements: string[] = []
+      for (const it of items) {
+        if (prev.current.get(it.id) !== it.status) {
+          if (it.status === 'completed') announcements.push(`Finished downloading ${it.title}`)
+          else if (it.status === 'error') announcements.push(`Download failed: ${it.title}`)
+        }
+      }
+      prev.current = new Map(items.map((i) => [i.id, i.status]))
+      if (announcements.length > 0) setMessage(announcements.join('. '))
+    }
+    // Seed the baseline without announcing the items already present on mount.
+    prev.current = new Map(useDownloads.getState().items.map((i) => [i.id, i.status]))
+    return useDownloads.subscribe((st) => check(st.items))
+  }, [])
+
+  return (
+    <div className={styles.srOnly} role="status" aria-live="polite" aria-atomic="true">
+      {message}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/MediaThumb.tsx b/src/renderer/src/components/MediaThumb.tsx
index 3b1b044..727d66c 100644
--- a/src/renderer/src/components/MediaThumb.tsx
+++ b/src/renderer/src/components/MediaThumb.tsx
@@ -41,7 +41,7 @@ export function MediaThumb({
 }): React.JSX.Element {
   const styles = useStyles()
   const isDark = useResolvedDark()
-  const colors = thumbColors[isDark ? 'dark' : 'light'][kind === 'audio' ? 'audio' : 'video']
+  const colors = thumbColors[isDark ? 'dark' : 'light'][kind]
   const [failedSrc, setFailedSrc] = useState<string | null>(null)
   const showImg = !!src && failedSrc !== src
 
@@ -53,13 +53,7 @@ export function MediaThumb({
       style={{ backgroundColor: colors.bg, color: colors.fg }}
     >
       {showImg ? (
-        <img
-          className={styles.img}
-          src={src}
-          alt=""
-          loading="lazy"
-          onError={() => setFailedSrc(src ?? null)}
-        />
+        <img className={styles.img} src={src} alt="" onError={() => setFailedSrc(src ?? null)} />
       ) : kind === 'audio' ? (
         <MusicNote2Regular fontSize={iconSize} />
       ) : (
diff --git a/src/renderer/src/components/Onboarding.tsx b/src/renderer/src/components/Onboarding.tsx
index 82697da..97872b1 100644
--- a/src/renderer/src/components/Onboarding.tsx
+++ b/src/renderer/src/components/Onboarding.tsx
@@ -6,6 +6,7 @@ import {
   Field,
   Button,
   makeStyles,
+  mergeClasses,
   tokens,
   shorthands
 } from '@fluentui/react-components'
@@ -14,9 +15,14 @@ import {
   ClipboardPasteRegular,
   HistoryRegular,
   OptionsRegular,
-  RocketRegular
+  RocketRegular,
+  FolderRegular,
+  MusicNote2Regular,
+  VideoClipRegular,
+  KeyboardRegular
 } from '@fluentui/react-icons'
 import { useSettings } from '../store/settings'
+import { SPACE, ICON } from './ui/tokens'
 
 const useStyles = makeStyles({
   root: {
@@ -26,13 +32,14 @@ const useStyles = makeStyles({
     alignItems: 'center',
     justifyContent: 'center',
     overflowY: 'auto',
-    padding: '24px'
+    padding: SPACE.page
   },
   card: {
     display: 'flex',
     flexDirection: 'column',
-    gap: '20px',
-    padding: '32px',
+    gap: SPACE.roomy,
+    // The welcome hero card (UI3 hero tier).
+    padding: SPACE.hero,
     maxWidth: '460px',
     width: '100%',
     ...shorthands.borderRadius(tokens.borderRadiusXLarge)
@@ -52,10 +59,45 @@ const useStyles = makeStyles({
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
-    fontSize: '26px'
+    // Brand tile glyph, snapped to the nearest ICON tier (UI11 — no literal px).
+    fontSize: `${ICON.section}px`
   },
   folderNote: {
-    color: tokens.colorNeutralForeground3
+    color: tokens.colorNeutralForeground3,
+    marginBottom: SPACE.tight
+  },
+  folderRow: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '10px',
+    padding: '8px 10px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusMedium),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  },
+  folderRowGap: {
+    marginTop: SPACE.tight
+  },
+  folderIcon: {
+    fontSize: `${ICON.control}px`,
+    flexShrink: 0,
+    color: tokens.colorCompoundBrandForeground1
+  },
+  folderCol: {
+    display: 'flex',
+    flexDirection: 'column',
+    minWidth: 0,
+    flexGrow: 1
+  },
+  folderLabel: {
+    fontWeight: tokens.fontWeightSemibold,
+    color: tokens.colorNeutralForeground1
+  },
+  folderPath: {
+    color: tokens.colorNeutralForeground3,
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+    whiteSpace: 'nowrap'
   },
   tips: {
     display: 'flex',
@@ -68,9 +110,9 @@ const useStyles = makeStyles({
     gap: '10px'
   },
   tipIcon: {
-    fontSize: '18px',
+    fontSize: `${ICON.control}px`,
     flexShrink: 0,
-    marginTop: '2px',
+    marginTop: SPACE.hairline,
     color: tokens.colorCompoundBrandForeground1
   }
 })
@@ -78,7 +120,7 @@ const useStyles = makeStyles({
 const TIPS: { icon: React.JSX.Element; text: string }[] = [
   {
     icon: <ClipboardPasteRegular />,
-    text: 'Copy a video link and AeroFetch offers to fetch it as soon as you switch back.'
+    text: 'Turn on clipboard detection in Settings and AeroFetch will offer to fetch links you copy.'
   },
   {
     icon: <HistoryRegular />,
@@ -87,12 +129,19 @@ const TIPS: { icon: React.JSX.Element; text: string }[] = [
   {
     icon: <OptionsRegular />,
     text: 'Subtitles, SponsorBlock, custom yt-dlp commands, and more live in Settings.'
+  },
+  {
+    icon: <KeyboardRegular />,
+    text: 'Press Ctrl+K anytime to jump to any screen or start a new download.'
   }
 ]
 
 export function Onboarding(): React.JSX.Element {
   const styles = useStyles()
   const update = useSettings((s) => s.update)
+  const videoDir = useSettings((s) => s.videoDir)
+  const audioDir = useSettings((s) => s.audioDir)
+  const chooseDir = useSettings((s) => s.chooseDir)
 
   return (
     <div className={styles.root}>
@@ -101,7 +150,7 @@ export function Onboarding(): React.JSX.Element {
           <div className={styles.mark}>
             <ArrowDownloadFilled />
           </div>
-          <Title2>Welcome to AeroFetch</Title2>
+          <Title2 as="h1">Welcome to AeroFetch</Title2>
         </div>
 
         <Body1>
@@ -111,10 +160,33 @@ export function Onboarding(): React.JSX.Element {
 
         <Field label="Where downloads go">
           <Caption1 className={styles.folderNote}>
-            Videos save to your <strong>Documents\Video</strong> folder and audio to{' '}
-            <strong>Documents\Audio</strong>. You can point each to a different folder any time
-            in Settings.
+            Videos and audio save to your Documents folders by default. Pick a different folder now,
+            or change it any time in Settings.
           </Caption1>
+          <div className={styles.folderRow}>
+            <VideoClipRegular className={styles.folderIcon} />
+            <div className={styles.folderCol}>
+              <Caption1 className={styles.folderLabel}>Video</Caption1>
+              <Caption1 className={styles.folderPath} title={videoDir || 'Documents\\Video'}>
+                {videoDir || 'Documents\\Video'}
+              </Caption1>
+            </div>
+            <Button size="small" icon={<FolderRegular />} onClick={() => chooseDir('videoDir')}>
+              Choose…
+            </Button>
+          </div>
+          <div className={mergeClasses(styles.folderRow, styles.folderRowGap)}>
+            <MusicNote2Regular className={styles.folderIcon} />
+            <div className={styles.folderCol}>
+              <Caption1 className={styles.folderLabel}>Audio</Caption1>
+              <Caption1 className={styles.folderPath} title={audioDir || 'Documents\\Audio'}>
+                {audioDir || 'Documents\\Audio'}
+              </Caption1>
+            </div>
+            <Button size="small" icon={<FolderRegular />} onClick={() => chooseDir('audioDir')}>
+              Choose…
+            </Button>
+          </div>
         </Field>
 
         <div className={styles.tips}>
diff --git a/src/renderer/src/components/QueueItem.tsx b/src/renderer/src/components/QueueItem.tsx
index cdf2297..d104680 100644
--- a/src/renderer/src/components/QueueItem.tsx
+++ b/src/renderer/src/components/QueueItem.tsx
@@ -1,12 +1,12 @@
-import { memo } from 'react'
+import { memo } from 'react'
 import {
   Text,
   Caption1,
   Button,
   ProgressBar,
-  Badge,
   Spinner,
   makeStyles,
+  mergeClasses,
   tokens,
   shorthands
 } from '@fluentui/react-components'
@@ -25,28 +25,38 @@ import {
   ErrorCircleFilled,
   EyeOffRegular
 } from '@fluentui/react-icons'
-import { useDownloads, type DownloadItem, type DownloadStatus } from '../store/downloads'
+import { useShallow } from 'zustand/react/shallow'
+import { useDownloads, type DownloadItem } from '../store/downloads'
 import { thumbUrl } from '../thumb'
+import { fmtSchedule } from '../datetime'
+import { fmtSpeed, fmtEta } from '@shared/format'
 import { MediaThumb } from './MediaThumb'
 import { Hint } from './Hint'
+import { StatusChip } from './ui/StatusChip'
+import { useFocusStyles } from './ui/focusRing'
+import { useTextStyles } from './ui/text'
+import { SPACE, RADIUS, ICON, META_SEP } from './ui/tokens'
+import { THUMB_MD } from '../thumbSizes'
 
 const useStyles = makeStyles({
   root: {
     display: 'flex',
     gap: '14px',
-    padding: '14px',
+    // List-item card: card padding + list-item radius (UI3/UI7).
+    padding: SPACE.section,
     backgroundColor: tokens.colorNeutralBackground1,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    ...shorthands.borderRadius(RADIUS.surface),
     border: `1px solid ${tokens.colorNeutralStroke2}`
   },
   thumb: {
     flexShrink: 0,
-    width: '108px',
-    height: '64px',
+    width: `${THUMB_MD.w}px`,
+    height: `${THUMB_MD.h}px`,
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
-    ...shorthands.borderRadius(tokens.borderRadiusLarge)
+    // One thumbnail radius app-wide (UI6): control tier / Medium.
+    ...shorthands.borderRadius(RADIUS.control)
   },
   body: {
     flexGrow: 1,
@@ -60,20 +70,11 @@ const useStyles = makeStyles({
     alignItems: 'center',
     gap: '8px'
   },
-  title: {
-    fontWeight: tokens.fontWeightSemibold,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  meta: {
-    color: tokens.colorNeutralForeground3
-  },
   progressRow: {
     display: 'flex',
     alignItems: 'center',
     gap: '10px',
-    marginTop: '4px'
+    marginTop: SPACE.xtight
   },
   progressBar: {
     flexGrow: 1
@@ -88,63 +89,88 @@ const useStyles = makeStyles({
   actions: {
     display: 'flex',
     alignItems: 'center',
-    gap: '4px',
-    flexShrink: 0
+    gap: SPACE.xtight,
+    flexShrink: 0,
+    // Icon-only row actions get a >=40px hit target for touch/pen (W16); the
+    // glyph stays its normal size, the subtle button just carries more padding.
+    '& button': {
+      minWidth: '40px',
+      minHeight: '40px'
+    }
   }
 })
 
-const STATUS_BADGE: Record<DownloadStatus, { label: string; color: 'brand' | 'success' | 'danger' | 'warning' | 'subtle' }> = {
-  queued: { label: 'Queued', color: 'subtle' },
-  downloading: { label: 'Downloading', color: 'brand' },
-  paused: { label: 'Paused', color: 'warning' },
-  saved: { label: 'Saved', color: 'subtle' },
-  completed: { label: 'Completed', color: 'success' },
-  error: { label: 'Failed', color: 'danger' },
-  canceled: { label: 'Canceled', color: 'warning' }
-}
-
 function pct(progress: number): string {
   return `${Math.round(progress * 100)}%`
 }
 
-function fmtSchedule(ms: number): string {
-  try {
-    return new Date(ms).toLocaleString([], { dateStyle: 'medium', timeStyle: 'short' })
-  } catch {
-    return ''
-  }
-}
-
 export const QueueItem = memo(function QueueItem({
   item
 }: {
   item: DownloadItem
 }): React.JSX.Element {
   const styles = useStyles()
-  const cancel = useDownloads((s) => s.cancel)
-  const pause = useDownloads((s) => s.pause)
-  const resume = useDownloads((s) => s.resume)
-  const prioritize = useDownloads((s) => s.prioritize)
-  const saveForLater = useDownloads((s) => s.saveForLater)
-  const queueNow = useDownloads((s) => s.queueNow)
-  const remove = useDownloads((s) => s.remove)
-  const retry = useDownloads((s) => s.retry)
-  const openFile = useDownloads((s) => s.openFile)
-  const showInFolder = useDownloads((s) => s.showInFolder)
+  const focus = useFocusStyles()
+  const text = useTextStyles()
+  // One shallow-compared selection instead of 10 separate subscriptions per row
+  // (L163). The actions are stable, so this never re-renders from the store.
+  const {
+    cancel,
+    pause,
+    resume,
+    prioritize,
+    saveForLater,
+    queueNow,
+    remove,
+    retry,
+    openFile,
+    showInFolder
+  } = useDownloads(
+    useShallow((s) => ({
+      cancel: s.cancel,
+      pause: s.pause,
+      resume: s.resume,
+      prioritize: s.prioritize,
+      saveForLater: s.saveForLater,
+      queueNow: s.queueNow,
+      remove: s.remove,
+      retry: s.retry,
+      openFile: s.openFile,
+      showInFolder: s.showInFolder
+    }))
+  )
 
-  const badge = STATUS_BADGE[item.status]
   const active = item.status === 'downloading' || item.status === 'queued'
 
+  // W7: Delete on a focused row removes it -- cancelling first if it's still running,
+  // since an in-flight download can't just be dropped from the list. Only when the
+  // row itself holds focus, so Delete on one of its action buttons is unaffected.
+  function onKeyDown(e: React.KeyboardEvent): void {
+    if (e.key === 'Delete' && e.target === e.currentTarget) {
+      e.preventDefault()
+      if (active) cancel(item.id)
+      else remove(item.id)
+    }
+  }
+
+  // Format the raw progress numbers for display (H4: main sends bytes/sec + secs,
+  // the renderer owns formatting via the one shared formatter).
+  const speedLabel = fmtSpeed(item.speedBytesPerSec)
+  const etaLabel = fmtEta(item.etaSeconds)
+
+  // L55: a probed-format quality label already carries the size ("720p · mp4 ·
+  // 184 MB"); skip sizeLabel when it's already embedded to avoid showing it twice.
+  const sizeAlreadyInQuality = item.sizeLabel && item.quality.includes(item.sizeLabel)
   const metaParts = [
     item.channel,
     item.durationLabel,
     item.quality,
     item.kind === 'audio' ? 'Audio' : 'Video',
-    item.sizeLabel
+    !sizeAlreadyInQuality ? item.sizeLabel : undefined
   ].filter(Boolean)
 
   return (
-    <div className={styles.root}>
+    <div className={mergeClasses(styles.root, focus.focusRing)} tabIndex={0} onKeyDown={onKeyDown}>
       <MediaThumb
         className={styles.thumb}
         src={thumbUrl({ thumbnail: item.thumbnail, url: item.url })}
@@ -156,57 +182,82 @@ export const QueueItem = memo(function QueueItem({
         <div className={styles.titleRow}>
           {item.status === 'completed' && (
             <CheckmarkCircleFilled
-              fontSize={16}
+              fontSize={ICON.inline}
               style={{ color: tokens.colorPaletteGreenForeground1, flexShrink: 0 }}
             />
           )}
           {item.status === 'error' && (
             <ErrorCircleFilled
-              fontSize={16}
+              fontSize={ICON.inline}
               style={{ color: tokens.colorPaletteRedForeground1, flexShrink: 0 }}
             />
           )}
-          <Text className={styles.title}>{item.title}</Text>
-          <Badge appearance="tint" color={badge.color}>
-            {badge.label}
-          </Badge>
+          <Text className={text.title}>{item.title}</Text>
+          <StatusChip status={item.status} />
           {item.incognito && (
-            <Hint label="Private — not saved to history" placement="top" align="start">
-              <EyeOffRegular fontSize={14} style={{ color: tokens.colorNeutralForeground3 }} />
+            <Hint label="Private -- not saved to history" placement="top" align="start">
+              <EyeOffRegular
+                fontSize={ICON.inline}
+                style={{ color: tokens.colorNeutralForeground3 }}
+              />
             </Hint>
           )}
         </div>
 
-        <Caption1 className={styles.meta}>{metaParts.join('  •  ')}</Caption1>
+        <Caption1 className={text.muted}>{metaParts.join(META_SEP)}</Caption1>
 
         {item.status === 'downloading' && (
           <div className={styles.progressRow}>
-            <ProgressBar className={styles.progressBar} value={item.progress} thickness="large" />
+            {/* Indeterminate when finishing (the second stream / merge reads as
+                "working" rather than a 0→100% restart, SR7) or when yt-dlp can't
+                report a total size, so the bar never sits frozen at 0% (L137). */}
+            <ProgressBar
+              className={styles.progressBar}
+              value={item.finishing || item.sizeUnknown ? undefined : item.progress}
+              thickness="large"
+              aria-label={`Download progress for ${item.title ?? item.url}`}
+            />
             <Caption1 className={styles.stats}>
-              {pct(item.progress)}
-              {item.speed ? `  •  ${item.speed}` : ''}
-              {item.eta ? `  •  ${item.eta} left` : ''}
+              {item.finishing ? (
+                'Finishing…'
+              ) : (
+                <>
+                  {item.sizeUnknown ? 'Downloading…' : pct(item.progress)}
+                  {speedLabel ? `${META_SEP}${speedLabel}` : ''}
+                  {etaLabel ? `${META_SEP}${etaLabel} left` : ''}
+                </>
+              )}
             </Caption1>
           </div>
         )}
 
         {item.status === 'queued' && (
           <div className={styles.progressRow}>
-            <Spinner size="extra-tiny" />
+            <Spinner size="tiny" />
             <Caption1 className={styles.stats}>Waiting to start…</Caption1>
           </div>
         )}
 
         {item.status === 'paused' && (
           <div className={styles.progressRow}>
-            <ProgressBar className={styles.progressBar} value={item.progress} thickness="large" />
-            <Caption1 className={styles.stats}>Paused • {pct(item.progress)}</Caption1>
+            <ProgressBar
+              className={styles.progressBar}
+              value={item.progress}
+              thickness="large"
+              aria-label={`Download progress for ${item.title ?? item.url}`}
+            />
+            <Caption1 className={styles.stats}>
+              Paused{META_SEP}
+              {pct(item.progress)}
+            </Caption1>
           </div>
         )}
 
         {item.status === 'saved' && (
           <Caption1 className={styles.stats}>
-            {item.scheduledFor ? `Scheduled for ${fmtSchedule(item.scheduledFor)}` : 'Saved for later'}
+            {item.scheduledFor
+              ? `Scheduled for ${fmtSchedule(item.scheduledFor)}`
+              : 'Saved for later'}
           </Caption1>
         )}
 
diff --git a/src/renderer/src/components/Select.tsx b/src/renderer/src/components/Select.tsx
index 18cdbad..449fa82 100644
--- a/src/renderer/src/components/Select.tsx
+++ b/src/renderer/src/components/Select.tsx
@@ -1,9 +1,15 @@
-import { makeStyles, mergeClasses, tokens, shorthands } from '@fluentui/react-components'
+import {
+  makeStyles,
+  mergeClasses,
+  tokens,
+  shorthands,
+  useFieldControlProps_unstable
+} from '@fluentui/react-components'
 
 // A native <select> styled to match Fluent inputs. We use this instead of
 // Fluent's <Dropdown> because Fluent's portal/popover menu is a composited
 // overlay in the WebContents, and on this dev machine's GPU/driver that overlay
-// paint blanks the whole window (same family as the documented flicker —
+// paint blanks the whole window (same family as the documented flicker --
 // hardware acceleration is already disabled; see memory "aerofetch-gpu-flicker").
 // The native <select> popup is drawn by the OS, so it can't trigger the blank.
 // The popup's light/dark styling follows the `color-scheme` set on the app root
@@ -27,6 +33,20 @@ const useStyles = makeStyles({
       outline: 'none',
       ...shorthands.borderColor(tokens.colorCompoundBrandStroke)
     }
+  },
+  large: {
+    height: '40px',
+    padding: '0 12px',
+    fontSize: tokens.fontSizeBase400
+  },
+  disabled: {
+    cursor: 'not-allowed',
+    color: tokens.colorNeutralForegroundDisabled,
+    backgroundColor: tokens.colorNeutralBackgroundDisabled,
+    ...shorthands.borderColor(tokens.colorNeutralStrokeDisabled),
+    ':hover': {
+      ...shorthands.borderColor(tokens.colorNeutralStrokeDisabled)
+    }
   }
 })
 
@@ -41,6 +61,8 @@ interface SelectProps {
   onChange: (value: string) => void
   className?: string
   'aria-label'?: string
+  size?: 'medium' | 'large'
+  disabled?: boolean
 }
 
 export function Select({
@@ -48,15 +70,30 @@ export function Select({
   options,
   onChange,
   className,
-  'aria-label': ariaLabel
+  'aria-label': ariaLabel,
+  size,
+  disabled
 }: SelectProps): React.JSX.Element {
   const styles = useStyles()
+  // Integrate with a wrapping Fluent <Field> (L133): pick up the id + label/hint
+  // association so the Field's visible label names the select natively (via
+  // `htmlFor`), instead of every call site repeating the name in an `aria-label`.
+  // Outside a Field this returns the props unchanged, so standalone selects keep
+  // their own `aria-label`. `supportsLabelFor` = native <label for>, not aria-labelledby.
+  const fieldProps = useFieldControlProps_unstable({}, { supportsLabelFor: true })
   return (
     <select
-      className={mergeClasses(styles.select, className)}
+      {...fieldProps}
+      aria-label={ariaLabel}
+      className={mergeClasses(
+        styles.select,
+        size === 'large' && styles.large,
+        disabled && styles.disabled,
+        className
+      )}
       value={value}
       onChange={(e) => onChange(e.target.value)}
-      aria-label={ariaLabel}
+      disabled={disabled}
     >
       {options.map((o) => (
         <option key={o.value} value={o.value}>
diff --git a/src/renderer/src/components/SettingsView.tsx b/src/renderer/src/components/SettingsView.tsx
index d7bae13..adca76c 100644
--- a/src/renderer/src/components/SettingsView.tsx
+++ b/src/renderer/src/components/SettingsView.tsx
@@ -1,451 +1,76 @@
 import { useEffect, useRef, useState } from 'react'
-import {
-  Field,
-  Input,
-  SpinButton,
-  Switch,
-  Button,
-  Card,
-  Subtitle2,
-  Caption1,
-  Spinner,
-  Text,
-  ProgressBar,
-  makeStyles,
-  mergeClasses,
-  tokens,
-  shorthands
-} from '@fluentui/react-components'
-import {
-  FolderRegular,
-  ArrowDownloadRegular,
-  DocumentRegular,
-  OptionsRegular,
-  InfoRegular,
-  GlobeRegular,
-  CookiesRegular,
-  CodeRegular,
-  ArrowClockwiseRegular,
-  DocumentArrowDownRegular,
-  DocumentArrowUpRegular,
-  BugRegular,
-  CopyRegular,
-  DeleteRegular,
-  PaintBucketRegular,
-  AccessibilityRegular,
-  ArrowSyncRegular,
-  OpenRegular,
-  SearchRegular
-} from '@fluentui/react-icons'
-import {
-  COOKIE_BROWSERS,
-  type YtdlpVersionResult,
-  type YtdlpUpdateChannel,
-  type YtdlpUpdateResult,
-  type FfmpegVersionResult,
-  type AppUpdateInfo,
-  type MediaKind,
-  type CookieSource,
-  type CookieBrowser,
-  type CookiesStatus,
-  type BackupExportResult,
-  type BackupImportResult,
-  type ThemeMode,
-  type AccentColor
-} from '@shared/ipc'
-import { useSettings } from '../store/settings'
-import { useSystemTheme } from '../store/systemTheme'
-import { QUALITY_OPTIONS, useDownloads } from '../store/downloads'
-import { useTemplates } from '../store/templates'
-import { useErrorLog } from '../store/errorlog'
-import { Select } from './Select'
-import { DownloadOptionsForm } from './DownloadOptionsForm'
-import { TemplateManager } from './TemplateManager'
-import { ACCENT_OPTIONS } from '../theme'
+import { Input, Caption1, makeStyles, mergeClasses, tokens } from '@fluentui/react-components'
+import { SearchRegular } from '@fluentui/react-icons'
+import { ScreenHeader, useScreenStyles } from './ui/Screen'
+import { SPACE } from './ui/tokens'
+import { DownloadsCard } from './settings/DownloadsCard'
+import { AppearanceCard } from './settings/AppearanceCard'
+import { PostProcessingCard } from './settings/PostProcessingCard'
+import { NetworkCard } from './settings/NetworkCard'
+import { CookiesCard } from './settings/CookiesCard'
+import { CustomCommandsCard } from './settings/CustomCommandsCard'
+import { FilenamesCard } from './settings/FilenamesCard'
+import { BackupCard } from './settings/BackupCard'
+import { DiagnosticsCard } from './settings/DiagnosticsCard'
+import { SoftwareUpdateCard } from './settings/SoftwareUpdateCard'
+import { AboutCard } from './settings/AboutCard'
 
 const useStyles = makeStyles({
   root: {
     display: 'flex',
     flexDirection: 'column',
-    gap: '16px',
-    maxWidth: '640px'
-  },
-  card: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '16px',
-    padding: '20px',
-    ...shorthands.borderRadius(tokens.borderRadiusXLarge)
-  },
-  notesBox: {
-    maxHeight: '180px',
-    overflowY: 'auto',
-    padding: '10px 12px',
-    backgroundColor: tokens.colorNeutralBackground2,
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    border: `1px solid ${tokens.colorNeutralStroke2}`,
-    whiteSpace: 'pre-wrap',
-    fontSize: tokens.fontSizeBase200,
-    lineHeight: tokens.lineHeightBase300
-  },
-  sectionHeader: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '10px'
-  },
-  sectionIcon: {
-    fontSize: '20px',
-    color: tokens.colorCompoundBrandForeground1
-  },
-  folderRow: {
-    display: 'flex',
-    gap: '8px',
-    alignItems: 'flex-end'
-  },
-  folderInput: {
-    flexGrow: 1
-  },
-  hint: {
-    color: tokens.colorNeutralForeground3
-  },
-  swatchRow: {
-    display: 'flex',
-    gap: '10px'
-  },
-  swatch: {
-    boxSizing: 'border-box',
-    width: '28px',
-    height: '28px',
-    flexShrink: 0,
-    ...shorthands.borderRadius('50%'),
-    ...shorthands.border('2px', 'solid', 'transparent'),
-    padding: 0,
-    cursor: 'pointer'
-  },
-  swatchActive: {
-    ...shorthands.borderColor(tokens.colorNeutralForeground1)
-  },
-  errorList: {
-    display: 'flex',
-    flexDirection: 'column',
-    gap: '8px'
-  },
-  errorRow: {
-    padding: '10px 12px',
-    backgroundColor: tokens.colorNeutralBackground2,
-    ...shorthands.borderRadius(tokens.borderRadiusLarge),
-    border: `1px solid ${tokens.colorNeutralStroke2}`
-  },
-  errorRowHeader: {
-    display: 'flex',
-    alignItems: 'center',
-    gap: '8px'
-  },
-  errorRowTitle: {
-    flexGrow: 1,
-    minWidth: 0,
-    fontWeight: tokens.fontWeightSemibold,
-    overflow: 'hidden',
-    textOverflow: 'ellipsis',
-    whiteSpace: 'nowrap'
-  },
-  errorRowText: {
-    color: tokens.colorPaletteRedForeground1,
-    whiteSpace: 'pre-wrap',
-    wordBreak: 'break-word'
+    gap: SPACE.section
   }
 })
 
-// Combined "Type — Quality" options for the default-format dropdown.
-const FORMAT_OPTIONS = [
-  ...QUALITY_OPTIONS.video.map((q) => ({ value: `video|${q}`, label: `Video — ${q}` })),
-  ...QUALITY_OPTIONS.audio.map((q) => ({ value: `audio|${q}`, label: `Audio — ${q}` }))
-]
-
-const THEME_MODE_OPTIONS = [
-  { value: 'light', label: 'Light' },
-  { value: 'dark', label: 'Dark' },
-  { value: 'system', label: 'Follow system' }
-]
-
-const COOKIE_SOURCE_OPTIONS = [
-  { value: 'none', label: 'None' },
-  { value: 'browser', label: "From a browser's cookie store" },
-  { value: 'login', label: 'Sign-in window (built into AeroFetch)' }
-]
-
-const COOKIE_BROWSER_OPTIONS = COOKIE_BROWSERS.map((b) => ({
-  value: b,
-  label: b[0].toUpperCase() + b.slice(1)
-}))
-
-const UPDATE_CHANNEL_OPTIONS = [
-  { value: 'stable', label: 'Stable' },
-  { value: 'nightly', label: 'Nightly' }
+// The cards, in display order. Rendered inside React-owned wrappers so the search
+// filter controls each card's visibility via state instead of mutating the card's
+// own DOM `style` (M14) — which broke if a card ever set its own inline style.
+const CARDS = [
+  DownloadsCard,
+  AppearanceCard,
+  PostProcessingCard,
+  NetworkCard,
+  CookiesCard,
+  CustomCommandsCard,
+  FilenamesCard,
+  BackupCard,
+  DiagnosticsCard,
+  SoftwareUpdateCard,
+  AboutCard
 ]
 
 export function SettingsView(): React.JSX.Element {
   const styles = useStyles()
+  const screen = useScreenStyles()
 
-  // Settings search (Phase O). Rather than thread a query through all ~11 cards,
-  // filter by toggling each card's `display` based on whether its text matches.
-  // The cards are the root's direct children; the search box (marked
-  // data-settings-search) is skipped. React never sets `style` on the cards, so
-  // our inline display survives their re-renders.
+  // Settings search (Phase O). Matching still reads each card's rendered text (so a
+  // search covers every visible label without hand-maintaining per-card keywords),
+  // but the result drives a `hidden` state array on the wrappers — React owns the
+  // visibility, rather than us writing `display:none` onto React's own card nodes (M14).
   const [search, setSearch] = useState('')
-  const [noResults, setNoResults] = useState(false)
-  const rootRef = useRef<HTMLDivElement>(null)
+  const cardRefs = useRef<(HTMLDivElement | null)[]>([])
+  const [hidden, setHidden] = useState<boolean[]>(() => CARDS.map(() => false))
+
   useEffect(() => {
-    const root = rootRef.current
-    if (!root) return
     const q = search.trim().toLowerCase()
-    let shown = 0
-    for (const el of Array.from(root.children) as HTMLElement[]) {
-      if (el.dataset.settingsSearch !== undefined) continue
-      const match = !q || (el.textContent ?? '').toLowerCase().includes(q)
-      el.style.display = match ? '' : 'none'
-      if (match) shown++
-    }
-    setNoResults(q !== '' && shown === 0)
+    setHidden(
+      CARDS.map((_, i) => {
+        if (!q) return false
+        const text = (cardRefs.current[i]?.textContent ?? '').toLowerCase()
+        return !text.includes(q)
+      })
+    )
   }, [search])
 
-  const videoDir = useSettings((s) => s.videoDir)
-  const audioDir = useSettings((s) => s.audioDir)
-  const chooseDir = useSettings((s) => s.chooseDir)
-  const clearDir = useSettings((s) => s.clearDir)
-  const defaultKind = useSettings((s) => s.defaultKind)
-  const defaultVideoQuality = useSettings((s) => s.defaultVideoQuality)
-  const defaultAudioQuality = useSettings((s) => s.defaultAudioQuality)
-  const maxConcurrent = useSettings((s) => s.maxConcurrent)
-  const filenameTemplate = useSettings((s) => s.filenameTemplate)
-  const theme = useSettings((s) => s.theme)
-  const accentColor = useSettings((s) => s.accentColor)
-  const highContrast = useSystemTheme((s) => s.shouldUseHighContrastColors)
-  const clipboardWatch = useSettings((s) => s.clipboardWatch)
-  const downloadOptions = useSettings((s) => s.downloadOptions)
-  const proxy = useSettings((s) => s.proxy)
-  const rateLimit = useSettings((s) => s.rateLimit)
-  const useAria2c = useSettings((s) => s.useAria2c)
-  const youtubePlayerClient = useSettings((s) => s.youtubePlayerClient)
-  const youtubePoToken = useSettings((s) => s.youtubePoToken)
-  const cookieSource = useSettings((s) => s.cookieSource)
-  const cookiesBrowser = useSettings((s) => s.cookiesBrowser)
-  const restrictFilenames = useSettings((s) => s.restrictFilenames)
-  const downloadArchive = useSettings((s) => s.downloadArchive)
-  const customCommandEnabled = useSettings((s) => s.customCommandEnabled)
-  const defaultTemplateId = useSettings((s) => s.defaultTemplateId)
-  const notifyOnComplete = useSettings((s) => s.notifyOnComplete)
-  const minimizeToTray = useSettings((s) => s.minimizeToTray)
-  const launchAtStartup = useSettings((s) => s.launchAtStartup)
-  const updateToken = useSettings((s) => s.updateToken)
-  const autoUpdateYtdlp = useSettings((s) => s.autoUpdateYtdlp)
-  const ytdlpChannel = useSettings((s) => s.ytdlpChannel)
-  const ytdlpLastUpdateCheck = useSettings((s) => s.ytdlpLastUpdateCheck)
-  const update = useSettings((s) => s.update)
-  const templates = useTemplates((s) => s.templates)
-  const errorEntries = useErrorLog((s) => s.entries)
-  const clearErrorLog = useErrorLog((s) => s.clear)
-
-  const formatQuality = defaultKind === 'audio' ? defaultAudioQuality : defaultVideoQuality
-  const formatValue = `${defaultKind}|${formatQuality}`
-
-  const [checking, setChecking] = useState(false)
-  const [version, setVersion] = useState<YtdlpVersionResult | null>(null)
-  const [ffmpeg, setFfmpeg] = useState<FfmpegVersionResult | null>(null)
-
-  const [updating, setUpdating] = useState(false)
-  const [updateResult, setUpdateResult] = useState<YtdlpUpdateResult | null>(null)
-
-  // --- AeroFetch app self-update ---
-  const [appVersion, setAppVersion] = useState('')
-  const [appUpd, setAppUpd] = useState<AppUpdateInfo | null>(null)
-  const [appChecking, setAppChecking] = useState(false)
-  const [appDownloading, setAppDownloading] = useState(false)
-  const [appFraction, setAppFraction] = useState<number | undefined>(undefined)
-  const [appUpdError, setAppUpdError] = useState<string | null>(null)
-
-  const [cookiesStatus, setCookiesStatus] = useState<CookiesStatus | null>(null)
-  const [loginUrl, setLoginUrl] = useState('https://www.youtube.com')
-  const [signingIn, setSigningIn] = useState(false)
-  const [loginError, setLoginError] = useState<string | null>(null)
-
-  const [exporting, setExporting] = useState(false)
-  const [exportResult, setExportResult] = useState<BackupExportResult | null>(null)
-  const [importing, setImporting] = useState(false)
-  const [importResult, setImportResult] = useState<BackupImportResult | null>(null)
-
-  useEffect(() => {
-    window.api.cookiesStatus().then(setCookiesStatus)
-  }, [])
-
-  useEffect(() => {
-    window.api.getAppVersion().then(setAppVersion).catch(() => {})
-    return window.api.onAppUpdateProgress((p) => setAppFraction(p.fraction))
-  }, [])
-
-  useEffect(() => {
-    // Show the current yt-dlp version without a manual click, and reflect a
-    // background auto-update (which may run on launch) live in this panel.
-    window.api.getYtdlpVersion().then(setVersion).catch(() => {})
-    // ffmpeg/ffprobe are display-only (bundled, not auto-updated); load them once.
-    window.api.getFfmpegVersions().then(setFfmpeg).catch(() => {})
-    return window.api.onYtdlpAutoUpdateStatus((s) => {
-      if (s.phase === 'checking') {
-        setChecking(true)
-        return
-      }
-      setChecking(false)
-      if (s.version) setVersion({ ok: true, version: s.version })
-      if (s.checkedAt) useSettings.setState({ ytdlpLastUpdateCheck: s.checkedAt })
-      if (s.phase === 'updated') {
-        setUpdateResult({ ok: true, output: `Updated to yt-dlp ${s.version ?? ''}`.trim() })
-      } else if (s.phase === 'error' && s.error) {
-        setUpdateResult({ ok: false, error: s.error })
-      }
-    })
-  }, [])
-
-  async function checkAppUpdate(): Promise<void> {
-    setAppChecking(true)
-    setAppUpd(null)
-    setAppUpdError(null)
-    try {
-      const info = await window.api.checkForAppUpdate()
-      // Funnel a failed check into the single error slot rather than storing a
-      // second not-ok AppUpdateInfo, so only one error message can ever render.
-      if (info.ok) setAppUpd(info)
-      else setAppUpdError(info.error ?? 'Update check failed.')
-    } catch (e) {
-      setAppUpdError(e instanceof Error ? e.message : String(e))
-    } finally {
-      setAppChecking(false)
-    }
-  }
-
-  async function installAppUpdate(): Promise<void> {
-    if (!appUpd?.downloadUrl) return
-    setAppDownloading(true)
-    setAppFraction(undefined)
-    setAppUpdError(null)
-    try {
-      const dl = await window.api.downloadAppUpdate(appUpd.downloadUrl)
-      if (!dl.ok || !dl.filePath) {
-        setAppUpdError(dl.error ?? 'Download failed.')
-        return
-      }
-      const run = await window.api.runAppUpdate(dl.filePath)
-      // On success the app quits as the installer launches; only errors return here.
-      if (!run.ok) setAppUpdError(run.error ?? 'Could not start the installer.')
-    } catch (e) {
-      setAppUpdError(e instanceof Error ? e.message : String(e))
-    } finally {
-      setAppDownloading(false)
-    }
-  }
-
-  async function exportBackup(): Promise<void> {
-    setExporting(true)
-    setExportResult(null)
-    try {
-      setExportResult(await window.api.exportBackup())
-    } catch (e) {
-      setExportResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
-    } finally {
-      setExporting(false)
-    }
-  }
-
-  async function importBackup(): Promise<void> {
-    setImporting(true)
-    setImportResult(null)
-    try {
-      const result = await window.api.importBackup()
-      setImportResult(result)
-      if (result.ok) {
-        // Settings + templates changed underneath the stores — reload both.
-        const [s, t] = await Promise.all([window.api.getSettings(), window.api.listTemplates()])
-        useSettings.setState({ ...s, loaded: true })
-        useTemplates.setState({ templates: t })
-      }
-    } catch (e) {
-      setImportResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
-    } finally {
-      setImporting(false)
-    }
-  }
-
-  function copyErrorReport(): void {
-    const report = errorEntries
-      .map((e) =>
-        [
-          new Date(e.occurredAt).toLocaleString(),
-          e.title ?? e.url,
-          e.url,
-          e.error
-        ].join('\n')
-      )
-      .join('\n\n---\n\n')
-    navigator.clipboard.writeText(report || 'No errors logged.').catch(() => {})
-  }
-
-  async function signIn(): Promise<void> {
-    setSigningIn(true)
-    setLoginError(null)
-    try {
-      const result = await window.api.cookiesLogin(loginUrl)
-      if (result.ok) setCookiesStatus(await window.api.cookiesStatus())
-      else setLoginError(result.error ?? 'Sign-in failed.')
-    } catch (e) {
-      setLoginError(e instanceof Error ? e.message : String(e))
-    } finally {
-      setSigningIn(false)
-    }
-  }
-
-  async function clearSavedCookies(): Promise<void> {
-    await window.api.cookiesClear()
-    setCookiesStatus({ exists: false })
-  }
-
-  function onFormatSelect(value: string): void {
-    const [kind, quality] = value.split('|') as [MediaKind, string]
-    update(
-      kind === 'audio'
-        ? { defaultKind: 'audio', defaultAudioQuality: quality }
-        : { defaultKind: 'video', defaultVideoQuality: quality }
-    )
-  }
-
-  async function checkVersion(): Promise<void> {
-    setChecking(true)
-    setVersion(null)
-    try {
-      setVersion(await window.api.getYtdlpVersion())
-    } catch (e) {
-      setVersion({ ok: false, error: e instanceof Error ? e.message : String(e) })
-    } finally {
-      setChecking(false)
-    }
-  }
-
-  async function runUpdate(): Promise<void> {
-    setUpdating(true)
-    setUpdateResult(null)
-    try {
-      const result = await window.api.updateYtdlp(ytdlpChannel)
-      setUpdateResult(result)
-      if (result.ok) setVersion(null) // stale — prompt a re-check rather than show a wrong version
-    } catch (e) {
-      setUpdateResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
-    } finally {
-      setUpdating(false)
-    }
-  }
+  const noResults = search.trim() !== '' && hidden.length > 0 && hidden.every(Boolean)
 
   return (
-    <div className={styles.root} ref={rootRef}>
-      <div data-settings-search>
+    <div className={mergeClasses(styles.root, screen.width)}>
+      <ScreenHeader title="Settings" description="Folders, formats, network, cookies, and more." />
+      <div>
         <Input
+          input={{ 'aria-label': 'Search settings' }}
           value={search}
           onChange={(_, d) => setSearch(d.value)}
           placeholder="Search settings…"
@@ -453,652 +78,24 @@ export function SettingsView(): React.JSX.Element {
           style={{ width: '100%' }}
         />
         {noResults && (
-          <Caption1 style={{ color: tokens.colorNeutralForeground3, marginTop: '8px' }}>
-            No settings match “{search}”.
+          <Caption1 style={{ color: tokens.colorNeutralForeground3, marginTop: SPACE.tight }}>
+            No settings match &quot;{search}&quot;.
           </Caption1>
         )}
       </div>
 
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <ArrowDownloadRegular className={styles.sectionIcon} />
-          <Subtitle2>Downloads</Subtitle2>
+      {CARDS.map((Card, i) => (
+        <div
+          // Static array, never reordered/filtered (cards only hide) — index key is stable.
+          key={i}
+          ref={(el) => {
+            cardRefs.current[i] = el
+          }}
+          style={hidden[i] ? { display: 'none' } : undefined}
+        >
+          <Card />
         </div>
-
-        <Field
-          label="Video folder"
-          hint="Where video downloads are saved. Leave blank to use Documents\Video."
-        >
-          <div className={styles.folderRow}>
-            <Input
-              readOnly
-              className={styles.folderInput}
-              value={videoDir}
-              placeholder="Documents\Video (default)"
-              contentBefore={<FolderRegular />}
-            />
-            <Button icon={<FolderRegular />} onClick={() => chooseDir('videoDir')}>
-              Browse
-            </Button>
-            {videoDir && (
-              <Button appearance="subtle" onClick={() => clearDir('videoDir')}>
-                Reset
-              </Button>
-            )}
-          </div>
-        </Field>
-
-        <Field
-          label="Audio folder"
-          hint="Where audio downloads are saved. Leave blank to use Documents\Audio."
-        >
-          <div className={styles.folderRow}>
-            <Input
-              readOnly
-              className={styles.folderInput}
-              value={audioDir}
-              placeholder="Documents\Audio (default)"
-              contentBefore={<FolderRegular />}
-            />
-            <Button icon={<FolderRegular />} onClick={() => chooseDir('audioDir')}>
-              Browse
-            </Button>
-            {audioDir && (
-              <Button appearance="subtle" onClick={() => clearDir('audioDir')}>
-                Reset
-              </Button>
-            )}
-          </div>
-        </Field>
-
-        <Field label="Default format">
-          <Select
-            aria-label="Default format"
-            value={formatValue}
-            options={FORMAT_OPTIONS}
-            onChange={onFormatSelect}
-          />
-        </Field>
-
-        <Field
-          label="Maximum simultaneous downloads"
-          hint="How many downloads run at once. 2–3 is a good balance."
-        >
-          <SpinButton
-            value={maxConcurrent}
-            min={1}
-            max={5}
-            onChange={(_, d) => {
-              const v = d.value ?? Number(d.displayValue)
-              if (typeof v === 'number' && Number.isFinite(v)) {
-                update({ maxConcurrent: Math.min(5, Math.max(1, Math.round(v))) })
-                // Raising the cap should start queued items right away.
-                useDownloads.getState().pump()
-              }
-            }}
-          />
-        </Field>
-
-        <Field
-          label="Detect links from clipboard"
-          hint="When AeroFetch gains focus, offer a video link you've just copied."
-        >
-          <Switch
-            checked={clipboardWatch}
-            onChange={(_, d) => update({ clipboardWatch: d.checked })}
-            label={clipboardWatch ? 'On' : 'Off'}
-          />
-        </Field>
-
-        <Field
-          label="Notify when downloads finish"
-          hint="Shows a native Windows notification when a download completes or fails."
-        >
-          <Switch
-            checked={notifyOnComplete}
-            onChange={(_, d) => update({ notifyOnComplete: d.checked })}
-            label={notifyOnComplete ? 'On' : 'Off'}
-          />
-        </Field>
-
-        <Field
-          label="Keep running in the tray"
-          hint="When on, closing the window minimizes AeroFetch to the system tray instead of quitting — so downloads keep going and watched channels can auto-download new uploads. Use the tray icon to reopen or quit. (A download in progress always keeps AeroFetch running, even when this is off.)"
-        >
-          <Switch
-            checked={minimizeToTray}
-            onChange={(_, d) => update({ minimizeToTray: d.checked })}
-            label={minimizeToTray ? 'On' : 'Off'}
-          />
-        </Field>
-
-        <Field
-          label="Start with Windows"
-          hint="Launch AeroFetch automatically when you sign in — useful with auto-download so watched channels stay current in the background."
-        >
-          <Switch
-            checked={launchAtStartup}
-            onChange={(_, d) => update({ launchAtStartup: d.checked })}
-            label={launchAtStartup ? 'On' : 'Off'}
-          />
-        </Field>
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <PaintBucketRegular className={styles.sectionIcon} />
-          <Subtitle2>Appearance</Subtitle2>
-        </div>
-
-        <Field label="Theme">
-          <Select
-            aria-label="Theme"
-            value={theme}
-            options={THEME_MODE_OPTIONS}
-            onChange={(v) => update({ theme: v as ThemeMode })}
-          />
-        </Field>
-
-        <Field label="Accent color">
-          <div className={styles.swatchRow}>
-            {ACCENT_OPTIONS.map((opt) => (
-              <button
-                key={opt.value}
-                type="button"
-                className={mergeClasses(
-                  styles.swatch,
-                  accentColor === opt.value && styles.swatchActive
-                )}
-                style={{ backgroundColor: opt.swatch }}
-                onClick={() => update({ accentColor: opt.value as AccentColor })}
-                aria-pressed={accentColor === opt.value}
-                aria-label={opt.label}
-                title={opt.label}
-              />
-            ))}
-          </div>
-        </Field>
-
-        <Caption1 className={styles.hint}>
-          {highContrast
-            ? 'A Windows high-contrast theme is active — AeroFetch follows your system colors.'
-            : 'AeroFetch automatically follows a Windows high-contrast theme if you turn one on.'}
-        </Caption1>
-        {highContrast && (
-          <div className={styles.folderRow}>
-            <Button
-              size="small"
-              icon={<AccessibilityRegular />}
-              onClick={() => window.api.openHighContrastSettings()}
-            >
-              Open accessibility settings
-            </Button>
-          </div>
-        )}
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <OptionsRegular className={styles.sectionIcon} />
-          <Subtitle2>Format &amp; post-processing</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          Defaults applied to every new download (yt-dlp and ffmpeg do the work).
-        </Caption1>
-
-        <DownloadOptionsForm
-          value={downloadOptions}
-          onChange={(o) => update({ downloadOptions: o })}
-        />
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <GlobeRegular className={styles.sectionIcon} />
-          <Subtitle2>Network</Subtitle2>
-        </div>
-
-        <Field
-          label="Proxy"
-          hint="HTTP/HTTPS/SOCKS proxy URL, e.g. socks5://127.0.0.1:1080. Leave blank to use the system default."
-        >
-          <Input
-            value={proxy}
-            placeholder="socks5://127.0.0.1:1080"
-            onChange={(_, d) => update({ proxy: d.value })}
-          />
-        </Field>
-
-        <Field
-          label="Rate limit"
-          hint="Caps download speed (e.g. 500K or 2M). Leave blank for unlimited."
-        >
-          <Input
-            value={rateLimit}
-            placeholder="2M"
-            onChange={(_, d) => update({ rateLimit: d.value })}
-          />
-        </Field>
-
-        <Field
-          label="Use aria2c downloader"
-          hint="Multi-connection downloads for faster speeds on supported sites. Requires aria2c.exe in resources/bin (see the README there) — falls back to yt-dlp's downloader if it's missing."
-        >
-          <Switch
-            checked={useAria2c}
-            onChange={(_, d) => update({ useAria2c: d.checked })}
-            label={useAria2c ? 'On' : 'Off'}
-          />
-        </Field>
-
-        <Field
-          label="YouTube client (advanced)"
-          hint="Override the YouTube extraction client when downloads start failing the bot check. Try web_safari, tv, or mweb. Leave blank for yt-dlp's default."
-        >
-          <Input
-            value={youtubePlayerClient}
-            placeholder="web_safari"
-            onChange={(_, d) => update({ youtubePlayerClient: d.value })}
-          />
-        </Field>
-
-        <Field
-          label="YouTube PO token (advanced)"
-          hint="A manually-obtained Proof-of-Origin token for YouTube's bot check, sent via --extractor-args. Usually cookies (above) are the easier fix; automatic minting is planned."
-        >
-          <Input
-            value={youtubePoToken}
-            placeholder="(none)"
-            onChange={(_, d) => update({ youtubePoToken: d.value })}
-          />
-        </Field>
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <CookiesRegular className={styles.sectionIcon} />
-          <Subtitle2>Cookies</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          Some sites only serve full quality, age-restricted, or members-only video to a
-          logged-in session. Supply cookies so yt-dlp can act like one.
-        </Caption1>
-
-        <Field label="Cookie source">
-          <Select
-            aria-label="Cookie source"
-            value={cookieSource}
-            options={COOKIE_SOURCE_OPTIONS}
-            onChange={(v) => update({ cookieSource: v as CookieSource })}
-          />
-        </Field>
-
-        {cookieSource === 'browser' && (
-          <Field
-            label="Browser"
-            hint="Reads that browser's saved cookies directly. Close it first if yt-dlp can't open a locked cookie database."
-          >
-            <Select
-              aria-label="Browser"
-              value={cookiesBrowser}
-              options={COOKIE_BROWSER_OPTIONS}
-              onChange={(v) => update({ cookiesBrowser: v as CookieBrowser })}
-            />
-          </Field>
-        )}
-
-        {cookieSource === 'login' && (
-          <>
-            <Field
-              label="Site to sign in to"
-              hint="Opens a sign-in window. Log in, then close the window — your cookies are saved automatically."
-            >
-              <div className={styles.folderRow}>
-                <Input
-                  className={styles.folderInput}
-                  value={loginUrl}
-                  placeholder="https://www.youtube.com"
-                  onChange={(_, d) => setLoginUrl(d.value)}
-                />
-                <Button appearance="primary" onClick={signIn} disabled={signingIn}>
-                  {signingIn ? 'Signing in…' : 'Sign in…'}
-                </Button>
-              </div>
-            </Field>
-
-            <div className={styles.folderRow}>
-              <Caption1 className={styles.hint}>
-                {cookiesStatus?.exists
-                  ? `Cookies saved ${new Date(cookiesStatus.savedAt!).toLocaleString()}.`
-                  : 'Not signed in yet.'}
-              </Caption1>
-              {cookiesStatus?.exists && (
-                <Button size="small" onClick={clearSavedCookies}>
-                  Clear saved cookies
-                </Button>
-              )}
-            </div>
-
-            {loginError && (
-              <Caption1 style={{ color: tokens.colorPaletteRedForeground1 }}>{loginError}</Caption1>
-            )}
-          </>
-        )}
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <CodeRegular className={styles.sectionIcon} />
-          <Subtitle2>Custom commands</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          Named templates of extra yt-dlp flags — your own power-user recipes (e.g.
-          --write-thumbnail, --no-mtime, anything yt-dlp supports). Appended after every other
-          option, so a template flag can override a setting above it.
-        </Caption1>
-
-        <Field
-          label="Run custom command"
-          hint="Applies the default template below to every new download (still overridable per download)."
-        >
-          <Switch
-            checked={customCommandEnabled}
-            onChange={(_, d) => update({ customCommandEnabled: d.checked })}
-            label={customCommandEnabled ? 'On' : 'Off'}
-          />
-        </Field>
-
-        {customCommandEnabled && (
-          <Field label="Default template">
-            <Select
-              aria-label="Default template"
-              value={defaultTemplateId ?? 'none'}
-              options={[
-                { value: 'none', label: 'None' },
-                ...templates.map((t) => ({ value: t.id, label: t.name }))
-              ]}
-              onChange={(v) => update({ defaultTemplateId: v === 'none' ? null : v })}
-            />
-          </Field>
-        )}
-
-        <TemplateManager />
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <DocumentRegular className={styles.sectionIcon} />
-          <Subtitle2>Filenames</Subtitle2>
-        </div>
-        <Field
-          label="Filename template"
-          hint="yt-dlp output template. Tokens like %(title)s and %(ext)s are filled in per video."
-        >
-          <Input
-            value={filenameTemplate}
-            onChange={(_, d) => update({ filenameTemplate: d.value })}
-          />
-        </Field>
-        <Caption1 className={styles.hint}>
-          Example: {filenameTemplate.replace('%(title)s', 'My Video').replace('%(ext)s', 'mp4')}
-        </Caption1>
-
-        <Field
-          label="Restrict filenames"
-          hint="Sanitize titles to plain ASCII letters/digits, no spaces — safer for old filesystems and shells."
-        >
-          <Switch
-            checked={restrictFilenames}
-            onChange={(_, d) => update({ restrictFilenames: d.checked })}
-            label={restrictFilenames ? 'On' : 'Off'}
-          />
-        </Field>
-
-        <Field
-          label="Skip already-downloaded videos"
-          hint="Keeps a record of completed downloads (--download-archive) and skips them on repeat playlist/channel runs."
-        >
-          <Switch
-            checked={downloadArchive}
-            onChange={(_, d) => update({ downloadArchive: d.checked })}
-            label={downloadArchive ? 'On' : 'Off'}
-          />
-        </Field>
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <DocumentArrowDownRegular className={styles.sectionIcon} />
-          <Subtitle2>Backup &amp; restore</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          Save your settings and custom-command templates to a JSON file, or restore them on
-          another machine. Does not include download history.
-        </Caption1>
-
-        <div className={styles.folderRow}>
-          <Button icon={<DocumentArrowDownRegular />} onClick={exportBackup} disabled={exporting}>
-            {exporting ? 'Exporting…' : 'Export backup…'}
-          </Button>
-          <Button icon={<DocumentArrowUpRegular />} onClick={importBackup} disabled={importing}>
-            {importing ? 'Importing…' : 'Import backup…'}
-          </Button>
-        </div>
-        {exportResult?.ok && exportResult.path && (
-          <Caption1 className={styles.hint}>Saved to {exportResult.path}</Caption1>
-        )}
-        {exportResult && !exportResult.ok && exportResult.error && (
-          <Caption1 style={{ color: tokens.colorPaletteRedForeground1 }}>
-            {exportResult.error}
-          </Caption1>
-        )}
-        {importResult?.ok && (
-          <Caption1 className={styles.hint}>Settings and templates restored.</Caption1>
-        )}
-        {importResult && !importResult.ok && importResult.error && (
-          <Caption1 style={{ color: tokens.colorPaletteRedForeground1 }}>
-            {importResult.error}
-          </Caption1>
-        )}
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <BugRegular className={styles.sectionIcon} />
-          <Subtitle2>Diagnostics</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          Failed downloads are logged here even after you clear the queue, so you can copy the
-          details into a bug report.
-        </Caption1>
-
-        <div className={styles.folderRow}>
-          <Button
-            icon={<CopyRegular />}
-            onClick={copyErrorReport}
-            disabled={errorEntries.length === 0}
-          >
-            Copy full report
-          </Button>
-          <Button icon={<DeleteRegular />} onClick={clearErrorLog} disabled={errorEntries.length === 0}>
-            Clear log
-          </Button>
-        </div>
-
-        {errorEntries.length === 0 ? (
-          <Caption1 className={styles.hint}>No errors logged.</Caption1>
-        ) : (
-          <div className={styles.errorList}>
-            {errorEntries.slice(0, 20).map((e) => (
-              <div key={e.id + String(e.occurredAt)} className={styles.errorRow}>
-                <div className={styles.errorRowHeader}>
-                  <Text className={styles.errorRowTitle}>{e.title ?? e.url}</Text>
-                  <Caption1 className={styles.hint}>
-                    {new Date(e.occurredAt).toLocaleString()}
-                  </Caption1>
-                </div>
-                <Caption1 className={styles.errorRowText}>{e.error}</Caption1>
-              </div>
-            ))}
-          </div>
-        )}
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <ArrowSyncRegular className={styles.sectionIcon} />
-          <Subtitle2>Software update</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          {appVersion
-            ? `You're running AeroFetch v${appVersion}. Updates are fetched from the AeroFetch release repo.`
-            : 'Checking your AeroFetch version…'}
-        </Caption1>
-
-        <div className={styles.folderRow}>
-          <Button
-            icon={<ArrowSyncRegular />}
-            onClick={checkAppUpdate}
-            disabled={appChecking || appDownloading}
-          >
-            {appChecking ? 'Checking…' : 'Check for updates'}
-          </Button>
-          {appChecking && <Spinner size="tiny" />}
-        </div>
-
-        <Field
-          label="Update access token"
-          hint="Only needed if the release server requires sign-in (you'll see “could not reach the update server” without it). Paste a read-only Gitea token to enable update checks and downloads. Stored encrypted on this device; leave blank for anonymous access."
-        >
-          <Input
-            type="password"
-            value={updateToken}
-            placeholder="Optional — Gitea access token"
-            onChange={(_, d) => update({ updateToken: d.value })}
-            contentBefore={<ArrowSyncRegular />}
-          />
-        </Field>
-
-        {appUpd?.ok && appUpd.available && (
-          <>
-            <Text style={{ fontWeight: tokens.fontWeightSemibold }}>
-              Version {appUpd.latestVersion} is available — here&apos;s what changed:
-            </Text>
-            {appUpd.notes && <div className={styles.notesBox}>{appUpd.notes}</div>}
-            <div className={styles.folderRow}>
-              <Button
-                appearance="primary"
-                icon={<ArrowDownloadRegular />}
-                onClick={installAppUpdate}
-                disabled={appDownloading || !appUpd.downloadUrl}
-              >
-                {appDownloading ? 'Downloading…' : 'Update now'}
-              </Button>
-              {appUpd.htmlUrl && (
-                <Button icon={<OpenRegular />} onClick={() => window.open(appUpd.htmlUrl, '_blank')}>
-                  View release
-                </Button>
-              )}
-            </div>
-            {!appUpd.downloadUrl && (
-              <Caption1 className={styles.hint}>
-                This release has no installer attached — use “View release” to download it manually.
-              </Caption1>
-            )}
-            {appDownloading && <ProgressBar value={appFraction} />}
-          </>
-        )}
-
-        {appUpd?.ok && !appUpd.available && (
-          <Text>You&apos;re up to date — v{appUpd.currentVersion} is the latest.</Text>
-        )}
-
-        {appUpdError && (
-          <Caption1 style={{ color: tokens.colorPaletteRedForeground1, whiteSpace: 'pre-wrap' }}>
-            {appUpdError}
-          </Caption1>
-        )}
-      </Card>
-
-      <Card className={styles.card}>
-        <div className={styles.sectionHeader}>
-          <InfoRegular className={styles.sectionIcon} />
-          <Subtitle2>About</Subtitle2>
-        </div>
-        <Caption1 className={styles.hint}>
-          AeroFetch is a generic frontend for yt-dlp. It bundles ffmpeg and manages its
-          own copy of yt-dlp, keeping it up to date automatically.
-        </Caption1>
-
-        <Field
-          label="Keep yt-dlp updated automatically"
-          hint="Checks once a day on launch and updates yt-dlp in the background, so YouTube changes don't start breaking downloads with 403 errors."
-        >
-          <Switch
-            checked={autoUpdateYtdlp}
-            onChange={(_, d) => update({ autoUpdateYtdlp: d.checked })}
-            label={autoUpdateYtdlp ? 'On' : 'Off'}
-          />
-        </Field>
-
-        {version?.ok && (
-          <Text style={{ fontFamily: tokens.fontFamilyMonospace }}>yt-dlp {version.version}</Text>
-        )}
-        {version && !version.ok && (
-          <Caption1 style={{ color: tokens.colorPaletteRedForeground1, whiteSpace: 'pre-wrap' }}>
-            {version.error}
-          </Caption1>
-        )}
-        {ffmpeg && (
-          <>
-            <Text style={{ fontFamily: tokens.fontFamilyMonospace }}>
-              ffmpeg {ffmpeg.ffmpeg ?? 'not found'}
-            </Text>
-            <Text style={{ fontFamily: tokens.fontFamilyMonospace }}>
-              ffprobe {ffmpeg.ffprobe ?? 'not found'}
-            </Text>
-          </>
-        )}
-        {ytdlpLastUpdateCheck > 0 && (
-          <Caption1 className={styles.hint}>
-            Last checked for updates {new Date(ytdlpLastUpdateCheck).toLocaleString()}.
-          </Caption1>
-        )}
-        <div className={styles.folderRow}>
-          <Button onClick={checkVersion} disabled={checking}>
-            Check yt-dlp version
-          </Button>
-          {checking && <Spinner size="tiny" />}
-        </div>
-
-        <Field
-          label="Update channel"
-          hint="Nightly tracks yt-dlp's daily build; stable is the tagged release. Nightly follows YouTube changes fastest."
-        >
-          <Select
-            aria-label="Update channel"
-            value={ytdlpChannel}
-            options={UPDATE_CHANNEL_OPTIONS}
-            onChange={(v) => update({ ytdlpChannel: v as YtdlpUpdateChannel })}
-          />
-        </Field>
-        <div className={styles.folderRow}>
-          <Button icon={<ArrowClockwiseRegular />} onClick={runUpdate} disabled={updating}>
-            {updating ? 'Updating…' : 'Update yt-dlp'}
-          </Button>
-          {updating && <Spinner size="tiny" />}
-        </div>
-        {updateResult?.ok && (
-          <Text style={{ fontFamily: tokens.fontFamilyMonospace, whiteSpace: 'pre-wrap' }}>
-            {updateResult.output || 'yt-dlp is already up to date.'}
-          </Text>
-        )}
-        {updateResult && !updateResult.ok && (
-          <Caption1 style={{ color: tokens.colorPaletteRedForeground1, whiteSpace: 'pre-wrap' }}>
-            {updateResult.error}
-          </Caption1>
-        )}
-      </Card>
+      ))}
     </div>
   )
 }
diff --git a/src/renderer/src/components/Sidebar.tsx b/src/renderer/src/components/Sidebar.tsx
index 4f0b61f..4bdaf67 100644
--- a/src/renderer/src/components/Sidebar.tsx
+++ b/src/renderer/src/components/Sidebar.tsx
@@ -1,4 +1,11 @@
-import { Caption1, makeStyles, mergeClasses, tokens, shorthands } from '@fluentui/react-components'
+import {
+  Caption1,
+  CounterBadge,
+  makeStyles,
+  mergeClasses,
+  tokens,
+  shorthands
+} from '@fluentui/react-components'
 import {
   ArrowDownloadFilled,
   ArrowDownloadRegular,
@@ -14,6 +21,11 @@ import {
 } from '@fluentui/react-icons'
 import type { ThemeMode } from '@shared/ipc'
 import { Hint } from './Hint'
+import { SegmentedControl } from './ui/SegmentedControl'
+import { IconButton } from './ui/IconButton'
+import { useFocusStyles } from './ui/focusRing'
+import { useTextStyles } from './ui/text'
+import { MOTION, ICON } from './ui/tokens'
 
 export type TabValue = 'downloads' | 'library' | 'history' | 'terminal' | 'settings'
 
@@ -27,7 +39,8 @@ const useStyles = makeStyles({
     padding: '16px 12px',
     backgroundColor: tokens.colorNeutralBackground1,
     borderRight: `1px solid ${tokens.colorNeutralStroke2}`,
-    transition: 'width 0.15s ease'
+    // The app's one motion timing, gated globally on prefers-reduced-motion (UI26).
+    transition: `width ${MOTION.duration} ${MOTION.curve}`
   },
   rootCollapsed: {
     width: '60px',
@@ -41,24 +54,6 @@ const useStyles = makeStyles({
   topBarCollapsed: {
     justifyContent: 'center'
   },
-  iconBtn: {
-    appearance: 'none',
-    border: 'none',
-    backgroundColor: 'transparent',
-    color: tokens.colorNeutralForeground3,
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    width: '32px',
-    height: '32px',
-    fontSize: '18px',
-    cursor: 'pointer',
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    ':hover': {
-      backgroundColor: tokens.colorNeutralBackground1Hover,
-      color: tokens.colorNeutralForeground2
-    }
-  },
   brand: {
     display: 'flex',
     alignItems: 'center',
@@ -79,7 +74,8 @@ const useStyles = makeStyles({
     display: 'flex',
     alignItems: 'center',
     justifyContent: 'center',
-    fontSize: '20px'
+    // Brand tile glyph, snapped to the nearest ICON tier (UI11 — no literal px).
+    fontSize: `${ICON.control}px`
   },
   brandText: {
     display: 'flex',
@@ -92,9 +88,6 @@ const useStyles = makeStyles({
     lineHeight: tokens.lineHeightBase400,
     color: tokens.colorNeutralForeground1
   },
-  caption: {
-    color: tokens.colorNeutralForeground3
-  },
   nav: {
     display: 'flex',
     flexDirection: 'column',
@@ -102,6 +95,8 @@ const useStyles = makeStyles({
     alignSelf: 'stretch'
   },
   navItem: {
+    // relative so the collapsed count badge can pin to the icon's corner.
+    position: 'relative',
     display: 'flex',
     alignItems: 'center',
     gap: '11px',
@@ -119,6 +114,16 @@ const useStyles = makeStyles({
       backgroundColor: tokens.colorNeutralBackground1Hover
     }
   },
+  // Expanded: the active-download count sits at the far right of the nav row.
+  navBadge: {
+    marginLeft: 'auto'
+  },
+  // Collapsed: pin the count to the top-right corner of the centered icon.
+  navBadgeCollapsed: {
+    position: 'absolute',
+    top: '4px',
+    right: '8px'
+  },
   navItemCollapsed: {
     justifyContent: 'center',
     padding: '9px 0'
@@ -132,47 +137,12 @@ const useStyles = makeStyles({
     }
   },
   navIcon: {
-    fontSize: '18px',
+    fontSize: `${ICON.control}px`,
     flexShrink: 0,
     display: 'flex'
   },
   spacer: {
     flexGrow: 1
-  },
-  // --- theme control (expanded): a 3-way Light / Dark / Auto segmented switch ---
-  themeGroup: {
-    alignSelf: 'stretch',
-    display: 'flex',
-    width: '100%',
-    border: `1px solid ${tokens.colorNeutralStroke1}`,
-    ...shorthands.borderRadius(tokens.borderRadiusMedium),
-    overflow: 'hidden'
-  },
-  themeSeg: {
-    flex: 1,
-    appearance: 'none',
-    border: 'none',
-    backgroundColor: 'transparent',
-    color: tokens.colorNeutralForeground2,
-    display: 'flex',
-    alignItems: 'center',
-    justifyContent: 'center',
-    gap: '5px',
-    padding: '7px 4px',
-    fontSize: tokens.fontSizeBase200,
-    fontFamily: tokens.fontFamilyBase,
-    cursor: 'pointer',
-    ':hover': {
-      backgroundColor: tokens.colorNeutralBackground1Hover
-    }
-  },
-  themeSegActive: {
-    backgroundColor: tokens.colorBrandBackground,
-    color: tokens.colorNeutralForegroundOnBrand,
-    fontWeight: tokens.fontWeightSemibold,
-    ':hover': {
-      backgroundColor: tokens.colorBrandBackgroundHover
-    }
   }
 })
 
@@ -202,6 +172,10 @@ interface SidebarProps {
   version: string
   collapsed: boolean
   onToggleCollapsed: () => void
+  /** Show the Terminal nav item (only when custom commands are enabled) */
+  showTerminal: boolean
+  /** Active (downloading + queued) count, badged on the Downloads nav item (UX9). */
+  downloadCount: number
 }
 
 export function Sidebar({
@@ -212,22 +186,27 @@ export function Sidebar({
   onSetTheme,
   version,
   collapsed,
-  onToggleCollapsed
+  onToggleCollapsed,
+  showTerminal,
+  downloadCount
 }: SidebarProps): React.JSX.Element {
   const styles = useStyles()
+  const focus = useFocusStyles()
+  const text = useTextStyles()
 
   // Collapsed view shows one button that cycles Light → Dark → Auto.
   const order: ThemeMode[] = ['light', 'dark', 'system']
   function cycleTheme(): void {
-    onSetTheme(order[(order.indexOf(theme) + 1) % order.length])
+    const next = order[(order.indexOf(theme) + 1) % order.length]
+    if (next) onSetTheme(next)
   }
   const themeIcon =
     theme === 'system' ? (
-      <DesktopRegular fontSize={18} />
+      <DesktopRegular fontSize={ICON.control} />
     ) : isDark ? (
-      <WeatherMoonRegular fontSize={18} />
+      <WeatherMoonRegular fontSize={ICON.control} />
     ) : (
-      <WeatherSunnyRegular fontSize={18} />
+      <WeatherSunnyRegular fontSize={ICON.control} />
     )
   const themeLabel = theme === 'system' ? 'Auto (system)' : isDark ? 'Dark' : 'Light'
 
@@ -235,15 +214,12 @@ export function Sidebar({
     <nav className={mergeClasses(styles.root, collapsed && styles.rootCollapsed)}>
       <div className={mergeClasses(styles.topBar, collapsed && styles.topBarCollapsed)}>
         <Hint label={collapsed ? 'Expand sidebar' : 'Collapse sidebar'} placement="right">
-          <button
-            type="button"
-            className={styles.iconBtn}
+          <IconButton
+            icon={collapsed ? <PanelLeftExpandRegular /> : <PanelLeftContractRegular />}
             onClick={onToggleCollapsed}
             aria-label={collapsed ? 'Expand sidebar' : 'Collapse sidebar'}
             aria-pressed={collapsed}
-          >
-            {collapsed ? <PanelLeftExpandRegular /> : <PanelLeftContractRegular />}
-          </button>
+          />
         </Hint>
       </div>
 
@@ -254,13 +230,18 @@ export function Sidebar({
         {!collapsed && (
           <div className={styles.brandText}>
             <span className={styles.brandName}>AeroFetch</span>
-            <Caption1 className={styles.caption}>{version ? `v${version}` : 'yt-dlp frontend'}</Caption1>
+            {/* Stable tagline so the caption never flips from text to a version
+                string once it loads (L66); the version shows on hover and in
+                Settings → About. */}
+            <Caption1 className={text.muted} title={version ? `Version ${version}` : undefined}>
+              Video downloader
+            </Caption1>
           </div>
         )}
       </div>
 
       <div className={styles.nav}>
-        {NAV.map((n) => {
+        {NAV.filter((n) => n.value !== 'terminal' || showTerminal).map((n) => {
           const active = tab === n.value
           const btn = (
             <button
@@ -269,7 +250,8 @@ export function Sidebar({
               className={mergeClasses(
                 styles.navItem,
                 collapsed && styles.navItemCollapsed,
-                active && styles.navItemActive
+                active && styles.navItemActive,
+                focus.focusRing
               )}
               style={
                 active && !collapsed
@@ -278,10 +260,23 @@ export function Sidebar({
               }
               onClick={() => onTabChange(n.value)}
               aria-current={active ? 'page' : undefined}
-              aria-label={n.label}
+              aria-label={
+                n.value === 'downloads' && downloadCount > 0
+                  ? `${n.label}, ${downloadCount} active`
+                  : n.label
+              }
             >
               <span className={styles.navIcon}>{n.icon}</span>
               {!collapsed && n.label}
+              {n.value === 'downloads' && downloadCount > 0 && (
+                <CounterBadge
+                  className={collapsed ? styles.navBadgeCollapsed : styles.navBadge}
+                  count={downloadCount}
+                  size="small"
+                  color="brand"
+                  aria-hidden
+                />
+              )}
             </button>
           )
           return collapsed ? (
@@ -298,34 +293,20 @@ export function Sidebar({
 
       {collapsed ? (
         <Hint label={`Theme: ${themeLabel}`} placement="right">
-          <button
-            type="button"
-            className={styles.iconBtn}
+          <IconButton
+            icon={themeIcon}
             onClick={cycleTheme}
-            aria-label={`Theme: ${themeLabel}. Click to change.`}
-          >
-            {themeIcon}
-          </button>
+            aria-label={`Change theme (currently ${themeLabel})`}
+          />
         </Hint>
       ) : (
-        <div className={styles.themeGroup} role="radiogroup" aria-label="Theme">
-          {THEMES.map((t) => {
-            const on = theme === t.value
-            return (
-              <button
-                key={t.value}
-                type="button"
-                role="radio"
-                aria-checked={on}
-                className={mergeClasses(styles.themeSeg, on && styles.themeSegActive)}
-                onClick={() => onSetTheme(t.value)}
-              >
-                <span className={styles.navIcon}>{t.icon}</span>
-                {t.label}
-              </button>
-            )
-          })}
-        </div>
+        <SegmentedControl<ThemeMode>
+          fitted
+          value={theme}
+          options={THEMES}
+          onChange={onSetTheme}
+          ariaLabel="Theme"
+        />
       )}
     </nav>
   )
diff --git a/src/renderer/src/components/TemplateManager.tsx b/src/renderer/src/components/TemplateManager.tsx
index 412961c..5f64bec 100644
--- a/src/renderer/src/components/TemplateManager.tsx
+++ b/src/renderer/src/components/TemplateManager.tsx
@@ -1,6 +1,7 @@
 import { useState } from 'react'
 import {
   Button,
+  Field,
   Input,
   Textarea,
   Caption1,
@@ -9,10 +10,18 @@ import {
   tokens,
   shorthands
 } from '@fluentui/react-components'
-import { AddRegular, EditRegular, DeleteRegular, SaveRegular, DismissRegular } from '@fluentui/react-icons'
+import {
+  AddRegular,
+  EditRegular,
+  DeleteRegular,
+  SaveRegular,
+  DismissRegular
+} from '@fluentui/react-icons'
 import type { CommandTemplate } from '@shared/ipc'
 import { useTemplates } from '../store/templates'
+import { newId } from '../id'
 import { Hint } from './Hint'
+import { EmptyState } from './ui/EmptyState'
 
 const useStyles = makeStyles({
   root: {
@@ -63,9 +72,6 @@ const useStyles = makeStyles({
     display: 'flex',
     gap: '8px',
     justifyContent: 'flex-end'
-  },
-  empty: {
-    color: tokens.colorNeutralForeground3
   }
 })
 
@@ -79,10 +85,6 @@ interface Draft {
 }
 const BLANK_DRAFT: Draft = { id: null, name: '', args: '', urlPattern: '' }
 
-function newId(): string {
-  return typeof crypto !== 'undefined' && crypto.randomUUID ? crypto.randomUUID() : `tpl-${Date.now()}`
-}
-
 /**
  * Inline (no-modal — see the Hint/Select comments re: composited overlays
  * flickering on this dev machine's GPU) CRUD list + add/edit form for
@@ -100,13 +102,24 @@ export function TemplateManager(): React.JSX.Element {
     setDraft({ id: t.id, name: t.name, args: t.args, urlPattern: t.urlPattern ?? '' })
   }
 
+  function patternError(): string | undefined {
+    const p = draft?.urlPattern.trim()
+    if (!p) return undefined
+    try {
+      new RegExp(p)
+      return undefined
+    } catch {
+      return 'Invalid regex — this pattern will never match.'
+    }
+  }
+
   function commit(): void {
     if (!draft) return
     const name = draft.name.trim()
-    if (!name) return
+    if (!name || patternError()) return
     const urlPattern = draft.urlPattern.trim()
     save({
-      id: draft.id ?? newId(),
+      id: draft.id ?? newId('tpl'),
       name,
       args: draft.args.trim(),
       ...(urlPattern ? { urlPattern } : {})
@@ -117,7 +130,7 @@ export function TemplateManager(): React.JSX.Element {
   return (
     <div className={styles.root}>
       {templates.length === 0 && !draft && (
-        <Caption1 className={styles.empty}>No custom command templates yet.</Caption1>
+        <EmptyState compact message="No custom command templates yet." />
       )}
 
       {templates.map((t) => (
@@ -162,11 +175,16 @@ export function TemplateManager(): React.JSX.Element {
             resize="vertical"
             onChange={(_, d) => setDraft({ ...draft, args: d.value })}
           />
-          <Input
-            value={draft.urlPattern}
-            placeholder="Auto-apply to URLs matching (regex, optional) — e.g. soundcloud\.com"
-            onChange={(_, d) => setDraft({ ...draft, urlPattern: d.value })}
-          />
+          <Field
+            validationState={patternError() ? 'error' : 'none'}
+            validationMessage={patternError()}
+          >
+            <Input
+              value={draft.urlPattern}
+              placeholder="Auto-apply to URLs matching (regex, optional) — e.g. soundcloud\.com"
+              onChange={(_, d) => setDraft({ ...draft, urlPattern: d.value })}
+            />
+          </Field>
           <div className={styles.formActions}>
             <Button appearance="subtle" icon={<DismissRegular />} onClick={() => setDraft(null)}>
               Cancel
@@ -182,7 +200,11 @@ export function TemplateManager(): React.JSX.Element {
           </div>
         </div>
       ) : (
-        <Button appearance="subtle" icon={<AddRegular />} onClick={() => setDraft({ ...BLANK_DRAFT })}>
+        <Button
+          appearance="subtle"
+          icon={<AddRegular />}
+          onClick={() => setDraft({ ...BLANK_DRAFT })}
+        >
           Add template
         </Button>
       )}
diff --git a/src/renderer/src/components/TerminalView.tsx b/src/renderer/src/components/TerminalView.tsx
index 4fd1ee9..87f0f7f 100644
--- a/src/renderer/src/components/TerminalView.tsx
+++ b/src/renderer/src/components/TerminalView.tsx
@@ -1,28 +1,42 @@
-import { useEffect, useRef, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import {
   Button,
   Textarea,
-  Subtitle2,
   Body1,
   Caption1,
   makeStyles,
+  mergeClasses,
   tokens,
   shorthands
 } from '@fluentui/react-components'
 import { PlayRegular, DismissRegular, DeleteRegular } from '@fluentui/react-icons'
 import { useSettings } from '../store/settings'
+import { newId } from '../id'
+import { ScreenHeader, useScreenStyles } from './ui/Screen'
+import { EmptyState } from './ui/EmptyState'
+import { SPACE } from './ui/tokens'
 
 type LineKind = 'stdout' | 'stderr' | 'cmd' | 'sys'
 interface Line {
+  id: number
   text: string
   kind: LineKind
 }
+let lineSeq = 0
+const mkLine = (text: string, kind: LineKind): Line => ({ id: ++lineSeq, text, kind })
+
+// Verbose yt-dlp runs (--verbose, -F on a large channel) can emit thousands of
+// lines in seconds. Cap the visible log to prevent unbounded React state growth
+// and keep the <pre> scrollable (H6); older lines are dropped from the front.
+const MAX_LOG_LINES = 2000
 
 const useStyles = makeStyles({
-  root: { display: 'flex', flexDirection: 'column', gap: '16px', height: '100%' },
-  header: { display: 'flex', flexDirection: 'column', gap: '2px' },
-  sub: { color: tokens.colorNeutralForeground3 },
+  root: { display: 'flex', flexDirection: 'column', gap: SPACE.section, height: '100%' },
   gate: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'flex-start',
+    gap: '8px',
     padding: '12px 14px',
     backgroundColor: tokens.colorStatusWarningBackground1,
     color: tokens.colorStatusWarningForeground1,
@@ -48,24 +62,24 @@ const useStyles = makeStyles({
     whiteSpace: 'pre-wrap',
     wordBreak: 'break-word'
   },
+  // Center the "no output yet" placeholder in the log box, so it reads as an
+  // empty state rather than a stray line of text at the top (L117).
+  logEmpty: { display: 'flex', alignItems: 'center', justifyContent: 'center' },
   cmd: { color: tokens.colorBrandForeground1, fontWeight: tokens.fontWeightSemibold },
   stderr: { color: tokens.colorPaletteRedForeground1 },
-  sys: { color: tokens.colorNeutralForeground3 },
-  empty: { color: tokens.colorNeutralForeground3 }
+  sys: { color: tokens.colorNeutralForeground3 }
 })
 
-function newId(): string {
-  return typeof crypto !== 'undefined' && crypto.randomUUID ? crypto.randomUUID() : `t-${Date.now()}`
-}
-
 /**
  * Built-in yt-dlp terminal (Phase N): type raw yt-dlp args, run the bundled
  * binary, and watch its output stream. Gated on the customCommandEnabled consent
- * flag (enforced again in main — see src/main/terminal.ts).
+ * flag (enforced again in main -- see src/main/terminal.ts).
  */
 export function TerminalView(): React.JSX.Element {
   const styles = useStyles()
+  const screen = useScreenStyles()
   const customCommandEnabled = useSettings((s) => s.customCommandEnabled)
+  const updateSettings = useSettings((s) => s.update)
 
   const [args, setArgs] = useState('')
   const [lines, setLines] = useState<Line[]>([])
@@ -79,13 +93,15 @@ export function TerminalView(): React.JSX.Element {
       window.api.onTerminalOutput((ev) => {
         if (ev.id !== runId.current) return
         if (ev.type === 'output') {
-          setLines((ls) => [...ls, { text: ev.line, kind: ev.stream }])
+          setLines((ls) => [...ls, mkLine(ev.line, ev.stream)].slice(-MAX_LOG_LINES))
         } else if (ev.type === 'error') {
-          setLines((ls) => [...ls, { text: ev.error, kind: 'stderr' }])
+          setLines((ls) => [...ls, mkLine(ev.error, 'stderr')].slice(-MAX_LOG_LINES))
           setRunning(false)
           runId.current = null
         } else {
-          setLines((ls) => [...ls, { text: `— exited (code ${ev.code ?? '?'})`, kind: 'sys' }])
+          setLines((ls) =>
+            [...ls, mkLine(`-- exited (code ${ev.code ?? '?'})`, 'sys')].slice(-MAX_LOG_LINES)
+          )
           setRunning(false)
           runId.current = null
         }
@@ -101,21 +117,21 @@ export function TerminalView(): React.JSX.Element {
   function run(): void {
     const a = args.trim()
     if (!a || running) return
-    const id = newId()
+    const id = newId('t')
     runId.current = id
-    setLines((ls) => [...ls, { text: `> yt-dlp ${a}`, kind: 'cmd' }])
+    setLines((ls) => [...ls, mkLine(`> yt-dlp ${a}`, 'cmd')])
     setRunning(true)
     window.api
       .runTerminal(id, a)
       .then((res) => {
         if (!res.ok) {
-          setLines((ls) => [...ls, { text: res.error ?? 'Failed to start.', kind: 'stderr' }])
+          setLines((ls) => [...ls, mkLine(res.error ?? 'Failed to start.', 'stderr')])
           setRunning(false)
           runId.current = null
         }
       })
       .catch((e: unknown) => {
-        setLines((ls) => [...ls, { text: String(e), kind: 'stderr' }])
+        setLines((ls) => [...ls, mkLine(String(e), 'stderr')])
         setRunning(false)
         runId.current = null
       })
@@ -126,29 +142,47 @@ export function TerminalView(): React.JSX.Element {
   }
 
   const lineClass = (kind: LineKind): string | undefined =>
-    kind === 'cmd' ? styles.cmd : kind === 'stderr' ? styles.stderr : kind === 'sys' ? styles.sys : undefined
+    kind === 'cmd'
+      ? styles.cmd
+      : kind === 'stderr'
+        ? styles.stderr
+        : kind === 'sys'
+          ? styles.sys
+          : undefined
 
   return (
-    <div className={styles.root}>
-      <div className={styles.header}>
-        <Subtitle2>Terminal</Subtitle2>
-        <Caption1 className={styles.sub}>
-          Run the bundled yt-dlp with your own arguments. The URL goes in the args too, e.g.{' '}
-          <code>-F https://youtu.be/…</code>. ffmpeg is wired up automatically.
-        </Caption1>
-      </div>
+    <div className={mergeClasses(styles.root, screen.width)}>
+      <ScreenHeader
+        title="Terminal"
+        description={
+          <>
+            Run the bundled yt-dlp with your own arguments. The URL goes in the args too, e.g.{' '}
+            <code>-F https://youtu.be/…</code>. ffmpeg is wired up automatically.
+          </>
+        }
+      />
 
       {!customCommandEnabled && (
-        <Body1 className={styles.gate}>
-          The terminal is part of custom commands. Turn on “Run custom commands” in Settings →
-          Custom commands to use it.
-        </Body1>
+        <div className={styles.gate}>
+          <Body1>
+            The terminal runs the bundled yt-dlp with your own arguments — part of custom commands,
+            which can pass arbitrary yt-dlp flags. Turn it on to use the terminal.
+          </Body1>
+          <Button
+            appearance="primary"
+            size="small"
+            onClick={() => updateSettings({ customCommandEnabled: true })}
+          >
+            Enable custom commands
+          </Button>
+        </div>
       )}
 
       <div className={styles.inputRow}>
         <div className={styles.inputCol}>
           <Caption1 className={styles.prefix}>yt-dlp</Caption1>
           <Textarea
+            textarea={{ 'aria-label': 'yt-dlp arguments' }}
             value={args}
             onChange={(_, d) => setArgs(d.value)}
             onKeyDown={(e) => {
@@ -164,7 +198,7 @@ export function TerminalView(): React.JSX.Element {
         </div>
         <div className={styles.buttons}>
           {running ? (
-            <Button appearance="secondary" icon={<DismissRegular />} onClick={stop}>
+            <Button appearance="subtle" icon={<DismissRegular />} onClick={stop}>
               Stop
             </Button>
           ) : (
@@ -187,12 +221,12 @@ export function TerminalView(): React.JSX.Element {
         </div>
       </div>
 
-      <pre className={styles.log} ref={logRef}>
+      <pre className={mergeClasses(styles.log, lines.length === 0 && styles.logEmpty)} ref={logRef}>
         {lines.length === 0 ? (
-          <span className={styles.empty}>Output will appear here.</span>
+          <EmptyState compact message="No output yet." hint="Run yt-dlp above to see its output." />
         ) : (
-          lines.map((l, i) => (
-            <div key={i} className={lineClass(l.kind)}>
+          lines.map((l) => (
+            <div key={l.id} className={lineClass(l.kind)}>
               {l.text}
             </div>
           ))
diff --git a/src/renderer/src/components/VirtualList.tsx b/src/renderer/src/components/VirtualList.tsx
index 9bd9bc0..61d5915 100644
--- a/src/renderer/src/components/VirtualList.tsx
+++ b/src/renderer/src/components/VirtualList.tsx
@@ -42,28 +42,35 @@ export function VirtualList<T>({
     estimateSize,
     overscan,
     gap,
-    getItemKey: (index) => getKey(items[index], index)
+    getItemKey: (index) => {
+      const it = items[index]
+      return it !== undefined ? getKey(it, index) : index
+    }
   })
 
   return (
     <div ref={scrollRef} className={className} style={{ overflowY: 'auto', ...style }}>
       <div style={{ height: virtualizer.getTotalSize(), position: 'relative', width: '100%' }}>
-        {virtualizer.getVirtualItems().map((vrow) => (
-          <div
-            key={vrow.key}
-            data-index={vrow.index}
-            ref={virtualizer.measureElement}
-            style={{
-              position: 'absolute',
-              top: 0,
-              left: 0,
-              width: '100%',
-              transform: `translateY(${vrow.start}px)`
-            }}
-          >
-            {renderItem(items[vrow.index], vrow.index)}
-          </div>
-        ))}
+        {virtualizer.getVirtualItems().map((vrow) => {
+          const item = items[vrow.index]
+          if (item === undefined) return null
+          return (
+            <div
+              key={vrow.key}
+              data-index={vrow.index}
+              ref={virtualizer.measureElement}
+              style={{
+                position: 'absolute',
+                top: 0,
+                left: 0,
+                width: '100%',
+                transform: `translateY(${vrow.start}px)`
+              }}
+            >
+              {renderItem(item, vrow.index)}
+            </div>
+          )
+        })}
       </div>
     </div>
   )
diff --git a/src/renderer/src/components/downloadBar/PlaylistPanel.tsx b/src/renderer/src/components/downloadBar/PlaylistPanel.tsx
new file mode 100644
index 0000000..666d6f3
--- /dev/null
+++ b/src/renderer/src/components/downloadBar/PlaylistPanel.tsx
@@ -0,0 +1,97 @@
+import { Button, Checkbox, Caption1, mergeClasses } from '@fluentui/react-components'
+import { AppsListRegular, VideoClipRegular, MusicNote2Regular } from '@fluentui/react-icons'
+import { type PlaylistInfo } from '@shared/ipc'
+import { type MediaKind } from '../../store/downloads'
+import { Hint } from '../Hint'
+import { IconButton } from '../ui/IconButton'
+import { useTextStyles } from '../ui/text'
+import { META_SEP } from '../ui/tokens'
+import { useDownloadBarStyles } from './styles'
+
+interface PlaylistPanelProps {
+  playlist: PlaylistInfo
+  selected: Set<number>
+  allSelected: boolean
+  onToggleAll: () => void
+  onSetAllKinds: (k: MediaKind) => void
+  onToggleEntry: (index: number, on: boolean) => void
+  effKind: (index: number) => MediaKind
+  onToggleItemKind: (index: number) => void
+}
+
+export function PlaylistPanel({
+  playlist,
+  selected,
+  allSelected,
+  onToggleAll,
+  onSetAllKinds,
+  onToggleEntry,
+  effKind,
+  onToggleItemKind
+}: PlaylistPanelProps): React.JSX.Element {
+  const styles = useDownloadBarStyles()
+  const text = useTextStyles()
+  return (
+    <div className={styles.plPanel}>
+      <div className={styles.plHeader}>
+        <AppsListRegular />
+        <Caption1 className={mergeClasses(styles.plHeaderGrow, text.title)}>
+          {playlist.title}
+          {playlist.uploader ? `${META_SEP}${playlist.uploader}` : ''}
+        </Caption1>
+        <Caption1 className={text.muted}>
+          {selected.size} of {playlist.count} selected
+        </Caption1>
+        <Button size="small" appearance="subtle" onClick={onToggleAll}>
+          {allSelected ? 'Select none' : 'Select all'}
+        </Button>
+        <Button size="small" appearance="subtle" onClick={() => onSetAllKinds('video')}>
+          All video
+        </Button>
+        <Button size="small" appearance="subtle" onClick={() => onSetAllKinds('audio')}>
+          All audio
+        </Button>
+      </div>
+      <div className={styles.plList}>
+        {playlist.entries.map((e) => (
+          <div key={e.index} className={styles.plItemRow}>
+            <Checkbox
+              className={styles.plItem}
+              checked={selected.has(e.index)}
+              onChange={(_, d) => onToggleEntry(e.index, !!d.checked)}
+              label={
+                <span className={styles.plItemLabel}>
+                  <span className={text.truncate}>
+                    {e.index}. {e.title}
+                  </span>
+                  {(e.durationLabel || e.uploader) && (
+                    <Caption1 className={text.muted}>
+                      {[e.durationLabel, e.uploader].filter(Boolean).join(META_SEP)}
+                    </Caption1>
+                  )}
+                </span>
+              }
+            />
+            <Hint
+              label={
+                effKind(e.index) === 'audio'
+                  ? 'Audio -- click for video'
+                  : 'Video -- click for audio'
+              }
+              placement="top"
+              align="end"
+            >
+              <IconButton
+                size="sm"
+                style={{ flexShrink: 0 }}
+                icon={effKind(e.index) === 'audio' ? <MusicNote2Regular /> : <VideoClipRegular />}
+                onClick={() => onToggleItemKind(e.index)}
+                aria-label={`Download type for ${e.title}: ${effKind(e.index)}`}
+              />
+            </Hint>
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/downloadBar/styles.ts b/src/renderer/src/components/downloadBar/styles.ts
new file mode 100644
index 0000000..06ac073
--- /dev/null
+++ b/src/renderer/src/components/downloadBar/styles.ts
@@ -0,0 +1,191 @@
+import { makeStyles, tokens, shorthands } from '@fluentui/react-components'
+import { THUMB_LG } from '../../thumbSizes'
+import { SPACE, RADIUS, ELEVATION } from '../ui/tokens'
+
+export const useDownloadBarStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: SPACE.cozy,
+    // Page-level card: card padding + card radius, and the app's one "raised"
+    // elevation — the download bar floats above the queue (UI3/UI7/L100).
+    padding: SPACE.section,
+    backgroundColor: tokens.colorNeutralBackground1,
+    ...shorthands.borderRadius(RADIUS.card),
+    boxShadow: ELEVATION.raised
+  },
+  // Highlight while a link / .url file is dragged over the card.
+  rootDragging: {
+    outline: `2px dashed ${tokens.colorBrandStroke1}`,
+    outlineOffset: '-2px'
+  },
+  urlRow: {
+    display: 'flex',
+    gap: '8px'
+  },
+  url: {
+    flexGrow: 1
+  },
+  // --- metadata preview card ---
+  preview: {
+    display: 'flex',
+    gap: '12px',
+    padding: '10px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  },
+  previewThumb: {
+    flexShrink: 0,
+    width: `${THUMB_LG.w}px`,
+    height: `${THUMB_LG.h}px`,
+    objectFit: 'cover',
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+    backgroundColor: tokens.colorBrandBackground2,
+    color: tokens.colorBrandForeground1,
+    // One thumbnail radius app-wide (UI6): control tier / Medium.
+    ...shorthands.borderRadius(RADIUS.control)
+  },
+  previewBody: {
+    flexGrow: 1,
+    minWidth: 0,
+    display: 'flex',
+    flexDirection: 'column',
+    justifyContent: 'center',
+    gap: '2px'
+  },
+  statusRow: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px',
+    color: tokens.colorNeutralForeground3
+  },
+  errorRow: {
+    color: tokens.colorPaletteRedForeground1
+  },
+  controls: {
+    display: 'flex',
+    alignItems: 'flex-end',
+    gap: '16px',
+    flexWrap: 'wrap'
+  },
+  control: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '4px'
+  },
+  quality: {
+    minWidth: '220px'
+  },
+  spacer: {
+    flexGrow: 1
+  },
+  // --- playlist selection ---
+  plPanel: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '8px',
+    padding: '12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  },
+  plHeader: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px'
+  },
+  // Just the layout role; the truncation + weight come from the shared text.title
+  // (L114/L126), merged on at the call site.
+  plHeaderGrow: {
+    flexGrow: 1
+  },
+  plList: {
+    display: 'flex',
+    flexDirection: 'column',
+    maxHeight: '260px',
+    overflowY: 'auto',
+    paddingRight: '4px'
+  },
+  plItemRow: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px'
+  },
+  plItem: {
+    display: 'flex',
+    alignItems: 'flex-start',
+    padding: '2px 0',
+    flexGrow: 1,
+    minWidth: 0
+  },
+  plItemLabel: {
+    display: 'flex',
+    flexDirection: 'column',
+    minWidth: 0
+  },
+  // --- trim / schedule panels ---
+  trimBlock: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '8px',
+    alignItems: 'flex-start'
+  },
+  optButtons: {
+    display: 'flex',
+    gap: '8px'
+  },
+  trimPanel: {
+    alignSelf: 'stretch',
+    padding: '12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  },
+  // Native datetime-local input, themed to sit beside the Fluent controls.
+  // No explicit `colorScheme` here (UI32): it inherits the resolved in-app scheme
+  // set on the app root in App.tsx, so the native calendar popup follows the app's
+  // Light/Dark theme — consistent with the native <Select> — rather than the OS
+  // preference (which the former `'light dark'` value tied it to).
+  dtInput: {
+    fontFamily: tokens.fontFamilyBase,
+    fontSize: tokens.fontSizeBase300,
+    padding: '6px 10px',
+    ...shorthands.borderRadius(tokens.borderRadiusMedium),
+    border: `1px solid ${tokens.colorNeutralStroke1}`,
+    backgroundColor: tokens.colorNeutralBackground1,
+    color: tokens.colorNeutralForeground1
+  },
+  // --- command preview & options panels ---
+  commandBlock: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '8px'
+  },
+  commandPreviewPanel: {
+    padding: '12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    fontFamily: tokens.fontFamilyMonospace,
+    fontSize: tokens.fontSizeBase200,
+    overflowX: 'auto',
+    whiteSpace: 'pre-wrap',
+    wordBreak: 'break-all',
+    color: tokens.colorNeutralForeground1
+  },
+  commandError: {
+    color: tokens.colorStatusDangerForeground1
+  },
+  optionsPanel: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '12px',
+    padding: '12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  }
+})
diff --git a/src/renderer/src/components/downloadBar/useDownloadBar.ts b/src/renderer/src/components/downloadBar/useDownloadBar.ts
new file mode 100644
index 0000000..ca1f21d
--- /dev/null
+++ b/src/renderer/src/components/downloadBar/useDownloadBar.ts
@@ -0,0 +1,606 @@
+import { useState, useEffect, useRef, type Dispatch, type SetStateAction } from 'react'
+import {
+  parseUrlShortcutContent,
+  type MediaInfo,
+  type FormatOption,
+  type PlaylistInfo,
+  type DownloadOptions,
+  DEFAULT_DOWNLOAD_OPTIONS,
+  type CommandPreviewResult
+} from '@shared/ipc'
+import { useDownloads, type MediaKind } from '../../store/downloads'
+import { useHistory } from '../../store/history'
+import { QUALITY_OPTIONS } from '../../qualityOptions'
+import { sameVideo } from '../../store/queueStats'
+import { useSettings } from '../../store/settings'
+import { useNav } from '../../store/nav'
+import {
+  useClipboardLink,
+  looksLikeUrl,
+  looksLikeChannelOrPlaylist,
+  firstUrlInText,
+  type SuggestionSource
+} from '../../useClipboardLink'
+import { logError } from '../../reportError'
+
+/** Pull the URL= target out of a dropped Windows .url Internet Shortcut file. */
+function parseUrlFile(content: string): string | null {
+  const url = parseUrlShortcutContent(content)
+  return url && looksLikeUrl(url) ? url : null
+}
+
+// Format a Date as the `YYYY-MM-DDTHH:mm` value a datetime-local input expects,
+// in LOCAL time -- used as the picker's `min` so a past time can't be chosen and
+// then silently download immediately (L156/L57).
+export function toLocalDatetimeValue(d: Date): string {
+  const pad = (n: number): string => String(n).padStart(2, '0')
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`
+}
+
+/** Everything the DownloadBar render needs — the hook's public surface. */
+export interface DownloadBarController {
+  // form state
+  url: string
+  kind: MediaKind
+  quality: string
+  // trim / schedule
+  showTrim: boolean
+  setShowTrim: Dispatch<SetStateAction<boolean>>
+  trim: string
+  showSchedule: boolean
+  setShowSchedule: Dispatch<SetStateAction<boolean>>
+  scheduleAt: string
+  setScheduleAt: Dispatch<SetStateAction<string>>
+  // drag / dup
+  dragActive: boolean
+  setDragActive: Dispatch<SetStateAction<boolean>>
+  dup: string | null
+  setDup: Dispatch<SetStateAction<string | null>>
+  /** true when the duplicate was found in history (already downloaded) vs the live queue (L144). */
+  dupInHistory: boolean
+  // advanced / preview
+  showAdvanced: boolean
+  setShowAdvanced: Dispatch<SetStateAction<boolean>>
+  downloadOptions: DownloadOptions
+  incognito: boolean
+  setIncognito: Dispatch<SetStateAction<boolean>>
+  commandPreview: CommandPreviewResult | null
+  previewLoading: boolean
+  // probe (single video)
+  info: MediaInfo | null
+  thumbFailed: string | null
+  setThumbFailed: Dispatch<SetStateAction<string | null>>
+  probing: boolean
+  probeError: string | null
+  usingFormats: boolean
+  selectedFormat: FormatOption | undefined
+  // playlist
+  playlist: PlaylistInfo | null
+  selected: Set<number>
+  allSelected: boolean
+  // suggestion banner
+  suggestion: string | null
+  suggestionSource: SuggestionSource
+  dismissSuggestion: () => void
+  // channel/playlist nudge → Library (UX3)
+  channelHint: boolean
+  openInLibrary: () => void
+  dismissChannelHint: () => void
+  // handlers
+  onDragEnter: (e: React.DragEvent) => void
+  onDragOver: (e: React.DragEvent) => void
+  onDragLeave: () => void
+  onDrop: (e: React.DragEvent) => void
+  onUrlChange: (next: string) => void
+  onKindChange: (next: MediaKind) => void
+  onQualityChange: (v: string) => void
+  onFormatIdChange: (v: string) => void
+  onTrimChange: (v: string) => void
+  onDownloadOptionsChange: (next: DownloadOptions) => void
+  toggleCommandPreview: () => Promise<void>
+  fetchFormats: () => Promise<void>
+  paste: () => Promise<void>
+  acceptSuggestion: () => void
+  download: () => void
+  downloadAnyway: () => void
+  addPlaylist: () => void
+  toggleEntry: (index: number, on: boolean) => void
+  toggleAll: () => void
+  effKind: (index: number) => MediaKind
+  toggleItemKind: (index: number) => void
+  setAllKinds: (k: MediaKind) => void
+}
+
+/**
+ * All state and behaviour for the DownloadBar. Extracted from the component so
+ * the ~17 interdependent state hooks and their handlers live in one place and
+ * the component is render-only.
+ */
+export function useDownloadBar(): DownloadBarController {
+  const addFromUrl = useDownloads((s) => s.addFromUrl)
+  const addMany = useDownloads((s) => s.addMany)
+  const openLibraryWith = useNav((s) => s.openLibraryWith)
+  const settingsLoaded = useSettings((s) => s.loaded)
+  const defaultKind = useSettings((s) => s.defaultKind)
+  const defaultVideoQuality = useSettings((s) => s.defaultVideoQuality)
+  const defaultAudioQuality = useSettings((s) => s.defaultAudioQuality)
+
+  const [url, setUrl] = useState('')
+  const [kind, setKind] = useState<MediaKind>('video')
+  const [quality, setQuality] = useState<string>(QUALITY_OPTIONS.video[0])
+
+  // Optional trim: keep only certain time ranges. Raw text, normalised in main.
+  const [showTrim, setShowTrim] = useState(false)
+  const [trim, setTrim] = useState('')
+
+  // Optional schedule: a datetime-local value; a future time parks the download.
+  const [showSchedule, setShowSchedule] = useState(false)
+  const [scheduleAt, setScheduleAt] = useState('')
+
+  // Drag-and-drop: highlight while a link / .url file hovers the card.
+  const [dragActive, setDragActive] = useState(false)
+
+  // Channel/playlist nudge: a whole channel/playlist belongs in the Library, not
+  // the one-off queue. Once dismissed for the current URL, stay quiet (UX3).
+  const [channelHintDismissed, setChannelHintDismissed] = useState(false)
+
+  // Duplicate guard: warn before enqueuing a URL already in the active queue.
+  const [dup, setDup] = useState<string | null>(null)
+  // Whether the duplicate matched a history entry (already downloaded) rather than
+  // a live queue item (L144) — the banner wording differs.
+  const [dupInHistory, setDupInHistory] = useState(false)
+  const confirmDup = useRef(false)
+
+  // Per-download options (M5/M6/UX1): advanced features.
+  const [showAdvanced, setShowAdvanced] = useState(false)
+  const [downloadOptions, setDownloadOptions] = useState<DownloadOptions>(DEFAULT_DOWNLOAD_OPTIONS)
+  const [incognito, setIncognito] = useState(false)
+  const [commandPreview, setCommandPreview] = useState<CommandPreviewResult | null>(null)
+  const [previewLoading, setPreviewLoading] = useState(false)
+
+  // Probe state for the single-video format picker.
+  const [info, setInfo] = useState<MediaInfo | null>(null)
+  const [thumbFailed, setThumbFailed] = useState<string | null>(null)
+  const [probing, setProbing] = useState(false)
+  const [probeError, setProbeError] = useState<string | null>(null)
+  const [formatId, setFormatId] = useState<string>('')
+
+  // Probe state for a playlist URL.
+  const [playlist, setPlaylist] = useState<PlaylistInfo | null>(null)
+  const [selected, setSelected] = useState<Set<number>>(new Set())
+  // Per-entry kind override (entry.index → 'video' | 'audio'); absent = use the
+  // bar's global kind. Lets a playlist mix video and audio downloads.
+  const [itemKinds, setItemKinds] = useState<Record<number, MediaKind>>({})
+
+  // Drag highlight is gated on a depth counter, not raw enter/leave (L158): a
+  // dragleave fires every time the cursor crosses onto a child element, so toggling
+  // on leave made the dashed outline blink. Count enters vs leaves and only clear
+  // the highlight when the drag has actually left the whole card (depth back to 0).
+  const dragDepth = useRef(0)
+  function onDragEnter(e: React.DragEvent): void {
+    e.preventDefault()
+    dragDepth.current += 1
+    if (!dragActive) setDragActive(true)
+  }
+  function onDragOver(e: React.DragEvent): void {
+    // Required so the element is a valid drop target; the highlight is owned by
+    // onDragEnter/onDragLeave.
+    e.preventDefault()
+  }
+  function onDragLeave(): void {
+    dragDepth.current = Math.max(0, dragDepth.current - 1)
+    if (dragDepth.current === 0) setDragActive(false)
+  }
+  function onDrop(e: React.DragEvent): void {
+    e.preventDefault()
+    dragDepth.current = 0
+    setDragActive(false)
+    const dt = e.dataTransfer
+    const fromText = firstUrlInText(dt.getData('text/uri-list') || dt.getData('text/plain') || '')
+    if (fromText) {
+      onUrlChange(fromText)
+      return
+    }
+    // A dropped Windows .url Internet Shortcut -- read its URL= line.
+    const file = Array.from(dt.files).find((f) => f.name.toLowerCase().endsWith('.url'))
+    if (file) {
+      file
+        .text()
+        .then((content) => {
+          const u = parseUrlFile(content)
+          if (u) onUrlChange(u)
+        })
+        .catch(logError('dropped .url file read'))
+    }
+  }
+
+  // When settings load or change, update kind/quality -- but only while the bar
+  // is idle (URL empty) so an in-progress setup isn't unexpectedly reset.
+  useEffect(() => {
+    if (!settingsLoaded || url.trim()) return
+    setKind(defaultKind)
+    setQuality(defaultKind === 'audio' ? defaultAudioQuality : defaultVideoQuality)
+  }, [settingsLoaded, defaultKind, defaultVideoQuality, defaultAudioQuality, url])
+
+  // Clipboard auto-detect and links handed to AeroFetch from outside (the
+  // aerofetch:// protocol or a "Send to" .url file) share one suggestion banner,
+  // driven by the same hook the library's add-source field uses. An external link
+  // always takes priority over a clipboard guess -- it's a direct request.
+  const {
+    suggestion,
+    source: suggestionSource,
+    accept: acceptLink,
+    dismiss: dismissSuggestion,
+    offer: offerLink
+  } = useClipboardLink(url)
+  useEffect(
+    () => window.api.onExternalUrl((incoming) => offerLink(incoming, 'external')),
+    [offerLink]
+  )
+
+  function acceptSuggestion(): void {
+    const link = acceptLink()
+    if (link) onUrlChange(link)
+  }
+
+  const usingFormats = kind === 'video' && info !== null && info.formats.length > 0
+  const selectedFormat: FormatOption | undefined = usingFormats
+    ? (info.formats.find((f) => f.id === formatId) ?? info.formats[0])
+    : undefined
+
+  // Show the "add this in the Library" nudge for a clear channel/playlist URL,
+  // but only while the bar is still idle for it (nothing probed/resolved yet) and
+  // the user hasn't waved it away (UX3).
+  const channelHint =
+    looksLikeChannelOrPlaylist(url) &&
+    !channelHintDismissed &&
+    info === null &&
+    playlist === null &&
+    probeError === null
+
+  function clearProbe(): void {
+    setInfo(null)
+    setProbeError(null)
+    setFormatId('')
+    setPlaylist(null)
+    setSelected(new Set())
+    setItemKinds({})
+  }
+
+  // Reset the whole bar after a download / playlist is enqueued: clear the URL +
+  // probe and drop the one-shot overrides (trim / schedule / advanced / incognito /
+  // per-download options) so the next download starts from the global defaults.
+  // Shared by download() and addPlaylist() so a playlist add resets the same state
+  // a single download does (L132 — addPlaylist previously left trim/schedule open).
+  function resetForm(): void {
+    setUrl('')
+    setTrim('')
+    setShowTrim(false)
+    setScheduleAt('')
+    setShowSchedule(false)
+    setShowAdvanced(false)
+    setCommandPreview(null)
+    setIncognito(false)
+    setDownloadOptions(DEFAULT_DOWNLOAD_OPTIONS)
+    clearProbe()
+  }
+
+  // Fetch (or toggle off) the exact yt-dlp command line for the current form
+  // state. The options mirror what download() sends so the preview matches the
+  // command that will actually run -- including a probe-selected format and any
+  // trim spec (M5).
+  async function toggleCommandPreview(): Promise<void> {
+    if (commandPreview) {
+      setCommandPreview(null)
+      return
+    }
+    const trimmed = url.trim()
+    if (!trimmed) return
+    setPreviewLoading(true)
+    try {
+      const result = await window.api.previewCommand({
+        id: 'preview',
+        url: trimmed,
+        kind: usingFormats ? 'video' : kind,
+        quality: usingFormats && selectedFormat ? selectedFormat.label : quality,
+        formatId: usingFormats ? selectedFormat?.id : undefined,
+        formatHasAudio: usingFormats ? selectedFormat?.hasAudio : undefined,
+        options: downloadOptions,
+        trim: trim.trim() || undefined
+      })
+      setCommandPreview(result)
+    } catch (e) {
+      setCommandPreview({ ok: false, error: (e as Error).message })
+    } finally {
+      setPreviewLoading(false)
+    }
+  }
+
+  function onUrlChange(next: string): void {
+    setUrl(next)
+    // Any probed info -- or a duplicate warning -- is stale once the URL changes.
+    if (info || probeError || playlist) clearProbe()
+    if (dup) setDup(null)
+    setCommandPreview(null)
+    confirmDup.current = false
+    // A new URL gets a fresh chance to nudge toward the Library.
+    setChannelHintDismissed(false)
+  }
+
+  function onKindChange(next: MediaKind): void {
+    setKind(next)
+    setQuality(QUALITY_OPTIONS[next][0])
+    // The command changes with kind/quality, so any shown preview is now stale.
+    setCommandPreview(null)
+  }
+
+  // Any change to quality / format / trim / options invalidates a shown preview.
+  function onQualityChange(v: string): void {
+    setQuality(v)
+    setCommandPreview(null)
+  }
+  function onFormatIdChange(v: string): void {
+    setFormatId(v)
+    setCommandPreview(null)
+  }
+  function onTrimChange(v: string): void {
+    setTrim(v)
+    setCommandPreview(null)
+  }
+  function onDownloadOptionsChange(next: DownloadOptions): void {
+    setDownloadOptions(next)
+    setCommandPreview(null)
+  }
+
+  async function fetchFormats(): Promise<void> {
+    const trimmed = url.trim()
+    if (!trimmed || probing) return
+    setProbing(true)
+    setProbeError(null)
+    setInfo(null)
+    setPlaylist(null)
+    // Probing may switch the URL to the format-picker path, changing the command.
+    setCommandPreview(null)
+    try {
+      const res = await window.api.probe(trimmed)
+      if (res.ok && res.kind === 'playlist' && res.playlist) {
+        setPlaylist(res.playlist)
+        // Pre-select every entry; the user can trim the list.
+        setSelected(new Set(res.playlist.entries.map((e) => e.index)))
+      } else if (res.ok && res.info) {
+        setInfo(res.info)
+        setFormatId(res.info.formats[0]?.id ?? '')
+      } else {
+        setProbeError(res.error ?? 'Could not fetch video info.')
+      }
+    } catch (e) {
+      setProbeError(String(e))
+    } finally {
+      setProbing(false)
+    }
+  }
+
+  async function paste(): Promise<void> {
+    try {
+      const text = (await window.api?.readClipboard?.()) ?? ''
+      if (text) onUrlChange(text.trim())
+    } catch {
+      /* ignore in preview */
+    }
+  }
+
+  // Hand the current channel/playlist URL to the Library tab, which pre-fills its
+  // add field with it, and clear the bar (the URL now lives over there) (UX3).
+  function openInLibrary(): void {
+    const trimmed = url.trim()
+    if (!trimmed) return
+    openLibraryWith(trimmed)
+    setUrl('')
+    // Clear the URL-specific command preview too, so no stale command lingers over
+    // the now-empty bar (the same invariant onUrlChange keeps).
+    setCommandPreview(null)
+    clearProbe()
+  }
+  function dismissChannelHint(): void {
+    setChannelHintDismissed(true)
+  }
+
+  // Selection helpers for the playlist panel.
+  const allSelected = playlist !== null && selected.size === playlist.entries.length
+  function toggleEntry(index: number, on: boolean): void {
+    setSelected((prev) => {
+      const next = new Set(prev)
+      if (on) next.add(index)
+      else next.delete(index)
+      return next
+    })
+  }
+  function toggleAll(): void {
+    if (!playlist) return
+    setSelected(allSelected ? new Set() : new Set(playlist.entries.map((e) => e.index)))
+  }
+
+  // Per-entry kind: the override if set, else the bar's global kind.
+  function effKind(index: number): MediaKind {
+    return itemKinds[index] ?? kind
+  }
+  function toggleItemKind(index: number): void {
+    setItemKinds((m) => ({ ...m, [index]: effKind(index) === 'audio' ? 'video' : 'audio' }))
+  }
+  function setAllKinds(k: MediaKind): void {
+    if (!playlist) return
+    const all: Record<number, MediaKind> = {}
+    for (const e of playlist.entries) all[e.index] = k
+    setItemKinds(all)
+  }
+
+  function download(): void {
+    const trimmed = url.trim()
+    if (!trimmed) return
+
+    // Duplicate guard: if this URL is already in the queue (and the user hasn't
+    // confirmed via "Download anyway"), warn instead of silently enqueuing a copy.
+    // Canceled/failed items don't count -- re-adding those is a legitimate retry.
+    if (!confirmDup.current) {
+      const existing = useDownloads
+        .getState()
+        .items.find(
+          (i) => i.status !== 'canceled' && i.status !== 'error' && sameVideo(i.url, trimmed)
+        )
+      if (existing) {
+        // Use the URL as fallback if the title is still the placeholder generated
+        // by titleFromUrl() before metadata loads (L76).
+        const isPlaceholder =
+          /video \(\w+\)$/.test(existing.title) ||
+          existing.title.endsWith(' download') ||
+          existing.title === 'New download'
+        setDup(isPlaceholder ? existing.url : existing.title)
+        setDupInHistory(false)
+        return
+      }
+      // Not in the queue, but maybe already downloaded earlier (L144): warn so a
+      // re-download is a deliberate choice, not an accidental duplicate.
+      const downloaded = useHistory.getState().entries.find((h) => sameVideo(h.url, trimmed))
+      if (downloaded) {
+        setDup(downloaded.title || downloaded.url)
+        setDupInHistory(true)
+        return
+      }
+    }
+    confirmDup.current = false
+    setDup(null)
+
+    const meta = info
+      ? {
+          title: info.title,
+          channel: info.channel,
+          durationLabel: info.durationLabel,
+          thumbnail: info.thumbnail
+        }
+      : {}
+
+    const trimSpec = trim.trim() || undefined
+    const scheduledFor = scheduleAt ? new Date(scheduleAt).getTime() : undefined
+
+    if (usingFormats && selectedFormat) {
+      addFromUrl(trimmed, 'video', selectedFormat.label, {
+        ...meta,
+        trim: trimSpec,
+        scheduledFor,
+        options: downloadOptions,
+        incognito,
+        format: {
+          id: selectedFormat.id,
+          hasAudio: selectedFormat.hasAudio,
+          label: selectedFormat.label
+        }
+      })
+    } else {
+      addFromUrl(trimmed, kind, quality, {
+        ...meta,
+        trim: trimSpec,
+        scheduledFor,
+        options: downloadOptions,
+        incognito
+      })
+    }
+
+    resetForm()
+  }
+
+  function downloadAnyway(): void {
+    confirmDup.current = true
+    download()
+  }
+
+  function addPlaylist(): void {
+    if (!playlist) return
+    const chosen = playlist.entries.filter((e) => selected.has(e.index))
+    // Each entry uses its own kind override; quality falls back to that kind's
+    // default unless the entry matches the bar's current kind/quality.
+    addMany(
+      chosen.map((e) => {
+        const k = effKind(e.index)
+        return {
+          url: e.url,
+          kind: k,
+          quality: k === kind ? quality : QUALITY_OPTIONS[k][0],
+          opts: { title: e.title, channel: e.uploader, durationLabel: e.durationLabel }
+        }
+      })
+    )
+    resetForm()
+  }
+
+  return {
+    // form state
+    url,
+    kind,
+    quality,
+    // trim / schedule
+    showTrim,
+    setShowTrim,
+    trim,
+    showSchedule,
+    setShowSchedule,
+    scheduleAt,
+    setScheduleAt,
+    // drag / dup
+    dupInHistory,
+    dragActive,
+    setDragActive,
+    dup,
+    setDup,
+    // advanced / preview
+    showAdvanced,
+    setShowAdvanced,
+    downloadOptions,
+    incognito,
+    setIncognito,
+    commandPreview,
+    previewLoading,
+    // probe (single video)
+    info,
+    thumbFailed,
+    setThumbFailed,
+    probing,
+    probeError,
+    usingFormats,
+    selectedFormat,
+    // playlist
+    playlist,
+    selected,
+    allSelected,
+    // suggestion banner
+    suggestion,
+    suggestionSource,
+    dismissSuggestion,
+    // channel/playlist nudge → Library (UX3)
+    channelHint,
+    openInLibrary,
+    dismissChannelHint,
+    // handlers
+    onDragEnter,
+    onDragOver,
+    onDragLeave,
+    onDrop,
+    onUrlChange,
+    onKindChange,
+    onQualityChange,
+    onFormatIdChange,
+    onTrimChange,
+    onDownloadOptionsChange,
+    toggleCommandPreview,
+    fetchFormats,
+    paste,
+    acceptSuggestion,
+    download,
+    downloadAnyway,
+    addPlaylist,
+    toggleEntry,
+    toggleAll,
+    effKind,
+    toggleItemKind,
+    setAllKinds
+  }
+}
diff --git a/src/renderer/src/components/settings/AboutCard.tsx b/src/renderer/src/components/settings/AboutCard.tsx
new file mode 100644
index 0000000..7f993e3
--- /dev/null
+++ b/src/renderer/src/components/settings/AboutCard.tsx
@@ -0,0 +1,181 @@
+import { useEffect, useState } from 'react'
+import {
+  Field,
+  Switch,
+  Button,
+  Card,
+  Subtitle2,
+  Caption1,
+  Text,
+  Spinner
+} from '@fluentui/react-components'
+import { InfoRegular, ArrowSyncRegular } from '@fluentui/react-icons'
+import {
+  type YtdlpVersionResult,
+  type YtdlpUpdateChannel,
+  type YtdlpUpdateResult,
+  type FfmpegVersionResult
+} from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { Select } from '../Select'
+import { useErrorTextStyles } from '../ui/errorText'
+import { logError } from '../../reportError'
+import { useSettingsStyles } from './settingsStyles'
+
+const UPDATE_CHANNEL_OPTIONS = [
+  { value: 'stable', label: 'Stable' },
+  { value: 'nightly', label: 'Nightly' }
+]
+
+export function AboutCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const errText = useErrorTextStyles()
+  const autoUpdateYtdlp = useSettings((s) => s.autoUpdateYtdlp)
+  const ytdlpChannel = useSettings((s) => s.ytdlpChannel)
+  const ytdlpLastUpdateCheck = useSettings((s) => s.ytdlpLastUpdateCheck)
+  const update = useSettings((s) => s.update)
+
+  const [checking, setChecking] = useState(false)
+  const [version, setVersion] = useState<YtdlpVersionResult | null>(null)
+  const [ffmpeg, setFfmpeg] = useState<FfmpegVersionResult | null>(null)
+  const [updating, setUpdating] = useState(false)
+  const [updateResult, setUpdateResult] = useState<YtdlpUpdateResult | null>(null)
+
+  useEffect(() => {
+    // Show the current yt-dlp version without a manual click, and reflect a
+    // background auto-update (which may run on launch) live in this panel.
+    window.api.getYtdlpVersion().then(setVersion).catch(logError('getYtdlpVersion'))
+    // ffmpeg/ffprobe are display-only (bundled, not auto-updated); load them once.
+    window.api.getFfmpegVersions().then(setFfmpeg).catch(logError('getFfmpegVersions'))
+    return window.api.onYtdlpAutoUpdateStatus((s) => {
+      if (s.phase === 'checking') {
+        setChecking(true)
+        return
+      }
+      setChecking(false)
+      if (s.version) setVersion({ ok: true, version: s.version })
+      if (s.checkedAt) useSettings.setState({ ytdlpLastUpdateCheck: s.checkedAt })
+      if (s.phase === 'updated') {
+        setUpdateResult({ ok: true, output: `Updated to yt-dlp ${s.version ?? ''}`.trim() })
+      } else if (s.phase === 'error' && s.error) {
+        setUpdateResult({ ok: false, error: s.error })
+      }
+    })
+  }, [])
+
+  async function checkVersion(): Promise<void> {
+    setChecking(true)
+    setVersion(null)
+    try {
+      setVersion(await window.api.getYtdlpVersion())
+    } catch (e) {
+      setVersion({ ok: false, error: e instanceof Error ? e.message : String(e) })
+    } finally {
+      setChecking(false)
+    }
+  }
+
+  async function runUpdate(): Promise<void> {
+    setUpdating(true)
+    setUpdateResult(null)
+    try {
+      const result = await window.api.updateYtdlp(ytdlpChannel)
+      setUpdateResult(result)
+      if (result.ok) setVersion(null) // stale -- prompt a re-check rather than show a wrong version
+    } catch (e) {
+      setUpdateResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
+    } finally {
+      setUpdating(false)
+    }
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <InfoRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">About</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        AeroFetch is a generic frontend for yt-dlp. It bundles ffmpeg and manages its own copy of
+        yt-dlp, keeping it up to date automatically.
+      </Caption1>
+      <div className={styles.folderRow}>
+        {/* Re-show the first-run welcome/tips screen on demand (UX22). */}
+        <Button size="small" onClick={() => update({ hasCompletedOnboarding: false })}>
+          Show welcome tips again
+        </Button>
+      </div>
+
+      <Field
+        label="Keep yt-dlp updated automatically"
+        hint="Checks once a day on launch and updates the downloader in the background, so site changes don't start breaking your downloads."
+      >
+        <Switch
+          checked={autoUpdateYtdlp}
+          onChange={(_, d) => update({ autoUpdateYtdlp: d.checked })}
+        />
+      </Field>
+
+      {version?.ok && <Text className={styles.mono}>yt-dlp {version.version}</Text>}
+      {version && !version.ok && <Caption1 className={errText.errorPre}>{version.error}</Caption1>}
+      {ffmpeg && (
+        <div className={styles.folderRow}>
+          <div>
+            <Text className={styles.monoBlock}>ffmpeg {ffmpeg.ffmpeg ?? 'not found'}</Text>
+            <Text className={styles.monoBlock}>ffprobe {ffmpeg.ffprobe ?? 'not found'}</Text>
+          </div>
+          <Button
+            appearance="subtle"
+            icon={<ArrowSyncRegular />}
+            onClick={() =>
+              window.api.getFfmpegVersions().then(setFfmpeg).catch(logError('getFfmpegVersions'))
+            }
+            aria-label="Re-check ffmpeg versions"
+          />
+        </div>
+      )}
+      {ytdlpLastUpdateCheck > 0 && (
+        <Caption1 className={styles.hint}>
+          Last checked for updates {new Date(ytdlpLastUpdateCheck).toLocaleString()}.
+        </Caption1>
+      )}
+      <div className={styles.folderRow}>
+        <Button
+          icon={checking ? <Spinner size="tiny" /> : <ArrowSyncRegular />}
+          onClick={checkVersion}
+          disabled={checking}
+        >
+          Check yt-dlp version
+        </Button>
+      </div>
+
+      <Field
+        label="Update channel"
+        hint="Nightly tracks yt-dlp's daily build; stable is the tagged release. Nightly follows YouTube changes fastest."
+      >
+        <Select
+          value={ytdlpChannel}
+          options={UPDATE_CHANNEL_OPTIONS}
+          onChange={(v) => update({ ytdlpChannel: v as YtdlpUpdateChannel })}
+        />
+      </Field>
+      <div className={styles.folderRow}>
+        <Button
+          icon={updating ? <Spinner size="tiny" /> : <ArrowSyncRegular />}
+          onClick={runUpdate}
+          disabled={updating}
+        >
+          {updating ? 'Updating…' : 'Update yt-dlp'}
+        </Button>
+      </div>
+      {updateResult?.ok && (
+        <Text className={styles.monoPre}>
+          {updateResult.output || 'yt-dlp is already up to date.'}
+        </Text>
+      )}
+      {updateResult && !updateResult.ok && (
+        <Caption1 className={errText.errorPre}>{updateResult.error}</Caption1>
+      )}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/AppearanceCard.tsx b/src/renderer/src/components/settings/AppearanceCard.tsx
new file mode 100644
index 0000000..804c35f
--- /dev/null
+++ b/src/renderer/src/components/settings/AppearanceCard.tsx
@@ -0,0 +1,110 @@
+import { useRef } from 'react'
+import { Field, Button, Card, Subtitle2, Caption1, mergeClasses } from '@fluentui/react-components'
+import { PaintBucketRegular, AccessibilityRegular } from '@fluentui/react-icons'
+import { type ThemeMode, type AccentColor } from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { useSystemTheme } from '../../store/systemTheme'
+import { Select } from '../Select'
+import { ACCENT_OPTIONS } from '../../theme'
+import { useFocusStyles } from '../ui/focusRing'
+import { useSettingsStyles } from './settingsStyles'
+
+const THEME_MODE_OPTIONS = [
+  { value: 'light', label: 'Light' },
+  { value: 'dark', label: 'Dark' },
+  { value: 'system', label: 'Follow system' }
+]
+
+export function AppearanceCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const focus = useFocusStyles()
+  const theme = useSettings((s) => s.theme)
+  const accentColor = useSettings((s) => s.accentColor)
+  const highContrast = useSystemTheme((s) => s.shouldUseHighContrastColors)
+  const update = useSettings((s) => s.update)
+
+  // Roving-tabindex arrow-key navigation for the accent radiogroup (L155), so the
+  // single-select swatches behave like the Theme radio pattern rather than a row
+  // of plain buttons.
+  const swatchRefs = useRef<(HTMLButtonElement | null)[]>([])
+  function onSwatchKey(e: React.KeyboardEvent, index: number): void {
+    const n = ACCENT_OPTIONS.length
+    let next = -1
+    if (e.key === 'ArrowRight' || e.key === 'ArrowDown') next = (index + 1) % n
+    else if (e.key === 'ArrowLeft' || e.key === 'ArrowUp') next = (index - 1 + n) % n
+    else if (e.key === 'Home') next = 0
+    else if (e.key === 'End') next = n - 1
+    else return
+    const opt = ACCENT_OPTIONS[next]
+    if (!opt) return
+    e.preventDefault()
+    update({ accentColor: opt.value as AccentColor })
+    swatchRefs.current[next]?.focus()
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <PaintBucketRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Appearance</Subtitle2>
+      </div>
+
+      <Field label="Theme">
+        <Select
+          value={theme}
+          options={THEME_MODE_OPTIONS}
+          onChange={(v) => update({ theme: v as ThemeMode })}
+        />
+      </Field>
+
+      <Field label="Accent color">
+        <div className={styles.swatchRow} role="radiogroup" aria-label="Accent color">
+          {ACCENT_OPTIONS.map((opt, i) => {
+            const selected = accentColor === opt.value
+            return (
+              <button
+                key={opt.value}
+                ref={(el) => {
+                  swatchRefs.current[i] = el
+                }}
+                type="button"
+                role="radio"
+                aria-checked={selected}
+                // Roving tabindex: only the selected swatch is a tab stop; arrows
+                // move within the group (L155).
+                tabIndex={selected ? 0 : -1}
+                className={mergeClasses(
+                  styles.swatch,
+                  selected && styles.swatchActive,
+                  focus.focusRing
+                )}
+                style={{ backgroundColor: opt.swatch }}
+                onClick={() => update({ accentColor: opt.value as AccentColor })}
+                onKeyDown={(e) => onSwatchKey(e, i)}
+                aria-label={opt.label}
+                title={opt.label}
+              />
+            )
+          })}
+        </div>
+      </Field>
+
+      <Caption1 className={styles.hint}>
+        {highContrast
+          ? 'A Windows high-contrast theme is active -- AeroFetch follows your system colors.'
+          : 'AeroFetch automatically follows a Windows high-contrast theme if you turn one on.'}
+      </Caption1>
+      {highContrast && (
+        <div className={styles.folderRow}>
+          <Button
+            size="small"
+            icon={<AccessibilityRegular />}
+            onClick={() => window.api.openHighContrastSettings()}
+          >
+            Open accessibility settings
+          </Button>
+        </div>
+      )}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/BackupCard.tsx b/src/renderer/src/components/settings/BackupCard.tsx
new file mode 100644
index 0000000..7207c5d
--- /dev/null
+++ b/src/renderer/src/components/settings/BackupCard.tsx
@@ -0,0 +1,84 @@
+import { useState } from 'react'
+import { Button, Card, Subtitle2, Caption1 } from '@fluentui/react-components'
+import { DocumentArrowDownRegular, DocumentArrowUpRegular } from '@fluentui/react-icons'
+import { type BackupExportResult, type BackupImportResult } from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { useTemplates } from '../../store/templates'
+import { useErrorTextStyles } from '../ui/errorText'
+import { useSettingsStyles } from './settingsStyles'
+
+export function BackupCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const errText = useErrorTextStyles()
+
+  const [exporting, setExporting] = useState(false)
+  const [exportResult, setExportResult] = useState<BackupExportResult | null>(null)
+  const [importing, setImporting] = useState(false)
+  const [importResult, setImportResult] = useState<BackupImportResult | null>(null)
+
+  async function exportBackup(): Promise<void> {
+    setExporting(true)
+    setExportResult(null)
+    try {
+      setExportResult(await window.api.exportBackup())
+    } catch (e) {
+      setExportResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
+    } finally {
+      setExporting(false)
+    }
+  }
+
+  async function importBackup(): Promise<void> {
+    setImporting(true)
+    setImportResult(null)
+    try {
+      const result = await window.api.importBackup()
+      setImportResult(result)
+      if (result.ok) {
+        // Settings + templates changed underneath the stores -- reload both.
+        const [s, t] = await Promise.all([window.api.getSettings(), window.api.listTemplates()])
+        useSettings.setState({ ...s, loaded: true })
+        useTemplates.setState({ templates: t })
+      }
+    } catch (e) {
+      setImportResult({ ok: false, error: e instanceof Error ? e.message : String(e) })
+    } finally {
+      setImporting(false)
+    }
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <DocumentArrowDownRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Backup &amp; restore</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        Save your settings and custom-command templates to a JSON file, or restore them on another
+        machine. Does not include download history or credentials (proxy, API tokens -- re-enter
+        those after import).
+      </Caption1>
+
+      <div className={styles.folderRow}>
+        <Button icon={<DocumentArrowDownRegular />} onClick={exportBackup} disabled={exporting}>
+          {exporting ? 'Exporting…' : 'Export backup…'}
+        </Button>
+        <Button icon={<DocumentArrowUpRegular />} onClick={importBackup} disabled={importing}>
+          {importing ? 'Importing…' : 'Import backup…'}
+        </Button>
+      </div>
+      {exportResult?.ok && exportResult.path && (
+        <Caption1 className={styles.hint}>Saved to {exportResult.path}</Caption1>
+      )}
+      {exportResult && !exportResult.ok && exportResult.error && (
+        <Caption1 className={errText.error}>{exportResult.error}</Caption1>
+      )}
+      {importResult?.ok && (
+        <Caption1 className={styles.hint}>Settings and templates restored.</Caption1>
+      )}
+      {importResult && !importResult.ok && importResult.error && (
+        <Caption1 className={errText.error}>{importResult.error}</Caption1>
+      )}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/CookiesCard.tsx b/src/renderer/src/components/settings/CookiesCard.tsx
new file mode 100644
index 0000000..fc99fe8
--- /dev/null
+++ b/src/renderer/src/components/settings/CookiesCard.tsx
@@ -0,0 +1,136 @@
+import { useEffect, useState } from 'react'
+import { Field, Input, Button, Card, Subtitle2, Caption1 } from '@fluentui/react-components'
+import { CookiesRegular } from '@fluentui/react-icons'
+import {
+  COOKIE_BROWSERS,
+  type CookieSource,
+  type CookieBrowser,
+  type CookiesStatus
+} from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { Select } from '../Select'
+import { useErrorTextStyles } from '../ui/errorText'
+import { useSettingsStyles } from './settingsStyles'
+
+const COOKIE_SOURCE_OPTIONS = [
+  { value: 'none', label: 'None' },
+  { value: 'browser', label: "From a browser's cookie store" },
+  { value: 'login', label: 'Sign-in window (built into AeroFetch)' }
+]
+
+const COOKIE_BROWSER_OPTIONS = COOKIE_BROWSERS.map((b) => ({
+  value: b,
+  label: b.charAt(0).toUpperCase() + b.slice(1)
+}))
+
+export function CookiesCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const errText = useErrorTextStyles()
+  const cookieSource = useSettings((s) => s.cookieSource)
+  const cookiesBrowser = useSettings((s) => s.cookiesBrowser)
+  const update = useSettings((s) => s.update)
+
+  const [cookiesStatus, setCookiesStatus] = useState<CookiesStatus | null>(null)
+  const [loginUrl, setLoginUrl] = useState('https://www.youtube.com')
+  const [signingIn, setSigningIn] = useState(false)
+  const [loginError, setLoginError] = useState<string | null>(null)
+
+  useEffect(() => {
+    window.api.cookiesStatus().then(setCookiesStatus)
+  }, [])
+
+  async function signIn(): Promise<void> {
+    setSigningIn(true)
+    setLoginError(null)
+    try {
+      const result = await window.api.cookiesLogin(loginUrl)
+      if (result.ok && result.cookieCount === 0) {
+        // Window closed without capturing anything -- don't imply success (L50).
+        setLoginError('No cookies were captured -- did you sign in before closing the window?')
+      } else if (result.ok) {
+        setCookiesStatus(await window.api.cookiesStatus())
+      } else {
+        setLoginError(result.error ?? 'Sign-in failed.')
+      }
+    } catch (e) {
+      setLoginError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setSigningIn(false)
+    }
+  }
+
+  async function clearSavedCookies(): Promise<void> {
+    await window.api.cookiesClear()
+    setCookiesStatus({ exists: false })
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <CookiesRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Cookies</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        Some sites only serve full quality, age-restricted, or members-only video to a logged-in
+        session. Supply cookies so yt-dlp can act like one.
+      </Caption1>
+
+      <Field label="Cookie source">
+        <Select
+          value={cookieSource}
+          options={COOKIE_SOURCE_OPTIONS}
+          onChange={(v) => update({ cookieSource: v as CookieSource })}
+        />
+      </Field>
+
+      {cookieSource === 'browser' && (
+        <Field
+          label="Browser"
+          hint="Reads that browser's saved cookies directly. Close the browser first if it won't let AeroFetch read them."
+        >
+          <Select
+            value={cookiesBrowser}
+            options={COOKIE_BROWSER_OPTIONS}
+            onChange={(v) => update({ cookiesBrowser: v as CookieBrowser })}
+          />
+        </Field>
+      )}
+
+      {cookieSource === 'login' && (
+        <>
+          <Field
+            label="Site to sign in to"
+            hint="Opens a sign-in window. Log in, then close the window -- your cookies are saved automatically."
+          >
+            <div className={styles.folderRow}>
+              <Input
+                className={styles.folderInput}
+                value={loginUrl}
+                placeholder="https://www.youtube.com"
+                onChange={(_, d) => setLoginUrl(d.value)}
+              />
+              <Button appearance="primary" onClick={signIn} disabled={signingIn}>
+                {signingIn ? 'Signing in…' : 'Sign in…'}
+              </Button>
+            </div>
+          </Field>
+
+          <div className={styles.folderRow}>
+            <Caption1 className={styles.hint}>
+              {cookiesStatus?.exists
+                ? `Cookies saved ${new Date(cookiesStatus.savedAt!).toLocaleString()}.`
+                : 'Not signed in yet.'}
+            </Caption1>
+            {cookiesStatus?.exists && (
+              <Button size="small" onClick={clearSavedCookies}>
+                Clear saved cookies
+              </Button>
+            )}
+          </div>
+
+          {loginError && <Caption1 className={errText.error}>{loginError}</Caption1>}
+        </>
+      )}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/CustomCommandsCard.tsx b/src/renderer/src/components/settings/CustomCommandsCard.tsx
new file mode 100644
index 0000000..e66b89d
--- /dev/null
+++ b/src/renderer/src/components/settings/CustomCommandsCard.tsx
@@ -0,0 +1,54 @@
+import { Field, Switch, Card, Subtitle2, Caption1 } from '@fluentui/react-components'
+import { CodeRegular } from '@fluentui/react-icons'
+import { useSettings } from '../../store/settings'
+import { useTemplates } from '../../store/templates'
+import { Select } from '../Select'
+import { TemplateManager } from '../TemplateManager'
+import { useSettingsStyles } from './settingsStyles'
+
+export function CustomCommandsCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const customCommandEnabled = useSettings((s) => s.customCommandEnabled)
+  const defaultTemplateId = useSettings((s) => s.defaultTemplateId)
+  const update = useSettings((s) => s.update)
+  const templates = useTemplates((s) => s.templates)
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <CodeRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Custom commands</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        Named templates of extra yt-dlp flags -- your own power-user recipes (e.g.
+        --write-thumbnail, --no-mtime, anything yt-dlp supports). Appended after every other option,
+        so a template flag can override a setting above it.
+      </Caption1>
+
+      <Field
+        label="Run custom command"
+        hint="Applies the default template below to every new download (still overridable per download)."
+      >
+        <Switch
+          checked={customCommandEnabled}
+          onChange={(_, d) => update({ customCommandEnabled: d.checked })}
+        />
+      </Field>
+
+      {customCommandEnabled && (
+        <Field label="Default template">
+          <Select
+            value={defaultTemplateId ?? 'none'}
+            options={[
+              { value: 'none', label: 'None' },
+              ...templates.map((t) => ({ value: t.id, label: t.name }))
+            ]}
+            onChange={(v) => update({ defaultTemplateId: v === 'none' ? null : v })}
+          />
+        </Field>
+      )}
+
+      <TemplateManager />
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/DiagnosticsCard.tsx b/src/renderer/src/components/settings/DiagnosticsCard.tsx
new file mode 100644
index 0000000..20f51ae
--- /dev/null
+++ b/src/renderer/src/components/settings/DiagnosticsCard.tsx
@@ -0,0 +1,99 @@
+import { useState } from 'react'
+import { Button, Card, Subtitle2, Caption1, Text } from '@fluentui/react-components'
+import { BugRegular, CopyRegular, DeleteRegular } from '@fluentui/react-icons'
+import { useErrorLog } from '../../store/errorlog'
+import { useErrorTextStyles } from '../ui/errorText'
+import { EmptyState } from '../ui/EmptyState'
+import { useSettingsStyles } from './settingsStyles'
+
+export function DiagnosticsCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const errText = useErrorTextStyles()
+  const errorEntries = useErrorLog((s) => s.entries)
+  const clearErrorLog = useErrorLog((s) => s.clear)
+
+  const [confirmClearLog, setConfirmClearLog] = useState(false)
+
+  function copyErrorReport(): void {
+    // The button is disabled when there are no entries, so `report` is always
+    // non-empty here -- no need for an unreachable empty-report fallback (L159).
+    const report = errorEntries
+      .map((e) =>
+        [new Date(e.occurredAt).toLocaleString(), e.title ?? e.url, e.url, e.error].join('\n')
+      )
+      .join('\n\n---\n\n')
+    navigator.clipboard.writeText(report).catch(() => {})
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <BugRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Diagnostics</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        Failed downloads are logged here even after you clear the queue, so you can copy the details
+        into a bug report.
+      </Caption1>
+
+      <div className={styles.folderRow}>
+        <Button
+          icon={<CopyRegular />}
+          onClick={copyErrorReport}
+          disabled={errorEntries.length === 0}
+        >
+          Copy full report
+        </Button>
+        {confirmClearLog ? (
+          <>
+            <Caption1>
+              Clear all {errorEntries.length} {errorEntries.length === 1 ? 'error' : 'errors'}?
+            </Caption1>
+            <Button
+              icon={<DeleteRegular />}
+              appearance="primary"
+              onClick={() => {
+                clearErrorLog()
+                setConfirmClearLog(false)
+              }}
+            >
+              Clear log
+            </Button>
+            <Button appearance="subtle" onClick={() => setConfirmClearLog(false)}>
+              Cancel
+            </Button>
+          </>
+        ) : (
+          <Button
+            icon={<DeleteRegular />}
+            onClick={() => setConfirmClearLog(true)}
+            disabled={errorEntries.length === 0}
+          >
+            Clear log
+          </Button>
+        )}
+      </div>
+
+      {errorEntries.length === 0 ? (
+        <EmptyState compact message="No errors yet." />
+      ) : (
+        <div className={styles.errorList}>
+          {errorEntries.slice(0, 20).map((e) => (
+            <div key={e.id} className={styles.errorRow}>
+              <div className={styles.errorRowHeader}>
+                <Text className={styles.errorRowTitle}>{e.title ?? e.url}</Text>
+                <Caption1 className={styles.hint}>
+                  {new Date(e.occurredAt).toLocaleString()}
+                </Caption1>
+              </div>
+              <Caption1 className={errText.errorPre}>{e.error}</Caption1>
+            </div>
+          ))}
+          {errorEntries.length > 20 && (
+            <Caption1 className={styles.hint}>Showing 20 of {errorEntries.length} errors.</Caption1>
+          )}
+        </div>
+      )}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/DownloadsCard.tsx b/src/renderer/src/components/settings/DownloadsCard.tsx
new file mode 100644
index 0000000..910dfda
--- /dev/null
+++ b/src/renderer/src/components/settings/DownloadsCard.tsx
@@ -0,0 +1,180 @@
+import {
+  Field,
+  Input,
+  SpinButton,
+  Switch,
+  Button,
+  Card,
+  Subtitle2
+} from '@fluentui/react-components'
+import { FolderRegular, ArrowDownloadRegular } from '@fluentui/react-icons'
+import { type MediaKind } from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { useDownloads } from '../../store/downloads'
+import { QUALITY_OPTIONS } from '../../qualityOptions'
+import { Select } from '../Select'
+import { SegmentedControl } from '../ui/SegmentedControl'
+import { useSettingsStyles } from './settingsStyles'
+
+export function DownloadsCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const videoDir = useSettings((s) => s.videoDir)
+  const audioDir = useSettings((s) => s.audioDir)
+  const chooseDir = useSettings((s) => s.chooseDir)
+  const clearDir = useSettings((s) => s.clearDir)
+  const defaultKind = useSettings((s) => s.defaultKind)
+  const defaultVideoQuality = useSettings((s) => s.defaultVideoQuality)
+  const defaultAudioQuality = useSettings((s) => s.defaultAudioQuality)
+  const maxConcurrent = useSettings((s) => s.maxConcurrent)
+  const clipboardWatch = useSettings((s) => s.clipboardWatch)
+  const notifyOnComplete = useSettings((s) => s.notifyOnComplete)
+  const minimizeToTray = useSettings((s) => s.minimizeToTray)
+  const launchAtStartup = useSettings((s) => s.launchAtStartup)
+  const update = useSettings((s) => s.update)
+
+  const formatQuality = defaultKind === 'audio' ? defaultAudioQuality : defaultVideoQuality
+
+  function onKindSelect(kind: MediaKind): void {
+    update({ defaultKind: kind })
+  }
+
+  function onQualitySelect(quality: string): void {
+    update(
+      defaultKind === 'audio' ? { defaultAudioQuality: quality } : { defaultVideoQuality: quality }
+    )
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <ArrowDownloadRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Downloads</Subtitle2>
+      </div>
+
+      <Field
+        label="Video folder"
+        hint="Where video downloads are saved. Leave blank to use Documents\Video."
+      >
+        <div className={styles.folderRow}>
+          <Input
+            className={styles.folderInput}
+            value={videoDir}
+            placeholder="Documents\Video (default)"
+            contentBefore={<FolderRegular />}
+            onChange={(_, d) => update({ videoDir: d.value })}
+          />
+          <Button icon={<FolderRegular />} onClick={() => chooseDir('videoDir')}>
+            Browse…
+          </Button>
+          {videoDir && (
+            <Button appearance="subtle" onClick={() => clearDir('videoDir')}>
+              Reset
+            </Button>
+          )}
+        </div>
+      </Field>
+
+      <Field
+        label="Audio folder"
+        hint="Where audio downloads are saved. Leave blank to use Documents\Audio."
+      >
+        <div className={styles.folderRow}>
+          <Input
+            className={styles.folderInput}
+            value={audioDir}
+            placeholder="Documents\Audio (default)"
+            contentBefore={<FolderRegular />}
+            onChange={(_, d) => update({ audioDir: d.value })}
+          />
+          <Button icon={<FolderRegular />} onClick={() => chooseDir('audioDir')}>
+            Browse…
+          </Button>
+          {audioDir && (
+            <Button appearance="subtle" onClick={() => clearDir('audioDir')}>
+              Reset
+            </Button>
+          )}
+        </div>
+      </Field>
+
+      <Field label="Default format">
+        <div className={styles.formatRow}>
+          <SegmentedControl<MediaKind>
+            value={defaultKind}
+            options={[
+              { value: 'video', label: 'Video' },
+              { value: 'audio', label: 'Audio' }
+            ]}
+            onChange={onKindSelect}
+            ariaLabel="Default download type"
+          />
+          <Select
+            className={styles.formatQuality}
+            value={formatQuality}
+            options={QUALITY_OPTIONS[defaultKind].map((q) => ({ value: q, label: q }))}
+            onChange={onQualitySelect}
+          />
+        </div>
+      </Field>
+
+      <Field
+        label="Maximum simultaneous downloads"
+        hint="How many downloads run at once. 2-3 is a good balance."
+      >
+        <SpinButton
+          value={maxConcurrent}
+          min={1}
+          max={5}
+          onChange={(_, d) => {
+            const v = d.value ?? Number(d.displayValue)
+            if (typeof v === 'number' && Number.isFinite(v)) {
+              update({ maxConcurrent: Math.min(5, Math.max(1, Math.round(v))) })
+              // Raising the cap should start queued items right away.
+              useDownloads.getState().pump()
+            }
+          }}
+        />
+      </Field>
+
+      <Field
+        label="Detect links from clipboard"
+        hint="When AeroFetch gains focus, offer a video link you've just copied."
+      >
+        <Switch
+          checked={clipboardWatch}
+          onChange={(_, d) => update({ clipboardWatch: d.checked })}
+        />
+      </Field>
+
+      <Field
+        label="Notify when downloads finish"
+        hint="Shows a native Windows notification when a download completes or fails."
+      >
+        <Switch
+          checked={notifyOnComplete}
+          onChange={(_, d) => update({ notifyOnComplete: d.checked })}
+        />
+      </Field>
+
+      <Field
+        label="Keep running in the tray"
+        hint="Closing the window minimizes to the system tray instead of quitting, so downloads and watched-channel syncing keep running."
+      >
+        <Switch
+          checked={minimizeToTray}
+          onChange={(_, d) => update({ minimizeToTray: d.checked })}
+        />
+      </Field>
+
+      <Field
+        label="Start with Windows"
+        hint="Launch AeroFetch automatically when you sign in -- useful with auto-download so watched channels stay current in the background."
+      >
+        <Switch
+          checked={launchAtStartup}
+          onChange={(_, d) => update({ launchAtStartup: d.checked })}
+        />
+      </Field>
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/FilenamesCard.tsx b/src/renderer/src/components/settings/FilenamesCard.tsx
new file mode 100644
index 0000000..07a2164
--- /dev/null
+++ b/src/renderer/src/components/settings/FilenamesCard.tsx
@@ -0,0 +1,53 @@
+import { Field, Input, Switch, Card, Subtitle2, Caption1 } from '@fluentui/react-components'
+import { DocumentRegular } from '@fluentui/react-icons'
+import { useSettings } from '../../store/settings'
+import { useSettingsStyles } from './settingsStyles'
+
+export function FilenamesCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const filenameTemplate = useSettings((s) => s.filenameTemplate)
+  const restrictFilenames = useSettings((s) => s.restrictFilenames)
+  const downloadArchive = useSettings((s) => s.downloadArchive)
+  const update = useSettings((s) => s.update)
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <DocumentRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Filenames</Subtitle2>
+      </div>
+      <Field
+        label="Filename template"
+        hint="Controls how saved files are named. Use %(title)s for the video title, %(ext)s for the extension, and similar tokens."
+      >
+        <Input
+          value={filenameTemplate}
+          onChange={(_, d) => update({ filenameTemplate: d.value })}
+        />
+      </Field>
+      <Caption1 className={styles.hint}>
+        Example: {filenameTemplate.replace('%(title)s', 'My Video').replace('%(ext)s', 'mp4')}
+      </Caption1>
+
+      <Field
+        label="Restrict filenames"
+        hint="Sanitize titles to plain ASCII letters/digits, no spaces -- safer for old filesystems and shells."
+      >
+        <Switch
+          checked={restrictFilenames}
+          onChange={(_, d) => update({ restrictFilenames: d.checked })}
+        />
+      </Field>
+
+      <Field
+        label="Skip already-downloaded videos"
+        hint="Keeps a record of completed downloads (--download-archive) and skips them on repeat playlist/channel runs."
+      >
+        <Switch
+          checked={downloadArchive}
+          onChange={(_, d) => update({ downloadArchive: d.checked })}
+        />
+      </Field>
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/NetworkCard.tsx b/src/renderer/src/components/settings/NetworkCard.tsx
new file mode 100644
index 0000000..2926cf2
--- /dev/null
+++ b/src/renderer/src/components/settings/NetworkCard.tsx
@@ -0,0 +1,118 @@
+import { useState } from 'react'
+import { Field, Input, Switch, Button, Card, Subtitle2, Spinner } from '@fluentui/react-components'
+import { GlobeRegular } from '@fluentui/react-icons'
+import { useSettings } from '../../store/settings'
+import { useSettingsStyles } from './settingsStyles'
+
+export function NetworkCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const proxy = useSettings((s) => s.proxy)
+  const rateLimit = useSettings((s) => s.rateLimit)
+  const useAria2c = useSettings((s) => s.useAria2c)
+  const youtubePlayerClient = useSettings((s) => s.youtubePlayerClient)
+  const youtubePoToken = useSettings((s) => s.youtubePoToken)
+  const update = useSettings((s) => s.update)
+
+  const [mintingPot, setMintingPot] = useState(false)
+  const [potHint, setPotHint] = useState<string | null>(null)
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <GlobeRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Network</Subtitle2>
+      </div>
+
+      <Field
+        label="Proxy"
+        hint="HTTP/HTTPS/SOCKS proxy URL, e.g. socks5://127.0.0.1:1080. Leave blank to use the system default."
+      >
+        <Input
+          type="password"
+          value={proxy}
+          placeholder="socks5://127.0.0.1:1080"
+          onChange={(_, d) => update({ proxy: d.value })}
+        />
+      </Field>
+
+      <Field
+        label="Rate limit"
+        hint="Caps download speed (e.g. 500K or 2M). Leave blank for unlimited."
+      >
+        <Input
+          value={rateLimit}
+          placeholder="2M"
+          onChange={(_, d) => update({ rateLimit: d.value })}
+        />
+      </Field>
+
+      <Field
+        label="Use aria2c downloader"
+        hint="Multi-connection downloads for faster speeds on supported sites. Falls back to the standard downloader if the accelerator isn't available."
+      >
+        <Switch checked={useAria2c} onChange={(_, d) => update({ useAria2c: d.checked })} />
+      </Field>
+
+      <Field
+        label="YouTube client (advanced)"
+        hint="Override how AeroFetch identifies itself to YouTube when downloads start failing. Try web_safari, tv, or mweb. Leave blank for the automatic default."
+      >
+        <datalist id="yt-client-list">
+          {['web', 'web_safari', 'web_embedded', 'mweb', 'tv', 'ios', 'android'].map((c) => (
+            <option key={c} value={c} />
+          ))}
+        </datalist>
+        <Input
+          value={youtubePlayerClient}
+          placeholder="web_safari"
+          list="yt-client-list"
+          onChange={(_, d) => update({ youtubePlayerClient: d.value })}
+        />
+      </Field>
+
+      <Field
+        label="YouTube PO Token (advanced)"
+        hint={
+          potHint ??
+          'A token that helps get past YouTube\'s bot check. Click "Fetch" to grab one automatically, or paste it manually. Signing in with cookies (above) is usually the easier fix.'
+        }
+      >
+        <div className={styles.folderRow}>
+          <Input
+            type="password"
+            style={{ flexGrow: 1 }}
+            value={youtubePoToken}
+            placeholder="Optional -- paste a token"
+            onChange={(_, d) => {
+              update({ youtubePoToken: d.value })
+              setPotHint(null)
+            }}
+          />
+          <Button
+            size="small"
+            disabled={mintingPot}
+            icon={mintingPot ? <Spinner size="tiny" /> : undefined}
+            onClick={async () => {
+              setMintingPot(true)
+              setPotHint(null)
+              try {
+                const token = await window.api.mintPoToken()
+                if (token) {
+                  setPotHint('Token saved.')
+                } else {
+                  setPotHint('Token not found -- try signing into YouTube first via Cookies above.')
+                }
+              } catch {
+                setPotHint('Failed to open YouTube window.')
+              } finally {
+                setMintingPot(false)
+              }
+            }}
+          >
+            {mintingPot ? 'Fetching…' : 'Fetch'}
+          </Button>
+        </div>
+      </Field>
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/PostProcessingCard.tsx b/src/renderer/src/components/settings/PostProcessingCard.tsx
new file mode 100644
index 0000000..63c0cc9
--- /dev/null
+++ b/src/renderer/src/components/settings/PostProcessingCard.tsx
@@ -0,0 +1,30 @@
+import { Card, Subtitle2, Caption1 } from '@fluentui/react-components'
+import { OptionsRegular } from '@fluentui/react-icons'
+import { useSettings } from '../../store/settings'
+import { DownloadOptionsForm } from '../DownloadOptionsForm'
+import { useSettingsStyles } from './settingsStyles'
+
+export function PostProcessingCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const defaultKind = useSettings((s) => s.defaultKind)
+  const downloadOptions = useSettings((s) => s.downloadOptions)
+  const update = useSettings((s) => s.update)
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <OptionsRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Format &amp; post-processing</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        Defaults applied to every new download (yt-dlp and ffmpeg do the work).
+      </Caption1>
+
+      <DownloadOptionsForm
+        value={downloadOptions}
+        kind={defaultKind}
+        onChange={(o) => update({ downloadOptions: o })}
+      />
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/SoftwareUpdateCard.tsx b/src/renderer/src/components/settings/SoftwareUpdateCard.tsx
new file mode 100644
index 0000000..3fae425
--- /dev/null
+++ b/src/renderer/src/components/settings/SoftwareUpdateCard.tsx
@@ -0,0 +1,156 @@
+import { useEffect, useState } from 'react'
+import {
+  Field,
+  Input,
+  Button,
+  Card,
+  Subtitle2,
+  Caption1,
+  Text,
+  Spinner,
+  ProgressBar,
+  tokens
+} from '@fluentui/react-components'
+import { ArrowSyncRegular, ArrowDownloadRegular, OpenRegular } from '@fluentui/react-icons'
+import { type AppUpdateInfo } from '@shared/ipc'
+import { useSettings } from '../../store/settings'
+import { useErrorTextStyles } from '../ui/errorText'
+import { logError } from '../../reportError'
+import { useSettingsStyles } from './settingsStyles'
+
+export function SoftwareUpdateCard(): React.JSX.Element {
+  const styles = useSettingsStyles()
+  const errText = useErrorTextStyles()
+  const updateToken = useSettings((s) => s.updateToken)
+  const update = useSettings((s) => s.update)
+
+  const [appVersion, setAppVersion] = useState('')
+  const [appUpd, setAppUpd] = useState<AppUpdateInfo | null>(null)
+  const [appChecking, setAppChecking] = useState(false)
+  const [appDownloading, setAppDownloading] = useState(false)
+  const [appFraction, setAppFraction] = useState<number | undefined>(undefined)
+  const [appUpdError, setAppUpdError] = useState<string | null>(null)
+
+  useEffect(() => {
+    window.api.getAppVersion().then(setAppVersion).catch(logError('getAppVersion'))
+    return window.api.onAppUpdateProgress((p) => setAppFraction(p.fraction))
+  }, [])
+
+  async function checkAppUpdate(): Promise<void> {
+    setAppChecking(true)
+    setAppUpd(null)
+    setAppUpdError(null)
+    try {
+      const info = await window.api.checkForAppUpdate()
+      // Funnel a failed check into the single error slot rather than storing a
+      // second not-ok AppUpdateInfo, so only one error message can ever render.
+      if (info.ok) setAppUpd(info)
+      else setAppUpdError(info.error ?? 'Update check failed.')
+    } catch (e) {
+      setAppUpdError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setAppChecking(false)
+    }
+  }
+
+  async function installAppUpdate(): Promise<void> {
+    if (!appUpd?.downloadUrl) return
+    setAppDownloading(true)
+    setAppFraction(undefined)
+    setAppUpdError(null)
+    try {
+      const dl = await window.api.downloadAppUpdate(appUpd.downloadUrl)
+      if (!dl.ok || !dl.filePath) {
+        setAppUpdError(dl.error ?? 'Download failed.')
+        return
+      }
+      const run = await window.api.runAppUpdate(dl.filePath)
+      // On success the app quits as the installer launches; only errors return here.
+      if (!run.ok) setAppUpdError(run.error ?? 'Could not start the installer.')
+    } catch (e) {
+      setAppUpdError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setAppDownloading(false)
+    }
+  }
+
+  return (
+    <Card className={styles.card}>
+      <div className={styles.sectionHeader}>
+        <ArrowSyncRegular className={styles.sectionIcon} />
+        <Subtitle2 as="h2">Software update</Subtitle2>
+      </div>
+      <Caption1 className={styles.hint}>
+        {appVersion
+          ? `You're running AeroFetch v${appVersion}. Updates are fetched from the AeroFetch release repo.`
+          : 'Checking your AeroFetch version…'}
+      </Caption1>
+
+      <div className={styles.folderRow}>
+        <Button
+          icon={appChecking ? <Spinner size="tiny" /> : <ArrowSyncRegular />}
+          onClick={checkAppUpdate}
+          disabled={appChecking || appDownloading}
+        >
+          {appChecking ? 'Checking…' : 'Check for updates'}
+        </Button>
+      </div>
+
+      {(updateToken.trim() !== '' || !!appUpdError) && (
+        <Field
+          label="Update access token"
+          hint="Only needed if the update server requires sign-in. Paste a read-only access token to enable update checks and downloads. Stored encrypted on this device; leave blank for anonymous access."
+        >
+          <Input
+            type="password"
+            value={updateToken}
+            placeholder="Optional -- access token"
+            onChange={(_, d) => update({ updateToken: d.value })}
+            contentBefore={<ArrowSyncRegular />}
+          />
+        </Field>
+      )}
+
+      {appUpd?.ok && appUpd.available && (
+        <>
+          <Text style={{ fontWeight: tokens.fontWeightSemibold }}>
+            Version {appUpd.latestVersion} is available -- here&apos;s what changed:
+          </Text>
+          {appUpd.notes && <div className={styles.notesBox}>{appUpd.notes}</div>}
+          <div className={styles.folderRow}>
+            <Button
+              appearance="primary"
+              icon={<ArrowDownloadRegular />}
+              onClick={installAppUpdate}
+              disabled={appDownloading || !appUpd.downloadUrl}
+            >
+              {appDownloading ? 'Downloading…' : 'Update now'}
+            </Button>
+            {appUpd.htmlUrl && (
+              <Button
+                icon={<OpenRegular />}
+                onClick={() => void window.api?.openUrl?.(appUpd.htmlUrl ?? '')}
+              >
+                View release
+              </Button>
+            )}
+          </div>
+          {!appUpd.downloadUrl && (
+            <Caption1 className={styles.hint}>
+              This release has no installer attached -- use "View release" to download it manually.
+            </Caption1>
+          )}
+          {appDownloading && (
+            <ProgressBar value={appFraction} aria-label="App update download progress" />
+          )}
+        </>
+      )}
+
+      {appUpd?.ok && !appUpd.available && (
+        <Text>You&apos;re up to date -- v{appUpd.currentVersion} is the latest.</Text>
+      )}
+
+      {appUpdError && <Caption1 className={errText.errorPre}>{appUpdError}</Caption1>}
+    </Card>
+  )
+}
diff --git a/src/renderer/src/components/settings/settingsStyles.ts b/src/renderer/src/components/settings/settingsStyles.ts
new file mode 100644
index 0000000..3039e09
--- /dev/null
+++ b/src/renderer/src/components/settings/settingsStyles.ts
@@ -0,0 +1,117 @@
+import { makeStyles, tokens, shorthands } from '@fluentui/react-components'
+import { SPACE, RADIUS, ICON } from '../ui/tokens'
+
+// Shared styles for the Settings cards. Each card renders a single <Card> so it
+// stays one direct child of SettingsView's root -- the search filter toggles
+// `display` per child, so the one-DOM-node-per-card shape must be preserved.
+export const useSettingsStyles = makeStyles({
+  card: {
+    display: 'flex',
+    flexDirection: 'column',
+    // Page-level card: card padding + card radius (UI3/UI7).
+    gap: SPACE.section,
+    padding: SPACE.section,
+    ...shorthands.borderRadius(RADIUS.card)
+  },
+  notesBox: {
+    maxHeight: '180px',
+    overflowY: 'auto',
+    padding: '10px 12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusMedium),
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    whiteSpace: 'pre-wrap',
+    fontSize: tokens.fontSizeBase200,
+    lineHeight: tokens.lineHeightBase300
+  },
+  sectionHeader: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '10px'
+  },
+  sectionIcon: {
+    // Section-header glyph, next to each card's <Subtitle2> title (UI12 section tier).
+    fontSize: `${ICON.section}px`,
+    color: tokens.colorCompoundBrandForeground1
+  },
+  folderRow: {
+    display: 'flex',
+    gap: '8px',
+    alignItems: 'flex-end'
+  },
+  folderInput: {
+    flexGrow: 1
+  },
+  // The "Default format" control: a Video/Audio segmented toggle beside a quality
+  // dropdown, mirroring the DownloadBar so both read as one mental model (L102).
+  formatRow: {
+    display: 'flex',
+    gap: '8px',
+    alignItems: 'center',
+    flexWrap: 'wrap'
+  },
+  formatQuality: {
+    minWidth: '200px'
+  },
+  hint: {
+    color: tokens.colorNeutralForeground3
+  },
+  // Monospace version/output text (About card). Replaces the repeated inline
+  // `style={{ fontFamily: fontFamilyMonospace }}` (L5).
+  mono: {
+    fontFamily: tokens.fontFamilyMonospace
+  },
+  monoBlock: {
+    fontFamily: tokens.fontFamilyMonospace,
+    display: 'block'
+  },
+  monoPre: {
+    fontFamily: tokens.fontFamilyMonospace,
+    whiteSpace: 'pre-wrap'
+  },
+  swatchRow: {
+    display: 'flex',
+    gap: '10px'
+  },
+  swatch: {
+    boxSizing: 'border-box',
+    width: '28px',
+    height: '28px',
+    flexShrink: 0,
+    ...shorthands.borderRadius(tokens.borderRadiusCircular),
+    ...shorthands.border('2px', 'solid', 'transparent'),
+    padding: 0,
+    cursor: 'pointer',
+    // The swatch *is* a color preview, so keep the accent color under Windows
+    // High Contrast / forced-colors (W18); otherwise every swatch flattens to one
+    // system color and the accents become indistinguishable.
+    forcedColorAdjust: 'none'
+  },
+  swatchActive: {
+    ...shorthands.borderColor(tokens.colorNeutralForeground1)
+  },
+  errorList: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '8px'
+  },
+  errorRow: {
+    padding: '10px 12px',
+    backgroundColor: tokens.colorNeutralBackground2,
+    ...shorthands.borderRadius(tokens.borderRadiusLarge),
+    border: `1px solid ${tokens.colorNeutralStroke2}`
+  },
+  errorRowHeader: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px'
+  },
+  errorRowTitle: {
+    flexGrow: 1,
+    minWidth: 0,
+    fontWeight: tokens.fontWeightSemibold,
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+    whiteSpace: 'nowrap'
+  }
+})
diff --git a/src/renderer/src/components/ui/Banner.tsx b/src/renderer/src/components/ui/Banner.tsx
new file mode 100644
index 0000000..6822efb
--- /dev/null
+++ b/src/renderer/src/components/ui/Banner.tsx
@@ -0,0 +1,63 @@
+import { makeStyles, mergeClasses, tokens, shorthands } from '@fluentui/react-components'
+import { RADIUS } from './tokens'
+import { useTextStyles } from './text'
+
+/**
+ * One inline notification bar (UI19). The DownloadBar's copied-link suggestion,
+ * its channel/playlist nudge, its duplicate warning, and the Library's copied-link
+ * suggestion had each hand-rolled the same tinted row (leading icon + flex-grow
+ * text + trailing actions). This is that row, once: a leading `icon`, `children`
+ * content that truncates by default (`wrap` to let it flow onto multiple lines),
+ * and a trailing `actions` slot.
+ *
+ * `tone` picks the semantic tint — `brand` for suggestions/nudges, `warning` for
+ * the duplicate caution — matching the former per-component colors exactly.
+ */
+export type BannerTone = 'brand' | 'warning'
+
+const useStyles = makeStyles({
+  root: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px',
+    padding: '8px 8px 8px 12px',
+    ...shorthands.borderRadius(RADIUS.surface)
+  },
+  brand: {
+    backgroundColor: tokens.colorBrandBackground2,
+    color: tokens.colorBrandForeground2
+  },
+  warning: {
+    backgroundColor: tokens.colorStatusWarningBackground1,
+    color: tokens.colorStatusWarningForeground1
+  },
+  content: {
+    flexGrow: 1,
+    minWidth: 0
+  }
+})
+
+export function Banner({
+  icon,
+  tone = 'brand',
+  wrap = false,
+  children,
+  actions
+}: {
+  icon?: React.ReactNode
+  tone?: BannerTone
+  /** Let the content wrap onto multiple lines instead of truncating (the channel nudge). */
+  wrap?: boolean
+  children: React.ReactNode
+  actions?: React.ReactNode
+}): React.JSX.Element {
+  const styles = useStyles()
+  const text = useTextStyles()
+  return (
+    <div className={mergeClasses(styles.root, styles[tone])}>
+      {icon}
+      <div className={mergeClasses(styles.content, !wrap && text.truncate)}>{children}</div>
+      {actions}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/ui/EmptyState.tsx b/src/renderer/src/components/ui/EmptyState.tsx
new file mode 100644
index 0000000..6091b09
--- /dev/null
+++ b/src/renderer/src/components/ui/EmptyState.tsx
@@ -0,0 +1,57 @@
+import { Body1, Caption1, makeStyles, mergeClasses, tokens } from '@fluentui/react-components'
+import { SPACE } from './tokens'
+
+/**
+ * One shared empty-state block (L116/L117). The screens had drifted into three
+ * shapes — Downloads (icon + line), History (colored badge + line + sub-hint),
+ * Library (icon + line, no sub-hint) — and the Terminal / Diagnostics "empty"
+ * text wasn't a centered block at all (inline text). This centers them all on one
+ * structure: an optional focal `icon` (a hero glyph or a colored badge), a `Body1`
+ * message at normal foreground, and an optional muted `hint` line.
+ *
+ * `compact` swaps the tall screen-level padding (56px) for a smaller inset (32px),
+ * for placeholders that sit inside an already-populated screen (the Terminal log,
+ * the Diagnostics list) rather than filling an empty one.
+ */
+const useStyles = makeStyles({
+  root: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'center',
+    gap: SPACE.tight,
+    padding: '56px 16px',
+    // The container is muted, so a hero glyph and the hint line read as secondary;
+    // the message overrides back to the normal foreground so it stays legible.
+    color: tokens.colorNeutralForeground3,
+    textAlign: 'center'
+  },
+  compact: {
+    padding: '32px 16px'
+  },
+  message: {
+    color: tokens.colorNeutralForeground1
+  }
+})
+
+export function EmptyState({
+  icon,
+  message,
+  hint,
+  compact = false,
+  className
+}: {
+  icon?: React.ReactNode
+  message: React.ReactNode
+  hint?: React.ReactNode
+  compact?: boolean
+  className?: string
+}): React.JSX.Element {
+  const styles = useStyles()
+  return (
+    <div className={mergeClasses(styles.root, compact && styles.compact, className)}>
+      {icon}
+      <Body1 className={styles.message}>{message}</Body1>
+      {hint && <Caption1>{hint}</Caption1>}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/ui/IconButton.tsx b/src/renderer/src/components/ui/IconButton.tsx
new file mode 100644
index 0000000..9f2e5a4
--- /dev/null
+++ b/src/renderer/src/components/ui/IconButton.tsx
@@ -0,0 +1,59 @@
+import { forwardRef } from 'react'
+import { makeStyles, mergeClasses, tokens } from '@fluentui/react-components'
+import { useFocusStyles } from './focusRing'
+import { ICON } from './tokens'
+
+const useStyles = makeStyles({
+  btn: {
+    appearance: 'none',
+    border: 'none',
+    backgroundColor: 'transparent',
+    color: tokens.colorNeutralForeground3,
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+    cursor: 'pointer',
+    borderRadius: tokens.borderRadiusMedium,
+    ':hover': {
+      backgroundColor: tokens.colorNeutralBackground1Hover,
+      color: tokens.colorNeutralForeground2
+    },
+    ':disabled': {
+      cursor: 'not-allowed',
+      color: tokens.colorNeutralForegroundDisabled,
+      backgroundColor: 'transparent'
+    }
+  },
+  md: { width: '32px', height: '32px', fontSize: `${ICON.control}px` },
+  sm: { width: '28px', height: '28px', fontSize: `${ICON.inline}px` }
+})
+
+type IconButtonProps = {
+  icon: React.JSX.Element
+  size?: 'sm' | 'md'
+} & React.ButtonHTMLAttributes<HTMLButtonElement>
+
+/**
+ * The recurring icon-only ghost button (UI15) — one implementation for the
+ * sidebar's collapse/theme toggles and the playlist row's video/audio switch,
+ * which were separate hand-rolled buttons with the same look. Carries the shared
+ * focus ring (UI29). Extra props (onClick, aria-label, aria-pressed, disabled, …)
+ * pass straight through to the underlying `<button>`.
+ */
+export const IconButton = forwardRef<HTMLButtonElement, IconButtonProps>(function IconButton(
+  { icon, size = 'md', className, type = 'button', ...rest },
+  ref
+) {
+  const styles = useStyles()
+  const focus = useFocusStyles()
+  return (
+    <button
+      ref={ref}
+      type={type}
+      className={mergeClasses(styles.btn, styles[size], focus.focusRing, className)}
+      {...rest}
+    >
+      {icon}
+    </button>
+  )
+})
diff --git a/src/renderer/src/components/ui/LinkSuggestion.tsx b/src/renderer/src/components/ui/LinkSuggestion.tsx
new file mode 100644
index 0000000..5d45441
--- /dev/null
+++ b/src/renderer/src/components/ui/LinkSuggestion.tsx
@@ -0,0 +1,50 @@
+import { Button, Caption1 } from '@fluentui/react-components'
+import { LinkRegular, DismissRegular } from '@fluentui/react-icons'
+import { Banner } from './Banner'
+
+/**
+ * The "use this copied/received link?" banner (UI19), shared by the DownloadBar
+ * and the Library add-source field, which had identical markup + CSS. Renders the
+ * link (with an optional lead-in like "Link received: ") and Use / Dismiss actions
+ * on the shared {@link Banner}.
+ */
+export function LinkSuggestion({
+  prefix,
+  link,
+  onAccept,
+  onDismiss,
+  dismissLabel
+}: {
+  /** Short lead-in before the link, e.g. "Use copied link? " or "Link received: ". */
+  prefix: string
+  link: string
+  onAccept: () => void
+  onDismiss: () => void
+  /** Accessible name for the dismiss button — say what's being dismissed (L153). */
+  dismissLabel: string
+}): React.JSX.Element {
+  return (
+    <Banner
+      icon={<LinkRegular />}
+      actions={
+        <>
+          <Button size="small" appearance="primary" onClick={onAccept}>
+            Use
+          </Button>
+          <Button
+            size="small"
+            appearance="subtle"
+            icon={<DismissRegular />}
+            onClick={onDismiss}
+            aria-label={dismissLabel}
+          />
+        </>
+      }
+    >
+      <Caption1>
+        {prefix}
+        {link}
+      </Caption1>
+    </Banner>
+  )
+}
diff --git a/src/renderer/src/components/ui/Screen.tsx b/src/renderer/src/components/ui/Screen.tsx
new file mode 100644
index 0000000..09ac655
--- /dev/null
+++ b/src/renderer/src/components/ui/Screen.tsx
@@ -0,0 +1,74 @@
+import { Subtitle2, Caption1, makeStyles, tokens } from '@fluentui/react-components'
+
+/**
+ * One shared content max-width for every screen (UI1).
+ *
+ * Settings used to be a 640px column while the list screens (Downloads, Library,
+ * History, Terminal) were full-width, so on a wide window Settings read as an odd
+ * narrow strip beside edge-to-edge siblings. This caps them all at the same
+ * reading width and centers, so they line up. On typical window sizes the content
+ * is already under the cap, so the list screens are visually unchanged — only the
+ * wide-window upper bound is now shared.
+ *
+ * Merge `screen.width` onto each screen's existing root with `mergeClasses`.
+ */
+export const useScreenStyles = makeStyles({
+  width: {
+    width: '100%',
+    maxWidth: '1200px',
+    marginLeft: 'auto',
+    marginRight: 'auto'
+  }
+})
+
+const useStyles = makeStyles({
+  header: {
+    display: 'flex',
+    alignItems: 'flex-start',
+    gap: '12px',
+    flexWrap: 'wrap'
+  },
+  titleBlock: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '2px',
+    minWidth: 0,
+    flexGrow: 1
+  },
+  description: {
+    color: tokens.colorNeutralForeground3
+  },
+  actions: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '8px',
+    flexShrink: 0
+  }
+})
+
+/**
+ * The consistent screen header block (UI9/UI10): one page-title style on every
+ * screen, with an optional one-line description and an optional right-aligned
+ * action slot. Previously each screen rolled its own (Subtitle2 / Title2 / none),
+ * and only Library had a description.
+ */
+export function ScreenHeader({
+  title,
+  description,
+  actions
+}: {
+  title: string
+  description?: React.ReactNode
+  actions?: React.ReactNode
+}): React.JSX.Element {
+  const styles = useStyles()
+  return (
+    <div className={styles.header}>
+      <div className={styles.titleBlock}>
+        <Subtitle2 as="h1">{title}</Subtitle2>
+        {description && <Caption1 className={styles.description}>{description}</Caption1>}
+      </div>
+      {actions && <div className={styles.actions}>{actions}</div>}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/ui/SegmentedControl.tsx b/src/renderer/src/components/ui/SegmentedControl.tsx
new file mode 100644
index 0000000..fb46ea5
--- /dev/null
+++ b/src/renderer/src/components/ui/SegmentedControl.tsx
@@ -0,0 +1,153 @@
+import { useRef } from 'react'
+import { makeStyles, mergeClasses, tokens } from '@fluentui/react-components'
+import { useFocusStyles } from './focusRing'
+import { ICON } from './tokens'
+
+export interface SegmentOption<T extends string> {
+  value: T
+  label: string
+  /** optional leading icon (used by the sidebar theme switch) */
+  icon?: React.JSX.Element
+}
+
+const useStyles = makeStyles({
+  group: {
+    display: 'inline-flex',
+    width: 'fit-content',
+    border: `1px solid ${tokens.colorNeutralStroke1}`,
+    borderRadius: tokens.borderRadiusMedium,
+    overflow: 'hidden'
+  },
+  // Full-width variant: segments split the available width (the sidebar style).
+  fitted: {
+    display: 'flex',
+    width: '100%'
+  },
+  segment: {
+    appearance: 'none',
+    border: 'none',
+    backgroundColor: 'transparent',
+    color: tokens.colorNeutralForeground2,
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+    gap: '5px',
+    padding: '7px 16px',
+    fontSize: tokens.fontSizeBase300,
+    fontFamily: tokens.fontFamilyBase,
+    cursor: 'pointer',
+    ':hover': {
+      backgroundColor: tokens.colorNeutralBackground1Hover
+    }
+  },
+  segmentFitted: {
+    flexGrow: 1,
+    flexBasis: 0,
+    padding: '7px 4px',
+    fontSize: tokens.fontSizeBase200
+  },
+  segmentActive: {
+    backgroundColor: tokens.colorBrandBackground,
+    color: tokens.colorNeutralForegroundOnBrand,
+    fontWeight: tokens.fontWeightSemibold,
+    ':hover': {
+      backgroundColor: tokens.colorBrandBackgroundHover
+    },
+    // Under Windows High Contrast the brand background is flattened to the system
+    // canvas, so the checked segment would be indistinguishable from the others
+    // (W18). Paint it with the system Highlight pair so the selection stays visible.
+    '@media (forced-colors: active)': {
+      backgroundColor: 'Highlight',
+      color: 'HighlightText',
+      forcedColorAdjust: 'none'
+    }
+  },
+  icon: {
+    display: 'flex',
+    fontSize: `${ICON.inline}px`,
+    flexShrink: 0
+  }
+})
+
+/**
+ * One shared segmented control (UI14) replacing the two hand-rolled versions —
+ * the DownloadBar's Video/Audio kind toggle and the Sidebar's Light/Dark/Auto
+ * theme switch. Renders an ARIA radiogroup with roving-tabindex arrow-key
+ * navigation (UI30) and the shared focus ring (UI29). `fitted` makes the segments
+ * split the full width (sidebar); the default is fit-content (download bar).
+ *
+ * Active treatment is solid brand — the app's one rule for *toggles* (a compact
+ * set where the chosen option should read as pressed). This is deliberately
+ * distinct from the brand-*tint* used for *selection within a list* (the Sidebar
+ * nav item, the CommandPalette active option): one active treatment per control
+ * class (UI20).
+ */
+export function SegmentedControl<T extends string>({
+  value,
+  options,
+  onChange,
+  ariaLabel,
+  fitted = false
+}: {
+  value: T
+  options: SegmentOption<T>[]
+  onChange: (value: T) => void
+  ariaLabel: string
+  fitted?: boolean
+}): React.JSX.Element {
+  const styles = useStyles()
+  const focus = useFocusStyles()
+  const refs = useRef<(HTMLButtonElement | null)[]>([])
+
+  function onKeyDown(e: React.KeyboardEvent, index: number): void {
+    let next = -1
+    if (e.key === 'ArrowRight' || e.key === 'ArrowDown') next = (index + 1) % options.length
+    else if (e.key === 'ArrowLeft' || e.key === 'ArrowUp')
+      next = (index - 1 + options.length) % options.length
+    else if (e.key === 'Home') next = 0
+    else if (e.key === 'End') next = options.length - 1
+    else return
+    const opt = options[next]
+    if (!opt) return
+    e.preventDefault()
+    onChange(opt.value)
+    refs.current[next]?.focus()
+  }
+
+  return (
+    <div
+      className={mergeClasses(styles.group, fitted && styles.fitted)}
+      role="radiogroup"
+      aria-label={ariaLabel}
+    >
+      {options.map((opt, i) => {
+        const on = opt.value === value
+        return (
+          <button
+            key={opt.value}
+            ref={(el) => {
+              refs.current[i] = el
+            }}
+            type="button"
+            role="radio"
+            aria-checked={on}
+            // Roving tabindex: only the selected segment is a tab stop; arrow keys
+            // move within the group, as a radiogroup is expected to behave.
+            tabIndex={on ? 0 : -1}
+            className={mergeClasses(
+              styles.segment,
+              fitted && styles.segmentFitted,
+              on && styles.segmentActive,
+              focus.focusRing
+            )}
+            onClick={() => onChange(opt.value)}
+            onKeyDown={(e) => onKeyDown(e, i)}
+          >
+            {opt.icon && <span className={styles.icon}>{opt.icon}</span>}
+            {opt.label}
+          </button>
+        )
+      })}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/ui/StatusChip.tsx b/src/renderer/src/components/ui/StatusChip.tsx
new file mode 100644
index 0000000..0171f0c
--- /dev/null
+++ b/src/renderer/src/components/ui/StatusChip.tsx
@@ -0,0 +1,35 @@
+import { Badge } from '@fluentui/react-components'
+import type { DownloadStatus } from '../../store/downloads'
+
+/** The item-download status shown as a chip — the queue's live status plus the
+ *  library's 'pending' (catalogued but not yet downloaded). */
+export type ChipStatus = DownloadStatus | 'pending'
+
+type ChipColor = 'brand' | 'success' | 'danger' | 'warning' | 'subtle'
+
+/**
+ * One label + color per status (UI18 / M8) — the single source of truth that
+ * replaces QueueItem's Fluent `Badge` map and LibraryView's custom color `pill`
+ * spans, so the same status concept looks and reads identically on both screens
+ * (e.g. Library no longer says "Downloaded" where the queue says "Completed").
+ */
+const STATUS_CHIP: Record<ChipStatus, { label: string; color: ChipColor }> = {
+  pending: { label: 'Pending', color: 'subtle' },
+  queued: { label: 'Queued', color: 'subtle' },
+  downloading: { label: 'Downloading', color: 'brand' },
+  paused: { label: 'Paused', color: 'warning' },
+  saved: { label: 'Saved', color: 'subtle' },
+  completed: { label: 'Completed', color: 'success' },
+  error: { label: 'Failed', color: 'danger' },
+  canceled: { label: 'Canceled', color: 'subtle' }
+}
+
+/** Shared status chip used by the download queue and the library item list. */
+export function StatusChip({ status }: { status: ChipStatus }): React.JSX.Element {
+  const { label, color } = STATUS_CHIP[status]
+  return (
+    <Badge appearance="tint" color={color}>
+      {label}
+    </Badge>
+  )
+}
diff --git a/src/renderer/src/components/ui/Toaster.tsx b/src/renderer/src/components/ui/Toaster.tsx
new file mode 100644
index 0000000..dc8f468
--- /dev/null
+++ b/src/renderer/src/components/ui/Toaster.tsx
@@ -0,0 +1,99 @@
+import {
+  Caption1,
+  Button,
+  makeStyles,
+  mergeClasses,
+  tokens,
+  shorthands
+} from '@fluentui/react-components'
+import {
+  DismissRegular,
+  ErrorCircleFilled,
+  CheckmarkCircleFilled,
+  InfoFilled
+} from '@fluentui/react-icons'
+import { useToasts, type ToastTone } from '../../store/toasts'
+import { Z, ELEVATION, RADIUS, ICON } from './tokens'
+
+/**
+ * Renders the transient-toast stack (UX6/UX9) bottom-center. Deliberately NOT a
+ * Fluent Toaster/portal — this app avoids portal-based overlays (they blank/flicker
+ * on the dev GPU; see Select.tsx / CommandPalette.tsx) — so it's a plain fixed
+ * stack. No enter/exit animation, matching the app's conservative motion policy on
+ * this machine.
+ */
+const useStyles = makeStyles({
+  stack: {
+    position: 'fixed',
+    left: '50%',
+    bottom: '24px',
+    transform: 'translateX(-50%)',
+    zIndex: Z.tooltip,
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'center',
+    gap: '8px',
+    // Let clicks fall through the gaps between toasts to the app underneath.
+    pointerEvents: 'none'
+  },
+  toast: {
+    pointerEvents: 'auto',
+    display: 'flex',
+    alignItems: 'center',
+    gap: '10px',
+    maxWidth: 'min(520px, 90vw)',
+    padding: '10px 8px 10px 12px',
+    backgroundColor: tokens.colorNeutralBackground1,
+    border: `1px solid ${tokens.colorNeutralStroke2}`,
+    ...shorthands.borderRadius(RADIUS.surface),
+    boxShadow: ELEVATION.overlay
+  },
+  icon: {
+    flexShrink: 0,
+    fontSize: `${ICON.control}px`,
+    display: 'flex'
+  },
+  info: { color: tokens.colorNeutralForeground3 },
+  error: { color: tokens.colorStatusDangerForeground1 },
+  success: { color: tokens.colorStatusSuccessForeground1 },
+  message: {
+    flexGrow: 1,
+    minWidth: 0
+  }
+})
+
+const ICONS: Record<ToastTone, React.JSX.Element> = {
+  info: <InfoFilled />,
+  error: <ErrorCircleFilled />,
+  success: <CheckmarkCircleFilled />
+}
+
+export function Toaster(): React.JSX.Element | null {
+  const styles = useStyles()
+  const toasts = useToasts((s) => s.toasts)
+  const dismiss = useToasts((s) => s.dismiss)
+  const toneClass: Record<ToastTone, string> = {
+    info: styles.info,
+    error: styles.error,
+    success: styles.success
+  }
+
+  if (toasts.length === 0) return null
+  return (
+    <div className={styles.stack} role="status" aria-live="polite">
+      {toasts.map((t) => (
+        <div key={t.id} className={styles.toast}>
+          <span className={mergeClasses(styles.icon, toneClass[t.tone])}>{ICONS[t.tone]}</span>
+          <Caption1 className={styles.message}>{t.message}</Caption1>
+          <Button
+            size="small"
+            appearance="subtle"
+            icon={<DismissRegular />}
+            onClick={() => dismiss(t.id)}
+            aria-label="Dismiss notification"
+          />
+        </div>
+      ))}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/ui/errorText.ts b/src/renderer/src/components/ui/errorText.ts
new file mode 100644
index 0000000..374d219
--- /dev/null
+++ b/src/renderer/src/components/ui/errorText.ts
@@ -0,0 +1,21 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+/**
+ * Shared error-text styling (M12). The red `colorPaletteRedForeground1` was being
+ * applied via inline `style={{ color: … }}` across the app; this hook is the one
+ * place that owns it.
+ *
+ * - `error` — a single line of error copy (e.g. an inline validation/result message).
+ * - `errorPre` — the same colour but preserving newlines/long tokens, for multi-line
+ *   yt-dlp/updater error output that would otherwise overflow.
+ */
+export const useErrorTextStyles = makeStyles({
+  error: {
+    color: tokens.colorPaletteRedForeground1
+  },
+  errorPre: {
+    color: tokens.colorPaletteRedForeground1,
+    whiteSpace: 'pre-wrap',
+    wordBreak: 'break-word'
+  }
+})
diff --git a/src/renderer/src/components/ui/focusRing.ts b/src/renderer/src/components/ui/focusRing.ts
new file mode 100644
index 0000000..9636612
--- /dev/null
+++ b/src/renderer/src/components/ui/focusRing.ts
@@ -0,0 +1,26 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+/**
+ * One focus-visible ring for every hand-rolled interactive element (UI29).
+ *
+ * Fluent's own controls draw their own focus indicator; the app's bespoke
+ * buttons, segmented controls, command-palette rows, and `role="button"` headers
+ * previously fell back to the UA default (often invisible) or removed it
+ * entirely. This gives them all the same visible, theme-aware keyboard focus.
+ *
+ * Apply with `mergeClasses(focus.focusRing, …)`. The ring is inset (negative
+ * offset) so it never clips inside `overflow: hidden` containers and follows each
+ * element's own border-radius; it shows only for `:focus-visible`, so pointer
+ * clicks stay quiet.
+ */
+export const useFocusStyles = makeStyles({
+  focusRing: {
+    outlineStyle: 'none',
+    ':focus-visible': {
+      outlineWidth: '2px',
+      outlineStyle: 'solid',
+      outlineColor: tokens.colorStrokeFocus2,
+      outlineOffset: '-2px'
+    }
+  }
+})
diff --git a/src/renderer/src/components/ui/text.ts b/src/renderer/src/components/ui/text.ts
new file mode 100644
index 0000000..b236d10
--- /dev/null
+++ b/src/renderer/src/components/ui/text.ts
@@ -0,0 +1,52 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+/**
+ * Shared text-role styles + the app's type-role convention (Batch 7).
+ *
+ * The renderer had drifted on typography: the one muted color was re-declared under
+ * eight class names (L110), row titles were rendered as three different components
+ * (L114), and `Caption1`/`Body1`/`Text` were applied by feel (L123/L124). The
+ * convention below makes the roles explicit; this module supplies the two styles
+ * that back it.
+ *
+ * Type roles — reach for the Fluent type component, add `muted` for secondary color:
+ * - `<Subtitle2>` — screen titles and settings-section headers (via `ScreenHeader`
+ *   and each settings card's header).
+ * - `<Text>` — the one row/item title component (add `title` for the semibold,
+ *   single-line-with-ellipsis treatment). Previously split across `<Text>`, a bare
+ *   `<span>`, and `<Caption1>` (L114).
+ * - `<Body1>` — body copy: empty-state messages, onboarding prose, gated notices.
+ *   Not for titles or metadata (L124).
+ * - `<Caption1>` — small secondary text: metadata, hints, counts, timestamps. One
+ *   role doing several closely-related jobs, all "small secondary text" (L123).
+ */
+export const useTextStyles = makeStyles({
+  /**
+   * The single muted / secondary-text color (L110) — was re-declared as
+   * hint/sub/meta/srcSub/stats/count/emptyHint/previewMeta. Merge onto a `<Caption1>`
+   * or `<Text>`, or use alone where the element sets no other style.
+   */
+  muted: {
+    color: tokens.colorNeutralForeground3
+  },
+  /** The shared row/item title treatment (L114): semibold, single line, ellipsis. */
+  title: {
+    fontWeight: tokens.fontWeightSemibold,
+    minWidth: 0,
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+    whiteSpace: 'nowrap'
+  },
+  /**
+   * The single-line truncation utility (L126): clip overflowing text to one line
+   * with an ellipsis. This is `title` without the semibold weight — for metadata
+   * and non-title text that should truncate rather than wrap. Needs `minWidth: 0`
+   * so it can shrink inside a flex row.
+   */
+  truncate: {
+    minWidth: 0,
+    overflow: 'hidden',
+    textOverflow: 'ellipsis',
+    whiteSpace: 'nowrap'
+  }
+})
diff --git a/src/renderer/src/components/ui/tokens.ts b/src/renderer/src/components/ui/tokens.ts
new file mode 100644
index 0000000..0febf66
--- /dev/null
+++ b/src/renderer/src/components/ui/tokens.ts
@@ -0,0 +1,139 @@
+import { tokens } from '@fluentui/react-components'
+
+/**
+ * AeroFetch design tokens — the app's own semantic scales, layered on Fluent's.
+ *
+ * Batch 6 of the audit (UI2–UI7, UI12, UI26, L100, L101, L121, L125, L160, L164)
+ * found the same visual decisions expressed as ad-hoc literals scattered across
+ * components: four section gaps, seven card paddings, two floating shadows, two
+ * hardcoded `zIndex: 1000`s, a raw `rgba()` scrim, nine inline icon sizes, and
+ * three metadata separators. This module is the single home for those values so
+ * every screen reads as one product and a change happens in one place.
+ *
+ * Where Fluent already defines a scale (spacing, radius, shadow, motion, the
+ * overlay scrim) these alias Fluent's tokens, so the app stays pixel-aligned with
+ * Fluent's own controls. Where Fluent has no token (z-index, icon px, the
+ * metadata separator) the value lives here.
+ *
+ * Griffel evaluates `makeStyles` at runtime in this project (no build plugin — see
+ * `thumbSizes` already imported into `downloadBar/styles.ts`), so these imported
+ * constants work directly inside `makeStyles` blocks and in inline `style={{}}`.
+ */
+
+/**
+ * Spacing ramp (px). Gaps, padding, and margins all draw from this one scale; the
+ * comments record the role each step plays so call sites stay self-documenting.
+ * Values match Fluent's spacing ramp (XXS 2 · XS 4 · S 8 · MNudge 10 · M 12 · L 16
+ * · XL 20 · XXL 24 · XXXL 32).
+ */
+export const SPACE = {
+  /** 2px — optical hairline nudge (e.g. aligning an icon to a text baseline) (L160). */
+  hairline: '2px',
+  /** 4px — icon-button clusters (UI5); tight margins between stacked lines (L160). */
+  xtight: '4px',
+  /** 8px — labelled-control rows (UI5); the default inline gap. */
+  tight: '8px',
+  /** 10px — control inner padding; small tiles. */
+  snug: '10px',
+  /** 12px — list-row padding; the gap between rows inside a card. */
+  cozy: '12px',
+  /** 16px — the one gap between screen sections (UI2) and the card padding tier (UI3). */
+  section: '16px',
+  /** 20px — a larger block gap. */
+  roomy: '20px',
+  /** 24px — page content padding (UI4); the hero padding tier's floor. */
+  page: '24px',
+  /** 32px — the onboarding / welcome hero card padding (UI3 hero tier). */
+  hero: '32px'
+} as const
+
+/**
+ * Corner-radius tiers by surface (UI6/UI7). Aliases Fluent's radius tokens, which
+ * `friendlyRadii` (theme.ts) tunes to Medium 10 · Large 12 · XLarge 16.
+ *
+ * - `control` (10) — inputs, thumbnails, small tiles, popover rows.
+ * - `surface` (12) — list-item cards and inline panels.
+ * - `card` (16) — page-level cards (the download bar, settings cards, onboarding).
+ */
+export const RADIUS = {
+  control: tokens.borderRadiusMedium,
+  surface: tokens.borderRadiusLarge,
+  card: tokens.borderRadiusXLarge
+} as const
+
+/**
+ * Elevation scale (L100). Cards are flat by default (border only — the app's
+ * resting surface); only genuinely floating surfaces cast a shadow.
+ *
+ * - `flat` — the default card: no shadow, a 1px neutral-stroke border.
+ * - `raised` (shadow4) — the download bar, which floats above the queue.
+ * - `overlay` (shadow28) — the command palette and any future popover.
+ */
+export const ELEVATION = {
+  flat: 'none',
+  raised: tokens.shadow4,
+  overlay: tokens.shadow28
+} as const
+
+/**
+ * Z-index scale (L101). Replaces the two hardcoded `zIndex: 1000`s so stacking is
+ * ordered on purpose: tooltips sit above full-screen overlays.
+ */
+export const Z = {
+  /** full-screen scrims and the command palette. */
+  overlay: 1000,
+  /** hint bubbles — above overlays so a tooltip is never clipped by one. */
+  tooltip: 1100
+} as const
+
+/**
+ * Theme-aware scrim for full-screen overlays (L121). Fluent's overlay token
+ * replaces the renderer's one raw `rgba(0,0,0,0.32)` — it's the semantic dialog
+ * scrim and darkens a touch more, so the palette separates cleanly from a dark UI.
+ */
+export const SCRIM = tokens.colorBackgroundOverlay
+
+/**
+ * Icon-size scale in px (UI12/L125): one small set instead of the nine scattered
+ * `fontSize` literals. Applied as a numeric `fontSize={ICON.x}` on standalone
+ * glyphs, or `` `${ICON.x}px` `` on the rare makeStyles container.
+ *
+ * - `inline` (16) — glyphs sitting inline with text (row actions, small badges).
+ * - `control` (20) — glyphs inside buttons, nav items, toggles, and small leading
+ *   accent icons (e.g. the onboarding folder/tip rows).
+ * - `section` (24) — section/card-header glyphs (e.g. each settings card's title).
+ * - `hero` (40) — the focal icon in an empty state.
+ *
+ * Snapped to the nearest tier rather than a literal px even when centered in a
+ * fixed tile (UI11 — no literal px font sizes): the brand/source tiles
+ * (Sidebar/Onboarding `mark`, Library `srcIcon`, History `emptyBadge`) take
+ * `control` or `section`. Genuinely off this scale: the tiny `watchBadge` glyph
+ * (matched to its badge-caption text size) and the thumbnail placeholder icons
+ * (which track `thumbSizes`).
+ */
+export const ICON = {
+  inline: 16,
+  control: 20,
+  section: 24,
+  hero: 40
+} as const
+
+/**
+ * One motion policy (UI26). The app keeps a single, subtle transition timing
+ * (matching the sidebar's former `0.15s ease`) and gates *all* transitions and
+ * animations behind `prefers-reduced-motion` globally in base.css — so motion is
+ * consistent where it exists and fully off for users who ask for less.
+ */
+export const MOTION = {
+  duration: tokens.durationFast,
+  curve: tokens.curveEasyEase
+} as const
+
+/**
+ * The single metadata separator (L164). Joins independent fields on a meta line
+ * (e.g. `Channel • 12:04`, `1.2 GB/s • 3s left`). Previously three styles were in
+ * use (`'  •  '`, `' · '`, `' • '`). Note this is distinct from the *intra-value*
+ * separator inside a compound quality label ("720p · mp4 · 184 MB"), which is a
+ * data format parsed elsewhere and intentionally left alone.
+ */
+export const META_SEP = ' • '
diff --git a/src/renderer/src/datetime.ts b/src/renderer/src/datetime.ts
new file mode 100644
index 0000000..2c0f83f
--- /dev/null
+++ b/src/renderer/src/datetime.ts
@@ -0,0 +1,48 @@
+// One home for the renderer's date/time formatters (M9). These were previously
+// three private functions — `relTime` (LibraryView), `formatWhen` (HistoryView)
+// and `fmtSchedule` (QueueItem) — each reimplementing date math inline.
+
+/** Relative "time since" label: "just now" / "5 min ago" / "3 h ago" /
+ *  "2 d ago" / "3 w ago" / "2 mo ago". Returns "never" for a missing
+ *  timestamp. (Library last-indexed.) */
+export function relTime(ms?: number): string {
+  if (!ms) return 'never'
+  const mins = Math.round((Date.now() - ms) / 60000)
+  if (mins < 1) return 'just now'
+  if (mins < 60) return `${mins} min ago`
+  const hrs = Math.round(mins / 60)
+  if (hrs < 24) return `${hrs} h ago`
+  const days = Math.round(hrs / 24)
+  if (days < 7) return `${days} d ago`
+  const weeks = Math.round(days / 7)
+  if (weeks < 5) return `${weeks} w ago`
+  return `${Math.round(days / 30)} mo ago`
+}
+
+/** Absolute "when" label: "Today, 3:04 PM" / "Yesterday, 3:04 PM" /
+ *  "Jun 5" (current year) / "Jun 5, 2024" (past year). (History rows.) */
+export function formatWhen(ts: number): string {
+  const d = new Date(ts)
+  const time = d.toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })
+  const now = new Date()
+  const startOfToday = new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime()
+  const dayMs = 1000 * 60 * 60 * 24
+  if (ts >= startOfToday) return `Today, ${time}`
+  if (ts >= startOfToday - dayMs) return `Yesterday, ${time}`
+  const sameYear = d.getFullYear() === now.getFullYear()
+  return d.toLocaleDateString(undefined, {
+    month: 'short',
+    day: 'numeric',
+    ...(sameYear ? {} : { year: 'numeric' })
+  })
+}
+
+/** Full date + time for a scheduled download, e.g. "Jun 5, 2025, 3:04 PM".
+ *  Returns '' if the timestamp can't be formatted. (Queue scheduled badge.) */
+export function fmtSchedule(ms: number): string {
+  try {
+    return new Date(ms).toLocaleString([], { dateStyle: 'medium', timeStyle: 'short' })
+  } catch {
+    return ''
+  }
+}
diff --git a/src/renderer/src/id.ts b/src/renderer/src/id.ts
new file mode 100644
index 0000000..9a08423
--- /dev/null
+++ b/src/renderer/src/id.ts
@@ -0,0 +1,14 @@
+// Single id generator for queue items, terminal runs, and command templates.
+// Replaces three near-identical `newId()` copies that had divergent fallback
+// prefixes and could collide within a millisecond (M7 / L33 / L70).
+//
+// `crypto.randomUUID` is the real path in Electron/Node; the counter-suffixed
+// fallback is effectively unreachable but kept so the function is total in any
+// host, and the monotonic counter makes two ids minted in the same millisecond
+// distinct (the old `Date.now()`-only fallbacks could collide).
+let counter = 0
+
+export function newId(prefix = 'id'): string {
+  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()
+  return `${prefix}-${Date.now()}-${++counter}`
+}
diff --git a/src/renderer/src/isPreview.ts b/src/renderer/src/isPreview.ts
new file mode 100644
index 0000000..9d1a723
--- /dev/null
+++ b/src/renderer/src/isPreview.ts
@@ -0,0 +1,8 @@
+/**
+ * True in the standalone browser UI preview, where Electron's preload never ran
+ * so `window.electron` (and the real `window.api` IPC bridge) is absent. The
+ * stores and a few views branch on this to drive seed data / fake tickers instead
+ * of calling IPC. Single-sourced here (C1) so the check isn't re-declared in ~8
+ * files — import it as `PREVIEW` where that reads better locally.
+ */
+export const isPreview = typeof window === 'undefined' || !window.electron
diff --git a/src/renderer/src/lib/urlHelpers.ts b/src/renderer/src/lib/urlHelpers.ts
new file mode 100644
index 0000000..37db4ad
--- /dev/null
+++ b/src/renderer/src/lib/urlHelpers.ts
@@ -0,0 +1,105 @@
+/**
+ * Pull the video id out of any YouTube watch / shorts / embed / live / youtu.be
+ * URL. Returns null for non-YouTube URLs or anything unparseable, so callers can
+ * cheaply ask "is there a YouTube id derivable from this link?". The single home
+ * for this parse — thumbnails, duplicate detection, and the placeholder title all
+ * use it (H2).
+ */
+export function youtubeId(url: string | undefined): string | null {
+  if (!url) return null
+  let u: URL
+  try {
+    u = new URL(url)
+  } catch {
+    return null
+  }
+  const host = u.hostname.replace(/^www\./i, '').toLowerCase()
+  if (host === 'youtu.be') return u.pathname.slice(1).split('/')[0] || null
+  if (host === 'youtube.com' || host.endsWith('.youtube.com')) {
+    const v = u.searchParams.get('v')
+    if (v) return v
+    const m = u.pathname.match(/^\/(?:embed|shorts|v|live)\/([^/?#]+)/i)
+    if (m?.[1]) return m[1]
+  }
+  return null
+}
+
+/** A quick heuristic for "this clipboard text is a link worth offering". */
+export function looksLikeUrl(text: string): boolean {
+  const t = text.trim()
+  if (!/^https?:\/\//i.test(t)) return false
+  try {
+    new URL(t)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * True for URLs that point at a single video rather than a channel/playlist. The
+ * library's add-source field wants collections to sync, not one-off videos, so it
+ * filters these out of its suggestions. Conservative on purpose: it only flags the
+ * common YouTube single-video shapes (a `/watch?v=` or `youtu.be/<id>` with no
+ * `list=` context), so a channel/playlist link — on YouTube or any other site — is
+ * never wrongly rejected. A `list=` param means "add the playlist", so it's kept.
+ */
+export function looksLikeSingleVideo(text: string): boolean {
+  let u: URL
+  try {
+    u = new URL(text.trim())
+  } catch {
+    return false
+  }
+  if (u.searchParams.has('list')) return false
+  const host = u.hostname.replace(/^www\./, '').toLowerCase()
+  if (host === 'youtube.com' || host === 'm.youtube.com' || host === 'music.youtube.com') {
+    return u.pathname === '/watch' && u.searchParams.has('v')
+  }
+  if (host === 'youtu.be') {
+    return /^\/[\w-]{6,}$/.test(u.pathname)
+  }
+  return false
+}
+
+/**
+ * True for URLs that point at a whole channel or playlist rather than a single
+ * video — the shapes that belong in the Library (index once, download in bulk),
+ * not the one-off Downloads bar (UX3). Conservative on purpose: it only flags the
+ * clear YouTube channel and dedicated-playlist shapes, so a plain `/watch?v=…`
+ * video (even one carrying a `list=` context) is never flagged and keeps working
+ * in the Downloads bar; a non-YouTube link is never flagged.
+ */
+export function looksLikeChannelOrPlaylist(text: string): boolean {
+  let u: URL
+  try {
+    u = new URL(text.trim())
+  } catch {
+    return false
+  }
+  const host = u.hostname.replace(/^www\./, '').toLowerCase()
+  const isYouTube =
+    host === 'youtube.com' || host === 'm.youtube.com' || host === 'music.youtube.com'
+  if (!isYouTube) return false
+  // A dedicated playlist page (not a /watch video that merely carries a list).
+  if (u.pathname === '/playlist' && u.searchParams.has('list')) return true
+  // Channel shapes: /channel/UC…, /c/Name, /user/Name, /@handle — with an optional
+  // /videos, /streams, /shorts, /playlists tab suffix.
+  if (/^\/(channel|c|user)\/[^/]+/i.test(u.pathname)) return true
+  if (/^\/@[^/]+/.test(u.pathname)) return true
+  return false
+}
+
+/**
+ * Return the first http(s) URL from a multi-line blob of text.
+ * Lines are trimmed; '#' comment lines are skipped.
+ * Used for clipboard paste and drag-drop text.
+ */
+export function firstUrlInText(text: string): string | null {
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#')) continue
+    if (looksLikeUrl(line)) return line
+  }
+  return null
+}
diff --git a/src/renderer/src/main.tsx b/src/renderer/src/main.tsx
index f793de3..1f18d6a 100644
--- a/src/renderer/src/main.tsx
+++ b/src/renderer/src/main.tsx
@@ -1,240 +1,22 @@
 import './assets/base.css'
 import React from 'react'
 import ReactDOM from 'react-dom/client'
-import { DEFAULT_DOWNLOAD_OPTIONS, type Settings, type CommandTemplate } from '@shared/ipc'
 import App from './App'
+import { ErrorBoundary } from './components/ErrorBoundary'
+import { mockApi } from './mockApi'
 
 // In the standalone UI preview (browser, no Electron preload) window.api isn't
-// injected. Stub the full surface so the UI renders and stays interactive during
-// design work. The store detects preview mode (no window.electron) and drives a
-// fake progress ticker instead of calling these, so most are inert no-ops.
-// In the real Electron app this branch is skipped — preload provides window.api.
+// injected. Install the mock surface (mockApi.ts) so the UI renders and stays
+// interactive during design work. In the real Electron app this branch is
+// skipped — preload provides the real window.api.
 if (import.meta.env.DEV && !window.api) {
-  const MOCK_SETTINGS: Settings = {
-    videoDir: 'C:\\Users\\you\\Documents\\Video',
-    audioDir: 'C:\\Users\\you\\Documents\\Audio',
-    defaultKind: 'video',
-    defaultVideoQuality: 'Best available',
-    defaultAudioQuality: 'Best (MP3)',
-    maxConcurrent: 2,
-    filenameTemplate: '%(title)s.%(ext)s',
-    theme: 'light',
-    accentColor: 'teal',
-    clipboardWatch: true,
-    downloadOptions: DEFAULT_DOWNLOAD_OPTIONS,
-    proxy: '',
-    rateLimit: '',
-    useAria2c: false,
-    cookieSource: 'none',
-    cookiesBrowser: 'chrome',
-    youtubePlayerClient: '',
-    youtubePoToken: '',
-    restrictFilenames: false,
-    downloadArchive: false,
-    autoUpdateYtdlp: true,
-    ytdlpChannel: 'nightly',
-    ytdlpLastUpdateCheck: Date.now() - 3_600_000,
-    customCommandEnabled: false,
-    defaultTemplateId: null,
-    notifyOnComplete: true,
-    autoDownloadNew: true,
-    hasCompletedOnboarding: true,
-    minimizeToTray: false,
-    launchAtStartup: false,
-    updateToken: ''
-  }
-  // Stands in for the cookies.txt file's mtime — lets the Cookies card's
-  // sign-in/clear flow be exercised in this browser-only preview.
-  let mockCookiesSavedAt: number | null = null
-  // Stands in for templates.json — lets the Custom commands card's CRUD and
-  // the download bar's template picker be exercised in this browser-only preview.
-  let mockTemplates: CommandTemplate[] = [
-    { id: 'tpl1', name: 'Write thumbnail, no mtime', args: '--write-thumbnail --no-mtime' }
-  ]
-
-  window.api = {
-    getAppVersion: async () => '0.4.0-preview',
-    checkForAppUpdate: async () => {
-      await new Promise((r) => setTimeout(r, 400))
-      return {
-        ok: true,
-        available: true,
-        currentVersion: '0.4.0',
-        latestVersion: '0.5.0',
-        notes:
-          '### What’s new in v0.5.0\n- In-app updater (this screen!)\n- Faster downloads\n- Bug fixes',
-        htmlUrl: 'https://gitea.netbird.zimspace.uk:5938/debont80/AeroFetch/releases',
-        downloadUrl: 'https://gitea.netbird.zimspace.uk:5938/example/AeroFetch-Setup-0.5.0.exe',
-        assetName: 'AeroFetch-Setup-0.5.0.exe'
-      }
-    },
-    downloadAppUpdate: async () => ({
-      ok: false,
-      error: 'Downloading updates is disabled in the browser preview.'
-    }),
-    runAppUpdate: async () => ({ ok: true }),
-    onAppUpdateProgress: () => () => {},
-    getYtdlpVersion: async () => ({ ok: true, version: '2025.06.01 (UI preview mock)' }),
-    getFfmpegVersions: async () => ({ ffmpeg: '7.1-full_build (UI preview mock)', ffprobe: '7.1-full_build (UI preview mock)' }),
-    probe: async (url: string) => {
-      await new Promise((r) => setTimeout(r, 700)) // simulate network latency
-      // A 'list'/'playlist' URL exercises the playlist selection UI in preview.
-      if (/list=|playlist/i.test(url)) {
-        return {
-          ok: true,
-          kind: 'playlist',
-          playlist: {
-            title: 'Full Electron Course — All Episodes',
-            uploader: 'DevChannel',
-            count: 5,
-            entries: Array.from({ length: 5 }, (_, i) => ({
-              index: i + 1,
-              id: `vid${i + 1}`,
-              title: `Episode ${i + 1} — ${['Setup', 'Main Process', 'IPC', 'Packaging', 'Release'][i]}`,
-              url: `https://youtube.com/watch?v=vid${i + 1}`,
-              durationLabel: `${10 + i}:0${i}`,
-              uploader: 'DevChannel'
-            }))
-          }
-        }
-      }
-      return {
-        ok: true,
-        kind: 'video',
-        info: {
-          title: 'Building a Desktop App with Electron — Full Course',
-          channel: 'DevChannel',
-          durationLabel: '1:42:08',
-          thumbnail: undefined,
-          formats: [
-            { id: '__best__', label: 'Best available', ext: 'mp4', hasAudio: true },
-            { id: '299', label: '1080p60 · mp4 · 248 MB', height: 1080, ext: 'mp4', filesizeLabel: '248 MB', hasAudio: false },
-            { id: '136', label: '720p · mp4 · 124 MB', height: 720, ext: 'mp4', filesizeLabel: '124 MB', hasAudio: false },
-            { id: '135', label: '480p · mp4 · 72 MB', height: 480, ext: 'mp4', filesizeLabel: '72 MB', hasAudio: false },
-            { id: '134', label: '360p · mp4 · 38 MB', height: 360, ext: 'mp4', filesizeLabel: '38 MB', hasAudio: false }
-          ]
-        }
-      }
-    },
-    startDownload: async () => ({ ok: true }),
-    cancelDownload: async () => {},
-    pauseDownload: async () => {},
-    getDefaultFolder: async () => 'C:\\Users\\you\\Downloads',
-    chooseFolder: async () => null,
-    openPath: async () => '',
-    showInFolder: async () => {},
-    readClipboard: async () => '',
-    getSettings: async () => MOCK_SETTINGS,
-    setSettings: async (partial) => Object.assign(MOCK_SETTINGS, partial),
-    listHistory: async () => [],
-    addHistory: async () => [],
-    removeHistory: async () => [],
-    removeManyHistory: async () => [],
-    clearHistory: async () => [],
-    cookiesLogin: async () => {
-      await new Promise((r) => setTimeout(r, 600)) // simulate the sign-in window
-      mockCookiesSavedAt = Date.now()
-      return { ok: true, cookieCount: 14 }
-    },
-    cookiesStatus: async () =>
-      mockCookiesSavedAt ? { exists: true, savedAt: mockCookiesSavedAt } : { exists: false },
-    cookiesClear: async () => {
-      mockCookiesSavedAt = null
-    },
-    listTemplates: async () => mockTemplates,
-    saveTemplate: async (template) => {
-      mockTemplates = [template, ...mockTemplates.filter((t) => t.id !== template.id)]
-      return mockTemplates
-    },
-    removeTemplate: async (id) => {
-      mockTemplates = mockTemplates.filter((t) => t.id !== id)
-      return mockTemplates
-    },
-    previewCommand: async (opts) => {
-      await new Promise((r) => setTimeout(r, 300)) // simulate the main-process round-trip
-      const extra = opts.extraArgs ? ` ${opts.extraArgs}` : ''
-      const dir = opts.kind === 'audio' ? MOCK_SETTINGS.audioDir : MOCK_SETTINGS.videoDir
-      return {
-        ok: true,
-        command:
-          `yt-dlp.exe -f "bv*+ba/b" -o "${dir}\\%(title)s.%(ext)s"` + `${extra} -- ${opts.url}`
-      }
-    },
-    updateYtdlp: async (channel) => {
-      await new Promise((r) => setTimeout(r, 600)) // simulate the self-update run
-      return { ok: true, output: `yt-dlp is already up to date (channel: ${channel}, UI preview mock)` }
-    },
-    // No background updater in the browser preview — hand back an inert unsubscribe.
-    onYtdlpAutoUpdateStatus: () => () => {},
-    listErrorLog: async () => [],
-    clearErrorLog: async () => [],
-    exportBackup: async () => ({ ok: true, path: 'C:\\Users\\you\\Downloads\\aerofetch-backup.json' }),
-    importBackup: async () => ({ ok: true }),
-    onDownloadEvent: () => () => {},
-    getSystemTheme: async () => ({ shouldUseDarkColors: false, shouldUseHighContrastColors: false }),
-    onSystemThemeUpdate: () => () => {},
-    openHighContrastSettings: async () => {},
-    onExternalUrl: () => () => {},
-    // Media-manager sources — a seeded channel so the (Phase H) Library view has
-    // demo data in this browser-only preview.
-    listSources: async () => [
-      {
-        id: 'src-demo',
-        url: 'https://www.youtube.com/@DevChannel',
-        kind: 'channel',
-        title: 'DevChannel',
-        channel: 'DevChannel',
-        addedAt: Date.now() - 86_400_000,
-        lastIndexedAt: Date.now() - 3_600_000,
-        itemCount: 7
-      }
-    ],
-    indexSource: async (url) => {
-      await new Promise((r) => setTimeout(r, 800)) // simulate the index walk
-      return {
-        ok: true,
-        source: {
-          id: 'src-demo',
-          url,
-          kind: 'channel',
-          title: 'DevChannel',
-          channel: 'DevChannel',
-          addedAt: Date.now(),
-          lastIndexedAt: Date.now(),
-          itemCount: 7
-        },
-        itemCount: 7
-      }
-    },
-    reindexSource: async () => ({ ok: true, itemCount: 7, newCount: 0 }),
-    removeSource: async () => [],
-    markSourceItemDownloaded: async () => [],
-    setSourceWatched: async () => [],
-    syncSources: async () => ({ ok: true, newItems: [] }),
-    getScheduledSync: async () => ({ enabled: false }),
-    setScheduledSync: async (enabled: boolean) => ({ enabled }),
-    listSourceItems: async (sourceId) =>
-      Array.from({ length: 7 }, (_, i) => ({
-        id: `${sourceId}:vid${i + 1}`,
-        sourceId,
-        videoId: `vid${i + 1}`,
-        title: `Episode ${i + 1}`,
-        url: `https://youtube.com/watch?v=vid${i + 1}`,
-        playlistTitle: i < 5 ? 'Full Electron Course' : 'Uploads',
-        playlistIndex: i < 5 ? i + 1 : i - 4,
-        durationLabel: `${10 + i}:0${i}`,
-        downloaded: i < 2
-      })),
-    onIndexProgress: () => () => {},
-    runTerminal: async () => ({ ok: true }),
-    cancelTerminal: async () => {},
-    onTerminalOutput: () => () => {},
-    setTaskbarProgress: () => {}
-  }
+  window.api = mockApi
 }
 
 ReactDOM.createRoot(document.getElementById('root') as HTMLElement).render(
   <React.StrictMode>
-    <App />
+    <ErrorBoundary>
+      <App />
+    </ErrorBoundary>
   </React.StrictMode>
 )
diff --git a/src/renderer/src/mockApi.ts b/src/renderer/src/mockApi.ts
new file mode 100644
index 0000000..b4f21d8
--- /dev/null
+++ b/src/renderer/src/mockApi.ts
@@ -0,0 +1,264 @@
+import { DEFAULT_SETTINGS, type Settings, type CommandTemplate } from '@shared/ipc'
+
+/**
+ * The browser-preview stand-in for the real `window.api` IPC bridge (C1). In the
+ * standalone UI preview (browser, no Electron preload) `window.api` isn't
+ * injected, so main.tsx assigns this mock to keep the UI interactive during
+ * design work. Typed as the real `Api` surface (`Window['api']`) so it can't
+ * silently drift from the preload contract — a missing or mistyped method is a
+ * compile error. Most methods are inert no-ops because the stores detect preview
+ * mode (no window.electron) and drive a fake progress ticker instead.
+ */
+type Api = Window['api']
+
+// The preview settings: the canonical defaults, plus preview-only tweaks —
+// placeholder folders, a nightly channel + a recent check to exercise the
+// updater card, auto-download on, and onboarding already dismissed so design
+// work isn't blocked behind the welcome screen.
+const MOCK_SETTINGS: Settings = {
+  ...DEFAULT_SETTINGS,
+  videoDir: 'C:\\Users\\you\\Documents\\Video',
+  audioDir: 'C:\\Users\\you\\Documents\\Audio',
+  ytdlpChannel: 'nightly',
+  ytdlpLastUpdateCheck: Date.now() - 3_600_000,
+  autoDownloadNew: true,
+  hasCompletedOnboarding: true
+}
+
+// One mock "installed version" so the sidebar (getAppVersion) and the update card
+// (checkForAppUpdate.currentVersion) agree instead of disagreeing 0.4.0-preview vs
+// 0.4.0 (L171). Kept below the mock "latest" so the updater card demos an available
+// update in the browser preview.
+const MOCK_CURRENT_VERSION = '0.4.0'
+
+// Stands in for the cookies.txt file's mtime — lets the Cookies card's
+// sign-in/clear flow be exercised in this browser-only preview.
+let mockCookiesSavedAt: number | null = null
+// Stands in for templates.json — lets the Custom commands card's CRUD and
+// the download bar's template picker be exercised in this browser-only preview.
+let mockTemplates: CommandTemplate[] = [
+  { id: 'tpl1', name: 'Write thumbnail, no mtime', args: '--write-thumbnail --no-mtime' }
+]
+
+export const mockApi: Api = {
+  getAppVersion: async () => MOCK_CURRENT_VERSION,
+  checkForAppUpdate: async () => {
+    await new Promise((r) => setTimeout(r, 400))
+    return {
+      ok: true,
+      available: true,
+      currentVersion: MOCK_CURRENT_VERSION,
+      latestVersion: '0.5.0',
+      notes:
+        '### What’s new in v0.5.0\n- In-app updater (this screen!)\n- Faster downloads\n- Bug fixes',
+      htmlUrl: 'https://gitea.netbird.zimspace.uk:5938/debont80/AeroFetch/releases',
+      downloadUrl: 'https://gitea.netbird.zimspace.uk:5938/example/AeroFetch-Setup-0.5.0.exe',
+      assetName: 'AeroFetch-Setup-0.5.0.exe'
+    }
+  },
+  downloadAppUpdate: async () => ({
+    ok: false,
+    error: 'Downloading updates is disabled in the browser preview.'
+  }),
+  runAppUpdate: async () => ({ ok: true }),
+  onAppUpdateProgress: () => () => {},
+  getYtdlpVersion: async () => ({ ok: true, version: '2025.06.01 (UI preview mock)' }),
+  getFfmpegVersions: async () => ({
+    ffmpeg: '7.1-full_build (UI preview mock)',
+    ffprobe: '7.1-full_build (UI preview mock)'
+  }),
+  probe: async (url: string) => {
+    await new Promise((r) => setTimeout(r, 700)) // simulate network latency
+    // A 'list'/'playlist' URL exercises the playlist selection UI in preview.
+    if (/list=|playlist/i.test(url)) {
+      return {
+        ok: true,
+        kind: 'playlist',
+        playlist: {
+          title: 'Full Electron Course — All Episodes',
+          uploader: 'DevChannel',
+          count: 5,
+          entries: Array.from({ length: 5 }, (_, i) => ({
+            index: i + 1,
+            id: `vid${i + 1}`,
+            title: `Episode ${i + 1} — ${['Setup', 'Main Process', 'IPC', 'Packaging', 'Release'][i]}`,
+            url: `https://youtube.com/watch?v=vid${i + 1}`,
+            durationLabel: `${10 + i}:0${i}`,
+            uploader: 'DevChannel'
+          }))
+        }
+      }
+    }
+    return {
+      ok: true,
+      kind: 'video',
+      info: {
+        title: 'Building a Desktop App with Electron — Full Course',
+        channel: 'DevChannel',
+        durationLabel: '1:42:08',
+        thumbnail: undefined,
+        formats: [
+          { id: '__best__', label: 'Best available', ext: 'mp4', hasAudio: true },
+          {
+            id: '299',
+            label: '1080p60 · mp4 · 248 MB',
+            height: 1080,
+            ext: 'mp4',
+            filesizeLabel: '248 MB',
+            hasAudio: false
+          },
+          {
+            id: '136',
+            label: '720p · mp4 · 124 MB',
+            height: 720,
+            ext: 'mp4',
+            filesizeLabel: '124 MB',
+            hasAudio: false
+          },
+          {
+            id: '135',
+            label: '480p · mp4 · 72 MB',
+            height: 480,
+            ext: 'mp4',
+            filesizeLabel: '72 MB',
+            hasAudio: false
+          },
+          {
+            id: '134',
+            label: '360p · mp4 · 38 MB',
+            height: 360,
+            ext: 'mp4',
+            filesizeLabel: '38 MB',
+            hasAudio: false
+          }
+        ]
+      }
+    }
+  },
+  startDownload: async () => ({ ok: true }),
+  cancelDownload: async () => {},
+  pauseDownload: async () => {},
+  chooseFolder: async () => null,
+  openPath: async () => '',
+  openUrl: async () => {},
+  showInFolder: async () => '',
+  readClipboard: async () => '',
+  logError: () => {},
+  getSettings: async () => MOCK_SETTINGS,
+  setSettings: async (partial) => Object.assign(MOCK_SETTINGS, partial),
+  listHistory: async () => [],
+  addHistory: async () => [],
+  removeHistory: async () => [],
+  removeManyHistory: async () => [],
+  clearHistory: async () => [],
+  cookiesLogin: async () => {
+    await new Promise((r) => setTimeout(r, 600)) // simulate the sign-in window
+    mockCookiesSavedAt = Date.now()
+    return { ok: true, cookieCount: 14 }
+  },
+  cookiesStatus: async () =>
+    mockCookiesSavedAt ? { exists: true, savedAt: mockCookiesSavedAt } : { exists: false },
+  cookiesClear: async () => {
+    mockCookiesSavedAt = null
+  },
+  listTemplates: async () => mockTemplates,
+  saveTemplate: async (template) => {
+    mockTemplates = [template, ...mockTemplates.filter((t) => t.id !== template.id)]
+    return mockTemplates
+  },
+  removeTemplate: async (id) => {
+    mockTemplates = mockTemplates.filter((t) => t.id !== id)
+    return mockTemplates
+  },
+  previewCommand: async (opts) => {
+    await new Promise((r) => setTimeout(r, 300)) // simulate the main-process round-trip
+    const extra = opts.extraArgs ? ` ${opts.extraArgs}` : ''
+    const dir = opts.kind === 'audio' ? MOCK_SETTINGS.audioDir : MOCK_SETTINGS.videoDir
+    return {
+      ok: true,
+      command: `yt-dlp.exe -f "bv*+ba/b" -o "${dir}\\%(title)s.%(ext)s"` + `${extra} -- ${opts.url}`
+    }
+  },
+  updateYtdlp: async (channel) => {
+    await new Promise((r) => setTimeout(r, 600)) // simulate the self-update run
+    return {
+      ok: true,
+      output: `yt-dlp is already up to date (channel: ${channel}, UI preview mock)`
+    }
+  },
+  // No background updater in the browser preview — hand back an inert unsubscribe.
+  onYtdlpAutoUpdateStatus: () => () => {},
+  listErrorLog: async () => [],
+  clearErrorLog: async () => [],
+  listQueue: async () => [],
+  saveQueue: async () => {},
+  exportBackup: async () => ({
+    ok: true,
+    path: 'C:\\Users\\you\\Downloads\\aerofetch-backup.json'
+  }),
+  importBackup: async () => ({ ok: true }),
+  onDownloadEvent: () => () => {},
+  getSystemTheme: async () => ({
+    shouldUseDarkColors: false,
+    shouldUseHighContrastColors: false
+  }),
+  onSystemThemeUpdate: () => () => {},
+  openHighContrastSettings: async () => {},
+  onExternalUrl: () => () => {},
+  // Media-manager sources — a seeded channel so the (Phase H) Library view has
+  // demo data in this browser-only preview.
+  listSources: async () => [
+    {
+      id: 'src-demo',
+      url: 'https://www.youtube.com/@DevChannel',
+      kind: 'channel',
+      title: 'DevChannel',
+      channel: 'DevChannel',
+      addedAt: Date.now() - 86_400_000,
+      lastIndexedAt: Date.now() - 3_600_000,
+      itemCount: 7
+    }
+  ],
+  indexSource: async (url) => {
+    await new Promise((r) => setTimeout(r, 800)) // simulate the index walk
+    return {
+      ok: true,
+      source: {
+        id: 'src-demo',
+        url,
+        kind: 'channel',
+        title: 'DevChannel',
+        channel: 'DevChannel',
+        addedAt: Date.now(),
+        lastIndexedAt: Date.now(),
+        itemCount: 7
+      },
+      itemCount: 7
+    }
+  },
+  reindexSource: async () => ({ ok: true, itemCount: 7, newCount: 0 }),
+  removeSource: async () => [],
+  setMediaItemDownloaded: async () => [],
+  setSourceWatched: async () => [],
+  syncWatchedSources: async () => ({ ok: true, newItems: [] }),
+  getScheduledSync: async () => ({ enabled: false }),
+  setScheduledSync: async (enabled: boolean) => ({ enabled }),
+  listSourceItems: async (sourceId) =>
+    Array.from({ length: 7 }, (_, i) => ({
+      id: `${sourceId}:vid${i + 1}`,
+      sourceId,
+      videoId: `vid${i + 1}`,
+      title: `Episode ${i + 1}`,
+      url: `https://youtube.com/watch?v=vid${i + 1}`,
+      playlistTitle: i < 5 ? 'Full Electron Course' : 'Uploads',
+      playlistIndex: i < 5 ? i + 1 : i - 4,
+      durationLabel: `${10 + i}:0${i}`,
+      downloaded: i < 2
+    })),
+  onIndexProgress: () => () => {},
+  runTerminal: async () => ({ ok: true }),
+  cancelTerminal: async () => {},
+  onTerminalOutput: () => () => {},
+  setTaskbarProgress: async () => {},
+  mintPoToken: async () => null
+}
diff --git a/src/renderer/src/qualityOptions.ts b/src/renderer/src/qualityOptions.ts
new file mode 100644
index 0000000..3cc4bb7
--- /dev/null
+++ b/src/renderer/src/qualityOptions.ts
@@ -0,0 +1,9 @@
+import { VIDEO_QUALITY_OPTIONS, AUDIO_QUALITY_OPTIONS, type MediaKind } from '@shared/ipc'
+
+// `satisfies` (not an annotation) so the tuple element types survive: under
+// noUncheckedIndexedAccess a `readonly string[]` index yields `string | undefined`,
+// but the const tuples keep `QUALITY_OPTIONS[kind][0]` known-defined (L168).
+export const QUALITY_OPTIONS = {
+  video: VIDEO_QUALITY_OPTIONS,
+  audio: AUDIO_QUALITY_OPTIONS
+} satisfies Record<MediaKind, readonly string[]>
diff --git a/src/renderer/src/reportError.ts b/src/renderer/src/reportError.ts
new file mode 100644
index 0000000..b960a4f
--- /dev/null
+++ b/src/renderer/src/reportError.ts
@@ -0,0 +1,21 @@
+// Centralized handler for fire-and-forget IPC (and similar async) calls whose
+// failure we want recorded but can't surface to the user — the optimistic store
+// update has already happened, so there's nothing to roll back or prompt about.
+// Replaces the swallowed `.catch(() => {})` sites the audit flagged (M29) with a
+// single, consistent log format. `op` names the operation, e.g. 'addHistory'.
+//
+// The failure is both printed to the renderer console (dev/`--inspect`) and
+// forwarded to the main process's file-backed diagnostic log (CC8), so it survives
+// into a packaged build where the renderer console is unreachable.
+export function logError(op: string): (e: unknown) => void {
+  return (e) => {
+    console.error(`[AeroFetch] ${op} failed:`, e)
+    try {
+      const detail = e instanceof Error ? e.message : String(e)
+      // window.api is absent in the browser UI preview and in unit tests.
+      if (typeof window !== 'undefined') window.api?.logError?.(op, detail)
+    } catch {
+      /* logging must never throw out of a catch handler */
+    }
+  }
+}
diff --git a/src/renderer/src/reveal.ts b/src/renderer/src/reveal.ts
new file mode 100644
index 0000000..55cc28e
--- /dev/null
+++ b/src/renderer/src/reveal.ts
@@ -0,0 +1,19 @@
+import { toast } from './store/toasts'
+import { logError } from './reportError'
+
+/**
+ * Open a downloaded file, or reveal it in its folder, surfacing any failure as a
+ * toast (UX6) instead of silently doing nothing. Clicking "Open file" on a
+ * download that was later moved or deleted used to no-op with no message; now the
+ * main-process reason ("File not found — it may have been moved…", "Refusing to
+ * open this file type.") is shown. Both IPC calls resolve to '' on success or an
+ * error string; a rejected promise (a bridge failure) is logged.
+ */
+export function revealFile(action: 'open' | 'folder', filePath: string): void {
+  const call = action === 'open' ? window.api.openPath(filePath) : window.api.showInFolder(filePath)
+  call
+    .then((err) => {
+      if (err) toast(err, 'error')
+    })
+    .catch(logError(action === 'open' ? 'openPath' : 'showInFolder'))
+}
diff --git a/src/renderer/src/store/coordinator.ts b/src/renderer/src/store/coordinator.ts
new file mode 100644
index 0000000..429db20
--- /dev/null
+++ b/src/renderer/src/store/coordinator.ts
@@ -0,0 +1,51 @@
+import type { AddEntry } from './downloads'
+
+/**
+ * A tiny typed event bus that owns the cross-store reactions between the
+ * downloads and sources stores (C2). Previously `downloads.ts` imported
+ * `useSources` and `sources.ts` imported `useDownloads`, a circular dependency
+ * that only worked because both sides reached across lazily via `.getState()`.
+ *
+ * Now each store depends on this bus instead of on the other: a store *emits* the
+ * events it produces and *subscribes* to the ones it consumes. The bus itself has
+ * no runtime dependency on either store (the `AddEntry` import is type-only and is
+ * erased at build time), so there is no import cycle.
+ *
+ *   sources  --enqueueDownloads-->  downloads   (queue a channel's media items)
+ *   downloads --downloadCompleted--> sources    (mark the source item downloaded)
+ *   sources  --sourceRemoved------>  downloads   (cancel that source's in-flight downloads)
+ */
+export interface StoreEvents {
+  /** sources → downloads: enqueue a batch of media items as downloads */
+  enqueueDownloads: AddEntry[]
+  /** downloads → sources: a download tied to a source MediaItem finished */
+  downloadCompleted: { mediaItemId: string; filePath?: string }
+  /** sources → downloads: a source was removed; cancel its in-flight downloads (L157) */
+  sourceRemoved: string
+}
+
+type Handler<K extends keyof StoreEvents> = (payload: StoreEvents[K]) => void
+
+// Heterogeneous handler sets keyed by event name. The `never` payload is the
+// standard trick for a per-key event map; the public on/emit signatures keep the
+// payload types sound at every call site.
+const handlers = new Map<keyof StoreEvents, Set<(payload: never) => void>>()
+
+/** Subscribe to a store event. Returns an unsubscribe function. */
+export function on<K extends keyof StoreEvents>(event: K, handler: Handler<K>): () => void {
+  let set = handlers.get(event)
+  if (!set) {
+    set = new Set()
+    handlers.set(event, set)
+  }
+  const erased = handler as (payload: never) => void
+  set.add(erased)
+  return () => set.delete(erased)
+}
+
+/** Dispatch a store event to all current subscribers. */
+export function emit<K extends keyof StoreEvents>(event: K, payload: StoreEvents[K]): void {
+  const set = handlers.get(event)
+  if (!set) return
+  for (const handler of set) (handler as Handler<K>)(payload)
+}
diff --git a/src/renderer/src/store/downloadItem.ts b/src/renderer/src/store/downloadItem.ts
new file mode 100644
index 0000000..878560e
--- /dev/null
+++ b/src/renderer/src/store/downloadItem.ts
@@ -0,0 +1,64 @@
+import { type DownloadMeta, type MediaKind } from '@shared/ipc'
+import { newId } from '../id'
+import { youtubeId } from '../lib/urlHelpers'
+import { type AddOptions, type DownloadItem } from './downloadTypes'
+
+// Placeholder channel shown while metadata is still being fetched. Tracked as a
+// constant so the meta/error/done handlers can recognise and clear it instead of
+// letting it stick forever when a probe returns no channel (SR6).
+export const RESOLVING = 'Resolving…'
+
+/**
+ * Build a fresh queued DownloadItem from a URL + options. Pure (no store access)
+ * so addFromUrl and addMany share it. If the caller already probed the URL, its
+ * metadata is carried as probedMeta so main can skip a redundant probe (audit P2).
+ */
+export function buildItem(
+  url: string,
+  kind: MediaKind,
+  quality: string,
+  opts?: AddOptions
+): DownloadItem {
+  const probedMeta: DownloadMeta | undefined =
+    opts?.title || opts?.channel || opts?.durationLabel
+      ? { title: opts?.title, channel: opts?.channel, durationLabel: opts?.durationLabel }
+      : undefined
+  // A future scheduled time parks the item as 'saved' until its moment arrives;
+  // a past/absent time starts it queued as usual.
+  const scheduledFor =
+    opts?.scheduledFor && opts.scheduledFor > Date.now() ? opts.scheduledFor : undefined
+  return {
+    id: newId('item'),
+    url,
+    title: opts?.title ?? titleFromUrl(url),
+    channel: opts?.channel ?? RESOLVING,
+    durationLabel: opts?.durationLabel,
+    thumbnail: opts?.thumbnail,
+    kind,
+    quality,
+    status: scheduledFor ? 'saved' : 'queued',
+    progress: 0,
+    formatId: opts?.format?.id,
+    formatHasAudio: opts?.format?.hasAudio,
+    options: opts?.options,
+    extraArgs: opts?.extraArgs,
+    trim: opts?.trim,
+    scheduledFor,
+    incognito: opts?.incognito,
+    collection: opts?.collection,
+    mediaItemId: opts?.mediaItemId,
+    probedMeta
+  }
+}
+
+export function titleFromUrl(url: string): string {
+  const id = youtubeId(url)
+  if (id) return `YouTube video (${id})`
+  try {
+    const host = new URL(url).hostname
+    if (host) return `${host} download`
+  } catch {
+    /* not a URL */
+  }
+  return 'New download'
+}
diff --git a/src/renderer/src/store/downloadSeed.ts b/src/renderer/src/store/downloadSeed.ts
new file mode 100644
index 0000000..007ff74
--- /dev/null
+++ b/src/renderer/src/store/downloadSeed.ts
@@ -0,0 +1,62 @@
+import { isPreview as PREVIEW } from '../isPreview'
+import { newId } from '../id'
+import { type DownloadItem } from './downloadTypes'
+
+// Mock seed data so every visual state is visible in the UI preview. Empty in a
+// real run -- the queue starts blank. Gated on `import.meta.env.DEV` as well as the
+// runtime PREVIEW flag so Rollup dead-code-eliminates this whole array from the
+// packaged (production) renderer build, where DEV is statically false (L128).
+export const seed: DownloadItem[] =
+  import.meta.env.DEV && PREVIEW
+    ? [
+        {
+          id: newId('item'),
+          url: 'https://youtube.com/watch?v=dQw4w9WgXcQ',
+          title: 'Building a Desktop App with Electron -- Full Course',
+          channel: 'DevChannel',
+          durationLabel: '1:42:08',
+          kind: 'video',
+          quality: '1080p',
+          status: 'downloading',
+          progress: 0.42,
+          speedBytesPerSec: 4.7 * 1024 * 1024,
+          etaSeconds: 72,
+          sizeLabel: '512 MB'
+        },
+        {
+          id: newId('item'),
+          url: 'https://youtube.com/watch?v=abcd1234',
+          title: 'Lo-fi beats to code to (1 hour mix)',
+          channel: 'ChillStudio',
+          durationLabel: '1:00:21',
+          kind: 'audio',
+          quality: 'Best',
+          status: 'queued',
+          progress: 0
+        },
+        {
+          id: newId('item'),
+          url: 'https://youtube.com/watch?v=zzz9999',
+          title: 'How yt-dlp Works Under the Hood',
+          channel: 'Open Source Weekly',
+          durationLabel: '14:03',
+          kind: 'video',
+          quality: '720p',
+          status: 'completed',
+          progress: 1,
+          sizeLabel: '184 MB',
+          filePath: 'C:\\Users\\you\\Downloads\\How yt-dlp Works Under the Hood.mp4'
+        },
+        {
+          id: newId('item'),
+          url: 'https://youtube.com/watch?v=err0r',
+          title: 'Private video',
+          channel: undefined,
+          kind: 'video',
+          quality: 'Best available',
+          status: 'error',
+          progress: 0,
+          error: 'Video unavailable: this video is private.'
+        }
+      ]
+    : []
diff --git a/src/renderer/src/store/downloadTypes.ts b/src/renderer/src/store/downloadTypes.ts
new file mode 100644
index 0000000..1598e04
--- /dev/null
+++ b/src/renderer/src/store/downloadTypes.ts
@@ -0,0 +1,131 @@
+import {
+  type DownloadEvent,
+  type DownloadMeta,
+  type DownloadOptions,
+  type CollectionContext,
+  type MediaKind
+} from '@shared/ipc'
+
+// Single-sourced from the IPC contract (L105) and re-exported so existing
+// `import { MediaKind } from '../store/downloads'` sites keep working.
+export type { MediaKind }
+
+export type DownloadStatus =
+  'queued' | 'downloading' | 'paused' | 'saved' | 'completed' | 'error' | 'canceled'
+
+/** An exact probed format chosen for a download (omitted for the preset path). */
+export interface ChosenFormat {
+  id: string
+  hasAudio: boolean
+  label: string
+}
+
+export interface DownloadItem {
+  id: string
+  url: string
+  title: string
+  channel?: string
+  durationLabel?: string
+  thumbnail?: string
+  kind: MediaKind
+  quality: string
+  status: DownloadStatus
+  /** 0..1 */
+  progress: number
+  /** raw transfer rate in bytes/sec (formatted for display via @shared/format) */
+  speedBytesPerSec?: number
+  /** raw time remaining in seconds (formatted for display via @shared/format) */
+  etaSeconds?: number
+  sizeLabel?: string
+  /** yt-dlp reported no total size -- render the bar indeterminate, not 0% (L137) */
+  sizeUnknown?: boolean
+  /** true once the main download stream finished and yt-dlp is fetching the
+   *  remaining stream / merging / post-processing -- the bar goes indeterminate
+   *  instead of visibly restarting 0→100% for the second stream (SR7) */
+  finishing?: boolean
+  filePath?: string
+  error?: string
+  /** exact format carried so retry re-downloads the same thing */
+  formatId?: string
+  formatHasAudio?: boolean
+  /** per-download post-processing override (omitted = use persisted defaults) */
+  options?: DownloadOptions
+  /** per-download custom-command override (omitted = use the persisted default template) */
+  extraArgs?: string
+  /** raw trim spec -- time ranges to keep (parsed to --download-sections in main) */
+  trim?: string
+  /** epoch ms to auto-start a 'saved' item; undefined = parked indefinitely (Phase M) */
+  scheduledFor?: number
+  /** private download -- completion is never recorded to history */
+  incognito?: boolean
+  /** metadata already fetched at probe time; forwarded to main so it skips a redundant probe */
+  probedMeta?: DownloadMeta
+  /** media-manager folder context -- files this into <channel>/<playlist>/<NNN> - <title> */
+  collection?: CollectionContext
+  /** when set, the source MediaItem id this download came from -- marked downloaded on completion */
+  mediaItemId?: string
+}
+
+/** Options accepted when enqueuing a URL (shared by addFromUrl + addMany). */
+export interface AddOptions {
+  format?: ChosenFormat
+  title?: string
+  channel?: string
+  durationLabel?: string
+  thumbnail?: string
+  options?: DownloadOptions
+  extraArgs?: string
+  trim?: string
+  /** when set and in the future, the item starts 'saved' and auto-queues at this time */
+  scheduledFor?: number
+  incognito?: boolean
+  collection?: CollectionContext
+  mediaItemId?: string
+}
+
+/** One URL to enqueue in a single addMany batch. */
+export interface AddEntry {
+  url: string
+  kind: MediaKind
+  quality: string
+  opts?: AddOptions
+}
+
+export interface DownloadState {
+  items: DownloadItem[]
+  addFromUrl: (url: string, kind: MediaKind, quality: string, opts?: AddOptions) => void
+  /**
+   * Enqueue many URLs at once with a single state update and a single pump, so
+   * queuing an entire channel (1000s of items) doesn't churn the store O(n²) the
+   * way looping addFromUrl would.
+   */
+  addMany: (entries: AddEntry[]) => void
+  retry: (id: string) => void
+  /** re-queue every failed item at once (Phase M) */
+  retryAll: () => void
+  /** stop a running download but keep its partial file for a later resume (Phase M) */
+  pause: (id: string) => void
+  /** re-queue a paused download; yt-dlp continues its partial file on relaunch */
+  resume: (id: string) => void
+  /** move a queued item to the front of the promotion order ("download next", Phase M) */
+  prioritize: (id: string) => void
+  /** park a queued item indefinitely as 'saved' (Phase M) */
+  saveForLater: (id: string) => void
+  /** un-park a 'saved' item back into the queue now (clears any schedule) */
+  queueNow: (id: string) => void
+  /** internal: promote any 'saved' item whose scheduledFor time has arrived */
+  promoteDueScheduled: () => void
+  cancel: (id: string) => void
+  /** cancel every active (downloading + queued) item at once (UX15) */
+  cancelAll: () => void
+  remove: (id: string) => void
+  clearFinished: () => void
+  openFile: (id: string) => void
+  showInFolder: (id: string) => void
+  /** promote queued items into free download slots (respects MAX_CONCURRENT) */
+  pump: () => void
+  /** internal: apply a main-process download event */
+  applyEvent: (ev: DownloadEvent) => void
+  /** Load the persisted queue from main on launch (M4); no-op in preview. */
+  hydrate: () => void
+}
diff --git a/src/renderer/src/store/downloads.ts b/src/renderer/src/store/downloads.ts
index de168d4..c2ea243 100644
--- a/src/renderer/src/store/downloads.ts
+++ b/src/renderer/src/store/downloads.ts
@@ -1,252 +1,63 @@
 import { create } from 'zustand'
-import type { DownloadEvent, DownloadMeta, DownloadOptions, CollectionContext } from '@shared/ipc'
+import { type MediaKind } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
+import { logError } from '../reportError'
+import { revealFile } from '../reveal'
 import { useSettings } from './settings'
 import { useHistory } from './history'
-import { useSources } from './sources'
+import { emit, on } from './coordinator'
+import { RESOLVING, buildItem } from './downloadItem'
+import { fromPersisted, persistableItems } from './queuePersist'
+import { seed } from './downloadSeed'
+import {
+  type ChosenFormat,
+  type DownloadItem,
+  type DownloadStatus,
+  type AddOptions,
+  type AddEntry,
+  type DownloadState
+} from './downloadTypes'
 
-export type MediaKind = 'video' | 'audio'
+// Re-export the store's public types from their canonical home so existing
+// `import { … } from '../store/downloads'` sites keep working.
+export type { MediaKind, ChosenFormat, DownloadItem, DownloadStatus, AddOptions, AddEntry }
 
-export type DownloadStatus =
-  | 'queued'
-  | 'downloading'
-  | 'paused'
-  | 'saved'
-  | 'completed'
-  | 'error'
-  | 'canceled'
+// M4: gate the persist subscription until the initial hydrate has read the saved
+// queue, so a launch-time store mutation can't overwrite queue.json with [] before
+// we've loaded it back.
+let queueHydrated = false
 
-/** An exact probed format chosen for a download (omitted for the preset path). */
-export interface ChosenFormat {
-  id: string
-  hasAudio: boolean
-  label: string
-}
-
-export interface DownloadItem {
-  id: string
-  url: string
-  title: string
-  channel?: string
-  durationLabel?: string
-  thumbnail?: string
-  kind: MediaKind
-  quality: string
-  status: DownloadStatus
-  /** 0..1 */
-  progress: number
-  speed?: string
-  eta?: string
-  sizeLabel?: string
-  filePath?: string
-  error?: string
-  /** exact format carried so retry re-downloads the same thing */
-  formatId?: string
-  formatHasAudio?: boolean
-  /** per-download post-processing override (omitted = use persisted defaults) */
-  options?: DownloadOptions
-  /** per-download custom-command override (omitted = use the persisted default template) */
-  extraArgs?: string
-  /** raw trim spec — time ranges to keep (parsed to --download-sections in main) */
-  trim?: string
-  /** epoch ms to auto-start a 'saved' item; undefined = parked indefinitely (Phase M) */
-  scheduledFor?: number
-  /** private download — completion is never recorded to history */
-  incognito?: boolean
-  /** metadata already fetched at probe time; forwarded to main so it skips a redundant probe */
-  probedMeta?: DownloadMeta
-  /** media-manager folder context — files this into <channel>/<playlist>/<NNN> - <title> */
-  collection?: CollectionContext
-  /** when set, the source MediaItem id this download came from — marked downloaded on completion */
-  mediaItemId?: string
-}
-
-export const QUALITY_OPTIONS: Record<MediaKind, string[]> = {
-  video: ['Best available', '1080p', '720p', '480p', '360p'],
-  audio: ['Best (MP3)', '320 kbps', '192 kbps', '128 kbps']
-}
-
-/** Options accepted when enqueuing a URL (shared by addFromUrl + addMany). */
-export interface AddOptions {
-  format?: ChosenFormat
-  title?: string
-  channel?: string
-  durationLabel?: string
-  thumbnail?: string
-  options?: DownloadOptions
-  extraArgs?: string
-  trim?: string
-  /** when set and in the future, the item starts 'saved' and auto-queues at this time */
-  scheduledFor?: number
-  incognito?: boolean
-  collection?: CollectionContext
-  mediaItemId?: string
-}
-
-/** One URL to enqueue in a single addMany batch. */
-export interface AddEntry {
-  url: string
-  kind: MediaKind
-  quality: string
-  opts?: AddOptions
-}
-
-// True when running in the standalone browser preview (no Electron preload).
-// The real preload injects window.electron; the browser stub does not.
-const PREVIEW = typeof window === 'undefined' || !window.electron
-
-interface DownloadState {
-  items: DownloadItem[]
-  addFromUrl: (url: string, kind: MediaKind, quality: string, opts?: AddOptions) => void
-  /**
-   * Enqueue many URLs at once with a single state update and a single pump, so
-   * queuing an entire channel (1000s of items) doesn't churn the store O(n²) the
-   * way looping addFromUrl would.
-   */
-  addMany: (entries: AddEntry[]) => void
-  retry: (id: string) => void
-  /** re-queue every failed item at once (Phase M) */
-  retryAll: () => void
-  /** stop a running download but keep its partial file for a later resume (Phase M) */
-  pause: (id: string) => void
-  /** re-queue a paused download; yt-dlp continues its partial file on relaunch */
-  resume: (id: string) => void
-  /** move a queued item to the front of the promotion order ("download next", Phase M) */
-  prioritize: (id: string) => void
-  /** park a queued item indefinitely as 'saved' (Phase M) */
-  saveForLater: (id: string) => void
-  /** un-park a 'saved' item back into the queue now (clears any schedule) */
-  queueNow: (id: string) => void
-  /** internal: promote any 'saved' item whose scheduledFor time has arrived */
-  promoteDueScheduled: () => void
-  cancel: (id: string) => void
-  remove: (id: string) => void
-  clearFinished: () => void
-  openFile: (id: string) => void
-  showInFolder: (id: string) => void
-  /** promote queued items into free download slots (respects MAX_CONCURRENT) */
-  pump: () => void
-  /** internal: apply a main-process download event */
-  applyEvent: (ev: DownloadEvent) => void
-}
-
-let idCounter = 0
-function newId(): string {
-  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID()
-  return `item-${++idCounter}`
-}
-
-/**
- * Build a fresh queued DownloadItem from a URL + options. Pure (no store access)
- * so addFromUrl and addMany share it. If the caller already probed the URL, its
- * metadata is carried as probedMeta so main can skip a redundant probe (audit P2).
- */
-function buildItem(url: string, kind: MediaKind, quality: string, opts?: AddOptions): DownloadItem {
-  const probedMeta: DownloadMeta | undefined =
-    opts?.title || opts?.channel || opts?.durationLabel
-      ? { title: opts?.title, channel: opts?.channel, durationLabel: opts?.durationLabel }
-      : undefined
-  // A future scheduled time parks the item as 'saved' until its moment arrives;
-  // a past/absent time starts it queued as usual.
-  const scheduledFor =
-    opts?.scheduledFor && opts.scheduledFor > Date.now() ? opts.scheduledFor : undefined
-  return {
-    id: newId(),
-    url,
-    title: opts?.title ?? titleFromUrl(url),
-    channel: opts?.channel ?? 'Resolving…',
-    durationLabel: opts?.durationLabel,
-    thumbnail: opts?.thumbnail,
-    kind,
-    quality,
-    status: scheduledFor ? 'saved' : 'queued',
-    progress: 0,
-    formatId: opts?.format?.id,
-    formatHasAudio: opts?.format?.hasAudio,
-    options: opts?.options,
-    extraArgs: opts?.extraArgs,
-    trim: opts?.trim,
-    scheduledFor,
-    incognito: opts?.incognito,
-    collection: opts?.collection,
-    mediaItemId: opts?.mediaItemId,
-    probedMeta
+// Side-effects to run exactly once when a download completes: record it to
+// history (unless private) and mark its source MediaItem downloaded. Shared by
+// the real `applyEvent('done')` path and the preview ticker so the two can't
+// drift (M3).
+function recordCompletion(item: DownloadItem): void {
+  if (!item.incognito) {
+    useHistory.getState().add({
+      id: item.id,
+      title: item.title,
+      channel: item.channel,
+      url: item.url,
+      kind: item.kind,
+      quality: item.quality,
+      formatId: item.formatId,
+      formatHasAudio: item.formatHasAudio,
+      filePath: item.filePath,
+      sizeLabel: item.sizeLabel,
+      thumbnail: item.thumbnail,
+      // Carry the post-processing options so a re-download reproduces the same
+      // output rather than the current global defaults (L87).
+      options: item.options,
+      completedAt: Date.now()
+    })
+  }
+  if (item.mediaItemId) {
+    // Tell the sources store to mark its MediaItem downloaded — via the event bus
+    // rather than a direct import, so downloads and sources don't form a cycle (C2).
+    emit('downloadCompleted', { mediaItemId: item.mediaItemId, filePath: item.filePath })
   }
 }
 
-function titleFromUrl(url: string): string {
-  try {
-    const u = new URL(url)
-    const v = u.searchParams.get('v')
-    if (v) return `YouTube video (${v})`
-    if (u.hostname) return `${u.hostname} download`
-  } catch {
-    /* not a URL */
-  }
-  return 'New download'
-}
-
-function fmtEta(seconds: number): string {
-  const s = Math.max(0, Math.round(seconds))
-  const m = Math.floor(s / 60)
-  const r = s % 60
-  return `${m}:${String(r).padStart(2, '0')}`
-}
-
-// --- Mock seed data so every visual state is visible in the UI preview ------
-const seed: DownloadItem[] = PREVIEW
-  ? [
-      {
-        id: newId(),
-        url: 'https://youtube.com/watch?v=dQw4w9WgXcQ',
-        title: 'Building a Desktop App with Electron — Full Course',
-        channel: 'DevChannel',
-        durationLabel: '1:42:08',
-        kind: 'video',
-        quality: '1080p',
-        status: 'downloading',
-        progress: 0.42,
-        speed: '4.7 MB/s',
-        eta: '1:12',
-        sizeLabel: '512 MB'
-      },
-      {
-        id: newId(),
-        url: 'https://youtube.com/watch?v=abcd1234',
-        title: 'Lo-fi beats to code to (1 hour mix)',
-        channel: 'ChillStudio',
-        durationLabel: '1:00:21',
-        kind: 'audio',
-        quality: 'Best (MP3)',
-        status: 'queued',
-        progress: 0
-      },
-      {
-        id: newId(),
-        url: 'https://youtube.com/watch?v=zzz9999',
-        title: 'How yt-dlp Works Under the Hood',
-        channel: 'Open Source Weekly',
-        durationLabel: '14:03',
-        kind: 'video',
-        quality: '720p',
-        status: 'completed',
-        progress: 1,
-        sizeLabel: '184 MB',
-        filePath: 'C:\\Users\\you\\Downloads\\How yt-dlp Works Under the Hood.mp4'
-      },
-      {
-        id: newId(),
-        url: 'https://youtube.com/watch?v=err0r',
-        title: 'Private video',
-        channel: undefined,
-        kind: 'video',
-        quality: 'Best available',
-        status: 'error',
-        progress: 0,
-        error: 'Video unavailable: this video is private.'
-      }
-    ]
-  : []
-
 // UI-preview only: animate fake progress so the queue feels alive without yt-dlp.
 function startFakeTicker(
   id: string,
@@ -270,8 +81,8 @@ function startFakeTicker(
               channel: 'Sample Channel',
               durationLabel: '12:34',
               sizeLabel: '96.4 MB',
-              speed: done ? undefined : `${(2 + Math.random() * 5).toFixed(1)} MB/s`,
-              eta: done ? undefined : fmtEta((1 - next) * 90),
+              speedBytesPerSec: done ? undefined : (2 + Math.random() * 5) * 1024 * 1024,
+              etaSeconds: done ? undefined : (1 - next) * 90,
               status: done ? 'completed' : 'downloading',
               filePath: done ? `C:\\Users\\you\\Downloads\\${cur.title}.mp4` : undefined
             }
@@ -281,26 +92,8 @@ function startFakeTicker(
     if (done) {
       clearInterval(timer)
       const finished = get().items.find((i) => i.id === id)
-      if (finished && !finished.incognito) {
-        useHistory.getState().add({
-          id: finished.id,
-          title: finished.title,
-          channel: finished.channel,
-          url: finished.url,
-          kind: finished.kind,
-          quality: finished.quality,
-          filePath: finished.filePath,
-          sizeLabel: finished.sizeLabel,
-          thumbnail: finished.thumbnail,
-          completedAt: Date.now()
-        })
-      }
-      // Mirror the real applyEvent path so collection completions mark their
-      // source item downloaded in the preview too.
-      if (finished?.mediaItemId) {
-        useSources.getState().markDownloaded(finished.mediaItemId, finished.filePath)
-      }
-      get().pump() // a slot just freed — promote the next queued item
+      if (finished) recordCompletion(finished)
+      get().pump() // a slot just freed -- promote the next queued item
     }
   }, 650)
 }
@@ -332,6 +125,9 @@ export const useDownloads = create<DownloadState>((set, get) => {
         options: item.options,
         extraArgs: item.extraArgs,
         trim: item.trim,
+        // Carry the private flag to main so it also skips errorlog, notification
+        // detail, and cookies — not just the renderer's history skip (L136).
+        incognito: item.incognito,
         meta: item.probedMeta,
         collection: item.collection
       })
@@ -344,9 +140,9 @@ export const useDownloads = create<DownloadState>((set, get) => {
   // Promote queued items (oldest first) into free slots, then launch them.
   //
   // Note: this only gates *future* promotions. Lowering maxConcurrent while N
-  // downloads are already active does NOT pause the overflow — the running
+  // downloads are already active does NOT pause the overflow -- the running
   // processes finish on their own, and the lower cap takes effect only as slots
-  // free up. (audit P3 — documented behaviour, not a bug.)
+  // free up. (audit P3 -- documented behaviour, not a bug.)
   function pump(): void {
     const items = get().items
     const running = items.filter((i) => i.status === 'downloading').length
@@ -369,6 +165,29 @@ export const useDownloads = create<DownloadState>((set, get) => {
     items: seed,
     pump,
 
+    hydrate: () => {
+      if (PREVIEW) return
+      window.api
+        .listQueue()
+        .then((persisted) => {
+          if (persisted.length === 0) return
+          // Merge ahead of anything already present (normally nothing at launch),
+          // de-duping by id so a double-hydrate can't double-insert.
+          set((s) => {
+            const have = new Set(s.items.map((i) => i.id))
+            const add = persisted.filter((p) => !have.has(p.id)).map(fromPersisted)
+            return add.length ? { items: [...s.items, ...add] } : {}
+          })
+          pump()
+        })
+        .catch(logError('listQueue'))
+        .finally(() => {
+          // Enable persistence once the read has completed (success or failure), so
+          // subsequent queue changes are saved but the pre-hydrate window can't wipe.
+          queueHydrated = true
+        })
+    },
+
     addFromUrl: (url, kind, quality, opts) => {
       set((s) => ({ items: [buildItem(url, kind, quality, opts), ...s.items] }))
       pump()
@@ -376,7 +195,11 @@ export const useDownloads = create<DownloadState>((set, get) => {
 
     addMany: (entries) => {
       if (entries.length === 0) return
-      const built = entries.map((e) => buildItem(e.url, e.kind, e.quality, e.opts))
+      // The queue is a newest-first array and pump() promotes the highest-index
+      // (oldest) queued item first, so a batch must be stored last-entry-first for
+      // the playlist/channel to download 1→N instead of N→1 (M32). Entry 1 then
+      // sits at the bottom of the list -- the same way repeated single adds stack.
+      const built = entries.map((e) => buildItem(e.url, e.kind, e.quality, e.opts)).reverse()
       set((s) => ({ items: [...built, ...s.items] }))
       pump()
     },
@@ -385,7 +208,14 @@ export const useDownloads = create<DownloadState>((set, get) => {
       set((s) => ({
         items: s.items.map((i) =>
           i.id === id
-            ? { ...i, status: 'queued', progress: 0, error: undefined, speed: undefined, eta: undefined }
+            ? {
+                ...i,
+                status: 'queued',
+                progress: 0,
+                error: undefined,
+                speedBytesPerSec: undefined,
+                etaSeconds: undefined
+              }
             : i
         )
       }))
@@ -396,7 +226,14 @@ export const useDownloads = create<DownloadState>((set, get) => {
       set((s) => ({
         items: s.items.map((i) =>
           i.status === 'error'
-            ? { ...i, status: 'queued', progress: 0, error: undefined, speed: undefined, eta: undefined }
+            ? {
+                ...i,
+                status: 'queued',
+                progress: 0,
+                error: undefined,
+                speedBytesPerSec: undefined,
+                etaSeconds: undefined
+              }
             : i
         )
       }))
@@ -412,7 +249,7 @@ export const useDownloads = create<DownloadState>((set, get) => {
       set((s) => ({
         items: s.items.map((i) =>
           i.id === id && (i.status === 'downloading' || i.status === 'queued')
-            ? { ...i, status: 'paused', speed: undefined, eta: undefined }
+            ? { ...i, status: 'paused', speedBytesPerSec: undefined, etaSeconds: undefined }
             : i
         )
       }))
@@ -431,15 +268,16 @@ export const useDownloads = create<DownloadState>((set, get) => {
     },
 
     prioritize: (id) => {
-      // Reposition the item so pump() — which promotes the highest-index queued
-      // item first (oldest-first over a newest-first array) — picks it next.
+      // Reposition the item so pump() -- which promotes the highest-index queued
+      // item first (oldest-first over a newest-first array) -- picks it next.
       set((s) => {
         const idx = s.items.findIndex((i) => i.id === id)
-        if (idx < 0 || s.items[idx].status !== 'queued') return {}
+        if (idx < 0 || s.items[idx]?.status !== 'queued') return {}
         const items = s.items.slice()
         const [it] = items.splice(idx, 1)
+        if (!it) return {}
         let after = -1
-        for (let k = 0; k < items.length; k++) if (items[k].status === 'queued') after = k
+        for (let k = 0; k < items.length; k++) if (items[k]?.status === 'queued') after = k
         items.splice(after + 1, 0, it)
         return { items }
       })
@@ -468,6 +306,10 @@ export const useDownloads = create<DownloadState>((set, get) => {
     },
 
     promoteDueScheduled: () => {
+      // Wall-clock comparison: each scheduled item fires once (the promotion flips it
+      // out of 'saved'), so a backward clock jump only delays it and can't double-fire;
+      // a forward jump can fire it early. Accepted as minor per R9 — a monotonic
+      // scheduler would be overkill for a park-until-time feature.
       const now = Date.now()
       set((s) => ({
         items: s.items.map((i) =>
@@ -487,7 +329,26 @@ export const useDownloads = create<DownloadState>((set, get) => {
       set((s) => ({
         items: s.items.map((i) =>
           i.id === id && (i.status === 'downloading' || i.status === 'queued')
-            ? { ...i, status: 'canceled', speed: undefined, eta: undefined }
+            ? { ...i, status: 'canceled', speedBytesPerSec: undefined, etaSeconds: undefined }
+            : i
+        )
+      }))
+      pump()
+    },
+
+    cancelAll: () => {
+      const active = get().items.filter((i) => i.status === 'downloading' || i.status === 'queued')
+      if (active.length === 0) return
+      // Kill the live processes for the running ones; queued items never started.
+      if (!PREVIEW) {
+        for (const i of active) {
+          if (i.status === 'downloading') window.api.cancelDownload(i.id).catch(() => {})
+        }
+      }
+      set((s) => ({
+        items: s.items.map((i) =>
+          i.status === 'downloading' || i.status === 'queued'
+            ? { ...i, status: 'canceled', speedBytesPerSec: undefined, etaSeconds: undefined }
             : i
         )
       }))
@@ -512,12 +373,12 @@ export const useDownloads = create<DownloadState>((set, get) => {
 
     openFile: (id) => {
       const item = get().items.find((i) => i.id === id)
-      if (!PREVIEW && item?.filePath) window.api.openPath(item.filePath)
+      if (!PREVIEW && item?.filePath) revealFile('open', item.filePath)
     },
 
     showInFolder: (id) => {
       const item = get().items.find((i) => i.id === id)
-      if (!PREVIEW && item?.filePath) window.api.showInFolder(item.filePath)
+      if (!PREVIEW && item?.filePath) revealFile('folder', item.filePath)
     },
 
     applyEvent: (ev) => {
@@ -526,21 +387,35 @@ export const useDownloads = create<DownloadState>((set, get) => {
           if (i.id !== ev.id) return i
           switch (ev.type) {
             case 'meta':
+              // A late meta event can arrive between cancel() and the child's
+              // close -- don't overwrite a canceled item's fields (B5; mirrors the
+              // canceled guard on the done/error cases below).
+              if (i.status === 'canceled') return i
               return {
                 ...i,
                 title: ev.meta.title ?? i.title,
-                channel: ev.meta.channel ?? i.channel,
+                // Clear the 'Resolving…' placeholder even when the probe returns
+                // no channel, so it can't stick forever (SR6); a real channel is
+                // always preserved.
+                channel: ev.meta.channel ?? (i.channel === RESOLVING ? undefined : i.channel),
                 durationLabel: ev.meta.durationLabel ?? i.durationLabel
               }
             case 'progress':
-              // Ignore late events once the item has left the active state.
-              if (i.status !== 'downloading' && i.status !== 'queued') return i
+              // Only a launched (downloading) item should take progress. Never
+              // promote a 'queued' item here -- pump() owns the queued→downloading
+              // transition and the concurrency cap (L88); a stray progress event
+              // for a non-downloading item is ignored.
+              if (i.status !== 'downloading') return i
               return {
                 ...i,
                 status: 'downloading',
                 progress: ev.progress.progress,
-                speed: ev.progress.speed,
-                eta: ev.progress.eta,
+                // Main owns the latch and resends it on every tick, so reflecting
+                // it directly resets cleanly on a retry's fresh spawn (SR7).
+                finishing: ev.progress.finishing,
+                speedBytesPerSec: ev.progress.speedBytesPerSec,
+                etaSeconds: ev.progress.etaSeconds,
+                sizeUnknown: ev.progress.sizeUnknown,
                 sizeLabel: ev.progress.sizeLabel ?? i.sizeLabel
               }
             case 'done':
@@ -549,63 +424,89 @@ export const useDownloads = create<DownloadState>((set, get) => {
                 ...i,
                 status: 'completed',
                 progress: 1,
-                speed: undefined,
-                eta: undefined,
+                finishing: false,
+                speedBytesPerSec: undefined,
+                etaSeconds: undefined,
+                channel: i.channel === RESOLVING ? undefined : i.channel,
                 filePath: ev.filePath ?? i.filePath
               }
             case 'error':
               if (i.status === 'canceled') return i
-              return { ...i, status: 'error', speed: undefined, eta: undefined, error: ev.error }
+              return {
+                ...i,
+                status: 'error',
+                finishing: false,
+                speedBytesPerSec: undefined,
+                etaSeconds: undefined,
+                channel: i.channel === RESOLVING ? undefined : i.channel,
+                error: ev.error
+              }
             default:
               return i
           }
         })
       }))
-      // Record completed downloads to history (unless this was a private download).
+      // Record completion (history + source markDownloaded) via the shared helper.
       if (ev.type === 'done') {
         const item = get().items.find((i) => i.id === ev.id)
-        if (item && item.status === 'completed' && !item.incognito) {
-          useHistory.getState().add({
-            id: item.id,
-            title: item.title,
-            channel: item.channel,
-            url: item.url,
-            kind: item.kind,
-            quality: item.quality,
-            filePath: item.filePath,
-            sizeLabel: item.sizeLabel,
-            thumbnail: item.thumbnail,
-            completedAt: Date.now()
-          })
-        }
-        // Persist media-manager completion so an incremental re-sync skips it.
-        if (item?.mediaItemId) {
-          useSources.getState().markDownloaded(item.mediaItemId, item.filePath)
-        }
+        if (item && item.status === 'completed') recordCompletion(item)
       }
-      // A finished item frees a slot — promote whatever is queued next.
+      // A finished item frees a slot -- promote whatever is queued next.
       if (ev.type === 'done' || ev.type === 'error') pump()
     }
   }
 })
 
-// Promote scheduled ('saved' + a due scheduledFor) items when their time arrives.
-// Session-only: the queue isn't persisted, so a schedule only fires while the app
-// runs (noted in ROADMAP.md). A 15s tick is plenty for minute-granularity times.
-setInterval(() => {
+// Consume the sources store's enqueue requests (C2): when the user downloads a
+// channel's media items, sources emits the batch on the bus and we add it here —
+// no direct import from sources, so the two stores stay acyclic.
+on('enqueueDownloads', (entries) => useDownloads.getState().addMany(entries))
+
+// A removed source cancels its in-flight downloads (L157): MediaItem ids are
+// `${sourceId}:${videoId}` (indexerCore), so a download's mediaItemId prefix
+// identifies its source. Only active (downloading/queued) items are canceled;
+// finished/failed ones are left alone. cancel() owns the process kill + pump.
+on('sourceRemoved', (sourceId) => {
   const st = useDownloads.getState()
-  const now = Date.now()
-  if (st.items.some((i) => i.status === 'saved' && i.scheduledFor != null && i.scheduledFor <= now)) {
-    st.promoteDueScheduled()
+  const prefix = `${sourceId}:`
+  for (const it of st.items) {
+    if (
+      (it.status === 'downloading' || it.status === 'queued') &&
+      it.mediaItemId?.startsWith(prefix)
+    ) {
+      st.cancel(it.id)
+    }
   }
-}, 15_000)
+})
+
+// M4: mirror the durable queue to main whenever it changes, so saved/scheduled and
+// other pending items survive a quit. Skipped in preview (no IPC bridge). A
+// progress-only update doesn't churn this — toPersisted drops progress/speed/eta, so
+// the persistable snapshot is unchanged by a tick and no redundant save fires. Main's
+// jsonStore coalesces the actual disk writes.
+if (!PREVIEW) {
+  let lastSig = ''
+  useDownloads.subscribe((state) => {
+    // Don't persist until the initial hydrate has read the saved file (above).
+    if (!queueHydrated) return
+    const persistable = persistableItems(state.items)
+    const sig = JSON.stringify(persistable)
+    if (sig === lastSig) return
+    lastSig = sig
+    window.api.saveQueue(persistable).catch(logError('saveQueue'))
+  })
+}
+
+// The scheduled-download promoter tick lives in App (a useEffect), not here, so
+// importing this store in tests/preview doesn't start a stray never-cleared timer
+// on module load (L1). See SCHEDULE_TICK_MS / App.tsx.
 
 // Wire main → renderer push events. (Output folder + cap live in the settings store.)
 if (!PREVIEW) {
   window.api.onDownloadEvent((ev) => useDownloads.getState().applyEvent(ev))
 } else {
   // Browser preview: animate any seed item that starts out 'downloading' so the
-  // queue is live (and its completion promotes the queued seed item — a real
+  // queue is live (and its completion promotes the queued seed item -- a real
   // demo of the concurrency cap).
   useDownloads
     .getState()
diff --git a/src/renderer/src/store/errorlog.ts b/src/renderer/src/store/errorlog.ts
index c8a2af6..9e53799 100644
--- a/src/renderer/src/store/errorlog.ts
+++ b/src/renderer/src/store/errorlog.ts
@@ -1,8 +1,7 @@
 import { create } from 'zustand'
 import type { ErrorLogEntry } from '@shared/ipc'
-
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
+import { isPreview as PREVIEW } from '../isPreview'
+import { logError } from '../reportError'
 
 // Sample entries so the Diagnostics card has content during UI design.
 const seed: ErrorLogEntry[] = PREVIEW
@@ -12,7 +11,7 @@ const seed: ErrorLogEntry[] = PREVIEW
         title: 'Private video',
         url: 'https://youtube.com/watch?v=err0r',
         kind: 'video',
-        error: 'ERROR: [youtube] err0r: Private video. Sign in if you have access.',
+        error: '[youtube] err0r: Private video. Sign in if you have access.',
         occurredAt: Date.now() - 1000 * 60 * 12
       }
     ]
@@ -28,7 +27,7 @@ export const useErrorLog = create<ErrorLogState>((set) => ({
 
   clear: () => {
     set({ entries: [] })
-    if (!PREVIEW) window.api.clearErrorLog().catch(() => {})
+    if (!PREVIEW) window.api.clearErrorLog().catch(logError('clearErrorLog'))
   }
 }))
 
diff --git a/src/renderer/src/store/history.ts b/src/renderer/src/store/history.ts
index 9947dad..7bdb74d 100644
--- a/src/renderer/src/store/history.ts
+++ b/src/renderer/src/store/history.ts
@@ -1,48 +1,54 @@
 import { create } from 'zustand'
-import type { HistoryEntry } from '@shared/ipc'
+import { HISTORY_MAX_ENTRIES, type HistoryEntry } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
+import { logError } from '../reportError'
+import { revealFile } from '../reveal'
 
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
-
-// Mock history so the History tab has content during UI design.
-const seed: HistoryEntry[] = PREVIEW
-  ? [
-      {
-        id: 'h1',
-        title: 'How yt-dlp Works Under the Hood',
-        channel: 'Open Source Weekly',
-        url: 'https://youtube.com/watch?v=zzz9999',
-        kind: 'video',
-        quality: '720p · mp4 · 184 MB',
-        sizeLabel: '184 MB',
-        filePath: 'C:\\Users\\you\\Downloads\\How yt-dlp Works Under the Hood.mp4',
-        completedAt: Date.now() - 1000 * 60 * 42
-      },
-      {
-        id: 'h2',
-        title: 'Deep Focus — Ambient Mix',
-        channel: 'ChillStudio',
-        url: 'https://youtube.com/watch?v=aaa1111',
-        kind: 'audio',
-        quality: 'Best (MP3)',
-        sizeLabel: '142 MB',
-        filePath: 'C:\\Users\\you\\Downloads\\Deep Focus — Ambient Mix.mp3',
-        completedAt: Date.now() - 1000 * 60 * 60 * 26
-      },
-      {
-        id: 'h3',
-        title: 'Conference Keynote 2026 (Full)',
-        channel: 'TechConf',
-        url: 'https://youtube.com/watch?v=bbb2222',
-        kind: 'video',
-        quality: '1080p · mp4 · 1.2 GB',
-        sizeLabel: '1.2 GB',
-        filePath: 'C:\\Users\\you\\Downloads\\Conference Keynote 2026 (Full).mp4',
-        completedAt: Date.now() - 1000 * 60 * 60 * 24 * 3
-      }
-    ]
-  : []
+// Mock history so the History tab has content during UI design. Gated on
+// `import.meta.env.DEV` too so Rollup drops it from the production build (L128).
+const seed: HistoryEntry[] =
+  import.meta.env.DEV && PREVIEW
+    ? [
+        {
+          id: 'h1',
+          title: 'How yt-dlp Works Under the Hood',
+          channel: 'Open Source Weekly',
+          url: 'https://youtube.com/watch?v=zzz9999',
+          kind: 'video',
+          quality: '720p · mp4 · 184 MB',
+          sizeLabel: '184 MB',
+          filePath: 'C:\\Users\\you\\Downloads\\How yt-dlp Works Under the Hood.mp4',
+          completedAt: Date.now() - 1000 * 60 * 42
+        },
+        {
+          id: 'h2',
+          title: 'Deep Focus — Ambient Mix',
+          channel: 'ChillStudio',
+          url: 'https://youtube.com/watch?v=aaa1111',
+          kind: 'audio',
+          quality: 'Best',
+          sizeLabel: '142 MB',
+          filePath: 'C:\\Users\\you\\Downloads\\Deep Focus — Ambient Mix.mp3',
+          completedAt: Date.now() - 1000 * 60 * 60 * 26
+        },
+        {
+          id: 'h3',
+          title: 'Conference Keynote 2026 (Full)',
+          channel: 'TechConf',
+          url: 'https://youtube.com/watch?v=bbb2222',
+          kind: 'video',
+          quality: '1080p · mp4 · 1.2 GB',
+          sizeLabel: '1.2 GB',
+          filePath: 'C:\\Users\\you\\Downloads\\Conference Keynote 2026 (Full).mp4',
+          completedAt: Date.now() - 1000 * 60 * 60 * 24 * 3
+        }
+      ]
+    : []
 
+// Cap the optimistic in-memory list at the same shared limit main persists to
+// (HISTORY_MAX_ENTRIES) so a long session can't grow it past what a reload would
+// show (L141). De-duping by url as well as id keeps it consistent with main's add
+// (M35), so the optimistic list matches the reload.
 interface HistoryState {
   entries: HistoryEntry[]
   add: (entry: HistoryEntry) => void
@@ -57,34 +63,39 @@ export const useHistory = create<HistoryState>((set, get) => ({
   entries: seed,
 
   add: (entry) => {
-    set((s) => ({ entries: [entry, ...s.entries.filter((e) => e.id !== entry.id)] }))
-    if (!PREVIEW) window.api.addHistory(entry).catch(() => {})
+    set((s) => ({
+      entries: [entry, ...s.entries.filter((e) => e.id !== entry.id && e.url !== entry.url)].slice(
+        0,
+        HISTORY_MAX_ENTRIES
+      )
+    }))
+    if (!PREVIEW) window.api.addHistory(entry).catch(logError('addHistory'))
   },
 
   remove: (id) => {
     set((s) => ({ entries: s.entries.filter((e) => e.id !== id) }))
-    if (!PREVIEW) window.api.removeHistory(id).catch(() => {})
+    if (!PREVIEW) window.api.removeHistory(id).catch(logError('removeHistory'))
   },
 
   removeMany: (ids) => {
     const remove = new Set(ids)
     set((s) => ({ entries: s.entries.filter((e) => !remove.has(e.id)) }))
-    if (!PREVIEW) window.api.removeManyHistory(ids).catch(() => {})
+    if (!PREVIEW) window.api.removeManyHistory(ids).catch(logError('removeManyHistory'))
   },
 
   clear: () => {
     set({ entries: [] })
-    if (!PREVIEW) window.api.clearHistory().catch(() => {})
+    if (!PREVIEW) window.api.clearHistory().catch(logError('clearHistory'))
   },
 
   openFile: (id) => {
     const e = get().entries.find((x) => x.id === id)
-    if (!PREVIEW && e?.filePath) window.api.openPath(e.filePath)
+    if (!PREVIEW && e?.filePath) revealFile('open', e.filePath)
   },
 
   showInFolder: (id) => {
     const e = get().entries.find((x) => x.id === id)
-    if (!PREVIEW && e?.filePath) window.api.showInFolder(e.filePath)
+    if (!PREVIEW && e?.filePath) revealFile('folder', e.filePath)
   }
 }))
 
diff --git a/src/renderer/src/store/nav.ts b/src/renderer/src/store/nav.ts
new file mode 100644
index 0000000..e0c8a8e
--- /dev/null
+++ b/src/renderer/src/store/nav.ts
@@ -0,0 +1,44 @@
+import { create } from 'zustand'
+import type { TabValue } from '../components/Sidebar'
+
+/**
+ * The active screen, owned in a store so any component can navigate without
+ * threading an `onTabChange` prop through the tree. It also carries a one-shot
+ * URL handoff: the Downloads bar detects a channel/playlist link (which belongs
+ * in the Library, not the one-off queue) and hands it here; the Library consumes
+ * it once to pre-fill its add field (UX3).
+ */
+interface NavState {
+  tab: TabValue
+  setTab: (tab: TabValue) => void
+  /** A channel/playlist URL handed from the Downloads bar to the Library. */
+  pendingLibraryUrl: string | null
+  /** Switch to the Library tab and stage `url` for its add field. */
+  openLibraryWith: (url: string) => void
+  /** Read and clear the staged Library URL (returns null if none is pending). */
+  consumeLibraryUrl: () => string | null
+  /**
+   * The DownloadBar registers a focuser for its URL field here (L118), so App can
+   * ask for focus (on launch / "New download") without reaching into the DOM by a
+   * hardcoded element id. The DownloadBar owns *how* it focuses (its own ref);
+   * callers just call `focusUrlField()`.
+   */
+  urlFocuser: (() => void) | null
+  registerUrlFocuser: (fn: (() => void) | null) => void
+  focusUrlField: () => void
+}
+
+export const useNav = create<NavState>((set, get) => ({
+  tab: 'downloads',
+  setTab: (tab) => set({ tab }),
+  pendingLibraryUrl: null,
+  openLibraryWith: (url) => set({ tab: 'library', pendingLibraryUrl: url }),
+  consumeLibraryUrl: () => {
+    const url = get().pendingLibraryUrl
+    if (url !== null) set({ pendingLibraryUrl: null })
+    return url
+  },
+  urlFocuser: null,
+  registerUrlFocuser: (fn) => set({ urlFocuser: fn }),
+  focusUrlField: () => get().urlFocuser?.()
+}))
diff --git a/src/renderer/src/store/queuePersist.ts b/src/renderer/src/store/queuePersist.ts
new file mode 100644
index 0000000..90623e5
--- /dev/null
+++ b/src/renderer/src/store/queuePersist.ts
@@ -0,0 +1,63 @@
+import { type PersistedQueueItem, type PersistedQueueStatus } from '@shared/ipc'
+import { type DownloadItem, type DownloadStatus } from './downloadTypes'
+
+/**
+ * Pure mapping between the live `DownloadItem` and the durable `PersistedQueueItem`
+ * main stores across restarts (M4). Kept free of any store/zustand import so it can
+ * be unit-tested in isolation (mirrors queueStats / formatters). Only stable fields
+ * persist — runtime-only progress/speed/eta/sizeLabel/finishing are dropped and
+ * re-derived on restore.
+ */
+
+// Statuses worth surviving a quit. 'completed'/'canceled' are transient results
+// (completions already live in history) and are never persisted.
+export const PERSISTED_STATUSES: readonly DownloadStatus[] = [
+  'queued',
+  'downloading',
+  'paused',
+  'saved',
+  'error'
+]
+
+export function toPersisted(i: DownloadItem): PersistedQueueItem {
+  return {
+    id: i.id,
+    url: i.url,
+    title: i.title,
+    channel: i.channel,
+    durationLabel: i.durationLabel,
+    thumbnail: i.thumbnail,
+    kind: i.kind,
+    quality: i.quality,
+    status: i.status as PersistedQueueStatus,
+    filePath: i.filePath,
+    error: i.error,
+    formatId: i.formatId,
+    formatHasAudio: i.formatHasAudio,
+    options: i.options,
+    extraArgs: i.extraArgs,
+    trim: i.trim,
+    scheduledFor: i.scheduledFor,
+    incognito: i.incognito,
+    probedMeta: i.probedMeta,
+    collection: i.collection,
+    mediaItemId: i.mediaItemId
+  }
+}
+
+export function fromPersisted(p: PersistedQueueItem): DownloadItem {
+  return {
+    ...p,
+    // A download in flight when we quit lost its process; re-queue it (yt-dlp
+    // continues the .part on relaunch). Progress restarts from 0.
+    status: p.status === 'downloading' ? 'queued' : p.status,
+    progress: 0
+  }
+}
+
+/** The persistable subset of the live queue, in durable form. */
+export function persistableItems(items: DownloadItem[]): PersistedQueueItem[] {
+  return items
+    .filter((i) => (PERSISTED_STATUSES as readonly string[]).includes(i.status))
+    .map(toPersisted)
+}
diff --git a/src/renderer/src/store/queueStats.ts b/src/renderer/src/store/queueStats.ts
index f12f077..66c79ac 100644
--- a/src/renderer/src/store/queueStats.ts
+++ b/src/renderer/src/store/queueStats.ts
@@ -5,46 +5,8 @@
  * unit-tested without constructing the Zustand store or its preview ticker.
  */
 import type { DownloadItem } from './downloads'
-
-// Parse a human speed string ('4.7 MB/s', '512 KiB/s') into bytes/second. Tolerant
-// of the SI (KB) and binary (KiB) suffixes yt-dlp may emit; the 1000-vs-1024
-// difference is immaterial for a live display estimate.
-function parseSpeed(s?: string): number {
-  if (!s) return 0
-  const m = /([\d.]+)\s*([KMGT]?)i?B\/s/i.exec(s)
-  if (!m) return 0
-  const n = parseFloat(m[1])
-  if (!isFinite(n)) return 0
-  const mult: Record<string, number> = { '': 1, K: 1e3, M: 1e6, G: 1e9, T: 1e12 }
-  return n * (mult[m[2].toUpperCase()] ?? 1)
-}
-
-function formatSpeed(bytesPerSec: number): string {
-  if (bytesPerSec <= 0) return ''
-  const units = ['B/s', 'KB/s', 'MB/s', 'GB/s']
-  let v = bytesPerSec
-  let i = 0
-  while (v >= 1000 && i < units.length - 1) {
-    v /= 1000
-    i++
-  }
-  return `${v.toFixed(1)} ${units[i]}`
-}
-
-// Parse 'M:SS' / 'H:MM:SS' (or bare seconds) into seconds.
-function parseEtaSeconds(s?: string): number {
-  if (!s) return 0
-  const parts = s.split(':').map((p) => Number(p))
-  if (parts.length === 0 || parts.some((p) => !isFinite(p))) return 0
-  return parts.reduce((acc, p) => acc * 60 + p, 0)
-}
-
-function formatEta(totalSeconds: number): string {
-  if (totalSeconds <= 0) return ''
-  const s = Math.round(totalSeconds)
-  const m = Math.floor(s / 60)
-  return `${m}:${String(s % 60).padStart(2, '0')}`
-}
+import { youtubeId } from '../lib/urlHelpers'
+import { fmtSpeed, fmtEta } from '@shared/format'
 
 export interface QueueSummary {
   downloading: number
@@ -81,8 +43,10 @@ export function summarizeQueue(items: DownloadItem[]): QueueSummary {
       downloading++
       progressSum += i.progress
       progressCount++
-      speed += parseSpeed(i.speed)
-      maxEta = Math.max(maxEta, parseEtaSeconds(i.eta))
+      // Raw numbers carried straight from main (H4) — sum the rates, take the
+      // longest ETA; no string round-trip.
+      speed += i.speedBytesPerSec ?? 0
+      maxEta = Math.max(maxEta, i.etaSeconds ?? 0)
     } else if (i.status === 'queued') {
       queued++
       progressCount++
@@ -96,25 +60,30 @@ export function summarizeQueue(items: DownloadItem[]): QueueSummary {
     failed,
     active: downloading > 0 || queued > 0,
     progress: progressCount > 0 ? progressSum / progressCount : 0,
-    speedLabel: formatSpeed(speed),
-    etaLabel: formatEta(maxEta)
+    // Empty label (not '0 B/s' / '0:00') when nothing is actively transferring.
+    speedLabel: speed > 0 ? (fmtSpeed(speed) ?? '') : '',
+    etaLabel: maxEta > 0 ? (fmtEta(maxEta) ?? '') : ''
   }
 }
 
+// A 1-entry memo of the last summary, keyed on the `items` array reference. The
+// store hands out a new `items` array on every change, and both App's taskbar
+// subscription and DownloadsView's render summarize that same array per change — so
+// caching by reference computes the O(n) aggregate once per change instead of twice
+// (PERF4 / L94). `summarizeQueue` stays pure for the unit tests.
+let cachedItems: DownloadItem[] | null = null
+let cachedSummary: QueueSummary | null = null
+
+/** Memoized `summarizeQueue`: recomputes only when the `items` reference changes. */
+export function queueSummaryOf(items: DownloadItem[]): QueueSummary {
+  if (items === cachedItems && cachedSummary) return cachedSummary
+  cachedItems = items
+  cachedSummary = summarizeQueue(items)
+  return cachedSummary
+}
+
 // --- Duplicate detection ----------------------------------------------------
 
-function youtubeId(url: string): string | null {
-  try {
-    const u = new URL(url)
-    const host = u.hostname.replace(/^www\./, '')
-    if (host === 'youtu.be') return u.pathname.slice(1) || null
-    if (host.endsWith('youtube.com')) return u.searchParams.get('v')
-  } catch {
-    /* not a URL */
-  }
-  return null
-}
-
 function normalizeUrl(url: string): string {
   try {
     const u = new URL(url)
diff --git a/src/renderer/src/store/settings.ts b/src/renderer/src/store/settings.ts
index 0fec846..6455e7f 100644
--- a/src/renderer/src/store/settings.ts
+++ b/src/renderer/src/store/settings.ts
@@ -1,44 +1,22 @@
 import { create } from 'zustand'
-import { DEFAULT_DOWNLOAD_OPTIONS, type Settings } from '@shared/ipc'
+import { DEFAULT_SETTINGS, type Settings } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
+import { logError } from '../reportError'
 
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
-
-const FALLBACK: Settings = {
-  videoDir: PREVIEW ? 'C:\\Users\\you\\Documents\\Video' : '',
-  audioDir: PREVIEW ? 'C:\\Users\\you\\Documents\\Audio' : '',
-  defaultKind: 'video',
-  defaultVideoQuality: 'Best available',
-  defaultAudioQuality: 'Best (MP3)',
-  maxConcurrent: 2,
-  filenameTemplate: '%(title)s.%(ext)s',
-  theme: 'light',
-  accentColor: 'teal',
-  clipboardWatch: true,
-  downloadOptions: DEFAULT_DOWNLOAD_OPTIONS,
-  proxy: '',
-  rateLimit: '',
-  useAria2c: false,
-  cookieSource: 'none',
-  cookiesBrowser: 'chrome',
-  youtubePlayerClient: '',
-  youtubePoToken: '',
-  restrictFilenames: false,
-  downloadArchive: false,
-  autoUpdateYtdlp: true,
-  ytdlpChannel: 'nightly',
-  ytdlpLastUpdateCheck: 0,
-  customCommandEnabled: false,
-  defaultTemplateId: null,
-  notifyOnComplete: true,
-  autoDownloadNew: true,
-  // True in preview so design work isn't blocked behind the welcome screen;
-  // a real first launch gets `false` from main/settings.ts's DEFAULTS instead.
-  hasCompletedOnboarding: PREVIEW,
-  minimizeToTray: false,
-  launchAtStartup: false,
-  updateToken: ''
-}
+// The pre-load fallback is the canonical DEFAULT_SETTINGS (single-sourced from the
+// shared contract, C1) — including theme:'system' (SR1) so there's no white-on-
+// first-paint flash for a dark-mode user before the real settings arrive. In the
+// browser preview a couple of fields differ: placeholder folder paths, and
+// onboarding pre-dismissed so design work isn't blocked behind the welcome screen
+// (a real first launch keeps DEFAULT_SETTINGS' false from main).
+const FALLBACK: Settings = PREVIEW
+  ? {
+      ...DEFAULT_SETTINGS,
+      videoDir: 'C:\\Users\\you\\Documents\\Video',
+      audioDir: 'C:\\Users\\you\\Documents\\Audio',
+      hasCompletedOnboarding: true
+    }
+  : DEFAULT_SETTINGS
 
 interface SettingsState extends Settings {
   /** true once persisted settings have loaded (always true in preview) */
@@ -56,14 +34,31 @@ export const useSettings = create<SettingsState>((set, get) => ({
 
   update: (partial) => {
     set(partial) // optimistic local update
-    if (!PREVIEW) window.api.setSettings(partial).catch(() => {})
+    if (PREVIEW) return
+    // M34: reconcile with main's authoritative, validated result — for exactly the
+    // keys we changed — so a value main clamps, sanitizes, or rejects (e.g. an
+    // unsafe filenameTemplate, an out-of-range maxConcurrent, a malformed
+    // rateLimit) stops showing as accepted in the UI until restart.
+    window.api
+      .setSettings(partial)
+      .then((saved) => {
+        const reconciled = Object.fromEntries(
+          (Object.keys(partial) as (keyof Settings)[]).map((k) => [k, saved[k]])
+        ) as Partial<Settings>
+        set(reconciled)
+      })
+      .catch(logError('setSettings'))
   },
 
   chooseDir: (target) => {
     if (PREVIEW) return
-    window.api.chooseFolder().then((dir) => {
-      if (dir) get().update({ [target]: dir })
-    })
+    // Seed the OS picker with the folder this target currently points at (W5).
+    window.api
+      .chooseFolder(get()[target])
+      .then((dir) => {
+        if (dir) get().update({ [target]: dir })
+      })
+      .catch(logError('chooseFolder'))
   },
 
   clearDir: (target) => get().update({ [target]: '' })
diff --git a/src/renderer/src/store/sources.ts b/src/renderer/src/store/sources.ts
index 0cd1a37..ce8b74f 100644
--- a/src/renderer/src/store/sources.ts
+++ b/src/renderer/src/store/sources.ts
@@ -1,10 +1,9 @@
 import { create } from 'zustand'
-import type { Source, MediaItem, IndexProgress } from '@shared/ipc'
-import { useDownloads } from './downloads'
+import type { Source, MediaItem, IndexProgress, MediaKind } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
 import { useSettings } from './settings'
-
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
+import { emit, on } from './coordinator'
+import { logError } from '../reportError'
 
 // --- Preview seed data ------------------------------------------------------
 
@@ -13,7 +12,7 @@ function seedItems(sourceId: string, playlist: string, n: number, downloadedUpTo
     id: `${sourceId}:${playlist}-${i + 1}`,
     sourceId,
     videoId: `${playlist}-${i + 1}`,
-    title: `${playlist} — part ${i + 1}`,
+    title: `${playlist} -- part ${i + 1}`,
     url: `https://youtube.com/watch?v=${sourceId}${i + 1}`,
     playlistTitle: playlist,
     playlistIndex: i + 1,
@@ -22,40 +21,44 @@ function seedItems(sourceId: string, playlist: string, n: number, downloadedUpTo
   }))
 }
 
-const seedSources: Source[] = PREVIEW
-  ? [
-      {
-        id: 'src-dev',
-        url: 'https://www.youtube.com/@DevChannel',
-        kind: 'channel',
-        title: 'DevChannel',
-        channel: 'DevChannel',
-        addedAt: Date.now() - 86_400_000,
-        lastIndexedAt: Date.now() - 3_600_000,
-        itemCount: 9
-      },
-      {
-        id: 'src-mix',
-        url: 'https://www.youtube.com/playlist?list=PLmix',
-        kind: 'playlist',
-        title: 'Lo-fi Coding Mixes',
-        channel: 'ChillStudio',
-        addedAt: Date.now() - 2 * 86_400_000,
-        lastIndexedAt: Date.now() - 7_200_000,
-        itemCount: 5
-      }
-    ]
-  : []
+// Gated on `import.meta.env.DEV` too so Rollup drops these preview seeds from the
+// packaged production renderer (DEV is statically false there) (L128).
+const seedSources: Source[] =
+  import.meta.env.DEV && PREVIEW
+    ? [
+        {
+          id: 'src-dev',
+          url: 'https://www.youtube.com/@DevChannel',
+          kind: 'channel',
+          title: 'DevChannel',
+          channel: 'DevChannel',
+          addedAt: Date.now() - 86_400_000,
+          lastIndexedAt: Date.now() - 3_600_000,
+          itemCount: 9
+        },
+        {
+          id: 'src-mix',
+          url: 'https://www.youtube.com/playlist?list=PLmix',
+          kind: 'playlist',
+          title: 'Lo-fi Coding Mixes',
+          channel: 'ChillStudio',
+          addedAt: Date.now() - 2 * 86_400_000,
+          lastIndexedAt: Date.now() - 7_200_000,
+          itemCount: 5
+        }
+      ]
+    : []
 
-const seedItemsBySource: Record<string, MediaItem[]> = PREVIEW
-  ? {
-      'src-dev': [
-        ...seedItems('src-dev', 'Full Electron Course', 6, 2),
-        ...seedItems('src-dev', 'Uploads', 3)
-      ],
-      'src-mix': seedItems('src-mix', 'Lo-fi Coding Mixes', 5, 1)
-    }
-  : {}
+const seedItemsBySource: Record<string, MediaItem[]> =
+  import.meta.env.DEV && PREVIEW
+    ? {
+        'src-dev': [
+          ...seedItems('src-dev', 'Full Electron Course', 6, 2),
+          ...seedItems('src-dev', 'Uploads', 3)
+        ],
+        'src-mix': seedItems('src-mix', 'Lo-fi Coding Mixes', 5, 1)
+      }
+    : {}
 
 // --- Store ------------------------------------------------------------------
 
@@ -83,11 +86,11 @@ interface SourcesState {
   removeSource: (id: string) => void
   /**
    * Enqueue the given media items into the download queue with folder context.
-   * Queues all of them — one click can fill the queue with an entire channel,
+   * Queues all of them -- one click can fill the queue with an entire channel,
    * which maxConcurrent then gates into download slots. Returns how many were
    * enqueued.
    */
-  enqueueItems: (sourceId: string, items: MediaItem[]) => number
+  enqueueItems: (sourceId: string, items: MediaItem[], kind?: MediaKind) => number
   /** mark an item downloaded once its queue download completes (called by the downloads store) */
   markDownloaded: (itemId: string, filePath?: string) => void
   /** toggle a source's watched-for-new-uploads flag (Phase J) */
@@ -113,7 +116,7 @@ export const useSources = create<SourcesState>((set, get) => ({
     window.api
       .listSources()
       .then((sources) => set({ sources }))
-      .catch(() => {})
+      .catch(logError('listSources'))
   },
 
   selectSource: (id) => {
@@ -123,7 +126,7 @@ export const useSources = create<SourcesState>((set, get) => ({
       window.api
         .listSourceItems(id)
         .then((items) => set((s) => ({ itemsBySource: { ...s.itemsBySource, [id]: items } })))
-        .catch(() => {})
+        .catch(logError('listSourceItems'))
     }
   },
 
@@ -150,7 +153,7 @@ export const useSources = create<SourcesState>((set, get) => ({
 
   reindexSource: async (id) => {
     const src = get().sources.find((s) => s.id === id)
-    set({ indexing: { active: true, url: src?.url, message: 'Re-indexing…' } })
+    set({ indexing: { active: true, url: src?.url, message: 'Refreshing…' } })
     if (PREVIEW) {
       await new Promise((r) => setTimeout(r, 700))
       set({ indexing: { active: false } })
@@ -164,7 +167,8 @@ export const useSources = create<SourcesState>((set, get) => ({
         const items = await window.api.listSourceItems(id)
         set((s) => ({ itemsBySource: { ...s.itemsBySource, [id]: items } }))
       }
-    } catch {
+    } catch (e) {
+      logError('reindexSource')(e)
       set({ indexing: { active: false } })
     }
   },
@@ -174,16 +178,24 @@ export const useSources = create<SourcesState>((set, get) => ({
       sources: s.sources.filter((x) => x.id !== id),
       selectedSourceId: s.selectedSourceId === id ? null : s.selectedSourceId
     }))
-    if (!PREVIEW) window.api.removeSource(id).catch(() => {})
+    // Cancel any of this source's downloads still in flight, so removing a source
+    // stops its videos from finishing into now-orphaned folders (L157). Routed via
+    // the event bus (C2) so sources doesn't import downloads.
+    emit('sourceRemoved', id)
+    if (!PREVIEW) window.api.removeSource(id).catch(logError('removeSource'))
   },
 
-  enqueueItems: (sourceId, items) => {
+  enqueueItems: (sourceId, items, kindOverride) => {
     const src = get().sources.find((s) => s.id === sourceId)
     const settings = useSettings.getState()
-    const kind = settings.defaultKind
+    // Per-batch override (Library video/audio toggle) falls back to the global default (M27).
+    const kind = kindOverride ?? settings.defaultKind
     const quality = kind === 'video' ? settings.defaultVideoQuality : settings.defaultAudioQuality
-    // One batched state update + pump, so queuing a whole channel stays O(n).
-    useDownloads.getState().addMany(
+    // Hand the batch to the downloads store via the event bus (C2) rather than a
+    // direct import. addMany applies it as one batched state update + pump, so
+    // queuing a whole channel stays O(n).
+    emit(
+      'enqueueDownloads',
       items.map((it) => ({
         url: it.url,
         kind,
@@ -220,12 +232,13 @@ export const useSources = create<SourcesState>((set, get) => ({
       }
       return changed ? { itemsBySource: next } : {}
     })
-    if (!PREVIEW) window.api.markSourceItemDownloaded(itemId, filePath).catch(() => {})
+    if (!PREVIEW)
+      window.api.setMediaItemDownloaded(itemId, filePath).catch(logError('setMediaItemDownloaded'))
   },
 
   setWatched: (id, watched) => {
     set((s) => ({ sources: s.sources.map((x) => (x.id === id ? { ...x, watched } : x)) }))
-    if (!PREVIEW) window.api.setSourceWatched(id, watched).catch(() => {})
+    if (!PREVIEW) window.api.setSourceWatched(id, watched).catch(logError('setSourceWatched'))
   },
 
   syncWatched: async () => {
@@ -236,7 +249,7 @@ export const useSources = create<SourcesState>((set, get) => ({
         await new Promise((r) => setTimeout(r, 700))
         return 0 // preview has no real feed to poll
       }
-      const res = await window.api.syncSources()
+      const res = await window.api.syncWatchedSources()
       if (!res.ok) return 0
       get().loadSources()
       // Refresh any expanded source's items so new videos appear in the tree.
@@ -262,6 +275,12 @@ export const useSources = create<SourcesState>((set, get) => ({
   }
 }))
 
+// When a download tied to one of our MediaItems finishes, the downloads store
+// emits this on the bus (C2) — mark the item downloaded so the library reflects it.
+on('downloadCompleted', ({ mediaItemId, filePath }) =>
+  useSources.getState().markDownloaded(mediaItemId, filePath)
+)
+
 // Load persisted sources on startup, and subscribe to live indexing progress.
 if (!PREVIEW) {
   window.api
@@ -274,7 +293,7 @@ if (!PREVIEW) {
         setTimeout(() => useSources.getState().syncWatched(), 1500)
       }
     })
-    .catch(() => {})
+    .catch(logError('startup listSources'))
   window.api.onIndexProgress((p: IndexProgress) => {
     useSources.setState({
       indexing: {
diff --git a/src/renderer/src/store/systemTheme.ts b/src/renderer/src/store/systemTheme.ts
index 12095c9..cbe2fd8 100644
--- a/src/renderer/src/store/systemTheme.ts
+++ b/src/renderer/src/store/systemTheme.ts
@@ -1,10 +1,8 @@
 import { create } from 'zustand'
 import type { SystemThemeInfo } from '@shared/ipc'
+import { isPreview as PREVIEW } from '../isPreview'
 import { useSettings } from './settings'
 
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
-
 const prefersDark =
   typeof window !== 'undefined' && window.matchMedia
     ? window.matchMedia('(prefers-color-scheme: dark)')
diff --git a/src/renderer/src/store/templates.ts b/src/renderer/src/store/templates.ts
index e442896..f94b018 100644
--- a/src/renderer/src/store/templates.ts
+++ b/src/renderer/src/store/templates.ts
@@ -1,8 +1,7 @@
 import { create } from 'zustand'
 import type { CommandTemplate } from '@shared/ipc'
-
-// True in the standalone browser preview (no Electron preload).
-const PREVIEW = typeof window === 'undefined' || !window.electron
+import { isPreview as PREVIEW } from '../isPreview'
+import { logError } from '../reportError'
 
 // Sample templates so the Settings tab has content during UI design.
 const seed: CommandTemplate[] = PREVIEW
@@ -24,12 +23,12 @@ export const useTemplates = create<TemplatesState>((set) => ({
 
   save: (template) => {
     set((s) => ({ templates: [template, ...s.templates.filter((t) => t.id !== template.id)] }))
-    if (!PREVIEW) window.api.saveTemplate(template).catch(() => {})
+    if (!PREVIEW) window.api.saveTemplate(template).catch(logError('saveTemplate'))
   },
 
   remove: (id) => {
     set((s) => ({ templates: s.templates.filter((t) => t.id !== id) }))
-    if (!PREVIEW) window.api.removeTemplate(id).catch(() => {})
+    if (!PREVIEW) window.api.removeTemplate(id).catch(logError('removeTemplate'))
   }
 }))
 
diff --git a/src/renderer/src/store/toasts.ts b/src/renderer/src/store/toasts.ts
new file mode 100644
index 0000000..8b9032c
--- /dev/null
+++ b/src/renderer/src/store/toasts.ts
@@ -0,0 +1,45 @@
+import { create } from 'zustand'
+import { newId } from '../id'
+
+/**
+ * A tiny transient-notification store (audit UX6/UX9). The app had no way to tell
+ * the user about a background failure — a swallowed `openPath` error, a file that
+ * moved — so those actions silently did nothing. This backs a lightweight,
+ * non-blocking toast stack rendered by `Toaster`; any store or component can raise
+ * one via {@link toast}.
+ */
+export type ToastTone = 'info' | 'error' | 'success'
+
+export interface Toast {
+  id: string
+  message: string
+  tone: ToastTone
+}
+
+interface ToastState {
+  toasts: Toast[]
+  show: (message: string, tone?: ToastTone) => void
+  dismiss: (id: string) => void
+}
+
+/** How long a toast lingers before auto-dismissing. */
+const AUTO_DISMISS_MS = 5000
+
+export const useToasts = create<ToastState>((set, get) => ({
+  toasts: [],
+  show: (message, tone = 'info') => {
+    const id = newId('toast')
+    set((s) => ({ toasts: [...s.toasts, { id, message, tone }] }))
+    // Auto-dismiss so the stack self-clears; the user can also dismiss early.
+    setTimeout(() => get().dismiss(id), AUTO_DISMISS_MS)
+  },
+  dismiss: (id) => set((s) => ({ toasts: s.toasts.filter((t) => t.id !== id) }))
+}))
+
+/**
+ * Imperative shortcut for non-component callers (the Zustand stores), so a store
+ * action can surface an error without wiring the hook through a component.
+ */
+export function toast(message: string, tone?: ToastTone): void {
+  useToasts.getState().show(message, tone)
+}
diff --git a/src/renderer/src/theme.ts b/src/renderer/src/theme.ts
index 7c65b5f..1f666e0 100644
--- a/src/renderer/src/theme.ts
+++ b/src/renderer/src/theme.ts
@@ -1,3 +1,4 @@
+import { PAGE_BACKGROUND } from '@shared/theme'
 import {
   createLightTheme,
   createDarkTheme,
@@ -168,14 +169,7 @@ export function getTheme(accent: AccentColor, mode: 'light' | 'dark'): Theme {
   return mode === 'dark' ? preset.dark : preset.light
 }
 
-// Page background behind the app shell. Light: a clean, barely-cool off-white.
-// Dark: neutral charcoal. Intentionally accent-INDEPENDENT — the accent shows up
-// only on buttons/links, so this stays neutral whichever preset is chosen.
-// Keep light/dark in sync with THEME_BACKGROUND in src/main/index.ts.
-export const pageBackground = {
-  light: '#f7f7f8',
-  dark: '#161618'
-}
+export const pageBackground = PAGE_BACKGROUND
 
 // Per-kind thumbnail tints. Video vs audio differ by ramp DEPTH rather than a
 // competing hue, keeping a monochrome look. Theme-aware (light/dark) but
diff --git a/src/renderer/src/thumb.ts b/src/renderer/src/thumb.ts
index d44e0fc..34ab3b8 100644
--- a/src/renderer/src/thumb.ts
+++ b/src/renderer/src/thumb.ts
@@ -4,30 +4,7 @@
  * video id with no extra network probe. Anything non-YouTube without a probed
  * thumbnail returns undefined, and the UI falls back to a kind icon.
  */
-
-/**
- * Pull the video id out of any YouTube watch / shorts / embed / live / youtu.be
- * URL. Returns null for non-YouTube URLs or anything unparseable, so callers can
- * cheaply ask "is there a thumbnail derivable from this link?".
- */
-export function youtubeId(url: string | undefined): string | null {
-  if (!url) return null
-  let u: URL
-  try {
-    u = new URL(url)
-  } catch {
-    return null
-  }
-  const host = u.hostname.replace(/^www\./i, '').toLowerCase()
-  if (host === 'youtu.be') return u.pathname.slice(1).split('/')[0] || null
-  if (host === 'youtube.com' || host.endsWith('.youtube.com')) {
-    const v = u.searchParams.get('v')
-    if (v) return v
-    const m = u.pathname.match(/^\/(?:embed|shorts|v|live)\/([^/?#]+)/i)
-    if (m) return m[1]
-  }
-  return null
-}
+import { youtubeId } from './lib/urlHelpers'
 
 /**
  * Resolve a preview thumbnail URL for a media item. Prefers an explicit thumbnail
diff --git a/src/renderer/src/thumbSizes.ts b/src/renderer/src/thumbSizes.ts
new file mode 100644
index 0000000..4911e53
--- /dev/null
+++ b/src/renderer/src/thumbSizes.ts
@@ -0,0 +1,5 @@
+/** Shared 16:9 thumbnail box dimensions used across queue, history, and library views. */
+export const THUMB_LG = { w: 120, h: 68 } as const
+export const THUMB_MD = { w: 108, h: 64 } as const
+export const THUMB_SM = { w: 72, h: 44 } as const
+export const THUMB_XS = { w: 60, h: 34 } as const
diff --git a/src/renderer/src/useClipboardLink.ts b/src/renderer/src/useClipboardLink.ts
index a8f7769..22c94b5 100644
--- a/src/renderer/src/useClipboardLink.ts
+++ b/src/renderer/src/useClipboardLink.ts
@@ -1,43 +1,15 @@
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { useSettings } from './store/settings'
-
-/** A quick heuristic for "this clipboard text is a link worth offering". */
-export function looksLikeUrl(text: string): boolean {
-  const t = text.trim()
-  if (!/^https?:\/\//i.test(t)) return false
-  try {
-    new URL(t)
-    return true
-  } catch {
-    return false
-  }
-}
-
-/**
- * True for URLs that point at a single video rather than a channel/playlist. The
- * library's add-source field wants collections to sync, not one-off videos, so it
- * filters these out of its suggestions. Conservative on purpose: it only flags the
- * common YouTube single-video shapes (a `/watch?v=` or `youtu.be/<id>` with no
- * `list=` context), so a channel/playlist link — on YouTube or any other site — is
- * never wrongly rejected. A `list=` param means "add the playlist", so it's kept.
- */
-export function looksLikeSingleVideo(text: string): boolean {
-  let u: URL
-  try {
-    u = new URL(text.trim())
-  } catch {
-    return false
-  }
-  if (u.searchParams.has('list')) return false
-  const host = u.hostname.replace(/^www\./, '').toLowerCase()
-  if (host === 'youtube.com' || host === 'm.youtube.com' || host === 'music.youtube.com') {
-    return u.pathname === '/watch' && u.searchParams.has('v')
-  }
-  if (host === 'youtu.be') {
-    return /^\/[\w-]{6,}$/.test(u.pathname)
-  }
-  return false
-}
+// Pure URL helpers extracted to a standalone module so they can be tested
+// without pulling in the Zustand store (L40). Re-exported here for existing
+// consumers (DownloadBar, LibraryView) without an import-path change.
+export {
+  looksLikeUrl,
+  looksLikeSingleVideo,
+  looksLikeChannelOrPlaylist,
+  firstUrlInText
+} from './lib/urlHelpers'
+import { looksLikeUrl } from './lib/urlHelpers'
 
 /** Where an offered link came from — drives the banner's wording. */
 export type SuggestionSource = 'clipboard' | 'external'
@@ -73,6 +45,11 @@ interface ClipboardLink {
  * clipboard guess; links pushed via `offer()` bypass it (and the other guards),
  * since they're explicit requests rather than guesses.
  */
+// Module-level (not a per-instance ref) so a dismissed/accepted link stays
+// suppressed across hook remounts — switching Downloads↔Library remounts the hook,
+// and the same clipboard link shouldn't be re-offered after being dismissed (L145).
+let lastSeen: string | null = null
+
 export function useClipboardLink(
   currentValue: string,
   filter?: (url: string) => boolean
@@ -85,18 +62,22 @@ export function useClipboardLink(
   // focus listener from re-subscribing every render.
   const filterRef = useRef(filter)
   filterRef.current = filter
-  // The last link we offered or that the user dismissed — so re-focusing doesn't
-  // keep re-offering the same one.
-  const lastSeen = useRef<string | null>(null)
   // Mirror the live suggestion so accept/dismiss can read it without depending on
   // it — keeps their identity stable across renders.
   const suggestionRef = useRef<string | null>(null)
   suggestionRef.current = suggestion
+  // Re-run the check once persisted settings arrive, so a link copied before launch
+  // is still offered (the mount check is a no-op until `loaded`, L138).
+  const loaded = useSettings((s) => s.loaded)
 
   useEffect(() => {
     let active = true
     async function check(): Promise<void> {
-      if (!useSettings.getState().clipboardWatch || valueRef.current.trim()) return
+      const s = useSettings.getState()
+      // Don't touch the clipboard until real settings have loaded (L138): before
+      // that we'd be acting on the pre-load fallback for clipboardWatch instead of
+      // the user's actual choice — and we never read it when the watcher is off.
+      if (!s.loaded || !s.clipboardWatch || valueRef.current.trim()) return
       let text = ''
       try {
         text = (await window.api.readClipboard()) ?? ''
@@ -106,7 +87,7 @@ export function useClipboardLink(
       if (!active) return
       text = text.trim()
       const wanted = looksLikeUrl(text) && (filterRef.current?.(text) ?? true)
-      if (wanted && text !== lastSeen.current) {
+      if (wanted && text !== lastSeen) {
         setSource('clipboard')
         setSuggestion(text)
       }
@@ -117,18 +98,18 @@ export function useClipboardLink(
       active = false
       window.removeEventListener('focus', check)
     }
-  }, [])
+  }, [loaded])
 
   const accept = useCallback((): string | null => {
     const link = suggestionRef.current
     if (!link) return null
-    lastSeen.current = link
+    lastSeen = link
     setSuggestion(null)
     return link
   }, [])
 
   const dismiss = useCallback((): void => {
-    lastSeen.current = suggestionRef.current
+    lastSeen = suggestionRef.current
     setSuggestion(null)
   }, [])
 
diff --git a/src/shared/format.ts b/src/shared/format.ts
new file mode 100644
index 0000000..52d79f6
--- /dev/null
+++ b/src/shared/format.ts
@@ -0,0 +1,34 @@
+// Pure display formatters shared by main and renderer. Kept in @shared (not a
+// main- or renderer-only lib) so byte/speed/ETA formatting has ONE definition on
+// both sides of the IPC boundary — the renderer no longer re-parses formatted
+// strings back into numbers to aggregate them (H2/H4).
+
+/** Format a byte count as a binary-scaled size, e.g. 1048576 → '1.0 MB'. */
+export function fmtBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  const units = ['KB', 'MB', 'GB', 'TB']
+  let v = bytes / 1024
+  let i = 0
+  while (v >= 1024 && i < units.length - 1) {
+    v /= 1024
+    i++
+  }
+  return `${v.toFixed(v >= 100 ? 0 : 1)} ${units[i]}`
+}
+
+/** Format a transfer rate, e.g. 4928307 → '4.7 MB/s'. Undefined for no rate. */
+export function fmtSpeed(bytesPerSec?: number): string | undefined {
+  if (bytesPerSec == null) return undefined
+  return `${fmtBytes(bytesPerSec)}/s`
+}
+
+/** Format a duration in seconds as M:SS or H:MM:SS. Undefined for no value. */
+export function fmtEta(seconds?: number): string | undefined {
+  if (seconds == null) return undefined
+  const s = Math.max(0, Math.round(seconds))
+  const h = Math.floor(s / 3600)
+  const m = Math.floor((s % 3600) / 60)
+  const r = s % 60
+  if (h > 0) return `${h}:${String(m).padStart(2, '0')}:${String(r).padStart(2, '0')}`
+  return `${m}:${String(r).padStart(2, '0')}`
+}
diff --git a/src/shared/ipc.ts b/src/shared/ipc.ts
index 9f5e90f..331ee6e 100644
--- a/src/shared/ipc.ts
+++ b/src/shared/ipc.ts
@@ -20,9 +20,9 @@ export const IpcChannels = {
   downloadStart: 'download:start',
   downloadCancel: 'download:cancel',
   downloadPause: 'download:pause',
-  defaultFolder: 'download:default-folder',
   chooseFolder: 'download:choose-folder',
   openPath: 'shell:open-path',
+  openUrl: 'shell:open-url',
   showInFolder: 'shell:show-in-folder',
   clipboardRead: 'clipboard:read',
   settingsGet: 'settings:get',
@@ -46,15 +46,24 @@ export const IpcChannels = {
   ytdlpAutoUpdateStatus: 'ytdlp:auto-update-status',
   errorLogList: 'errorlog:list',
   errorLogClear: 'errorlog:clear',
+  /** Persisted download queue (M4): saved/scheduled/pending items survive a quit. */
+  queueList: 'queue:list',
+  queueSave: 'queue:save',
   backupExport: 'backup:export',
   backupImport: 'backup:import',
   systemThemeGet: 'system-theme:get',
   /** main → renderer push channel for OS theme/contrast changes (nativeTheme 'updated') */
   systemThemeUpdate: 'system-theme:update',
   openHighContrastSettings: 'shell:open-high-contrast-settings',
+  /** preload → main: the contextBridge failed to expose the API; main shows a
+   *  hard error instead of letting the renderer silently fall back to mock mode (M30) */
+  preloadBridgeFailure: 'preload:bridge-failure',
+  /** renderer → main fire-and-forget: forward a renderer-side failure to the main
+   *  diagnostic log so it survives into a packaged build (CC8; the M29 sink half). */
+  logWrite: 'log:write',
   /** main → renderer push channel: a URL handed to AeroFetch from outside the app
    *  (the aerofetch:// protocol, or a .url file via Explorer's "Send to" menu) */
-  externalUrl: 'external-url',
+  externalUrl: 'app:external-url',
   // --- Sources & media-manager indexing (Pinchflat-style, see ROADMAP-PINCHFLAT.md) ---
   sourcesList: 'sources:list',
   sourceIndex: 'sources:index',
@@ -78,7 +87,9 @@ export const IpcChannels = {
   /** main → renderer push channel for live terminal output lines */
   terminalOutput: 'terminal:output',
   /** renderer → main: reflect overall queue progress on the Windows taskbar (Phase O) */
-  taskbarProgress: 'taskbar:progress'
+  taskbarProgress: 'taskbar:progress',
+  /** renderer → main: open a YouTube WebView and extract a PO token (Phase P) */
+  youtubePoTokenMint: 'youtube:po-token-mint'
 } as const
 
 /** Sentinel format id meaning "let yt-dlp pick the best video+audio". */
@@ -118,6 +129,17 @@ export type CookieBrowser = (typeof COOKIE_BROWSERS)[number]
 export const ACCENT_COLORS = ['rose', 'coral', 'amber', 'teal'] as const
 export type AccentColor = (typeof ACCENT_COLORS)[number]
 
+/** Quality/format labels for the video download selector. */
+export const VIDEO_QUALITY_OPTIONS = ['Best available', '1080p', '720p', '480p', '360p'] as const
+export type VideoQuality = (typeof VIDEO_QUALITY_OPTIONS)[number]
+
+/** Quality/format labels for the audio download selector. */
+// Format-agnostic: the audio container/codec is chosen separately (downloadOptions
+// .audioFormat); these are just the target quality. Bitrate values are ignored for
+// lossless formats (flac/wav) -- see buildArgs (M18/M21).
+export const AUDIO_QUALITY_OPTIONS = ['Best', '320 kbps', '192 kbps', '128 kbps'] as const
+export type AudioQuality = (typeof AUDIO_QUALITY_OPTIONS)[number]
+
 /** UI color theme: an explicit mode, or 'system' to follow the OS preference. */
 export type ThemeMode = 'light' | 'dark' | 'system'
 
@@ -177,6 +199,12 @@ export interface DownloadOptions {
   splitChapters: boolean
   /** embed metadata (title/artist/etc.) */
   embedMetadata: boolean
+  /** override the title tag before embedding; blank = keep the extracted value */
+  metadataTitle?: string
+  /** override the artist tag before embedding (audio downloads) */
+  metadataArtist?: string
+  /** override the album tag before embedding (audio downloads) */
+  metadataAlbum?: string
   /** embed the thumbnail (cover art for audio, poster for mp4/mkv video) */
   embedThumbnail: boolean
   /** crop embedded audio artwork to a centred square (Seal's "crop artwork") */
@@ -199,7 +227,7 @@ export const DEFAULT_DOWNLOAD_OPTIONS: DownloadOptions = {
   autoSubtitles: false,
   sponsorBlock: false,
   sponsorBlockMode: 'remove',
-  sponsorBlockCategories: ['sponsor'],
+  sponsorBlockCategories: ['sponsor', 'selfpromo', 'interaction'],
   embedChapters: false,
   splitChapters: false,
   embedMetadata: true,
@@ -390,7 +418,7 @@ export interface StartDownloadOptions {
   id: string
   url: string
   kind: MediaKind
-  /** one of the UI quality labels (e.g. '1080p', 'Best (MP3)') */
+  /** one of the UI quality labels (e.g. '1080p', 'Best') */
   quality: string
   /** absolute output directory; main falls back to the OS Downloads folder */
   outputDir?: string
@@ -398,6 +426,13 @@ export interface StartDownloadOptions {
   formatId?: string
   /** whether the chosen format already includes audio (skips +bestaudio) */
   formatHasAudio?: boolean
+  /**
+   * Incognito ("private") download. Main enforces the promise the UI makes ("no
+   * logging, no history, no cookies"): it writes no errorlog entry, reveals no
+   * title/URL in an OS notification, and attaches no saved login / browser
+   * cookies — not just the renderer's history skip (L136 / M6).
+   */
+  incognito?: boolean
   /** per-download post-processing override; main falls back to settings defaults */
   options?: DownloadOptions
   /**
@@ -446,12 +481,20 @@ export interface DownloadProgress {
   status: string
   /** 0..1 (0 when total size is unknown) */
   progress: number
-  /** human-readable, e.g. '4.7 MB/s' */
-  speed?: string
-  /** human-readable, e.g. '1:12' */
-  eta?: string
+  /** raw transfer rate in bytes/sec; the renderer formats + aggregates it (H4) */
+  speedBytesPerSec?: number
+  /** raw time remaining in seconds; the renderer formats + aggregates it (H4) */
+  etaSeconds?: number
   /** human-readable total size, e.g. '512 MB' */
   sizeLabel?: string
+  /** true when yt-dlp reports no total/estimated size (livestreams, some sites),
+   *  so `progress` stays 0 the whole time — the bar should go indeterminate
+   *  instead of reading a frozen 0% (L137) */
+  sizeUnknown?: boolean
+  /** latched true once the first download stream has finished, so the remaining
+   *  stream/merge/post-processing shows as an indeterminate "Finishing…" state
+   *  rather than a second 0→100% fill of the bar (SR7) */
+  finishing?: boolean
 }
 
 /** Discriminated union pushed on IpcChannels.downloadEvent. */
@@ -461,6 +504,41 @@ export type DownloadEvent =
   | { type: 'done'; id: string; filePath?: string }
   | { type: 'error'; id: string; error: string }
 
+/** The subset of a persisted queue item's status worth surviving a quit. */
+export type PersistedQueueStatus = 'queued' | 'downloading' | 'paused' | 'saved' | 'error'
+
+/**
+ * A queue item persisted across restarts (M4) so saved/scheduled and other pending
+ * downloads return after a quit. This is the *durable* subset of the renderer's
+ * `DownloadItem`: runtime-only fields (progress/speed/eta/sizeLabel/finishing) are
+ * dropped since a restored item re-derives them. Transient results ('completed' /
+ * 'canceled') are never persisted; on load a 'downloading' item is normalized back
+ * to 'queued' because its process died with the previous session.
+ */
+export interface PersistedQueueItem {
+  id: string
+  url: string
+  title: string
+  channel?: string
+  durationLabel?: string
+  thumbnail?: string
+  kind: MediaKind
+  quality: string
+  status: PersistedQueueStatus
+  filePath?: string
+  error?: string
+  formatId?: string
+  formatHasAudio?: boolean
+  options?: DownloadOptions
+  extraArgs?: string
+  trim?: string
+  scheduledFor?: number
+  incognito?: boolean
+  probedMeta?: DownloadMeta
+  collection?: CollectionContext
+  mediaItemId?: string
+}
+
 /** Persisted user settings (electron-store). */
 export interface Settings {
   /** where video downloads are saved; empty string = the default Documents\Video folder */
@@ -527,6 +605,8 @@ export interface Settings {
   minimizeToTray: boolean
   /** launch AeroFetch automatically when the user signs in to Windows */
   launchAtStartup: boolean
+  /** whether the navigation sidebar is collapsed to icon-only mode */
+  sidebarCollapsed: boolean
   /**
    * Optional Gitea access token for the in-app updater. Empty = anonymous (works
    * only where the release repo allows anonymous access). When the release repo
@@ -536,6 +616,63 @@ export interface Settings {
   updateToken: string
 }
 
+/**
+ * The canonical default Settings — the single source of truth shared by the main
+ * electron-store defaults (main/settings.ts), the renderer's pre-load FALLBACK
+ * (store/settings.ts), and the browser-preview mock (mockApi.ts), so the full
+ * Settings object is no longer hand-maintained in three places (C1). Preview-only
+ * tweaks (placeholder folders, skip onboarding, demo channel) are layered on top
+ * of this at each call site.
+ */
+export const DEFAULT_SETTINGS: Settings = {
+  // Both blank by default → downloads land in Documents\Video / Documents\Audio
+  // (see getDefaultMediaDir). A non-empty value is an explicit per-kind override.
+  videoDir: '',
+  audioDir: '',
+  defaultKind: 'video',
+  defaultVideoQuality: 'Best available',
+  defaultAudioQuality: 'Best',
+  maxConcurrent: 2,
+  filenameTemplate: '%(title)s.%(ext)s',
+  // Follow the OS theme on first launch (SR1) so a dark-mode Windows user isn't
+  // greeted by a bright white window despite full system-theme support.
+  theme: 'system',
+  accentColor: 'teal',
+  // Off on first launch (SR4): reading the clipboard on every window focus is a
+  // privacy surprise for a brand-new user. It's a one-toggle opt-in in Settings
+  // (the onboarding tip points there). Existing installs keep their saved value.
+  clipboardWatch: false,
+  downloadOptions: DEFAULT_DOWNLOAD_OPTIONS,
+  proxy: '',
+  rateLimit: '',
+  useAria2c: false,
+  cookieSource: 'none',
+  cookiesBrowser: 'chrome',
+  youtubePlayerClient: '',
+  youtubePoToken: '',
+  restrictFilenames: false,
+  downloadArchive: false,
+  // yt-dlp is self-managed: a writable copy under userData, auto-updated on the
+  // configured channel so a stale binary can't silently cause YouTube 403s.
+  autoUpdateYtdlp: true,
+  // Default to stable so a nightly regression doesn't break downloads for
+  // everyone out of the box (SR2). Users who want the latest YouTube fixes
+  // can switch to nightly in Settings → Software.
+  ytdlpChannel: 'stable',
+  ytdlpLastUpdateCheck: 0,
+  customCommandEnabled: false,
+  defaultTemplateId: null,
+  notifyOnComplete: true,
+  // Default off so adding a watched channel doesn't silently fill the user's
+  // disk on first use (SR3). Enable explicitly once they know what it does.
+  autoDownloadNew: false,
+  hasCompletedOnboarding: false,
+  minimizeToTray: false,
+  launchAtStartup: false,
+  sidebarCollapsed: false,
+  updateToken: ''
+}
+
 /**
  * A named, reusable set of extra yt-dlp CLI flags (Phase C "custom commands"),
  * e.g. name: 'Write thumbnail + no mtime', args: '--write-thumbnail --no-mtime'.
@@ -585,14 +722,33 @@ export interface HistoryEntry {
   channel?: string
   url: string
   kind: MediaKind
+  /** Quality preset ('720p', 'Best available', 'Best', …) or the probed
+   *  format's display label. Used for display and, when no formatId is present,
+   *  as the fallback quality selector on re-download (H5). */
   quality: string
+  /** Exact yt-dlp format id from the probe picker, carried so re-downloading
+   *  always uses the same format rather than falling back to a preset (H5). */
+  formatId?: string
+  /** Whether the probed format already carries its own audio track (H5). */
+  formatHasAudio?: boolean
   filePath?: string
   sizeLabel?: string
   thumbnail?: string
+  /** The per-download post-processing options used originally, carried so a
+   *  re-download reproduces the same output (subtitles, SponsorBlock, container,
+   *  codec, …) instead of silently falling back to the current global defaults (L87). */
+  options?: DownloadOptions
   /** epoch milliseconds */
   completedAt: number
 }
 
+/**
+ * Cap on persisted history rows. Single-sourced here so the main store (history.ts)
+ * and the renderer's optimistic in-memory list (store/history.ts, L141) share one
+ * value instead of two hand-synced copies.
+ */
+export const HISTORY_MAX_ENTRIES = 500
+
 /**
  * A failed download or download-start attempt, persisted to errorlog.json
  * (newest-first) so the report survives the queue item being cleared —
@@ -625,9 +781,9 @@ export interface BackupImportResult {
 
 // --- Sources & media-manager indexing (Pinchflat-style) ---------------------
 // See ROADMAP-PINCHFLAT.md. A Source (channel/playlist) is indexed once into a
-// persisted list of MediaItem records; the live download queue then pulls from
-// that list a batch at a time, so "download an entire channel" never has to hold
-// the whole collection in the queue at once.
+// persisted list of MediaItem records. When the user downloads pending items,
+// all selected entries are enqueued at once — add a batch cap here if large
+// channel queues (thousands of items) cause performance issues (M33).
 
 /** Whether a Source is a whole channel or a single playlist. */
 export type SourceKind = 'channel' | 'playlist'
@@ -734,10 +890,22 @@ export interface TerminalRunResult {
   error?: string
 }
 
+/**
+ * Extract the `URL=` value from a Windows Internet Shortcut (.url) file's content.
+ * Returns the raw URL string (untrimmed), or null if not found.
+ * Callers validate the result with their own http/https check.
+ */
+export function parseUrlShortcutContent(text: string): string | null {
+  const m = /^\s*URL\s*=\s*(\S+)/im.exec(text)
+  return m?.[1]?.trim() ?? null
+}
+
 /** Overall queue state for the Windows taskbar progress bar (Phase O). */
 export interface TaskbarProgress {
   /** 0..1 overall fraction; ignored when mode is 'none' */
   fraction: number
   /** taskbar bar mode: hidden, normal, or red (some failed) */
   mode: 'none' | 'normal' | 'error'
+  /** active download count for the overlay badge; absent or 0 = clear badge */
+  badgeCount?: number
 }
diff --git a/src/shared/theme.ts b/src/shared/theme.ts
new file mode 100644
index 0000000..7d7d07d
--- /dev/null
+++ b/src/shared/theme.ts
@@ -0,0 +1,11 @@
+/**
+ * Native window background colors per theme mode. Light: barely-cool off-white.
+ * Dark: neutral charcoal. These match the renderer's page background so there's
+ * no flash when a compositor overlay (tooltip, dropdown) first renders on Windows.
+ * Intentionally accent-independent — the accent shows on buttons/links only.
+ *
+ * Shared between main/index.ts (BrowserWindow backgroundColor) and
+ * renderer/src/theme.ts (CSS backgroundColor on the root div) so the two never
+ * drift apart.
+ */
+export const PAGE_BACKGROUND = { light: '#f7f7f8', dark: '#161618' } as const
diff --git a/test/buildArgs.test.ts b/test/buildArgs.test.ts
index fb125d7..089ee5d 100644
--- a/test/buildArgs.test.ts
+++ b/test/buildArgs.test.ts
@@ -28,7 +28,7 @@ function opts(overrides: Partial<StartDownloadOptions> = {}): StartDownloadOptio
   return { id: 't', url: URL, kind: 'video', quality: '1080p', ...overrides }
 }
 function audio(overrides: Partial<StartDownloadOptions> = {}): StartDownloadOptions {
-  return opts({ kind: 'audio', quality: 'Best (MP3)', ...overrides })
+  return opts({ kind: 'audio', quality: 'Best', ...overrides })
 }
 function dlo(overrides: Partial<DownloadOptions> = {}): DownloadOptions {
   return { ...DEFAULT_DOWNLOAD_OPTIONS, ...overrides }
@@ -39,7 +39,7 @@ function build(
   access: AccessOptions = NO_ACCESS,
   extraArgs: string[] = []
 ): string[] {
-  return buildArgs(o, OUT, d, BIN, access, extraArgs)
+  return buildArgs({ opts: o, outputTemplate: OUT, options: d, binDir: BIN, access, extraArgs })
 }
 
 /** True when `seq` appears as a contiguous run inside `argv`. */
@@ -87,9 +87,9 @@ describe('network options', () => {
 
   it('emits --downloader <path> --downloader-args when an aria2c path is given', () => {
     const argv = build(opts(), dlo(), { ...NO_ACCESS, aria2cPath: 'C:/fake/bin/aria2c.exe' })
-    expect(hasSeq(argv, '--downloader', 'C:/fake/bin/aria2c.exe', '--downloader-args', ARIA2C_ARGS)).toBe(
-      true
-    )
+    expect(
+      hasSeq(argv, '--downloader', 'C:/fake/bin/aria2c.exe', '--downloader-args', ARIA2C_ARGS)
+    ).toBe(true)
   })
 
   it('omits --downloader when aria2cPath is not set', () => {
@@ -144,7 +144,10 @@ describe('restrictFilenames / downloadArchivePath', () => {
   })
 
   it('emits --download-archive <path> when a path is given', () => {
-    const argv = build(opts(), dlo(), { ...NO_ACCESS, downloadArchivePath: 'C:/userdata/archive.txt' })
+    const argv = build(opts(), dlo(), {
+      ...NO_ACCESS,
+      downloadArchivePath: 'C:/userdata/archive.txt'
+    })
     expect(hasSeq(argv, '--download-archive', 'C:/userdata/archive.txt')).toBe(true)
   })
 
@@ -162,7 +165,7 @@ describe('audio: -x --audio-format <fmt>', () => {
   })
 
   it('maps the quality label to an --audio-quality value', () => {
-    expect(hasSeq(build(audio({ quality: 'Best (MP3)' }), dlo()), '--audio-quality', '0')).toBe(true)
+    expect(hasSeq(build(audio({ quality: 'Best' }), dlo()), '--audio-quality', '0')).toBe(true)
     expect(hasSeq(build(audio({ quality: '320 kbps' }), dlo()), '--audio-quality', '320K')).toBe(
       true
     )
@@ -215,13 +218,19 @@ describe('embedSubtitles', () => {
 
 describe('sponsorBlock', () => {
   it('remove → --sponsorblock-remove <cats> --force-keyframes-at-cuts', () => {
-    const argv = build(opts(), dlo({ sponsorBlock: true, sponsorBlockMode: 'remove' }))
+    const argv = build(
+      opts(),
+      dlo({ sponsorBlock: true, sponsorBlockMode: 'remove', sponsorBlockCategories: ['sponsor'] })
+    )
     expect(hasSeq(argv, '--sponsorblock-remove', 'sponsor', '--force-keyframes-at-cuts')).toBe(true)
     expect(argv).not.toContain('--sponsorblock-mark')
   })
 
   it('mark → --sponsorblock-mark <cats>, no keyframe forcing', () => {
-    const argv = build(opts(), dlo({ sponsorBlock: true, sponsorBlockMode: 'mark' }))
+    const argv = build(
+      opts(),
+      dlo({ sponsorBlock: true, sponsorBlockMode: 'mark', sponsorBlockCategories: ['sponsor'] })
+    )
     expect(hasSeq(argv, '--sponsorblock-mark', 'sponsor')).toBe(true)
     expect(argv).not.toContain('--sponsorblock-remove')
     expect(argv).not.toContain('--force-keyframes-at-cuts')
@@ -247,18 +256,18 @@ describe('sponsorBlock', () => {
 
 describe('preferredVideoCodec → -S res,fps,vcodec:<token>', () => {
   it('maps av1 to the av01 codec token', () => {
-    expect(hasSeq(build(opts(), dlo({ preferredVideoCodec: 'av1' })), '-S', 'res,fps,vcodec:av01')).toBe(
-      true
-    )
+    expect(
+      hasSeq(build(opts(), dlo({ preferredVideoCodec: 'av1' })), '-S', 'res,fps,vcodec:av01')
+    ).toBe(true)
   })
 
   it('passes h264 / vp9 through verbatim', () => {
-    expect(hasSeq(build(opts(), dlo({ preferredVideoCodec: 'h264' })), '-S', 'res,fps,vcodec:h264')).toBe(
-      true
-    )
-    expect(hasSeq(build(opts(), dlo({ preferredVideoCodec: 'vp9' })), '-S', 'res,fps,vcodec:vp9')).toBe(
-      true
-    )
+    expect(
+      hasSeq(build(opts(), dlo({ preferredVideoCodec: 'h264' })), '-S', 'res,fps,vcodec:h264')
+    ).toBe(true)
+    expect(
+      hasSeq(build(opts(), dlo({ preferredVideoCodec: 'vp9' })), '-S', 'res,fps,vcodec:vp9')
+    ).toBe(true)
   })
 
   it('omits -S entirely when codec preference is "any"', () => {
@@ -274,13 +283,14 @@ describe('cropThumbnail → --ppa crop', () => {
     expect(hasSeq(argv, '--embed-thumbnail', '--ppa', CROP_SQUARE_PPA)).toBe(true)
   })
 
-  it('uses single-quoted, comma-protected crop expressions for ffmpeg', () => {
-    // The commas live inside gt(...) and MUST stay quoted so ffmpeg does not read
-    // them as filtergraph separators. The targeted-postprocessor key plus the
-    // ffmpeg_o output-args selector frame the whole value.
-    expect(CROP_SQUARE_PPA).toBe(
-      "EmbedThumbnail+ffmpeg_o:-c:v mjpeg -vf crop=\"'if(gt(ih,iw),iw,ih)':'if(gt(iw,ih),ih,iw)'\""
-    )
+  it('targets the EmbedThumbnail post-processor and uses ffmpeg output args (L39)', () => {
+    // Structural test: verify the key invariants without locking in the exact string,
+    // so minor whitespace or quoting style tweaks don't break CI.
+    expect(CROP_SQUARE_PPA).toMatch(/^EmbedThumbnail\+ffmpeg_o:/)
+    expect(CROP_SQUARE_PPA).toContain('-c:v mjpeg')
+    expect(CROP_SQUARE_PPA).toMatch(/-vf\s+crop=/)
+    // Commas inside gt() MUST be inside quotes so ffmpeg doesn't split on them.
+    expect(CROP_SQUARE_PPA).toMatch(/crop="[^"]*,/)
   })
 
   it('does not add --ppa when cropThumbnail is off', () => {
@@ -294,6 +304,16 @@ describe('cropThumbnail → --ppa crop', () => {
     expect(argv).not.toContain('--ppa')
     expect(argv).not.toContain('--embed-thumbnail')
   })
+
+  it('suppresses --embed-thumbnail for webm (not supported by the container, L38)', () => {
+    const argv = build(opts(), dlo({ embedThumbnail: true, videoContainer: 'webm' }))
+    expect(argv).not.toContain('--embed-thumbnail')
+  })
+
+  it('keeps --embed-thumbnail for mp4 container (L38)', () => {
+    const argv = build(opts(), dlo({ embedThumbnail: true, videoContainer: 'mp4' }))
+    expect(argv).toContain('--embed-thumbnail')
+  })
 })
 
 // --- Custom commands (Phase C): extra args + display formatting ------------
@@ -468,9 +488,9 @@ describe('YouTube extractor-args', () => {
       youtubePlayerClient: 'web_safari',
       youtubePoToken: 'web.gvs+ABC'
     })
-    expect(hasSeq(argv, '--extractor-args', 'youtube:player_client=web_safari;po_token=web.gvs+ABC')).toBe(
-      true
-    )
+    expect(
+      hasSeq(argv, '--extractor-args', 'youtube:player_client=web_safari;po_token=web.gvs+ABC')
+    ).toBe(true)
   })
 
   it('emits only the fields that are set', () => {
@@ -485,7 +505,10 @@ describe('YouTube extractor-args', () => {
 
 describe('format sorting (-S)', () => {
   it('emits a raw -S string when formatSort is set, overriding the codec tiebreaker', () => {
-    const argv = build(opts(), dlo({ formatSort: 'res:1080,vcodec:av01', preferredVideoCodec: 'h264' }))
+    const argv = build(
+      opts(),
+      dlo({ formatSort: 'res:1080,vcodec:av01', preferredVideoCodec: 'h264' })
+    )
     expect(hasSeq(argv, '-S', 'res:1080,vcodec:av01')).toBe(true)
     expect(hasSeq(argv, '-S', 'res,fps,vcodec:h264')).toBe(false)
   })
@@ -578,6 +601,15 @@ describe('parseTrimSections', () => {
     expect(parseTrimSections('')).toEqual([])
     expect(parseTrimSections(undefined)).toEqual([])
   })
+
+  it('rejects times with more than two colon groups (L146)', () => {
+    // H:MM:SS is the deepest valid form; a fourth component is nonsense and used
+    // to slip through to yt-dlp, failing there instead of being rejected here.
+    expect(parseTrimSections('1:2:3:4-5:6:7:8')).toEqual([])
+    expect(parseTrimSections('0:00:00:01-0:00:00:02')).toEqual([])
+    // The deepest valid form still passes.
+    expect(parseTrimSections('1:02:03-1:02:04')).toEqual(['*1:02:03-1:02:04'])
+  })
 })
 
 describe('trim (--download-sections)', () => {
@@ -655,12 +687,12 @@ describe('collectionOutputTemplate', () => {
   })
 
   it('zero-pads the index to three digits and clamps bad values to 001', () => {
-    expect(collectionOutputTemplate('C:/o', { ...ctx, index: 42 }, 'f').replace(/\\/g, '/')).toContain(
-      '/042 - f'
-    )
-    expect(collectionOutputTemplate('C:/o', { ...ctx, index: 0 }, 'f').replace(/\\/g, '/')).toContain(
-      '/001 - f'
-    )
+    expect(
+      collectionOutputTemplate('C:/o', { ...ctx, index: 42 }, 'f').replace(/\\/g, '/')
+    ).toContain('/042 - f')
+    expect(
+      collectionOutputTemplate('C:/o', { ...ctx, index: 0 }, 'f').replace(/\\/g, '/')
+    ).toContain('/001 - f')
     expect(
       collectionOutputTemplate('C:/o', { ...ctx, index: NaN }, 'f').replace(/\\/g, '/')
     ).toContain('/001 - f')
@@ -675,3 +707,43 @@ describe('collectionOutputTemplate', () => {
     expect(t.replace(/\\/g, '/')).toBe('C:/out/A B/Untitled/001 - %(title)s.%(ext)s')
   })
 })
+
+describe('metadata overrides (--replace-in-metadata)', () => {
+  it('emits --embed-metadata and --replace-in-metadata for each set field', () => {
+    const argv = build(opts(), dlo({ embedMetadata: false, metadataTitle: 'My Track' }))
+    expect(argv).toContain('--embed-metadata')
+    expect(hasSeq(argv, '--replace-in-metadata', 'title', '^.*$', 'My Track')).toBe(true)
+  })
+
+  it('emits all three override fields when all are set', () => {
+    const argv = build(opts(), dlo({ metadataTitle: 'T', metadataArtist: 'A', metadataAlbum: 'B' }))
+    expect(hasSeq(argv, '--replace-in-metadata', 'title', '^.*$', 'T')).toBe(true)
+    expect(hasSeq(argv, '--replace-in-metadata', 'artist', '^.*$', 'A')).toBe(true)
+    expect(hasSeq(argv, '--replace-in-metadata', 'album', '^.*$', 'B')).toBe(true)
+  })
+
+  it('passes a value containing a colon as a single arg without splitting', () => {
+    const argv = build(opts(), dlo({ metadataTitle: 'Foo: Bar' }))
+    expect(hasSeq(argv, '--replace-in-metadata', 'title', '^.*$', 'Foo: Bar')).toBe(true)
+  })
+
+  it('escapes backslashes in the replacement string', () => {
+    const argv = build(opts(), dlo({ metadataTitle: 'A\\B' }))
+    expect(hasSeq(argv, '--replace-in-metadata', 'title', '^.*$', 'A\\\\B')).toBe(true)
+  })
+
+  it('skips blank or whitespace-only values', () => {
+    const argv = build(opts(), dlo({ metadataTitle: '', metadataArtist: '   ' }))
+    expect(argv).not.toContain('--replace-in-metadata')
+  })
+
+  it('forces --embed-metadata even when embedMetadata is false and an override is set', () => {
+    const argv = build(opts(), dlo({ embedMetadata: false, metadataAlbum: 'Soundtrack' }))
+    expect(argv).toContain('--embed-metadata')
+  })
+
+  it('emits no override flags when no fields are set', () => {
+    const argv = build(opts(), dlo({ embedMetadata: true }))
+    expect(argv).not.toContain('--replace-in-metadata')
+  })
+})
diff --git a/test/clipboardLink.test.ts b/test/clipboardLink.test.ts
index 047e014..0e2dca1 100644
--- a/test/clipboardLink.test.ts
+++ b/test/clipboardLink.test.ts
@@ -1,5 +1,40 @@
 import { describe, it, expect } from 'vitest'
-import { looksLikeUrl, looksLikeSingleVideo } from '../src/renderer/src/useClipboardLink'
+// Import from the pure utility module directly — no Zustand store init needed (L40).
+import {
+  looksLikeUrl,
+  looksLikeSingleVideo,
+  looksLikeChannelOrPlaylist,
+  youtubeId
+} from '../src/renderer/src/lib/urlHelpers'
+
+describe('youtubeId', () => {
+  it('extracts the id from a watch URL', () => {
+    expect(youtubeId('https://www.youtube.com/watch?v=dQw4w9WgXcQ')).toBe('dQw4w9WgXcQ')
+    expect(youtubeId('https://youtube.com/watch?v=abc123&list=xyz')).toBe('abc123')
+    expect(youtubeId('https://music.youtube.com/watch?v=musicId')).toBe('musicId')
+  })
+
+  it('extracts the id from a youtu.be short link', () => {
+    expect(youtubeId('https://youtu.be/dQw4w9WgXcQ')).toBe('dQw4w9WgXcQ')
+    expect(youtubeId('https://youtu.be/abc123?t=42')).toBe('abc123')
+  })
+
+  it('extracts the id from shorts / embed / live / v paths', () => {
+    expect(youtubeId('https://www.youtube.com/shorts/shortId1')).toBe('shortId1')
+    expect(youtubeId('https://youtube.com/embed/embedId2')).toBe('embedId2')
+    expect(youtubeId('https://www.youtube.com/live/liveId3')).toBe('liveId3')
+    expect(youtubeId('https://youtube.com/v/vId4?fs=1')).toBe('vId4')
+  })
+
+  it('returns null for non-YouTube, unparseable, or empty input', () => {
+    expect(youtubeId('https://vimeo.com/12345')).toBeNull()
+    expect(youtubeId('https://notyoutube.com/watch?v=x')).toBeNull()
+    expect(youtubeId('https://www.youtube.com/@somechannel')).toBeNull()
+    expect(youtubeId('not a url')).toBeNull()
+    expect(youtubeId(undefined)).toBeNull()
+    expect(youtubeId('')).toBeNull()
+  })
+})
 
 describe('looksLikeUrl', () => {
   it('accepts http(s) URLs', () => {
@@ -73,3 +108,37 @@ describe('looksLikeSingleVideo', () => {
     expect(looksLikeSingleVideo('')).toBe(false)
   })
 })
+
+describe('looksLikeChannelOrPlaylist', () => {
+  it('flags YouTube channel URLs', () => {
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/@SomeChannel')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/@SomeChannel/videos')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/channel/UC123')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/c/SomeChannel')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/user/SomeUser')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://m.youtube.com/@SomeChannel')).toBe(true)
+  })
+
+  it('flags a dedicated playlist page', () => {
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/playlist?list=PL123')).toBe(true)
+    expect(looksLikeChannelOrPlaylist('https://music.youtube.com/playlist?list=PL123')).toBe(true)
+  })
+
+  it('does not flag single videos, even inside a playlist context', () => {
+    // A /watch video belongs in the Downloads bar, not the Library — even with a list.
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/watch?v=abc')).toBe(false)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/watch?v=abc&list=PL123')).toBe(false)
+    expect(looksLikeChannelOrPlaylist('https://youtu.be/dQw4w9WgXcQ')).toBe(false)
+  })
+
+  it('does not flag non-YouTube hosts or a bare playlist path without a list', () => {
+    expect(looksLikeChannelOrPlaylist('https://vimeo.com/channels/staffpicks')).toBe(false)
+    expect(looksLikeChannelOrPlaylist('https://example.com/@handle')).toBe(false)
+    expect(looksLikeChannelOrPlaylist('https://www.youtube.com/playlist')).toBe(false)
+  })
+
+  it('returns false for non-URLs', () => {
+    expect(looksLikeChannelOrPlaylist('not a url')).toBe(false)
+    expect(looksLikeChannelOrPlaylist('')).toBe(false)
+  })
+})
diff --git a/test/datetime.test.ts b/test/datetime.test.ts
new file mode 100644
index 0000000..19e1175
--- /dev/null
+++ b/test/datetime.test.ts
@@ -0,0 +1,43 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { relTime, formatWhen, fmtSchedule } from '../src/renderer/src/datetime'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('relTime', () => {
+  it('returns "never" for a missing timestamp', () => {
+    expect(relTime(undefined)).toBe('never')
+    expect(relTime(0)).toBe('never')
+  })
+
+  it('buckets into just now / minutes / hours / days', () => {
+    const now = new Date('2026-06-30T12:00:00Z').getTime()
+    vi.useFakeTimers()
+    vi.setSystemTime(now)
+    expect(relTime(now - 20 * 1000)).toBe('just now') // < 1 min
+    expect(relTime(now - 5 * 60_000)).toBe('5 min ago')
+    expect(relTime(now - 3 * 3_600_000)).toBe('3 h ago')
+    expect(relTime(now - 2 * 86_400_000)).toBe('2 d ago')
+  })
+})
+
+describe('formatWhen', () => {
+  it('labels today and yesterday with the time, older with a date', () => {
+    const now = new Date('2026-06-30T12:00:00Z').getTime()
+    vi.useFakeTimers()
+    vi.setSystemTime(now)
+    expect(formatWhen(now)).toMatch(/^Today, /)
+    expect(formatWhen(now - 86_400_000)).toMatch(/^Yesterday, /)
+    // A clearly-older timestamp falls through to an absolute date (with year).
+    expect(formatWhen(new Date('2025-01-05T09:00:00Z').getTime())).toMatch(/2025/)
+  })
+})
+
+describe('fmtSchedule', () => {
+  it('formats a valid timestamp and never throws', () => {
+    expect(fmtSchedule(new Date('2026-06-30T15:04:00Z').getTime())).toMatch(/2026/)
+    // Defensive: NaN can't be formatted but must not throw.
+    expect(typeof fmtSchedule(Number.NaN)).toBe('string')
+  })
+})
diff --git a/test/download.test.ts b/test/download.test.ts
new file mode 100644
index 0000000..d81a7bb
--- /dev/null
+++ b/test/download.test.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect } from 'vitest'
+// Import from the pure modules directly — no electron import chain (L37).
+import { parseProgress } from '../src/main/lib/formatters'
+import { fmtBytes, fmtEta } from '../src/shared/format'
+
+describe('fmtBytes', () => {
+  it('formats bytes under 1 KB verbatim', () => {
+    expect(fmtBytes(0)).toBe('0 B')
+    expect(fmtBytes(512)).toBe('512 B')
+    expect(fmtBytes(1023)).toBe('1023 B')
+  })
+
+  it('switches to KB at 1024', () => {
+    expect(fmtBytes(1024)).toBe('1.0 KB')
+    expect(fmtBytes(1536)).toBe('1.5 KB')
+  })
+
+  it('uses one decimal below 100, none above', () => {
+    expect(fmtBytes(99 * 1024)).toBe('99.0 KB')
+    expect(fmtBytes(100 * 1024)).toBe('100 KB')
+    expect(fmtBytes(150 * 1024)).toBe('150 KB')
+  })
+
+  it('switches to MB and GB', () => {
+    expect(fmtBytes(1024 * 1024)).toBe('1.0 MB')
+    expect(fmtBytes(1024 * 1024 * 1024)).toBe('1.0 GB')
+  })
+})
+
+describe('fmtEta', () => {
+  it('returns undefined for null / undefined input', () => {
+    expect(fmtEta(undefined)).toBeUndefined()
+    expect(fmtEta(null as unknown as number)).toBeUndefined()
+  })
+
+  it('formats seconds to M:SS', () => {
+    expect(fmtEta(0)).toBe('0:00')
+    expect(fmtEta(59)).toBe('0:59')
+    expect(fmtEta(60)).toBe('1:00')
+    expect(fmtEta(90)).toBe('1:30')
+    expect(fmtEta(3599)).toBe('59:59')
+  })
+
+  it('formats hours to H:MM:SS (L166)', () => {
+    expect(fmtEta(3600)).toBe('1:00:00')
+    expect(fmtEta(3661)).toBe('1:01:01')
+    expect(fmtEta(7260)).toBe('2:01:00')
+    expect(fmtEta(7384)).toBe('2:03:04')
+  })
+
+  it('clamps negative input to 0', () => {
+    expect(fmtEta(-10)).toBe('0:00')
+  })
+})
+
+describe('parseProgress', () => {
+  const makeRaw = (parts: string[]): string => parts.join('|')
+
+  it('returns null when there are fewer than 6 fields', () => {
+    expect(parseProgress('')).toBeNull()
+    expect(parseProgress('downloading|100|200|200')).toBeNull()
+  })
+
+  it('parses a normal progress line', () => {
+    // status | downloaded | total | totalEst | speed | eta
+    const raw = makeRaw(['downloading', '524288', '1048576', '1048576', '262144', '2'])
+    const p = parseProgress(raw)
+    expect(p).not.toBeNull()
+    expect(p!.progress).toBeCloseTo(0.5)
+    expect(p!.speedBytesPerSec).toBe(262144)
+    expect(p!.etaSeconds).toBe(2)
+    expect(p!.sizeLabel).toBe('1.0 MB')
+    expect(p!.sizeUnknown).toBe(false)
+  })
+
+  it('falls back to totalEst when total is NA', () => {
+    const raw = makeRaw(['downloading', '100', 'NA', '1000', '50', '18'])
+    const p = parseProgress(raw)
+    expect(p).not.toBeNull()
+    expect(p!.sizeLabel).toBe('1000 B')
+    expect(p!.sizeUnknown).toBe(false)
+  })
+
+  it('marks sizeUnknown when both total and totalEst are NA', () => {
+    const raw = makeRaw(['downloading', '100', 'NA', 'NA', 'NA', 'NA'])
+    const p = parseProgress(raw)
+    expect(p).not.toBeNull()
+    expect(p!.sizeUnknown).toBe(true)
+    expect(p!.etaSeconds).toBeUndefined()
+    expect(p!.speedBytesPerSec).toBeUndefined()
+  })
+
+  it('clamps progress to 1.0', () => {
+    const raw = makeRaw(['downloading', '2000', '1000', '1000', '500', '0'])
+    const p = parseProgress(raw)
+    expect(p!.progress).toBe(1)
+  })
+
+  it('carries a raw ETA in seconds; the renderer formats it (L166)', () => {
+    const raw = makeRaw(['downloading', '100', '1000', '1000', '10', '3661'])
+    const p = parseProgress(raw)
+    expect(p!.etaSeconds).toBe(3661)
+    expect(fmtEta(p!.etaSeconds)).toBe('1:01:01')
+  })
+})
diff --git a/test/exec.test.ts b/test/exec.test.ts
new file mode 100644
index 0000000..c24be67
--- /dev/null
+++ b/test/exec.test.ts
@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest'
+import { execFileAsync } from '../src/main/lib/exec'
+
+// Exercised against the Node binary itself so the test needs no fixtures and is
+// deterministic. Covers the contract the six migrated spawn sites rely on
+// (SIMP2/CC4/CC5): normalized ok/stdout/stderr, never-rejects, and the timedOut flag.
+describe('execFileAsync (SIMP2/CC4/CC5)', () => {
+  it('resolves ok with stdout on a clean exit', async () => {
+    const r = await execFileAsync(process.execPath, ['-e', 'process.stdout.write("hello")'])
+    expect(r.ok).toBe(true)
+    expect(r.stdout).toBe('hello')
+    expect(r.timedOut).toBe(false)
+    expect(r.error).toBeUndefined()
+  })
+
+  it('captures stderr and reports not-ok on a non-zero exit', async () => {
+    const r = await execFileAsync(process.execPath, [
+      '-e',
+      'process.stderr.write("boom"); process.exit(2)'
+    ])
+    expect(r.ok).toBe(false)
+    expect(r.stderr).toContain('boom')
+    expect(r.error).toBeInstanceOf(Error)
+    expect(r.timedOut).toBe(false)
+  })
+
+  it('never rejects — a missing binary resolves not-ok with an error', async () => {
+    const r = await execFileAsync('definitely-not-a-real-binary-xyz', ['--version'])
+    expect(r.ok).toBe(false)
+    expect(r.error).toBeDefined()
+    expect(r.timedOut).toBe(false)
+  })
+
+  it('flags timedOut when the timeout kills the process', async () => {
+    const r = await execFileAsync(process.execPath, ['-e', 'setTimeout(() => {}, 5000)'], {
+      timeout: 100
+    })
+    expect(r.ok).toBe(false)
+    expect(r.timedOut).toBe(true)
+  })
+})
diff --git a/test/id.test.ts b/test/id.test.ts
new file mode 100644
index 0000000..d43acc5
--- /dev/null
+++ b/test/id.test.ts
@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest'
+import { newId } from '../src/renderer/src/id'
+
+describe('newId', () => {
+  it('produces unique ids across many calls', () => {
+    const ids = new Set(Array.from({ length: 1000 }, () => newId('item')))
+    expect(ids.size).toBe(1000)
+  })
+
+  it('returns a non-empty string', () => {
+    expect(newId('tpl')).toBeTruthy()
+    expect(typeof newId('t')).toBe('string')
+  })
+
+  it('falls back to a prefixed, collision-free id when crypto.randomUUID is absent', () => {
+    const orig = globalThis.crypto
+    // Simulate a host without randomUUID; the counter suffix must keep same-ms ids distinct.
+    Object.defineProperty(globalThis, 'crypto', { value: {}, configurable: true })
+    try {
+      const a = newId('item')
+      const b = newId('item')
+      expect(a).toMatch(/^item-/)
+      expect(a).not.toBe(b)
+    } finally {
+      Object.defineProperty(globalThis, 'crypto', { value: orig, configurable: true })
+    }
+  })
+})
diff --git a/test/jsonStore.test.ts b/test/jsonStore.test.ts
new file mode 100644
index 0000000..b81b550
--- /dev/null
+++ b/test/jsonStore.test.ts
@@ -0,0 +1,79 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync, readdirSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { readJsonArraySafe, writeJsonAtomic } from '../src/main/jsonStore'
+import { logger } from '../src/main/logger'
+
+interface Row {
+  id: string
+}
+const isRow = (o: unknown): o is Row =>
+  typeof o === 'object' && o !== null && typeof (o as Row).id === 'string'
+
+describe('jsonStore atomic write + safe read', () => {
+  const dirs: string[] = []
+  function tmp(): string {
+    const d = mkdtempSync(join(tmpdir(), 'aerofetch-jsonstore-'))
+    dirs.push(d)
+    return d
+  }
+  afterEach(() => {
+    for (const d of dirs.splice(0)) {
+      try {
+        rmSync(d, { recursive: true, force: true })
+      } catch {
+        /* ignore */
+      }
+    }
+  })
+
+  it('round-trips a valid array (R1 write → read)', () => {
+    const file = join(tmp(), 'data.json')
+    writeJsonAtomic(file, [{ id: 'a' }, { id: 'b' }])
+    expect(readJsonArraySafe(file, isRow)).toEqual([{ id: 'a' }, { id: 'b' }])
+  })
+
+  it('leaves no .tmp file behind (atomic temp+rename)', () => {
+    const d = tmp()
+    writeJsonAtomic(join(d, 'data.json'), [{ id: 'a' }])
+    expect(readdirSync(d)).toEqual(['data.json'])
+  })
+
+  it('returns [] for a missing file (first run)', () => {
+    expect(readJsonArraySafe(join(tmp(), 'nope.json'), isRow)).toEqual([])
+  })
+
+  it('drops rows that fail validation', () => {
+    const file = join(tmp(), 'data.json')
+    writeFileSync(file, JSON.stringify([{ id: 'a' }, { nope: 1 }, { id: 'c' }]))
+    expect(readJsonArraySafe(file, isRow)).toEqual([{ id: 'a' }, { id: 'c' }])
+  })
+
+  it('reports success/failure instead of swallowing a bad write (R6)', () => {
+    const d = tmp()
+    const err = vi.spyOn(logger, 'error').mockImplementation(() => {})
+    try {
+      // A normal write lands and reports true, with nothing logged.
+      expect(writeJsonAtomic(join(d, 'data.json'), [{ id: 'a' }])).toBe(true)
+      expect(err).not.toHaveBeenCalled()
+      // A target under a non-existent directory can't be written — it must report
+      // false (so a caller can warn/retry) and log, not throw or silently drop it.
+      expect(writeJsonAtomic(join(d, 'no', 'such', 'dir', 'data.json'), [{ id: 'a' }])).toBe(false)
+      expect(err).toHaveBeenCalledOnce()
+    } finally {
+      err.mockRestore()
+    }
+    // No stray .tmp left behind by the failed write.
+    expect(readdirSync(d)).toEqual(['data.json'])
+  })
+
+  it('backs up a corrupt file instead of silently wiping it (R2)', () => {
+    const d = tmp()
+    const file = join(d, 'data.json')
+    writeFileSync(file, '{ truncated, not valid json')
+    expect(readJsonArraySafe(file, isRow)).toEqual([])
+    const backups = readdirSync(d).filter((f) => f.startsWith('data.json.corrupt-'))
+    expect(backups.length).toBe(1)
+  })
+})
diff --git a/test/lineBuffer.test.ts b/test/lineBuffer.test.ts
new file mode 100644
index 0000000..f36f744
--- /dev/null
+++ b/test/lineBuffer.test.ts
@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest'
+import { createLineBuffer } from '../src/main/lib/lineBuffer'
+
+/** Collect every line a buffer emits, for assertions. */
+function collect(): { lines: string[]; buf: ReturnType<typeof createLineBuffer> } {
+  const lines: string[] = []
+  const buf = createLineBuffer((l) => lines.push(l))
+  return { lines, buf }
+}
+
+describe('createLineBuffer', () => {
+  it('emits one line per newline, without the newline', () => {
+    const { lines, buf } = collect()
+    buf.push('a\nb\nc\n')
+    expect(lines).toEqual(['a', 'b', 'c'])
+  })
+
+  it('holds a partial line until its newline arrives across chunks', () => {
+    const { lines, buf } = collect()
+    buf.push('hel')
+    expect(lines).toEqual([])
+    buf.push('lo\nwor')
+    expect(lines).toEqual(['hello'])
+    buf.push('ld\n')
+    expect(lines).toEqual(['hello', 'world'])
+  })
+
+  it('strips a trailing CR so CRLF streams split cleanly', () => {
+    const { lines, buf } = collect()
+    buf.push('one\r\ntwo\r\n')
+    expect(lines).toEqual(['one', 'two'])
+  })
+
+  it('flush emits a trailing partial line that never saw a newline', () => {
+    const { lines, buf } = collect()
+    buf.push('no newline here')
+    expect(lines).toEqual([])
+    buf.flush()
+    expect(lines).toEqual(['no newline here'])
+  })
+
+  it('flush is a no-op when the buffer is empty (e.g. stream ended on a newline)', () => {
+    const { lines, buf } = collect()
+    buf.push('done\n')
+    buf.flush()
+    buf.flush()
+    expect(lines).toEqual(['done'])
+  })
+
+  it('preserves empty lines between consecutive newlines', () => {
+    const { lines, buf } = collect()
+    buf.push('a\n\nb\n')
+    expect(lines).toEqual(['a', '', 'b'])
+  })
+
+  it('splits a multi-line chunk that arrives all at once', () => {
+    const { lines, buf } = collect()
+    buf.push('1\n2\n3')
+    expect(lines).toEqual(['1', '2'])
+    buf.flush()
+    expect(lines).toEqual(['1', '2', '3'])
+  })
+})
diff --git a/test/logger.test.ts b/test/logger.test.ts
new file mode 100644
index 0000000..c10f32c
--- /dev/null
+++ b/test/logger.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest'
+import { formatLine, composeMessage, logger } from '../src/main/logger'
+
+// The logger's file sink needs Electron's `app` (userData path), which is absent in
+// the node test env — so here we cover the pure formatting helpers and assert that
+// the impure entry points degrade to a safe no-op rather than throwing (CC8).
+describe('logger (CC8)', () => {
+  const now = new Date('2026-07-01T08:30:00.000Z')
+
+  it('formatLine renders ISO timestamp + upper-case level + message', () => {
+    expect(formatLine('error', 'boom', now)).toBe('2026-07-01T08:30:00.000Z [ERROR] boom')
+    expect(formatLine('info', 'hi', now)).toBe('2026-07-01T08:30:00.000Z [INFO] hi')
+  })
+
+  it('composeMessage passes the label through when there is no detail', () => {
+    expect(composeMessage('settings write failed')).toBe('settings write failed')
+  })
+
+  it('composeMessage appends an Error message', () => {
+    expect(composeMessage('write failed', new Error('ENOSPC'))).toBe('write failed: ENOSPC')
+  })
+
+  it('composeMessage stringifies a non-Error detail', () => {
+    expect(composeMessage('op', 42)).toBe('op: 42')
+    expect(composeMessage('op', 'bad input')).toBe('op: bad input')
+  })
+
+  it('logger.error is a safe no-op when app/userData is unavailable', () => {
+    expect(() => logger.error('some op', new Error('x'))).not.toThrow()
+  })
+})
diff --git a/test/queuePersist.test.ts b/test/queuePersist.test.ts
new file mode 100644
index 0000000..63b0d74
--- /dev/null
+++ b/test/queuePersist.test.ts
@@ -0,0 +1,75 @@
+import { describe, it, expect } from 'vitest'
+import {
+  toPersisted,
+  fromPersisted,
+  persistableItems
+} from '../src/renderer/src/store/queuePersist'
+import type { DownloadItem } from '../src/renderer/src/store/downloadTypes'
+
+function item(over: Partial<DownloadItem>): DownloadItem {
+  return {
+    id: 'i1',
+    url: 'https://example.com/1',
+    title: 'Title',
+    kind: 'video',
+    quality: '1080p',
+    status: 'queued',
+    progress: 0,
+    ...over
+  }
+}
+
+describe('queuePersist (M4)', () => {
+  it('keeps pending states and drops transient completed/canceled', () => {
+    const items = [
+      item({ id: 'q', status: 'queued' }),
+      item({ id: 'd', status: 'downloading' }),
+      item({ id: 'p', status: 'paused' }),
+      item({ id: 's', status: 'saved', scheduledFor: 123 }),
+      item({ id: 'e', status: 'error', error: 'boom' }),
+      item({ id: 'c', status: 'completed' }),
+      item({ id: 'x', status: 'canceled' })
+    ]
+    expect(persistableItems(items).map((i) => i.id)).toEqual(['q', 'd', 'p', 's', 'e'])
+  })
+
+  it('drops runtime-only fields when persisting', () => {
+    const p = toPersisted(
+      item({
+        progress: 0.5,
+        speedBytesPerSec: 1000,
+        etaSeconds: 10,
+        sizeLabel: '5 MB',
+        finishing: true
+      })
+    )
+    expect(p).not.toHaveProperty('progress')
+    expect(p).not.toHaveProperty('speedBytesPerSec')
+    expect(p).not.toHaveProperty('etaSeconds')
+    expect(p).not.toHaveProperty('sizeLabel')
+    expect(p).not.toHaveProperty('finishing')
+  })
+
+  it('normalizes a downloading item back to queued with progress 0 on restore', () => {
+    const restored = fromPersisted(toPersisted(item({ status: 'downloading', progress: 0.7 })))
+    expect(restored.status).toBe('queued')
+    expect(restored.progress).toBe(0)
+  })
+
+  it('preserves saved + scheduledFor across a round-trip (the core M4 promise)', () => {
+    const restored = fromPersisted(toPersisted(item({ status: 'saved', scheduledFor: 999 })))
+    expect(restored.status).toBe('saved')
+    expect(restored.scheduledFor).toBe(999)
+  })
+
+  it('round-trips durable fields (formatId/trim/incognito)', () => {
+    const restored = fromPersisted(
+      toPersisted(
+        item({ formatId: '137', formatHasAudio: false, trim: '1:00-2:00', incognito: true })
+      )
+    )
+    expect(restored.formatId).toBe('137')
+    expect(restored.trim).toBe('1:00-2:00')
+    expect(restored.incognito).toBe(true)
+  })
+})
diff --git a/test/queueStats.test.ts b/test/queueStats.test.ts
index 50f9de7..09a2291 100644
--- a/test/queueStats.test.ts
+++ b/test/queueStats.test.ts
@@ -48,19 +48,25 @@ describe('summarizeQueue', () => {
     expect(s.progress).toBeCloseTo(0.4, 5)
   })
 
-  it('sums download speeds across MB/s and MiB/s strings', () => {
+  it('sums raw download rates into one formatted label', () => {
+    const MB = 1024 * 1024
     const s = summarizeQueue([
-      item({ status: 'downloading', progress: 0.1, speed: '4.0 MB/s' }),
-      item({ status: 'downloading', progress: 0.1, speed: '2000 KiB/s' })
+      item({ status: 'downloading', progress: 0.1, speedBytesPerSec: 4 * MB }),
+      item({ status: 'downloading', progress: 0.1, speedBytesPerSec: 2 * MB })
     ])
-    // 4.0 MB/s + ~2.0 MB/s ≈ 6.0 MB/s
+    // 4 MB/s + 2 MB/s = 6 MB/s
     expect(s.speedLabel).toBe('6.0 MB/s')
   })
 
+  it('leaves the speed label empty when no item reports a rate', () => {
+    const s = summarizeQueue([item({ status: 'downloading', progress: 0.1 })])
+    expect(s.speedLabel).toBe('')
+  })
+
   it('reports the longest active ETA as the time left', () => {
     const s = summarizeQueue([
-      item({ status: 'downloading', progress: 0.5, eta: '0:30' }),
-      item({ status: 'downloading', progress: 0.2, eta: '2:10' })
+      item({ status: 'downloading', progress: 0.5, etaSeconds: 30 }),
+      item({ status: 'downloading', progress: 0.2, etaSeconds: 130 })
     ])
     expect(s.etaLabel).toBe('2:10')
   })
@@ -73,10 +79,7 @@ describe('sameVideo', () => {
 
   it('matches YouTube links by video id across watch/youtu.be/extra params', () => {
     expect(
-      sameVideo(
-        'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
-        'https://youtu.be/dQw4w9WgXcQ'
-      )
+      sameVideo('https://www.youtube.com/watch?v=dQw4w9WgXcQ', 'https://youtu.be/dQw4w9WgXcQ')
     ).toBe(true)
     expect(
       sameVideo(
diff --git a/test/real-download.integration.test.ts b/test/real-download.integration.test.ts
index 2d5aa1b..967aea0 100644
--- a/test/real-download.integration.test.ts
+++ b/test/real-download.integration.test.ts
@@ -72,10 +72,14 @@ function parseCoverDims(info: string): { w: number; h: number } | undefined {
 }
 
 function probeSourceDuration(url: string): number | undefined {
-  const r = spawnSync(YTDLP, ['--no-warnings', '--no-playlist', '--print', '%(duration)s', '--', url], {
-    encoding: 'utf8',
-    windowsHide: true
-  })
+  const r = spawnSync(
+    YTDLP,
+    ['--no-warnings', '--no-playlist', '--print', '%(duration)s', '--', url],
+    {
+      encoding: 'utf8',
+      windowsHide: true
+    }
+  )
   const n = Number((r.stdout || '').trim())
   return Number.isFinite(n) ? n : undefined
 }
@@ -95,7 +99,16 @@ function ffprobeJson(file: string): {
 } {
   const r = spawnSync(
     FFPROBE,
-    ['-v', 'quiet', '-print_format', 'json', '-show_format', '-show_streams', '-show_chapters', file],
+    [
+      '-v',
+      'quiet',
+      '-print_format',
+      'json',
+      '-show_format',
+      '-show_streams',
+      '-show_chapters',
+      file
+    ],
     { encoding: 'utf8', windowsHide: true, maxBuffer: 32 * 1024 * 1024 }
   )
   try {
@@ -128,262 +141,305 @@ afterAll(() => {
 })
 
 describe.skipIf(!RUN)('real yt-dlp downloads (buildArgs end-to-end)', () => {
-  it(
-    'cropThumbnail: audio mp3 gets a SQUARE embedded cover (--ppa crop survives ffmpeg)',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'crop',
-        url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // "Me at the zoo", 19s
-        kind: 'audio',
-        quality: 'Best (MP3)'
-      }
-      const options = {
-        ...DEFAULT_DOWNLOAD_OPTIONS,
-        audioFormat: 'mp3' as const,
-        embedThumbnail: true,
-        cropThumbnail: true
-      }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
-      console.log('[crop] argv:', JSON.stringify(argv))
+  it('cropThumbnail: audio mp3 gets a SQUARE embedded cover (--ppa crop survives ffmpeg)', () => {
+    const opts: StartDownloadOptions = {
+      id: 'crop',
+      url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // "Me at the zoo", 19s
+      kind: 'audio',
+      quality: 'Best'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      audioFormat: 'mp3' as const,
+      embedThumbnail: true,
+      cropThumbnail: true
+    }
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS
+    })
+    console.log('[crop] argv:', JSON.stringify(argv))
 
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[crop] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
-      expect(existsSync(res.filePath!)).toBe(true)
-      expect(statSync(res.filePath!).size).toBeGreaterThan(1000)
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[crop] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+    expect(existsSync(res.filePath!)).toBe(true)
+    expect(statSync(res.filePath!).size).toBeGreaterThan(1000)
 
-      const info = ffinfo(res.filePath!)
-      const dims = parseCoverDims(info)
-      console.log('[crop] output:', res.filePath, 'cover dims:', dims)
-      expect(dims, 'embedded cover image should be present').toBeTruthy()
-      expect(dims!.w, 'cover must be cropped to a square').toBe(dims!.h)
-    },
-    240_000
-  )
+    const info = ffinfo(res.filePath!)
+    const dims = parseCoverDims(info)
+    console.log('[crop] output:', res.filePath, 'cover dims:', dims)
+    expect(dims, 'embedded cover image should be present').toBeTruthy()
+    expect(dims!.w, 'cover must be cropped to a square').toBe(dims!.h)
+  }, 240_000)
 
-  it(
-    'sponsorBlock remove: output is shorter than source by the removed segments',
-    () => {
-      const url = 'https://www.youtube.com/watch?v=kJQP7kiw5Fk' // has ~54s of music_offtopic
-      const source = probeSourceDuration(url)
-      console.log('[sb] source duration:', source)
-      expect(source, 'should read source duration').toBeGreaterThan(60)
+  it('sponsorBlock remove: output is shorter than source by the removed segments', () => {
+    const url = 'https://www.youtube.com/watch?v=kJQP7kiw5Fk' // has ~54s of music_offtopic
+    const source = probeSourceDuration(url)
+    console.log('[sb] source duration:', source)
+    expect(source, 'should read source duration').toBeGreaterThan(60)
 
-      const opts: StartDownloadOptions = {
-        id: 'sb',
-        url,
-        kind: 'audio',
-        quality: 'Best (MP3)'
-      }
-      const options = {
-        ...DEFAULT_DOWNLOAD_OPTIONS,
-        audioFormat: 'mp3' as const,
-        embedThumbnail: false,
-        sponsorBlock: true,
-        sponsorBlockMode: 'remove' as const,
-        sponsorBlockCategories: ['music_offtopic' as const]
-      }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
-      console.log('[sb] argv:', JSON.stringify(argv))
+    const opts: StartDownloadOptions = {
+      id: 'sb',
+      url,
+      kind: 'audio',
+      quality: 'Best'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      audioFormat: 'mp3' as const,
+      embedThumbnail: false,
+      sponsorBlock: true,
+      sponsorBlockMode: 'remove' as const,
+      sponsorBlockCategories: ['music_offtopic' as const]
+    }
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS
+    })
+    console.log('[sb] argv:', JSON.stringify(argv))
 
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[sb] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath).toBeTruthy()
-      expect(existsSync(res.filePath!)).toBe(true)
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[sb] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath).toBeTruthy()
+    expect(existsSync(res.filePath!)).toBe(true)
 
-      const outDur = parseDurationSec(ffinfo(res.filePath!))
-      console.log('[sb] output duration:', outDur, 'removed ≈', (source ?? 0) - (outDur ?? 0), 's')
-      expect(outDur, 'should read output duration').toBeGreaterThan(0)
-      // ~54s of segments are removed; require a clear, unambiguous shrink.
-      expect(source! - outDur!).toBeGreaterThan(30)
-    },
-    240_000
-  )
+    const outDur = parseDurationSec(ffinfo(res.filePath!))
+    console.log('[sb] output duration:', outDur, 'removed ≈', (source ?? 0) - (outDur ?? 0), 's')
+    expect(outDur, 'should read output duration').toBeGreaterThan(0)
+    // ~54s of segments are removed; require a clear, unambiguous shrink.
+    expect(source! - outDur!).toBeGreaterThan(30)
+  }, 240_000)
 
-  it(
-    'audioFormat opus: --audio-format re-encodes to a real .opus stream',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'opus',
-        url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw',
-        kind: 'audio',
-        quality: 'Best'
-      }
-      const options = {
-        ...DEFAULT_DOWNLOAD_OPTIONS,
-        audioFormat: 'opus' as const,
-        embedThumbnail: false
-      }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[opus] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
-      expect(res.filePath!.toLowerCase().endsWith('.opus'), 'output ext should be .opus').toBe(true)
+  it('audioFormat opus: --audio-format re-encodes to a real .opus stream', () => {
+    const opts: StartDownloadOptions = {
+      id: 'opus',
+      url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw',
+      kind: 'audio',
+      quality: 'Best'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      audioFormat: 'opus' as const,
+      embedThumbnail: false
+    }
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS
+    })
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[opus] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+    expect(res.filePath!.toLowerCase().endsWith('.opus'), 'output ext should be .opus').toBe(true)
 
-      const audio = streamsOfType(res.filePath!, 'audio')
-      console.log('[opus] audio codecs:', audio.map((s) => s.codec_name))
-      expect(audio.length, 'should have one audio stream').toBeGreaterThan(0)
-      expect(audio[0].codec_name, '--audio-format opus should produce opus').toBe('opus')
-    },
-    240_000
-  )
+    const audio = streamsOfType(res.filePath!, 'audio')
+    console.log(
+      '[opus] audio codecs:',
+      audio.map((s) => s.codec_name)
+    )
+    expect(audio.length, 'should have one audio stream').toBeGreaterThan(0)
+    expect(audio[0].codec_name, '--audio-format opus should produce opus').toBe('opus')
+  }, 240_000)
 
-  it(
-    'video mkv + vp9 preference: merged .mkv carries a vp9 video stream + audio',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'mkv-vp9',
-        url: 'https://www.youtube.com/watch?v=kJQP7kiw5Fk', // serves both vp9 + av01 at 360p
-        kind: 'video',
-        quality: '360p'
-      }
-      const options = {
-        ...DEFAULT_DOWNLOAD_OPTIONS,
-        videoContainer: 'mkv' as const,
-        preferredVideoCodec: 'vp9' as const,
-        embedThumbnail: false
-      }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
-      console.log('[mkv-vp9] argv:', JSON.stringify(argv))
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[mkv-vp9] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
-      expect(res.filePath!.toLowerCase().endsWith('.mkv'), 'output ext should be .mkv').toBe(true)
+  it('video mkv + vp9 preference: merged .mkv carries a vp9 video stream + audio', () => {
+    const opts: StartDownloadOptions = {
+      id: 'mkv-vp9',
+      url: 'https://www.youtube.com/watch?v=kJQP7kiw5Fk', // serves both vp9 + av01 at 360p
+      kind: 'video',
+      quality: '360p'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      videoContainer: 'mkv' as const,
+      preferredVideoCodec: 'vp9' as const,
+      embedThumbnail: false
+    }
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS
+    })
+    console.log('[mkv-vp9] argv:', JSON.stringify(argv))
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[mkv-vp9] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+    expect(res.filePath!.toLowerCase().endsWith('.mkv'), 'output ext should be .mkv').toBe(true)
 
-      const video = streamsOfType(res.filePath!, 'video')
-      const audio = streamsOfType(res.filePath!, 'audio')
-      console.log('[mkv-vp9] video:', video.map((s) => s.codec_name), 'audio:', audio.map((s) => s.codec_name))
-      expect(video.length, 'should have a video stream').toBeGreaterThan(0)
-      expect(audio.length, 'merge should pull in a separate audio stream').toBeGreaterThan(0)
-      expect(video[0].codec_name, 'the vcodec sort should steer to vp9').toBe('vp9')
-    },
-    240_000
-  )
+    const video = streamsOfType(res.filePath!, 'video')
+    const audio = streamsOfType(res.filePath!, 'audio')
+    console.log(
+      '[mkv-vp9] video:',
+      video.map((s) => s.codec_name),
+      'audio:',
+      audio.map((s) => s.codec_name)
+    )
+    expect(video.length, 'should have a video stream').toBeGreaterThan(0)
+    expect(audio.length, 'merge should pull in a separate audio stream').toBeGreaterThan(0)
+    expect(video[0].codec_name, 'the vcodec sort should steer to vp9').toBe('vp9')
+  }, 240_000)
 
-  it(
-    'embed auto-subtitles + chapters (mp4): mov_text subtitle stream and all 3 chapters',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'subs-ch',
-        url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // has en auto-captions + 3 chapters
-        kind: 'video',
-        quality: '360p'
-      }
-      const options = {
-        ...DEFAULT_DOWNLOAD_OPTIONS,
-        videoContainer: 'mp4' as const,
-        embedSubtitles: true,
-        autoSubtitles: true,
-        subtitleLanguages: 'en',
-        embedChapters: true,
-        embedThumbnail: false
-      }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
-      console.log('[subs-ch] argv:', JSON.stringify(argv))
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[subs-ch] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+  it('embed auto-subtitles + chapters (mp4): mov_text subtitle stream and all 3 chapters', () => {
+    const opts: StartDownloadOptions = {
+      id: 'subs-ch',
+      url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // has en auto-captions + 3 chapters
+      kind: 'video',
+      quality: '360p'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      videoContainer: 'mp4' as const,
+      embedSubtitles: true,
+      autoSubtitles: true,
+      subtitleLanguages: 'en',
+      embedChapters: true,
+      embedThumbnail: false
+    }
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS
+    })
+    console.log('[subs-ch] argv:', JSON.stringify(argv))
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[subs-ch] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
 
-      const info = ffprobeJson(res.filePath!)
-      const subs = (info.streams ?? []).filter((s) => s.codec_type === 'subtitle')
-      const chapters = info.chapters ?? []
-      console.log('[subs-ch] subtitles:', subs.map((s) => s.codec_name), 'chapters:', chapters.length)
-      expect(subs.length, 'an en auto-caption should be embedded').toBeGreaterThan(0)
-      expect(subs[0].codec_name, 'mp4 subtitles convert to mov_text').toBe('mov_text')
-      expect(chapters.length, 'all 3 source chapters should be embedded').toBe(3)
-    },
-    240_000
-  )
+    const info = ffprobeJson(res.filePath!)
+    const subs = (info.streams ?? []).filter((s) => s.codec_type === 'subtitle')
+    const chapters = info.chapters ?? []
+    console.log(
+      '[subs-ch] subtitles:',
+      subs.map((s) => s.codec_name),
+      'chapters:',
+      chapters.length
+    )
+    expect(subs.length, 'an en auto-caption should be embedded').toBeGreaterThan(0)
+    expect(subs[0].codec_name, 'mp4 subtitles convert to mov_text').toBe('mov_text')
+    expect(chapters.length, 'all 3 source chapters should be embedded').toBe(3)
+  }, 240_000)
 
-  it(
-    'restrictFilenames: output basename is sanitized to a portable ASCII subset',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'restrict',
-        url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // title "Me at the zoo"
-        kind: 'audio',
-        quality: 'Best'
-      }
-      const options = { ...DEFAULT_DOWNLOAD_OPTIONS, audioFormat: 'mp3' as const, embedThumbnail: false }
-      const access = { ...NO_ACCESS, restrictFilenames: true }
-      // %(title)s so the spaces in "Me at the zoo" actually exercise the sanitizer.
-      const argv = buildArgs(opts, join(outDir, '%(title)s.%(ext)s'), options, BIN_DIR, access)
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[restrict] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+  it('restrictFilenames: output basename is sanitized to a portable ASCII subset', () => {
+    const opts: StartDownloadOptions = {
+      id: 'restrict',
+      url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', // title "Me at the zoo"
+      kind: 'audio',
+      quality: 'Best'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      audioFormat: 'mp3' as const,
+      embedThumbnail: false
+    }
+    const access = { ...NO_ACCESS, restrictFilenames: true }
+    // %(title)s so the spaces in "Me at the zoo" actually exercise the sanitizer.
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, '%(title)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access
+    })
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[restrict] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
 
-      const base = baseName(res.filePath!)
-      console.log('[restrict] basename:', base)
-      expect(base, 'a restricted filename has no spaces').not.toMatch(/\s/)
-      expect(base, 'restricted to [A-Za-z0-9._-]').toMatch(/^[A-Za-z0-9._-]+$/)
-    },
-    240_000
-  )
+    const base = baseName(res.filePath!)
+    console.log('[restrict] basename:', base)
+    expect(base, 'a restricted filename has no spaces').not.toMatch(/\s/)
+    expect(base, 'restricted to [A-Za-z0-9._-]').toMatch(/^[A-Za-z0-9._-]+$/)
+  }, 240_000)
 
-  it(
-    'downloadArchive: a second run of the same URL is skipped via the archive',
-    () => {
-      const archive = join(outDir, 'archive.txt')
-      const mk = (id: string): string[] =>
-        buildArgs(
-          { id, url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw', kind: 'audio', quality: 'Best' },
-          join(outDir, 'arch-%(id)s.%(ext)s'),
-          { ...DEFAULT_DOWNLOAD_OPTIONS, audioFormat: 'mp3' as const, embedThumbnail: false },
-          BIN_DIR,
-          { ...NO_ACCESS, downloadArchivePath: archive }
-        )
+  it('downloadArchive: a second run of the same URL is skipped via the archive', () => {
+    const archive = join(outDir, 'archive.txt')
+    const mk = (id: string): string[] =>
+      buildArgs({
+        opts: {
+          id,
+          url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw',
+          kind: 'audio',
+          quality: 'Best'
+        },
+        outputTemplate: join(outDir, 'arch-%(id)s.%(ext)s'),
+        options: {
+          ...DEFAULT_DOWNLOAD_OPTIONS,
+          audioFormat: 'mp3' as const,
+          embedThumbnail: false
+        },
+        binDir: BIN_DIR,
+        access: { ...NO_ACCESS, downloadArchivePath: archive }
+      })
 
-      const first = runYtdlp(mk('a1'))
-      if (first.status !== 0) console.error('[archive] first stderr:\n' + first.stderr)
-      expect(first.status, 'first run should download').toBe(0)
-      expect(first.filePath, 'first run should produce a file').toBeTruthy()
-      expect(existsSync(archive), 'archive file should be written').toBe(true)
+    const first = runYtdlp(mk('a1'))
+    if (first.status !== 0) console.error('[archive] first stderr:\n' + first.stderr)
+    expect(first.status, 'first run should download').toBe(0)
+    expect(first.filePath, 'first run should produce a file').toBeTruthy()
+    expect(existsSync(archive), 'archive file should be written').toBe(true)
 
-      const second = runYtdlp(mk('a2'))
-      expect(second.status, 'second run should still exit 0').toBe(0)
-      // The id is in the archive, so the second run downloads nothing — and thus
-      // prints no after_move `path|` line. (yt-dlp's "has already been recorded"
-      // notice is itself silenced because buildArgs' --print implies --quiet, so
-      // we assert on the archive contents + the absence of a fresh download.)
-      expect(second.filePath, 'second run should be skipped (no new download)').toBeFalsy()
-      const archiveBody = readFileSync(archive, 'utf8')
-      console.log('[archive] archive.txt:', JSON.stringify(archiveBody.trim()))
-      expect(archiveBody, 'the archive should record the downloaded video id').toContain('jNQXAC9IVRw')
-    },
-    240_000
-  )
+    const second = runYtdlp(mk('a2'))
+    expect(second.status, 'second run should still exit 0').toBe(0)
+    // The id is in the archive, so the second run downloads nothing — and thus
+    // prints no after_move `path|` line. (yt-dlp's "has already been recorded"
+    // notice is itself silenced because buildArgs' --print implies --quiet, so
+    // we assert on the archive contents + the absence of a fresh download.)
+    expect(second.filePath, 'second run should be skipped (no new download)').toBeFalsy()
+    const archiveBody = readFileSync(archive, 'utf8')
+    console.log('[archive] archive.txt:', JSON.stringify(archiveBody.trim()))
+    expect(archiveBody, 'the archive should record the downloaded video id').toContain(
+      'jNQXAC9IVRw'
+    )
+  }, 240_000)
 
-  it(
-    'extraArgs (custom command): parseExtraArgs tokens reach yt-dlp (--write-info-json sidecar)',
-    () => {
-      const opts: StartDownloadOptions = {
-        id: 'extra',
-        url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw',
-        kind: 'audio',
-        quality: 'Best'
-      }
-      const options = { ...DEFAULT_DOWNLOAD_OPTIONS, audioFormat: 'mp3' as const, embedThumbnail: false }
-      const extra = parseExtraArgs('--write-info-json --no-mtime')
-      expect(extra, 'parseExtraArgs splits into discrete tokens').toEqual([
-        '--write-info-json',
-        '--no-mtime'
-      ])
-      const argv = buildArgs(opts, join(outDir, 'extra-%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS, extra)
-      const res = runYtdlp(argv)
-      if (res.status !== 0) console.error('[extra] stderr:\n' + res.stderr)
-      expect(res.status, 'yt-dlp should exit 0').toBe(0)
-      expect(res.filePath, 'after_move path should be printed').toBeTruthy()
+  it('extraArgs (custom command): parseExtraArgs tokens reach yt-dlp (--write-info-json sidecar)', () => {
+    const opts: StartDownloadOptions = {
+      id: 'extra',
+      url: 'https://www.youtube.com/watch?v=jNQXAC9IVRw',
+      kind: 'audio',
+      quality: 'Best'
+    }
+    const options = {
+      ...DEFAULT_DOWNLOAD_OPTIONS,
+      audioFormat: 'mp3' as const,
+      embedThumbnail: false
+    }
+    const extra = parseExtraArgs('--write-info-json --no-mtime')
+    expect(extra, 'parseExtraArgs splits into discrete tokens').toEqual([
+      '--write-info-json',
+      '--no-mtime'
+    ])
+    const argv = buildArgs({
+      opts,
+      outputTemplate: join(outDir, 'extra-%(id)s.%(ext)s'),
+      options,
+      binDir: BIN_DIR,
+      access: NO_ACCESS,
+      extraArgs: extra
+    })
+    const res = runYtdlp(argv)
+    if (res.status !== 0) console.error('[extra] stderr:\n' + res.stderr)
+    expect(res.status, 'yt-dlp should exit 0').toBe(0)
+    expect(res.filePath, 'after_move path should be printed').toBeTruthy()
 
-      const infoJson = join(outDir, 'extra-jNQXAC9IVRw.info.json')
-      console.log('[extra] info.json exists:', existsSync(infoJson))
-      expect(existsSync(infoJson), '--write-info-json should write a sidecar').toBe(true)
-    },
-    240_000
-  )
+    const infoJson = join(outDir, 'extra-jNQXAC9IVRw.info.json')
+    console.log('[extra] info.json exists:', existsSync(infoJson))
+    expect(existsSync(infoJson), '--write-info-json should write a sidecar').toBe(true)
+  }, 240_000)
 })
diff --git a/test/security-guards.test.ts b/test/security-guards.test.ts
index 9cae025..3bc6689 100644
--- a/test/security-guards.test.ts
+++ b/test/security-guards.test.ts
@@ -85,7 +85,9 @@ describe('isTrustedDownloadUrl (app-updater host pin)', () => {
 
   it('rejects the right hostname on the wrong port', () => {
     // host comparison includes the port, so :443 (default) is not the same origin
-    expect(isTrustedDownloadUrl('https://gitea.netbird.zimspace.uk/AeroFetch-Setup.exe')).toBe(false)
+    expect(isTrustedDownloadUrl('https://gitea.netbird.zimspace.uk/AeroFetch-Setup.exe')).toBe(
+      false
+    )
   })
 
   it('rejects plain http even on the update host', () => {
@@ -93,9 +95,9 @@ describe('isTrustedDownloadUrl (app-updater host pin)', () => {
   })
 
   it('is not fooled by the trusted host placed in the userinfo', () => {
-    expect(
-      isTrustedDownloadUrl('https://gitea.netbird.zimspace.uk:5938@evil.example/x.exe')
-    ).toBe(false)
+    expect(isTrustedDownloadUrl('https://gitea.netbird.zimspace.uk:5938@evil.example/x.exe')).toBe(
+      false
+    )
   })
 
   it('rejects unparseable input', () => {
@@ -130,6 +132,19 @@ describe('extractSha256 (app-updater checksum parsing)', () => {
   it('does not slice a 64-char window out of a longer hex run (e.g. sha512)', () => {
     expect(extractSha256('a'.repeat(128))).toBeNull()
   })
+
+  it('matches the hash on the line naming the asset in a combined file (B3)', () => {
+    const other = 'b'.repeat(64)
+    const combined = `${other}  OtherApp.exe\n${hash} *AeroFetch-Setup-0.5.0.exe\n`
+    // Without the filename it would pick the FIRST hash (the wrong one); with the
+    // asset name it must select the line that actually names the installer.
+    expect(extractSha256(combined)).toBe(other)
+    expect(extractSha256(combined, 'AeroFetch-Setup-0.5.0.exe')).toBe(hash)
+  })
+
+  it('falls back to the only digest when a bare file omits the filename', () => {
+    expect(extractSha256(hash, 'AeroFetch-Setup-0.5.0.exe')).toBe(hash)
+  })
 })
 
 // --- app-updater: compareVersions — prerelease never outranks its release ----
@@ -149,6 +164,15 @@ describe('compareVersions (app-updater version ordering)', () => {
     // 0.5.0-rc.1 must not be offered as an "upgrade" over a running 0.5.0
     expect(compareVersions('0.5.0-rc.1', '0.5.0')).toBe(0)
   })
+
+  it('treats missing trailing components as zero (L36)', () => {
+    // Differing component counts: the shorter version pads with 0s, so 1.2 == 1.2.0
+    // and 1.2 < 1.2.1, rather than mis-ordering on length.
+    expect(compareVersions('1.2', '1.2.0')).toBe(0)
+    expect(compareVersions('1.2', '1.2.1')).toBe(-1)
+    expect(compareVersions('1.2.1', '1.2')).toBe(1)
+    expect(compareVersions('1', '1.0.0')).toBe(0)
+  })
 })
 
 // --- F1: isYtdlpUpdateChannel — --update-to allowlist -----------------------
diff --git a/test/toasts.test.ts b/test/toasts.test.ts
new file mode 100644
index 0000000..23c14e6
--- /dev/null
+++ b/test/toasts.test.ts
@@ -0,0 +1,40 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { useToasts, toast } from '../src/renderer/src/store/toasts'
+
+describe('toasts store', () => {
+  beforeEach(() => {
+    useToasts.setState({ toasts: [] })
+    vi.useRealTimers()
+  })
+
+  it('show() adds a toast with the given message and tone', () => {
+    toast('could not open file', 'error')
+    const ts = useToasts.getState().toasts
+    expect(ts).toHaveLength(1)
+    expect(ts[0]?.message).toBe('could not open file')
+    expect(ts[0]?.tone).toBe('error')
+  })
+
+  it('defaults the tone to info', () => {
+    toast('heads up')
+    expect(useToasts.getState().toasts[0]?.tone).toBe('info')
+  })
+
+  it('dismiss() removes only the matching toast', () => {
+    toast('a')
+    toast('b')
+    const firstId = useToasts.getState().toasts[0]?.id ?? ''
+    useToasts.getState().dismiss(firstId)
+    const ts = useToasts.getState().toasts
+    expect(ts).toHaveLength(1)
+    expect(ts[0]?.message).toBe('b')
+  })
+
+  it('auto-dismisses after the timeout elapses', () => {
+    vi.useFakeTimers()
+    toast('temporary')
+    expect(useToasts.getState().toasts).toHaveLength(1)
+    vi.advanceTimersByTime(5000)
+    expect(useToasts.getState().toasts).toHaveLength(0)
+  })
+})
diff --git a/test/validation.test.ts b/test/validation.test.ts
index 6445e90..88a0e02 100644
--- a/test/validation.test.ts
+++ b/test/validation.test.ts
@@ -5,9 +5,10 @@ import {
   isValidHistoryEntry,
   isValidErrorLogEntry,
   isTemplateLike,
-  isValidSource
+  isValidSource,
+  isValidMediaItem
 } from '../src/main/validation'
-import type { HistoryEntry, ErrorLogEntry, Source } from '@shared/ipc'
+import type { HistoryEntry, ErrorLogEntry, Source, MediaItem } from '@shared/ipc'
 
 // --- S4: filename template path-traversal -----------------------------------
 
@@ -208,3 +209,52 @@ describe('isValidSource', () => {
     expect(isValidSource('nope')).toBe(false)
   })
 })
+
+// --- L35: isValidMediaItem — the persisted media-items.json row validator ----
+
+describe('isValidMediaItem', () => {
+  const valid: MediaItem = {
+    id: 'src1:vid1',
+    sourceId: 'src1',
+    videoId: 'vid1',
+    title: 'A video',
+    url: 'https://youtube.com/watch?v=vid1',
+    playlistTitle: 'Uploads',
+    playlistIndex: 1,
+    downloaded: false
+  }
+
+  it('accepts a minimal valid item', () => {
+    expect(isValidMediaItem(valid)).toBe(true)
+  })
+
+  it('accepts the optional fields when well-typed', () => {
+    expect(
+      isValidMediaItem({
+        ...valid,
+        durationLabel: '3:21',
+        downloaded: true,
+        downloadedAt: 1_700_000_000_000,
+        filePath: 'C:/Videos/a.mp4'
+      })
+    ).toBe(true)
+  })
+
+  it('rejects a missing or wrong-typed required field', () => {
+    const { videoId: _v, ...noVideoId } = valid
+    expect(isValidMediaItem(noVideoId)).toBe(false)
+    expect(isValidMediaItem({ ...valid, playlistIndex: '1' })).toBe(false)
+    expect(isValidMediaItem({ ...valid, downloaded: 'no' })).toBe(false)
+  })
+
+  it('rejects wrong-typed optional fields', () => {
+    expect(isValidMediaItem({ ...valid, durationLabel: 42 })).toBe(false)
+    expect(isValidMediaItem({ ...valid, downloadedAt: 'soon' })).toBe(false)
+    expect(isValidMediaItem({ ...valid, filePath: 99 })).toBe(false)
+  })
+
+  it('rejects non-objects', () => {
+    expect(isValidMediaItem(null)).toBe(false)
+    expect(isValidMediaItem('nope')).toBe(false)
+  })
+})
diff --git a/test/ytdlpPolicy.test.ts b/test/ytdlpPolicy.test.ts
index 1f5101e..149b181 100644
--- a/test/ytdlpPolicy.test.ts
+++ b/test/ytdlpPolicy.test.ts
@@ -31,4 +31,11 @@ describe('shouldAutoCheckYtdlp', () => {
     expect(shouldAutoCheckYtdlp(true, NOW - 30 * 60_000, NOW, hour)).toBe(false)
     expect(shouldAutoCheckYtdlp(true, NOW - hour, NOW, hour)).toBe(true)
   })
+
+  it('checks when the clock ran backward (lastCheck is in the future, R9)', () => {
+    // A backward clock correction leaves lastCheck > now → (now - lastCheck) is
+    // negative; without the guard the check would be skipped forever.
+    expect(shouldAutoCheckYtdlp(true, NOW + AUTO_UPDATE_INTERVAL_MS, NOW)).toBe(true)
+    expect(shouldAutoCheckYtdlp(true, NOW + 1, NOW)).toBe(true)
+  })
 })
diff --git a/tsconfig.node.json b/tsconfig.node.json
index f1d4bc4..0dab63b 100644
--- a/tsconfig.node.json
+++ b/tsconfig.node.json
@@ -9,6 +9,9 @@
   "compilerOptions": {
     "composite": true,
     "types": ["electron-vite/node", "node"],
+    "noImplicitAny": true,
+    "noUncheckedIndexedAccess": true,
+    "noFallthroughCasesInSwitch": true,
     "paths": {
       "@shared/*": ["./src/shared/*"]
     }
diff --git a/tsconfig.web.json b/tsconfig.web.json
index 29b549d..097d2bb 100644
--- a/tsconfig.web.json
+++ b/tsconfig.web.json
@@ -8,6 +8,9 @@
   ],
   "compilerOptions": {
     "composite": true,
+    "noImplicitAny": true,
+    "noUncheckedIndexedAccess": true,
+    "noFallthroughCasesInSwitch": true,
     "paths": {
       "@renderer/*": ["./src/renderer/src/*"],
       "@shared/*": ["./src/shared/*"]
diff --git a/vitest.config.ts b/vitest.config.ts
index 0e473c0..2542223 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -1,9 +1,11 @@
 import { resolve } from 'path'
 import { defineConfig } from 'vitest/config'
 
-// Stand-alone vitest config. The unit tests only exercise the pure arg-building
-// logic in src/main/buildArgs.ts, which imports types/consts from @shared — so we
-// just need that one alias mirrored from electron.vite.config.ts.
+// Stand-alone vitest config. The unit suites exercise the pure logic across
+// src/main and src/renderer (buildArgs, validation, datetime, id, jsonStore,
+// queueStats, indexer, deeplink, updater guards, …), all of which import
+// types/consts from @shared — so we just need that one alias mirrored from
+// electron.vite.config.ts.
 export default defineConfig({
   resolve: {
     alias: {