diff --git a/.agents/memory.md b/.agents/memory.md
deleted file mode 100644
index 86e5240..0000000
--- a/.agents/memory.md
+++ /dev/null
@@ -1,178 +0,0 @@
-# Pebrel 持久化发布记忆
-
-最后核验：2026-09-07，GitHub 仓库更名、旧链接跳转与历史发布资产一致性。1.6.0 仍为本地候选，本次没有创建正式 Release、推送发布提交或移动版本标签。
-
-本文记录已经实际遇到并核实的发布陷阱，以及后续版本可直接执行的 Release Note 与 GitHub Release 规则。它不保存密钥、令牌、临时构建路径或未经验证的猜测。
-
-## 0. 当前品牌与仓库迁移状态（2026-09-07 核验）
-
-用户已明确授权将现有 GitHub 项目更名。`Kuddev/nebula` 已重命名为
-[`Kuddev/pebrel`](https://github.com/Kuddev/pebrel)，repository ID 仍为 `1289958986`。
-这次操作只修改仓库名称；当时的 663 stars、44 forks、17 open issues 保持不变。
-后续仓库命令与当前文档使用新地址；旧推广链接按下列实测边界保留访问。
-
-- 旧仓库主页、PR、commit、blob、Releases、tag、latest、真实旧资产与 API 地址均已实际检查；旧 raw README 和 PNG 地址直接返回 200，内容 SHA256 与新地址一致。
-- 旧 Issue `#95`、`#60` 使用普通浏览器的 `Accept: text/html` 时，301 跳转到新仓库后返回 200。相同旧地址在 `curl` 默认 `Accept: */*` 下曾返回 404；不能把这种内容协商差异说成所有客户端都无条件重定向，也不能据此认定浏览器推广链接失效。
-- GitHub 支持旧 Git clone/fetch/push URL 重定向，旧 HTTPS Git 地址已通过只读 `ls-remote` 核验；本地 `origin` 已更新到新地址，没有为验证执行推送。
-- 更名前后 `main`、发布分支和 18 个版本标签未移动；20 个 Release 与 34 个资产的元数据保持一致。其他验证分支的并发快进另行核对，不冒充所有远端引用完全静止。
-- 通过旧 1.5.0 安装器下载地址实际下载得到 `29,945,853` 字节，SHA256 为 `416a1e127045ce81c78cc2d0990d469d8adde935931963148fb81a9d5cef2bd2`，与更名前一致。
-- 不要重新创建 `Kuddev/nebula` 仓库，否则旧名称会被新仓库占用并破坏重定向。GitHub Pages 与其他仓库通过旧名称 `uses:` 引用的 Actions 不属于通用重定向保证；本项目核验时 `has_pages=false`，完整默认分支树没有 `action.yml` 或 `action.yaml`。
-
-官方说明：[Renaming a repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/renaming-a-repository)。历史版本说明、标签与资产文件名保持原样；仓库更名不会替已改名的 Release 资产创建文件名别名。
-
-1.6.0 候选的源码与打包脚本已采用以下新名称，但**这不代表 1.6.0 已经公开发布**：
-
-| 对象 | 1.6.0 候选名称 |
-| --- | --- |
-| 主程序与 CLI | `pebrel.exe` / `pebrel` |
-| AI hook 辅助程序 | `runtime/pebrel-hook.exe` |
-| Portable ZIP | `Pebrel-v1.6.0-windows-x64.zip` |
-| Windows 安装器 | `Pebrel-1.6.0-windows-x64-setup.exe` |
-| Release Note | `docs/release-notes/v1.6.0.md`，标题 `Pebrel 1.6.0` |
-
-旧客户端按精确的 `NebulaTerminal-<version>-windows-x64-setup.exe` 名称查找更新。
-未来公开发布 Pebrel 安装资产时，还需要提供相同安装器字节的旧命名兼容资产，或先完成明确的客户端迁移方案；不能把仓库重定向当成资产改名兼容。
-目前下载入口应指向真实的 `https://github.com/Kuddev/pebrel/releases/latest` 页面，不能生成指向尚未发布 Pebrel 资产的 `latest/download/...` 链接。
-
-下文保留 1.3.0 / 1.3.1 的已发布核验先例与通用发布步骤。其历史名称用于识别旧版本，新的候选名称以上表和当前打包脚本为准；最终 SHA256 仍必须在新文件生成后重新计算。
-
-## 1. 命名规范是接口，不是装饰
-
-以已发布的 `v1.3.0` 和 `v1.3.1` 为准：
-
-| 对象 | 规范 | 示例 |
-| --- | --- | --- |
-| Git 标签 | `vX.Y.Z` | `v1.3.1` |
-| GitHub Release 标题 | `Nebula Terminal X.Y.Z` | `Nebula Terminal 1.3.1` |
-| Portable ZIP | `NebulaTerminal-vX.Y.Z-windows-x64.zip` | `NebulaTerminal-v1.3.1-windows-x64.zip` |
-| Windows 安装器 | `NebulaTerminal-X.Y.Z-windows-x64-setup.exe` | `NebulaTerminal-1.3.1-windows-x64-setup.exe` |
-| Release Note 文件 | `docs/release-notes/vX.Y.Z.md` | `docs/release-notes/v1.3.1.md` |
-
-- ZIP 带 `v`，安装器不带 `v`。不要为了“看起来统一”擅自改成同一种格式。
-- 应用内更新会按精确安装器文件名选择资产。发布资产改名不仅影响展示，还可能直接破坏自动更新。
-- GitHub CLI 上传资产时，`<path>#<label>` 中的 `#...` 会设置自定义资产标签。GitHub Assets 区域随后优先显示这个 label，造成文件名看起来被改乱。正式上传只传文件路径，不加 `#label`。
-- 资产 `label` 的正确值是空字符串。若文件本身、大小和 digest 都正确，只是 label 错了，应通过 GitHub API 清空 label；不要重新上传并损失下载计数或引入重复资产。
-
-## 2. Release Note 内容与结构
-
-### 固定结构
-
-沿用 `docs/release-notes/v1.3.0.md`：
-
-```text
-# Nebula Terminal X.Y.Z
-
-## English
-### Added
-### Fixed
-### Improved
-
-## 中文
-### 新增
-### 修复
-### 改进
-
-## Contributors
----
-SHA256
-```
-
-- 某个分类没有内容时可以省略该分类，但不能让中英文分类不对称。
-- `CHANGELOG.md` 的同版本条目与独立 Release Note 必须语义一致；GitHub Release 正文应直接取自独立 Release Note。
-- `CHANGELOG.md` 会被 `scripts/package-release.ps1` 和 `scripts/build-installer.ps1` 收进发布包。因此必须先定稿说明，再构建最终二进制和归档。
-- `SHA256` 只能在最终文件生成后计算。文件被重新构建或重新打包后，即使版本号相同也必须重新计算，不能沿用旧值。
-
-### 选材与措辞
-
-- 从上一个版本标签到候选发布提交审计用户可感知变化；多个连续提交修复同一问题时合并成一条，不把调试过程写成多个功能。
-- 优先陈述结果、触发条件和用户影响。实现细节只在能解释安全性或行为边界时保留，例如安装器会校验大小、PE 文件头与 SHA256。
-- `Added` 用于新能力，`Fixed` 用于已存在行为的回归或错误，`Improved` 用于兼容性、可用性或一致性提升。不要为了让三个分类都有内容而错误分类。
-- Debug-only 强制更新提醒只是验收探针，正式版本必须移除，Release Note 也不得把它描述成启动时必定弹出的产品行为。
-- 自动更新说明必须以真实 GitHub 最新 Release 检测为前提：比较运行包版本，遵守跳过版本和稍后提醒；不得发布写死版本或强制测试弹窗。
-- “已修复”必须有相应实现和针对性验证。Issue 仍开放、只覆盖其中一部分或缺少复现验证时，应准确写“改进”“部分处理”或不引用，不能替用户关闭结论。
-
-## 3. Issue 引用规则与 1.3.1 样例
-
-发布前通过 GitHub 读取候选 Issue 的标题、正文、状态和必要评论，再与具体代码和说明逐项映射。仅凭标题相似、路径相关或用户给出的编号都不够。
-
-规范格式：
-
-```markdown
-Addresses [#60](https://github.com/Kuddev/nebula/issues/60).
-对应 [#60](https://github.com/Kuddev/nebula/issues/60)。
-```
-
-`v1.3.1` 已核实映射：
-
-- `#60` 对应终端不透明度设为 100% 后回到 82%。
-- `#61` 对应侧边栏可见分隔线与鼠标拖拽命中位置不一致。
-- `#64` 对应通用确认弹窗缺少确认操作；说明必须覆盖“确认操作正常显示并执行”，不能只写弹窗尺寸或取消行为。
-- `#47` 是“自动更新或使用 scoop/winget 更新”的宽泛且仍开放功能诉求。它可以作为在线更新方向的需求背景，但正文没有逐项要求 GitHub API、右下角提醒、Windows x64 资产或 SHA256；不能把这些实现细节都说成 `#47` 报告的 Bug。
-
-同一 Issue 不要散落重复挂在许多条目上。旧版本的 Issue 链接属于历史记录，也不能因为主题相近而复制到新版本。
-
-## 4. 版本面必须一起更新
-
-发布新版本时核对以下位置，不能只改 `nebula_app/Cargo.toml`：
-
-- 本地发布 crate：`nebula-completions`、`nebula_app`、`nebula_config`、`nebula_config_derive`、`nebula_settings`、`nebula_split`、`nebula_terminal` 的 package version。
-- `nebula_app` 内部 path dependency 的版本约束，以及 `nebula_config` / `nebula_config_derive` 互相引用的 dev-dependency 版本。
-- `Cargo.lock` 中上述 Nebula 本地包记录。不要全局替换第三方 crate 的同号版本。
-- `nebula_app/windows/nebula.rc` 的 `FILEVERSION`、`PRODUCTVERSION`、`FileVersion` 和 `ProductVersion`。
-- `scripts/installer.iss` 的 `AppVersion` 与四段式 `NumericVersion`。
-- `CHANGELOG.md` 和新的 `docs/release-notes/vX.Y.Z.md`。
-
-不要机械改动：
-
-- `nebula_gpui`、`nebula_hook` 的独立版本，除非该版本本身确实要发布。
-- 历史 Release Note、历史 Changelog、第三方依赖版本。
-- 测试中用于表达“旧版本/新版本”的固定字符串，除非测试语义要求更新。
-- `scripts/package-release.ps1` 的默认值 `unreleased`。
-
-## 5. 构建与打包踩坑
-
-- `cargo build --workspace` 可能在输出目录留下非预期的产品构建。1.6 候选脚本先构建 `--workspace --exclude nebula`，最后显式构建 `-p nebula --bin pebrel --features gpui-shell`；内部 package 名仍为 `nebula`。不要在它之后再用 workspace 默认构建覆盖产品 exe；旧版脚本的 `--bin nebula` 只适用于旧源码。
-- 正式包必须全新构建。`-SkipBuild` 和 `-AllowStale` 只用于脚本自测，不能用于正式 Release。
-- Windows 正在运行的 `pebrel.exe`（旧版本为 `nebula.exe`）可能锁住输出文件，并把链接失败表现为 `os error 5`。应使用用户允许的独立 `TargetDirectory` 和 `OutputDirectory` 隔离构建，不要结束用户正在使用的实例。
-- 不得根据剩余空间擅自选择磁盘。本次用户明确禁止操作 `E:\`；这一约束优先于任何“空间更大”的构建建议。
-- 当前构建脚本会验证 `pebrel.exe --help` 包含 `--gpui`、`--version` 与目标版本匹配，并检查二进制不早于源码。不要绕过这些检查；1.3 历史产物的程序名为 `nebula.exe`。
-- Inno Setup 的简体中文翻译来自固定上游提交并校验 SHA256；下载失败或哈希不符应停止发布，不能静默使用未知版本。
-- ZIP 和安装器必须从同一个发布提交、同一套新鲜二进制生成。产物生成后核对文件清单、大小、可执行文件头、版本输出和 SHA256。
-
-## 6. Git、GitHub CLI 与发布顺序
-
-- 大规模或核心修改前先提交可回退基线。正式发布提交只包含预期代码、版本和文档；工作区有大量未跟踪探针时必须逐路径 `git add`，禁止 `git add -A`、清理或重置用户文件。
-- 受限执行环境中的 GitHub CLI 登录、Issue 或 Release 查询可能返回 `401`、`403` 或共享 IP rate limit，而同一机器的授权宿主环境实际有权限。先在获准的真实网络与凭据上下文复核，再要求用户重新登录，不能把沙箱假阴性当成仓库无权限。
-- 使用普通 push，同步目标发布分支和 `main`；禁止 force push，除非用户明确要求且风险已经说明。
-- 先确定发布提交并从它构建产物，再创建 `vX.Y.Z` 标签和 GitHub Release。上传资产时不设置自定义 label。
-- 发布后若只修订 Release Note：提交并推送文档到相关分支，使用同一 Markdown 更新 GitHub Release 正文；版本标签继续指向实际生成二进制的发布提交。除非用户明确要求，不移动或强制更新标签。
-
-`v1.3.1` 的实际先例：
-
-- 二进制发布提交与标签：`8de58a373c48068ab7af23d100538bcdb38c6810`。
-- 后续 Issue 引用文档提交：`c5866feb557559d91e59c2974a3b6c5bc9de1f0e`，同步到 `main` 和 `upgrade/gpui-v1.16.1`。
-- 文档补充后没有移动 `v1.3.1` 标签，也没有重传资产；只同步仓库文档和 GitHub Release 正文。
-
-## 7. GitHub Release 最终核验
-
-创建或编辑 Release 后必须重新读取远端数据，逐项确认：
-
-1. Release 为非 draft、非 prerelease，标题为 `Nebula Terminal X.Y.Z`，tag 为 `vX.Y.Z`。
-2. Release 正文与 `docs/release-notes/vX.Y.Z.md` 一致，中英文、Issue 链接和 SHA256 均存在。
-3. 资产名称完全符合约定，`label` 为空，状态为 uploaded，大小与本地最终文件一致。
-4. GitHub 返回的 asset digest、本地 `Get-FileHash` 和 Release Note 中的 SHA256 三者一致。
-5. `main`、发布分支和版本标签分别指向预期提交；特别区分“分支上的后续文档提交”和“标签对应的二进制发布提交”。
-6. 自动更新实际能识别精确的 Windows x64 安装器资产，测试用强制提醒不在 release build 中。
-7. 没有误上传探针、临时目录、旧包或用户文件，也没有操作用户禁止的磁盘和目录。
-
-`v1.3.1` 最终已核实资产：
-
-```text
-NebulaTerminal-v1.3.1-windows-x64.zip
-SHA256 211A657F2B772AA44A69ED3E7DF20448C79D734217EFDDBB094CF8459FF46216
-
-NebulaTerminal-1.3.1-windows-x64-setup.exe
-SHA256 41FCC6B3E09B5E7D0EBF4B7316FC75379EAD4CC5FB74FD7EDA092AE355E27F58
-```
-
-两个资产的 GitHub `label` 均为空；Release 标题为 `Nebula Terminal 1.3.1`，标签为 `v1.3.1`。
diff --git a/.gitignore b/.gitignore
index d33992f..37f187e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,6 +41,10 @@ tocodex-docs/
 /docs/**
 !/docs/lua-configuration.md
 !/docs/math-rendering-test.md
+!/docs/chemistry-rendering-test.md
+!/docs/biology-rendering-test.md
+!/docs/scientific-rendering-acceptance-paper.md
+!/docs/scientific-rendering-performance.md
 !/docs/runtime-control-api.md
 !/docs/runtime-api-v1.schema.json
 !/docs/preview-release-checklist.md
@@ -200,3 +204,6 @@ dist-pack-*/
 # 发布走 scripts/package-release.ps1，不从工作区入库。
 NebulaTerminal-*/
 *-preview-package/
+
+# Local agent instructions and persistent workspace memory.
+/.agents/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5aa4fb1..3b0ab5b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,6 +9,8 @@ when changing them. Internal Rust crate and source-directory names remain stable
 
 - [Architecture and module ownership](docs/architecture.md)
 - [Enforced contracts and review rules](docs/project-constraints.md)
+- UI changes must also satisfy the **UI 设计约束 / UI design constraints** chapter
+  in that document: interaction states, result feedback, hit targets and visual acceptance.
 - [Decision log and policy change process](docs/architecture-decisions.md)
 - [Evidence behind the rules](docs/engineering-evidence.md)
 - [Internationalization](docs/internationalization.md) when changing UI text
diff --git a/Cargo.lock b/Cargo.lock
index 3b29564..095b3e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1152,6 +1152,71 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "chematic-core"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c4da33c5ba013bd5872ed39343ed94957e0d1940026b4ae51a396dda1bfffbf"
+
+[[package]]
+name = "chematic-depict"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0a7090aba353caeaec7c788485b3f127715da8138a715c3c7211a7f5935421d"
+dependencies = [
+ "chematic-core",
+ "chematic-perception",
+ "chematic-rxn",
+ "chematic-smiles",
+]
+
+[[package]]
+name = "chematic-perception"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "007603c541f81ae5b466ef5d98b14a4508780505f1c672685b6a60da2bdafd1a"
+dependencies = [
+ "chematic-core",
+ "rustc-hash 2.1.3",
+]
+
+[[package]]
+name = "chematic-rxn"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "074290504dfa9abd90bde715cd5fde592ab45f13e10805e0492a41c8c84b86ae"
+dependencies = [
+ "chematic-core",
+ "chematic-perception",
+ "chematic-smarts",
+ "chematic-smiles",
+ "rustc-hash 2.1.3",
+ "serde",
+]
+
+[[package]]
+name = "chematic-smarts"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faa830d23953347170257486184c164004a7763e72bb65bbaeaf78d87b4a715f"
+dependencies = [
+ "chematic-core",
+ "chematic-perception",
+ "rustc-hash 2.1.3",
+ "web-time",
+]
+
+[[package]]
+name = "chematic-smiles"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6154faef287e5ed7b516f20a4b695c39ec38faaa48197f3b1e421dbc073ae3fe"
+dependencies = [
+ "chematic-core",
+ "chematic-perception",
+ "smallvec",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -2016,7 +2081,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2322,7 +2387,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4858,7 +4923,7 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "536bfad37a309d62069485248eeaba1e8d9853aaf951caaeaed0585a95346f08"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5029,6 +5094,8 @@ dependencies = [
  "argon2",
  "base64",
  "bitflags 2.13.0",
+ "chematic-depict",
+ "chematic-smiles",
  "chrono",
  "clap",
  "clap_complete",
@@ -5095,6 +5162,8 @@ dependencies = [
  "unicode-width",
  "ureq",
  "wgpu 25.0.2",
+ "windows 0.61.3",
+ "windows-core 0.61.2",
  "windows-sys 0.59.0",
  "winit",
  "winreg",
@@ -5330,7 +5399,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6803,7 +6872,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7560,7 +7629,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8297,7 +8366,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8433,7 +8502,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8823,7 +8892,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.2",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9658,7 +9727,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10651,7 +10720,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/architecture/file-budgets.txt b/architecture/file-budgets.txt
index 9df7572..25d6d35 100644
--- a/architecture/file-budgets.txt
+++ b/architecture/file-budgets.txt
@@ -15,7 +15,6 @@ nebula_app/src/display/command_palette.rs 3935
 nebula_app/src/display/markdown_view.rs 2067
 nebula_app/src/display/mod.rs 11150
 nebula_app/src/display/settings.rs 8434
-nebula_app/src/display/terminal_math.rs 2783
 nebula_app/src/event.rs 3594
 nebula_app/src/gpui_shell/terminal/view.rs 2416
 nebula_app/src/gpui_shell/workspace.rs 4798
diff --git a/docs/architecture-decisions.md b/docs/architecture-decisions.md
index a04dd5f..039317a 100644
--- a/docs/architecture-decisions.md
+++ b/docs/architecture-decisions.md
@@ -102,12 +102,92 @@ unrelated feature's growth. Remote approval/enforcement is not implied by this l
 - **Revisit condition:** Remove compatibility readers only after support for old
   clients and persisted configurations is explicitly retired.
 
+## ADR-0004 - Molecular diagrams and file hover previews
+
+- **Status:** Requested in the current working session, 2026-09-08; implementation
+  and validation in progress, pending normal review.
+- **Context:** Markdown and AI CLI output need the same SMILES interpretation.
+  File tree previews must not decode large images or PDFs during row rendering.
+- **Decision:** Keep SMILES parsing and SVG depiction in one presentation-independent
+  application module, using exact `chematic-smiles` / `chematic-depict` 1.0.9 pins
+  (MIT OR Apache-2.0). Use the existing GPUI SVG image pipeline. Disable the
+  depiction crate's optional PNG/PDF backends; they add unrelated renderers.
+  Bound input, molecule size and cache capacity, perform layout in background work,
+  and preserve source text on invalid or unsupported input. UI adapters own their
+  pending work; discarded views cannot receive stale results.
+- **Preview boundary:** Native Windows PDF first-page rendering lives under
+  `platform`, through Windows.Data.Pdf using the already-resolved `windows` 0.61.3
+  family. Image decoding and thumbnail caching share a bounded application adapter.
+  Cache identity includes path, modification time and length; no preview changes
+  the user's file or creates a persistent format.
+- **Alternatives:** Handwritten SMILES geometry would duplicate specialized ring
+  and stereochemistry rules. A Python/Node subprocess or a web service would add
+  deployment or availability requirements. A whole PDF viewer is outside hover
+  preview responsibility.
+- **Validation:** Regression fixtures cover common rings, branches, charges and
+  invalid SMILES; unsupported stereo notation preserves source because the pinned
+  depiction backend does not project atom parity / alkene direction. Preview checks
+  cover dimension bounds, cache invalidation and
+  real first-page rendering. Real product compilation and UI inspection are
+  reported separately from these behavior tests.
+- **Revisit condition:** Remove or replace an adapter when upstream support covers
+  the same behavior, or measured parsing/rendering cost exceeds the bounded use.
+
+## ADR-0005 — Remote file workflows and persistent host organization
+
+- **Status:** Implemented in the working tree on 2026-09-08 for the maintainer's
+  requested workflows. Native compilation and focused regression checks passed;
+  full GPUI/Explorer/server acceptance and normal maintainer review remain separate.
+- **Context:** Upload drops only target the currently visible directory; Windows
+  has no outbound remote-file drag. Remote files cannot enter the editable document
+  lifecycle. The saved-host MRU also serves as the long-term host list.
+- **Decision:** Keep transfer policy and I/O in the existing SSH/SFTP capability.
+  A gesture captures the source and destination identities; asynchronous directory
+  checks and native dialogs cannot retarget it when the focused pane changes.
+  Windows outbound drag uses a scoped native OLE adapter and virtual file streams;
+  its worker owns the drag, materialization, cancellation and temporary resources.
+  The GPUI thread never waits for file contents. Reuse the already pinned Windows
+  bindings rather than adding another native framework or changing the GPUI fork.
+  The worker associates its input queue with the captured source window thread
+  for the native gesture, then detaches it. File descriptors are prepared lazily,
+  and initialization rechecks the physical button state before entering OLE.
+  The direct `windows-core` 0.61.2 edge is required by the official COM implement
+  macro and shares the version already resolved by `windows` 0.61.3.
+- **Documents:** Share text decoding, BOM/newline handling and conditional-save
+  semantics between local and remote documents. The editor owns a fixed document
+  source, dirty buffer and in-flight revision. SFTP reads and writes run on the
+  existing network runtime, use bounded text snapshots and preserve drafts on
+  failure. Source conflicts and unsupported replacement semantics remain visible.
+- **Hosts:** Existing profiles remain the authority for explicitly managed hosts;
+  recent connections remain bounded separately. Optional organization metadata is
+  backward compatible, excludes credentials, and survives profile edits/renames.
+  UI search and grouping consume cached profile data, indexing profiles once per
+  filter pass instead of scanning every profile for every candidate. Import/export must validate
+  before changing persisted state and must never serialize private credentials.
+  Profile saves reuse the existing OS-handle lock and atomic state writer, and
+  reject a snapshot that differs from the file last loaded by that writer.
+- **Alternatives:** A second SSH transport, renderer-specific persistence engine,
+  synchronous download in a drag callback, or enlarged MRU alone would preserve
+  the workflow gaps or duplicate existing contracts.
+- **Validation:** Windows GPUI product compilation, architecture, i18n, settings
+  and line-budget checks passed. Production-source regressions cover destination
+  identity, cancellation, names, encoding, host retention and import. Eight remote
+  save cases use the real SFTP codec over an injected peer, including permission
+  failure, publication rollback and competing writes. A separately invoked desktop
+  OLE test copies a Unicode filename and its contents between owned test windows.
+  These tests do not exercise real Explorer, GPUI gestures or SSH authentication.
+  Full-workspace formatting still reports differences in other working-tree
+  changes; the files modified for these workflows have no remaining format findings.
+- **Revisit condition:** Replace the OLE adapter when the pinned GPUI exposes an
+  equivalent Windows virtual-file drag with the same ownership contract. Revisit
+  persistent host identity before adding shared/cloud mutation or credential export.
+
 ## 中文说明
 
 记录重大取舍而非每次小修复；事实与测试能推翻旧决定。规范误伤、安全修复与旧预算冲突时，
 先记录问题和最小修订，维护者审查后更新合同；不能将“只减不增”变成拒绝纠正规范的理由。
 
-## ADR-0005 — Editable documents, reusable layouts and pane drop targets
+## ADR-0006 — Editable documents, reusable layouts and pane drop targets
 
 - **Status:** Implemented in the working tree, 2026-09-08, for the requested editor,
   recipe and quick-terminal workflows; pending normal maintainer review.
@@ -146,3 +226,50 @@ unrelated feature's growth. Remote approval/enforcement is not implied by this l
 - **Revisit condition:** Add command replay or externally imported recipes only
   with a deliberate replay contract. Replace the preview block adapter when the
   pinned TextView exposes an equivalent public heading/navigation API.
+
+## ADR-0007 — Formula bitmap admission and preview view lifetime
+
+- **Status:** Implemented for the maintainer's memory reduction request,
+  2026-09-09; validation and normal review tracked separately.
+- **Context:** The shared 48 MiB scientific cache bounded completed resources,
+  but two workers could allocate formula bitmaps before cache eviction. Reading
+  created lazy preview views that remained retained after switching to source.
+- **Decision:** Reuse bitmap geometry preflight for both worker admission and
+  allocation. Reserve formula output bytes against the existing cache allowance
+  before starting a worker; shrink the LRU allowance while reservations live and
+  release reservations on success/failure. Compose alpha directly in the final
+  BGRA allocation. Source mode releases parsed preview views while preserving
+  the outline, source, scroll position and editor undo state.
+- **Boundaries:** This does not change worker count, persistence, terminal
+  identity or dependencies. It does not cap the entire process: compiler/glyph
+  scratch, GPU copies, queued inputs, other images and references outside the
+  cache remain separate costs. Molecular rendering is currently disabled.
+- **Alternatives:** Evicting only after allocation retains the peak; shrinking
+  the cache constant alone does not reserve in-flight output. Evicting arbitrary
+  actively selected Markdown blocks would lose selection state.
+- **Validation:** Regression tests cover fractional-DPI preflight/allocation,
+  alpha overlap, reservations exceeding available bytes, failure release,
+  cold-entry eviction and source/preview transitions. Native product checks and
+  any measured memory reduction are reported separately.
+- **Revisit condition:** Extend reservations to other resource types when they
+  are enabled/profiled; add viewport eviction only with preserved selection and
+  measured parsed-view accounting. No 50 MB process-wide guarantee is implied.
+
+## ADR-0008 — Optional in-app AI message toasts
+
+- **Status:** Requested by the maintainer, 2026-09-11; implemented in the working
+  tree, with native validation pending.
+- **Decision:** Add the default-on `ai_toasts` preference to `nebula_settings` and
+  its existing persistence/reset contracts. The GPUI adapter caches it with other
+  runtime settings. Disabling it hides only in-app AI completion/confirmation
+  cards; native system notifications, tab indicators and terminal state retain
+  their existing behavior. Source identity reuses the shared agent registry.
+- **Lifetime:** Existing cards use the component notification identity and
+  dismissal lifecycle. A settings observer dismisses only AI cards across open
+  windows; deferred startup delivery rechecks the preference. No second queue,
+  background service, dependency or per-event settings-file read is introduced.
+- **Validation:** Regression coverage includes defaults, parsing, round trips,
+  reset, independent delivery channels, search, and component-card dismissal.
+  Native compilation and UI results must be reported separately.
+- **Revisit condition:** Add separate system-notification or per-agent controls
+  only when requested, rather than expanding the meaning of this persisted key.
diff --git a/docs/biology-rendering-test.md b/docs/biology-rendering-test.md
new file mode 100644
index 0000000..662b321
--- /dev/null
+++ b/docs/biology-rendering-test.md
@@ -0,0 +1,1561 @@
+# 生物科研渲染回归文档
+
+这些是小体积、可重复的验证材料；不是一次打开 100 MB 或启动 80 个 AI 的压力脚本。测试直接读取本文件中的数学和 SMILES 块。先在单窗口验证，再采用受限的模型测试验证多会话和总预算。不要为测试自动请求真实 AI 服务。
+
+公式块应作为普通数学成功渲染；FASTA、FASTQ、序列比对、Newick、GFF、BED、PDB 和 Mermaid 只作为可复制源码对照。所有序列、注释、坐标和通路名称都是合成夹具，不是实验数据或研究发现。
+
+每次检查：往返滚动、反复拖选文字、连续改变窗口宽高、切换标签后返回、切换主题；记录有无丢图、闪烁、错误重绘、选区错位和内存持续增长。看到不支持的语法时应保留源码，不能悄悄生成错误科学图形。
+
+## 能力边界
+
+动力学、概率和统计公式使用通用数学渲染，小分子代谢物使用 SMILES。FASTA、序列比对和蛋白质三维结构当前没有专用解析器，下面的代码块应保持可复制文本；不能把普通代码高亮误认为生物结构渲染。
+
+矩阵、信息熵和常见生物小分子也只使用已有的数学或单分子 SMILES 路径；多序列、树、注释和通路不会被伪装成图形。
+
+## 米氏方程
+
+$$
+v=\frac{V_{\max}[S]}{K_m+[S]}
+$$
+
+## Hill 方程
+
+$$
+\theta=\frac{[L]^n}{K_d^n+[L]^n}
+$$
+
+## Logistic 增长
+
+$$
+\frac{dN}{dt}=rN\left(1-\frac{N}{K}\right)
+$$
+
+## Hardy–Weinberg 关系
+
+$$
+p+q=1\qquad p^2+2pq+q^2=1
+$$
+
+## 序列文本对照
+
+```fasta
+>synthetic_fixture_not_a_real_sample
+ACGTACGTACGTACGT
+```
+
+```text
+fixture_A  ACGTACGT--ACGT
+fixture_B  ACGTACGTTTACGT
+```
+
+## 混合长文与代谢物
+
+下面是渲染与缓存负载材料，参数编号仅用来制造不同表达式。序列片段是合成占位数据，不含患者或真实实验数据。
+
+### 观察窗口 01
+
+第 1 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{1}=\frac{V_{\max,1}[S]}{K_{m,1}+[S]}\qquad P(X=1)=\frac{\lambda^{1}e^{-\lambda}}{1!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_01
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 02
+
+第 2 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{2}=\frac{V_{\max,2}[S]}{K_{m,2}+[S]}\qquad P(X=2)=\frac{\lambda^{2}e^{-\lambda}}{2!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_02
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 03
+
+第 3 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{3}=\frac{V_{\max,3}[S]}{K_{m,3}+[S]}\qquad P(X=3)=\frac{\lambda^{3}e^{-\lambda}}{3!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_03
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 04
+
+第 4 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{4}=\frac{V_{\max,4}[S]}{K_{m,4}+[S]}\qquad P(X=4)=\frac{\lambda^{4}e^{-\lambda}}{4!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_04
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 05
+
+第 5 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{5}=\frac{V_{\max,5}[S]}{K_{m,5}+[S]}\qquad P(X=5)=\frac{\lambda^{5}e^{-\lambda}}{5!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_05
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 06
+
+第 6 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{6}=\frac{V_{\max,6}[S]}{K_{m,6}+[S]}\qquad P(X=6)=\frac{\lambda^{6}e^{-\lambda}}{6!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_06
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 07
+
+第 7 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{7}=\frac{V_{\max,7}[S]}{K_{m,7}+[S]}\qquad P(X=7)=\frac{\lambda^{7}e^{-\lambda}}{7!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_07
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 08
+
+第 8 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{8}=\frac{V_{\max,8}[S]}{K_{m,8}+[S]}\qquad P(X=8)=\frac{\lambda^{8}e^{-\lambda}}{8!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_08
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 09
+
+第 9 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{9}=\frac{V_{\max,9}[S]}{K_{m,9}+[S]}\qquad P(X=9)=\frac{\lambda^{9}e^{-\lambda}}{9!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_09
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 10
+
+第 10 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{10}=\frac{V_{\max,10}[S]}{K_{m,10}+[S]}\qquad P(X=10)=\frac{\lambda^{10}e^{-\lambda}}{10!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_10
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 11
+
+第 11 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{11}=\frac{V_{\max,11}[S]}{K_{m,11}+[S]}\qquad P(X=11)=\frac{\lambda^{11}e^{-\lambda}}{11!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_11
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 12
+
+第 12 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{12}=\frac{V_{\max,12}[S]}{K_{m,12}+[S]}\qquad P(X=12)=\frac{\lambda^{12}e^{-\lambda}}{12!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_12
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 13
+
+第 13 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{13}=\frac{V_{\max,13}[S]}{K_{m,13}+[S]}\qquad P(X=13)=\frac{\lambda^{13}e^{-\lambda}}{13!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_13
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 14
+
+第 14 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{14}=\frac{V_{\max,14}[S]}{K_{m,14}+[S]}\qquad P(X=14)=\frac{\lambda^{14}e^{-\lambda}}{14!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_14
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 15
+
+第 15 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{15}=\frac{V_{\max,15}[S]}{K_{m,15}+[S]}\qquad P(X=15)=\frac{\lambda^{15}e^{-\lambda}}{15!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_15
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 16
+
+第 16 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{16}=\frac{V_{\max,16}[S]}{K_{m,16}+[S]}\qquad P(X=16)=\frac{\lambda^{16}e^{-\lambda}}{16!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_16
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 17
+
+第 17 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{17}=\frac{V_{\max,17}[S]}{K_{m,17}+[S]}\qquad P(X=17)=\frac{\lambda^{17}e^{-\lambda}}{17!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_17
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 18
+
+第 18 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{18}=\frac{V_{\max,18}[S]}{K_{m,18}+[S]}\qquad P(X=18)=\frac{\lambda^{18}e^{-\lambda}}{18!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_18
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 19
+
+第 19 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{19}=\frac{V_{\max,19}[S]}{K_{m,19}+[S]}\qquad P(X=19)=\frac{\lambda^{19}e^{-\lambda}}{19!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_19
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 20
+
+第 20 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{20}=\frac{V_{\max,20}[S]}{K_{m,20}+[S]}\qquad P(X=20)=\frac{\lambda^{20}e^{-\lambda}}{20!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_20
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 21
+
+第 21 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{21}=\frac{V_{\max,21}[S]}{K_{m,21}+[S]}\qquad P(X=21)=\frac{\lambda^{21}e^{-\lambda}}{21!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_21
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 22
+
+第 22 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{22}=\frac{V_{\max,22}[S]}{K_{m,22}+[S]}\qquad P(X=22)=\frac{\lambda^{22}e^{-\lambda}}{22!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_22
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 23
+
+第 23 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{23}=\frac{V_{\max,23}[S]}{K_{m,23}+[S]}\qquad P(X=23)=\frac{\lambda^{23}e^{-\lambda}}{23!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_23
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 24
+
+第 24 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{24}=\frac{V_{\max,24}[S]}{K_{m,24}+[S]}\qquad P(X=24)=\frac{\lambda^{24}e^{-\lambda}}{24!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_24
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 25
+
+第 25 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{25}=\frac{V_{\max,25}[S]}{K_{m,25}+[S]}\qquad P(X=25)=\frac{\lambda^{25}e^{-\lambda}}{25!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_25
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 26
+
+第 26 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{26}=\frac{V_{\max,26}[S]}{K_{m,26}+[S]}\qquad P(X=26)=\frac{\lambda^{26}e^{-\lambda}}{26!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_26
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 27
+
+第 27 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{27}=\frac{V_{\max,27}[S]}{K_{m,27}+[S]}\qquad P(X=27)=\frac{\lambda^{27}e^{-\lambda}}{27!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_27
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 28
+
+第 28 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{28}=\frac{V_{\max,28}[S]}{K_{m,28}+[S]}\qquad P(X=28)=\frac{\lambda^{28}e^{-\lambda}}{28!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_28
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 29
+
+第 29 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{29}=\frac{V_{\max,29}[S]}{K_{m,29}+[S]}\qquad P(X=29)=\frac{\lambda^{29}e^{-\lambda}}{29!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_29
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 30
+
+第 30 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{30}=\frac{V_{\max,30}[S]}{K_{m,30}+[S]}\qquad P(X=30)=\frac{\lambda^{30}e^{-\lambda}}{30!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_30
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 31
+
+第 31 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{31}=\frac{V_{\max,31}[S]}{K_{m,31}+[S]}\qquad P(X=31)=\frac{\lambda^{31}e^{-\lambda}}{31!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_31
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 32
+
+第 32 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{32}=\frac{V_{\max,32}[S]}{K_{m,32}+[S]}\qquad P(X=32)=\frac{\lambda^{32}e^{-\lambda}}{32!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_32
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 33
+
+第 33 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{33}=\frac{V_{\max,33}[S]}{K_{m,33}+[S]}\qquad P(X=33)=\frac{\lambda^{33}e^{-\lambda}}{33!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_33
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 34
+
+第 34 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{34}=\frac{V_{\max,34}[S]}{K_{m,34}+[S]}\qquad P(X=34)=\frac{\lambda^{34}e^{-\lambda}}{34!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_34
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 35
+
+第 35 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{35}=\frac{V_{\max,35}[S]}{K_{m,35}+[S]}\qquad P(X=35)=\frac{\lambda^{35}e^{-\lambda}}{35!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_35
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 36
+
+第 36 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{36}=\frac{V_{\max,36}[S]}{K_{m,36}+[S]}\qquad P(X=36)=\frac{\lambda^{36}e^{-\lambda}}{36!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_36
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 37
+
+第 37 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{37}=\frac{V_{\max,37}[S]}{K_{m,37}+[S]}\qquad P(X=37)=\frac{\lambda^{37}e^{-\lambda}}{37!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_37
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 38
+
+第 38 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{38}=\frac{V_{\max,38}[S]}{K_{m,38}+[S]}\qquad P(X=38)=\frac{\lambda^{38}e^{-\lambda}}{38!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_38
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 39
+
+第 39 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{39}=\frac{V_{\max,39}[S]}{K_{m,39}+[S]}\qquad P(X=39)=\frac{\lambda^{39}e^{-\lambda}}{39!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_39
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 40
+
+第 40 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{40}=\frac{V_{\max,40}[S]}{K_{m,40}+[S]}\qquad P(X=40)=\frac{\lambda^{40}e^{-\lambda}}{40!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_40
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 41
+
+第 41 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{41}=\frac{V_{\max,41}[S]}{K_{m,41}+[S]}\qquad P(X=41)=\frac{\lambda^{41}e^{-\lambda}}{41!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_41
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 42
+
+第 42 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{42}=\frac{V_{\max,42}[S]}{K_{m,42}+[S]}\qquad P(X=42)=\frac{\lambda^{42}e^{-\lambda}}{42!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_42
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 43
+
+第 43 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{43}=\frac{V_{\max,43}[S]}{K_{m,43}+[S]}\qquad P(X=43)=\frac{\lambda^{43}e^{-\lambda}}{43!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_43
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 44
+
+第 44 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{44}=\frac{V_{\max,44}[S]}{K_{m,44}+[S]}\qquad P(X=44)=\frac{\lambda^{44}e^{-\lambda}}{44!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_44
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 45
+
+第 45 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{45}=\frac{V_{\max,45}[S]}{K_{m,45}+[S]}\qquad P(X=45)=\frac{\lambda^{45}e^{-\lambda}}{45!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_45
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 46
+
+第 46 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{46}=\frac{V_{\max,46}[S]}{K_{m,46}+[S]}\qquad P(X=46)=\frac{\lambda^{46}e^{-\lambda}}{46!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_46
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 47
+
+第 47 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{47}=\frac{V_{\max,47}[S]}{K_{m,47}+[S]}\qquad P(X=47)=\frac{\lambda^{47}e^{-\lambda}}{47!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_47
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 48
+
+第 48 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{48}=\frac{V_{\max,48}[S]}{K_{m,48}+[S]}\qquad P(X=48)=\frac{\lambda^{48}e^{-\lambda}}{48!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_48
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 49
+
+第 49 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{49}=\frac{V_{\max,49}[S]}{K_{m,49}+[S]}\qquad P(X=49)=\frac{\lambda^{49}e^{-\lambda}}{49!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_49
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 50
+
+第 50 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{50}=\frac{V_{\max,50}[S]}{K_{m,50}+[S]}\qquad P(X=50)=\frac{\lambda^{50}e^{-\lambda}}{50!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_50
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 51
+
+第 51 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{51}=\frac{V_{\max,51}[S]}{K_{m,51}+[S]}\qquad P(X=51)=\frac{\lambda^{51}e^{-\lambda}}{51!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_51
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 52
+
+第 52 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{52}=\frac{V_{\max,52}[S]}{K_{m,52}+[S]}\qquad P(X=52)=\frac{\lambda^{52}e^{-\lambda}}{52!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_52
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 53
+
+第 53 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{53}=\frac{V_{\max,53}[S]}{K_{m,53}+[S]}\qquad P(X=53)=\frac{\lambda^{53}e^{-\lambda}}{53!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_53
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 54
+
+第 54 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{54}=\frac{V_{\max,54}[S]}{K_{m,54}+[S]}\qquad P(X=54)=\frac{\lambda^{54}e^{-\lambda}}{54!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_54
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 55
+
+第 55 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{55}=\frac{V_{\max,55}[S]}{K_{m,55}+[S]}\qquad P(X=55)=\frac{\lambda^{55}e^{-\lambda}}{55!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_55
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 56
+
+第 56 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{56}=\frac{V_{\max,56}[S]}{K_{m,56}+[S]}\qquad P(X=56)=\frac{\lambda^{56}e^{-\lambda}}{56!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_56
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 57
+
+第 57 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{57}=\frac{V_{\max,57}[S]}{K_{m,57}+[S]}\qquad P(X=57)=\frac{\lambda^{57}e^{-\lambda}}{57!}
+$$
+
+代谢物/化学结构测试条目：乙醇。
+
+```smiles
+CCO
+```
+
+```fasta
+>synthetic_fragment_57
+ACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 58
+
+第 58 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{58}=\frac{V_{\max,58}[S]}{K_{m,58}+[S]}\qquad P(X=58)=\frac{\lambda^{58}e^{-\lambda}}{58!}
+$$
+
+代谢物/化学结构测试条目：苯。
+
+```smiles
+c1ccccc1
+```
+
+```fasta
+>synthetic_fragment_58
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 59
+
+第 59 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{59}=\frac{V_{\max,59}[S]}{K_{m,59}+[S]}\qquad P(X=59)=\frac{\lambda^{59}e^{-\lambda}}{59!}
+$$
+
+代谢物/化学结构测试条目：阿司匹林。
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+```fasta
+>synthetic_fragment_59
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 60
+
+第 60 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{60}=\frac{V_{\max,60}[S]}{K_{m,60}+[S]}\qquad P(X=60)=\frac{\lambda^{60}e^{-\lambda}}{60!}
+$$
+
+代谢物/化学结构测试条目：咖啡因。
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+```fasta
+>synthetic_fragment_60
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 61
+
+第 61 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{61}=\frac{V_{\max,61}[S]}{K_{m,61}+[S]}\qquad P(X=61)=\frac{\lambda^{61}e^{-\lambda}}{61!}
+$$
+
+代谢物/化学结构测试条目：甘氨酸。
+
+```smiles
+NCC(=O)O
+```
+
+```fasta
+>synthetic_fragment_61
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 62
+
+第 62 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{62}=\frac{V_{\max,62}[S]}{K_{m,62}+[S]}\qquad P(X=62)=\frac{\lambda^{62}e^{-\lambda}}{62!}
+$$
+
+代谢物/化学结构测试条目：乙酸。
+
+```smiles
+CC(=O)O
+```
+
+```fasta
+>synthetic_fragment_62
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 63
+
+第 63 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{63}=\frac{V_{\max,63}[S]}{K_{m,63}+[S]}\qquad P(X=63)=\frac{\lambda^{63}e^{-\lambda}}{63!}
+$$
+
+代谢物/化学结构测试条目：氯化铵。
+
+```smiles
+[NH4+].[Cl-]
+```
+
+```fasta
+>synthetic_fragment_63
+ACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+### 观察窗口 64
+
+第 64 组记录：比较中文段落、英文 protein / metabolite 标签、公式基线和结构图之间的间距。连续拖拽选区跨过这一段，随后缩放窗口并滚回前文，原始序列和公式的复制结果应稳定。
+
+$$
+v_{64}=\frac{V_{\max,64}[S]}{K_{m,64}+[S]}\qquad P(X=64)=\frac{\lambda^{64}e^{-\lambda}}{64!}
+$$
+
+代谢物/化学结构测试条目：萘。
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+```fasta
+>synthetic_fragment_64
+ACGTACGTACGTACGTACGTACGTACGTACGT
+```
+
+![重复图片与缓存复用](screenshots/scientific-fixture.png)
+
+## 大生物结构的源码回退
+
+以下只验证文本保留，不代表已经支持 PDB 三维显示。
+
+```pdb
+REMARK synthetic fixture; not an experimental structure
+ATOM      1  N   GLY A   1       0.000   0.000   0.000  1.00  0.00           N
+ATOM      2  CA  GLY A   1       1.000   0.000   0.000  1.00  0.00           C
+END
+```
+
+### 立体化学必须保留
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+N[C@@H](C)C(=O)O
+```
+
+## 公式覆盖：动力学、概率、统计、矩阵与信息熵
+
+下面的公式只使用通用数学命令。参数是符号夹具，不能解释成真实样本的估计值。
+
+### 竞争性抑制动力学
+
+$$
+v=\frac{V_{max}[S]}{K_m\left(1+\frac{[I]}{K_i}\right)+[S]}
+$$
+
+### 二项分布与期望
+
+$$
+P(X=k)=\frac{n!}{k!(n-k)!}p^k(1-p)^{n-k}, \qquad E[X]=np
+$$
+
+### 正态近似与方差
+
+$$
+z=\frac{x-\mu}{\sigma}, \qquad \sigma^2=\frac{1}{n}\sum_{i=1}^{n}(x_i-\mu)^2
+$$
+
+### 两状态矩阵模型
+
+$$
+\left(\begin{matrix}x_{t+1}\\y_{t+1}\end{matrix}\right)=\left(\begin{matrix}a&b\\c&d\end{matrix}\right)\left(\begin{matrix}x_t\\y_t\end{matrix}\right)
+$$
+
+### Shannon 熵与互信息
+
+$$
+H(X)=-\sum_i p_i\log p_i, \qquad I(X;Y)=\sum_{i,j}p_{ij}\log\frac{p_{ij}}{p_i p_j}
+$$
+
+### 相关系数夹具
+
+$$
+r=\frac{\sum_i(x_i-\mu_x)(y_i-\mu_y)}{\sqrt{\sum_i(x_i-\mu_x)^2}\sqrt{\sum_i(y_i-\mu_y)^2}}
+$$
+
+## 合成生物小分子
+
+这些是无立体标记的单分子输入，用于检查小分子代谢物标签和数学段落的相邻布局；不代表样本来源或代谢通量结果。
+
+### 乳酸
+
+```smiles
+CC(O)C(=O)O
+```
+
+### 开链葡萄糖夹具
+
+```smiles
+OCC(O)C(O)C(O)C(O)C=O
+```
+
+### 丙酮酸根夹具
+
+```smiles
+CC(=O)C(=O)[O-]
+```
+
+## 序列、注释、结构和通路源码对照
+
+以下块必须保持普通代码文本。它们的字段和名称全部是 synthetic fixture，不能当作专用生物图形或真实研究结果。
+
+### FASTA（合成序列）
+
+```fasta
+>synthetic_gene_alpha
+ACGTACGTACGTACGTACGT
+>synthetic_gene_beta
+TTGCAATTGCAATTGCAA
+```
+
+### FASTQ（合成序列和质量占位）
+
+```fastq
+@synthetic_read_01
+ACGTACGTACGT
++
+IIIIIIIIIIII
+@synthetic_read_02
+TTGCAATTGC
++
+JJJJJJJJJJ
+```
+
+### 序列比对（普通文本）
+
+```text
+# synthetic pairwise alignment; '-' is a gap
+synthetic_A  ACGTACGT--ACGT
+synthetic_B  ACGTACGTTTACGT
+              ||||||  ||||
+```
+
+### Newick 树（源码对照）
+
+```newick
+(synthetic_A:0.10,(synthetic_B:0.20,synthetic_C:0.20):0.05)synthetic_root;
+```
+
+### GFF3 注释（源码对照）
+
+```gff3
+##gff-version 3
+synthetic_seq	synthetic	gene	1	18	.	+	.	ID=synthetic_gene_1
+synthetic_seq	synthetic	CDS	4	15	.	+	0	Parent=synthetic_gene_1
+```
+
+### BED 区间（源码对照）
+
+```bed
+synthetic_seq	0	18	synthetic_gene_1	0	+
+synthetic_seq	24	42	synthetic_gene_2	0	-
+```
+
+### PDB 坐标（源码对照）
+
+现有 PDB 块只验证固定宽度文本、复制和回退行为，不代表已实现三维结构显示。
+
+```pdb
+REMARK synthetic fixture; not an experimental structure
+ATOM      1  N   ALA A   1       0.000   0.000   0.000  1.00  0.00           N
+ATOM      2  CA  ALA A   1       1.450   0.000   0.000  1.00  0.00           C
+TER
+END
+```
+
+### 通路 Mermaid（源码对照）
+
+Mermaid 代码仅作为通路关系的可复制夹具；当前没有 Mermaid/通路图专用渲染器。
+
+```mermaid
+flowchart LR
+  synthetic_substrate[synthetic substrate] --> synthetic_enzyme[synthetic enzyme]
+  synthetic_enzyme --> synthetic_product[synthetic product]
+```
+
+## 人工观察记录
+
+每次查看这份语料都记录：向上和向下重复滚动后公式、代码块和图片是否仍在原位置；拖选跨过公式、SMILES 和多行序列时选区是否连续；连续缩放窗口宽高后是否出现截断、重排抖动或水平溢出；切换标签后返回时缓存内容、源码顺序和图片是否恢复。只记录实际观察到的现象，不把合成数据或小规模语料写成生物学结论。
+矩阵、信息熵和常见生物小分子也只使用已有的数学或单分子 SMILES 路径；多序列、树、注释和通路不会被伪装成图形。
+单分子 SMILES 同样受 2048 字节、128 个原子和 192 条键的生产限制；本文件中的所有 SMILES 都保持单行。
diff --git a/docs/chemistry-rendering-test.md b/docs/chemistry-rendering-test.md
new file mode 100644
index 0000000..727be72
--- /dev/null
+++ b/docs/chemistry-rendering-test.md
@@ -0,0 +1,939 @@
+# 化学科研渲染回归文档
+
+这些是小体积、可重复的验证材料；不是一次打开 100 MB 或启动 80 个 AI 的压力脚本。测试直接读取本文件中的数学和 SMILES 块。先在单窗口验证，再采用受限的模型测试验证多会话和总预算。不要为测试自动请求真实 AI 服务。
+
+成功的 SMILES 必须是单行、单个分子，源码不超过 2048 字节，最多 128 个原子和 192 条键。反应 SMILES、立体化学、坏结构和专用格式都单独标记源码回退，不能把回退文本当成结构图通过。
+
+每次检查：往返滚动、反复拖选文字、连续改变窗口宽高、切换标签后返回、切换主题；记录有无丢图、闪烁、错误重绘、选区错位和内存持续增长。看到不支持的语法时应保留源码，不能悄悄生成错误科学图形。
+
+## 基础化学方程与二维结构
+
+普通 TeX 描述上下标与箭头；SMILES 给出明确的二维连接关系。
+
+$$
+2\mathrm{H}_2+\mathrm{O}_2\rightarrow 2\mathrm{H}_2\mathrm{O}
+$$
+
+### 乙醇
+
+```smiles
+CCO
+```
+
+### 苯
+
+```smiles
+c1ccccc1
+```
+
+### 阿司匹林
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+### 咖啡因
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+### 甘氨酸
+
+```smiles
+NCC(=O)O
+```
+
+### 乙酸
+
+```smiles
+CC(=O)O
+```
+
+### 氯化铵
+
+```smiles
+[NH4+].[Cl-]
+```
+
+### 萘
+
+```smiles
+c1ccc2ccccc2c1
+```
+
+## 常用化学公式
+
+以下是应进入普通数学渲染的基础化学式；下标、上标和电荷都保留在 TeX 源码中。方括号表示浓度或离子，不是 SMILES 输入。
+
+内联浓度关系为 $c=\frac{n}{V}$，酸碱平衡常数为 $K_a=\frac{[\mathrm{H}^{+}][\mathrm{A}^{-}]}{[\mathrm{HA}]}$。
+
+$$
+2\mathrm{H}_2+\mathrm{O}_2\rightarrow2\mathrm{H}_2\mathrm{O}
+$$
+
+$$
+\mathrm{NH}_4^{+}\leftrightarrow\mathrm{NH}_3+\mathrm{H}^{+},\qquad
+K_b=\frac{[\mathrm{NH}_4^{+}]}{[\mathrm{NH}_3][\mathrm{H}^{+}]}
+$$
+
+$$
+\mathrm{Fe}^{2+}+2\mathrm{OH}^{-}\rightarrow\mathrm{Fe(OH)}_2,\qquad
+{}^{13}\mathrm{C}-\mathrm{NMR}\;\delta=31\,\mathrm{ppm}
+$$
+
+$$
+\Delta G^{\circ}_{\mathrm{rxn}}=\Delta H^{\circ}_{\mathrm{rxn}}-T\Delta S^{\circ}_{\mathrm{rxn}},\qquad
+\Delta G=\Delta G^{\circ}+RT\ln Q
+$$
+
+## SMILES 覆盖
+
+这些单行块覆盖芳香环、稠环、支链、离子、断连盐和同位素。它们是合成的输入样例，不表达实验结果。
+
+### 芳香杂环
+
+```smiles
+c1ccncc1
+```
+
+### 支链与羧酸
+
+```smiles
+CC(C)C(=O)O
+```
+
+### 离子与断连盐
+
+```smiles
+C[N+](C)(C)C.[Cl-]
+```
+
+### 同位素甲烷
+
+```smiles
+[13CH4]
+```
+
+### 氘水
+
+```smiles
+[2H]O[2H]
+```
+
+`[13CH4]` 和 `[2H]O[2H]` 是有效的同位素 SMILES，需由生产解析器实际验证；若当前依赖不接受同位素属性，测试应记录源码回退原因，不得改写成普通氢原子。
+
+## 超过单面板缓存项数的不同结构
+
+直链烷烃是布局负载样例，不用于比较化学性质。每段混合重复公式、不同分子和相同本地图片，验证资源复用。
+
+### 链长样例 01
+
+第 1 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+C
+```
+
+$$
+K_{1}=\frac{[P]}{[R]}\qquad \Delta G_{1}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 02
+
+第 2 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CC
+```
+
+$$
+K_{2}=\frac{[P]}{[R]}\qquad \Delta G_{2}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 03
+
+第 3 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCC
+```
+
+$$
+K_{3}=\frac{[P]}{[R]}\qquad \Delta G_{3}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 04
+
+第 4 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCC
+```
+
+$$
+K_{4}=\frac{[P]}{[R]}\qquad \Delta G_{4}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 05
+
+第 5 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCC
+```
+
+$$
+K_{5}=\frac{[P]}{[R]}\qquad \Delta G_{5}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 06
+
+第 6 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCC
+```
+
+$$
+K_{6}=\frac{[P]}{[R]}\qquad \Delta G_{6}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 07
+
+第 7 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCC
+```
+
+$$
+K_{7}=\frac{[P]}{[R]}\qquad \Delta G_{7}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 08
+
+第 8 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCC
+```
+
+$$
+K_{8}=\frac{[P]}{[R]}\qquad \Delta G_{8}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 09
+
+第 9 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCC
+```
+
+$$
+K_{9}=\frac{[P]}{[R]}\qquad \Delta G_{9}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 10
+
+第 10 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCC
+```
+
+$$
+K_{10}=\frac{[P]}{[R]}\qquad \Delta G_{10}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 11
+
+第 11 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCC
+```
+
+$$
+K_{11}=\frac{[P]}{[R]}\qquad \Delta G_{11}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 12
+
+第 12 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCC
+```
+
+$$
+K_{12}=\frac{[P]}{[R]}\qquad \Delta G_{12}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 13
+
+第 13 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCC
+```
+
+$$
+K_{13}=\frac{[P]}{[R]}\qquad \Delta G_{13}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 14
+
+第 14 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCC
+```
+
+$$
+K_{14}=\frac{[P]}{[R]}\qquad \Delta G_{14}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 15
+
+第 15 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCC
+```
+
+$$
+K_{15}=\frac{[P]}{[R]}\qquad \Delta G_{15}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 16
+
+第 16 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCC
+```
+
+$$
+K_{16}=\frac{[P]}{[R]}\qquad \Delta G_{16}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 17
+
+第 17 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{17}=\frac{[P]}{[R]}\qquad \Delta G_{17}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 18
+
+第 18 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{18}=\frac{[P]}{[R]}\qquad \Delta G_{18}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 19
+
+第 19 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{19}=\frac{[P]}{[R]}\qquad \Delta G_{19}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 20
+
+第 20 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{20}=\frac{[P]}{[R]}\qquad \Delta G_{20}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 21
+
+第 21 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{21}=\frac{[P]}{[R]}\qquad \Delta G_{21}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 22
+
+第 22 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{22}=\frac{[P]}{[R]}\qquad \Delta G_{22}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 23
+
+第 23 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{23}=\frac{[P]}{[R]}\qquad \Delta G_{23}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 24
+
+第 24 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{24}=\frac{[P]}{[R]}\qquad \Delta G_{24}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 25
+
+第 25 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{25}=\frac{[P]}{[R]}\qquad \Delta G_{25}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 26
+
+第 26 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{26}=\frac{[P]}{[R]}\qquad \Delta G_{26}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 27
+
+第 27 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{27}=\frac{[P]}{[R]}\qquad \Delta G_{27}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 28
+
+第 28 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{28}=\frac{[P]}{[R]}\qquad \Delta G_{28}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 29
+
+第 29 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{29}=\frac{[P]}{[R]}\qquad \Delta G_{29}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 30
+
+第 30 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{30}=\frac{[P]}{[R]}\qquad \Delta G_{30}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 31
+
+第 31 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{31}=\frac{[P]}{[R]}\qquad \Delta G_{31}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 32
+
+第 32 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{32}=\frac{[P]}{[R]}\qquad \Delta G_{32}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 33
+
+第 33 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{33}=\frac{[P]}{[R]}\qquad \Delta G_{33}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 34
+
+第 34 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{34}=\frac{[P]}{[R]}\qquad \Delta G_{34}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 35
+
+第 35 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{35}=\frac{[P]}{[R]}\qquad \Delta G_{35}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 36
+
+第 36 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{36}=\frac{[P]}{[R]}\qquad \Delta G_{36}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 37
+
+第 37 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{37}=\frac{[P]}{[R]}\qquad \Delta G_{37}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 38
+
+第 38 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{38}=\frac{[P]}{[R]}\qquad \Delta G_{38}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 39
+
+第 39 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{39}=\frac{[P]}{[R]}\qquad \Delta G_{39}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 40
+
+第 40 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{40}=\frac{[P]}{[R]}\qquad \Delta G_{40}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 41
+
+第 41 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{41}=\frac{[P]}{[R]}\qquad \Delta G_{41}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 42
+
+第 42 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{42}=\frac{[P]}{[R]}\qquad \Delta G_{42}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 43
+
+第 43 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{43}=\frac{[P]}{[R]}\qquad \Delta G_{43}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 44
+
+第 44 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{44}=\frac{[P]}{[R]}\qquad \Delta G_{44}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 45
+
+第 45 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{45}=\frac{[P]}{[R]}\qquad \Delta G_{45}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 46
+
+第 46 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{46}=\frac{[P]}{[R]}\qquad \Delta G_{46}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 47
+
+第 47 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{47}=\frac{[P]}{[R]}\qquad \Delta G_{47}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+### 链长样例 48
+
+第 48 次结构预览。上下往返滚动并拖选这段文字，检查图片出现后段落锚点是否移动。缩窄窗口后恢复，分子不能污染其他块或下一个标签。
+
+```smiles
+CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+```
+
+$$
+K_{48}=\frac{[P]}{[R]}\qquad \Delta G_{48}=\Delta G^\circ+RT\ln Q
+$$
+
+![复用的本地小图片](screenshots/scientific-fixture.png)
+
+## 不支持输入必须保留源码
+
+### 手性标记
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C[C@H](O)C(=O)O
+```
+
+### 双键立体方向
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+F/C=C/F
+```
+
+### 非闭合环
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C1CC
+```
+
+### mhchem 当前尚未实现
+
+<!-- pebrel-test: source-fallback -->
+$$
+\ce{2H2 + O2 -> 2H2O}
+$$
+
+### 分子名不应被当成 SMILES
+
+普通段落提到 smiles 或 caffeine，不应自行触发分子图。
+
+## 反应式、立体化学与坏结构
+
+生产渲染器只接收一个分子。反应 SMILES 仍是可复制的科学源码；它不能被误画成单个分子。带 `@`、`/` 或 `\` 的手性输入，以及解析失败的结构，都必须保留原文。
+
+### 反应 SMILES（源码回退）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+CC(=O)O.OCC>>CC(=O)OCC.O
+```
+
+### 反应 SMILES（含试剂段，源码回退）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+CC(=O)O.OCC>O>CC(=O)OCC
+```
+
+### 手性中心（`@`，源码回退）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C[C@H](O)C(=O)O
+```
+
+### 烯烃方向（`/`，源码回退）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+F/C=C/F
+```
+
+### 烯烃方向（反斜杠，源码回退）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+F/C=C\F
+```
+
+### 不闭合环（坏结构）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C1CC
+```
+
+### 未闭合分支（坏结构）
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C(C
+```
+
+## 专用结构格式仅作源码对照
+
+MOL/SDF 需要专用解析和布局，目前只放普通代码块来检查复制、滚动和选区稳定性；遇到这些格式时应回退到原始源码，这不是已支持的分子渲染格式。
+
+```mol
+synthetic_mol_fixture
+  Nebula  090826  2D
+
+  2  1  0  0  0  0  0  0  0  0  0  0  0  0  0  0
+    0.0000    0.0000    0.0000 C   0  0  0  0  0  0  0  0  0  0  0  0
+    1.5400    0.0000    0.0000 O   0  0  0  0  0  0  0  0  0  0  0  0
+  1  2  1  0  0  0  0
+M  END
+```
+
+```sdf
+synthetic_sdf_fixture
+  Nebula  090826
+
+  2  1  0  0  0  0  0  0  0  0  0  0  0  0  0  0
+    0.0000    0.0000    0.0000 C   0  0  0  0  0  0  0  0  0  0  0  0
+    1.5400    0.0000    0.0000 O   0  0  0  0  0  0  0  0  0  0  0  0
+  1  2  1  0  0  0  0
+M  END
+$$$$
+```
+
+## 尚未实现的化学 TeX 命令
+
+以下命令属于化学单位/化学式扩展，不是普通数学。每个块都必须留在源码中。
+
+### mhchem 化学式
+
+<!-- pebrel-test: source-fallback -->
+$$
+\ce{2H2 + O2 -> 2H2O}
+$$
+
+### siunitx 单位
+
+<!-- pebrel-test: source-fallback -->
+$$
+\SI{25}{\degreeCelsius}
+$$
+
+### siunitx 纯单位
+
+<!-- pebrel-test: source-fallback -->
+$$
+\pu{1.00e3\,kJ\,mol^{-1}}
+$$
diff --git a/docs/math-rendering-test.md b/docs/math-rendering-test.md
index 5252614..58507c2 100644
--- a/docs/math-rendering-test.md
+++ b/docs/math-rendering-test.md
@@ -176,3 +176,937 @@ $$
 ```
 
 最后的明确行内公式应该生成数学字形：$\lim_{x\to 0}\frac{\sin x}{x}=1$。
+
+## 15. 用户报告的七组科研公式
+
+每组先保留 `katex` 源码块，再用相同源码实际渲染。源码块只用于比对，公式由 `$` / `$$` 触发。测试直接读取本文件，不另抄公式。
+
+### 欧拉恒等式
+
+```katex
+e^{i\pi}+1=0
+```
+
+$$
+e^{i\pi}+1=0
+$$
+
+### 高斯积分
+
+```katex
+\int_{-\infty}^{+\infty} e^{-x^2}\,dx=\sqrt{\pi}
+```
+
+$$
+\int_{-\infty}^{+\infty} e^{-x^2}\,dx=\sqrt{\pi}
+$$
+
+### 傅里叶变换
+
+```katex
+\widehat{f}(\xi)
+=
+\int_{-\infty}^{+\infty}
+f(x)e^{-2\pi i x\xi}\,dx
+```
+
+$$
+\widehat{f}(\xi)
+=
+\int_{-\infty}^{+\infty}
+f(x)e^{-2\pi i x\xi}\,dx
+$$
+
+### Transformer 注意力机制
+
+```katex
+\operatorname{Attention}(Q,K,V)
+=
+\operatorname{softmax}\left(
+\frac{QK^{\mathsf T}}{\sqrt{d_k}}
+\right)V
+```
+
+$$
+\operatorname{Attention}(Q,K,V)
+=
+\operatorname{softmax}\left(
+\frac{QK^{\mathsf T}}{\sqrt{d_k}}
+\right)V
+$$
+
+### 分段函数
+
+```katex
+\phi(x)=
+\begin{cases}
+x, & x\ge 0,\\
+\alpha(e^x-1), & x<0.
+\end{cases}
+```
+
+$$
+\phi(x)=
+\begin{cases}
+x, & x\ge 0,\\
+\alpha(e^x-1), & x<0.
+\end{cases}
+$$
+
+### 矩阵
+
+```katex
+A=
+\begin{pmatrix}
+a_{11} & a_{12} & \cdots & a_{1n}\\
+a_{21} & a_{22} & \cdots & a_{2n}\\
+\vdots & \vdots & \ddots & \vdots\\
+a_{m1} & a_{m2} & \cdots & a_{mn}
+\end{pmatrix}
+```
+
+$$
+A=
+\begin{pmatrix}
+a_{11} & a_{12} & \cdots & a_{1n}\\
+a_{21} & a_{22} & \cdots & a_{2n}\\
+\vdots & \vdots & \ddots & \vdots\\
+a_{m1} & a_{m2} & \cdots & a_{mn}
+\end{pmatrix}
+$$
+
+### 多行推导
+
+```katex
+\begin{aligned}
+(a+b)^3
+&=(a+b)(a+b)^2\\
+&=(a+b)(a^2+2ab+b^2)\\
+&=a^3+3a^2b+3ab^2+b^3
+\end{aligned}
+```
+
+$$
+\begin{aligned}
+(a+b)^3
+&=(a+b)(a+b)^2\\
+&=(a+b)(a^2+2ab+b^2)\\
+&=a^3+3a^2b+3ab^2+b^3
+\end{aligned}
+$$
+
+## 16. 原始输出的异常对照
+
+前三个样例仍是可以排版的 TeX，但保留用户报告中的逗号和缺失等号，用于核对数学语义与原文保存。不能自动补出缺失的等号，也不能把逗号猜成 TeX 间距；测试只应确认源文本未被改写。后三个行末单反斜杠样例才是损坏输入，需要源码回退。
+
+### 高斯积分：逗号仍然是逗号
+
+<!-- pebrel-test: preserve-source -->
+$$
+\int_{-\infty}^{+\infty} e^{-x^2},dx=\sqrt{\pi}
+$$
+
+### 傅里叶变换：原文缺少等号
+
+<!-- pebrel-test: preserve-source -->
+$$
+\widehat{f}(\xi)
+
+\int_{-\infty}^{+\infty}
+f(x)e^{-2\pi i x\xi},dx
+$$
+
+### 注意力公式：原文缺少等号
+
+<!-- pebrel-test: preserve-source -->
+$$
+\operatorname{Attention}(Q,K,V)
+
+\operatorname{softmax}\left(
+\frac{QK^{\mathsf T}}{\sqrt{d_k}}
+\right)V
+$$
+
+### 行结束反斜杠损坏：分段函数
+
+<!-- pebrel-test: source-fallback -->
+$$
+\phi(x)=
+\begin{cases}
+x, & x\ge 0,\
+\alpha(e^x-1), & x<0.
+\end{cases}
+$$
+
+### 行结束反斜杠损坏：矩阵
+
+<!-- pebrel-test: source-fallback -->
+$$
+A=
+\begin{pmatrix}
+a_{11} & a_{12} & \cdots & a_{1n}\
+a_{21} & a_{22} & \cdots & a_{2n}\
+\vdots & \vdots & \ddots & \vdots\
+a_{m1} & a_{m2} & \cdots & a_{mn}
+\end{pmatrix}
+$$
+
+### 行结束反斜杠损坏：多行推导
+
+<!-- pebrel-test: source-fallback -->
+$$
+\begin{aligned}
+(a+b)^3
+&=(a+b)(a+b)^2\
+&=(a+b)(a^2+2ab+b^2)\
+&=a^3+3a^2b+3ab^2+b^3
+\end{aligned}
+$$
+
+## 17. 滚动、选区和缩放回归
+
+在本文件顶部与末尾之间往返滚动，再在公式附近拖选中文、英文和源码。窗口从宽列缩到窄列后恢复，检查分母、根号、矩阵括号、相邻文字和选区。Ctrl+C 的结果应保持源文本语义。输入法正在组合、终端光标所在行和 VI 模式不能被图片覆盖。
+
+下面的不同公式用于扰动布局缓存；编号是测试参数，不是新增数学结论。
+
+### 滚动样例 01
+
+第 1 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{1}(x)=\frac{x^2+1}{\sqrt{1+x^2}}+\sum_{k=1}^{1}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 02
+
+第 2 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{2}(x)=\frac{x^2+2}{\sqrt{1+x^2}}+\sum_{k=1}^{2}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 03
+
+第 3 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{3}(x)=\frac{x^2+3}{\sqrt{1+x^2}}+\sum_{k=1}^{3}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 04
+
+第 4 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{4}(x)=\frac{x^2+4}{\sqrt{1+x^2}}+\sum_{k=1}^{4}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 05
+
+第 5 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{5}(x)=\frac{x^2+5}{\sqrt{1+x^2}}+\sum_{k=1}^{5}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 06
+
+第 6 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{6}(x)=\frac{x^2+6}{\sqrt{1+x^2}}+\sum_{k=1}^{6}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 07
+
+第 7 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{7}(x)=\frac{x^2+7}{\sqrt{1+x^2}}+\sum_{k=1}^{7}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 08
+
+第 8 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{8}(x)=\frac{x^2+8}{\sqrt{1+x^2}}+\sum_{k=1}^{8}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 09
+
+第 9 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{9}(x)=\frac{x^2+9}{\sqrt{1+x^2}}+\sum_{k=1}^{9}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 10
+
+第 10 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{10}(x)=\frac{x^2+10}{\sqrt{1+x^2}}+\sum_{k=1}^{10}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 11
+
+第 11 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{11}(x)=\frac{x^2+11}{\sqrt{1+x^2}}+\sum_{k=1}^{11}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 12
+
+第 12 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{12}(x)=\frac{x^2+12}{\sqrt{1+x^2}}+\sum_{k=1}^{12}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 13
+
+第 13 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{13}(x)=\frac{x^2+13}{\sqrt{1+x^2}}+\sum_{k=1}^{13}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 14
+
+第 14 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{14}(x)=\frac{x^2+14}{\sqrt{1+x^2}}+\sum_{k=1}^{14}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 15
+
+第 15 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{15}(x)=\frac{x^2+15}{\sqrt{1+x^2}}+\sum_{k=1}^{15}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 16
+
+第 16 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{16}(x)=\frac{x^2+16}{\sqrt{1+x^2}}+\sum_{k=1}^{16}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 17
+
+第 17 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{17}(x)=\frac{x^2+17}{\sqrt{1+x^2}}+\sum_{k=1}^{17}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 18
+
+第 18 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{18}(x)=\frac{x^2+18}{\sqrt{1+x^2}}+\sum_{k=1}^{18}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 19
+
+第 19 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{19}(x)=\frac{x^2+19}{\sqrt{1+x^2}}+\sum_{k=1}^{19}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 20
+
+第 20 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{20}(x)=\frac{x^2+20}{\sqrt{1+x^2}}+\sum_{k=1}^{20}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 21
+
+第 21 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{21}(x)=\frac{x^2+21}{\sqrt{1+x^2}}+\sum_{k=1}^{21}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 22
+
+第 22 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{22}(x)=\frac{x^2+22}{\sqrt{1+x^2}}+\sum_{k=1}^{22}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 23
+
+第 23 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{23}(x)=\frac{x^2+23}{\sqrt{1+x^2}}+\sum_{k=1}^{23}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 24
+
+第 24 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{24}(x)=\frac{x^2+24}{\sqrt{1+x^2}}+\sum_{k=1}^{24}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 25
+
+第 25 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{25}(x)=\frac{x^2+25}{\sqrt{1+x^2}}+\sum_{k=1}^{25}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 26
+
+第 26 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{26}(x)=\frac{x^2+26}{\sqrt{1+x^2}}+\sum_{k=1}^{26}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 27
+
+第 27 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{27}(x)=\frac{x^2+27}{\sqrt{1+x^2}}+\sum_{k=1}^{27}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 28
+
+第 28 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{28}(x)=\frac{x^2+28}{\sqrt{1+x^2}}+\sum_{k=1}^{28}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 29
+
+第 29 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{29}(x)=\frac{x^2+29}{\sqrt{1+x^2}}+\sum_{k=1}^{29}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 30
+
+第 30 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{30}(x)=\frac{x^2+30}{\sqrt{1+x^2}}+\sum_{k=1}^{30}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 31
+
+第 31 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{31}(x)=\frac{x^2+31}{\sqrt{1+x^2}}+\sum_{k=1}^{31}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 32
+
+第 32 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{32}(x)=\frac{x^2+32}{\sqrt{1+x^2}}+\sum_{k=1}^{32}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 33
+
+第 33 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{33}(x)=\frac{x^2+33}{\sqrt{1+x^2}}+\sum_{k=1}^{33}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 34
+
+第 34 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{34}(x)=\frac{x^2+34}{\sqrt{1+x^2}}+\sum_{k=1}^{34}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 35
+
+第 35 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{35}(x)=\frac{x^2+35}{\sqrt{1+x^2}}+\sum_{k=1}^{35}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 36
+
+第 36 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{36}(x)=\frac{x^2+36}{\sqrt{1+x^2}}+\sum_{k=1}^{36}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 37
+
+第 37 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{37}(x)=\frac{x^2+37}{\sqrt{1+x^2}}+\sum_{k=1}^{37}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 38
+
+第 38 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{38}(x)=\frac{x^2+38}{\sqrt{1+x^2}}+\sum_{k=1}^{38}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 39
+
+第 39 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{39}(x)=\frac{x^2+39}{\sqrt{1+x^2}}+\sum_{k=1}^{39}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 40
+
+第 40 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{40}(x)=\frac{x^2+40}{\sqrt{1+x^2}}+\sum_{k=1}^{40}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 41
+
+第 41 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{41}(x)=\frac{x^2+41}{\sqrt{1+x^2}}+\sum_{k=1}^{41}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 42
+
+第 42 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{42}(x)=\frac{x^2+42}{\sqrt{1+x^2}}+\sum_{k=1}^{42}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 43
+
+第 43 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{43}(x)=\frac{x^2+43}{\sqrt{1+x^2}}+\sum_{k=1}^{43}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 44
+
+第 44 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{44}(x)=\frac{x^2+44}{\sqrt{1+x^2}}+\sum_{k=1}^{44}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 45
+
+第 45 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{45}(x)=\frac{x^2+45}{\sqrt{1+x^2}}+\sum_{k=1}^{45}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 46
+
+第 46 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{46}(x)=\frac{x^2+46}{\sqrt{1+x^2}}+\sum_{k=1}^{46}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 47
+
+第 47 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{47}(x)=\frac{x^2+47}{\sqrt{1+x^2}}+\sum_{k=1}^{47}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+### 滚动样例 48
+
+第 48 段：公式前的中文与英文 baseline alignment，检查窗口缩放后的段落连续性。
+
+$$
+f_{48}(x)=\frac{x^2+48}{\sqrt{1+x^2}}+\sum_{k=1}^{48}k
+$$
+
+公式后的说明应留在原段落中，重复拖选和滚动不能复制出渲染器内部文本。
+
+## 18. 重音与伸缩分隔符
+
+行内中文、英文和重音公式应保持同一条基线：复数共轭写作 $\overline{z}$，向量写作 $\vec{v}$，观测量写作 $\widehat{y}$。
+
+$$
+\hat{x}\quad \bar{x}\quad \tilde{x}\quad \vec{v}\quad
+\dot{x}\quad \ddot{x}\quad \widehat{AB}\quad
+\widetilde{f+g}\quad \overline{z}
+$$
+
+$$
+\begin{gathered}
+\left(\frac{a}{b}\right)\quad
+\left[\sum_{i=1}^{n}x_i\right]\quad
+\left\{x\in\mathbb{R}\mid x>0\right\}\\
+\left\langle u,v\right\rangle\quad
+\left\lvert x-1\right\rvert\quad
+\left\Vert A\right\Vert\quad
+\left\lfloor y\right\rfloor\quad
+\left\lceil y\right\rceil
+\end{gathered}
+$$
+
+$$
+\big(x+y\big)\quad
+\Big[x\Big]\quad
+\bigg\{x\bigg\}\quad
+\Bigg\langle x\Bigg\rangle\quad
+\left.\frac{\mathrm{d}f}{\mathrm{d}x}\right|_{x=0}
+$$
+
+## 19. 积分、大运算符与上下限
+
+上限和下限同时存在时，积分号、求和号和乘积号的脚标应随公式缩放；积分后的单位写在同一行。
+
+$$
+\int_{0}^{1}x^2\,\mathrm{d}x=\frac{1}{3},\quad
+\iint_{D}f(x,y)\,\mathrm{d}A,\quad
+\iiint_{V}g(x,y,z)\,\mathrm{d}V,\quad
+\oint_{\partial\Omega}\vec{F}\cdot\mathrm{d}\vec{r}
+$$
+
+$$
+\sum_{k=0}^{n}k^2,\quad
+\prod_{j=1}^{m}a_j,\quad
+\bigcup_{i=1}^{n}A_i,\quad
+\bigcap_{i=1}^{n}B_i,\quad
+\sum_{i=1}^{n}C_i
+$$
+
+$$
+\lim_{x\to 0}\frac{\sin x}{x}=1,\quad
+\limsup_{n\to\infty}a_n,\quad
+\sup_{x\in D}f(x),\quad
+\inf_{x\in D}f(x)
+$$
+
+## 20. 希腊字母、集合与逻辑
+
+$$
+\alpha\ \beta\ \gamma\ \delta\ \epsilon\ \varepsilon\ \zeta\ \eta\ \theta\ \vartheta\ \iota\ \kappa\ \lambda\ \mu\ \nu\ \xi\ \pi\ \varpi\ \rho\ \varrho\ \sigma\ \varsigma\ \tau\ \upsilon\ \phi\ \varphi\ \chi\ \psi\ \omega
+$$
+
+$$
+\mathbb{N}\subset\mathbb{Z}\subset\mathbb{Q}\subset\mathbb{R}\subset\mathbb{C},\quad
+\mathbb{R}\supset\mathbb{Q},\quad
+A\cup B,\quad
+\lvert A\cup B\rvert=\lvert A\rvert+\lvert B\rvert-\lvert A\cap B\rvert
+$$
+
+$$
+\forall x\in X,\ \exists y\in Y:\ P(x,y),\quad
+\neg(P\land Q)\Leftrightarrow(\neg P\lor\neg Q),\quad
+P\Rightarrow Q,\quad Q\Leftrightarrow P
+$$
+
+## 21. 矩阵环境族
+
+$$
+\begin{Bmatrix}
+a & b\\
+c & d
+\end{Bmatrix}
+\qquad
+\begin{Vmatrix}
+a & b\\
+c & d
+\end{Vmatrix}
+$$
+
+$$
+\begin{smallmatrix}
+1 & 2 & 3\\
+4 & 5 & 6
+\end{smallmatrix}
+\qquad
+\begin{array}{lcr}
+\text{左对齐} & \text{居中} & \text{右对齐}\\
+a & b & c\\
+d & e & f
+\end{array}
+$$
+
+$$
+\begin{pmatrix}
+1 & 0\\
+0 & 1
+\end{pmatrix}
+\begin{bmatrix}
+1 & 2\\
+3 & 4
+\end{bmatrix}
+\begin{Bmatrix}
+1 & 2\\
+3 & 4
+\end{Bmatrix}
+$$
+
+## 22. 嵌套分式与根式
+
+$$
+\frac{1+\dfrac{1}{1+\tfrac{1}{x}}}
+{\sqrt{1+\frac{a^2}{b^2}}}
+\quad
+\frac{\sqrt{b^2+a^2}}{\sqrt{b^2}}
+$$
+
+$$
+\sqrt{\frac{1+\frac{1}{n}}{1-\frac{1}{n}}}\quad
+\sqrt[3]{\frac{x^3+y^3}{x+y}}\quad
+\sqrt[\alpha]{\frac{\dfrac{p}{q}}{\sqrt{r+s}}}
+$$
+
+$$
+\left(
+\frac{\dfrac{\sqrt{x+1}}{y-1}}
+{\dfrac{a+b}{c+d}}
+\right)^{\!2}
+\quad
+\frac{\displaystyle\sum_{i=1}^{n}\frac{x_i}{1+x_i^2}}
+{\displaystyle\sqrt{\prod_{j=1}^{m}(1+z_j^2)}}
+$$
+
+## 23. 对齐与多行推导环境
+
+$$
+\begin{gathered}
+u+v=w\\
+w+t=s\\
+s-r=q
+\end{gathered}
+$$
+
+$$
+\begin{split}
+\sin(a+b)
+&=\sin a\cos b+\cos a\sin b\\
+\cos(a+b)
+&=\cos a\cos b-\sin a\sin b
+\end{split}
+$$
+
+$$
+\begin{alignedat}{2}
+f(x)&=x^2+1 &\qquad g(x)&=x^2-1\\
+f'(x)&=2x & g'(x)&=2x
+\end{alignedat}
+$$
+
+$$
+\begin{multline}
+\frac{1}{2}(a+b)^2
+=\frac{1}{2}a^2+ab+\frac{1}{2}b^2\\
+\text{用于检查多行公式在窄列中的连续性}
+\end{multline}
+$$
+
+## 24. 字体变体与样式
+
+$$
+\mathrm{d}x\quad
+\mathbf{v}\quad
+\mathit{X}\quad
+\mathsf{N}\quad
+\mathtt{code}\quad
+\mathbb{R}\quad
+\mathcal{L}\quad
+\mathfrak{g}
+$$
+
+$$
+\displaystyle\sum_{n=1}^{\infty}\frac{1}{n^2}
+=\frac{\pi^2}{6},\qquad
+\textstyle\sum_{n=1}^{3}n,\qquad
+\scriptstyle x_i^2,\qquad
+\scriptscriptstyle x_i^2
+$$
+
+$$
+\operatorname{rank}(BC)\leq
+\min\{\operatorname{rank}(B),\operatorname{rank}(C)\},\quad
+\mathrm{e}^{\mathrm{i}\theta}=\cos\theta+\mathrm{i}\sin\theta
+$$
+
+## 25. 单位与中文混排
+
+中文说明应可以紧邻行内公式：样品长度为 $12\,\mathrm{mm}$，速度为 $3.0\,\mathrm{m\,s^{-1}}$，温度为 $300\,\mathrm{K}$。公式前后的汉字不能被公式盒覆盖。
+
+$$
+m=2.5\,\mathrm{kg},\quad
+E=mc^2,\quad
+p=1.01\,\mathrm{MPa},\quad
+c=299\,792\,458\,\mathrm{m\,s^{-1}}
+$$
+
+$$
+\rho=\frac{m}{V}=1.00\,\mathrm{g\,cm^{-3}},\quad
+\lambda=532\,\mathrm{nm},\quad
+\nu=6.0\times10^{14}\,\mathrm{Hz},\quad
+\Delta T=25\,\mathrm{K}
+$$
+
+带中文的自然段也应保持数学源文本可复制：在 $x=0$ 附近，函数 $f(x)$ 的一阶导数满足 $\frac{\mathrm{d}f}{\mathrm{d}x}=0$。
+
+## 26. 可降级装饰
+
+boxed 和 tag 只要求数学内容仍可读；边框或编号位置可以由渲染器降级处理。
+
+$$
+\boxed{E=mc^2}\tag{1}
+$$
+
+$$
+\boxed{\frac{a+b}{c+d}}\tag*{附录}
+$$
+
+## 27. 不支持宏与坏输入的源码回退
+
+以下块故意使用当前引擎不支持的化学式、物理量和单位宏。回退时保留原始数学源码，不应把这些宏猜译成另一种公式。
+
+<!-- pebrel-test: source-fallback -->
+$$
+\ce{H2O + CO2 -> H2CO3}
+$$
+
+<!-- pebrel-test: source-fallback -->
+$$
+\pu{9.81\ m/s^2}
+$$
+
+<!-- pebrel-test: source-fallback -->
+$$
+\SI{9.81}{\meter\per\second\squared}
+$$
+
+以下块有意缺少右花括号，用于确认坏输入会回退到源码；不能补写缺失字符后再声称公式成功。
+
+<!-- pebrel-test: source-fallback -->
+$$
+\frac{a+b}{c+d
+$$
diff --git a/docs/project-constraints.md b/docs/project-constraints.md
index d0f9135..9d902dd 100644
--- a/docs/project-constraints.md
+++ b/docs/project-constraints.md
@@ -111,6 +111,109 @@ needs separate work. Fork patches retain exact-revision pins, thin adapter scope
 recorded motivation and an upstream-removal condition. Release safety remains in
 `AGENTS.md` and the existing verified release instructions.
 
+## 5. UI 设计约束 / UI design constraints
+
+用户在 2026-09-09 明确要求将交互反馈纳入工程约束。以下是产品实现与人工
+评审合同，不是“调用了某个组件就自动合格”，也不表示既有界面已经全部达标。
+新增或修改 UI 时，必须同时检查行为、状态、视觉与实际命中区域。
+
+### 5.1 交互反馈与状态可见性
+
+- 每个交互控件应声明适用的状态：默认、hover、pressed、键盘焦点、selected、
+  disabled、loading、success、error。不是每个控件都需要全部状态，但不能遗漏
+  用户理解当前操作所必需的状态。
+- 操作必须形成“触发 → 执行 → 可感知结果”的闭环。只绑定 `on_click`、写入
+  剪贴板或调用接口，不等于完成用户可用的交互。
+- 小范围操作优先**就地反馈**；toast 是辅助的非阻塞通知，不应每次操作都用
+  大弹窗或重复通知打断阅读。失败需要清楚说明原因或可执行的恢复方式。
+- success 只能在实际操作完成、或平台接口已接受写入后出现，不能在任务尚未
+  执行时提前显示。接口若返回错误必须处理；接口不暴露完成/错误状态时，应在
+  验证记录中明确能力边界，不得冒称已经做了系统级成功验证。
+- 重复点击、取消、超时、视图关闭和旧异步结果不得破坏反馈状态。定时恢复要
+  随拥有它的视图释放，新的操作应刷新期限，旧定时器不能提前清除新的反馈。
+
+### 5.2 复制操作的具体合同
+
+- 复制代码、路径、公式等内容后，必须提供用户能辨认的结果。轻量复制的默认
+  模式是“复制图标 → 勾选图标 + 已复制说明 → 恢复”，而不是点击后毫无变化。
+- 成功反馈期间，即使鼠标移开，反馈仍应可见。恢复时间使用共享实现或令牌，
+  约 1.5 秒是当前交互的起点，不是通用平台标准；连续复制要重置显示期限。
+- 成功与失败不能只用颜色区分。复制按钮变化、tooltip/短文案与可用的辅助技术
+  状态通知应表达同一事实；失败不能显示成功勾。
+- hover 显示的复制按钮使用覆盖式定位，不为隐藏按钮预留永久布局槽位，不在
+  显示/变勾/恢复时移动代码、公式、邻近文字或滚动位置。
+- 复制代码默认复制原始代码，不夹带语言标签、Markdown fence、行号或装饰。
+  “复制 Markdown 源码”如有需要应是独立且命名明确的操作。
+- 剪贴板适配、反馈期限和成功/失败语义保持单一权威实现，不在每个视图里复制
+  一套略有差异的定时器或虚假的成功 toast。
+
+### 5.3 Hover、键盘焦点与命中区域
+
+- 可点击内容必须有可发现的 hover/pressed 反馈。鼠标 hover、键盘焦点、菜单
+  展开和持久选中不是同一种状态，不得共用一个布尔值混为一谈。
+- 鼠标点击后不得残留无语义的黑框；修复时不能顺手禁用键盘焦点指示。键盘
+  Tab/方向键/Enter/Escape 路径必须仍然可达、可见、可退出。
+- 图标视觉尺寸与真实点击区域必须分开定义。常规桌面图标可使用约 16–18
+  logical px、约 32px 点击区域作为项目起点；经确认的紧凑控件可以不同，但
+  必须验证实际命中，不得拿截图物理像素当逻辑尺寸或声称这些值是普遍标准。
+- 标签控件应让整块标签区域（含留白）可点击，而非只有文字附近响应。
+  拖拽分隔线的可见宽度与命中宽度分离；释放鼠标、取消或离开有效生命周期后
+  必须结束拖动，且拖动控件不得误触发正文选区。
+- hover 弹出的工具栏必须允许指针从内容移动到工具栏，不能一离开公式/代码
+  就关闭导致无法点击；同时支持适用的键盘操作方式。
+
+### 5.4 颜色、布局与组件默认值
+
+- 使用语义角色区分正文、次级文字、代码底色、hover、selected、focus、危险和
+  成功。不能因为变量叫 `accent` 就用于选中下划线；必须核对当前主题中的实际
+  对比度和状态含义。
+- 原型已获确认时，落地应对照其颜色角色、位置、比例、留白和反馈，而不只是
+  复制控件名称。必须检查第三方组件的内部字体、图标尺寸、焦点边框、菜单和
+  搜索框是否覆盖应用层设定；外层 `.xsmall()` 等调用不构成视觉一致性证明。
+- 搜索输入、菜单行和触发标签的尺寸按各自职责控制。语言选择标签不能因缩小
+  自己而把弹出菜单的搜索框一起压矮；文本不得以字符数粗估宽度而截掉 CJK 标签。
+- 不靠扩大字号代替留白；不靠不可见/超低对比度解决视觉噪声。正常、浅色、
+  深色、高 DPI、窄窗口以及键盘焦点状态都要检查。
+- 几何（圆角/间隙/分隔线）、配色、透明度/模糊效果与窗口全屏分别归属明确
+  状态。文档专注模式不得调用系统全屏；隐藏侧栏后对应的标题栏色块、选中态
+  和恢复入口也必须同步，不留半套旧界面。
+- 主题候选需附可追溯来源、真实预览和适用范围，由用户审批后落地。社区采用
+  情况与作者自述、个人审美判断要分开记录，不自行新增“凑数”主题。
+
+### 5.5 数学公式的交互合同
+
+- 公式 hover/focus 提供轻量操作：**复制 LaTeX** 与 **复制公式图片**。操作必须
+  指向当前公式，不能复制整段文档、邻近公式或整窗截图。
+- 默认 LaTeX 复制保留原始公式体；是否携带 `$`/`$$` 等定界符必须明确，不得
+  悄悄使用标准化/裁剪后的显示文本替代源公式。
+- 行内公式的基线、段落高度和换行不得因工具栏出现改变；显示公式同样不能
+  因 hover 额外撑出操作栏。相邻公式要有独立身份与操作目标。
+- 图片导出应复用有界渲染资源，明确格式、透明背景/文字色、像素尺寸与缩放；
+  必须正确处理 BGRA/RGBA、DPI 和附加字体回补文字，不能产生颜色错误或缺字图
+  后仍显示成功。未就绪/不支持的导出须解释或禁用，不输出不完整图片。
+- hover 本身不得触发无界重编译、增加常驻整图副本或绕过科学渲染内存预算。
+  图片编码等昂贵工作不得阻塞界面线程；取消/关闭视图需释放相关任务与资源。
+- 文本复制与图片复制都遵循 5.2 的结果反馈规则，且应分别提供可识别名称。
+
+### 5.6 验收要求与证据边界
+
+- 交互测试要点击真实布局与控件，覆盖点击留白、hover 显示、键盘路径、重复
+  点击、成功恢复、失败/取消以及视图销毁；不能只断言一个回调或布尔函数。
+- 布局测试核对真实命中范围、工具栏不占位、选中线可见、长行/窄窗口以及不误选
+  正文。涉及异步反馈时使用可控时钟，避免靠真实长 sleep 得到脆弱测试。
+- 复制 LaTeX 核对实际剪贴板文本；图片核对内容完整性、通道顺序、尺寸和预算。
+  需要平台实测的路径，在没有实测时必须明确标记。
+- 对照批准原型保存关键状态截图：默认、hover、展开/搜索、复制完成、恢复及
+  专注模式进入/退出。编译通过或“状态测试通过”不能冒充视觉验收通过。
+- 这是新增/修改 UI 的评审要求，不声称现有 UI 全部达标，也不声称仅写入文档
+  就已经启用自动 UI 门禁。现有待修差异要列入验收记录，不能用新规范掩盖。
+
+参考：Nielsen 的 [Visibility of system status](https://www.nngroup.com/articles/visibility-system-status/)
+与 [10 usability heuristics](https://www.nngroup.com/articles/ten-usability-heuristics/)，
+以及 W3C 的 [Focus Visible](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html)
+和 [Target Size (Minimum)](https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html)。
+Web 可访问性标准与桌面逻辑尺寸不能直接画等号；具体项目数值仍须实测。
+
 ## Server-side activation
 
 The repository files alone do **not** activate GitHub merge protection. A maintainer
diff --git a/docs/scientific-rendering-acceptance-paper.md b/docs/scientific-rendering-acceptance-paper.md
new file mode 100644
index 0000000..e4bb2ca
--- /dev/null
+++ b/docs/scientific-rendering-acceptance-paper.md
@@ -0,0 +1,989 @@
+# 跨尺度代谢动力学、分子表征与注意力预测：科研渲染验收语料
+
+**文档类型：** 方法学论文式渲染验收示例　　**版本：** 0.1（合成数据） \
+**用途：** Pebrel/Nebula Markdown 与 AI CLI 的科学内容渲染验收输入 \
+**声明：** 本文是可重复的排版、解析、滚动和回退测试夹具，不是研究论文，也不报告真实科研发现。本文中的观测值、分子式、损失、置信区间和预测性能均由本文件为测试而构造；“准确”“稳定”“通过”等词只描述数学例子的内部一致性，不描述产品性能已经达标。
+
+## 摘要
+
+科学工作流常把不同尺度的对象放在同一个阅读表面：分子结构以 SMILES 表示，代谢通量以微分方程表示，时间序列以傅里叶基表示，而模型则以 Transformer 的注意力权重汇总上下文。它们有不同的语法边界，却会在同一份 Markdown 文档中相邻出现。本示例构造一套小型、完全合成的“代谢动力学—分子表征—注意力预测”实验，用来检验渲染器能否同时处理中文、English mixed text、窄窗口中的长公式、多行对齐推导、矩阵、分段函数、概率统计、代码、表格、Markdown 图片和 SMILES 化学结构。
+
+方法的核心是把一个可解释的动力学状态 $x(t)$ 转换为离散观测 $z_k$，以分子描述符 $m$ 和时间位置编码 $p_k$ 组成 token，再用注意力读出合成的未来通量。我们给出从守恒方程、指数衰减、傅里叶变换到 scaled dot-product attention 的连续推导，并用多组扰动参数检查长文滚动时的结构重复与缓存变化。结果章节只列出生成器预先指定的值，例如合成样本的均方误差和 bootstrap 区间；这些值不构成模型在现实数据上的性能证据。文末的验收附录列出滚动往返、跨文字选区、resize、切 tab 返回、缺图和无效语法回退等观察点，并明确 80 个真实 AI 会话与 100 MB 大负载需要独立预算，本文不能替代那类压力测试。
+
+**关键词：** scientific rendering；synthetic fixture；跨尺度动力学；傅里叶变换；Transformer attention；SMILES；可重复验收
+
+## 1. 引言
+
+### 1.1 问题背景
+
+在科研记录中，阅读者经常在相邻的段落之间切换抽象层级。一个小分子可能先以名称出现，再以键图或 SMILES 出现；同一系统的浓度变化可能先写成表格，再写成带积分的守恒关系；模型解释可能同时需要注意力矩阵、概率分布和误差统计。如果终端或桌面 Markdown 视图只正确绘制其中一种内容，用户会在复制、滚动或切换标签页时丢失上下文。
+
+本文件因此选择一个足够小但跨语法的合成问题。我们设代谢池 $A$、中间体 $B$ 和产物 $P$ 的量分别为 $a(t)$、$b(t)$、$p(t)$，并令输入通量为 $u(t)$。最小反应链可以写成
+
+$$
+A \xrightarrow{k_1} B \xrightarrow{k_2} P,
+\qquad
+\frac{d}{dt}\begin{bmatrix}a(t)\\b(t)\\p(t)\end{bmatrix}
+=
+\begin{bmatrix}-k_1 & 0 & 0\\ k_1 & -k_2 & 0\\ 0 & k_2 & 0\end{bmatrix}
+\begin{bmatrix}a(t)\\b(t)\\p(t)\end{bmatrix}
++\begin{bmatrix}u(t)\\0\\0\end{bmatrix}.
+\tag{1}
+$$
+
+式（1）同时覆盖了长矩阵、下标、导数、箭头和真正的行分隔符 `\\`。符号 $k_1,k_2>0$ 只是合成速率常数；它们没有从实验室测量中估计出来。
+
+### 1.2 验收问题
+
+本研究式夹具回答的是渲染问题，而非生物学问题：
+
+1. 行内和块级数学是否保持定界符、等号、上下标、希腊字母、积分和求和？
+2. 多行 `aligned`、`cases`、矩阵和窄窗口长公式是否保持行距，不覆盖相邻文字？
+3. 化学解析器能否把芳香环、分支、离子和同位素源码展示为结构；遇到手性或未知命令时，是否清楚回退到源码？
+4. Markdown 图片、表格、代码和双语文字能否与公式在同一滚动上下文中共存？
+5. 缓存、窗口尺寸和 tab 生命周期变化时，内容是否仍能重新排版，而不是依赖本次会话的偶然状态？
+
+### 1.3 边界声明
+
+“预测”一词在本文中只指一个由确定性脚本生成的数值序列。合成序列没有患者、样本、实验仪器或外部数据库，也没有通过网络服务生成。文中所有数字都可以由方法章节中的参数重新算出。尤其是表 4 中的 $R^2$、RMSE 和区间，不应被解释为真实模型的泛化能力。
+
+## 2. 方法
+
+### 2.1 符号与尺度
+
+时间变量 $t$ 的单位是 arbitrary time unit，浓度变量以 normalized concentration 表示。为避免把单位排版当作科学结论，我们只使用无量纲组合 $\theta=k_2t$ 和 $\rho=k_1/k_2$。指数衰减的基本解为
+
+$$
+\theta = k_2 t,
+\qquad
+a(t)=a_0e^{-k_1t},
+\qquad
+\rho=\frac{k_1}{k_2},
+\qquad
+\lim_{t\to\infty}a(t)=0.
+\tag{2}
+$$
+
+当 $k_1=k_2=k$ 时，连续链的中间体项出现线性因子。为使边界条件可见，我们从积分因子开始：
+
+$$
+\begin{aligned}
+\frac{db}{dt}+kb &= ka_0e^{-kt},\\
+\frac{d}{dt}\left(e^{kt}b(t)\right)&=ka_0,\\
+e^{kt}b(t)-b_0&=ka_0t,\\
+b(t)&=e^{-kt}\left(b_0+ka_0t\right).
+\end{aligned}
+\tag{3}
+$$
+
+这组推导故意让每一行都包含不同长度的英文或数学 token，便于观察换行和对齐。总量守恒的检验写成
+
+$$
+M(t)=a(t)+b(t)+p(t),
+\qquad
+\frac{dM}{dt}=u(t),
+\qquad
+M(t)=M(0)+\int_0^t u(s)\,ds.
+\tag{4}
+$$
+
+### 2.2 输入、采样与噪声
+
+每个样本在 $t_k=k\Delta t$ 处采样，默认 $\Delta t=0.25$，$k=0,1,\ldots,63$。输入由一个慢正弦、一项衰减和一个局部脉冲组成：
+
+$$
+u(t)=u_0+u_1\sin(\omega t+\varphi)+u_2e^{-t/\tau}+u_3\exp\left[-\frac{(t-t_c)^2}{2\sigma^2}\right].
+\tag{5}
+$$
+
+高斯项的归一化依据经典积分
+
+$$
+\int_{-\infty}^{\infty}e^{-x^2}\,dx=\sqrt{\pi},
+\qquad
+\int_{-\infty}^{\infty}\exp\left[-\frac{(t-t_c)^2}{2\sigma^2}\right]dt
+=\sqrt{2\pi}\,\sigma.
+\tag{6}
+$$
+
+观测值是确定性伪随机序列的加性扰动，写作
+
+$$
+z_k = h(x(t_k),m)+\epsilon_k,
+\qquad
+\epsilon_k\sim\mathcal N(0,\sigma_\epsilon^2),
+\qquad
+\mathbb E[\epsilon_k]=0,
+\quad
+\operatorname{Var}(\epsilon_k)=\sigma_\epsilon^2.
+\tag{7}
+$$
+
+`seed = 1729` 只用于让验收者复现同一份 fixture；它不是密码，也不代表随机性研究结论。为覆盖滚动缓存的变动，另外生成 `seed = 2718` 和 `seed = 31415` 的两组扰动，参数只改变噪声幅度与脉冲中心，正文不把它们合并成一个虚假的大样本。
+
+### 2.3 傅里叶表征
+
+对长度为 $N$ 的离散序列 $x_0,\ldots,x_{N-1}$，使用非归一化正向变换和 $1/N$ 归一化逆变换：
+
+$$
+X_n=\sum_{k=0}^{N-1}x_k\exp\left(-2\pi i\frac{kn}{N}\right),
+\qquad
+x_k=\frac{1}{N}\sum_{n=0}^{N-1}X_n\exp\left(2\pi i\frac{kn}{N}\right).
+\tag{8}
+$$
+
+连续版本与卷积关系分别为
+
+$$
+\widehat f(\xi)=\int_{-\infty}^{\infty}f(t)e^{-2\pi i\xi t}\,dt,
+\qquad
+f(t)=\int_{-\infty}^{\infty}\widehat f(\xi)e^{2\pi i\xi t}\,d\xi,
+\tag{9}
+$$
+
+$$
+\widehat{(f*g)}(\xi)=\widehat f(\xi)\widehat g(\xi),
+\qquad
+(f*g)(t)=\int_{-\infty}^{\infty}f(s)g(t-s)\,ds.
+\tag{10}
+$$
+
+在复平面上，欧拉恒等式提供最短的旋转基元：
+
+$$
+e^{i\pi}+1=0,
+\qquad
+e^{i\omega t}=\cos(\omega t)+i\sin(\omega t).
+\tag{11}
+$$
+
+式（11）同时检验 $i$、$\pi$、三角函数、加号与等号在窄行内的密度。本文不声称傅里叶特征一定优于时域特征；它们只是使验收输入包含复数和长求和的稳定方式。
+
+### 2.4 分子描述符
+
+每个 SMILES 源会被映射到一个合成描述符向量 $m\in\mathbb R^d$。为让数值可解释，本文只使用原子数、键数、芳香原子比例、形式电荷和同位素标记等字段；描述符的线性组合写成
+
+$$
+m=\begin{bmatrix}n_{\mathrm{atom}}&n_{\mathrm{bond}}&r_{\mathrm{arom}}&q_{\mathrm{formal}}&r_{\mathrm{iso}}\end{bmatrix}^{\mathsf T}
+\in\mathbb R^5.
+\tag{12}
+$$
+
+为了展示协方差和矩阵排版，中心化描述符的协方差采用
+
+$$
+\Sigma_m=\frac{1}{L-1}\sum_{j=1}^{L}(m_j-\bar m)(m_j-\bar m)^{\mathsf T},
+\qquad
+\bar m=\frac{1}{L}\sum_{j=1}^{L}m_j.
+\tag{13}
+$$
+
+一个二维投影的特征向量满足
+
+$$
+\Sigma_m v_\ell=\lambda_\ell v_\ell,
+\qquad
+v_\ell^{\mathsf T}v_r=\delta_{\ell r},
+\qquad
+\lambda_1\geq\lambda_2\geq0.
+\tag{14}
+$$
+
+这里的主成分只是视觉上方便的投影；它不等价于化学性质预测，也不替代结构验证。
+
+### 2.5 注意力编码器
+
+将动力学窗口、频域摘要和分子向量拼接成 token $y_k$ 后，使用模型维度 $d$ 的线性映射得到 query、key 和 value：
+
+$$
+Q=YW_Q,
+\qquad
+K=YW_K,
+\qquad
+V=YW_V,
+\qquad
+Y\in\mathbb R^{L\times d_{\mathrm{in}}}.
+\tag{15}
+$$
+
+缩放点积注意力为
+
+$$
+\operatorname{Attn}(Q,K,V)
+=\operatorname{softmax}\left(\frac{QK^{\mathsf T}}{\sqrt{d_k}}+M\right)V.
+\tag{16}
+$$
+
+其中遮罩 $M_{ij}$ 在允许连接时为 $0$，在禁止未来信息泄露时为 $-\infty$ 的数值近似。softmax 的第 $i$ 行满足
+
+$$
+\alpha_{ij}=\frac{\exp(s_{ij})}{\sum_{r=1}^{L}\exp(s_{ir})},
+\qquad
+\sum_{j=1}^{L}\alpha_{ij}=1,
+\qquad
+0\leq\alpha_{ij}\leq1.
+\tag{17}
+$$
+
+多头版本把不同投影的结果拼接，再经过输出矩阵：
+
+$$
+\operatorname{MultiHead}(Y)=\operatorname{Concat}(H_1,\ldots,H_h)W_O,
+\qquad
+H_r=\operatorname{Attn}(YW_Q^{(r)},YW_K^{(r)},YW_V^{(r)}).
+\tag{18}
+$$
+
+正弦位置编码则为
+
+$$
+\begin{aligned}
+P_{k,2r}&=\sin\left(k/10000^{2r/d}\right),\\
+P_{k,2r+1}&=\cos\left(k/10000^{2r/d}\right),\\
+Y'_k&=Y_k+P_k.
+\end{aligned}
+\tag{19}
+$$
+
+残差和 LayerNorm 的展示式为
+
+$$
+\operatorname{LN}(x)=\gamma\odot\frac{x-\mu_x\mathbf 1}{\sqrt{\sigma_x^2+\varepsilon}}+\beta,
+\qquad
+\operatorname{Block}(x)=x+\operatorname{FFN}(\operatorname{LN}(x)).
+\tag{20}
+$$
+
+为防止把注意力热图误写成因果解释，我们只把它称为“合成权重可视化”。注意力行和为 1 是 softmax 的代数性质，不代表某个分子真的导致了某个代谢结果。
+
+### 2.6 训练目标与概率记号
+
+预测头输出 $\hat y_k$，以均方误差和轻微的 L2 正则为合成目标：
+
+$$
+\mathcal L(\theta)=\frac{1}{N}\sum_{k=1}^{N}(y_k-\hat y_k)^2+\lambda\lVert\theta\rVert_2^2,
+\qquad
+\lVert\theta\rVert_2=\sqrt{\sum_j\theta_j^2}.
+\tag{21}
+$$
+
+梯度下降的一步更新为
+
+$$
+\theta_{r+1}=\theta_r-\eta\nabla_\theta\mathcal L(\theta_r),
+\qquad
+\nabla_\theta\mathcal L=\begin{bmatrix}\partial\mathcal L/\partial\theta_1&\cdots&\partial\mathcal L/\partial\theta_p\end{bmatrix}^{\mathsf T}.
+\tag{22}
+$$
+
+若把目标视为条件概率，负对数似然可以写成
+
+$$
+\mathcal J(\theta)=-\sum_{k=1}^{N}\log p_\theta(y_k\mid y_{<k},m),
+\qquad
+p_\theta(y_k\mid y_{<k},m)\geq0,
+\quad
+\sum_{y_k}p_\theta(y_k\mid y_{<k},m)=1.
+\tag{23}
+$$
+
+合成后验的贝叶斯记号为
+
+$$
+p(\theta\mid D)=\frac{p(D\mid\theta)p(\theta)}{p(D)},
+\qquad
+p(D)=\int p(D\mid\theta)p(\theta)\,d\theta.
+\tag{24}
+$$
+
+KL 散度和熵只用于检验上下标、期望与求和：
+
+$$
+D_{\mathrm{KL}}(p\Vert q)=\sum_i p_i\log\frac{p_i}{q_i},
+\qquad
+H(p)=-\sum_i p_i\log p_i.
+\tag{25}
+$$
+
+它们没有被拿来证明模型对真实分布有效。
+
+## 3. 分子语料与化学边界
+
+下列每个 fenced block 只有一行 SMILES 源；渲染器若支持结构预览，可以把源转换为二维结构；若仅支持文本，也必须保持源可复制。块与块之间的说明刻意改变长度，覆盖 short token、branch 和 ring closure 的混合。化学源不包含手性 `@`、`@@`、正斜杠或反斜杠；这些语法不在本文的“已支持结构”声明内。
+
+### 3.1 芳香环、分支和常见小分子
+
+苯是最小的芳香环夹具，环闭合数字 `1` 两次出现：
+
+```smiles
+c1ccccc1
+```
+
+吡啶把一个芳香碳替换为芳香氮，便于观察元素字母和环闭合的组合：
+
+```smiles
+n1ccccc1
+```
+
+阿司匹林同时包含芳香环、酯基和羧酸分支：
+
+```smiles
+CC(=O)Oc1ccccc1C(=O)O
+```
+
+咖啡因用于检验多个羰基、含氮环和分支的连续布局：
+
+```smiles
+Cn1c(=O)c2c(ncn2C)n(C)c1=O
+```
+
+尿嘧啶提供另一个含氮环，并保持短源长度：
+
+```smiles
+O=C1NC=CC(=O)N1
+```
+
+### 3.2 生物动力学中使用的小分子
+
+甘氨酸不含环，却包含胺和羧酸两个常见官能团：
+
+```smiles
+NCC(=O)O
+```
+
+丙氨酸在中心碳上添加甲基分支：
+
+```smiles
+CC(N)C(=O)O
+```
+
+乳酸用于观察羟基与羧酸并列时的宽度变化：
+
+```smiles
+CC(O)C(=O)O
+```
+
+一个简化的葡萄糖环源只用常见的环和支链写法，不把该字符串当作立体化学断言：
+
+```smiles
+C(C1C(C(C(C(O1)O)O)O)O)O
+```
+
+### 3.3 离子与同位素
+
+氯化钠测试两个带电片段和点分隔符：
+
+```smiles
+[Na+].[Cl-]
+```
+
+乙酸铵测试带电氮与羧酸根的组合：
+
+```smiles
+[NH4+].[O-]C(=O)C
+```
+
+甲烷的碳-13 版本只用于验证同位素方括号：
+
+```smiles
+[13CH4]
+```
+
+本节的源只构成渲染输入，不代表系统对每种键级、互变异构、价态或药理含义都已完成化学验证。原子数、键数和字节数应在解析入口处限制在本验收任务给出的边界内：单块最多 128 个原子、192 条键、2048 字节。
+
+## 4. 推导：从守恒到预测
+
+### 4.1 线性系统的离散化
+
+将式（1）记作 $\dot x=Kx+Bu$，显式 Euler 离散化得到
+
+$$
+x_{k+1}=x_k+\Delta t(Kx_k+Bu_k)
+=\left(I+\Delta tK\right)x_k+\Delta tBu_k.
+\tag{26}
+$$
+
+当时间步长减小时，离散轨迹与合成参考轨迹的差异按一阶项缩小。为了让“尺度”在公式中可见，我们定义快、慢两套采样：
+
+$$
+\Delta t_{\mathrm{fast}}=0.125,
+\qquad
+\Delta t_{\mathrm{slow}}=0.5,
+\qquad
+N_{\mathrm{fast}}\Delta t_{\mathrm{fast}}=N_{\mathrm{slow}}\Delta t_{\mathrm{slow}}=16.
+\tag{27}
+$$
+
+这两个窗口具有相同的总时长，却有不同的 token 数，因此能够让注意力矩阵的宽度和窄屏滚动长度产生真实变化。
+
+### 4.2 传递函数与频率响应
+
+对于单一衰减池 $\dot a=-ka+u$，零初值下的拉普拉斯域表达式为
+
+$$
+sA(s)=-kA(s)+U(s),
+\qquad
+G(s)=\frac{A(s)}{U(s)}=\frac{1}{s+k}.
+\tag{28}
+$$
+
+将 $s=i\omega$ 代入，可得幅值和相位的合成参照：
+
+$$
+\lvert G(i\omega)\rvert=\frac{1}{\sqrt{k^2+\omega^2}},
+\qquad
+\arg G(i\omega)=-\arctan\left(\frac{\omega}{k}\right).
+\tag{29}
+$$
+
+当 $\omega\to0$ 时，低频成分近似保留；当 $\omega\to\infty$ 时，高频输入被衰减。这里的极限只验证公式排版和量纲关系，不是对真实细胞系统的结论。
+
+### 4.3 cases 与边界策略
+
+为覆盖分段公式，合成的窗口权重定义为
+
+$$
+w(t)=
+\begin{cases}
+0, & t<0,\\
+t/T, & 0\leq t<T,\\
+1, & t\geq T.
+\end{cases}
+\tag{30}
+$$
+
+掩码分数在可见与不可见位置之间切换：
+
+$$
+S_{ij}=\begin{cases}
+q_i^{\mathsf T}k_j/\sqrt{d_k}, & j\leq i,\\
+-10^9, & j>i.
+\end{cases}
+\tag{31}
+$$
+
+在有限浮点实现中，$-10^9$ 是 $-\infty$ 的数值近似；文档不把它当作精确无穷。分段公式专门放在多行段落与表格附近，便于检查块级 margin。
+
+### 4.4 三步对齐推导
+
+把预测头写成带偏置的线性读出 $\hat y=Wh+b$，其平方损失的微分可以紧凑地写成：
+
+$$
+\begin{aligned}
+\mathcal L &=\frac12\lVert Wh+b-y\rVert_2^2,\\
+d\mathcal L&=(Wh+b-y)^{\mathsf T}(W\,dh+db),\\
+\nabla_h\mathcal L&=W^{\mathsf T}(Wh+b-y),\\
+\nabla_W\mathcal L&=(Wh+b-y)h^{\mathsf T}.
+\end{aligned}
+\tag{32}
+$$
+
+等号在每一行保留，`aligned` 中的对齐点位于等号附近。该推导的目的，是让验收器同时遇到范数、转置、梯度、矩阵乘法和长变量名。
+
+## 5. 合成实验设计
+
+### 5.1 数据生成协议
+
+每个合成实验运行同一组步骤：先用式（1）生成参考轨迹，再按式（5）加入输入，采样后附加式（7）的确定性噪声；随后为每个 SMILES 计算 5 维描述符，按时间窗口拼接 token，最后将目标通量的下一步值作为预测标签。流程可以用下面的伪代码表达：
+
+```python
+def make_fixture(seed, dt, rate_ratio, pulse_center):
+    time = arange(0.0, 16.0, dt)
+    input_flux = synthetic_input(time, center=pulse_center)
+    state = euler_chain(time, input_flux, k1=0.18 * rate_ratio, k2=0.18)
+    noisy = observe(state, seed=seed, sigma=0.015 + 0.002 * rate_ratio)
+    molecule = smiles_descriptors(SMILES_FIXTURE)
+    tokens = join_time_frequency_and_molecule(noisy, molecule)
+    return tokens[:-1], noisy[1:, 2]
+```
+
+代码是文档中的静态示例；本次写作没有启动 AI 服务，也没有执行昂贵的训练任务。`synthetic_input`、`euler_chain` 等名称用于让阅读者理解数据流，不承诺仓库中存在同名运行时函数。
+
+### 5.2 预注册参数
+
+表 1 预先列出四个小实验。`ratio` 是 $\rho$，`width` 是每个 token 的综合维度；不同值用于让长段落中出现可观察的数值变化。
+
+| 组别 | seed | $\Delta t$ | ratio $\rho$ | pulse center $t_c$ | width | 目的 |
+|---|---:|---:|---:|---:|---:|---|
+| A / baseline | 1729 | 0.25 | 1.00 | 6.0 | 32 | 基线结构、短表格和常规注意力 |
+| B / fast | 2718 | 0.125 | 0.75 | 5.5 | 48 | 加倍时间 token，观察窄窗口换行 |
+| C / slow | 31415 | 0.50 | 1.50 | 7.0 | 24 | 减少 token，观察缓存重新布局 |
+| D / aromatic | 1618 | 0.25 | 2.00 | 8.25 | 40 | 增加芳香分子描述符，观察表格宽度 |
+
+输入幅度参数固定为 $u_0=0.20$、$u_1=0.05$、$u_2=0.08$、$u_3=0.12$，但 $\tau$、$\omega$ 与 $\sigma$ 按组别变化：
+
+$$
+\begin{aligned}
+(\tau_A,\omega_A,\sigma_A)&=(4.0,0.80,0.60),\\
+(\tau_B,\omega_B,\sigma_B)&=(3.0,1.20,0.45),\\
+(\tau_C,\omega_C,\sigma_C)&=(6.0,0.55,0.90),\\
+(\tau_D,\omega_D,\sigma_D)&=(2.5,1.60,0.35).
+\end{aligned}
+\tag{33}
+$$
+
+### 5.3 评价量
+
+误差表只使用合成标签。给定预测值 $\hat y_i$ 和目标 $y_i$，评价量定义为
+
+$$
+\operatorname{MAE}=\frac1N\sum_{i=1}^{N}\lvert y_i-\hat y_i\rvert,
+\qquad
+\operatorname{RMSE}=\sqrt{\frac1N\sum_{i=1}^{N}(y_i-\hat y_i)^2}.
+\tag{34}
+$$
+
+为展示相关性和决定系数的排版，再定义
+
+$$
+r=\frac{\sum_i(y_i-\bar y)(\hat y_i-\bar{\hat y})}{\sqrt{\sum_i(y_i-\bar y)^2}\sqrt{\sum_i(\hat y_i-\bar{\hat y})^2}},
+\qquad
+R^2=1-\frac{\sum_i(y_i-\hat y_i)^2}{\sum_i(y_i-\bar y)^2}.
+\tag{35}
+$$
+
+每个区间由固定的 200 次索引重采样得到：
+
+$$
+\operatorname{CI}_{0.90}(T)=\left[q_{0.05}\left(T^{*}\right),q_{0.95}\left(T^{*}\right)\right],
+\qquad
+T^{*}=T(y_{i_1},\ldots,y_{i_N}),
+\quad i_j\sim\operatorname{Uniform}\{1,\ldots,N\}.
+\tag{36}
+$$
+
+由于样本和重采样次数很小，区间只是视觉夹具中的数字，不应被当作统计推断。
+
+### 5.4 分子清单与结构标签
+
+表 2 把上一节的源码和合成标签放在一起。标签是人为定义的 fixture class，不是化合物的临床、毒理或药理分类。
+
+| ID | 源摘要 | `aromatic` | `charged` | `isotope` | fixture class |
+|---|---|---:|---:|---:|---|
+| M01 | `c1ccccc1` | 1 | 0 | 0 | ring |
+| M02 | `n1ccccc1` | 1 | 0 | 0 | hetero-ring |
+| M03 | aspirin source | 1 | 0 | 0 | branch |
+| M04 | caffeine source | 1 | 0 | 0 | multi-carbonyl |
+| M05 | glycine source | 0 | 0 | 0 | amino-acid |
+| M06 | `[Na+].[Cl-]` | 0 | 1 | 0 | ionic |
+| M07 | `[13CH4]` | 0 | 0 | 1 | isotope |
+
+表 2 的反引号内容只作源代码标签；真正完整的 SMILES 一行位于第 3 节 fenced block 中。这样可同时测试 inline code 和多行 fenced code 的视觉差异。
+
+### 5.5 参考图片
+
+下面的本地图片是 96 × 48 像素的小型科学夹具。它只用于验证 Markdown 图片的加载、尺寸占位、缺失回退和滚动位置；颜色与像素没有科研含义。
+
+![96 × 48 像素的本地科学夹具图](screenshots/scientific-fixture.png)
+
+图 1 的 alt text 同时包含中文、数字和 multiplication sign；实际渲染若找不到文件，应保留 alt text 或可读回退，而不应让后续公式的布局消失。
+
+## 6. 合成实验结果
+
+### 6.1 轨迹与守恒检查
+
+表 3 给出由协议预注册的参考统计。`mass drift` 是离散总量与输入积分之间的最大绝对差；它是数值构造中的诊断量，不是实验测量。小数位故意不统一，以测试表格列宽与中文列名。
+
+| 组别 | $\max_t a(t)$ | $\max_t b(t)$ | $p(16)$ | mass drift | 备注 |
+|---|---:|---:|---:|---:|---|
+| A | 1.000 | 0.238 | 2.731 | $3.1\times10^{-4}$ | baseline |
+| B | 1.000 | 0.241 | 2.728 | $1.7\times10^{-4}$ | fast sampling |
+| C | 1.000 | 0.231 | 2.742 | $6.8\times10^{-4}$ | slow sampling |
+| D | 1.000 | 0.255 | 2.719 | $3.2\times10^{-4}$ | aromatic descriptor |
+
+离散总量的核对写成
+
+$$
+\Delta_M=\max_{0\leq k\leq N}\left\lvert M_k-M_0-\Delta t\sum_{j=0}^{k-1}u_j\right\rvert,
+\qquad
+\Delta_M\geq0.
+\tag{37}
+$$
+
+表 3 的数值只为这条定义服务。它们不会被推广为 Euler 方法的普遍误差界。
+
+### 6.2 预测统计
+
+四组预测头使用同一个确定性线性基线，再叠加由式（16）生成的合成权重。表 4 的数值作为渲染输入预先固定；如果实现重新计算得到不同数字，应以实现日志为准并在验收记录中注明，而不是把本文数字改写成“已达标”。
+
+| 组别 | MAE | RMSE | $R^2$ | $r$ | 90% synthetic interval for RMSE |
+|---|---:|---:|---:|---:|---|
+| A | 0.031 | 0.040 | 0.912 | 0.958 | [0.037, 0.044] |
+| B | 0.028 | 0.036 | 0.928 | 0.964 | [0.033, 0.040] |
+| C | 0.043 | 0.055 | 0.841 | 0.919 | [0.049, 0.062] |
+| D | 0.034 | 0.045 | 0.887 | 0.944 | [0.041, 0.050] |
+
+以组 A 为例，四舍五入前的合成误差使用
+
+$$
+\operatorname{RMSE}_A=\sqrt{\frac{1}{64}\sum_{k=1}^{64}(y_k-\hat y_k)^2}=0.0402,
+\qquad
+\operatorname{MAE}_A=0.0314.
+\tag{38}
+$$
+
+组 C 的较大误差来自更少的采样点与较宽的脉冲，而不是一个经过真实训练的模型退化。为了避免读者误把表格当作 benchmark，本文没有报告 GPU 时间、吞吐或多用户并发率。
+
+### 6.3 注意力矩阵的局部切片
+
+组 B 使用 $L=128$、$d_k=8$，因此单个 head 的分数矩阵属于 $\mathbb R^{128\times128}$。以下是取前三个 query、前五个 key 的小切片；数值四舍五入，行和只在完整行上为 1：
+
+$$
+A_{0:3,0:5}=\begin{bmatrix}
+0.31&0.24&0.18&0.15&0.12\\
+0.10&0.29&0.25&0.20&0.16\\
+0.07&0.11&0.34&0.27&0.21
+\end{bmatrix}.
+\tag{39}
+$$
+
+局部数字的和不必等于 1，因为它省略了其余 key。完整行的代数性质仍是
+
+$$
+\mathbf 1^{\mathsf T}\alpha_i=1,
+\qquad
+\alpha_i\in\Delta^{L-1}=\left\{v\in\mathbb R^L:v_j\geq0,\ \sum_{j=1}^{L}v_j=1\right\}.
+\tag{40}
+$$
+
+该段落同时测试矩阵括号、集合条件、\Delta 符号、范数空间和长中文解释是否互相挤压。
+
+### 6.4 跨尺度扰动与消融
+
+为了让不同窗口长度真实地产生不同的语料形状，我们对同一条参考轨迹构造三种时间聚合。令 $q$ 为正整数，区间平均和端点抽样分别为
+
+$$
+\bar{x}^{(q)}_j=\frac{1}{q}\sum_{r=0}^{q-1}x_{qj+r},
+\qquad
+x^{(q)}_j=x_{qj+q-1},
+\qquad
+j=0,\ldots,\left\lfloor\frac{N}{q}\right\rfloor-1.
+\tag{41}
+$$
+
+组 A 采用 $q=1$，组 B 在频域摘要前采用 $q=2$，组 C 采用 $q=4$，组 D 采用 $q=1$ 但移除芳香比例字段。这样，公式、表格与 token 长度的变化来自参数含义，而不是复制段落。时间聚合的低通直觉可以用 sinc 形式表示：
+
+$$
+H_q(\omega)=\frac{1}{q}\sum_{r=0}^{q-1}e^{-i\omega r}
+=e^{-i\omega(q-1)/2}\frac{\sin(q\omega/2)}{q\sin(\omega/2)}.
+\tag{42}
+$$
+
+当分母接近零时，右侧按连续极限解释；这个边界提醒有意保留在长公式中，供渲染器检查括号和分数线。若采样频率为 $f_s$，合成输入的 Nyquist 频率定义为
+
+$$
+f_{\mathrm{Nyq}}=\frac{f_s}{2},
+\qquad
+\omega_{\mathrm{Nyq}}=\pi f_s,
+\qquad
+f_s=\frac{1}{\Delta t}.
+\tag{43}
+$$
+
+我们再对注意力行的尖锐程度计算熵。它只用于产生一列解释性数值，不是信息论意义上的生物复杂度：
+
+$$
+\mathcal H_i=-\sum_{j=1}^{L}\alpha_{ij}\log(\alpha_{ij}+\varepsilon),
+\qquad
+0\leq\mathcal H_i\leq\log L+\delta_\varepsilon.
+\tag{44}
+$$
+
+为比较“去掉分子向量”和“保留分子向量”两种合成输入，读出层对输入的局部敏感度使用 Jacobian：
+
+$$
+J_{m}(y)=\frac{\partial\hat y}{\partial m}
+=\begin{bmatrix}
+\partial\hat y_1/\partial m_1&\cdots&\partial\hat y_1/\partial m_5\\
+\vdots&\ddots&\vdots\\
+\partial\hat y_N/\partial m_1&\cdots&\partial\hat y_N/\partial m_5
+\end{bmatrix}.
+\tag{45}
+$$
+
+表 6 给出一个预注册的消融记录。数值是由文档夹具构造的相对量，符号 “—” 表示该列在这个版本中没有生成，不应被解释为缺失科研数据。
+
+| 输入变体 | 时间聚合 $q$ | 是否含 $r_{\mathrm{arom}}$ | $L$ | mean attention entropy | 合成 MAE |
+|---|---:|---:|---:|---:|---:|
+| full / A | 1 | yes | 64 | 3.71 | 0.031 |
+| pooled / B | 2 | yes | 64 | 3.42 | 0.028 |
+| coarse / C | 4 | yes | 32 | 2.86 | 0.043 |
+| no-aromatic / D | 1 | no | 64 | 3.55 | 0.034 |
+
+表 6 的 token 长度取决于拼接规则，不等于真实 Transformer 的序列上限。特别地，熵减小并不证明模型找到“更重要”的分子片段；它只表示合成 softmax 行更集中。为了让该解释保持可审计，权重仍从式（17）定义的行归一化得到。
+
+动力学部分还使用一个无量纲比值描述输入变化相对反应变化的大小：
+
+$$
+\mathrm{Da}=\frac{k_1T}{1+k_2T},
+\qquad
+\mathrm{Da}_A=0.58,
+\quad
+\mathrm{Da}_B=0.44,
+\quad
+\mathrm{Da}_C=0.71.
+\tag{46}
+$$
+
+这里的 Damköhler-like 名称只表示构造出来的比例，不暗示本文覆盖任何具体反应工程制度。线性化的局部传播可以用矩阵指数表示：
+
+$$
+x(t+\delta t)=e^{K\delta t}x(t)+\int_0^{\delta t}e^{K(\delta t-s)}B\,u(t+s)\,ds,
+\qquad
+e^{K\delta t}=\sum_{r=0}^{\infty}\frac{(K\delta t)^r}{r!}.
+\tag{47}
+$$
+
+当窗口从 $16$ 缩到 $8$、脉冲中心从 $6.0$ 移到 $8.25$ 时，式（47）中的积分上限和输入位置同步变化；因此验收者可以在同一份文档中观察参数、公式和解释段落的局部差异。我们没有把这些消融数值与表 4 的预测误差合并成单一排行榜，也没有选择一个“最佳”设置来宣称模型已经达标。
+
+### 6.5 复现记录与人工核对
+
+合成夹具的最小复现记录包含四类字段：参数、源、渲染环境和观察结果。参数字段至少应记录 seed、$\Delta t$、$\rho$、$t_c$、$\sigma$ 和 token width；源字段应记录一行 SMILES、数学块的原始定界符和图片相对路径；环境字段应记录字体、主题、viewport、tab 生命周期；观察字段则记录可见文本、回退行为和复制结果。
+
+为防止“看起来相同”掩盖源文本差异，数学源的检查同时保留字符级等号和行分隔符。对于一个四行推导，行数计数可以写作
+
+$$
+n_{\mathrm{line}}=\sum_{\ell=1}^{4}\mathbf 1\!\left[\text{line}_{\ell}\text{ contains }=\right]=4,
+\qquad
+n_{\mathrm{break}}=3.
+\tag{48}
+$$
+
+这里的指示函数只是文档内的审计记号；它不要求渲染器执行自然语言。SMILES 的源审计也只计数语料边界：
+
+$$
+b_{\mathrm{smiles}}=\operatorname{bytes}(s),
+\qquad
+n_{\mathrm{atom}}\leq128,
+\qquad
+n_{\mathrm{bond}}\leq192,
+\qquad
+b_{\mathrm{smiles}}\leq2048.
+\tag{49}
+$$
+
+式（49）的不等式是验收输入约束，不是化学软件的完整结构合法性证明。若解析器拒绝某个有效源，记录应包含原始源和回退文本；若解析器接受 B.2 中的坏例，也应记录“环境额外接受”，不能修改正文的能力边界。
+
+### 6.6 窗口敏感性记录
+
+同一个内容块在宽窗口和窄窗口中承担的排版压力不同。为使观察可复现，我们预先选择三个 viewport 宽度 $w_1=1440$、$w_2=960$ 和 $w_3=640$（单位为 CSS px），并在每个宽度上阅读式（32）、表 4、咖啡因源和图 1。宽度本身不是性能分数，只是触发布局变化的输入。
+
+$$
+\kappa(w)=\frac{\text{visible content width at }w}{\text{viewport width }w},
+\qquad
+0<\kappa(w)\leq1.
+\tag{50}
+$$
+
+若长公式保持完整，或者在允许的横向容器中滚动，均可作为可读行为记录；若公式覆盖相邻正文、表头被裁切且没有可访问回退，则记录为待修复布局问题。为了避免把主观印象写成数值结果，验收者同时记录截图、原始宽度、字体和滚动位置。
+
+图片和结构源的回退也使用离散状态而非虚构的成功率：
+
+$$
+r_{\mathrm{asset}}=
+\begin{cases}
+0, & \text{asset is rendered or source remains readable},\\
+1, & \text{asset is missing and no readable fallback remains}.
+\end{cases}
+\tag{51}
+$$
+
+这个状态变量只描述一个具体文档位置。它不代表全产品图片成功率，也不把当前本地 fixture 的存在推断成网络图片能力。缺图时，alt text “96 × 48 像素的本地科学夹具图”应仍然能帮助读者定位内容。
+
+对于 tab 返回，记录返回前后的锚点差异：
+
+$$
+\Delta_{\mathrm{anchor}}=\left\lvert y_{\mathrm{return}}-y_{\mathrm{before}}\right\rvert,
+\qquad
+\Delta_{\mathrm{anchor}}=0\ \text{means exact scroll restoration in this fixture}.
+\tag{52}
+$$
+
+实际产品可能采用可见段落、最近标题或其他合理锚点；因此式（52）只是建议的观察量，不是强制的像素级合同。表 7 记录本文件希望看到的状态描述：
+
+| 视口 | 长公式 | 表格 | SMILES 源 | 图片 | 记录重点 |
+|---:|---|---|---|---|---|
+| 1440 px | 一行或自然留白 | 全列可见 | 源与结构均可复制 | 占位稳定 | 基线 |
+| 960 px | 允许局部换行 | 重点列仍可读 | 不截断单行源 | alt text 可定位 | 中等宽度 |
+| 640 px | 容器内滚动或清楚换行 | 不遮挡相邻段落 | 横向滚动不改源 | 缺图回退可见 | 窄窗口 |
+
+表 7 是预期观察表，不是已经执行的截图报告。若一个实现选择不同的合法排版策略，复核者应记录策略及其可访问性，而不是为了匹配表格文字强行修改实现。
+
+## 7. 讨论
+
+### 7.1 这套夹具覆盖什么
+
+从渲染角度看，本文把以下类型安排在同一条阅读路径上：
+
+- short inline math：$e^{i\pi}+1=0$、$\rho=k_1/k_2$、$\lVert x\rVert_2$；
+- long display math：含积分、矩阵、概率、softmax 和多行 `aligned` 的块；
+- chemistry source：ring closure、branch、aromatic element、charged fragment、isotope；
+- document primitives：表格、图片、代码块、引用编号、列表以及中英文混排；
+- lifecycle perturbation：不同 token 长度、表格宽度、图片占位和多 tab 返回。
+
+其中，长度变化是真实的语料变化：组 B 有 128 个时间 token，组 C 只有 32 个时间 token；式（33）又改变了指数衰减和脉冲宽度。它们不是复制同一段文字来填充页面。
+
+### 7.2 解释边界
+
+注意力权重可以被可视化，却不自动成为因果证据。分子描述符是五个合成字段，也不等同于完整的分子图网络。高斯积分、Euler 迭代和 softmax 恒等式都是数学定义或已知关系；把它们放在一个实验叙事中，是为了测试排版的组合复杂度。
+
+如果将来把该夹具接入真实数据，应重新审查采样频率、量纲、缺失值、单位换算、训练和评估切分，并由领域专家检查化学结构。真实数据的伦理、隐私、许可证和可重复性不能由 Markdown 渲染器代替。
+
+### 7.3 可访问性与可读性
+
+图片使用描述性 alt text，表格第一行提供列名，代码和 SMILES 保留可复制源。数学块的相邻正文解释符号，不把颜色作为唯一语义。窄窗口下应允许长公式横向滚动或合理换行；若浏览器无法显示结构图，则源码回退必须仍然可见。
+
+中英文混排有意保留：`synthetic fixture`、`baseline`、`source fallback`、`Transformer attention` 与中文解释相邻。验收时应观察字体回退、标点宽度、下标位置和代码等宽字体是否改变行高。
+
+### 7.4 语料维护原则
+
+这份语料以后若需要增加内容，应优先加入一个新的可观察边界，而不是复制一整节。例如，可以加入一个不同长度的 cases，一个含同位素的单行源，或一个缺图回退；每次新增都应说明它覆盖的解析器路径和预期观察。若只增加同样的句子来提高字节数，滚动缓存和布局扰动并不会因此更有代表性。
+
+数学符号也应保持单一含义。在本文中，$L$ 表示 token 数，$d$ 表示特征宽度，$k_1,k_2$ 表示合成速率常数，$\lambda$ 表示正则化权重或特征值时由下标区分上下文；引用了不同领域的记号时，邻近正文会重新说明。化学源则按块独立解释，避免从一个分子块把键或电荷状态“借”到下一个块。
+
+对比渲染结果时，复核者应优先保存原始 Markdown 和环境信息，再描述视觉差异。单张截图可能无法证明滚动往返后的缓存正确，单次复制也无法证明跨文字选区始终稳定。因此附录 C 把动作序列作为观察对象，并允许状态保持“待实机”。这是一份诚实的验收输入，而不是一张预填的通过清单。
+
+## 8. 相关工作与引用
+
+本文只借用公开教科书和论文中的常见记号，并没有复现引用工作的数据集或性能。引用用于验证参考文献布局、链接文本和中英文段落的组合；它们不构成对本文合成结果的外部背书。
+
+经典动力学和统计物理的教材给出常微分方程、线性系统和随机变量的基础记号 [1]。傅里叶分析的标准定义与卷积关系见 [2]。Transformer 的 scaled dot-product attention 记号沿用 [3]，而 SMILES 的线性表示背景可参见 [4]。这些来源支持符号选择，不支持本文虚构的表 3 和表 4。
+
+1. [1] H. Haken, *Synergetics: An Introduction*, Springer, 1983. 这里只作为动力学符号的教材式参照。
+2. [2] R. N. Bracewell, *The Fourier Transform and Its Applications*, 3rd ed., McGraw-Hill, 2000. 这里只作为傅里叶定义的参照。
+3. [3] A. Vaswani et al., “Attention Is All You Need,” *NeurIPS*, 2017. 本文只采用其常见注意力公式的记号。
+4. [4] D. Weininger, “SMILES, a Chemical Language and Information System,” *J. Chem. Inf. Comput. Sci.*, 1988. 本文仅以短 SMILES 作为渲染源。
+
+## 9. 结论
+
+本文构造了一个独立的中文科研渲染验收语料：守恒动力学提供上下标、导数、积分与矩阵；傅里叶段落提供复数、无穷积分和求和；注意力段落提供 softmax、遮罩、多头、位置编码与概率统计；分子段落提供常见 SMILES 结构；实验段落提供表格、代码、图片和可变参数。所有数值都是合成的，文档本身不宣称真实科研结果，也不宣称 Nebula 已经通过大规模负载或全部渲染能力验收。
+
+真正的产品验收还需要在目标构建、目标字体、目标窗口尺寸和实际 tab 生命周期上记录观察。附录中的空白或“待实机”状态应由主代理在运行渲染器后填写；没有运行证据时，不应把它们改成“通过”。
+
+## 附录 A：公式索引与覆盖矩阵
+
+为便于测试脚本或人工审阅定位，表 5 将主要公式映射到覆盖点。索引编号是本文内部编号，不是引用编号。
+
+| 公式 | 主要覆盖 | 公式 | 主要覆盖 |
+|---|---|---|---|
+| (1) | ODE、矩阵、守恒 | (2) | 指数、极限、比例 |
+| (3) | `aligned`、积分因子 | (4) | 积分、总量 |
+| (5) | 正弦、高斯、参数 | (6) | 高斯积分、根号 |
+| (7) | 概率、期望、方差 | (8) | DFT、复指数、求和 |
+| (9) | 傅里叶积分 | (10) | 卷积 |
+| (11) | 欧拉恒等式 | (12) | 向量、转置 |
+| (13) | 协方差、均值 | (14) | 特征值、Kronecker delta |
+| (15) | Q/K/V 矩阵 | (16) | scaled attention |
+| (17) | softmax、单纯形 | (18) | multi-head |
+| (19) | aligned、多行编码 | (20) | LayerNorm、残差 |
+| (21) | MSE、L2 范数 | (22) | 梯度更新 |
+| (23) | 条件概率 | (24) | Bayes 后验、积分 |
+| (25) | KL、熵 | (26) | Euler 离散化 |
+| (27) | 多尺度时间步 | (28) | Laplace、传递函数 |
+| (29) | 幅值、相位 | (30) | `cases` |
+| (31) | 因果 mask、`cases` | (32) | 多行梯度推导 |
+| (33) | 参数表、aligned | (34) | MAE、RMSE |
+| (35) | 相关性、$R^2$ | (36) | bootstrap 区间 |
+| (37) | 离散守恒 | (38) | 长等式、数值 |
+| (39) | 矩阵切片 | (40) | 概率单纯形 |
+
+此外，本文在各段正文中使用了短公式，例如 $A\to B\to P$、$s=i\omega$、$\alpha_{ij}\geq0$、$L\times d$、$\mathbb R^5$、$\delta_{\ell r}$ 和 $\varepsilon>0$。它们与块级公式相邻，用于检查同一段中的 baseline prose 与 inline math。
+
+## 附录 B：渲染能力边界与源码回退
+
+### B.1 明确的未来能力对照
+
+下列字符串只作为未来能力或源码对照，不应被当前渲染器当作已经支持的结构图。`\ce`、`\pu`、`\SI` 依赖额外宏包或专门解析器；Mermaid、FASTA、Newick 和 PDB 也需要各自的语言支持。为了保持验收语义清楚，它们放在 fenced code 中：
+
+```tex
+\ce{A -> B + C}
+\pu{3.0e8 m s-1}
+\SI{25}{\celsius}
+```
+
+```mermaid
+flowchart LR
+    A[substrate] --> B[intermediate]
+    B --> C[product]
+```
+
+```fasta
+>synthetic-sequence
+ACGTACGTACGT
+```
+
+```text
+((A:0.1,B:0.2):0.3,C:0.4);
+ATOM      1  N   GLY A   1      11.104  13.207   9.451
+```
+
+这些代码块应保持源码可读；除非产品另有明确渲染器，不应在验收记录中写“已变图”。
+
+### B.2 无效或不在支持范围的坏例
+
+下面的两个块专门标记为 source fallback 负例。它们不属于正文中的有效 SMILES 或数学示例。第一个包含手性标记，第二个包含未配置的 `\ce` 命令；期望行为是显示原始源码、错误标记或明确的降级文本，而不是悄悄生成一个错误结构。
+
+<!-- pebrel-test: source-fallback -->
+```smiles
+C[C@H](O)C(=O)O
+```
+
+<!-- pebrel-test: source-fallback -->
+$$
+\ce{H2O + CO2 -> H2CO3}
+$$
+
+正文有效源没有使用这些语法。若某个运行环境恰好支持它们，也只能在实机观察中记录“该环境额外支持”，不能反推本项目的通用合同已经扩大。
+
+## 附录 C：交互验收观察表
+
+本附录是待填写的验收协议。它列出动作、观察点、证据和状态；当前文档生成过程没有启动 GUI、AI 服务或外部网络服务，因此状态统一为“待实机”。主代理可以在实际渲染器中逐项记录，而不把静态 Markdown 检查冒充为交互通过。
+
+| 编号 | 操作 | 观察点 | 证据建议 | 当前状态 |
+|---|---|---|---|---|
+| C1 | 从摘要滚动到式（1）与式（3） | 上下标、矩阵行和 `aligned` 行距不重叠 | 记录窗口宽度与截图 | 待实机 |
+| C2 | 从式（3）滚动到式（11） | 长公式、欧拉恒等式和中文段落连续可读 | 记录窄窗口与宽窗口 | 待实机 |
+| C3 | 从 SMILES M01 拖选到 M04 | 跨文字选区不吞掉代码围栏或数学块 | 记录选区起止文本 | 待实机 |
+| C4 | 在表 1、式（33）、表 4 间往返 | 表格列宽和公式缓存随滚动保持稳定 | 记录第一次与第二次布局 | 待实机 |
+| C5 | 调整窗口宽度并 resize | `aligned`、`cases`、矩阵和中文英文混排重新布局 | 记录至少 3 个宽度 | 待实机 |
+| C6 | 切换到另一个 tab 后返回本文 | 公式、图片占位、代码块和滚动锚点仍存在 | 记录返回后的首屏 | 待实机 |
+| C7 | 暂时移除 `scientific-fixture.png` | alt text 或缺图回退可见，后续内容不坍塌 | 记录缺失图片截图 | 待实机 |
+| C8 | 检查坏例 B.2 | 手性 SMILES 与 `\ce` 不被错误宣称为有效结构 | 记录源码回退文本 | 待实机 |
+| C9 | 检查 Mermaid、FASTA、Newick、PDB | 未配置渲染器时仍显示源码 | 记录 fenced code 行为 | 待实机 |
+| C10 | 从附录返回摘要再到表 4 | 长文缓存、滚动位置和重复参数无错位 | 记录往返序列 | 待实机 |
+| C11 | 复制式（1）、式（16）、SMILES M03 | 复制文本保留等号、反斜杠语法和一行源 | 记录剪贴板文本 | 待实机 |
+| C12 | 在暗色与亮色主题间切换（若产品提供） | 公式、表格边框、代码和图片对比度可读 | 记录主题与字体 | 待实机 |
+
+### C.1 负载范围说明
+
+本文是单份中等大小的静态语料，目标是检查科学语法与交互边界。它不测试 80 个真实 AI 会话，不测试 100 MB 文档，不测试多机同步、远端模型排队或长时间 GPU 占用。那些场景需要有预算的独立验证：单独的负载模型、资源上限、超时策略、取消语义和可观测性记录都应先定义，再决定是否运行。任何人都不能仅凭本文“渲染成功”写出“系统承受 80 AI”或“系统已处理 100 MB”的结论。
+
+### C.2 实机记录模板
+
+```text
+Renderer build:
+Host OS and display scale:
+Viewport sizes:
+Font configuration:
+Tab sequence:
+Observed formula issues:
+Observed SMILES behavior:
+Missing-image behavior:
+Selection and copy behavior:
+Open syntax or layout issues:
+Evidence paths:
+Reviewer and date:
+```
+
+## 附录 D：复核者速查
+
+复核者可以按以下顺序快速检查语料，而不需要先运行完整产品：
+
+1. 搜索 `$$`，确认块级数学成对出现，并检查多行块确实含有两个反斜杠的行分隔符。
+2. 搜索 ` ```smiles`，逐块确认下一行只有一条源码，并检查正文有效源不含 `@`、`@@`、正斜杠或反斜杠。
+3. 搜索 `<!-- pebrel-test: source-fallback -->`，确认每个注释都紧接数学块或 SMILES 块。
+4. 检查表 1、表 2、表 3、表 4 和表 5 的表头、长单元格与中文英文混排。
+5. 检查图片路径 `screenshots/scientific-fixture.png` 是否相对当前 Markdown 文件正确。
+6. 记录未决语法，不把源码回退、缺图或未运行的交互项目改写成成功结果。
+
+本文到此结束。最后一次强调：它是一份方法学与渲染验收示例，数据是 synthetic，结论只涉及语料覆盖和待观察的交互协议；它不是现实生物医学研究，也不是产品容量证明。
diff --git a/docs/scientific-rendering-performance.md b/docs/scientific-rendering-performance.md
new file mode 100644
index 0000000..90aae9f
--- /dev/null
+++ b/docs/scientific-rendering-performance.md
@@ -0,0 +1,164 @@
+# 科学渲染性能设计与最终受限验收
+
+**状态：** 自动化验证已记录；GUI 人工覆盖仍有明确范围 \
+**日期：** 2026-09-08 \
+**范围：** Pebrel 自有 crate 的数学、SMILES、Markdown 预览和终端科学覆盖层 \
+**不包含：** GPUI/第三方依赖修改、80 个真实 AI、100 MB 全文阅读、GPU/FPS 容量承诺
+
+本文是工程证据记录，不是容量保证。48 MiB 科学资源缓存只约束 Pebrel 自己的缓存计账；它不约束进程 RSS、GPU、普通 Markdown 图片、GPUI 自身缓存或外部 AI 进程。
+
+## 最终实现
+
+ScientificRender 是 App 级共享资源服务，统一处理公式布局、CPU 位图、SMILES SVG 和单帧图像。视图保存 source 和短期图像句柄，资源服务负责去重、后台工作、缓存和 Wakeup。当前边界如下：
+
+| 边界 | 值 | 语义 |
+|---|---:|---|
+| 科学资源缓存 | 48 MiB、1024 entries | App 级 byte + entry LRU |
+| 科学 pending | 64 jobs、4 MiB charge | 入队前去重并拒绝超限 |
+| 科学后台任务 | 2 | 公式/分子任务最多同时运行 2 个 |
+| 文档工作许可 | 2 | 文件加载和 Outline 解析另有独立 permit |
+| 磁盘读取 | 8 MiB + 1 probe byte | 截断或编码错误内容只读 |
+| 富预览总输入 | 512 KiB | AST 前限制 Outline 输入 |
+| 单块富预览 | 32 KiB | 超限块按 literal source 展示 |
+| 单公式位图 | 8192 px 边长、24 MiB | 超限或不可读时源码回退 |
+
+RenderCache 的命中更新 touched 时间，按最近最少使用逐项淘汰；单项过大时先拒绝，不驱逐现有热资源。FormulaKey 包含 source、display、verbatim、字号和像素比例；图像 key 还包含缩放和 RGBA。分子 key 包含 source 和 dark theme。
+
+缓存 charge 的关键修正是：Layout 使用 MathLayout::allocated_bytes()；Image 和 Molecule 使用 RenderImage::as_bytes(0) 的实际像素长度。逻辑 480 × 240 geometry 不能推断 GPUI 图像内存。此前一次 GPUI 回归显示实际 1,843,200 bytes，旧的 480 × 240 × 4 = 460,800 估算低估了 2 倍边长造成的 4 倍像素。旧的 7.03 MiB 级分子像素估算同样作废；按当前实际像素计量，16 张对应图像约为 28.125 MiB。普通 Markdown 图片、图片临时文件、GPUI cache 和外部 AI 不在 48 MiB 预算内。
+
+数学 CPU 合成位于 math/bitmap.rs，GPUI 只包装 MathBitmap 的像素与几何。布局只处理从 Math root 可达节点，跳过解析重写留下的孤儿节点。overbar 使用字体 MATH 表的 vertical gap 和 rule thickness 生成规则线，不依赖 U+203E 字形。boxed/tag 有兼容降级；原始文档矩阵行末只有单个反斜杠时回退原始 source，terminal 传输层有独立行分隔修复。
+
+Markdown Outline 在 AST 前限制 512 KiB，并限制脚注/引用展开总量；超预算时设置 previewLimited，富预览显示“已缩短”的提示，用户可切换 Edit 阅读已经加载的 source。单块超过 32 KiB 或被截断的科学块按 literal source 展示。虚拟列表按需创建 TextViewState，并保留已创建状态。Ctrl+A 设置 whole-document selection；之后懒创建的新块立即继承选中状态，复制 source 不要求先解析所有块。
+
+Wakeup 在入队前合并；CommandStart、AiHookEnvelope、CommandDone、Exit 等语义事件保持顺序。文档加载/Outline 解析 permit 与科学后台任务计数器分开。
+
+## 自动化验证
+
+最终全量产品日志 All-20260908-083933.stdout.log：
+
+**1246 passed / 0 failed / 8 ignored / 2 filtered out**。两项过滤是既有凭据用例。该轮也实际构建了最新 GPUI 产品 binary。
+
+Outline 引用展开预算补丁后的核心日志 core-tests-final.log：
+
+**63 passed / 0 failed / 1 ignored**。覆盖 chemistry、document_io、math parser/layout/rasterizer/bitmap、Outline 预算与引用展开、RenderCache、scientific_corpus；忽略项是 informational corpus benchmark。该测试为独立核心路径，未链接 GPUI。
+
+其他独立结果：
+
+| 日志 | 结果 |
+|---|---|
+| Settings-20260908-085121 | 41 passed |
+| I18n-20260908-085253 | 14 passed / 1 ignored |
+| Integration-20260908-085625 | file budget 2 passed；i18n 14 passed / 1 ignored |
+
+历史 check-3.log 只作为较早完整 GPUI check 的证据；之后数学、预览和真实像素预算又有修订，最终判断以本节全量日志和后续人工复核为准。上一轮失败暴露的 geometry 计量已经改为 as_bytes 计量；最终全量日志已为 0 failed。
+
+最终格式化后的补充 Build 已通过：tmp/scientific-stress-20260908/Build-20260908-092256.stderr.log 记录 Finished dev profile，verify 返回 EXIT_CODE=0，耗时 2m51s。Integration 阶段也已实际构建 GPUI 产品 binary。
+
+## 核心 CPU benchmark
+
+tmp/scientific-stress-20260908/benchmark.log 是 O1 独立核心二进制的 dev benchmark，缓存为 dev 依赖；不是 Release，不链接 GPUI，不测 GPU/FPS。Markdown parse 每个文档重复 10 次；公式和分子使用各自样例分布。n=10 的 P95/P99 都是最大样本，不能当稳健尾延迟。本文不与旧 O3 探针比较。
+
+| 文档 | 阶段 | n | median ms | P95 ms | P99 ms |
+|---|---|---:|---:|---:|---:|
+| math | Markdown parse | 10 | 8.2548 | 9.7160 | 9.7160 |
+| math | compile | 121 | 0.0483 | 0.1313 | 0.2859 |
+| math | bitmap | 121 | 0.7571 | 1.6388 | 2.6597 |
+| chemistry | Markdown parse | 10 | 9.1201 | 10.3631 | 10.3631 |
+| chemistry | compile | 55 | 0.0397 | 0.0796 | 0.0994 |
+| chemistry | bitmap | 55 | 0.6739 | 1.0073 | 1.1081 |
+| chemistry | molecule SVG | 61 | 0.0344 | 0.1569 | 0.2687 |
+| biology | Markdown parse | 10 | 15.9760 | 17.8119 | 17.8119 |
+| biology | compile | 74 | 0.0714 | 0.1221 | 0.1722 |
+| biology | bitmap | 74 | 0.9691 | 1.2482 | 1.4304 |
+| biology | molecule SVG | 67 | 0.0383 | 0.1656 | 0.1884 |
+| paper | Markdown parse | 10 | 17.1089 | 17.6822 | 17.6822 |
+| paper | compile | 153 | 0.0176 | 0.1491 | 0.2150 |
+| paper | bitmap | 153 | 0.1806 | 2.1432 | 3.2010 |
+| paper | molecule SVG | 12 | 0.0231 | 0.4599 | 0.4599 |
+
+## Native SVG 与 UI 观察
+
+Native SVG benchmark 日志 native-svg.stderr.log：
+
+| 文档 | n | median ms | P95 ms | P99 ms |
+|---|---:|---:|---:|---:|
+| chemistry | 61 | 3.5352 | 10.2605 | 13.6102 |
+| biology | 67 | 8.7111 | 14.5232 | 18.5305 |
+| paper | 12 | 10.4214 | 13.8351 | 13.8351 |
+
+这是已预热字体的开发产品测试二进制中的 CPU SVG 栅格化；样例不是同一输入重复，不包含 GPU 绘制或 FPS。独立小测试进程 native-svg-process.json 的采样峰值工作集为 **18,984,960 bytes**，不能外推为桌面 App 或 80 AI 的占用。原生 GPUI SVG benchmark 尚未变成 GPU/FPS 证据。
+
+native/window-results.json 记录 9 张截图：数学、化学、论文各自执行 3 次尺寸操作，实际尺寸为 1280×900 和受最小窗口限制的 1162×821，再恢复到 1280×900。一个 App 加空 cmd，窗口已关闭，无 stderr 报错。工作集约 154–161 MiB，观测峰值约 164 MiB。截图复核确认数学公式渲染成功；化学和论文只看到了首页标题/介绍，未滚动完整文档，不能声称所有分子和全文均人工检查。该记录没有实际鼠标拖选、80 真实 AI 或 100 MB 全文。
+
+## 资源与生命周期核对
+
+公式请求先按 FormulaKey 查 Layout 或 Image。未命中时，pending HashSet 防止相同 key 重复排队；charge 同时计入 key、布局或真实像素。后台构建结束后先写缓存，再合并一次 UI refresh。单条公式超边长、超 24 MiB、无法布局或无法栅格化时返回源码回退；失败结果可被负缓存，避免每帧重复失败工作。
+
+SMILES 请求在 Pebrel chemistry 中解析并生成 SVG，再由 SvgRenderer 生成单帧 RenderImage。MoleculeView 和终端覆盖层都保留 source，图片未完成时显示加载或跳过覆盖，失败时显示 source/invalid 状态。dark theme 会形成独立 key。这里的单帧图像只说明资源生命周期，不说明 GPU 纹理已经归还。
+
+Markdown 文件读取、Outline 和科学资源任务分别受 8 MiB 文件上限、512 KiB Outline 上限、32 KiB block 上限、2 个 document permits 和 2 个科学后台任务约束。引用或脚注展开超过额外预算时，预览保持 source fallback 并标记 previewLimited；这和磁盘只读取 8 MiB 是两个不同层级。
+
+虚拟列表只为可见 block 创建 TextViewState。Ctrl+A 先标记 whole-document selection，再遍历已创建状态；后续可见块创建后立即补选。Copy 在 whole-document 状态下直接复制 InputState 的完整 source，所以远离视口的块无需解析。鼠标拖选仍必须观察跨块边界和真实系统选区。
+
+普通 Markdown 图片、动画图片转码、GPUI 自身图片缓存、字体缓存、SVG renderer 内存和外部 AI 都不从科学 RenderCache 预算扣除。科学缓存的 used_bytes、应用工作集、GPU 分配和子进程工作集必须在报告中分栏。
+
+## 证据矩阵
+
+| 层级 | 输入/日志 | 已确认事实 | 明确未覆盖 |
+|---|---|---|---|
+| 核心单元 | core-tests-final.log | 63/0/1；数学、chemistry、Outline 引用预算、LRU、文档前缀读取 | GPUI、窗口、真实输入 |
+| 全量产品 | All-20260908-083933.stdout.log | 1246/0/8/2；最新产品 binary 已构建 | 全文人工浏览、GPU/FPS、真实 AI |
+| 设置与集成 | Settings、I18n、Integration 日志 | 设置 41；I18n 14/1；file budget 2、i18n 14/1 | 发布环境长期运行 |
+| O1 CPU benchmark | benchmark.log | 四文档 parse/compile/bitmap/SVG 分布和实际毫秒值 | Release、GPUI、GPU、FPS |
+| Native SVG | native-svg.stderr.log | chemistry/biology/paper 三组 CPU SVG 栅格化分布 | GPU 绘制和桌面 App 资源 |
+| Native UI | native/window-results.json | 9 截图、3 次尺寸操作、2 种实际尺寸、无 stderr、工作集与峰值记录 | 全篇滚动、拖选、80 AI、100 MB |
+
+全量产品测试之前曾暴露 geometry 像素估算错误；最终证据以实际 as_bytes charge 和 1246/0/8/2 日志为准。旧日志中的失败不应被删改，但也不能继续作为当前实现状态。
+
+## 验收顺序
+
+为了复现最终结果，先用四份 docs 语料运行独立核心测试，核对 63 passed、0 failed、1 ignored；再读取 O1 benchmark 表，注意每份 Markdown parse 的 n=10 尾延迟限制。随后运行完整产品测试并保存 All 日志，确认 1246 passed、0 failed、8 ignored、2 filtered out。
+
+在 GUI 中逐个打开 math、chemistry 和 paper 文档，执行 3 次尺寸操作，涉及 1280×900 和最小 1162×821 两种实际尺寸，再恢复 1280×900。确认数学首屏、化学/论文的首屏 source/标题、previewLimited 提示、缺图或坏公式回退，然后继续人工补做完整滚动、跨文字拖选、Ctrl+A 后滚动到新 block、复制 source 和 tab 返回。现有 9 张截图只覆盖前述有限观察，不能替代这些后续动作。
+
+缓存观察应同时记录 entry count、used_bytes、真实 as_bytes、pending count、pending charge、running count、LRU 淘汰和 Weak 引用存活像素。遇到逻辑 geometry 与真实像素不一致时，以 RenderImage::as_bytes(0) 为准，不能恢复旧的 width × height × 4 估算。
+
+## 复核不变量
+
+| 不变量 | 复核方式 | 失败时的正确解释 |
+|---|---|---|
+| 科学 cache 不超过 48 MiB/1024 entries | 记录实际 charge、条目数和逐项淘汰 | 只说明 Pebrel cache 计账，不说明 RSS/GPU |
+| pending 不超过 64/4 MiB，科学任务不超过 2 | 记录 admission、拒绝、start/finish 和峰值 | 说明队列有界，不说明调度公平或输入流畅 |
+| document permit 不超过 2 | 同时触发多份加载和 Outline 解析 | 说明文档工作受限，不等于总线程上限 |
+| Image/Molecule 按真实 as_bytes 计量 | 对每个保留 Weak 升级并求像素长度 | 不用逻辑 geometry 代替实际像素 |
+| 公式只排版 root 可达节点 | 使用孤儿 accent、overbar、坏矩阵和 boxed/tag | 失败必须源码回退，不能猜测缺失行 |
+| 大文档不继续展开富预览 | 注入超 512 KiB、超 32 KiB block 和引用/脚注展开 | 显示 previewLimited/source，不代表完整文件已读 |
+| Ctrl+A 不依赖所有块物化 | Ctrl+A 后滚动到尚未创建的 block 再复制 | 新块继承选中状态，复制仍取完整 source |
+| Wakeup 合并不丢语义事件 | flood Wakeup 后检查 Command/AiHook/Done 顺序 | 只能合并 Wakeup，不能合并业务边沿 |
+
+### 回退路径
+
+公式回退包括解析失败、未知 presentation command、单反斜杠矩阵行末、超边长、超像素和不可读字号。分子回退包括非法 SMILES、超原子/超键/超字节、SVG 失败和主题 key 未完成。Markdown 回退包括图片缺失、引用/脚注展开超限、整份 Outline 超 512 KiB 和单 block 超 32 KiB。每类回退都应保留可复制 source，不能复用其他 key 的旧图。
+
+### 结果书写规则
+
+自动化日志给出的是测试二进制和输入集合的结果；benchmark 的 n、预热状态和构建模式必须随数字一起保存。原生 UI 记录给出的是有限截图和工作集观察；它不覆盖全文。任何“全部科学块通过”“所有图片正确”“输入延迟达标”“80 AI 平滑”“支持 100 MB”都需要额外证据，不得由本文件推断。
+
+## 复现与未覆盖项
+
+复现输入是四份维护语料：
+
+1. docs/math-rendering-test.md
+2. docs/chemistry-rendering-test.md
+3. docs/biology-rendering-test.md
+4. docs/scientific-rendering-acceptance-paper.md
+
+复核时保留日志、构建 revision、字体、显示缩放、GPU、viewport 和主题。核心测试应确认 63/0/1；全量测试应确认 1246/0/8/2；再分别检查缓存实际 as_bytes、Outline 预览缩短提示、Ctrl+A 后新块选择和 source 复制。
+
+以下事项仍不由这些结果覆盖：真实鼠标跨文字拖选；完整论文/化学/生物文档逐屏人工浏览；GPU 绘制与 FPS；桌面 App RSS/GPU 的容量上限；80 个真实 AI 的进程、事件和成本；100 MB 全文 Markdown AST、滚动和保存；发布端到端 P95/P99。普通图片、GPUI 自身 cache 和外部 AI 需要独立资源报告。不能用 48 MiB 科学 cache 或 18,984,960 bytes 独立进程峰值替代这些容量数据。
+
+本文件记录的是最终可复核的工程证据和边界。用户在主代理提交后仍需人工补齐拖选、全篇滚动、缺图/回退和真实窗口交互记录；这些动作完成前不扩大 GUI 覆盖结论。
+
+## 交接清单
+
+提交前保留 All、core-tests-final、benchmark、native-svg、native-svg-process、native/window-results 和 Build-20260908-092256.stderr.log 原始文件，不用截图代替日志。记录当前源 revision、产品 binary 路径和人工测试日期；若新证据改变像素计量、预览预算或 UI 覆盖范围，只修订本文件对应事实并保留旧日志。
diff --git a/docs/screenshots/scientific-fixture.png b/docs/screenshots/scientific-fixture.png
new file mode 100644
index 0000000..85b609f
Binary files /dev/null and b/docs/screenshots/scientific-fixture.png differ
diff --git a/nebula-completions/src/command_search.rs b/nebula-completions/src/command_search.rs
new file mode 100644
index 0000000..ea4c7cb
--- /dev/null
+++ b/nebula-completions/src/command_search.rs
@@ -0,0 +1,113 @@
+//! Case-insensitive, literal-word search for command lists and histories.
+
+use nucleo_matcher::{
+    Config, Matcher, Utf32Str,
+    pattern::{Atom, AtomKind, CaseMatching, Normalization},
+};
+
+/// One matcher per query. Spaces require every word to match, in any order;
+/// punctuation is literal, so shell flags never become search operators.
+pub struct CommandQuery {
+    words: Vec<(String, Atom)>,
+    matcher: Matcher,
+    buffer: Vec<char>,
+    valid: bool,
+}
+
+impl CommandQuery {
+    pub fn new(query: &str) -> Self {
+        let valid = query.len() <= 2048;
+        let words = if valid {
+            query
+                .split_whitespace()
+                .map(|word| {
+                    (
+                        word.to_lowercase(),
+                        Atom::new(
+                            word,
+                            CaseMatching::Ignore,
+                            Normalization::Smart,
+                            AtomKind::Fuzzy,
+                            false,
+                        ),
+                    )
+                })
+                .collect()
+        } else {
+            Vec::new()
+        };
+        let mut config = Config::DEFAULT;
+        config.prefer_prefix = true;
+        Self { words, matcher: Matcher::new(config), buffer: Vec::new(), valid }
+    }
+
+    pub fn score(&mut self, text: &str) -> Option<u32> {
+        self.score_fields(&[text])
+    }
+
+    /// Earlier fields have priority (for example, a saved name before its body).
+    pub fn score_fields(&mut self, fields: &[&str]) -> Option<u32> {
+        if !self.valid {
+            return None;
+        }
+        let mut total = 0;
+        for (word, atom) in &self.words {
+            let mut best = None;
+            for (index, text) in fields.iter().enumerate() {
+                let haystack = Utf32Str::new(text, &mut self.buffer);
+                let Some(fuzzy) = atom.score(haystack, &mut self.matcher) else { continue };
+                let folded = text.to_lowercase();
+                let tier = if folded == *word {
+                    4
+                } else if folded.starts_with(word.as_str()) {
+                    3
+                } else if folded
+                    .split(|ch: char| !ch.is_alphanumeric())
+                    .any(|part| part.starts_with(word.as_str()))
+                {
+                    2
+                } else if folded.contains(word.as_str()) {
+                    1
+                } else {
+                    0
+                };
+                let score = (fields.len() - index - 1) as u32 * 5_000
+                    + tier * 1_000
+                    + u32::from(fuzzy).min(999);
+                best = Some(best.map_or(score, |previous: u32| previous.max(score)));
+            }
+            total += best?;
+        }
+        Some(total)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn case_spaces_and_abbreviations_are_consistent() {
+        for query in ["DOCKER COMPOSE", "compose docker", "dck cmp"] {
+            assert!(CommandQuery::new(query).score("Docker Compose up").is_some());
+        }
+        assert!(
+            CommandQuery::new("环境 CREATE").score_fields(&["创建环境", "conda create"]).is_some()
+        );
+        assert!(CommandQuery::new("docker missing").score("docker compose").is_none());
+        assert!(CommandQuery::new("-xyz").score("docker compose").is_none());
+        assert!(CommandQuery::new(&"a".repeat(2049)).score("anything").is_none());
+    }
+
+    #[test]
+    fn exact_prefix_word_substring_and_fuzzy_have_stable_priority() {
+        let mut query = CommandQuery::new("git");
+        let scores =
+            ["git", "gitk", "run git", "legit", "g-in-t"].map(|text| query.score(text).unwrap());
+        assert!(scores.windows(2).all(|pair| pair[0] > pair[1]));
+        assert!(
+            query.score_fields(&["Git status", "echo hello"]).unwrap()
+                > query.score_fields(&["Inspect repository", "git status"]).unwrap()
+        );
+    }
+}
diff --git a/nebula-completions/src/lib.rs b/nebula-completions/src/lib.rs
index 07b1820..6a79898 100644
--- a/nebula-completions/src/lib.rs
+++ b/nebula-completions/src/lib.rs
@@ -10,6 +10,7 @@
 //! * Built-in completers for files, directories, and static string lists.
 //! * `Span`, `Suggestion`, `SemanticSuggestion`, and `SuggestionKind` types.
 
+pub mod command_search;
 pub mod completer;
 pub mod file;
 pub mod matcher;
diff --git a/nebula_app/Cargo.toml b/nebula_app/Cargo.toml
index 371dc60..6002e58 100644
--- a/nebula_app/Cargo.toml
+++ b/nebula_app/Cargo.toml
@@ -82,6 +82,9 @@ argon2 = "0.6.0-rc.8"
 aes-gcm = "0.11"
 bitflags = "2.2.1"
 chrono = "0.4.45"
+# Shared SMILES parsing and 2D SVG depiction; see ADR-0004.
+chematic-smiles = "=1.0.9"
+chematic-depict = { version = "=1.0.9", default-features = false }
 clap = { version = "4.2.7", features = ["derive", "env"] }
 copypasta = { version = "0.10.1", default-features = false }
 crossfont = { version = "0.9.0", optional = true }
@@ -184,6 +187,8 @@ objc2-app-kit = { version = "0.3.1", default-features = false, features = [
 ] }
 
 [target.'cfg(windows)'.dependencies]
+windows-core = "=0.61.2"
+windows = { version = "=0.61.3", features = ["Data_Pdf", "Storage", "Storage_Streams", "Foundation", "Win32_System_WinRT", "Win32_Graphics_Gdi", "Win32_System_Com", "Win32_System_Com_StructuredStorage", "Win32_System_DataExchange", "Win32_System_Memory", "Win32_System_Ole", "Win32_System_SystemServices", "Win32_UI_Shell", "Win32_UI_Input_KeyboardAndMouse"] }
 dirs = "6.0.0"
 dwrote = "0.11.5"
 # Registry reads for installed-shell detection (WSL distros under Lxss, Git /
diff --git a/nebula_app/assets/icons/nebula-command-manager.svg b/nebula_app/assets/icons/nebula-command-manager.svg
index 1c1dbc2..702dc57 100644
--- a/nebula_app/assets/icons/nebula-command-manager.svg
+++ b/nebula_app/assets/icons/nebula-command-manager.svg
@@ -1,4 +1,6 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round">
-  <rect x="3" y="4" width="18" height="16" rx="3"/>
-  <path d="m7 9 3 3-3 3m6 0h4"/>
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M9 2 3 12h4l-1 9 7-12H9l3-7Z"/>
+  <path d="M15 7h6"/>
+  <path d="M15 12h6"/>
+  <path d="M15 17h4"/>
 </svg>
diff --git a/nebula_app/i18n/en-US.json b/nebula_app/i18n/en-US.json
index b55ce81..40365c5 100644
--- a/nebula_app/i18n/en-US.json
+++ b/nebula_app/i18n/en-US.json
@@ -18,6 +18,12 @@
       "advanced": "Advanced",
       "backup": "Backup"
     },
+    "notifications": {
+      "ai_messages": "AI message toasts",
+      "ai_messages_description": "Show AI toasts in the lower-right corner. System notifications are unaffected.",
+      "ai_messages_details": "Turning this off dismisses existing in-app AI toasts and hides new completion and confirmation toasts. System notifications, including Windows notifications, and tab status indicators are unchanged. Terminal output and confirmation requests in the terminal remain available.",
+      "save_failed": "Could not save the AI toast setting: {error}"
+    },
     "network": {
       "title": "Network proxy",
       "mode": {
@@ -80,7 +86,9 @@
     },
     "keymap": {
       "conflict": "{combo} is assigned to both \"{first}\" and \"{second}\"; only the earlier \"{first}\" action will run.",
-      "help": "Click a row to rebind · Backspace restores the default · Esc cancels"
+      "help": "Click a shortcut and press a new combination. Backspace clears it; Esc cancels. Use the row buttons to clear or restore defaults.",
+      "clear": "Clear shortcut (pass through to terminal)",
+      "restore": "Restore this action’s default shortcut"
     },
     "input": {
       "backup_secret": "Credentials are stored only in the system credential manager"
@@ -252,6 +260,11 @@
     "update_notice": "Pebrel v{latest} is available (current v{current})",
     "copied_lines": "Copied {lines} lines to clipboard",
     "paste_lines": "Paste {lines} lines?",
+    "drop_paths_invalid": "Could not paste these paths. Check for special characters or drop fewer files.",
+    "drop_paths_busy": "The previous dropped paths are still being converted.",
+    "drop_paths_expired": "Path paste was canceled because the active input changed.",
+    "drop_paths_failed": "Could not convert the paths for this WSL session. Please try again.",
+    "drop_paths_remote": "Local paths cannot be used directly over SSH. Drop the files into the remote file tree to upload them.",
     "image_paste_failed": "Could not paste image: {error}",
     "image_paste_busy": "An image paste is still in progress.",
     "image_paste_expired": "Image paste was canceled because the active input changed.",
@@ -270,6 +283,23 @@
     "unsaved": "Unsaved",
     "edit": "Edit",
     "preview": "Preview",
+    "reading": "Read",
+    "statistics": "Document statistics",
+    "properties": "File properties",
+    "details_toggle": "Toggle document sidebar",
+    "details_close": "Hide document sidebar",
+    "fullscreen": "Enter fullscreen",
+    "exit_fullscreen": "Exit fullscreen",
+    "focus_reading": "Focus reading",
+    "exit_focus_reading": "Exit focus reading",
+    "search_code_language": "Search languages…",
+    "copy_code": "Copy code",
+    "copy_math_latex": "Copy LaTeX source",
+    "copy_math_image": "Copy formula image",
+    "math_image_unavailable": "Formula image is unavailable until rendering finishes or fallback text is needed",
+    "math_latex_copied": "LaTeX source copied",
+    "math_image_copied": "Formula image copied",
+    "markdown_document": "Markdown document",
     "outline": "Outline",
     "no_headings": "This document has no headings yet",
     "copy_heading": "Copy heading",
@@ -298,7 +328,64 @@
     "status": "Status",
     "copy_name": "Copy file name",
     "reveal": "Reveal in file manager",
-    "open_external": "Open with default app"
+    "open_external": "Open with default app",
+    "preview_limited": "The rich preview is shortened for this large document. Switch to Edit to read the loaded source."
+  },
+  "commands": {
+    "builtin": {
+      "docker_install_windows": "Install Docker Desktop · Windows",
+      "docker_install_mac": "Install Docker Desktop · macOS",
+      "docker_install_ubuntu": "Install Docker · Ubuntu 24.04",
+      "docker_install_fedora": "Install Docker · Fedora",
+      "docker_ps": "Docker · List all containers",
+      "docker_images": "Docker · List images",
+      "docker_build": "Docker · Build project image",
+      "docker_run": "Docker · Run with port mapping",
+      "docker_logs": "Docker · Follow container logs",
+      "docker_exec": "Docker · Open container shell",
+      "compose_up": "Docker Compose · Start development services",
+      "compose_logs": "Docker Compose · Follow service logs",
+      "compose_down": "Docker Compose · Stop services (keep volumes)",
+      "conda_install_windows": "Install Miniconda · Windows",
+      "conda_install_mac": "Install Miniconda · macOS",
+      "conda_install_linux": "Install Miniconda · Linux",
+      "conda_list": "Conda · List environments",
+      "conda_create": "Conda · Create Python environment",
+      "conda_activate": "Conda · Activate environment",
+      "conda_deactivate": "Conda · Deactivate environment",
+      "conda_install": "Conda · Install data science packages",
+      "conda_export": "Conda · Export environment dependencies",
+      "conda_restore": "Conda · Create environment from file",
+      "python_venv": "Python · Create virtual environment",
+      "python_activate_windows": "Python · Activate virtual environment · PowerShell",
+      "python_activate_posix": "Python · Activate virtual environment · Bash/Zsh",
+      "pip_install": "Python · Install project dependencies",
+      "uv_sync": "uv · Sync project environment",
+      "npm_install": "npm · Install locked dependencies",
+      "npm_dev": "npm · Start development server",
+      "pnpm_install": "pnpm · Install dependencies",
+      "git_status": "Git · Inspect working tree",
+      "git_diff": "Git · Inspect unstaged changes",
+      "git_log": "Git · View commit graph",
+      "git_branch": "Git · Create feature branch",
+      "cargo_test": "Rust · Run project tests",
+      "cargo_check": "Rust · Check all targets",
+      "ssh_key": "SSH · Create Ed25519 key"
+    },
+    "builtin_label": "Built-in",
+    "save_copy": "Save a copy"
+  },
+  "files": {
+    "ignore_add": "Add to .gitignore",
+    "ignore_remove": "Remove from .gitignore",
+    "ignore_added": "Added to .gitignore: {entry}",
+    "ignore_removed": "No longer ignored: {entry}",
+    "ignore_present": "Already ignored: {entry}",
+    "ignore_visible": "Already visible: {entry}",
+    "ignore_failed": "Could not change Git ignore rules: {error}",
+    "preview_loading": "Preparing preview…",
+    "preview_unavailable": "Preview unavailable for this file",
+    "preview_pages": "Page 1 of {pages}"
   },
   "recipe": {
     "title": "Layout recipes",
@@ -318,5 +405,62 @@
     "count": "{tabs} tabs · {panes} panes",
     "save_window": "Save current window layout…",
     "open_library": "Open layout recipes…"
+  },
+  "chemistry": {
+    "loading": "Drawing molecule…",
+    "invalid": "This SMILES cannot be drawn; source is preserved."
+  },
+  "markdown": {
+    "plain_text": "Plain text",
+    "choose_language": "Choose highlighting language for this block"
+  },
+  "transfer": {
+    "not_ready": "The remote directory is not ready",
+    "target_changed": "The target changed. Start the transfer again in the intended directory.",
+    "busy": "A transfer is already in progress. Wait for it or cancel it first.",
+    "checking": "Checking the transfer destination…",
+    "downloaded": "Download completed",
+    "cancelled": "Transfer cancelled",
+    "failed": "Transfer failed",
+    "upload_hint": "Drop files here to upload",
+    "download_hint": "Drag to a folder in File Explorer to download",
+    "conflict_title": "Items with the same name already exist",
+    "conflict_body": "{count} items already exist at the destination.",
+    "incompatible": "Some items have incompatible file and folder types and cannot be overwritten.",
+    "symlink_warning": "Overwriting a symbolic link changes its target directly. A failure or cancellation can leave partial content.",
+    "overwrite": "Overwrite",
+    "skip": "Skip",
+    "keep_both": "Keep both",
+    "cancel": "Cancel",
+    "cancelling": "Cancelling the operation…",
+    "busy_at": "A transfer is already running for {host}",
+    "destination": "Destination: {destination}",
+    "copied_item": "Copied remote item: {name}",
+    "choose_files": "Choose files to upload",
+    "choose_upload_directory": "Choose a folder to upload",
+    "choose_download_directory": "Choose the download folder",
+    "drag_hint": "Drop files here to upload; drag an item to File Explorer to download."
+  },
+  "hosts": {
+    "search": "Search name, address, group, tags or notes",
+    "group": "Group",
+    "tags": "Tags",
+    "notes": "Notes",
+    "tags_hint": "Separate tags with commas",
+    "all_groups": "All groups",
+    "ungrouped": "Ungrouped",
+    "all": "All hosts",
+    "managed": "Managed hosts",
+    "recent": "Recent connections",
+    "no_matches": "No matching hosts",
+    "import": "Import CSV",
+    "export": "Export CSV",
+    "import_preview": "Add {added} hosts and preserve {skipped} existing hosts. Existing credentials and connection settings are kept. Matching hidden hosts will be shown again.",
+    "invalid": "Invalid host details: {error}",
+    "processing": "Processing host information…",
+    "reloaded": "Host information reloaded",
+    "exported": "Host metadata exported without credentials",
+    "imported": "Added {added} hosts; skipped {skipped} existing hosts",
+    "imported_partial": "Added {added} hosts, but could not update their visibility. Retry the import: {error}"
   }
 }
diff --git a/nebula_app/i18n/zh-CN.json b/nebula_app/i18n/zh-CN.json
index fde998c..09d7b8a 100644
--- a/nebula_app/i18n/zh-CN.json
+++ b/nebula_app/i18n/zh-CN.json
@@ -18,6 +18,12 @@
       "advanced": "高级",
       "backup": "备份"
     },
+    "notifications": {
+      "ai_messages": "AI 消息弹窗",
+      "ai_messages_description": "显示右下角的 AI 弹窗，不影响系统通知。",
+      "ai_messages_details": "关闭后收起已有的应用内 AI 弹窗，并停止显示新的完成和确认弹窗。Windows 系统通知及标签状态提示仍保留，终端输出和终端内的确认请求不受影响。",
+      "save_failed": "无法保存 AI 弹窗设置：{error}"
+    },
     "network": {
       "title": "网络代理",
       "mode": {
@@ -80,7 +86,9 @@
     },
     "keymap": {
       "conflict": "{combo} 同时绑定了「{first}」与「{second}」——只有排前面的「{first}」会触发",
-      "help": "点击行改键 · Backspace 恢复默认 · Esc 取消"
+      "help": "点击快捷键后按新组合键；Backspace 清空，Esc 取消。右侧可清空或恢复默认。",
+      "clear": "清空快捷键（传给终端）",
+      "restore": "恢复此动作的默认快捷键"
     },
     "input": {
       "backup_secret": "凭据只写入系统凭据管理器"
@@ -252,6 +260,11 @@
     "update_notice": "Pebrel v{latest} 已发布（当前 v{current}）",
     "copied_lines": "已复制 {lines} 行到剪贴板",
     "paste_lines": "粘贴 {lines} 行文本？",
+    "drop_paths_invalid": "无法粘贴这些路径，请检查特殊字符或减少拖入的文件数量。",
+    "drop_paths_busy": "上一组拖入的路径仍在转换。",
+    "drop_paths_expired": "当前输入状态已改变，已取消路径粘贴。",
+    "drop_paths_failed": "无法为此 WSL 会话转换路径，请重试。",
+    "drop_paths_remote": "SSH 中不能直接使用本地路径，请将文件拖到远程文件树上传。",
     "image_paste_failed": "无法粘贴图片：{error}",
     "image_paste_busy": "上一张图片仍在处理。",
     "image_paste_expired": "当前输入状态已改变，已取消图片粘贴。",
@@ -270,6 +283,23 @@
     "unsaved": "未保存",
     "edit": "编辑",
     "preview": "预览",
+    "reading": "阅读",
+    "statistics": "文档统计",
+    "properties": "文件属性",
+    "details_toggle": "切换文档侧栏",
+    "details_close": "隐藏文档侧栏",
+    "fullscreen": "进入全屏",
+    "exit_fullscreen": "退出全屏",
+    "focus_reading": "专注阅读",
+    "exit_focus_reading": "退出专注阅读",
+    "search_code_language": "搜索语言…",
+    "copy_code": "复制代码",
+    "copy_math_latex": "复制 LaTeX 源码",
+    "copy_math_image": "复制公式图片",
+    "math_image_unavailable": "公式图片尚未完成渲染，或包含需要文本回补的字符",
+    "math_latex_copied": "LaTeX 源码已复制",
+    "math_image_copied": "公式图片已复制",
+    "markdown_document": "Markdown 文档",
     "outline": "目录",
     "no_headings": "此文档还没有标题",
     "copy_heading": "复制标题",
@@ -298,7 +328,64 @@
     "status": "状态",
     "copy_name": "复制文件名",
     "reveal": "在文件管理器中显示",
-    "open_external": "用默认应用打开"
+    "open_external": "用默认应用打开",
+    "preview_limited": "此文档较大，富文本预览已缩短。切换到编辑可查看已加载的源码。"
+  },
+  "commands": {
+    "builtin": {
+      "docker_install_windows": "安装 Docker Desktop · Windows",
+      "docker_install_mac": "安装 Docker Desktop · macOS",
+      "docker_install_ubuntu": "安装 Docker · Ubuntu 24.04",
+      "docker_install_fedora": "安装 Docker · Fedora",
+      "docker_ps": "Docker · 查看全部容器",
+      "docker_images": "Docker · 查看镜像",
+      "docker_build": "Docker · 构建当前项目镜像",
+      "docker_run": "Docker · 运行并映射端口",
+      "docker_logs": "Docker · 持续查看容器日志",
+      "docker_exec": "Docker · 进入容器 Shell",
+      "compose_up": "Docker Compose · 启动开发服务",
+      "compose_logs": "Docker Compose · 查看服务日志",
+      "compose_down": "Docker Compose · 停止服务（保留卷）",
+      "conda_install_windows": "安装 Miniconda · Windows",
+      "conda_install_mac": "安装 Miniconda · macOS",
+      "conda_install_linux": "安装 Miniconda · Linux",
+      "conda_list": "Conda · 查看环境列表",
+      "conda_create": "Conda · 创建 Python 开发环境",
+      "conda_activate": "Conda · 激活开发环境",
+      "conda_deactivate": "Conda · 退出当前环境",
+      "conda_install": "Conda · 安装常用数据科学包",
+      "conda_export": "Conda · 导出环境依赖",
+      "conda_restore": "Conda · 从文件创建环境",
+      "python_venv": "Python · 创建虚拟环境",
+      "python_activate_windows": "Python · 激活虚拟环境 · PowerShell",
+      "python_activate_posix": "Python · 激活虚拟环境 · Bash/Zsh",
+      "pip_install": "Python · 安装项目依赖",
+      "uv_sync": "uv · 同步项目环境与依赖",
+      "npm_install": "npm · 安装锁定依赖",
+      "npm_dev": "npm · 启动开发服务",
+      "pnpm_install": "pnpm · 安装项目依赖",
+      "git_status": "Git · 查看工作区状态",
+      "git_diff": "Git · 查看未暂存修改",
+      "git_log": "Git · 查看提交图",
+      "git_branch": "Git · 创建并切换开发分支",
+      "cargo_test": "Rust · 运行项目测试",
+      "cargo_check": "Rust · 检查所有目标",
+      "ssh_key": "SSH · 创建 Ed25519 密钥"
+    },
+    "builtin_label": "内置",
+    "save_copy": "保存副本"
+  },
+  "files": {
+    "ignore_add": "加入 .gitignore",
+    "ignore_remove": "从 .gitignore 移除",
+    "ignore_added": "已写入 .gitignore：{entry}",
+    "ignore_removed": "已取消忽略：{entry}",
+    "ignore_present": ".gitignore 已有这条规则：{entry}",
+    "ignore_visible": "此路径未被忽略：{entry}",
+    "ignore_failed": "修改 Git 忽略规则失败：{error}",
+    "preview_loading": "正在生成预览…",
+    "preview_unavailable": "此文件暂时无法预览",
+    "preview_pages": "第 1 页 · 共 {pages} 页"
   },
   "recipe": {
     "title": "布局配方",
@@ -318,5 +405,62 @@
     "count": "{tabs} 个标签 · {panes} 个分屏",
     "save_window": "保存当前窗口布局…",
     "open_library": "打开布局配方…"
+  },
+  "chemistry": {
+    "loading": "正在绘制分子结构…",
+    "invalid": "此 SMILES 暂无法绘制，保留源码。"
+  },
+  "markdown": {
+    "plain_text": "纯文本",
+    "choose_language": "选择此代码块的高亮语言"
+  },
+  "transfer": {
+    "not_ready": "远端目录尚未就绪",
+    "target_changed": "目标已改变，请在需要的目录重新发起传输。",
+    "busy": "已有传输正在进行，请等待完成或先取消。",
+    "checking": "正在检查传输目标…",
+    "downloaded": "下载完成",
+    "cancelled": "传输已取消",
+    "failed": "传输失败",
+    "upload_hint": "拖入文件以上传",
+    "download_hint": "拖到资源管理器文件夹以下载",
+    "conflict_title": "已有同名项目",
+    "conflict_body": "目标位置已有 {count} 个同名项目。",
+    "incompatible": "部分项目的文件与文件夹类型不一致，不能覆盖。",
+    "symlink_warning": "覆盖符号链接会直接修改其目标，失败或取消可能留下部分内容。",
+    "overwrite": "覆盖",
+    "skip": "跳过",
+    "keep_both": "保留两者",
+    "cancel": "取消",
+    "cancelling": "正在取消操作…",
+    "busy_at": "{host} 已有传输正在进行",
+    "destination": "目标位置：{destination}",
+    "copied_item": "已复制远端项目：{name}",
+    "choose_files": "选择要上传的文件",
+    "choose_upload_directory": "选择要上传的文件夹",
+    "choose_download_directory": "选择下载位置",
+    "drag_hint": "拖入文件即可上传；拖到资源管理器即可下载。"
+  },
+  "hosts": {
+    "search": "搜索名称、地址、分组、标签或备注",
+    "group": "分组",
+    "tags": "标签",
+    "notes": "备注",
+    "tags_hint": "用逗号分隔多个标签",
+    "all_groups": "全部分组",
+    "ungrouped": "未分组",
+    "all": "全部主机",
+    "managed": "长期主机",
+    "recent": "最近连接",
+    "no_matches": "没有匹配的主机",
+    "import": "导入 CSV",
+    "export": "导出 CSV",
+    "import_preview": "将新增 {added} 台主机，保留 {skipped} 台已有主机的凭据与连接设置。匹配的隐藏主机将恢复显示。",
+    "invalid": "主机信息无效：{error}",
+    "processing": "正在处理主机信息…",
+    "reloaded": "已重新读取主机信息",
+    "exported": "主机信息已导出，不含凭据",
+    "imported": "已新增 {added} 台主机，跳过 {skipped} 台已有主机",
+    "imported_partial": "已新增 {added} 台主机，但显示状态未能更新。请重试导入：{error}"
   }
 }
diff --git a/nebula_app/src/agent_env.rs b/nebula_app/src/agent_env.rs
index 8592b78..1ed612b 100644
--- a/nebula_app/src/agent_env.rs
+++ b/nebula_app/src/agent_env.rs
@@ -50,6 +50,10 @@ const LEGACY_CLI_ENV: &str = "NEBULA_CLI";
 pub const BIN_DIR_ENV: &str = "PEBREL_BIN_DIR";
 const LEGACY_BIN_DIR_ENV: &str = "NEBULA_BIN_DIR";
 
+/// 当前 Pebrel 进程的 PID。和 pane id 一起构成进程归属，避免两个同时运行的
+/// Pebrel 实例各自的 pane 1 被身份探测混在一起；数字值可原样穿过 WSL。
+pub const PROCESS_ENV: &str = "PEBREL_PROCESS_ID";
+
 const TERM_PROGRAM_ENV: &str = "TERM_PROGRAM";
 const TERM_PROGRAM_VERSION_ENV: &str = "TERM_PROGRAM_VERSION";
 const PATH_ENV: &str = "PATH";
@@ -71,6 +75,7 @@ pub fn apply(env: &mut HashMap<String, String>, pane_id: impl Display) {
     let pane_id = pane_id.to_string();
     insert_env(env, PANE_ENV, pane_id.clone());
     insert_env(env, crate::ai_hook::LEGACY_PANE_ENV, pane_id);
+    insert_env(env, PROCESS_ENV, std::process::id().to_string());
     insert_env(env, TERM_PROGRAM_ENV, TERM_PROGRAM.to_owned());
     insert_env(env, TERM_PROGRAM_VERSION_ENV, env!("VERSION").to_owned());
 
@@ -166,6 +171,7 @@ const WSLENV_ENTRIES: &[&str] = &[
     TERM_PROGRAM_VERSION_ENV,
     "PEBREL_CLI/p",
     "PEBREL_BIN_DIR/p",
+    PROCESS_ENV,
     "NEBULA_CLI/p",
     "NEBULA_BIN_DIR/p",
 ];
@@ -219,6 +225,8 @@ mod tests {
         let env = applied(17);
         assert_eq!(env.get(PANE_ENV).map(String::as_str), Some("17"));
         assert_eq!(env.get(crate::ai_hook::LEGACY_PANE_ENV), env.get(PANE_ENV));
+        let process_id = std::process::id().to_string();
+        assert_eq!(env.get(PROCESS_ENV).map(String::as_str), Some(process_id.as_str()));
         assert_eq!(env.get(LEGACY_CLI_ENV), env.get(CLI_ENV));
         assert_eq!(env.get(LEGACY_BIN_DIR_ENV), env.get(BIN_DIR_ENV));
         assert_eq!(env.get("TERM_PROGRAM").map(String::as_str), Some(TERM_PROGRAM));
@@ -299,6 +307,7 @@ mod tests {
         let names: Vec<&str> = WSLENV_ENTRIES.iter().copied().map(variable_name).collect();
         assert!(names.contains(&CLI_ENV), "{CLI_ENV} missing from WSLENV passthrough: {names:?}");
         assert!(names.contains(&BIN_DIR_ENV), "{BIN_DIR_ENV} missing: {names:?}");
+        assert!(names.contains(&PROCESS_ENV), "{PROCESS_ENV} missing: {names:?}");
     }
 
     #[cfg(windows)]
diff --git a/nebula_app/src/chemistry.rs b/nebula_app/src/chemistry.rs
new file mode 100644
index 0000000..ff6a7e9
--- /dev/null
+++ b/nebula_app/src/chemistry.rs
@@ -0,0 +1,80 @@
+//! Shared bounded SMILES parsing and 2D depiction for documents and terminals.
+
+use chematic_depict::{RenderOptions, compute_layout, render_svg_opts};
+use chematic_smiles::{SmilesParseLimits, parse_with_limits};
+
+/// Temporarily disabled while the product's memory budget is investigated.
+/// Keep depiction code available; UI adapters must return before scheduling work.
+pub(crate) const STRUCTURE_RENDERING_ENABLED: bool = false;
+
+pub(crate) const MAX_SOURCE_BYTES: usize = 2048;
+pub(crate) const IMAGE_WIDTH: u32 = 480;
+pub(crate) const IMAGE_HEIGHT: u32 = 240;
+
+/// Called by background adapters. Invalid input remains source text in the UI.
+pub(crate) fn render_smiles(source: &str, dark: bool) -> Result<String, String> {
+    let source = source.trim();
+    if source.is_empty() || source.len() > MAX_SOURCE_BYTES || source.contains(['\n', '\r']) {
+        return Err("Expected one SMILES molecule (up to 2048 bytes)".into());
+    }
+    // This backend does not yet project atom parity or alkene direction into
+    // correct 2D stereobonds. Preserve those expressions as source.
+    if source.contains(['@', '/', '\\']) {
+        return Err(
+            "Stereochemical SMILES is preserved as source until depiction is supported".into()
+        );
+    }
+    let limits =
+        SmilesParseLimits { max_input_bytes: MAX_SOURCE_BYTES, max_atoms: 128, max_bonds: 192 };
+    let molecule = parse_with_limits(source, &limits).map_err(|error| error.to_string())?;
+    if molecule.atom_count() == 0 {
+        return Err("The molecule has no atoms".into());
+    }
+    let layout = compute_layout(&molecule);
+    let options = RenderOptions {
+        width: Some(IMAGE_WIDTH),
+        height: Some(IMAGE_HEIGHT),
+        dark,
+        background: "transparent".into(),
+        padding: 12.0,
+        ..Default::default()
+    };
+    let svg = render_svg_opts(&molecule, &layout, &options);
+    if svg.len() > 512 * 1024 || svg.contains("NaN") || svg.contains("Infinity") {
+        return Err("The molecule could not be laid out within the preview budget".into());
+    }
+    Ok(svg)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn depicts_rings_branches_aromatics_and_charges() {
+        for source in ["c1ccccc1", "CC(=O)Oc1ccccc1C(=O)O", "[NH4+].[Cl-]"] {
+            for dark in [false, true] {
+                let svg = render_smiles(source, dark).unwrap();
+                assert!(svg.starts_with("<svg"));
+                assert!(svg.contains("viewBox="));
+                assert!(!svg.contains("NaN"));
+            }
+        }
+    }
+
+    #[test]
+    fn stereo_source_is_preserved_when_the_backend_cannot_depict_it() {
+        for source in ["C[C@H](O)C(=O)O", "C[C@@H](O)C(=O)O", "F/C=C/F", "F/C=C\\F"] {
+            assert!(render_smiles(source, false).is_err());
+        }
+    }
+
+    #[test]
+    fn invalid_and_oversized_input_is_not_drawn_as_a_different_molecule() {
+        for source in
+            ["", "C1CC", "not a molecule", "CCO\nc1ccccc1", &"C".repeat(129), &"C".repeat(2049)]
+        {
+            assert!(render_smiles(source, false).is_err(), "{source}");
+        }
+    }
+}
diff --git a/nebula_app/src/display/command_completion.rs b/nebula_app/src/display/command_completion.rs
index 8966956..0d67b7c 100644
--- a/nebula_app/src/display/command_completion.rs
+++ b/nebula_app/src/display/command_completion.rs
@@ -222,37 +222,16 @@ pub(crate) fn nebula_command_hints<'a>(
     if prefix.is_empty() || limit == 0 {
         return Vec::new();
     }
-    let mut out: Vec<&'a str> = Vec::new();
-
-    for exact_only in [true, false] {
-        for command in commands {
-            if command.len() < prefix.len() || !command.is_char_boundary(prefix.len()) {
-                continue;
-            }
-            let head = &command[..prefix.len()];
-            let exact = command.len() == prefix.len();
-            if exact != exact_only {
-                continue;
-            }
-            #[cfg(windows)]
-            let matches = head.eq_ignore_ascii_case(prefix);
-            #[cfg(not(windows))]
-            let matches = head == prefix;
-
-            #[cfg(windows)]
-            let duplicate = out.iter().any(|seen| seen.eq_ignore_ascii_case(command));
-            #[cfg(not(windows))]
-            let duplicate = out.iter().any(|seen| *seen == command.as_str());
-
-            if matches && !duplicate {
-                out.push(command);
-                if out.len() == limit {
-                    return out;
-                }
-            }
-        }
-    }
-    out
+    let mut query = nebula_completions::command_search::CommandQuery::new(prefix);
+    let mut matches: Vec<_> = commands
+        .iter()
+        .filter_map(|command| query.score(command).map(|score| (score, command.as_str())))
+        .collect();
+    matches.sort_by(|(a_score, a), (b_score, b)| {
+        b_score.cmp(a_score).then(a.len().cmp(&b.len())).then(a.cmp(b))
+    });
+    matches.dedup_by(|a, b| a.1 == b.1);
+    matches.into_iter().take(limit).map(|(_, command)| command).collect()
 }
 
 pub(crate) fn nebula_is_command_position(line: &str) -> bool {
@@ -301,7 +280,7 @@ mod tests {
             nebula_command_hints(&commands, "claude", 8),
             vec!["claude", "claude-agent-acp"]
         );
-        assert_eq!(nebula_command_hints(&commands, "c", 2), vec!["claude", "claude-agent-acp"]);
+        assert_eq!(nebula_command_hints(&commands, "c", 2), vec!["cargo", "claude"]);
         assert_eq!(nebula_command_hints(&strings(&["LsaIso", "lsass", "ls"]), "ls", 8)[0], "ls");
         assert!(nebula_command_hints(&commands, "", 8).is_empty());
     }
diff --git a/nebula_app/src/display/command_palette.rs b/nebula_app/src/display/command_palette.rs
index dbc7349..4699cff 100644
--- a/nebula_app/src/display/command_palette.rs
+++ b/nebula_app/src/display/command_palette.rs
@@ -260,6 +260,15 @@ pub(crate) struct PaletteItem {
 
 /// The full action table, in declaration order (also the tie-break order when
 /// fuzzy scores are equal, and the order shown for an empty query).
+const fn theme_item(theme: NebulaTheme, search: &'static str) -> PaletteItem {
+    PaletteItem {
+        label: theme.command_label(),
+        hint: "",
+        search,
+        action: PaletteAction::SelectTheme(theme),
+    }
+}
+
 const ITEMS: &[PaletteItem] = &[
     PaletteItem {
         label: "新建标签页",
@@ -427,60 +436,19 @@ const ITEMS: &[PaletteItem] = &[
         search: "恢复外观默认 reset appearance default huifu waiguan moren",
         action: PaletteAction::ResetAppearance,
     },
-    PaletteItem {
-        label: "主题：Nebula",
-        hint: "",
-        search: "主题 nebula theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::Nebula),
-    },
-    PaletteItem {
-        label: "主题：Silver Light",
-        hint: "",
-        search: "主题 silver light theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::SilverLight),
-    },
-    PaletteItem {
-        label: "主题：Steel Dark",
-        hint: "",
-        search: "主题 steel dark theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::SteelDark),
-    },
-    PaletteItem {
-        label: "主题：Limestone",
-        hint: "",
-        search: "主题 limestone light theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::LimestoneLight),
-    },
-    PaletteItem {
-        label: "主题：Coal Dark",
-        hint: "",
-        search: "主题 coal dark theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::CoalDark),
-    },
-    PaletteItem {
-        label: "主题：Linen Light",
-        hint: "",
-        search: "主题 linen light theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::LinenLight),
-    },
-    PaletteItem {
-        label: "主题：Moss Dark",
-        hint: "",
-        search: "主题 moss dark theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::MossDark),
-    },
-    PaletteItem {
-        label: "主题：Nord",
-        hint: "",
-        search: "主题 nord dark theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::Nord),
-    },
-    PaletteItem {
-        label: "主题：Paper",
-        hint: "",
-        search: "主题 paper light theme zhuti",
-        action: PaletteAction::SelectTheme(NebulaTheme::Paper),
-    },
+    theme_item(NebulaTheme::BreezeLight, "theme 主题 breeze light"),
+    theme_item(NebulaTheme::BreezeDark, "theme 主题 breeze dark"),
+    theme_item(NebulaTheme::MintLight, "theme 主题 mint light"),
+    theme_item(NebulaTheme::MintDark, "theme 主题 mint dark"),
+    theme_item(NebulaTheme::SilverLight, "theme 主题 silver light"),
+    theme_item(NebulaTheme::Nord, "theme 主题 nord dark"),
+    theme_item(NebulaTheme::Paper, "theme 主题 paper light"),
+    theme_item(NebulaTheme::LimestoneLight, "theme 主题 limestone light"),
+    theme_item(NebulaTheme::LinenLight, "theme 主题 linen light"),
+    theme_item(NebulaTheme::CatppuccinMocha, "theme 主题 catppuccin mocha dark"),
+    theme_item(NebulaTheme::CatppuccinLatte, "theme 主题 catppuccin latte light"),
+    theme_item(NebulaTheme::GlassLight, "theme 主题 glass light"),
+    theme_item(NebulaTheme::GlassDark, "theme 主题 glass dark"),
 ];
 
 /// Shared command catalog for alternate presentation layers.
@@ -1350,10 +1318,11 @@ impl CommandPalette {
             });
             self.filtered = order;
         } else {
-            let mut scored: Vec<(i32, PaletteCandidate)> = candidates
+            let mut matcher = nebula_completions::command_search::CommandQuery::new(query);
+            let mut scored: Vec<(u32, PaletteCandidate)> = candidates
                 .into_iter()
                 .filter_map(|candidate| {
-                    fuzzy_score(query, combined_search(candidate)).map(|score| (score, candidate))
+                    matcher.score(combined_search(candidate)).map(|score| (score, candidate))
                 })
                 .collect();
             scored.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.cmp(&b.1)));
@@ -1640,29 +1609,11 @@ pub struct PaletteRow {
 /// haystack. Consecutive runs and word-start matches are rewarded so intuitive
 /// queries rank first (e.g. "nt" prefers "new tab" over "next"). An empty
 /// needle matches everything with score 0, preserving declaration order.
+#[cfg(test)]
 fn fuzzy_score(needle: &str, haystack: &str) -> Option<i32> {
-    if needle.is_empty() {
-        return Some(0);
-    }
-    let needle: Vec<char> = needle.chars().flat_map(char::to_lowercase).collect();
-    let mut next = 0usize;
-    let mut score = 0i32;
-    let mut run = 0i32;
-    let mut prev = ' ';
-    for hc in haystack.chars().flat_map(char::to_lowercase) {
-        if next < needle.len() && hc == needle[next] {
-            score += 1 + run * 5; // consecutive-match run bonus (dominant)
-            if !prev.is_alphanumeric() {
-                score += 4; // word / segment start
-            }
-            run += 1;
-            next += 1;
-        } else {
-            run = 0;
-        }
-        prev = hc;
-    }
-    (next == needle.len()).then_some(score)
+    nebula_completions::command_search::CommandQuery::new(needle)
+        .score(haystack)
+        .map(|score| score as i32)
 }
 
 /// Scrollbar geometry shared by rendering and pointer input.
diff --git a/nebula_app/src/display/content.rs b/nebula_app/src/display/content.rs
index 024b625..e60c57a 100644
--- a/nebula_app/src/display/content.rs
+++ b/nebula_app/src/display/content.rs
@@ -364,7 +364,7 @@ impl RenderableCell {
         fg = content.color_resolver.resolve_foreground(
             fg,
             bg,
-            fixed_fg && !is_terminal_graphic(cell.c),
+            !is_terminal_graphic(cell.c),
             content.theme_foreground,
             content.theme_background,
         );
diff --git a/nebula_app/src/display/keymap.rs b/nebula_app/src/display/keymap.rs
index eb28627..80679e3 100644
--- a/nebula_app/src/display/keymap.rs
+++ b/nebula_app/src/display/keymap.rs
@@ -105,6 +105,59 @@ fn cached_defaults() -> &'static [KeyBinding] {
     DEFAULTS.get_or_init(default_key_bindings)
 }
 
+pub(crate) fn default_shortcuts() -> Vec<(String, Action)> {
+    cached_defaults()
+        .iter()
+        .filter_map(|binding| {
+            display_combo(binding.mods, &binding.trigger)
+                .map(|combo| (combo, binding.action.clone()))
+        })
+        .collect()
+}
+
+/// Preserve the existing keybind format: ReceiveChar explicitly passes a key
+/// to the terminal. Clearing an action disables its defaults and its custom key.
+pub(crate) fn clear_action(raw: &mut Vec<(String, String)>, action: &Action) {
+    let mut combos: Vec<String> = default_shortcuts()
+        .into_iter()
+        .filter(|(_, candidate)| candidate == action)
+        .map(|(combo, _)| combo)
+        .collect();
+    combos.extend(
+        raw.iter()
+            .filter(|(_, name)| parse_action(name).as_ref() == Some(action))
+            .map(|(combo, _)| combo.clone()),
+    );
+    raw.retain(|(_, name)| parse_action(name).as_ref() != Some(action));
+    for combo in combos {
+        let key = parse_combo(&combo);
+        if raw
+            .iter()
+            .rev()
+            .find(|(candidate, _)| parse_combo(candidate) == key)
+            .is_some_and(|(_, name)| parse_action(name) != Some(Action::ReceiveChar))
+        {
+            continue;
+        }
+        raw.retain(|(candidate, name)| {
+            parse_combo(candidate) != key || parse_action(name) != Some(Action::ReceiveChar)
+        });
+        raw.push((combo, "ReceiveChar".into()));
+    }
+}
+
+pub(crate) fn reset_action(raw: &mut Vec<(String, String)>, action: &Action) {
+    let defaults = default_shortcuts();
+    raw.retain(|(combo, name)| {
+        let parsed = parse_action(name);
+        parsed.as_ref() != Some(action)
+            && !(parsed == Some(Action::ReceiveChar)
+                && defaults.iter().any(|(default, candidate)| {
+                    candidate == action && parse_combo(combo) == parse_combo(default)
+                }))
+    });
+}
+
 // ---- combo 文本 ↔ 结构 ----
 
 /// 命名键与存储别名的映射（存储侧统一小写）。
@@ -384,7 +437,7 @@ pub(crate) enum CaptureOutcome {
     Pending,
     /// Esc：取消捕获，不改绑定。
     Cancel,
-    /// 裸 Backspace：删除该动作的自定义绑定（回落默认）。
+    /// Bare Backspace explicitly disables the action's shortcuts.
     ClearCustom,
     /// 得到一个可存储的组合。
     Bind(String),
@@ -521,6 +574,43 @@ pub(crate) fn gpui_mods_prefix(modifiers: &::gpui::Modifiers) -> String {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn clearing_ctrl_k_survives_persistence_and_restore_is_explicit() {
+        use super::*;
+        let action = Action::ToggleShellPicker;
+        let mut raw = vec![("ctrl+alt+k".to_owned(), action_storage_name(&action))];
+        clear_action(&mut raw, &action);
+        let saved = nebula_settings::apply_keybinds("theme=moss\n", &raw);
+        let reloaded = nebula_settings::keybind_pairs_from_text(&saved);
+        assert_eq!(raw, reloaded);
+        let bindings = build_bindings(&reloaded);
+        assert!(effective_combo(&action, &bindings).is_none());
+        for combo in ["ctrl+k", "ctrl+alt+k"] {
+            let (mods, trigger) = parse_combo(combo).unwrap();
+            assert!(bindings.iter().any(|binding| binding.mods == mods
+                && binding.trigger == trigger
+                && binding.action == Action::ReceiveChar));
+        }
+        reset_action(&mut raw, &action);
+        assert!(effective_combo(&action, &build_bindings(&raw)).is_some());
+    }
+
+    #[test]
+    fn clearing_does_not_steal_a_default_reassigned_to_another_action() {
+        use super::*;
+        let mut raw = vec![("ctrl+k".to_owned(), "CreateNewTab".to_owned())];
+        clear_action(&mut raw, &Action::ToggleShellPicker);
+        let (mods, trigger) = parse_combo("ctrl+k").unwrap();
+        let bindings = build_bindings(&raw);
+        assert_eq!(
+            bindings
+                .iter()
+                .find(|binding| binding.mods == mods && binding.trigger == trigger)
+                .unwrap()
+                .action,
+            Action::CreateNewTab
+        );
+    }
     use super::*;
 
     #[test]
diff --git a/nebula_app/src/display/mod.rs b/nebula_app/src/display/mod.rs
index 2fb6908..6e64731 100644
--- a/nebula_app/src/display/mod.rs
+++ b/nebula_app/src/display/mod.rs
@@ -7228,12 +7228,12 @@ impl Display {
         self.keymap_commit();
     }
 
-    /// 捕获态里按 Backspace：删除该动作的自定义绑定，回落内置默认。
+    /// Bare Backspace disables the action, preserving pass-through on reload.
     pub fn keymap_clear_custom(&mut self, row: usize) {
         if row == keymap::QUICK_TERMINAL_ROW {
             self.nebula_keymap_capture = None;
             self.nebula_keymap_capture_preview.clear();
-            self.nebula_quick_terminal_hotkey = keymap::DEFAULT_QUICK_TERMINAL_HOTKEY.to_owned();
+            self.nebula_quick_terminal_hotkey.clear();
             self.nebula_quick_hotkey_error = None;
             self.nebula_quick_hotkey_request = Some(self.nebula_quick_terminal_hotkey.clone());
             self.persist_nebula_settings();
@@ -7242,8 +7242,7 @@ impl Display {
         }
         let action_row = row.saturating_sub(1);
         let Some((action, ..)) = keymap::EDITABLE_ACTIONS.get(action_row) else { return };
-        let name = keymap::action_storage_name(action);
-        self.nebula_keybinds.retain(|(_, a)| !a.eq_ignore_ascii_case(&name));
+        keymap::clear_action(&mut self.nebula_keybinds, action);
         self.keymap_commit();
     }
 
diff --git a/nebula_app/src/display/settings.rs b/nebula_app/src/display/settings.rs
index ebadac8..b46932e 100644
--- a/nebula_app/src/display/settings.rs
+++ b/nebula_app/src/display/settings.rs
@@ -1250,7 +1250,7 @@ struct SettingsGeometry {
     /// Navigation group labels occupy the intentional gaps before connection
     /// and system settings, so the rail never contains unexplained whitespace.
     nav_groups: [(f32, f32, f32, f32); 2],
-    options: [(NebulaTheme, f32, f32, f32, f32); 9],
+    options: [(NebulaTheme, f32, f32, f32, f32); 13],
     /// Live terminal preview card at the top of Appearance: configure →
     /// immediately see (font, size, colors, wallpaper opacity, cursor).
     preview: (f32, f32, f32, f32),
@@ -1521,7 +1521,7 @@ fn settings_geometry(
     let row_h = s(ROW_H);
 
     // Appearance: preview, cards, colors, cursor and interface groups.
-    let card_rows = (9.0f32 / card_columns).ceil();
+    let card_rows = (nebula_settings::ThemeName::BUILTIN.len() as f32 / card_columns).ceil();
     let system_theme_y0 = card_y0 + card_rows * (64.0 + 48.0) + GROUP_ADVANCE;
     let color_y0 = system_theme_y0 + ROW_H + GROUP_ADVANCE;
     // Background-image controls: path, stretch,
@@ -1817,17 +1817,11 @@ fn settings_geometry(
         stacked_rows,
         nav,
         nav_groups,
-        options: [
-            (NebulaTheme::Nebula, card(0.0), card_slot_y(0.0), card_w, card_h),
-            (NebulaTheme::SilverLight, card(1.0), card_slot_y(1.0), card_w, card_h),
-            (NebulaTheme::SteelDark, card(2.0), card_slot_y(2.0), card_w, card_h),
-            (NebulaTheme::LimestoneLight, card(3.0), card_slot_y(3.0), card_w, card_h),
-            (NebulaTheme::CoalDark, card(4.0), card_slot_y(4.0), card_w, card_h),
-            (NebulaTheme::LinenLight, card(5.0), card_slot_y(5.0), card_w, card_h),
-            (NebulaTheme::MossDark, card(6.0), card_slot_y(6.0), card_w, card_h),
-            (NebulaTheme::Nord, card(7.0), card_slot_y(7.0), card_w, card_h),
-            (NebulaTheme::Paper, card(8.0), card_slot_y(8.0), card_w, card_h),
-        ],
+        options: std::array::from_fn(|index| {
+            let name = nebula_settings::ThemeName::BUILTIN[index];
+            let theme = NebulaTheme::from_prompt_name(name.prompt_name()).unwrap();
+            (theme, card(index as f32), card_slot_y(index as f32), card_w, card_h)
+        }),
         preview,
         system_theme: (row_x, at(system_theme_y0), row_w, row_h),
         background: (row_x, at(color_y0), row_w, row_h),
diff --git a/nebula_app/src/display/side_panel/gitignore.rs b/nebula_app/src/display/side_panel/gitignore.rs
new file mode 100644
index 0000000..6d9db4f
--- /dev/null
+++ b/nebula_app/src/display/side_panel/gitignore.rs
@@ -0,0 +1,264 @@
+//! Path-scoped Git ignore edits shared by the file tree adapters.
+
+use std::path::{Path, PathBuf};
+
+// ---- 手动忽略（写 `.gitignore`）----
+
+/// 追加一条忽略规则的结果。区分这两种是因为 UI 要说不同的话：真写进去了要
+/// 报出写的是哪一行，本来就有则什么都没动——把后者说成"已加入"会让用户以为
+/// 文件被改了。
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) enum IgnoreOutcome {
+    Added { entry: String, file: PathBuf },
+    AlreadyPresent { entry: String },
+    Removed { entry: String, file: PathBuf },
+    AlreadyVisible { entry: String },
+}
+
+/// 从 `path` 往上找 Git 仓库根（含 `.git` 的目录）。
+///
+/// 不 spawn `git rev-parse --show-toplevel`：这里的判据只是"有没有 `.git`"，
+/// 走文件系统就够，而这个函数在**构建右键菜单**时同步调用——起一个进程会让
+/// 菜单弹出可感知地慢。`.git` 是目录（普通仓库）或文件（worktree 与 submodule
+/// 的 gitdir 指针）都算。
+pub(crate) fn git_repository_root(path: &Path) -> Option<PathBuf> {
+    // 文件的规则要写进它所在目录的仓库，所以从父目录起步。
+    let start = if path.is_dir() { path } else { path.parent()? };
+    let mut probe = Some(start);
+    while let Some(current) = probe {
+        if current.join(".git").exists() {
+            return Some(current.to_owned());
+        }
+        probe = current.parent();
+    }
+    None
+}
+
+/// 一条 gitignore 规则。
+///
+/// 三个刻意的选择：
+/// - **锚定到仓库根**（前置 `/`）。不锚定的 `foo.txt` 会匹配仓库里**每一个**
+///   同名文件；用户点的是这一个，忽略范围就该只有这一个。
+/// - **目录带尾斜杠**，这样规则只匹配目录，不会连同名文件一起吃掉。
+/// - **转义 glob 元字符**。`a[1].psd` 这种名字（Windows 上完全合法）不转义就
+///   成了字符集，既漏掉本文件、又误伤 `a1.psd`。
+///
+/// 逐段走 [`Component`] 而不是对整个路径做 `replace('\\', "/")`：后者会把
+/// 文件名里的反斜杠（Unix 上合法）也当成分隔符。
+pub(crate) fn gitignore_entry(root: &Path, path: &Path, is_dir: bool) -> Option<String> {
+    use std::path::Component;
+
+    let relative = path.strip_prefix(root).ok()?;
+    let mut segments = Vec::new();
+    for component in relative.components() {
+        match component {
+            Component::Normal(name) => segments.push(escape_gitignore(&name.to_string_lossy())),
+            // `..`、盘符、根目录都不该出现在仓库内的相对路径里。
+            _ => return None,
+        }
+    }
+    if segments.is_empty() {
+        return None; // 仓库根自己不能忽略。
+    }
+    let mut entry = format!("/{}", segments.join("/"));
+    if is_dir {
+        entry.push('/');
+    }
+    Some(entry)
+}
+
+fn escape_gitignore(name: &str) -> String {
+    let mut escaped = String::with_capacity(name.len());
+    for character in name.chars() {
+        if matches!(character, '\\' | '*' | '?' | '[' | ']') {
+            escaped.push('\\');
+        }
+        escaped.push(character);
+    }
+    // gitignore 丢弃行尾空白，除非转义。名字以空格结尾时不转义就等于写错行。
+    if escaped.ends_with(' ') {
+        escaped.pop();
+        escaped.push_str("\\ ");
+    }
+    escaped
+}
+
+/// 把 `path` 追加到所在 Git 仓库根的 `.gitignore`。
+///
+/// 行尾跟随原文件：已有 CRLF 的 `.gitignore` 继续写 CRLF。混行尾会让
+/// `git diff` 把整个文件报成改动（见 hard lessons 里的 CRLF 假 diff 一案），
+/// 而这个功能一次只该动一行。
+pub(crate) fn append_to_gitignore(path: &Path, is_dir: bool) -> Result<IgnoreOutcome, String> {
+    let root = git_repository_root(path).ok_or("这个位置不在 Git 仓库里")?;
+    let entry =
+        gitignore_entry(&root, path, is_dir).ok_or("无法为这条路径生成忽略规则".to_owned())?;
+    let file = root.join(".gitignore");
+    let existing = match std::fs::read_to_string(&file) {
+        Ok(text) => text,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => String::new(),
+        Err(error) => return Err(format!("读 .gitignore 失败：{error}")),
+    };
+    let lines: Vec<_> = existing.lines().collect();
+    if let Some(last) = lines.iter().rposition(|line| line.trim() == entry)
+        && !lines[last + 1..].iter().any(|line| line.starts_with('!'))
+    {
+        return Ok(IgnoreOutcome::AlreadyPresent { entry });
+    }
+    let newline = if existing.contains("\r\n") { "\r\n" } else { "\n" };
+    let mut next = existing;
+    // 末行没有换行符时先补一个，否则新规则会和它拼成一行。
+    if !next.is_empty() && !next.ends_with('\n') {
+        next.push_str(newline);
+    }
+    next.push_str(&entry);
+    next.push_str(newline);
+    crate::atomic_file::write(&file, next.as_bytes())
+        .map_err(|error| format!("写 .gitignore 失败：{error}"))?;
+    Ok(IgnoreOutcome::Added { entry, file })
+}
+
+struct IgnoreRule {
+    source: PathBuf,
+    pattern: String,
+}
+
+fn matching_rule(root: &Path, path: &Path) -> Result<Option<IgnoreRule>, String> {
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+    let relative = path.strip_prefix(root).map_err(|error| error.to_string())?;
+    let mut command = Command::new("git");
+    command
+        .args(["--no-optional-locks", "check-ignore", "-v", "-z", "--stdin"])
+        .current_dir(root)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        command.creation_flags(0x0800_0000);
+    }
+    let mut child = command.spawn().map_err(|error| error.to_string())?;
+    let mut stdin = child.stdin.take().ok_or("git stdin unavailable")?;
+    let relative = relative.to_string_lossy();
+    #[cfg(windows)]
+    let relative = relative.replace('\\', "/");
+    stdin
+        .write_all(relative.as_bytes())
+        .and_then(|_| stdin.write_all(&[0]))
+        .map_err(|error| error.to_string())?;
+    drop(stdin);
+    let output = child.wait_with_output().map_err(|error| error.to_string())?;
+    if !output.status.success() && output.status.code() != Some(1) {
+        return Err(String::from_utf8_lossy(&output.stderr).trim().to_owned());
+    }
+    let parts: Vec<_> = output.stdout.split(|byte| *byte == 0).collect();
+    if parts.len() < 4 || parts[2].is_empty() || parts[2].starts_with(b"!") {
+        return Ok(None);
+    }
+    let source = std::str::from_utf8(parts[0]).map_err(|error| error.to_string())?;
+    let pattern = std::str::from_utf8(parts[2]).map_err(|error| error.to_string())?;
+    Ok(Some(IgnoreRule { source: root.join(source), pattern: pattern.to_owned() }))
+}
+
+/// Remove a path-specific rule where possible. A shared glob or an ignored
+/// ancestor instead gets a narrow exception, keeping sibling paths ignored.
+pub(crate) fn remove_from_gitignore(path: &Path, is_dir: bool) -> Result<IgnoreOutcome, String> {
+    let root = git_repository_root(path).ok_or("This path is outside a Git repository")?;
+    let entry = gitignore_entry(&root, path, is_dir).ok_or("Invalid ignore path")?;
+    if matching_rule(&root, path)?.is_none() {
+        return Ok(IgnoreOutcome::AlreadyVisible { entry });
+    }
+    let mut writes = Vec::<(PathBuf, Option<Vec<u8>>, Vec<u8>)>::new();
+    let result = (|| {
+        for _ in 0..64 {
+            let Some(rule) = matching_rule(&root, path)? else { return Ok(()) };
+            let source_is_repo_ignore = rule.source.starts_with(&root)
+                && rule.source.file_name().is_some_and(|name| name == ".gitignore");
+            let file = if source_is_repo_ignore { rule.source } else { root.join(".gitignore") };
+            // A symlinked ignore file could otherwise edit a different repository.
+            for ancestor in file.ancestors().take_while(|ancestor| *ancestor != root) {
+                if std::fs::symlink_metadata(ancestor)
+                    .is_ok_and(|meta| meta.file_type().is_symlink())
+                {
+                    return Err("Cannot edit a symlinked .gitignore path".to_owned());
+                }
+            }
+            let base = file.parent().ok_or("Invalid .gitignore location")?;
+            let local_entry = gitignore_entry(base, path, is_dir).ok_or("Invalid rule location")?;
+            let previous = match std::fs::read(&file) {
+                Ok(bytes) => Some(bytes),
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+                Err(error) => return Err(error.to_string()),
+            };
+            let existing = std::str::from_utf8(previous.as_deref().unwrap_or_default())
+                .map_err(|error| error.to_string())?;
+            let mut next = existing.to_owned();
+            // Only anchored literal rules describe exactly the clicked path.
+            if source_is_repo_ignore
+                && (rule.pattern == local_entry
+                    || (is_dir && rule.pattern == local_entry.trim_end_matches('/')))
+            {
+                next = existing
+                    .split_inclusive('\n')
+                    .filter(|line| line.trim_end_matches(['\r', '\n']) != rule.pattern)
+                    .collect();
+            } else {
+                let newline = if existing.contains("\r\n") { "\r\n" } else { "\n" };
+                let mut rules = Vec::new();
+                let mut parents: Vec<_> = path
+                    .parent()
+                    .into_iter()
+                    .flat_map(Path::ancestors)
+                    .take_while(|parent| *parent != base)
+                    .collect();
+                parents.reverse();
+                for parent in parents {
+                    if matching_rule(&root, parent)?.is_some() {
+                        let parent_entry =
+                            gitignore_entry(base, parent, true).ok_or("Invalid parent rule")?;
+                        rules.push(format!("!{parent_entry}"));
+                        rules.push(format!("{parent_entry}*"));
+                    }
+                }
+                rules.push(format!("!{local_entry}"));
+                if !next.is_empty() && !next.ends_with('\n') {
+                    next.push_str(newline);
+                }
+                for rule in rules {
+                    next.push_str(&rule);
+                    next.push_str(newline);
+                }
+            }
+            if next == existing {
+                return Err("The ignore rule could not be changed".to_owned());
+            }
+            crate::atomic_file::write(&file, next.as_bytes()).map_err(|error| error.to_string())?;
+            writes.push((file, previous, next.into_bytes()));
+        }
+        Err("Too many overlapping ignore rules".to_owned())
+    })();
+    if let Err(error) = result {
+        for (file, before, written) in writes.into_iter().rev() {
+            // Preserve a concurrent external edit rather than replacing it on rollback.
+            if std::fs::read(&file).ok().as_deref() == Some(written.as_slice()) {
+                match before {
+                    Some(bytes) => {
+                        let _ = crate::atomic_file::write(&file, &bytes);
+                    },
+                    None => {
+                        let _ = std::fs::remove_file(&file);
+                    },
+                }
+            }
+        }
+        return Err(error);
+    }
+    let file =
+        writes.last().map(|(file, _, _)| file.clone()).unwrap_or_else(|| root.join(".gitignore"));
+    Ok(IgnoreOutcome::Removed { entry, file })
+}
+
+#[cfg(test)]
+#[path = "gitignore_tests.rs"]
+mod tests;
diff --git a/nebula_app/src/display/side_panel/gitignore_tests.rs b/nebula_app/src/display/side_panel/gitignore_tests.rs
new file mode 100644
index 0000000..ced9c53
--- /dev/null
+++ b/nebula_app/src/display/side_panel/gitignore_tests.rs
@@ -0,0 +1,82 @@
+use super::*;
+
+fn repository() -> tempfile::TempDir {
+    let directory = tempfile::tempdir().unwrap();
+    assert!(
+        std::process::Command::new("git")
+            .args(["init", "-q"])
+            .arg(directory.path())
+            .status()
+            .unwrap()
+            .success()
+    );
+    directory
+}
+
+fn file(root: &Path, path: &str) -> PathBuf {
+    let path = root.join(path);
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(&path, "fixture").unwrap();
+    path
+}
+
+#[test]
+fn remove_exact_rule_preserves_comments_crlf_and_other_paths() {
+    let repo = repository();
+    let root = repo.path();
+    let path = file(root, "a[1].txt");
+    let other = file(root, "other.txt");
+    let ignore = root.join(".gitignore");
+    std::fs::write(&ignore, "# keep\r\n/a\\[1\\].txt\r\n/other.txt").unwrap();
+    assert!(matching_rule(root, &path).unwrap().is_some());
+    assert!(matches!(remove_from_gitignore(&path, false).unwrap(), IgnoreOutcome::Removed { .. }));
+    assert_eq!(std::fs::read_to_string(ignore).unwrap(), "# keep\r\n/other.txt");
+    assert!(matching_rule(root, &path).unwrap().is_none());
+    assert!(matching_rule(root, &other).unwrap().is_some());
+    assert!(matches!(
+        remove_from_gitignore(&path, false).unwrap(),
+        IgnoreOutcome::AlreadyVisible { .. }
+    ));
+}
+
+#[test]
+fn wildcard_exceptions_and_parent_exceptions_keep_siblings_ignored() {
+    for pattern in ["*.log\n", "/build/\n", "*\n"] {
+        let repo = repository();
+        let root = repo.path();
+        let target = file(root, "build/deep/keep.log");
+        let sibling = file(root, "build/deep/other.log");
+        let cousin = file(root, "build/other.log");
+        std::fs::write(root.join(".gitignore"), pattern).unwrap();
+        remove_from_gitignore(&target, false).unwrap();
+        assert!(matching_rule(root, &target).unwrap().is_none(), "{pattern}");
+        assert!(matching_rule(root, &sibling).unwrap().is_some(), "{pattern}");
+        assert!(matching_rule(root, &cousin).unwrap().is_some(), "{pattern}");
+        assert!(std::fs::read_to_string(root.join(".gitignore")).unwrap().starts_with(pattern));
+    }
+}
+
+#[test]
+fn nested_rules_and_repository_excludes_are_handled_in_the_right_scope() {
+    for source in ["sub/.gitignore", ".git/info/exclude"] {
+        let repo = repository();
+        let root = repo.path();
+        let target = file(root, "sub/keep.log");
+        let sibling = file(root, "sub/other.log");
+        std::fs::write(root.join(source), "*.log\n").unwrap();
+        remove_from_gitignore(&target, false).unwrap();
+        assert!(matching_rule(root, &target).unwrap().is_none());
+        assert!(matching_rule(root, &sibling).unwrap().is_some());
+        assert!(std::fs::read_to_string(root.join(source)).unwrap().starts_with("*.log\n"));
+    }
+}
+
+#[test]
+fn exact_directory_rule_removal_restores_children() {
+    let repo = repository();
+    let root = repo.path();
+    let child = file(root, "build/result.txt");
+    append_to_gitignore(&root.join("build"), true).unwrap();
+    remove_from_gitignore(&root.join("build"), true).unwrap();
+    assert!(matching_rule(root, &child).unwrap().is_none());
+}
diff --git a/nebula_app/src/display/side_panel/mod.rs b/nebula_app/src/display/side_panel/mod.rs
index 1311ec4..2215aa6 100644
--- a/nebula_app/src/display/side_panel/mod.rs
+++ b/nebula_app/src/display/side_panel/mod.rs
@@ -23,6 +23,7 @@ use std::time::{Duration, Instant};
 use unicode_width::UnicodeWidthChar;
 
 mod enumerate;
+mod gitignore;
 mod icons;
 #[cfg(feature = "legacy-shell")]
 mod render;
@@ -34,6 +35,7 @@ mod vcs;
 // 子模块的项一律 `pub(crate)`：本 crate 是 bin，没有下游用户，所以拆分不必
 // 把内部实现抬到 `pub`。glob 转发让 `display::side_panel::X` 这层路径不变。
 pub(crate) use enumerate::*;
+pub(crate) use gitignore::*;
 pub(crate) use icons::*;
 #[cfg(feature = "legacy-shell")]
 pub(crate) use render::*;
@@ -246,18 +248,99 @@ impl FileDrag {
 /// 参数是字符串而不是 `Path`：WSL 行要写的是**来宾**路径（`/home/x`），它在
 /// 宿主上不是一个有效的 `Path`，转一圈只会被 Windows 的路径语义改写。
 pub fn drop_text_for_path(path: &str) -> Option<Vec<u8>> {
-    let mut text = path.to_owned();
-    // Unix permits control characters (including CR/LF) in file names.
-    // Sending those bytes to a PTY could execute input despite the drop
-    // contract explicitly requiring paste-only behaviour.
-    if text.chars().any(char::is_control) {
+    drop_text_for_paths(&[path.to_owned()], PathQuote::CommandPrompt).map(String::into_bytes)
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum PathQuote {
+    CommandPrompt,
+    PowerShell,
+    Posix,
+}
+
+/// Paste-only path arguments. Reject control bytes and CMD expansion rather than
+/// letting filenames become a second command when the user eventually submits.
+pub fn drop_text_for_paths(paths: &[String], shell: PathQuote) -> Option<String> {
+    if paths.is_empty() || paths.len() > 32 {
         return None;
     }
-    if text.contains(char::is_whitespace) {
-        text = format!("\"{text}\"");
+    let mut output = String::new();
+    for path in paths {
+        if path.is_empty() || path.chars().any(char::is_control) {
+            return None;
+        }
+        let safe = path.chars().all(|ch| {
+            ch.is_alphanumeric()
+                || "/._-:".contains(ch)
+                || matches!(shell, PathQuote::CommandPrompt | PathQuote::PowerShell) && ch == '\\'
+        });
+        match shell {
+            PathQuote::CommandPrompt => {
+                if path.contains(['"', '%', '!']) {
+                    return None;
+                }
+                if safe {
+                    output.push_str(path);
+                } else {
+                    output.push('"');
+                    output.push_str(path);
+                    output.push('"');
+                }
+            },
+            PathQuote::PowerShell if !safe => {
+                output.push('\'');
+                output.push_str(&path.replace('\'', "''"));
+                output.push('\'');
+            },
+            PathQuote::Posix if !safe => {
+                output.push('\'');
+                output.push_str(&path.replace('\'', "'\\''"));
+                output.push('\'');
+            },
+            _ => output.push_str(path),
+        }
+        output.push(' ');
+        if output.len() > 64 * 1024 {
+            return None;
+        }
+    }
+    Some(output)
+}
+
+#[cfg(test)]
+mod dropped_path_tests {
+    use super::{PathQuote, drop_text_for_paths};
+
+    #[test]
+    fn paths_are_quoted_for_the_target_shell_without_submitting() {
+        assert_eq!(
+            drop_text_for_paths(&["D:\\研究资料\\a b.txt".into()], PathQuote::PowerShell).unwrap(),
+            "'D:\\研究资料\\a b.txt' "
+        );
+        assert_eq!(
+            drop_text_for_paths(&["/tmp/it's $(touch nope).txt".into()], PathQuote::Posix).unwrap(),
+            "'/tmp/it'\\''s $(touch nope).txt' "
+        );
+        assert_eq!(
+            drop_text_for_paths(
+                &["C:\\a&b.txt".into(), "C:\\two.txt".into()],
+                PathQuote::CommandPrompt
+            )
+            .unwrap(),
+            "\"C:\\a&b.txt\" C:\\two.txt "
+        );
+    }
+
+    #[test]
+    fn unsafe_or_unbounded_path_lists_are_rejected() {
+        for path in ["/tmp/a\ncommand", "/tmp/a\u{1b}[200~", ""] {
+            assert!(drop_text_for_paths(&[path.into()], PathQuote::Posix).is_none());
+        }
+        assert!(
+            drop_text_for_paths(&["C:\\%PATH%.txt".into()], PathQuote::CommandPrompt).is_none()
+        );
+        assert!(drop_text_for_paths(&vec!["a".into(); 33], PathQuote::PowerShell).is_none());
     }
-    text.push(' ');
-    Some(text.into_bytes())
 }
 
 /// WSL 子命令预算。
diff --git a/nebula_app/src/display/side_panel/vcs.rs b/nebula_app/src/display/side_panel/vcs.rs
index ee34448..0f49bf9 100644
--- a/nebula_app/src/display/side_panel/vcs.rs
+++ b/nebula_app/src/display/side_panel/vcs.rs
@@ -242,116 +242,6 @@ pub(crate) fn svn_relative_target(root: &Path, relative: &str) -> Option<PathBuf
     Some(root.join(relative))
 }
 
-// ---- 手动忽略（写 `.gitignore`）----
-
-/// 追加一条忽略规则的结果。区分这两种是因为 UI 要说不同的话：真写进去了要
-/// 报出写的是哪一行，本来就有则什么都没动——把后者说成"已加入"会让用户以为
-/// 文件被改了。
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub(crate) enum IgnoreOutcome {
-    Added { entry: String, file: PathBuf },
-    AlreadyPresent { entry: String },
-}
-
-/// 从 `path` 往上找 Git 仓库根（含 `.git` 的目录）。
-///
-/// 不 spawn `git rev-parse --show-toplevel`：这里的判据只是"有没有 `.git`"，
-/// 走文件系统就够，而这个函数在**构建右键菜单**时同步调用——起一个进程会让
-/// 菜单弹出可感知地慢。`.git` 是目录（普通仓库）或文件（worktree 与 submodule
-/// 的 gitdir 指针）都算。
-pub(crate) fn git_repository_root(path: &Path) -> Option<PathBuf> {
-    // 文件的规则要写进它所在目录的仓库，所以从父目录起步。
-    let start = if path.is_dir() { path } else { path.parent()? };
-    let mut probe = Some(start);
-    while let Some(current) = probe {
-        if current.join(".git").exists() {
-            return Some(current.to_owned());
-        }
-        probe = current.parent();
-    }
-    None
-}
-
-/// 一条 gitignore 规则。
-///
-/// 三个刻意的选择：
-/// - **锚定到仓库根**（前置 `/`）。不锚定的 `foo.txt` 会匹配仓库里**每一个**
-///   同名文件；用户点的是这一个，忽略范围就该只有这一个。
-/// - **目录带尾斜杠**，这样规则只匹配目录，不会连同名文件一起吃掉。
-/// - **转义 glob 元字符**。`a[1].psd` 这种名字（Windows 上完全合法）不转义就
-///   成了字符集，既漏掉本文件、又误伤 `a1.psd`。
-///
-/// 逐段走 [`Component`] 而不是对整个路径做 `replace('\\', "/")`：后者会把
-/// 文件名里的反斜杠（Unix 上合法）也当成分隔符。
-pub(crate) fn gitignore_entry(root: &Path, path: &Path, is_dir: bool) -> Option<String> {
-    use std::path::Component;
-
-    let relative = path.strip_prefix(root).ok()?;
-    let mut segments = Vec::new();
-    for component in relative.components() {
-        match component {
-            Component::Normal(name) => segments.push(escape_gitignore(&name.to_string_lossy())),
-            // `..`、盘符、根目录都不该出现在仓库内的相对路径里。
-            _ => return None,
-        }
-    }
-    if segments.is_empty() {
-        return None; // 仓库根自己不能忽略。
-    }
-    let mut entry = format!("/{}", segments.join("/"));
-    if is_dir {
-        entry.push('/');
-    }
-    Some(entry)
-}
-
-fn escape_gitignore(name: &str) -> String {
-    let mut escaped = String::with_capacity(name.len());
-    for character in name.chars() {
-        if matches!(character, '\\' | '*' | '?' | '[' | ']') {
-            escaped.push('\\');
-        }
-        escaped.push(character);
-    }
-    // gitignore 丢弃行尾空白，除非转义。名字以空格结尾时不转义就等于写错行。
-    if escaped.ends_with(' ') {
-        escaped.pop();
-        escaped.push_str("\\ ");
-    }
-    escaped
-}
-
-/// 把 `path` 追加到所在 Git 仓库根的 `.gitignore`。
-///
-/// 行尾跟随原文件：已有 CRLF 的 `.gitignore` 继续写 CRLF。混行尾会让
-/// `git diff` 把整个文件报成改动（见 hard lessons 里的 CRLF 假 diff 一案），
-/// 而这个功能一次只该动一行。
-pub(crate) fn append_to_gitignore(path: &Path, is_dir: bool) -> Result<IgnoreOutcome, String> {
-    let root = git_repository_root(path).ok_or("这个位置不在 Git 仓库里")?;
-    let entry =
-        gitignore_entry(&root, path, is_dir).ok_or("无法为这条路径生成忽略规则".to_owned())?;
-    let file = root.join(".gitignore");
-    let existing = match std::fs::read_to_string(&file) {
-        Ok(text) => text,
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => String::new(),
-        Err(error) => return Err(format!("读 .gitignore 失败：{error}")),
-    };
-    if existing.lines().any(|line| line.trim() == entry) {
-        return Ok(IgnoreOutcome::AlreadyPresent { entry });
-    }
-    let newline = if existing.contains("\r\n") { "\r\n" } else { "\n" };
-    let mut next = existing;
-    // 末行没有换行符时先补一个，否则新规则会和它拼成一行。
-    if !next.is_empty() && !next.ends_with('\n') {
-        next.push_str(newline);
-    }
-    next.push_str(&entry);
-    next.push_str(newline);
-    crate::atomic_file::write(&file, next.as_bytes())
-        .map_err(|error| format!("写 .gitignore 失败：{error}"))?;
-    Ok(IgnoreOutcome::Added { entry, file })
-}
-
 impl SidePanel {
     // ---- git mutations (add / commit / pull / push) ----
 
diff --git a/nebula_app/src/display/ssh_ui.rs b/nebula_app/src/display/ssh_ui.rs
index 00b7879..c9df9e7 100644
--- a/nebula_app/src/display/ssh_ui.rs
+++ b/nebula_app/src/display/ssh_ui.rs
@@ -122,14 +122,15 @@ pub(crate) fn merge_ssh_hosts(
     pinned: &[String],
     hidden: &[String],
 ) -> Vec<String> {
-    let mut hosts: Vec<_> = saved.iter().filter(|host| !hidden.contains(host)).cloned().collect();
-    for host in crate::ssh::ssh_config_hosts() {
-        if !hidden.contains(&host) && !hosts.contains(&host) {
-            hosts.push(host);
-        }
-    }
-    hosts.sort_by_key(|host| pinned.iter().position(|pinned| pinned == host).unwrap_or(usize::MAX));
-    hosts
+    // This adapter retains the legacy recent/config list. The GPUI host library
+    // supplies managed profiles to the same presentation-independent merge rule.
+    crate::ssh_profiles::merge_host_sources(
+        saved,
+        pinned,
+        hidden,
+        &crate::ssh::ssh_config_hosts(),
+        std::iter::empty(),
+    )
 }
 
 #[derive(Debug)]
diff --git a/nebula_app/src/display/state.rs b/nebula_app/src/display/state.rs
index 8bcd95a..773108d 100644
--- a/nebula_app/src/display/state.rs
+++ b/nebula_app/src/display/state.rs
@@ -67,6 +67,8 @@ pub struct NebulaCompletionItem {
     /// Characters typed into the PTY on acceptance (remainder past what the
     /// user already typed).
     pub insert: String,
+    /// Number of characters immediately before the cursor to replace.
+    pub replace_chars: usize,
     pub kind: NebulaCompletionKind,
 }
 
diff --git a/nebula_app/src/display/suggest_engine.rs b/nebula_app/src/display/suggest_engine.rs
index 768428b..7c5e386 100644
--- a/nebula_app/src/display/suggest_engine.rs
+++ b/nebula_app/src/display/suggest_engine.rs
@@ -448,6 +448,15 @@ pub(crate) fn elide_left(text: &str, max_chars: usize) -> String {
     format!("…{tail}")
 }
 
+/// Preserve the candidate's spelling when a case-insensitive/fuzzy match
+/// changes already-typed text. Only a literal prefix can be appended safely.
+fn popup_edit(line: &str, candidate: &str) -> (usize, String) {
+    match candidate.strip_prefix(line) {
+        Some(suffix) => (0, suffix.to_owned()),
+        None => (line.chars().count(), candidate.to_owned()),
+    }
+}
+
 /// Fill `state.completion_items` for the popup style: the same sources as
 /// the ghost hint (history → directory history → PATH commands → file
 /// system), but keeping several candidates each instead of the first hit.
@@ -471,12 +480,14 @@ fn suggest_collect(sources: &SuggestSources<'_>, state: &mut NebulaPaneState, li
     };
 
     // Whole-line history matches, newest first.
-    for (full, rem) in sources.history.hints(&state.suggest_env.history_scope(), line, 3) {
+    for full in sources.history.search(&state.suggest_env.history_scope(), line, 8) {
+        let (replace_chars, insert) = popup_edit(line, full);
         push(
             &mut items,
             NebulaCompletionItem {
+                replace_chars,
                 label: elide_left(full, LABEL_MAX),
-                insert: rem.to_owned(),
+                insert,
                 kind: NebulaCompletionKind::History,
             },
         );
@@ -492,6 +503,7 @@ fn suggest_collect(sources: &SuggestSources<'_>, state: &mut NebulaPaneState, li
             push(
                 &mut items,
                 NebulaCompletionItem {
+                    replace_chars: 0,
                     label: elide_left(&format!("{token}{rem}"), LABEL_MAX),
                     insert: rem,
                     kind: NebulaCompletionKind::Dir,
@@ -513,14 +525,14 @@ fn suggest_collect(sources: &SuggestSources<'_>, state: &mut NebulaPaneState, li
         for command in nebula_command_hints(commands, line, POPUP_LIMIT) {
             // 精确命令也必须成为可接受项；补一个空格既给用户明确反馈，
             // 又让 Enter 只完成选择而不立刻执行命令。
-            let insert = if command.len() == line.len() {
-                " ".to_owned()
-            } else {
-                command[line.len()..].to_owned()
-            };
+            let (replace_chars, mut insert) = popup_edit(line, command);
+            if command.eq_ignore_ascii_case(line) {
+                insert.push(' ');
+            }
             push(
                 &mut items,
                 NebulaCompletionItem {
+                    replace_chars,
                     label: elide_left(command, LABEL_MAX),
                     insert,
                     kind: NebulaCompletionKind::Command,
@@ -538,6 +550,7 @@ fn suggest_collect(sources: &SuggestSources<'_>, state: &mut NebulaPaneState, li
             push(
                 &mut items,
                 NebulaCompletionItem {
+                    replace_chars: 0,
                     label: elide_left(&format!("{token}{rem}"), LABEL_MAX),
                     insert: rem,
                     kind: if is_dir {
@@ -588,6 +601,7 @@ fn suggest_collect(sources: &SuggestSources<'_>, state: &mut NebulaPaneState, li
                 push(
                     &mut items,
                     NebulaCompletionItem {
+                        replace_chars: 0,
                         label: elide_left(&format!("{token}{insert}"), LABEL_MAX),
                         insert: insert.to_owned(),
                         kind,
diff --git a/nebula_app/src/display/terminal_color.rs b/nebula_app/src/display/terminal_color.rs
index e772549..b715e8e 100644
--- a/nebula_app/src/display/terminal_color.rs
+++ b/nebula_app/src/display/terminal_color.rs
@@ -18,7 +18,7 @@ struct ColorPairKey {
     theme_background: u32,
 }
 
-/// Resolves application-owned colors against the active terminal theme.
+/// Resolves text colors against the actual cell background and active theme.
 ///
 /// The terminal grid keeps the exact PTY colors. Only the draw-time result is
 /// cached, so changing the theme immediately recolors existing scrollback.
@@ -150,7 +150,7 @@ pub(crate) fn is_fixed_color(color: Color, overrides: &Colors) -> bool {
     }
 }
 
-fn ensure_contrast(
+pub(crate) fn ensure_contrast(
     foreground: Rgb,
     background: Rgb,
     theme_foreground: Rgb,
@@ -161,12 +161,20 @@ fn ensure_contrast(
         return foreground;
     }
 
-    let target = if theme_foreground.contrast(*background) >= theme_background.contrast(*background)
-    {
-        theme_foreground
-    } else {
-        theme_background
-    };
+    let mut target =
+        if theme_foreground.contrast(*background) >= theme_background.contrast(*background) {
+            theme_foreground
+        } else {
+            theme_background
+        };
+    // OSC overrides and custom surfaces can make both theme anchors unreadable.
+    // The fallback must itself meet the bound before we interpolate toward it.
+    if target.contrast(*background) < minimum {
+        let black = Rgb::new(0, 0, 0);
+        let white = Rgb::new(255, 255, 255);
+        target =
+            if black.contrast(*background) >= white.contrast(*background) { black } else { white };
+    }
     binary_mix(foreground, target, |candidate| candidate.contrast(*background) >= minimum)
 }
 
@@ -326,4 +334,19 @@ mod tests {
         overrides[NamedColor::Red] = Some(VteRgb { r: 1, g: 2, b: 3 });
         assert!(is_fixed_color(Color::Named(NamedColor::Red), &overrides));
     }
+
+    #[test]
+    fn pale_osc_anchors_cannot_leave_input_unreadable() {
+        let mut resolver = TerminalColorResolver::default();
+        let background = Rgb::new(250, 250, 250);
+        let input = Rgb::new(220, 220, 220);
+        let resolved = resolver.resolve_foreground(
+            input,
+            background,
+            true,
+            Rgb::new(240, 240, 240),
+            Rgb::new(255, 255, 255),
+        );
+        assert!(resolved.contrast(*background) >= FIXED_TEXT_MIN_CONTRAST);
+    }
 }
diff --git a/nebula_app/src/display/terminal_math.rs b/nebula_app/src/display/terminal_math.rs
index ff594ab..875cbc4 100644
--- a/nebula_app/src/display/terminal_math.rs
+++ b/nebula_app/src/display/terminal_math.rs
@@ -4,6 +4,11 @@
 //! scrollback, cursor positions, selections, or copied text. It only replaces
 //! visible delimiter spans during the final paint pass.
 
+#[path = "terminal_math/scan.rs"]
+mod scan;
+pub(crate) use scan::scan_visible;
+use scan::*;
+
 use std::collections::BTreeMap;
 use std::fmt;
 use std::hash::{DefaultHasher, Hash, Hasher};
@@ -90,6 +95,8 @@ const HEIGHT_OVERRUN_TOLERANCE: f32 = 0.12;
 /// are cheap to rebuild and remain bounded by `MathLayoutCache` afterwards.
 pub(crate) struct TerminalMathState {
     cache: MathLayoutCache,
+    layout_resolver: Option<LayoutResolver>,
+    last_scan: Option<(TextGrid, GridScanResult)>,
     projection: LineProjection,
     formulas: BTreeMap<FormulaAnchor, PersistedFormula>,
     persisted_bytes: usize,
@@ -103,6 +110,8 @@ impl Default for TerminalMathState {
     fn default() -> Self {
         Self {
             cache: MathLayoutCache::default(),
+            layout_resolver: None,
+            last_scan: None,
             projection: LineProjection::default(),
             formulas: BTreeMap::new(),
             persisted_bytes: 0,
@@ -133,7 +142,14 @@ impl fmt::Debug for TerminalMathState {
     }
 }
 
+pub(crate) type LayoutResolver =
+    Arc<dyn Fn(Arc<str>, f32, f32, bool) -> Option<Arc<MathLayout>> + Send + Sync>;
+
 impl TerminalMathState {
+    pub(crate) fn set_layout_resolver(&mut self, resolver: LayoutResolver) {
+        self.layout_resolver = Some(resolver);
+    }
+
     pub(crate) fn update_projection(
         &mut self,
         overlays: &[FormulaOverlay],
@@ -221,7 +237,14 @@ impl TerminalMathState {
         active_edit_rows: Option<&std::ops::RangeInclusive<usize>>,
     ) -> Option<FormulaAnchor> {
         let mut completed_pending = false;
-        let scan = scan_grid_result(grid);
+        let scan = match &self.last_scan {
+            Some((previous, scan)) if previous == grid => scan.clone(),
+            _ => {
+                let scan = scan_grid_result(grid);
+                self.last_scan = Some((grid.clone(), scan.clone()));
+                scan
+            },
+        };
         for overlay in scan.overlays {
             // 当前光标所在的逻辑行仍由 CLI 编辑器拥有。这里必须在持久化
             // 之前排除整段换行链，否则公式会先进入缓存，下一帧又覆盖输入。
@@ -422,15 +445,21 @@ impl TerminalMathState {
     fn layout(
         &mut self,
         formula_id: u64,
-        source: &str,
+        source: &Arc<str>,
         pixel_size: f32,
         pixels_per_point: f32,
         display: bool,
-    ) -> Result<&MathLayout, crate::math::MathError> {
+    ) -> Result<Arc<MathLayout>, crate::math::MathError> {
+        if let Some(resolve) = &self.layout_resolver {
+            return resolve(source.clone(), pixel_size, pixels_per_point, display)
+                .ok_or_else(|| crate::math::MathError::new(crate::math::MathErrorKind::Parse, 0));
+        }
         let key = FormulaCacheKey::new(formula_id, pixel_size, pixels_per_point, display);
-        self.cache.get_or_insert_with(key, || {
-            compile_formula(source, display, pixel_size, pixels_per_point, DEFAULT_LIMITS)
-        })
+        self.cache
+            .get_or_insert_with(key, || {
+                compile_formula(source, display, pixel_size, pixels_per_point, DEFAULT_LIMITS)
+            })
+            .map(|layout| Arc::new(layout.clone()))
     }
 }
 
@@ -762,1397 +791,6 @@ impl FormulaBounds {
     }
 }
 
-#[derive(Clone, Debug)]
-struct TextGrid {
-    rows: Vec<Vec<Option<char>>>,
-    wrapped: Vec<bool>,
-    columns: usize,
-    absolute_top: usize,
-    scrolled_out: usize,
-}
-
-impl TextGrid {
-    fn from_term<T>(terminal: &Term<T>, size: &SizeInfo) -> Self {
-        Self::from_term_with_lookback(terminal, size, 0)
-    }
-
-    fn from_term_with_lookback<T>(
-        terminal: &Term<T>,
-        size: &SizeInfo,
-        requested_lookback: usize,
-    ) -> Self {
-        let grid = terminal.grid();
-        // Grid and PTY resizes are committed together while display geometry
-        // updates every drag tick, so the visual viewport can differ from the
-        // grid. Anchor the scan to the renderer's viewport origin and only
-        // cover their shared rectangle, keeping overlay coordinates in the
-        // same space as the rendered cells they are matched against.
-        let origin = terminal.viewport_origin_for(size.screen_lines());
-        let columns = size.columns().min(grid.columns());
-        let screen_lines = size
-            .screen_lines()
-            .min(((grid.bottommost_line() - origin).0.max(0) as usize).saturating_add(1));
-        let scrolled_out = grid.scrolled_out();
-        let history_size = grid.history_size();
-        let available_lookback = (history_size as i64 + origin.0 as i64).max(0) as usize;
-        let lookback = requested_lookback.min(available_lookback);
-        let absolute_top = (scrolled_out as i64 + history_size as i64 + origin.0 as i64
-            - lookback as i64)
-            .max(0) as usize;
-        let row_count = screen_lines.saturating_add(lookback);
-        let mut rows = Vec::with_capacity(row_count);
-        let mut wrapped = Vec::with_capacity(row_count);
-
-        for row in 0..row_count {
-            let line = origin + (row as i32 - lookback as i32);
-            let mut cells = Vec::with_capacity(columns);
-            for column in 0..columns {
-                let cell = &grid[line][Column(column)];
-                let spacer = cell
-                    .flags
-                    .intersects(Flags::WIDE_CHAR_SPACER | Flags::LEADING_WIDE_CHAR_SPACER);
-                cells.push((!spacer).then_some(cell.c));
-            }
-            let is_wrapped =
-                columns > 0 && grid[line][Column(columns - 1)].flags.contains(Flags::WRAPLINE);
-            rows.push(cells);
-            wrapped.push(is_wrapped);
-        }
-
-        Self { rows, wrapped, columns, absolute_top, scrolled_out }
-    }
-
-    #[cfg(test)]
-    fn from_rows(rows: &[&str]) -> Self {
-        let columns = rows.iter().map(|row| row.chars().count()).max().unwrap_or(0);
-        let rows = rows
-            .iter()
-            .map(|row| {
-                let mut cells: Vec<_> = row.chars().map(Some).collect();
-                cells.resize(columns, Some(' '));
-                cells
-            })
-            .collect::<Vec<_>>();
-        let wrapped = vec![false; rows.len()];
-        Self { rows, wrapped, columns, absolute_top: 0, scrolled_out: 0 }
-    }
-
-    fn character(&self, position: GridPosition) -> Option<char> {
-        self.rows.get(position.row)?.get(position.column).copied().flatten()
-    }
-
-    /// Physical rows joined by terminal wrap flags form one editable logical
-    /// line. Suppressing only the cursor cell lets an earlier formula on the
-    /// same prompt line render while the user is still typing after it.
-    fn logical_rows_containing(&self, row: usize) -> Option<std::ops::RangeInclusive<usize>> {
-        if row >= self.rows.len() {
-            return None;
-        }
-        let mut start = row;
-        while start > 0 && self.wrapped.get(start - 1).copied().unwrap_or(false) {
-            start -= 1;
-        }
-        let mut end = row;
-        while end + 1 < self.rows.len() && self.wrapped.get(end).copied().unwrap_or(false) {
-            end += 1;
-        }
-        Some(start..=end)
-    }
-
-    fn starts_with(&self, position: GridPosition, delimiter: &[char]) -> bool {
-        delimiter.iter().enumerate().all(|(offset, expected)| {
-            self.character(GridPosition { row: position.row, column: position.column + offset })
-                == Some(*expected)
-        })
-    }
-
-    fn is_escaped(&self, position: GridPosition) -> bool {
-        let mut column = position.column;
-        let mut slashes = 0usize;
-        while column > 0
-            && self.character(GridPosition { row: position.row, column: column - 1 }) == Some('\\')
-        {
-            slashes += 1;
-            column -= 1;
-        }
-        slashes % 2 == 1
-    }
-
-    fn after(&self, position: GridPosition, width: usize) -> GridPosition {
-        GridPosition { row: position.row, column: position.column + width }
-    }
-
-    fn next(&self, position: GridPosition) -> Option<GridPosition> {
-        if position.column + 1 < self.columns {
-            Some(GridPosition { row: position.row, column: position.column + 1 })
-        } else if position.row + 1 < self.rows.len() {
-            Some(GridPosition { row: position.row + 1, column: 0 })
-        } else {
-            None
-        }
-    }
-
-    fn previous(&self, position: GridPosition) -> Option<GridPosition> {
-        if position.column > 0 {
-            Some(GridPosition { row: position.row, column: position.column - 1 })
-        } else if position.row > 0 {
-            Some(GridPosition { row: position.row - 1, column: self.columns.saturating_sub(1) })
-        } else {
-            None
-        }
-    }
-
-    /// Closing search for **display** delimiters: they own the rows between
-    /// them, so a real newline is part of the formula. Agent TUIs that hard-wrap
-    /// a block formula across rows are recovered by this path.
-    ///
-    /// A **blank row ends the search**. TeX forbids a paragraph break inside
-    /// math mode and Markdown ends a math block at a blank line, so no real
-    /// formula spans one — while `$$` is its own closer, so the scanner cannot
-    /// otherwise tell an opener from a closer whose partner has scrolled off the
-    /// top of the viewport. Without this barrier that orphan closer pairs with
-    /// the *next* block's delimiter and swallows every paragraph and formula in
-    /// between into one giant candidate, which then compiles (prose renders as
-    /// math identifiers) and covers the whole region with one image. Stopping at
-    /// the blank row leaves it unmatched instead, which is what hands it to the
-    /// history reconstruction in [`TerminalMathState::scan_visible_grid`].
-    ///
-    /// One blank row is **not** a paragraph break, though: the *TUI's* one. The
-    /// agent CLIs run the answer through a Markdown renderer that does not know
-    /// `$$`, and two of its rules split a display block with a blank row:
-    ///
-    /// * Claude Code (09-03 screenshot, see
-    ///   `claude_code_display_blocks_from_screenshot_pair_and_compile`): a row
-    ///   holding only `=` is a setext underline, so the row above becomes a
-    ///   heading, the `=` disappears and a blank row is emitted in its place.
-    /// * Codex (`codex-rs/tui/src/markdown_render.rs`, verified in source, not
-    ///   observed): a formula row starting with `- ` / `+ ` / `* ` interrupts
-    ///   the paragraph as a list item (pulldown-cmark `firstpass.rs`,
-    ///   `scan_paragraph_interrupt_no_table`), `start_list` pushes a blank
-    ///   line in front of it and `start_item` renders the marker as `- `
-    ///   with the rest of the block, closer included, indented two cells.
-    ///
-    /// `open` is the opener's position; when it stands alone on its row the
-    /// search may step over such a gap, under four conditions that together
-    /// keep the orphan-closer case above on the pending path:
-    ///
-    /// 1. the block already has content above the gap — an orphan closer is
-    ///    followed by its blank row immediately;
-    /// 2. the gap is a single row — two blank rows are a real section break;
-    /// 3. the row after the gap carries math evidence of its own — prose does
-    ///    not, so the swallowed-paragraph shape stops right there;
-    /// 4. past a gap the closer must stand alone on its row, and lie within
-    ///    [`DISPLAY_BLOCK_GAP_SEARCH_ROWS`] of the opener.
-    fn find_closing(
-        &self,
-        open: GridPosition,
-        mut position: GridPosition,
-        delimiter: &[char],
-    ) -> Option<GridPosition> {
-        let standalone_opener =
-            self.span_is_blank(open.row, position.column, self.columns) && open.row == position.row;
-        let last_row = open.row.saturating_add(DISPLAY_BLOCK_GAP_SEARCH_ROWS);
-        let mut content_rows = 0usize;
-        let mut bridged = false;
-        // 上一行是刚跨过的空行：这一行要先自证是公式，搜索才继续。
-        let mut gap_pending = false;
-        loop {
-            if position.row >= self.rows.len() {
-                return None;
-            }
-            if self.starts_with(position, delimiter)
-                && !self.is_escaped(position)
-                && (!bridged || self.delimiter_owns_row(position, delimiter.len()))
-            {
-                return Some(position);
-            }
-            let previous_row = position.row;
-            position = self.next(position)?;
-            if position.row == previous_row {
-                continue;
-            }
-            if self.span_is_blank(position.row, 0, self.columns) {
-                if !standalone_opener || content_rows == 0 || gap_pending {
-                    return None;
-                }
-                gap_pending = true;
-                bridged = true;
-                continue;
-            }
-            content_rows += 1;
-            if bridged && position.row > last_row {
-                return None;
-            }
-            if gap_pending {
-                gap_pending = false;
-                if !self.row_is_only(position.row, delimiter)
-                    && !self.row_has_math_evidence(position.row)
-                {
-                    return None;
-                }
-            }
-        }
-    }
-
-    /// Whether the delimiter at `position` is the only ink on its row.
-    fn delimiter_owns_row(&self, position: GridPosition, length: usize) -> bool {
-        self.span_is_blank(position.row, 0, position.column)
-            && self.span_is_blank(position.row, position.column + length, self.columns)
-    }
-
-    fn row_text(&self, row: usize) -> String {
-        self.rows.get(row).into_iter().flat_map(|cells| cells.iter().flatten()).collect()
-    }
-
-    /// Whether `row` holds nothing but `delimiter`.
-    fn row_is_only(&self, row: usize, delimiter: &[char]) -> bool {
-        self.row_text(row).trim().chars().eq(delimiter.iter().copied())
-    }
-
-    /// Row-level version of the source test, for rows a bridged search has to
-    /// vouch for on their own. In the Codex shape the row after the gap is a
-    /// list item in the renderer's eyes, so its leading sign is also read as
-    /// the list marker it became: `- 2xy` has no evidence as a whole, but a
-    /// compact operand behind the marker is one, while `- 修复 SSH 重连` (a
-    /// real list item) is not.
-    fn row_has_math_evidence(&self, row: usize) -> bool {
-        let text = self.row_text(row);
-        let text = text.trim();
-        if standard_formula_source(text, true) {
-            return true;
-        }
-        let body = text.trim_start_matches(['-', '+', '*']).trim_start();
-        body.len() != text.len()
-            && (implicit_product_operand(body) || standard_formula_source(body, true))
-    }
-
-    /// Closing search for **inline** delimiters. Inline TeX may cross a
-    /// terminal's physical row only when that row was produced by a soft wrap:
-    /// a real newline still ends the span, so two separate terminal lines can
-    /// never accidentally become one formula.
-    fn find_closing_soft_wrap(
-        &self,
-        mut position: GridPosition,
-        delimiter: &[char],
-    ) -> Option<GridPosition> {
-        loop {
-            if position.row >= self.rows.len() {
-                return None;
-            }
-            if self.starts_with(position, delimiter) && !self.is_escaped(position) {
-                return Some(position);
-            }
-            let previous_row = position.row;
-            position = self.next(position)?;
-            if position.row != previous_row && !self.wrapped[previous_row] {
-                return None;
-            }
-        }
-    }
-
-    /// Closing search with an explicit row budget **and** a frame-wide cell
-    /// budget, for openers that carry no intent of their own. A bare `(` is the
-    /// densest character in ordinary terminal output (code, logs, JSON), and an
-    /// unclosed one would otherwise scan to the end of the grid — once per `(`,
-    /// every frame. Measured on a 50×200 grid of unclosed parens that is a 165×
-    /// regression against the same grid of plain text, so the budget is not
-    /// optional. `spent` is shared by every bare candidate in the frame.
-    fn find_closing_bounded(
-        &self,
-        mut position: GridPosition,
-        rows: usize,
-        spent: &mut usize,
-        mut matcher: impl FnMut(&Self, GridPosition) -> Option<bool>,
-    ) -> Option<GridPosition> {
-        let last_row = position.row.saturating_add(rows);
-        loop {
-            if position.row >= self.rows.len() || position.row > last_row || *spent == 0 {
-                return None;
-            }
-            *spent -= 1;
-            if matcher(self, position)? {
-                return Some(position);
-            }
-            position = self.next(position)?;
-        }
-    }
-
-    fn extract(&self, start: GridPosition, end: GridPosition) -> Option<Box<str>> {
-        let mut output = String::new();
-        let mut position = start;
-        while position < end {
-            if let Some(character) = self.character(position) {
-                output.push(character);
-                if output.len() > DEFAULT_LIMITS.max_source_bytes {
-                    return None;
-                }
-            }
-
-            let previous_row = position.row;
-            position = self.next(position)?;
-            if position.row != previous_row && !self.wrapped[previous_row] {
-                output.push('\n');
-            }
-        }
-        let trimmed = output.trim();
-        (!trimmed.is_empty()).then(|| Box::<str>::from(trimmed))
-    }
-
-    fn span_fingerprint(
-        &self,
-        row: usize,
-        start: usize,
-        end: usize,
-        include_wrap: bool,
-    ) -> Option<u64> {
-        let cells = self.rows.get(row)?.get(start..end)?;
-        let mut hasher = DefaultHasher::new();
-        start.hash(&mut hasher);
-        end.hash(&mut hasher);
-        cells.hash(&mut hasher);
-        if include_wrap {
-            self.wrapped.get(row)?.hash(&mut hasher);
-        }
-        Some(hasher.finish())
-    }
-
-    /// Whether a span currently holds nothing but blanks. TUI redraws clear a
-    /// line before repainting it, so a blank span is treated as a transient
-    /// state rather than proof that a persisted formula is gone.
-    fn span_is_blank(&self, row: usize, start: usize, end: usize) -> bool {
-        self.rows.get(row).and_then(|cells| cells.get(start..end)).is_some_and(|cells| {
-            cells.iter().all(|cell| cell.is_none_or(|character| character == ' '))
-        })
-    }
-
-    /// Columns between the first and last non-blank cell of `row`, or `None`
-    /// for a blank row. Interior gaps are counted as occupied: a formula that
-    /// squeezes its ink between two words of the row above would read as an
-    /// overlap even where the cells are technically empty.
-    fn row_ink_columns(&self, row: usize) -> Option<(usize, usize)> {
-        let cells = self.rows.get(row)?;
-        let occupied = |cell: &Option<char>| cell.is_some_and(|character| character != ' ');
-        let start = cells.iter().position(occupied)?;
-        let end = cells.iter().rposition(occupied)? + 1;
-        Some((start, end))
-    }
-
-    fn spans(&self, start: GridPosition, end: GridPosition) -> Vec<RowSpan> {
-        if start.row == end.row {
-            return vec![RowSpan { row: start.row as i32, start: start.column, end: end.column }];
-        }
-
-        let mut spans = Vec::with_capacity(end.row - start.row + 1);
-        spans.push(RowSpan { row: start.row as i32, start: start.column, end: self.columns });
-        for row in start.row + 1..end.row {
-            spans.push(RowSpan { row: row as i32, start: 0, end: self.columns });
-        }
-        spans.push(RowSpan { row: end.row as i32, start: 0, end: end.column });
-        spans
-    }
-}
-
-impl PartialOrd for GridPosition {
-    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
-        Some(self.cmp(other))
-    }
-}
-
-impl Ord for GridPosition {
-    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        (self.row, self.column).cmp(&(other.row, other.column))
-    }
-}
-
-/// Scan the visible grid and attach renderer-resolved colors/fallback cells.
-#[allow(clippy::too_many_arguments)]
-pub(crate) fn scan_visible<T>(
-    state: &mut TerminalMathState,
-    terminal: &Term<T>,
-    size: &SizeInfo,
-    rendered_cells: &[RenderableCell],
-    filter_reasoning_style: bool,
-    cursor: Option<Point<usize>>,
-    default_foreground: Rgb,
-) -> Vec<FormulaOverlay> {
-    let grid = TextGrid::from_term(terminal, size);
-    let active_edit_rows = cursor.and_then(|cursor| grid.logical_rows_containing(cursor.line));
-    state.synchronize_grid(&grid);
-    if let Some(anchor) = state.scan_visible_grid(&grid, active_edit_rows.as_ref()) {
-        // `extract` counts every terminal cell toward the 16 KiB parser limit.
-        // Deriving the row cap from the current width keeps this rare temporary
-        // grid near 64 KiB of cell data instead of scanning all scrollback.
-        let source_rows = DEFAULT_LIMITS
-            .max_source_bytes
-            .div_ceil(grid.columns.max(1))
-            .saturating_add(4)
-            .min(MAX_HISTORY_FORMULA_ROWS);
-        // A viewport anchor means the pending delimiter is an orphan closer
-        // whose opener sits somewhere above; its depth is unknown, so look
-        // back by the full source budget instead of an exact distance.
-        let lookback = if anchor.row >= grid.absolute_top {
-            source_rows
-        } else {
-            grid.absolute_top - anchor.row
-        };
-        if lookback <= source_rows {
-            let history = TextGrid::from_term_with_lookback(terminal, size, lookback);
-            state.complete_pending_from_history(&history);
-        } else {
-            state.pending_display = None;
-        }
-    }
-
-    let mut overlays: Vec<_> = state
-        .visible_overlays(&grid)
-        .into_iter()
-        .filter(|overlay| {
-            active_edit_rows.as_ref().is_none_or(|rows| !overlay.intersects_rows(rows))
-        })
-        .filter_map(|mut overlay| {
-            overlay.fallback = rendered_cells
-                .iter()
-                .filter(|cell| overlay.contains(cell.point))
-                .cloned()
-                .collect();
-
-            // A non-default background usually belongs to a code block or a
-            // TUI-owned surface. Painting a formula over it would require the
-            // renderer to understand that application's layout, so the common
-            // terminal path deliberately leaves the source untouched.
-            let has_ansi_background = overlay.fallback.iter().any(|cell| cell.bg_alpha > 0.0);
-            if has_ansi_background {
-                return None;
-            }
-
-            overlay.foreground = overlay
-                .fallback
-                .iter()
-                .find(|cell| !cell.character.is_whitespace())
-                .map_or(default_foreground, |cell| cell.fg);
-
-            // Agent TUIs deliberately render chain-of-thought with a dim or
-            // opacity-reduced foreground, while their final answer uses the
-            // normal terminal foreground. Keep reasoning formulas literal:
-            // replacing them with a polished overlay makes internal work look
-            // like part of the answer. Restrict the heuristic to full-screen
-            // TUI callers so a user-coloured formula in an ordinary shell is
-            // never classified as reasoning.
-            if filter_reasoning_style && formula_uses_reasoning_style(&overlay) {
-                return None;
-            }
-
-            apply_layout_hints(&mut overlay, &grid);
-            Some(overlay)
-        })
-        .collect();
-    mark_formula_neighbours(&mut overlays);
-    overlays
-}
-
-/// Whether the source glyphs carry the presentation used by agent reasoning.
-///
-/// Codex and Claude Code mark muted reasoning with SGR DIM. Requiring three
-/// quarters of the source glyphs to agree avoids classifying a final answer as
-/// reasoning because one token happens to be dimmed.
-fn formula_uses_reasoning_style(overlay: &FormulaOverlay) -> bool {
-    let (source_cells, dim_cells) = overlay
-        .fallback
-        .iter()
-        .filter(|cell| !cell.character.is_whitespace())
-        .fold((0usize, 0usize), |(total, dim), cell| {
-            (total + 1, dim + usize::from(cell.flags.contains(Flags::DIM)))
-        });
-    source_cells > 0 && dim_cells * 4 >= source_cells * 3
-}
-
-/// Room the surrounding grid can lend an overlay, decided purely by what its
-/// neighbours hold. A formula's rendered size must not depend on how many rows
-/// and columns its source happened to occupy, so `$$x$$` on one line and the
-/// same source spread over three lines end up with the same budget whenever
-/// the blank space around them allows it. `scan_visible` and the tests share
-/// this one decision so the numbers behind fit and clip always agree.
-fn apply_layout_hints(overlay: &mut FormulaOverlay, grid: &TextGrid) {
-    // Record what the neighbouring rows hold; `prepare_overlays` decides how
-    // much of it is actually in the way once it knows the rendered width.
-    let (Some(first), Some(last)) = (overlay.spans.first(), overlay.spans.last()) else {
-        return;
-    };
-    overlay.neighbours_above = neighbour_rows(grid, first.row, -1, overlay.display);
-    overlay.neighbours_below = neighbour_rows(grid, last.row, 1, overlay.display);
-
-    // Rows that hold nothing right of the source span let a display formula
-    // lay out across the rest of the line, so its rendered size no longer
-    // depends on how many columns the source happened to span. Rows scrolled
-    // out of the viewport cannot be inspected; treating them as blank is safe
-    // because only visible rows can show a horizontal collision.
-    let source_right = overlay.spans.iter().map(|span| span.end).max().unwrap_or(0);
-    overlay.widen_right_to = (overlay.display
-        && overlay.spans.iter().all(|span| match usize::try_from(span.row) {
-            Ok(row) if row < grid.rows.len() => grid.span_is_blank(row, span.end, grid.columns),
-            _ => true,
-        }))
-    .then_some(grid.columns.max(source_right));
-}
-
-/// Mark rows occupied by a *different* formula after all visible overlays have
-/// been collected. The raw terminal row only tells us that text exists; this
-/// second pass preserves the distinction needed by vertical clipping.
-fn mark_formula_neighbours(overlays: &mut [FormulaOverlay]) {
-    let spans: Vec<Vec<(i32, usize, usize)>> = overlays
-        .iter()
-        .map(|overlay| overlay.spans.iter().map(|span| (span.row, span.start, span.end)).collect())
-        .collect();
-    for (index, overlay) in overlays.iter_mut().enumerate() {
-        let Some(first) = overlay.spans.first() else { continue };
-        let Some(last) = overlay.spans.last() else { continue };
-        let source_start = overlay.spans.iter().map(|span| span.start).min().unwrap_or(first.start);
-        let source_end = overlay.spans.iter().map(|span| span.end).max().unwrap_or(last.end);
-
-        for distance in 0..MAX_ABSORBED_BLANK_ROWS {
-            let distance = (distance + 1) as i32;
-            let above = first.row - distance;
-            let below = last.row + distance;
-            overlay.formula_neighbours_above[distance as usize - 1] =
-                spans.iter().enumerate().any(|(other_index, other_spans)| {
-                    other_index != index
-                        && other_spans.iter().any(|&(row, start, end)| {
-                            row == above && start < source_end && end > source_start
-                        })
-                });
-            overlay.formula_neighbours_below[distance as usize - 1] =
-                spans.iter().enumerate().any(|(other_index, other_spans)| {
-                    other_index != index
-                        && other_spans.iter().any(|&(row, start, end)| {
-                            row == below && start < source_end && end > source_start
-                        })
-                });
-        }
-    }
-}
-
-/// Ink columns of the [`MAX_ABSORBED_BLANK_ROWS`] rows starting one step from
-/// `from`, nearest first. Rows outside the viewport read as free for display
-/// math — the clip stops at the viewport edge, so the extra budget cannot
-/// reach anything — and as occupied for inline math, which would otherwise
-/// lift itself off the prose baseline it shares a row with.
-fn neighbour_rows(
-    grid: &TextGrid,
-    from: i32,
-    step: i32,
-    display: bool,
-) -> [Option<(usize, usize)>; MAX_ABSORBED_BLANK_ROWS] {
-    std::array::from_fn(|index| {
-        let row = from + step * (index as i32 + 1);
-        match usize::try_from(row) {
-            Ok(row) if row < grid.rows.len() => grid.row_ink_columns(row),
-            _ => (!display).then_some((0, grid.columns)),
-        }
-    })
-}
-
-#[cfg(test)]
-fn scan_grid(grid: &TextGrid) -> Vec<FormulaOverlay> {
-    scan_grid_result(grid).overlays
-}
-
-/// Test-only mirror of the `scan_visible` tail: scan, then let the neighbours
-/// hand out the same layout budget the real pipeline would.
-#[cfg(test)]
-fn scan_grid_with_hints(grid: &TextGrid) -> Vec<FormulaOverlay> {
-    let mut overlays = scan_grid(grid);
-    for overlay in &mut overlays {
-        apply_layout_hints(overlay, grid);
-    }
-    mark_formula_neighbours(&mut overlays);
-    overlays
-}
-
-struct GridScanResult {
-    overlays: Vec<FormulaOverlay>,
-    unmatched_display: Option<(GridPosition, DisplayDelimiterKind)>,
-}
-
-fn scan_grid_result(grid: &TextGrid) -> GridScanResult {
-    let mut overlays = Vec::new();
-    let mut unmatched_display = None;
-    let mut position = GridPosition { row: 0, column: 0 };
-    // 只有裸定界符消费它：其余四类各自有 O(1) 前置闸。
-    let mut bare_budget = BARE_SEARCH_CELL_BUDGET;
-
-    while position.row < grid.rows.len() && overlays.len() < MAX_VISIBLE_FORMULAS {
-        let (candidate, incomplete_display) =
-            if grid.starts_with(position, &['$', '$']) && !grid.is_escaped(position) {
-                let candidate = find_formula(
-                    grid,
-                    position,
-                    &['$', '$'],
-                    &['$', '$'],
-                    DelimiterKind::DollarDisplay,
-                );
-                (candidate, Some(DisplayDelimiterKind::Dollars))
-            } else if grid.starts_with(position, &['\\', '[']) && !grid.is_escaped(position) {
-                let candidate = find_formula(
-                    grid,
-                    position,
-                    &['\\', '['],
-                    &['\\', ']'],
-                    DelimiterKind::BracketDisplay,
-                );
-                (candidate, Some(DisplayDelimiterKind::Brackets))
-            } else if grid.starts_with(position, &['\\', ']']) && !grid.is_escaped(position) {
-                (None, Some(DisplayDelimiterKind::Brackets))
-            } else if grid.starts_with(position, &['\\', '(']) && !grid.is_escaped(position) {
-                (
-                    find_formula(
-                        grid,
-                        position,
-                        &['\\', '('],
-                        &['\\', ')'],
-                        DelimiterKind::Parenthesized,
-                    ),
-                    None,
-                )
-            } else if grid.character(position) == Some('[') && !grid.is_escaped(position) {
-                (find_bare_bracket_formula(grid, position, &mut bare_budget), None)
-            } else if grid.character(position) == Some('(') && !grid.is_escaped(position) {
-                (find_bare_paren_formula(grid, position, &mut bare_budget), None)
-            } else if grid.character(position) == Some('$') && !grid.is_escaped(position) {
-                (find_dollar_formula(grid, position), None)
-            } else {
-                (None, None)
-            };
-
-        if let Some((overlay, after)) = candidate {
-            overlays.push(overlay);
-            position = after;
-        } else if let Some(next) = grid.next(position) {
-            if let Some(kind) = incomplete_display {
-                unmatched_display = Some((position, kind));
-            }
-            position = next;
-        } else {
-            if let Some(kind) = incomplete_display {
-                unmatched_display = Some((position, kind));
-            }
-            break;
-        }
-    }
-
-    GridScanResult { overlays, unmatched_display }
-}
-
-fn find_formula(
-    grid: &TextGrid,
-    open: GridPosition,
-    opening: &[char],
-    closing: &[char],
-    kind: DelimiterKind,
-) -> Option<(FormulaOverlay, GridPosition)> {
-    let source_start = grid.after(open, opening.len());
-    // A display delimiter owns the rows between it and its closer, so it may
-    // cross a real newline — but only when it *opens* its row the way a block
-    // delimiter does. A `$$` reached in the middle of a line of prose is being
-    // quoted, not opened: an agent echoing back a question about `$$`, or a
-    // sentence that names the delimiter. Letting that one search across real
-    // newlines makes it pair with the *opening* delimiter of the next real
-    // block and swallow every formula in between — the scan resumes after the
-    // match (see `scan_grid_result`), so those rows are never even considered.
-    // Inline delimiters follow the same rule for the same reason: crossing a
-    // hard wrap merges two unrelated terminal lines into one formula.
-    let close = if kind.is_display() && opens_a_block(grid, open) {
-        grid.find_closing(open, source_start, closing)?
-    } else {
-        grid.find_closing_soft_wrap(source_start, closing)?
-    };
-    let after = grid.after(close, closing.len());
-    let source = grid.extract(source_start, close)?;
-    let display = kind.is_display();
-    if !standard_formula_source(&source, display) {
-        return None;
-    }
-    Some((make_overlay(grid, open, after, source, kind), after))
-}
-
-/// Whether a display delimiter opens its row: nothing but blanks — or a
-/// Markdown list marker — precedes it. Agents emit `$$` / `\[` that way even
-/// when they hard-wrap the formula that follows on the same row, while a
-/// sentence that merely mentions the delimiter always has prose in front of it.
-/// The prefix is the whole judgement: requiring a blank *tail* as well would
-/// reject `\[\displaystyle …` wrapped across rows, which is a real shape
-/// (see `screenshot_display_formulas_survive_agent_hard_wraps`). Mirrors the
-/// leading-blank half of the standalone rule [`find_bare_bracket_formula`]
-/// applies to a bare `[` block.
-fn opens_a_block(grid: &TextGrid, open: GridPosition) -> bool {
-    span_is_blank_or_markdown_list_marker(grid, open.row, open.column)
-}
-
-fn find_dollar_formula(
-    grid: &TextGrid,
-    open: GridPosition,
-) -> Option<(FormulaOverlay, GridPosition)> {
-    let source_start = grid.after(open, 1);
-    let first = grid.character(source_start)?;
-    // `$ ` is how every sh-family prompt ends, and `$$` belongs to a display
-    // delimiter. Neither opens an inline formula.
-    if first.is_whitespace() || first == '$' {
-        return None;
-    }
-
-    let mut search = source_start;
-    while let Some(close) = find_inline_dollar_closing(grid, search) {
-        // TeX never puts a space right before the closing `$`, while a shell
-        // line routinely does (`$HOME $USER`). A following identifier
-        // character means this `$` opens the *next* variable rather than
-        // closing ours.
-        let previous = grid.previous(close).and_then(|position| grid.character(position));
-        let next = grid.next(close).and_then(|position| grid.character(position));
-        if previous.is_some_and(char::is_whitespace)
-            || next.is_some_and(|character| character.is_ascii_alphanumeric() || character == '_')
-        {
-            search = grid.after(close, 1);
-            continue;
-        }
-
-        let after = grid.after(close, 1);
-        let source = grid.extract(source_start, close)?;
-        if standard_formula_source(&source, false) {
-            return Some((
-                make_overlay(grid, open, after, source, DelimiterKind::DollarInline),
-                after,
-            ));
-        }
-        search = after;
-    }
-    None
-}
-
-/// Find a single-dollar closer without borrowing either character from a
-/// `$$` display delimiter, and without leaving the logical line: an inline
-/// formula may follow a soft wrap, but a real newline ends it. An unmatched
-/// shell/currency dollar must not reach across rows to consume another one.
-fn find_inline_dollar_closing(grid: &TextGrid, mut position: GridPosition) -> Option<GridPosition> {
-    loop {
-        if position.row >= grid.rows.len() {
-            return None;
-        }
-        if grid.character(position) == Some('$') && !grid.is_escaped(position) {
-            let previous_is_dollar =
-                grid.previous(position).and_then(|previous| grid.character(previous)) == Some('$');
-            let next_is_dollar =
-                grid.next(position).and_then(|next| grid.character(next)) == Some('$');
-            if !previous_is_dollar && !next_is_dollar {
-                return Some(position);
-            }
-        }
-        let previous_row = position.row;
-        position = grid.next(position)?;
-        if position.row != previous_row && !grid.wrapped[previous_row] {
-            return None;
-        }
-    }
-}
-
-/// Markdown-unescaped display block: some AI CLIs run their answer through a
-/// markdown renderer that eats the backslash of `\[` / `\]` / `\,` (they are
-/// markdown punctuation escapes) while `\int`, `\frac` … survive, leaving a
-/// bare `[` block on screen. Bare brackets carry no math intent of their own —
-/// JSON, arrays and `[INFO]` logs all use them — so this form is held to a
-/// stricter shape than `\[`: `[` must start its row and `]` must end its row.
-/// A multi-line block also carries enough presentation intent to accept ordinary
-/// mathematical structure such as `E = mc^2`; the compact one-line form still
-/// requires a known TeX command so `[x^2]` does not turn into an overlay.
-fn find_bare_bracket_formula(
-    grid: &TextGrid,
-    open: GridPosition,
-    budget: &mut usize,
-) -> Option<(FormulaOverlay, GridPosition)> {
-    if !span_is_blank_or_markdown_list_marker(grid, open.row, open.column) {
-        return None;
-    }
-    let source_start = grid.after(open, 1);
-    let multiline = grid.span_is_blank(open.row, open.column + 1, grid.columns);
-    let close = if multiline {
-        // 多行形态：`[` 独占一行，闭合 `]` 也必须独占一行。数学源码里
-        // `[0, 1]` 区间的 `]` 不具备闭合资格，跳过继续找。搜索同样带行
-        // 预算：屏幕底部一个没闭合的 `[` 不该每帧扫到网格末尾。空行按
-        // 与 `find_closing` 同一条理由收尾（数学模式里没有分段），否则一个
-        // 没闭合的 `[` 会把下面一整段正文连同它自己的公式吞成一条候选——
-        // 也按同一套条件放行 TUI 塞进来的那一行空行：吃掉 `\[` 的正是
-        // 这个 Markdown 渲染器，它切开 `$$` 块的手法在这里一模一样。
-        let mut content_rows = 0usize;
-        let mut gap_pending = false;
-        grid.find_closing_bounded(
-            source_start,
-            BARE_BRACKET_SEARCH_ROWS,
-            budget,
-            |grid, position| {
-                if position.column == 0 && position.row > open.row {
-                    if grid.span_is_blank(position.row, 0, grid.columns) {
-                        if content_rows == 0 || gap_pending {
-                            return None;
-                        }
-                        gap_pending = true;
-                        return Some(false);
-                    }
-                    content_rows += 1;
-                    if std::mem::take(&mut gap_pending)
-                        && !grid.row_is_only(position.row, &[']'])
-                        && !grid.row_has_math_evidence(position.row)
-                    {
-                        return None;
-                    }
-                }
-                if grid.character(position) != Some(']') || grid.is_escaped(position) {
-                    return Some(false);
-                }
-                Some(grid.delimiter_owns_row(position, 1))
-            },
-        )?
-    } else {
-        // 单行形态 `[ … ]`：闭合必须是本行最后一个非空白字符。
-        let cells = grid.rows.get(open.row)?;
-        let last = cells.iter().rposition(|cell| cell.is_some_and(|c| c != ' '))?;
-        let close = GridPosition { row: open.row, column: last };
-        if last <= open.column || grid.character(close) != Some(']') {
-            return None;
-        }
-        close
-    };
-    let after = grid.after(close, 1);
-    let source = grid.extract(source_start, close)?;
-    if !bare_formula_source(&source, true) {
-        return None;
-    }
-    Some((make_overlay(grid, open, after, source, DelimiterKind::BareBracketDisplay), after))
-}
-
-/// Codex-style Markdown renderers retain the list bullet while unescaping
-/// `\[` / `\]`, yielding `• [` followed by TeX and an indented `]`. A list
-/// marker is presentation-only, so it may precede an otherwise standalone
-/// opening bracket. Other prefixes still reject the candidate (JSON, logs,
-/// shell prompts, and prose remain literal).
-fn span_is_blank_or_markdown_list_marker(grid: &TextGrid, row: usize, end: usize) -> bool {
-    if grid.span_is_blank(row, 0, end) {
-        return true;
-    }
-    let marker: String =
-        grid.rows.get(row).into_iter().flat_map(|cells| cells.iter().take(end).flatten()).collect();
-    matches!(marker.trim(), "•" | "-" | "*" | "+")
-}
-
-/// Markdown-unescaped inline formula: `\( … \)` stripped down to bare
-/// parentheses. Bare parens are prose punctuation, so a known TeX command
-/// (`(\sqrt{…})`) is normally required. Codex may also strip the delimiters
-/// around a compact equation such as `(E=mc^2)`; that narrow mathematical
-/// shape qualifies while regexes and ordinary prose remain literal. The closer
-/// is matched by paren depth so `(\sin(x))` keeps its inner `)`.
-fn find_bare_paren_formula(
-    grid: &TextGrid,
-    open: GridPosition,
-    budget: &mut usize,
-) -> Option<(FormulaOverlay, GridPosition)> {
-    let source_start = grid.after(open, 1);
-    let mut depth = 1usize;
-    let close = grid.find_closing_bounded(
-        source_start,
-        BARE_PAREN_SEARCH_ROWS,
-        budget,
-        |grid, position| {
-            match grid.character(position) {
-                Some('(') if !grid.is_escaped(position) => depth += 1,
-                Some(')') if !grid.is_escaped(position) => {
-                    depth -= 1;
-                    return Some(depth == 0);
-                },
-                _ => {},
-            }
-            Some(false)
-        },
-    )?;
-    let after = grid.after(close, 1);
-    let source = grid.extract(source_start, close)?;
-    if !bare_formula_source(&source, false) {
-        return None;
-    }
-    Some((make_overlay(grid, open, after, source, DelimiterKind::BareParenInline), after))
-}
-
-/// Strict compact-equation fallback for delimiters whose surrounding context
-/// may not yet identify an AI client. Requiring an equality plus an
-/// arithmetic/exponent marker or a short implicit product avoids rendering
-/// configuration prose such as `key=value`.
-fn looks_like_compact_equation(source: &str) -> bool {
-    let source = compact_equation_source(source);
-    let compact_syntax = source.chars().all(|character| {
-        character.is_ascii_alphanumeric()
-            || character.is_ascii_whitespace()
-            || matches!(
-                character,
-                '=' | '+' | '-' | '*' | '/' | '^' | '_' | '{' | '}' | '(' | ')' | '.' | ','
-            )
-    });
-    if !compact_syntax {
-        return false;
-    }
-
-    let Some((left, right)) = source.split_once('=') else {
-        return false;
-    };
-    if right.contains('=') {
-        return false;
-    }
-
-    source.chars().any(|character| {
-        character.is_ascii_digit() || matches!(character, '+' | '-' | '*' | '/' | '^' | '_')
-    }) || looks_like_implicit_product_equation(left, right)
-}
-
-fn compact_equation_source(source: &str) -> &str {
-    let source = source.trim();
-    // Presentation commands do not change whether the following source is a
-    // compact equation. Markdown renderers may leave this command inside bare
-    // parentheses after consuming the original `\(` / `\)` delimiters.
-    source.strip_prefix(r"\displaystyle").map(str::trim_start).unwrap_or(source)
-}
-
-/// Recognize compact equations whose multiplication signs are conventionally
-/// omitted, such as `F=ma` and `PV=nRT`. Requiring short identifiers plus a
-/// single-symbol or uppercase variable keeps configuration prose like
-/// `key=value` outside the formula path.
-fn looks_like_implicit_product_equation(left: &str, right: &str) -> bool {
-    fn compact_identifier(source: &str) -> Option<(usize, bool)> {
-        let source = source.trim();
-        let count = source.chars().count();
-        if !(1..=3).contains(&count)
-            || !source.chars().all(|character| character.is_ascii_alphabetic())
-        {
-            return None;
-        }
-        Some((count, source.chars().any(|character| character.is_ascii_uppercase())))
-    }
-
-    let Some((left_count, left_uppercase)) = compact_identifier(left) else {
-        return false;
-    };
-    let Some((right_count, right_uppercase)) = compact_identifier(right) else {
-        return false;
-    };
-
-    left_count == 1 || right_count == 1 || left_uppercase || right_uppercase
-}
-
-/// Commands that justify treating bare delimiters as math. Deliberately a
-/// whitelist instead of "any `\` + letters": regex escapes (`\d`, `\w`), C
-/// escapes and Windows paths all match the loose shape. Single-letter
-/// commands are excluded wholesale by the caller-side length check baked in
-/// here (every entry is ≥2 chars).
-const KNOWN_TEX_COMMANDS: &[&str] = &[
-    "alpha",
-    "approx",
-    "arccos",
-    "arcsin",
-    "arctan",
-    "bar",
-    "begin",
-    "beta",
-    "big",
-    "bigg",
-    "binom",
-    "boldsymbol",
-    "bullet",
-    "cap",
-    "cdot",
-    "cdots",
-    "chi",
-    "circ",
-    "cos",
-    "cosh",
-    "cot",
-    "csc",
-    "cup",
-    "ddot",
-    "ddots",
-    "delta",
-    "det",
-    "dfrac",
-    "div",
-    "dot",
-    "dots",
-    "emptyset",
-    "end",
-    "epsilon",
-    "equiv",
-    "eta",
-    "exists",
-    "exp",
-    "forall",
-    "frac",
-    "gamma",
-    "gcd",
-    "ge",
-    "geq",
-    "gg",
-    "hat",
-    "iff",
-    "iiint",
-    "iint",
-    "implies",
-    "in",
-    "inf",
-    "infty",
-    "int",
-    "iota",
-    "kappa",
-    "lambda",
-    "land",
-    "langle",
-    "lceil",
-    "ldots",
-    "le",
-    "left",
-    "leftarrow",
-    "leftrightarrow",
-    "leq",
-    "lfloor",
-    "lg",
-    "lim",
-    "liminf",
-    "limsup",
-    "ll",
-    "ln",
-    "log",
-    "lor",
-    "mapsto",
-    "mathbb",
-    "mathbf",
-    "mathcal",
-    "mathfrak",
-    "mathit",
-    "mathrm",
-    "mathsf",
-    "max",
-    "min",
-    "mp",
-    "mu",
-    "nabla",
-    "ne",
-    "neg",
-    "neq",
-    "notin",
-    "nu",
-    "odot",
-    "oint",
-    "omega",
-    "ominus",
-    "operatorname",
-    "oplus",
-    "otimes",
-    "overbrace",
-    "overline",
-    "partial",
-    "phi",
-    "pi",
-    "pm",
-    "prod",
-    "propto",
-    "psi",
-    "qquad",
-    "quad",
-    "rangle",
-    "rceil",
-    "rfloor",
-    "rho",
-    "right",
-    "rightarrow",
-    "sec",
-    "sigma",
-    "sim",
-    "simeq",
-    "sin",
-    "sinh",
-    "sqrt",
-    "subset",
-    "subseteq",
-    "sum",
-    "sup",
-    "supset",
-    "supseteq",
-    "tan",
-    "tanh",
-    "tau",
-    "text",
-    "textbf",
-    "textit",
-    "textrm",
-    "theta",
-    "tilde",
-    "times",
-    "to",
-    "underbrace",
-    "underline",
-    "upsilon",
-    "varepsilon",
-    "varnothing",
-    "varphi",
-    "varpi",
-    "varrho",
-    "varsigma",
-    "vartheta",
-    "vec",
-    "vert",
-    "widehat",
-    "widetilde",
-    "xi",
-    "zeta",
-    "Big",
-    "Bigg",
-    "Delta",
-    "Gamma",
-    "Lambda",
-    "Leftarrow",
-    "Leftrightarrow",
-    "Omega",
-    "Phi",
-    "Pi",
-    "Psi",
-    "Rightarrow",
-    "Sigma",
-    "Theta",
-    "Upsilon",
-    "Vert",
-    "Xi",
-];
-
-/// Whether `source` contains at least one whitelisted TeX command. Bare
-/// delimiters have no `\[` / `\(` intent statement backing them, so a real
-/// math command is required as evidence before they may render.
-fn has_known_tex_command(source: &str) -> bool {
-    let mut rest = source;
-    while let Some(index) = rest.find('\\') {
-        rest = &rest[index + 1..];
-        let end = rest.find(|c: char| !c.is_ascii_alphabetic()).unwrap_or(rest.len());
-        if end > 1 && KNOWN_TEX_COMMANDS.contains(&&rest[..end]) {
-            return true;
-        }
-        rest = &rest[end..];
-    }
-    false
-}
-
-/// Delimiters state intent, content supplies evidence.
-///
-/// The intent statement alone is not enough: a terminal is full of dollars that
-/// are shell sigils, prompts and prices, so a scanner that accepts any non-empty
-/// span turns `echo $HOME $USER` into a formula. Display blocks (`$$…$$`,
-/// `\[…\]`) rarely occur outside real math, so lax evidence suffices; inline
-/// `$…$` and `\(…\)` collide with currency, shell variables and BRE capture
-/// groups, so their evidence must be structurally compact.
-fn standard_formula_source(source: &str, display: bool) -> bool {
-    let source = source.trim();
-    !obviously_non_math(source) && has_math_evidence(source, display)
-}
-
-/// Terminal noise that must never render as math regardless of delimiter
-/// strength: comments/URLs (`//`), Windows paths (`:\`), control bytes,
-/// currency amounts, and ALL_CAPS shell variables.
-fn obviously_non_math(source: &str) -> bool {
-    if source.is_empty()
-        || source.contains("//")
-        || source.contains(":\\")
-        || source
-            .chars()
-            .any(|character| character.is_control() && !matches!(character, '\n' | '\t'))
-    {
-        return true;
-    }
-
-    // Currency and shell variables are the dominant terminal use of dollars.
-    let currency = source.chars().all(|character| {
-        character.is_ascii_digit()
-            || character.is_ascii_whitespace()
-            || ".,EURUSDCNYGBPJPY".contains(character)
-    });
-    let shell_identifier = source.chars().all(|character| {
-        character.is_ascii_uppercase() || character.is_ascii_digit() || character == '_'
-    });
-    currency || (shell_identifier && source.chars().count() > 1)
-}
-
-/// At least one structural sign of mathematics. `lax` (display blocks) lifts
-/// the compact-operand requirement on script bases so implicit products like
-/// `mc^2` qualify; inline keeps it so `$foo^bar$` stays literal text.
-fn has_math_evidence(source: &str, lax: bool) -> bool {
-    let chars: Vec<_> = source.chars().collect();
-    let single_variable = chars.len() == 1 && chars[0].is_alphabetic();
-    let tex_command = chars.windows(2).any(|pair| pair[0] == '\\' && pair[1].is_alphabetic());
-    let script = source.find(['^', '_']).is_some_and(|index| {
-        let (base, suffix) = source.split_at(index);
-        let suffix = &suffix[1..];
-        let base_qualifies = if lax { !base.trim().is_empty() } else { explicit_operand(base) };
-        base_qualifies && !suffix.trim().is_empty()
-    });
-    let relation = ["<=", ">=", "!=", "==", "=", "<", ">"].into_iter().any(|operator| {
-        source.find(operator).is_some_and(|index| {
-            relation_operand(&source[..index])
-                && relation_operand(&source[index + operator.len()..])
-        })
-    });
-    // `n!` / `\binom` 的裸写法：阶乘是后缀运算符，本身就是数学证据。
-    let factorial = source
-        .trim_end()
-        .strip_suffix('!')
-        .is_some_and(|base| explicit_operand(base) || implicit_product_operand(base));
-    let structural = script
-        || relation
-        || factorial
-        || source.chars().any(|character| {
-            matches!(
-                character,
-                '±' | '×'
-                    | '÷'
-                    | '√'
-                    | '∑'
-                    | '∏'
-                    | '∫'
-                    | '∞'
-                    | '≈'
-                    | '≠'
-                    | '≤'
-                    | '≥'
-                    | '∂'
-                    | '∇'
-                    | '∈'
-                    | '∉'
-                    | '⊂'
-                    | '⊆'
-                    | '∪'
-                    | '∩'
-                    | '→'
-                    | '↦'
-            )
-        });
-    let known_function = source.split(|character: char| !character.is_alphabetic()).any(|word| {
-        matches!(
-            word.to_ascii_lowercase().as_str(),
-            "sin" | "cos" | "tan" | "log" | "ln" | "exp" | "lim" | "det" | "max" | "min"
-        )
-    });
-    let function_application = source.find('(').is_some_and(|open| {
-        let name = source[..open].trim();
-        let arguments = source[open + 1..].strip_suffix(')').unwrap_or("").trim();
-        name.chars().count() == 1 && name.chars().all(char::is_alphabetic) && !arguments.is_empty()
-    });
-    let parenthesized_variable = source
-        .strip_prefix('(')
-        .and_then(|source| source.strip_suffix(')'))
-        .is_some_and(explicit_operand);
-    let compact_operator = ['+', '-', '*', '/'].into_iter().any(|operator| {
-        source.find(operator).is_some_and(|index| {
-            let (left, right) = source.split_at(index);
-            let right = &right[operator.len_utf8()..];
-            explicit_operand(left) && explicit_operand(right)
-        })
-    });
-
-    single_variable
-        || tex_command
-        || structural
-        || known_function
-        || function_application
-        || parenthesized_variable
-        || compact_operator
-}
-
-/// A single mathematical operand: one variable at most, optionally scripted.
-/// Multi-letter runs are rejected so `$foo^bar$` and `key=value` stay text.
-fn explicit_operand(operand: &str) -> bool {
-    let operand = operand.trim().trim_matches(['(', ')', '[', ']', '{', '}']);
-    if operand.is_empty() || operand.contains(char::is_whitespace) {
-        return false;
-    }
-    let alphabetic = operand.chars().filter(|character| character.is_alphabetic()).count();
-    alphabetic <= 1
-        && operand.chars().all(|character| {
-            character.is_alphanumeric() || matches!(character, '.' | ',' | '\\' | '^' | '_')
-        })
-}
-
-/// Physics writes products without a multiplication sign: `mc^2`, `nRT`, `ma`.
-/// [`explicit_operand`] caps identifiers at one letter and therefore rejects
-/// every one of them, which is why `$E=mc^2$` used to stay literal. Allow up to
-/// three letters here — still no whitespace and no punctuation beyond scripts,
-/// so `PATH=/tmp` (slash), `key=value` (five letters) and `npm install`
-/// (whitespace) remain outside the formula path.
-fn implicit_product_operand(operand: &str) -> bool {
-    let operand = operand.trim().trim_matches(['(', ')', '[', ']', '{', '}']);
-    if operand.is_empty() || operand.contains(char::is_whitespace) {
-        return false;
-    }
-    let alphabetic = operand.chars().filter(|character| character.is_alphabetic()).count();
-    (1..=3).contains(&alphabetic)
-        && operand
-            .chars()
-            .all(|character| character.is_alphanumeric() || matches!(character, '^' | '_' | '.'))
-}
-
-/// A relation may also be applied to a function call (`f(x)=0`) or to an
-/// implicit product (`E=mc^2`), neither of which is a single operand.
-fn relation_operand(operand: &str) -> bool {
-    let operand = operand.trim();
-    explicit_operand(operand)
-        || implicit_product_operand(operand)
-        || operand.find('(').is_some_and(|open| {
-            let name = operand[..open].trim();
-            let arguments = operand[open + 1..].strip_suffix(')').unwrap_or("").trim();
-            name.chars().count() == 1
-                && name.chars().all(char::is_alphabetic)
-                && !arguments.is_empty()
-        })
-}
-
-/// A bare bracket or parenthesis has no explicit TeX intent after Markdown has
-/// consumed the delimiter backslashes. Recover it only when the remaining
-/// source still carries TeX/equation evidence, and never reinterpret a Windows
-/// path as a formula merely because it contains a whitelisted command name.
-///
-/// Bare delimiters answer to both layers: the standard evidence above, plus
-/// their own stricter requirement of a known command or a compact equation.
-fn bare_formula_source(source: &str, display: bool) -> bool {
-    standard_formula_source(source, display)
-        && !source.contains(":\\")
-        && (has_known_tex_command(source) || looks_like_compact_equation(source))
-}
-
-fn make_overlay(
-    grid: &TextGrid,
-    open: GridPosition,
-    after: GridPosition,
-    source: Box<str>,
-    kind: DelimiterKind,
-) -> FormulaOverlay {
-    let display = kind.is_display();
-    let mut hasher = DefaultHasher::new();
-    source.hash(&mut hasher);
-    kind.hash(&mut hasher);
-    grid.absolute_top.saturating_add(open.row).hash(&mut hasher);
-    open.column.hash(&mut hasher);
-    let formula_id = hasher.finish();
-    FormulaOverlay {
-        source: Arc::from(source),
-        display,
-        formula_id,
-        spans: grid.spans(open, after),
-        foreground: Rgb::default(),
-        fallback: Vec::new(),
-        neighbours_above: [NEIGHBOUR_UNKNOWN; MAX_ABSORBED_BLANK_ROWS],
-        neighbours_below: [NEIGHBOUR_UNKNOWN; MAX_ABSORBED_BLANK_ROWS],
-        formula_neighbours_above: [false; MAX_ABSORBED_BLANK_ROWS],
-        formula_neighbours_below: [false; MAX_ABSORBED_BLANK_ROWS],
-        widen_right_to: None,
-    }
-}
-
 /// A formula that passed layout pre-flight: the grid pass omits its source
 /// cells and [`draw_overlays`] paints the compiled layout in their place.
 /// Every geometric decision is taken here, so the fit and the clip can never
diff --git a/nebula_app/src/display/terminal_math/scan.rs b/nebula_app/src/display/terminal_math/scan.rs
new file mode 100644
index 0000000..63caeab
--- /dev/null
+++ b/nebula_app/src/display/terminal_math/scan.rs
@@ -0,0 +1,1405 @@
+//! Terminal-grid recognition and bounded delimiter searches.
+
+use super::*;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct TextGrid {
+    pub(super) rows: Vec<Vec<Option<char>>>,
+    pub(super) wrapped: Vec<bool>,
+    pub(super) columns: usize,
+    pub(super) absolute_top: usize,
+    pub(super) scrolled_out: usize,
+}
+
+impl TextGrid {
+    pub(super) fn from_term<T>(terminal: &Term<T>, size: &SizeInfo) -> Self {
+        Self::from_term_with_lookback(terminal, size, 0)
+    }
+
+    pub(super) fn from_term_with_lookback<T>(
+        terminal: &Term<T>,
+        size: &SizeInfo,
+        requested_lookback: usize,
+    ) -> Self {
+        let grid = terminal.grid();
+        // Grid and PTY resizes are committed together while display geometry
+        // updates every drag tick, so the visual viewport can differ from the
+        // grid. Anchor the scan to the renderer's viewport origin and only
+        // cover their shared rectangle, keeping overlay coordinates in the
+        // same space as the rendered cells they are matched against.
+        let origin = terminal.viewport_origin_for(size.screen_lines());
+        let columns = size.columns().min(grid.columns());
+        let screen_lines = size
+            .screen_lines()
+            .min(((grid.bottommost_line() - origin).0.max(0) as usize).saturating_add(1));
+        let scrolled_out = grid.scrolled_out();
+        let history_size = grid.history_size();
+        let available_lookback = (history_size as i64 + origin.0 as i64).max(0) as usize;
+        let lookback = requested_lookback.min(available_lookback);
+        let absolute_top = (scrolled_out as i64 + history_size as i64 + origin.0 as i64
+            - lookback as i64)
+            .max(0) as usize;
+        let row_count = screen_lines.saturating_add(lookback);
+        let mut rows = Vec::with_capacity(row_count);
+        let mut wrapped = Vec::with_capacity(row_count);
+
+        for row in 0..row_count {
+            let line = origin + (row as i32 - lookback as i32);
+            let mut cells = Vec::with_capacity(columns);
+            for column in 0..columns {
+                let cell = &grid[line][Column(column)];
+                let spacer = cell
+                    .flags
+                    .intersects(Flags::WIDE_CHAR_SPACER | Flags::LEADING_WIDE_CHAR_SPACER);
+                cells.push((!spacer).then_some(cell.c));
+            }
+            let is_wrapped =
+                columns > 0 && grid[line][Column(columns - 1)].flags.contains(Flags::WRAPLINE);
+            rows.push(cells);
+            wrapped.push(is_wrapped);
+        }
+
+        Self { rows, wrapped, columns, absolute_top, scrolled_out }
+    }
+
+    #[cfg(test)]
+    pub(super) fn from_rows(rows: &[&str]) -> Self {
+        let columns = rows.iter().map(|row| row.chars().count()).max().unwrap_or(0);
+        let rows = rows
+            .iter()
+            .map(|row| {
+                let mut cells: Vec<_> = row.chars().map(Some).collect();
+                cells.resize(columns, Some(' '));
+                cells
+            })
+            .collect::<Vec<_>>();
+        let wrapped = vec![false; rows.len()];
+        Self { rows, wrapped, columns, absolute_top: 0, scrolled_out: 0 }
+    }
+
+    pub(super) fn character(&self, position: GridPosition) -> Option<char> {
+        self.rows.get(position.row)?.get(position.column).copied().flatten()
+    }
+
+    /// Physical rows joined by terminal wrap flags form one editable logical
+    /// line. Suppressing only the cursor cell lets an earlier formula on the
+    /// same prompt line render while the user is still typing after it.
+    pub(super) fn logical_rows_containing(
+        &self,
+        row: usize,
+    ) -> Option<std::ops::RangeInclusive<usize>> {
+        if row >= self.rows.len() {
+            return None;
+        }
+        let mut start = row;
+        while start > 0 && self.wrapped.get(start - 1).copied().unwrap_or(false) {
+            start -= 1;
+        }
+        let mut end = row;
+        while end + 1 < self.rows.len() && self.wrapped.get(end).copied().unwrap_or(false) {
+            end += 1;
+        }
+        Some(start..=end)
+    }
+
+    pub(super) fn starts_with(&self, position: GridPosition, delimiter: &[char]) -> bool {
+        delimiter.iter().enumerate().all(|(offset, expected)| {
+            self.character(GridPosition { row: position.row, column: position.column + offset })
+                == Some(*expected)
+        })
+    }
+
+    pub(super) fn is_escaped(&self, position: GridPosition) -> bool {
+        let mut column = position.column;
+        let mut slashes = 0usize;
+        while column > 0
+            && self.character(GridPosition { row: position.row, column: column - 1 }) == Some('\\')
+        {
+            slashes += 1;
+            column -= 1;
+        }
+        slashes % 2 == 1
+    }
+
+    pub(super) fn after(&self, position: GridPosition, width: usize) -> GridPosition {
+        GridPosition { row: position.row, column: position.column + width }
+    }
+
+    pub(super) fn next(&self, position: GridPosition) -> Option<GridPosition> {
+        if position.column + 1 < self.columns {
+            Some(GridPosition { row: position.row, column: position.column + 1 })
+        } else if position.row + 1 < self.rows.len() {
+            Some(GridPosition { row: position.row + 1, column: 0 })
+        } else {
+            None
+        }
+    }
+
+    pub(super) fn previous(&self, position: GridPosition) -> Option<GridPosition> {
+        if position.column > 0 {
+            Some(GridPosition { row: position.row, column: position.column - 1 })
+        } else if position.row > 0 {
+            Some(GridPosition { row: position.row - 1, column: self.columns.saturating_sub(1) })
+        } else {
+            None
+        }
+    }
+
+    /// Closing search for **display** delimiters: they own the rows between
+    /// them, so a real newline is part of the formula. Agent TUIs that hard-wrap
+    /// a block formula across rows are recovered by this path.
+    ///
+    /// A **blank row ends the search**. TeX forbids a paragraph break inside
+    /// math mode and Markdown ends a math block at a blank line, so no real
+    /// formula spans one — while `$$` is its own closer, so the scanner cannot
+    /// otherwise tell an opener from a closer whose partner has scrolled off the
+    /// top of the viewport. Without this barrier that orphan closer pairs with
+    /// the *next* block's delimiter and swallows every paragraph and formula in
+    /// between into one giant candidate, which then compiles (prose renders as
+    /// math identifiers) and covers the whole region with one image. Stopping at
+    /// the blank row leaves it unmatched instead, which is what hands it to the
+    /// history reconstruction in [`TerminalMathState::scan_visible_grid`].
+    ///
+    /// One blank row is **not** a paragraph break, though: the *TUI's* one. The
+    /// agent CLIs run the answer through a Markdown renderer that does not know
+    /// `$$`, and two of its rules split a display block with a blank row:
+    ///
+    /// * Claude Code (09-03 screenshot, see
+    ///   `claude_code_display_blocks_from_screenshot_pair_and_compile`): a row
+    ///   holding only `=` is a setext underline, so the row above becomes a
+    ///   heading, the `=` disappears and a blank row is emitted in its place.
+    /// * Codex (`codex-rs/tui/src/markdown_render.rs`, verified in source, not
+    ///   observed): a formula row starting with `- ` / `+ ` / `* ` interrupts
+    ///   the paragraph as a list item (pulldown-cmark `firstpass.rs`,
+    ///   `scan_paragraph_interrupt_no_table`), `start_list` pushes a blank
+    ///   line in front of it and `start_item` renders the marker as `- `
+    ///   with the rest of the block, closer included, indented two cells.
+    ///
+    /// `open` is the opener's position; when it stands alone on its row the
+    /// search may step over such a gap, under four conditions that together
+    /// keep the orphan-closer case above on the pending path:
+    ///
+    /// 1. the block already has content above the gap — an orphan closer is
+    ///    followed by its blank row immediately;
+    /// 2. the gap is a single row — two blank rows are a real section break;
+    /// 3. the row after the gap carries math evidence of its own — prose does
+    ///    not, so the swallowed-paragraph shape stops right there;
+    /// 4. past a gap the closer must stand alone on its row, and lie within
+    ///    [`DISPLAY_BLOCK_GAP_SEARCH_ROWS`] of the opener.
+    pub(super) fn find_closing(
+        &self,
+        open: GridPosition,
+        mut position: GridPosition,
+        delimiter: &[char],
+    ) -> Option<GridPosition> {
+        let standalone_opener =
+            self.span_is_blank(open.row, position.column, self.columns) && open.row == position.row;
+        let last_row = open.row.saturating_add(DISPLAY_BLOCK_GAP_SEARCH_ROWS);
+        let mut content_rows = 0usize;
+        let mut bridged = false;
+        // 上一行是刚跨过的空行：这一行要先自证是公式，搜索才继续。
+        let mut gap_pending = false;
+        loop {
+            if position.row >= self.rows.len() {
+                return None;
+            }
+            if self.starts_with(position, delimiter)
+                && !self.is_escaped(position)
+                && (!bridged || self.delimiter_owns_row(position, delimiter.len()))
+            {
+                return Some(position);
+            }
+            let previous_row = position.row;
+            position = self.next(position)?;
+            if position.row == previous_row {
+                continue;
+            }
+            if self.span_is_blank(position.row, 0, self.columns) {
+                if !standalone_opener || content_rows == 0 || gap_pending {
+                    return None;
+                }
+                gap_pending = true;
+                bridged = true;
+                continue;
+            }
+            content_rows += 1;
+            if bridged && position.row > last_row {
+                return None;
+            }
+            if gap_pending {
+                gap_pending = false;
+                if !self.row_is_only(position.row, delimiter)
+                    && !self.row_has_math_evidence(position.row)
+                {
+                    return None;
+                }
+            }
+        }
+    }
+
+    /// Whether the delimiter at `position` is the only ink on its row.
+    pub(super) fn delimiter_owns_row(&self, position: GridPosition, length: usize) -> bool {
+        self.span_is_blank(position.row, 0, position.column)
+            && self.span_is_blank(position.row, position.column + length, self.columns)
+    }
+
+    pub(super) fn row_text(&self, row: usize) -> String {
+        self.rows.get(row).into_iter().flat_map(|cells| cells.iter().flatten()).collect()
+    }
+
+    /// Whether `row` holds nothing but `delimiter`.
+    pub(super) fn row_is_only(&self, row: usize, delimiter: &[char]) -> bool {
+        self.row_text(row).trim().chars().eq(delimiter.iter().copied())
+    }
+
+    /// Row-level version of the source test, for rows a bridged search has to
+    /// vouch for on their own. In the Codex shape the row after the gap is a
+    /// list item in the renderer's eyes, so its leading sign is also read as
+    /// the list marker it became: `- 2xy` has no evidence as a whole, but a
+    /// compact operand behind the marker is one, while `- 修复 SSH 重连` (a
+    /// real list item) is not.
+    pub(super) fn row_has_math_evidence(&self, row: usize) -> bool {
+        let text = self.row_text(row);
+        let text = text.trim();
+        if standard_formula_source(text, true) {
+            return true;
+        }
+        let body = text.trim_start_matches(['-', '+', '*']).trim_start();
+        body.len() != text.len()
+            && (implicit_product_operand(body) || standard_formula_source(body, true))
+    }
+
+    /// Closing search for **inline** delimiters. Inline TeX may cross a
+    /// terminal's physical row only when that row was produced by a soft wrap:
+    /// a real newline still ends the span, so two separate terminal lines can
+    /// never accidentally become one formula.
+    pub(super) fn find_closing_soft_wrap(
+        &self,
+        mut position: GridPosition,
+        delimiter: &[char],
+    ) -> Option<GridPosition> {
+        loop {
+            if position.row >= self.rows.len() {
+                return None;
+            }
+            if self.starts_with(position, delimiter) && !self.is_escaped(position) {
+                return Some(position);
+            }
+            let previous_row = position.row;
+            position = self.next(position)?;
+            if position.row != previous_row && !self.wrapped[previous_row] {
+                return None;
+            }
+        }
+    }
+
+    /// Closing search with an explicit row budget **and** a frame-wide cell
+    /// budget, for openers that carry no intent of their own. A bare `(` is the
+    /// densest character in ordinary terminal output (code, logs, JSON), and an
+    /// unclosed one would otherwise scan to the end of the grid — once per `(`,
+    /// every frame. Measured on a 50×200 grid of unclosed parens that is a 165×
+    /// regression against the same grid of plain text, so the budget is not
+    /// optional. `spent` is shared by every bare candidate in the frame.
+    pub(super) fn find_closing_bounded(
+        &self,
+        mut position: GridPosition,
+        rows: usize,
+        spent: &mut usize,
+        mut matcher: impl FnMut(&Self, GridPosition) -> Option<bool>,
+    ) -> Option<GridPosition> {
+        let last_row = position.row.saturating_add(rows);
+        loop {
+            if position.row >= self.rows.len() || position.row > last_row || *spent == 0 {
+                return None;
+            }
+            *spent -= 1;
+            if matcher(self, position)? {
+                return Some(position);
+            }
+            position = self.next(position)?;
+        }
+    }
+
+    pub(super) fn extract(&self, start: GridPosition, end: GridPosition) -> Option<Box<str>> {
+        let mut output = String::new();
+        let mut position = start;
+        while position < end {
+            if let Some(character) = self.character(position) {
+                output.push(character);
+                if output.len() > DEFAULT_LIMITS.max_source_bytes {
+                    return None;
+                }
+            }
+
+            let previous_row = position.row;
+            position = self.next(position)?;
+            if position.row != previous_row && !self.wrapped[previous_row] {
+                output.push('\n');
+            }
+        }
+        let trimmed = output.trim();
+        (!trimmed.is_empty()).then(|| Box::<str>::from(trimmed))
+    }
+
+    pub(super) fn span_fingerprint(
+        &self,
+        row: usize,
+        start: usize,
+        end: usize,
+        include_wrap: bool,
+    ) -> Option<u64> {
+        let cells = self.rows.get(row)?.get(start..end)?;
+        let mut hasher = DefaultHasher::new();
+        start.hash(&mut hasher);
+        end.hash(&mut hasher);
+        cells.hash(&mut hasher);
+        if include_wrap {
+            self.wrapped.get(row)?.hash(&mut hasher);
+        }
+        Some(hasher.finish())
+    }
+
+    /// Whether a span currently holds nothing but blanks. TUI redraws clear a
+    /// line before repainting it, so a blank span is treated as a transient
+    /// state rather than proof that a persisted formula is gone.
+    pub(super) fn span_is_blank(&self, row: usize, start: usize, end: usize) -> bool {
+        self.rows.get(row).and_then(|cells| cells.get(start..end)).is_some_and(|cells| {
+            cells.iter().all(|cell| cell.is_none_or(|character| character == ' '))
+        })
+    }
+
+    /// Columns between the first and last non-blank cell of `row`, or `None`
+    /// for a blank row. Interior gaps are counted as occupied: a formula that
+    /// squeezes its ink between two words of the row above would read as an
+    /// overlap even where the cells are technically empty.
+    pub(super) fn row_ink_columns(&self, row: usize) -> Option<(usize, usize)> {
+        let cells = self.rows.get(row)?;
+        let occupied = |cell: &Option<char>| cell.is_some_and(|character| character != ' ');
+        let start = cells.iter().position(occupied)?;
+        let end = cells.iter().rposition(occupied)? + 1;
+        Some((start, end))
+    }
+
+    pub(super) fn spans(&self, start: GridPosition, end: GridPosition) -> Vec<RowSpan> {
+        if start.row == end.row {
+            return vec![RowSpan { row: start.row as i32, start: start.column, end: end.column }];
+        }
+
+        let mut spans = Vec::with_capacity(end.row - start.row + 1);
+        spans.push(RowSpan { row: start.row as i32, start: start.column, end: self.columns });
+        for row in start.row + 1..end.row {
+            spans.push(RowSpan { row: row as i32, start: 0, end: self.columns });
+        }
+        spans.push(RowSpan { row: end.row as i32, start: 0, end: end.column });
+        spans
+    }
+}
+
+impl PartialOrd for GridPosition {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for GridPosition {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        (self.row, self.column).cmp(&(other.row, other.column))
+    }
+}
+
+/// Scan the visible grid and attach renderer-resolved colors/fallback cells.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn scan_visible<T>(
+    state: &mut TerminalMathState,
+    terminal: &Term<T>,
+    size: &SizeInfo,
+    rendered_cells: &[RenderableCell],
+    filter_reasoning_style: bool,
+    cursor: Option<Point<usize>>,
+    default_foreground: Rgb,
+) -> Vec<FormulaOverlay> {
+    let grid = TextGrid::from_term(terminal, size);
+    let active_edit_rows = cursor.and_then(|cursor| grid.logical_rows_containing(cursor.line));
+    state.synchronize_grid(&grid);
+    if let Some(anchor) = state.scan_visible_grid(&grid, active_edit_rows.as_ref()) {
+        // `extract` counts every terminal cell toward the 16 KiB parser limit.
+        // Deriving the row cap from the current width keeps this rare temporary
+        // grid near 64 KiB of cell data instead of scanning all scrollback.
+        let source_rows = DEFAULT_LIMITS
+            .max_source_bytes
+            .div_ceil(grid.columns.max(1))
+            .saturating_add(4)
+            .min(MAX_HISTORY_FORMULA_ROWS);
+        // A viewport anchor means the pending delimiter is an orphan closer
+        // whose opener sits somewhere above; its depth is unknown, so look
+        // back by the full source budget instead of an exact distance.
+        let lookback = if anchor.row >= grid.absolute_top {
+            source_rows
+        } else {
+            grid.absolute_top - anchor.row
+        };
+        if lookback <= source_rows {
+            let history = TextGrid::from_term_with_lookback(terminal, size, lookback);
+            state.complete_pending_from_history(&history);
+        } else {
+            state.pending_display = None;
+        }
+    }
+
+    let mut overlays: Vec<_> = state
+        .visible_overlays(&grid)
+        .into_iter()
+        .filter(|overlay| {
+            active_edit_rows.as_ref().is_none_or(|rows| !overlay.intersects_rows(rows))
+        })
+        .filter_map(|mut overlay| {
+            overlay.fallback = rendered_cells
+                .iter()
+                .filter(|cell| overlay.contains(cell.point))
+                .cloned()
+                .collect();
+
+            // A non-default background usually belongs to a code block or a
+            // TUI-owned surface. Painting a formula over it would require the
+            // renderer to understand that application's layout, so the common
+            // terminal path deliberately leaves the source untouched.
+            let has_ansi_background = overlay.fallback.iter().any(|cell| cell.bg_alpha > 0.0);
+            if has_ansi_background {
+                return None;
+            }
+
+            overlay.foreground = overlay
+                .fallback
+                .iter()
+                .find(|cell| !cell.character.is_whitespace())
+                .map_or(default_foreground, |cell| cell.fg);
+
+            // Agent TUIs deliberately render chain-of-thought with a dim or
+            // opacity-reduced foreground, while their final answer uses the
+            // normal terminal foreground. Keep reasoning formulas literal:
+            // replacing them with a polished overlay makes internal work look
+            // like part of the answer. Restrict the heuristic to full-screen
+            // TUI callers so a user-coloured formula in an ordinary shell is
+            // never classified as reasoning.
+            if filter_reasoning_style && formula_uses_reasoning_style(&overlay) {
+                return None;
+            }
+
+            apply_layout_hints(&mut overlay, &grid);
+            Some(overlay)
+        })
+        .collect();
+    mark_formula_neighbours(&mut overlays);
+    overlays
+}
+
+/// Whether the source glyphs carry the presentation used by agent reasoning.
+///
+/// Codex and Claude Code mark muted reasoning with SGR DIM. Requiring three
+/// quarters of the source glyphs to agree avoids classifying a final answer as
+/// reasoning because one token happens to be dimmed.
+pub(super) fn formula_uses_reasoning_style(overlay: &FormulaOverlay) -> bool {
+    let (source_cells, dim_cells) = overlay
+        .fallback
+        .iter()
+        .filter(|cell| !cell.character.is_whitespace())
+        .fold((0usize, 0usize), |(total, dim), cell| {
+            (total + 1, dim + usize::from(cell.flags.contains(Flags::DIM)))
+        });
+    source_cells > 0 && dim_cells * 4 >= source_cells * 3
+}
+
+/// Room the surrounding grid can lend an overlay, decided purely by what its
+/// neighbours hold. A formula's rendered size must not depend on how many rows
+/// and columns its source happened to occupy, so `$$x$$` on one line and the
+/// same source spread over three lines end up with the same budget whenever
+/// the blank space around them allows it. `scan_visible` and the tests share
+/// this one decision so the numbers behind fit and clip always agree.
+pub(super) fn apply_layout_hints(overlay: &mut FormulaOverlay, grid: &TextGrid) {
+    // Record what the neighbouring rows hold; `prepare_overlays` decides how
+    // much of it is actually in the way once it knows the rendered width.
+    let (Some(first), Some(last)) = (overlay.spans.first(), overlay.spans.last()) else {
+        return;
+    };
+    overlay.neighbours_above = neighbour_rows(grid, first.row, -1, overlay.display);
+    overlay.neighbours_below = neighbour_rows(grid, last.row, 1, overlay.display);
+
+    // Rows that hold nothing right of the source span let a display formula
+    // lay out across the rest of the line, so its rendered size no longer
+    // depends on how many columns the source happened to span. Rows scrolled
+    // out of the viewport cannot be inspected; treating them as blank is safe
+    // because only visible rows can show a horizontal collision.
+    let source_right = overlay.spans.iter().map(|span| span.end).max().unwrap_or(0);
+    overlay.widen_right_to = (overlay.display
+        && overlay.spans.iter().all(|span| match usize::try_from(span.row) {
+            Ok(row) if row < grid.rows.len() => grid.span_is_blank(row, span.end, grid.columns),
+            _ => true,
+        }))
+    .then_some(grid.columns.max(source_right));
+}
+
+/// Mark rows occupied by a *different* formula after all visible overlays have
+/// been collected. The raw terminal row only tells us that text exists; this
+/// second pass preserves the distinction needed by vertical clipping.
+pub(super) fn mark_formula_neighbours(overlays: &mut [FormulaOverlay]) {
+    let spans: Vec<Vec<(i32, usize, usize)>> = overlays
+        .iter()
+        .map(|overlay| overlay.spans.iter().map(|span| (span.row, span.start, span.end)).collect())
+        .collect();
+    for (index, overlay) in overlays.iter_mut().enumerate() {
+        let Some(first) = overlay.spans.first() else { continue };
+        let Some(last) = overlay.spans.last() else { continue };
+        let source_start = overlay.spans.iter().map(|span| span.start).min().unwrap_or(first.start);
+        let source_end = overlay.spans.iter().map(|span| span.end).max().unwrap_or(last.end);
+
+        for distance in 0..MAX_ABSORBED_BLANK_ROWS {
+            let distance = (distance + 1) as i32;
+            let above = first.row - distance;
+            let below = last.row + distance;
+            overlay.formula_neighbours_above[distance as usize - 1] =
+                spans.iter().enumerate().any(|(other_index, other_spans)| {
+                    other_index != index
+                        && other_spans.iter().any(|&(row, start, end)| {
+                            row == above && start < source_end && end > source_start
+                        })
+                });
+            overlay.formula_neighbours_below[distance as usize - 1] =
+                spans.iter().enumerate().any(|(other_index, other_spans)| {
+                    other_index != index
+                        && other_spans.iter().any(|&(row, start, end)| {
+                            row == below && start < source_end && end > source_start
+                        })
+                });
+        }
+    }
+}
+
+/// Ink columns of the [`MAX_ABSORBED_BLANK_ROWS`] rows starting one step from
+/// `from`, nearest first. Rows outside the viewport read as free for display
+/// math — the clip stops at the viewport edge, so the extra budget cannot
+/// reach anything — and as occupied for inline math, which would otherwise
+/// lift itself off the prose baseline it shares a row with.
+pub(super) fn neighbour_rows(
+    grid: &TextGrid,
+    from: i32,
+    step: i32,
+    display: bool,
+) -> [Option<(usize, usize)>; MAX_ABSORBED_BLANK_ROWS] {
+    std::array::from_fn(|index| {
+        let row = from + step * (index as i32 + 1);
+        match usize::try_from(row) {
+            Ok(row) if row < grid.rows.len() => grid.row_ink_columns(row),
+            _ => (!display).then_some((0, grid.columns)),
+        }
+    })
+}
+
+#[cfg(test)]
+pub(super) fn scan_grid(grid: &TextGrid) -> Vec<FormulaOverlay> {
+    scan_grid_result(grid).overlays
+}
+
+/// Test-only mirror of the `scan_visible` tail: scan, then let the neighbours
+/// hand out the same layout budget the real pipeline would.
+#[cfg(test)]
+pub(super) fn scan_grid_with_hints(grid: &TextGrid) -> Vec<FormulaOverlay> {
+    let mut overlays = scan_grid(grid);
+    for overlay in &mut overlays {
+        apply_layout_hints(overlay, grid);
+    }
+    mark_formula_neighbours(&mut overlays);
+    overlays
+}
+
+#[derive(Clone)]
+pub(super) struct GridScanResult {
+    pub(super) overlays: Vec<FormulaOverlay>,
+    pub(super) unmatched_display: Option<(GridPosition, DisplayDelimiterKind)>,
+}
+
+pub(super) fn scan_grid_result(grid: &TextGrid) -> GridScanResult {
+    let mut overlays = Vec::new();
+    let mut unmatched_display = None;
+    let mut position = GridPosition { row: 0, column: 0 };
+    // 只有裸定界符消费它：其余四类各自有 O(1) 前置闸。
+    let mut bare_budget = BARE_SEARCH_CELL_BUDGET;
+
+    while position.row < grid.rows.len() && overlays.len() < MAX_VISIBLE_FORMULAS {
+        let (candidate, incomplete_display) =
+            if grid.starts_with(position, &['$', '$']) && !grid.is_escaped(position) {
+                let candidate = find_formula(
+                    grid,
+                    position,
+                    &['$', '$'],
+                    &['$', '$'],
+                    DelimiterKind::DollarDisplay,
+                );
+                (candidate, Some(DisplayDelimiterKind::Dollars))
+            } else if grid.starts_with(position, &['\\', '[']) && !grid.is_escaped(position) {
+                let candidate = find_formula(
+                    grid,
+                    position,
+                    &['\\', '['],
+                    &['\\', ']'],
+                    DelimiterKind::BracketDisplay,
+                );
+                (candidate, Some(DisplayDelimiterKind::Brackets))
+            } else if grid.starts_with(position, &['\\', ']']) && !grid.is_escaped(position) {
+                (None, Some(DisplayDelimiterKind::Brackets))
+            } else if grid.starts_with(position, &['\\', '(']) && !grid.is_escaped(position) {
+                (
+                    find_formula(
+                        grid,
+                        position,
+                        &['\\', '('],
+                        &['\\', ')'],
+                        DelimiterKind::Parenthesized,
+                    ),
+                    None,
+                )
+            } else if grid.character(position) == Some('[') && !grid.is_escaped(position) {
+                (find_bare_bracket_formula(grid, position, &mut bare_budget), None)
+            } else if grid.character(position) == Some('(') && !grid.is_escaped(position) {
+                (find_bare_paren_formula(grid, position, &mut bare_budget), None)
+            } else if grid.character(position) == Some('$') && !grid.is_escaped(position) {
+                (find_dollar_formula(grid, position), None)
+            } else {
+                (None, None)
+            };
+
+        if let Some((overlay, after)) = candidate {
+            overlays.push(overlay);
+            position = after;
+        } else if let Some(next) = grid.next(position) {
+            if let Some(kind) = incomplete_display {
+                unmatched_display = Some((position, kind));
+            }
+            position = next;
+        } else {
+            if let Some(kind) = incomplete_display {
+                unmatched_display = Some((position, kind));
+            }
+            break;
+        }
+    }
+
+    GridScanResult { overlays, unmatched_display }
+}
+
+pub(super) fn find_formula(
+    grid: &TextGrid,
+    open: GridPosition,
+    opening: &[char],
+    closing: &[char],
+    kind: DelimiterKind,
+) -> Option<(FormulaOverlay, GridPosition)> {
+    let source_start = grid.after(open, opening.len());
+    // A display delimiter owns the rows between it and its closer, so it may
+    // cross a real newline — but only when it *opens* its row the way a block
+    // delimiter does. A `$$` reached in the middle of a line of prose is being
+    // quoted, not opened: an agent echoing back a question about `$$`, or a
+    // sentence that names the delimiter. Letting that one search across real
+    // newlines makes it pair with the *opening* delimiter of the next real
+    // block and swallow every formula in between — the scan resumes after the
+    // match (see `scan_grid_result`), so those rows are never even considered.
+    // Inline delimiters follow the same rule for the same reason: crossing a
+    // hard wrap merges two unrelated terminal lines into one formula.
+    let close = if kind.is_display() && opens_a_block(grid, open) {
+        grid.find_closing(open, source_start, closing)?
+    } else {
+        grid.find_closing_soft_wrap(source_start, closing)?
+    };
+    let after = grid.after(close, closing.len());
+    let source = grid.extract(source_start, close)?;
+    let display = kind.is_display();
+    if !standard_formula_source(&source, display) {
+        return None;
+    }
+    Some((make_overlay(grid, open, after, source, kind), after))
+}
+
+/// Whether a display delimiter opens its row: nothing but blanks — or a
+/// Markdown list marker — precedes it. Agents emit `$$` / `\[` that way even
+/// when they hard-wrap the formula that follows on the same row, while a
+/// sentence that merely mentions the delimiter always has prose in front of it.
+/// The prefix is the whole judgement: requiring a blank *tail* as well would
+/// reject `\[\displaystyle …` wrapped across rows, which is a real shape
+/// (see `screenshot_display_formulas_survive_agent_hard_wraps`). Mirrors the
+/// leading-blank half of the standalone rule [`find_bare_bracket_formula`]
+/// applies to a bare `[` block.
+pub(super) fn opens_a_block(grid: &TextGrid, open: GridPosition) -> bool {
+    span_is_blank_or_markdown_list_marker(grid, open.row, open.column)
+}
+
+pub(super) fn find_dollar_formula(
+    grid: &TextGrid,
+    open: GridPosition,
+) -> Option<(FormulaOverlay, GridPosition)> {
+    let source_start = grid.after(open, 1);
+    let first = grid.character(source_start)?;
+    // `$ ` is how every sh-family prompt ends, and `$$` belongs to a display
+    // delimiter. Neither opens an inline formula.
+    if first.is_whitespace() || first == '$' {
+        return None;
+    }
+
+    let mut search = source_start;
+    while let Some(close) = find_inline_dollar_closing(grid, search) {
+        // TeX never puts a space right before the closing `$`, while a shell
+        // line routinely does (`$HOME $USER`). A following identifier
+        // character means this `$` opens the *next* variable rather than
+        // closing ours.
+        let previous = grid.previous(close).and_then(|position| grid.character(position));
+        let next = grid.next(close).and_then(|position| grid.character(position));
+        if previous.is_some_and(char::is_whitespace)
+            || next.is_some_and(|character| character.is_ascii_alphanumeric() || character == '_')
+        {
+            search = grid.after(close, 1);
+            continue;
+        }
+
+        let after = grid.after(close, 1);
+        let source = grid.extract(source_start, close)?;
+        if standard_formula_source(&source, false) {
+            return Some((
+                make_overlay(grid, open, after, source, DelimiterKind::DollarInline),
+                after,
+            ));
+        }
+        search = after;
+    }
+    None
+}
+
+/// Find a single-dollar closer without borrowing either character from a
+/// `$$` display delimiter, and without leaving the logical line: an inline
+/// formula may follow a soft wrap, but a real newline ends it. An unmatched
+/// shell/currency dollar must not reach across rows to consume another one.
+pub(super) fn find_inline_dollar_closing(
+    grid: &TextGrid,
+    mut position: GridPosition,
+) -> Option<GridPosition> {
+    loop {
+        if position.row >= grid.rows.len() {
+            return None;
+        }
+        if grid.character(position) == Some('$') && !grid.is_escaped(position) {
+            let previous_is_dollar =
+                grid.previous(position).and_then(|previous| grid.character(previous)) == Some('$');
+            let next_is_dollar =
+                grid.next(position).and_then(|next| grid.character(next)) == Some('$');
+            if !previous_is_dollar && !next_is_dollar {
+                return Some(position);
+            }
+        }
+        let previous_row = position.row;
+        position = grid.next(position)?;
+        if position.row != previous_row && !grid.wrapped[previous_row] {
+            return None;
+        }
+    }
+}
+
+/// Markdown-unescaped display block: some AI CLIs run their answer through a
+/// markdown renderer that eats the backslash of `\[` / `\]` / `\,` (they are
+/// markdown punctuation escapes) while `\int`, `\frac` … survive, leaving a
+/// bare `[` block on screen. Bare brackets carry no math intent of their own —
+/// JSON, arrays and `[INFO]` logs all use them — so this form is held to a
+/// stricter shape than `\[`: `[` must start its row and `]` must end its row.
+/// A multi-line block also carries enough presentation intent to accept ordinary
+/// mathematical structure such as `E = mc^2`; the compact one-line form still
+/// requires a known TeX command so `[x^2]` does not turn into an overlay.
+pub(super) fn find_bare_bracket_formula(
+    grid: &TextGrid,
+    open: GridPosition,
+    budget: &mut usize,
+) -> Option<(FormulaOverlay, GridPosition)> {
+    if !span_is_blank_or_markdown_list_marker(grid, open.row, open.column) {
+        return None;
+    }
+    let source_start = grid.after(open, 1);
+    let multiline = grid.span_is_blank(open.row, open.column + 1, grid.columns);
+    let close = if multiline {
+        // 多行形态：`[` 独占一行，闭合 `]` 也必须独占一行。数学源码里
+        // `[0, 1]` 区间的 `]` 不具备闭合资格，跳过继续找。搜索同样带行
+        // 预算：屏幕底部一个没闭合的 `[` 不该每帧扫到网格末尾。空行按
+        // 与 `find_closing` 同一条理由收尾（数学模式里没有分段），否则一个
+        // 没闭合的 `[` 会把下面一整段正文连同它自己的公式吞成一条候选——
+        // 也按同一套条件放行 TUI 塞进来的那一行空行：吃掉 `\[` 的正是
+        // 这个 Markdown 渲染器，它切开 `$$` 块的手法在这里一模一样。
+        let mut content_rows = 0usize;
+        let mut gap_pending = false;
+        grid.find_closing_bounded(
+            source_start,
+            BARE_BRACKET_SEARCH_ROWS,
+            budget,
+            |grid, position| {
+                if position.column == 0 && position.row > open.row {
+                    if grid.span_is_blank(position.row, 0, grid.columns) {
+                        if content_rows == 0 || gap_pending {
+                            return None;
+                        }
+                        gap_pending = true;
+                        return Some(false);
+                    }
+                    content_rows += 1;
+                    if std::mem::take(&mut gap_pending)
+                        && !grid.row_is_only(position.row, &[']'])
+                        && !grid.row_has_math_evidence(position.row)
+                    {
+                        return None;
+                    }
+                }
+                if grid.character(position) != Some(']') || grid.is_escaped(position) {
+                    return Some(false);
+                }
+                Some(grid.delimiter_owns_row(position, 1))
+            },
+        )?
+    } else {
+        // 单行形态 `[ … ]`：闭合必须是本行最后一个非空白字符。
+        let cells = grid.rows.get(open.row)?;
+        let last = cells.iter().rposition(|cell| cell.is_some_and(|c| c != ' '))?;
+        let close = GridPosition { row: open.row, column: last };
+        if last <= open.column || grid.character(close) != Some(']') {
+            return None;
+        }
+        close
+    };
+    let after = grid.after(close, 1);
+    let source = grid.extract(source_start, close)?;
+    if !bare_formula_source(&source, true) {
+        return None;
+    }
+    Some((make_overlay(grid, open, after, source, DelimiterKind::BareBracketDisplay), after))
+}
+
+/// Codex-style Markdown renderers retain the list bullet while unescaping
+/// `\[` / `\]`, yielding `• [` followed by TeX and an indented `]`. A list
+/// marker is presentation-only, so it may precede an otherwise standalone
+/// opening bracket. Other prefixes still reject the candidate (JSON, logs,
+/// shell prompts, and prose remain literal).
+pub(super) fn span_is_blank_or_markdown_list_marker(
+    grid: &TextGrid,
+    row: usize,
+    end: usize,
+) -> bool {
+    if grid.span_is_blank(row, 0, end) {
+        return true;
+    }
+    let marker: String =
+        grid.rows.get(row).into_iter().flat_map(|cells| cells.iter().take(end).flatten()).collect();
+    matches!(marker.trim(), "•" | "-" | "*" | "+")
+}
+
+/// Markdown-unescaped inline formula: `\( … \)` stripped down to bare
+/// parentheses. Bare parens are prose punctuation, so a known TeX command
+/// (`(\sqrt{…})`) is normally required. Codex may also strip the delimiters
+/// around a compact equation such as `(E=mc^2)`; that narrow mathematical
+/// shape qualifies while regexes and ordinary prose remain literal. The closer
+/// is matched by paren depth so `(\sin(x))` keeps its inner `)`.
+pub(super) fn find_bare_paren_formula(
+    grid: &TextGrid,
+    open: GridPosition,
+    budget: &mut usize,
+) -> Option<(FormulaOverlay, GridPosition)> {
+    let source_start = grid.after(open, 1);
+    let mut depth = 1usize;
+    let close = grid.find_closing_bounded(
+        source_start,
+        BARE_PAREN_SEARCH_ROWS,
+        budget,
+        |grid, position| {
+            match grid.character(position) {
+                Some('(') if !grid.is_escaped(position) => depth += 1,
+                Some(')') if !grid.is_escaped(position) => {
+                    depth -= 1;
+                    return Some(depth == 0);
+                },
+                _ => {},
+            }
+            Some(false)
+        },
+    )?;
+    let after = grid.after(close, 1);
+    let source = grid.extract(source_start, close)?;
+    if !bare_formula_source(&source, false) {
+        return None;
+    }
+    Some((make_overlay(grid, open, after, source, DelimiterKind::BareParenInline), after))
+}
+
+/// Strict compact-equation fallback for delimiters whose surrounding context
+/// may not yet identify an AI client. Requiring an equality plus an
+/// arithmetic/exponent marker or a short implicit product avoids rendering
+/// configuration prose such as `key=value`.
+pub(super) fn looks_like_compact_equation(source: &str) -> bool {
+    let source = compact_equation_source(source);
+    let compact_syntax = source.chars().all(|character| {
+        character.is_ascii_alphanumeric()
+            || character.is_ascii_whitespace()
+            || matches!(
+                character,
+                '=' | '+' | '-' | '*' | '/' | '^' | '_' | '{' | '}' | '(' | ')' | '.' | ','
+            )
+    });
+    if !compact_syntax {
+        return false;
+    }
+
+    let Some((left, right)) = source.split_once('=') else {
+        return false;
+    };
+    if right.contains('=') {
+        return false;
+    }
+
+    source.chars().any(|character| {
+        character.is_ascii_digit() || matches!(character, '+' | '-' | '*' | '/' | '^' | '_')
+    }) || looks_like_implicit_product_equation(left, right)
+}
+
+pub(super) fn compact_equation_source(source: &str) -> &str {
+    let source = source.trim();
+    // Presentation commands do not change whether the following source is a
+    // compact equation. Markdown renderers may leave this command inside bare
+    // parentheses after consuming the original `\(` / `\)` delimiters.
+    source.strip_prefix(r"\displaystyle").map(str::trim_start).unwrap_or(source)
+}
+
+/// Recognize compact equations whose multiplication signs are conventionally
+/// omitted, such as `F=ma` and `PV=nRT`. Requiring short identifiers plus a
+/// single-symbol or uppercase variable keeps configuration prose like
+/// `key=value` outside the formula path.
+pub(super) fn looks_like_implicit_product_equation(left: &str, right: &str) -> bool {
+    fn compact_identifier(source: &str) -> Option<(usize, bool)> {
+        let source = source.trim();
+        let count = source.chars().count();
+        if !(1..=3).contains(&count)
+            || !source.chars().all(|character| character.is_ascii_alphabetic())
+        {
+            return None;
+        }
+        Some((count, source.chars().any(|character| character.is_ascii_uppercase())))
+    }
+
+    let Some((left_count, left_uppercase)) = compact_identifier(left) else {
+        return false;
+    };
+    let Some((right_count, right_uppercase)) = compact_identifier(right) else {
+        return false;
+    };
+
+    left_count == 1 || right_count == 1 || left_uppercase || right_uppercase
+}
+
+/// Commands that justify treating bare delimiters as math. Deliberately a
+/// whitelist instead of "any `\` + letters": regex escapes (`\d`, `\w`), C
+/// escapes and Windows paths all match the loose shape. Single-letter
+/// commands are excluded wholesale by the caller-side length check baked in
+/// here (every entry is ≥2 chars).
+const KNOWN_TEX_COMMANDS: &[&str] = &[
+    "alpha",
+    "approx",
+    "arccos",
+    "arcsin",
+    "arctan",
+    "bar",
+    "begin",
+    "beta",
+    "big",
+    "bigg",
+    "binom",
+    "boldsymbol",
+    "bullet",
+    "cap",
+    "cdot",
+    "cdots",
+    "chi",
+    "circ",
+    "cos",
+    "cosh",
+    "cot",
+    "csc",
+    "cup",
+    "ddot",
+    "ddots",
+    "delta",
+    "det",
+    "dfrac",
+    "div",
+    "dot",
+    "dots",
+    "emptyset",
+    "end",
+    "epsilon",
+    "equiv",
+    "eta",
+    "exists",
+    "exp",
+    "forall",
+    "frac",
+    "gamma",
+    "gcd",
+    "ge",
+    "geq",
+    "gg",
+    "hat",
+    "iff",
+    "iiint",
+    "iint",
+    "implies",
+    "in",
+    "inf",
+    "infty",
+    "int",
+    "iota",
+    "kappa",
+    "lambda",
+    "land",
+    "langle",
+    "lceil",
+    "ldots",
+    "le",
+    "left",
+    "leftarrow",
+    "leftrightarrow",
+    "leq",
+    "lfloor",
+    "lg",
+    "lim",
+    "liminf",
+    "limsup",
+    "ll",
+    "ln",
+    "log",
+    "lor",
+    "mapsto",
+    "mathbb",
+    "mathbf",
+    "mathcal",
+    "mathfrak",
+    "mathit",
+    "mathrm",
+    "mathsf",
+    "max",
+    "min",
+    "mp",
+    "mu",
+    "nabla",
+    "ne",
+    "neg",
+    "neq",
+    "notin",
+    "nu",
+    "odot",
+    "oint",
+    "omega",
+    "ominus",
+    "operatorname",
+    "oplus",
+    "otimes",
+    "overbrace",
+    "overline",
+    "partial",
+    "phi",
+    "pi",
+    "pm",
+    "prod",
+    "propto",
+    "psi",
+    "qquad",
+    "quad",
+    "rangle",
+    "rceil",
+    "rfloor",
+    "rho",
+    "right",
+    "rightarrow",
+    "sec",
+    "sigma",
+    "sim",
+    "simeq",
+    "sin",
+    "sinh",
+    "sqrt",
+    "subset",
+    "subseteq",
+    "sum",
+    "sup",
+    "supset",
+    "supseteq",
+    "tan",
+    "tanh",
+    "tau",
+    "text",
+    "textbf",
+    "textit",
+    "textrm",
+    "theta",
+    "tilde",
+    "times",
+    "to",
+    "underbrace",
+    "underline",
+    "upsilon",
+    "varepsilon",
+    "varnothing",
+    "varphi",
+    "varpi",
+    "varrho",
+    "varsigma",
+    "vartheta",
+    "vec",
+    "vert",
+    "widehat",
+    "widetilde",
+    "xi",
+    "zeta",
+    "Big",
+    "Bigg",
+    "Delta",
+    "Gamma",
+    "Lambda",
+    "Leftarrow",
+    "Leftrightarrow",
+    "Omega",
+    "Phi",
+    "Pi",
+    "Psi",
+    "Rightarrow",
+    "Sigma",
+    "Theta",
+    "Upsilon",
+    "Vert",
+    "Xi",
+];
+
+/// Whether `source` contains at least one whitelisted TeX command. Bare
+/// delimiters have no `\[` / `\(` intent statement backing them, so a real
+/// math command is required as evidence before they may render.
+pub(super) fn has_known_tex_command(source: &str) -> bool {
+    let mut rest = source;
+    while let Some(index) = rest.find('\\') {
+        rest = &rest[index + 1..];
+        let end = rest.find(|c: char| !c.is_ascii_alphabetic()).unwrap_or(rest.len());
+        if end > 1 && KNOWN_TEX_COMMANDS.contains(&&rest[..end]) {
+            return true;
+        }
+        rest = &rest[end..];
+    }
+    false
+}
+
+/// Delimiters state intent, content supplies evidence.
+///
+/// The intent statement alone is not enough: a terminal is full of dollars that
+/// are shell sigils, prompts and prices, so a scanner that accepts any non-empty
+/// span turns `echo $HOME $USER` into a formula. Display blocks (`$$…$$`,
+/// `\[…\]`) rarely occur outside real math, so lax evidence suffices; inline
+/// `$…$` and `\(…\)` collide with currency, shell variables and BRE capture
+/// groups, so their evidence must be structurally compact.
+pub(super) fn standard_formula_source(source: &str, display: bool) -> bool {
+    let source = source.trim();
+    !obviously_non_math(source) && has_math_evidence(source, display)
+}
+
+/// Terminal noise that must never render as math regardless of delimiter
+/// strength: comments/URLs (`//`), Windows paths (`:\`), control bytes,
+/// currency amounts, and ALL_CAPS shell variables.
+pub(super) fn obviously_non_math(source: &str) -> bool {
+    if source.is_empty()
+        || source.contains("//")
+        || source.contains(":\\")
+        || source
+            .chars()
+            .any(|character| character.is_control() && !matches!(character, '\n' | '\t'))
+    {
+        return true;
+    }
+
+    // Currency and shell variables are the dominant terminal use of dollars.
+    let currency = source.chars().all(|character| {
+        character.is_ascii_digit()
+            || character.is_ascii_whitespace()
+            || ".,EURUSDCNYGBPJPY".contains(character)
+    });
+    let shell_identifier = source.chars().all(|character| {
+        character.is_ascii_uppercase() || character.is_ascii_digit() || character == '_'
+    });
+    currency || (shell_identifier && source.chars().count() > 1)
+}
+
+/// At least one structural sign of mathematics. `lax` (display blocks) lifts
+/// the compact-operand requirement on script bases so implicit products like
+/// `mc^2` qualify; inline keeps it so `$foo^bar$` stays literal text.
+pub(super) fn has_math_evidence(source: &str, lax: bool) -> bool {
+    let chars: Vec<_> = source.chars().collect();
+    let single_variable = chars.len() == 1 && chars[0].is_alphabetic();
+    let tex_command = chars.windows(2).any(|pair| pair[0] == '\\' && pair[1].is_alphabetic());
+    let script = source.find(['^', '_']).is_some_and(|index| {
+        let (base, suffix) = source.split_at(index);
+        let suffix = &suffix[1..];
+        let base_qualifies = if lax { !base.trim().is_empty() } else { explicit_operand(base) };
+        base_qualifies && !suffix.trim().is_empty()
+    });
+    let relation = ["<=", ">=", "!=", "==", "=", "<", ">"].into_iter().any(|operator| {
+        source.find(operator).is_some_and(|index| {
+            relation_operand(&source[..index])
+                && relation_operand(&source[index + operator.len()..])
+        })
+    });
+    // `n!` / `\binom` 的裸写法：阶乘是后缀运算符，本身就是数学证据。
+    let factorial = source
+        .trim_end()
+        .strip_suffix('!')
+        .is_some_and(|base| explicit_operand(base) || implicit_product_operand(base));
+    let structural = script
+        || relation
+        || factorial
+        || source.chars().any(|character| {
+            matches!(
+                character,
+                '±' | '×'
+                    | '÷'
+                    | '√'
+                    | '∑'
+                    | '∏'
+                    | '∫'
+                    | '∞'
+                    | '≈'
+                    | '≠'
+                    | '≤'
+                    | '≥'
+                    | '∂'
+                    | '∇'
+                    | '∈'
+                    | '∉'
+                    | '⊂'
+                    | '⊆'
+                    | '∪'
+                    | '∩'
+                    | '→'
+                    | '↦'
+            )
+        });
+    let known_function = source.split(|character: char| !character.is_alphabetic()).any(|word| {
+        matches!(
+            word.to_ascii_lowercase().as_str(),
+            "sin" | "cos" | "tan" | "log" | "ln" | "exp" | "lim" | "det" | "max" | "min"
+        )
+    });
+    let function_application = source.find('(').is_some_and(|open| {
+        let name = source[..open].trim();
+        let arguments = source[open + 1..].strip_suffix(')').unwrap_or("").trim();
+        name.chars().count() == 1 && name.chars().all(char::is_alphabetic) && !arguments.is_empty()
+    });
+    let parenthesized_variable = source
+        .strip_prefix('(')
+        .and_then(|source| source.strip_suffix(')'))
+        .is_some_and(explicit_operand);
+    let compact_operator = ['+', '-', '*', '/'].into_iter().any(|operator| {
+        source.find(operator).is_some_and(|index| {
+            let (left, right) = source.split_at(index);
+            let right = &right[operator.len_utf8()..];
+            explicit_operand(left) && explicit_operand(right)
+        })
+    });
+
+    single_variable
+        || tex_command
+        || structural
+        || known_function
+        || function_application
+        || parenthesized_variable
+        || compact_operator
+}
+
+/// A single mathematical operand: one variable at most, optionally scripted.
+/// Multi-letter runs are rejected so `$foo^bar$` and `key=value` stay text.
+pub(super) fn explicit_operand(operand: &str) -> bool {
+    let operand = operand.trim().trim_matches(['(', ')', '[', ']', '{', '}']);
+    if operand.is_empty() || operand.contains(char::is_whitespace) {
+        return false;
+    }
+    let alphabetic = operand.chars().filter(|character| character.is_alphabetic()).count();
+    alphabetic <= 1
+        && operand.chars().all(|character| {
+            character.is_alphanumeric() || matches!(character, '.' | ',' | '\\' | '^' | '_')
+        })
+}
+
+/// Physics writes products without a multiplication sign: `mc^2`, `nRT`, `ma`.
+/// [`explicit_operand`] caps identifiers at one letter and therefore rejects
+/// every one of them, which is why `$E=mc^2$` used to stay literal. Allow up to
+/// three letters here — still no whitespace and no punctuation beyond scripts,
+/// so `PATH=/tmp` (slash), `key=value` (five letters) and `npm install`
+/// (whitespace) remain outside the formula path.
+pub(super) fn implicit_product_operand(operand: &str) -> bool {
+    let operand = operand.trim().trim_matches(['(', ')', '[', ']', '{', '}']);
+    if operand.is_empty() || operand.contains(char::is_whitespace) {
+        return false;
+    }
+    let alphabetic = operand.chars().filter(|character| character.is_alphabetic()).count();
+    (1..=3).contains(&alphabetic)
+        && operand
+            .chars()
+            .all(|character| character.is_alphanumeric() || matches!(character, '^' | '_' | '.'))
+}
+
+/// A relation may also be applied to a function call (`f(x)=0`) or to an
+/// implicit product (`E=mc^2`), neither of which is a single operand.
+pub(super) fn relation_operand(operand: &str) -> bool {
+    let operand = operand.trim();
+    explicit_operand(operand)
+        || implicit_product_operand(operand)
+        || operand.find('(').is_some_and(|open| {
+            let name = operand[..open].trim();
+            let arguments = operand[open + 1..].strip_suffix(')').unwrap_or("").trim();
+            name.chars().count() == 1
+                && name.chars().all(char::is_alphabetic)
+                && !arguments.is_empty()
+        })
+}
+
+/// A bare bracket or parenthesis has no explicit TeX intent after Markdown has
+/// consumed the delimiter backslashes. Recover it only when the remaining
+/// source still carries TeX/equation evidence, and never reinterpret a Windows
+/// path as a formula merely because it contains a whitelisted command name.
+///
+/// Bare delimiters answer to both layers: the standard evidence above, plus
+/// their own stricter requirement of a known command or a compact equation.
+pub(super) fn bare_formula_source(source: &str, display: bool) -> bool {
+    standard_formula_source(source, display)
+        && !source.contains(":\\")
+        && (has_known_tex_command(source) || looks_like_compact_equation(source))
+}
+
+pub(super) fn make_overlay(
+    grid: &TextGrid,
+    open: GridPosition,
+    after: GridPosition,
+    source: Box<str>,
+    kind: DelimiterKind,
+) -> FormulaOverlay {
+    let display = kind.is_display();
+    let mut hasher = DefaultHasher::new();
+    source.hash(&mut hasher);
+    kind.hash(&mut hasher);
+    grid.absolute_top.saturating_add(open.row).hash(&mut hasher);
+    open.column.hash(&mut hasher);
+    let formula_id = hasher.finish();
+    FormulaOverlay {
+        source: Arc::from(source),
+        display,
+        formula_id,
+        spans: grid.spans(open, after),
+        foreground: Rgb::default(),
+        fallback: Vec::new(),
+        neighbours_above: [NEIGHBOUR_UNKNOWN; MAX_ABSORBED_BLANK_ROWS],
+        neighbours_below: [NEIGHBOUR_UNKNOWN; MAX_ABSORBED_BLANK_ROWS],
+        formula_neighbours_above: [false; MAX_ABSORBED_BLANK_ROWS],
+        formula_neighbours_below: [false; MAX_ABSORBED_BLANK_ROWS],
+        widen_right_to: None,
+    }
+}
diff --git a/nebula_app/src/display/ui/theme.rs b/nebula_app/src/display/ui/theme.rs
index b54afd2..2a6d769 100644
--- a/nebula_app/src/display/ui/theme.rs
+++ b/nebula_app/src/display/ui/theme.rs
@@ -46,6 +46,10 @@ pub enum NebulaTheme {
     BreezeDark,
     MintLight,
     MintDark,
+    CatppuccinMocha,
+    CatppuccinLatte,
+    GlassLight,
+    GlassDark,
 }
 
 impl Default for NebulaTheme {
@@ -85,6 +89,10 @@ impl NebulaTheme {
             (Self::BreezeLight | Self::BreezeDark, false) => Self::BreezeDark,
             (Self::MintLight | Self::MintDark, true) => Self::MintLight,
             (Self::MintLight | Self::MintDark, false) => Self::MintDark,
+            (Self::CatppuccinMocha | Self::CatppuccinLatte, true) => Self::CatppuccinLatte,
+            (Self::CatppuccinMocha | Self::CatppuccinLatte, false) => Self::CatppuccinMocha,
+            (Self::GlassLight | Self::GlassDark, true) => Self::GlassLight,
+            (Self::GlassLight | Self::GlassDark, false) => Self::GlassDark,
         }
     }
 
@@ -103,11 +111,15 @@ impl NebulaTheme {
             Self::BreezeDark => "Breeze Dark",
             Self::MintLight => "Mint Light",
             Self::MintDark => "Mint Dark",
+            Self::CatppuccinMocha => "Catppuccin Mocha",
+            Self::CatppuccinLatte => "Catppuccin Latte",
+            Self::GlassLight => "Glass Light",
+            Self::GlassDark => "Glass Dark",
         }
     }
 
     /// Static command-palette labels share theme metadata rather than a second exhaustive UI match.
-    pub(crate) fn command_label(self) -> &'static str {
+    pub(crate) const fn command_label(self) -> &'static str {
         match self {
             Self::Nebula => "Theme: Nebula",
             Self::SilverLight => "Theme: Silver Light",
@@ -122,6 +134,10 @@ impl NebulaTheme {
             Self::BreezeDark => "Theme: Breeze Dark",
             Self::MintLight => "Theme: Mint Light",
             Self::MintDark => "Theme: Mint Dark",
+            Self::CatppuccinMocha => "Theme: Catppuccin Mocha",
+            Self::CatppuccinLatte => "Theme: Catppuccin Latte",
+            Self::GlassLight => "Theme: Glass Light",
+            Self::GlassDark => "Theme: Glass Dark",
         }
     }
 
@@ -140,6 +156,10 @@ impl NebulaTheme {
             Self::BreezeDark => "BreezeDark",
             Self::MintLight => "MintLight",
             Self::MintDark => "MintDark",
+            Self::CatppuccinMocha => "CatppuccinMocha",
+            Self::CatppuccinLatte => "CatppuccinLatte",
+            Self::GlassLight => "GlassLight",
+            Self::GlassDark => "GlassDark",
         }
     }
 
@@ -160,6 +180,10 @@ impl NebulaTheme {
             "BreezeDark" => Self::BreezeDark,
             "MintLight" => Self::MintLight,
             "MintDark" => Self::MintDark,
+            "CatppuccinMocha" => Self::CatppuccinMocha,
+            "CatppuccinLatte" => Self::CatppuccinLatte,
+            "GlassLight" => Self::GlassLight,
+            "GlassDark" => Self::GlassDark,
 
             _ => return None,
         })
@@ -188,9 +212,14 @@ impl NebulaTheme {
     /// themes a light one).
     pub(crate) fn accent(self) -> Rgb {
         match self {
-            Self::BreezeLight | Self::BreezeDark | Self::MintLight | Self::MintDark => {
-                rgb8(self.fresh_palette().unwrap().accent)
-            },
+            Self::BreezeLight
+            | Self::BreezeDark
+            | Self::MintLight
+            | Self::MintDark
+            | Self::CatppuccinMocha
+            | Self::CatppuccinLatte
+            | Self::GlassLight
+            | Self::GlassDark => rgb8(self.fresh_palette().unwrap().accent),
             Self::Nebula => Rgb::new(82, 168, 255),
             Self::SilverLight => Rgb::new(73, 80, 87),
             Self::SteelDark => Rgb::new(148, 163, 184),
@@ -340,13 +369,18 @@ impl NebulaTheme {
     /// theme switch retroactively, which users read as "the prompt is stuck").
     pub(crate) fn powerline_colors(self) -> [Rgb; 8] {
         match self {
-            Self::BreezeLight | Self::BreezeDark | Self::MintLight | Self::MintDark => {
-                nebula_settings::ThemeName::from_prompt_name(self.prompt_name())
-                    .unwrap()
-                    .term_theme()
-                    .powerline
-                    .map(rgb8)
-            },
+            Self::BreezeLight
+            | Self::BreezeDark
+            | Self::MintLight
+            | Self::MintDark
+            | Self::CatppuccinMocha
+            | Self::CatppuccinLatte
+            | Self::GlassLight
+            | Self::GlassDark => nebula_settings::ThemeName::from_prompt_name(self.prompt_name())
+                .unwrap()
+                .term_theme()
+                .powerline
+                .map(rgb8),
             Self::Nebula => [
                 Rgb::new(57, 75, 112),
                 Rgb::new(192, 202, 245),
@@ -446,193 +480,76 @@ impl NebulaTheme {
     }
 
     pub(crate) fn palette(self) -> NebulaPalette {
-        match self {
-            Self::BreezeLight | Self::BreezeDark | Self::MintLight | Self::MintDark => {
-                let p = self.fresh_palette().unwrap();
-                let rgba = |rgb: [u8; 3], a| Rgba::new(rgb[0], rgb[1], rgb[2], a);
-                NebulaPalette {
-                    panel: rgba(p.shell, 255),
-                    pill: rgba(p.surface, 255),
-                    tab_stroke_l: rgba(p.muted, 32),
-                    tab_bg_l: rgba(p.surface, 255),
-                    tab_bg_r: rgba(p.surface, 255),
-                    edge_l: rgba(p.accent, 255),
-                    edge_r: rgba(p.accent, 255),
-                    edge_glow_l: rgba(p.accent, 0),
-                    glow_l: rgba(p.accent, 0),
-                    glow_r: rgba(p.accent, 0),
-                    is_light: p.is_light,
-                    term_bg: rgb8(p.surface),
-                    shell_bg: rgb8(p.shell),
-                }
-            },
-            Self::Nebula => NebulaPalette {
-                panel: Rgba::new(34, 38, 48, 224),
-                pill: Rgba::new(43, 48, 59, 218),
-                tab_stroke_l: Rgba::new(150, 157, 188, 132),
-                tab_bg_l: Rgba::new(65, 72, 88, 230),
-                tab_bg_r: Rgba::new(48, 54, 67, 226),
-                edge_l: Rgba::new(169, 152, 188, 180),
-                edge_r: Rgba::new(125, 178, 194, 180),
-                edge_glow_l: Rgba::new(169, 152, 188, 24),
-                glow_l: Rgba::new(169, 152, 188, 14),
-                glow_r: Rgba::new(125, 178, 194, 14),
-                is_light: false,
-                term_bg: Rgb::new(15, 17, 26),
-                shell_bg: Rgb::new(34, 38, 48),
-            },
-            // Cool silver — the light half of the steel pair. Chrome layers
-            // follow the premium-light sheet: sidebar #f3f4f6 over app-bg
-            // #f9fafb, terminal pure white for maximum contrast.
-            Self::SilverLight => NebulaPalette {
-                // Neutral silver, blue removed: the panel/tab surfaces sit on a
-                // true-neutral gray ramp (was Tailwind's blue-leaning gray-100),
-                // and the active-tab halo is a soft neutral shadow instead of a
-                // blue wash — a pure-white pill lifting off a flat gray gutter.
-                panel: Rgba::new(245, 245, 246, 236),
-                pill: Rgba::new(233, 233, 234, 230),
-                tab_stroke_l: Rgba::new(198, 198, 200, 150),
-                tab_bg_l: Rgba::new(255, 255, 255, 242),
-                tab_bg_r: Rgba::new(250, 250, 251, 236),
-                edge_l: Rgba::new(110, 112, 116, 170),
-                edge_r: Rgba::new(118, 121, 126, 180),
-                edge_glow_l: Rgba::new(118, 121, 126, 18),
-                // Ambient glows are OFF on light themes: a ~4% alpha radial
-                // gradient over a pale backdrop lands on very few 8-bit steps,
-                // and the quantization contours read as blurry gray "lines"
-                // (invisible on the dark themes' deep backgrounds).
-                glow_l: Rgba::new(82, 168, 255, 0),
-                glow_r: Rgba::new(73, 80, 87, 0),
-                is_light: true,
-                // Pure white terminal on every light theme (premium-light
-                // sheet): highest contrast for the Primer ANSI ink set.
-                term_bg: Rgb::new(255, 255, 255),
-                // Premium-light app-bg layer (#f3f4f6-ish): the white terminal
-                // card floats on this neutral silver.
-                shell_bg: Rgb::new(243, 244, 246),
-            },
-            // Warm limestone — the light half of the coal pair.
-            Self::LimestoneLight => NebulaPalette {
-                panel: Rgba::new(240, 239, 235, 236),
-                pill: Rgba::new(231, 229, 224, 230),
-                tab_stroke_l: Rgba::new(163, 160, 151, 150),
-                tab_bg_l: Rgba::new(255, 255, 255, 242),
-                tab_bg_r: Rgba::new(247, 246, 242, 236),
-                edge_l: Rgba::new(88, 85, 76, 160),
-                edge_r: Rgba::new(206, 178, 126, 190),
-                edge_glow_l: Rgba::new(206, 178, 126, 20),
-                // Ambient glow off on light themes (8-bit banding, see Silver).
-                glow_l: Rgba::new(206, 178, 126, 0),
-                glow_r: Rgba::new(88, 85, 76, 0),
-                is_light: true,
-                term_bg: Rgb::new(255, 255, 255),
-                shell_bg: Rgb::new(240, 239, 235),
-            },
-            // Soft linen — the light half of the moss pair.
-            Self::LinenLight => NebulaPalette {
-                panel: Rgba::new(242, 242, 236, 236),
-                pill: Rgba::new(233, 233, 227, 230),
-                tab_stroke_l: Rgba::new(176, 179, 176, 150),
-                tab_bg_l: Rgba::new(255, 255, 255, 242),
-                tab_bg_r: Rgba::new(251, 251, 246, 236),
-                edge_l: Rgba::new(95, 99, 95, 160),
-                edge_r: Rgba::new(149, 175, 149, 190),
-                edge_glow_l: Rgba::new(149, 175, 149, 20),
-                // Ambient glow off on light themes (8-bit banding, see Silver).
-                glow_l: Rgba::new(149, 175, 149, 0),
-                glow_r: Rgba::new(95, 99, 95, 0),
-                is_light: true,
-                term_bg: Rgb::new(255, 255, 255),
-                shell_bg: Rgb::new(242, 242, 236),
-            },
-            // The three dark themes from the floating-pill design sheet
-            // (steel blue-gray / coal warm-gold / moss green), low-saturation
-            // accents per the powerline sheet.
-            Self::SteelDark => NebulaPalette {
-                panel: Rgba::new(22, 24, 30, 224),
-                pill: Rgba::new(30, 33, 41, 218),
-                tab_stroke_l: Rgba::new(148, 163, 184, 124),
-                tab_bg_l: Rgba::new(52, 58, 72, 230),
-                tab_bg_r: Rgba::new(38, 43, 54, 226),
-                edge_l: Rgba::new(148, 163, 184, 170),
-                edge_r: Rgba::new(82, 168, 255, 168),
-                edge_glow_l: Rgba::new(148, 163, 184, 20),
-                glow_l: Rgba::new(148, 163, 184, 12),
-                glow_r: Rgba::new(82, 168, 255, 12),
-                is_light: false,
-                term_bg: Rgb::new(26, 28, 36),
-                shell_bg: Rgb::new(22, 24, 30),
-            },
-            Self::CoalDark => NebulaPalette {
-                panel: Rgba::new(22, 22, 22, 224),
-                pill: Rgba::new(30, 30, 30, 218),
-                tab_stroke_l: Rgba::new(186, 186, 182, 120),
-                tab_bg_l: Rgba::new(56, 56, 54, 230),
-                tab_bg_r: Rgba::new(41, 41, 40, 226),
-                edge_l: Rgba::new(206, 178, 126, 172),
-                edge_r: Rgba::new(212, 212, 212, 148),
-                edge_glow_l: Rgba::new(206, 178, 126, 22),
-                glow_l: Rgba::new(206, 178, 126, 12),
-                glow_r: Rgba::new(212, 212, 212, 12),
-                is_light: false,
-                term_bg: Rgb::new(23, 23, 23),
-                shell_bg: Rgb::new(22, 22, 22),
-            },
-            Self::MossDark => NebulaPalette {
-                panel: Rgba::new(25, 28, 25, 224),
-                pill: Rgba::new(33, 37, 33, 218),
-                tab_stroke_l: Rgba::new(163, 179, 163, 124),
-                tab_bg_l: Rgba::new(54, 61, 54, 230),
-                tab_bg_r: Rgba::new(40, 46, 40, 226),
-                edge_l: Rgba::new(149, 175, 149, 172),
-                edge_r: Rgba::new(163, 179, 163, 158),
-                edge_glow_l: Rgba::new(149, 175, 149, 22),
-                glow_l: Rgba::new(149, 175, 149, 12),
-                glow_r: Rgba::new(163, 179, 163, 12),
-                is_light: false,
-                term_bg: Rgb::new(30, 33, 30),
-                shell_bg: Rgb::new(25, 28, 25),
-            },
-            Self::Nord => NebulaPalette {
-                // `Nord`: panel/background #2E3440, elevated
-                // surface #3B4252, one cyan accent and no ambient glow.
-                panel: Rgba::new(0x2e, 0x34, 0x40, 255),
-                pill: Rgba::new(0x3b, 0x42, 0x52, 255),
-                tab_stroke_l: Rgba::new(255, 255, 255, 15),
-                tab_bg_l: Rgba::new(0x3b, 0x42, 0x52, 255),
-                tab_bg_r: Rgba::new(0x3b, 0x42, 0x52, 255),
-                edge_l: Rgba::new(0x88, 0xc0, 0xd0, 255),
-                edge_r: Rgba::new(0x88, 0xc0, 0xd0, 255),
-                edge_glow_l: Rgba::new(0x88, 0xc0, 0xd0, 0),
-                glow_l: Rgba::new(0x88, 0xc0, 0xd0, 0),
-                glow_r: Rgba::new(0x88, 0xc0, 0xd0, 0),
-                is_light: false,
-                term_bg: Rgb::new(0x2e, 0x34, 0x40),
-                shell_bg: Rgb::new(0x2e, 0x34, 0x40),
-            },
-            Self::Paper => NebulaPalette {
-                // `Paper`: warm panel #F5F4F0 around the
-                // #FCFBF9 terminal surface, with botanical green accent.
-                panel: Rgba::new(0xf5, 0xf4, 0xf0, 255),
-                pill: Rgba::new(0xfc, 0xfb, 0xf9, 255),
-                tab_stroke_l: Rgba::new(0xe0, 0xdf, 0xd5, 255),
-                tab_bg_l: Rgba::new(255, 255, 255, 255),
-                tab_bg_r: Rgba::new(255, 255, 255, 255),
-                edge_l: Rgba::new(0x2b, 0x5a, 0x38, 255),
-                edge_r: Rgba::new(0x2b, 0x5a, 0x38, 255),
-                edge_glow_l: Rgba::new(0x2b, 0x5a, 0x38, 0),
-                glow_l: Rgba::new(0x2b, 0x5a, 0x38, 0),
-                glow_r: Rgba::new(0x2b, 0x5a, 0x38, 0),
-                is_light: true,
-                term_bg: Rgb::new(0xfc, 0xfb, 0xf9),
-                shell_bg: Rgb::new(0xf5, 0xf4, 0xf0),
-            },
+        let p = self.fresh_palette().expect("reviewed theme palette");
+        let rgba = |rgb: [u8; 3], alpha| Rgba::new(rgb[0], rgb[1], rgb[2], alpha);
+        let reviewed = nebula_settings::ThemeName::from_prompt_name(self.prompt_name())
+            .expect("shared theme identity")
+            .reviewed_palette();
+        NebulaPalette {
+            panel: rgba(p.shell, 255),
+            pill: rgba(p.surface, 255),
+            tab_stroke_l: Rgba::new(
+                reviewed.line[0],
+                reviewed.line[1],
+                reviewed.line[2],
+                reviewed.line[3],
+            ),
+            tab_bg_l: Rgba::new(
+                reviewed.selected[0],
+                reviewed.selected[1],
+                reviewed.selected[2],
+                reviewed.selected[3],
+            ),
+            tab_bg_r: Rgba::new(
+                reviewed.selected[0],
+                reviewed.selected[1],
+                reviewed.selected[2],
+                reviewed.selected[3],
+            ),
+            edge_l: rgba(p.accent, 255),
+            edge_r: rgba(p.accent, 255),
+            edge_glow_l: rgba(p.accent, 0),
+            glow_l: rgba(p.accent, 0),
+            glow_r: rgba(p.accent, 0),
+            is_light: p.is_light,
+            term_bg: rgb8(p.surface),
+            shell_bg: rgb8(p.shell),
         }
     }
 
     /// Theme-derived ink/surface tokens for every floating chrome layer.
     /// See [`Skin`] for what each token means.
     pub(crate) fn skin(self) -> Skin {
+        let mut skin = self.skin_defaults();
+        let p = nebula_settings::ThemeName::from_prompt_name(self.prompt_name())
+            .expect("shared theme identity")
+            .reviewed_palette();
+        let rgba = |rgb: [u8; 3]| Rgba::new(rgb[0], rgb[1], rgb[2], 255);
+        let wash = |rgb: [u8; 4]| Rgba::new(rgb[0], rgb[1], rgb[2], rgb[3]);
+        skin.panel = rgba(p.background);
+        skin.input = rgba(p.background);
+        skin.ink = rgb8(p.foreground);
+        skin.ink_strong = skin.ink;
+        skin.ink_dim = rgb8(p.muted);
+        skin.ink_faint = skin.ink_dim;
+        skin.icon = skin.ink_dim;
+        skin.icon_hover = skin.ink;
+        skin.accent = rgb8(p.accent);
+        skin.accent_soft = wash(p.selected);
+        skin.hover = skin.accent_soft;
+        skin.hover_strong = skin.accent_soft;
+        skin.surface = skin.accent_soft;
+        skin.card = skin.accent_soft;
+        skin.hairline = wash(p.line);
+        skin.danger = rgba(p.red);
+        skin.ok = rgba(p.green);
+        skin.warn = rgba(p.yellow);
+        skin.ink_on_accent =
+            if skin.is_light { Rgb::new(255, 255, 255) } else { rgb8(p.background) };
+        skin
+    }
+
+    fn skin_defaults(self) -> Skin {
         match self {
             Self::Nord => return nord_skin(),
             Self::Paper => return paper_skin(),
@@ -664,7 +581,7 @@ impl NebulaTheme {
         let shell_avg = ((shell.r as f32 + shell.g as f32 + shell.b as f32) / 3.0).max(1.0);
         let lift_factor = (shell_avg + 14.0) / shell_avg;
         let lift = |c: u8| ((c as f32 * lift_factor).round().min(255.0)) as u8;
-        if p.is_light {
+        let mut skin = if p.is_light {
             Skin {
                 // 浅色的三层不是单调递增的明度阶梯，而是**凹槽**（2026-07-31
                 // 裁定，推翻 07-29 的"浮层比内容更暗"）：浮层底与输入面同为
@@ -805,7 +722,22 @@ impl NebulaTheme {
                 scrollbar_thumb: Rgba::new(148, 163, 184, 0), // slate-400
                 is_light: false,
             }
+        };
+        if let Some(palette) = self.fresh_palette() {
+            let rgba = |rgb: [u8; 3], alpha| Rgba::new(rgb[0], rgb[1], rgb[2], alpha);
+            skin.panel = rgba(palette.surface, 255);
+            skin.input = skin.panel;
+            skin.card = rgba(palette.shell, 255);
+            skin.ink = rgb8(palette.foreground);
+            skin.ink_strong = skin.ink;
+            skin.ink_dim = rgb8(palette.muted);
+            skin.icon = skin.ink_dim;
+            skin.icon_hover = skin.ink;
+            skin.accent = rgb8(palette.accent);
+            skin.accent_soft = rgba(palette.accent, if palette.is_light { 28 } else { 38 });
+            skin.hairline = rgba(palette.muted, 36);
         }
+        skin
     }
 }
 
diff --git a/nebula_app/src/document_io.rs b/nebula_app/src/document_io.rs
new file mode 100644
index 0000000..31ee778
--- /dev/null
+++ b/nebula_app/src/document_io.rs
@@ -0,0 +1,69 @@
+//! Prefix reads bound memory before decoding or parsing a document.
+
+use std::io::{self, Read};
+
+pub(crate) fn read_prefix(
+    reader: &mut impl Read,
+    declared_size: u64,
+    limit: usize,
+) -> io::Result<(Vec<u8>, bool)> {
+    let capacity = declared_size.min(limit as u64) as usize;
+    let mut bytes = Vec::with_capacity(capacity);
+    reader.by_ref().take(limit as u64).read_to_end(&mut bytes)?;
+    // Probe overflow separately, avoiding an 8 MiB -> 16 MiB Vec growth merely
+    // to read the extra byte that identifies a truncated preview.
+    let mut extra = [0u8; 1];
+    let truncated = reader.read(&mut extra)? != 0;
+    if truncated {
+        if let Err(error) = std::str::from_utf8(&bytes) {
+            if error.error_len().is_none() {
+                bytes.truncate(error.valid_up_to());
+            }
+        }
+    }
+    Ok((bytes, truncated))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    struct VirtualLargeFile {
+        remaining: usize,
+        read: usize,
+    }
+    impl Read for VirtualLargeFile {
+        fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+            let count = buffer.len().min(self.remaining);
+            buffer[..count].fill(b'x');
+            self.remaining -= count;
+            self.read += count;
+            Ok(count)
+        }
+    }
+
+    #[test]
+    fn virtual_hundred_megabyte_file_never_materializes_its_full_contents() {
+        let length = 100 * 1024 * 1024;
+        let limit = 64 * 1024;
+        let mut file = VirtualLargeFile { remaining: length, read: 0 };
+        let (bytes, truncated) = read_prefix(&mut file, length as u64, limit).unwrap();
+        assert!(truncated);
+        assert_eq!(file.read, limit + 1);
+        assert_eq!(bytes.len(), limit);
+        assert_eq!(bytes.capacity(), limit);
+    }
+
+    #[test]
+    fn short_files_growth_and_unicode_boundaries_remain_correct() {
+        let (bytes, truncated) = read_prefix(&mut "甲乙丙".as_bytes(), 9, 7).unwrap();
+        assert!(truncated);
+        assert_eq!(std::str::from_utf8(&bytes).unwrap(), "甲乙");
+        let (bytes, truncated) = read_prefix(&mut &b"abcdef"[..], 1, 4).unwrap();
+        assert!(truncated);
+        assert_eq!(bytes, b"abcd");
+        let (bytes, truncated) = read_prefix(&mut &b"abcd"[..], 4, 4).unwrap();
+        assert!(!truncated);
+        assert_eq!(bytes, b"abcd");
+    }
+}
diff --git a/nebula_app/src/event.rs b/nebula_app/src/event.rs
index 8802357..18e409b 100644
--- a/nebula_app/src/event.rs
+++ b/nebula_app/src/event.rs
@@ -68,6 +68,7 @@ use crate::window_transition::{NativeWindowStage, NativeWindowStageTracker};
 mod agent_runtime;
 mod input_state;
 mod proxy;
+mod quick_hotkey;
 mod runtime_control;
 mod search_state;
 mod types;
@@ -230,33 +231,6 @@ impl Processor {
         });
     }
 
-    /// Create the global hotkey manager and register the quick-terminal toggle
-    /// (Ctrl+`). Returns `(None, None)` if the platform rejects it, so the rest
-    /// of the terminal keeps working without a quick terminal.
-    fn init_quick_hotkey(combo: &str) -> (Option<GlobalHotKeyManager>, Option<HotKey>) {
-        let manager = match GlobalHotKeyManager::new() {
-            Ok(manager) => manager,
-            Err(err) => {
-                warn!("Quick terminal disabled: global hotkey init failed: {err}");
-                return (None, None);
-            },
-        };
-        let hotkey = combo
-            .parse::<HotKey>()
-            .unwrap_or_else(|_| HotKey::new(Some(HotKeyModifiers::CONTROL), Code::Backquote));
-        match manager.register(hotkey) {
-            Ok(()) => (Some(manager), Some(hotkey)),
-            Err(err) => {
-                // Non-fatal and common in dev: a hard-killed previous instance
-                // never ran Drop to release Ctrl+`, or another app already owns
-                // it. The terminal works fine without the quick-terminal hotkey,
-                // so log quietly instead of nagging the on-screen message bar.
-                debug!("Quick terminal hotkey (Ctrl+`) not registered: {err}");
-                (Some(manager), None)
-            },
-        }
-    }
-
     /// Create initial window and load GL platform.
     ///
     /// This will initialize the OpenGL Api and pick a config that
@@ -432,83 +406,6 @@ impl Processor {
         self.detached.retain(|detached| !detached.is_empty());
     }
 
-    /// Drain global-hotkey events and toggle the quick terminal on a press.
-    fn poll_quick_hotkey(&mut self, event_loop: &ActiveEventLoop) {
-        let Some(hotkey_id) = self.quick_hotkey.map(|hotkey| hotkey.id()) else { return };
-        let mut toggle = false;
-        while let Ok(event) = GlobalHotKeyEvent::receiver().try_recv() {
-            if event.id == hotkey_id && event.state == HotKeyState::Pressed {
-                toggle = true;
-            }
-        }
-        if toggle {
-            self.toggle_quick_terminal(event_loop);
-        }
-    }
-
-    /// Replace the global quick-terminal shortcut transactionally. Registering
-    /// the candidate before releasing the old key keeps the existing shortcut
-    /// alive when the OS rejects a conflicting or malformed candidate.
-    fn apply_quick_terminal_hotkey(&mut self, requested: &str) -> Result<(), String> {
-        let new_hotkey =
-            requested.parse::<HotKey>().map_err(|err| format!("快捷键格式无效：{err}"))?;
-        if self.quick_hotkey == Some(new_hotkey) {
-            self.quick_hotkey_combo = requested.to_owned();
-            return Ok(());
-        }
-
-        let mut manager = self.global_hotkey.take().or_else(|| GlobalHotKeyManager::new().ok());
-        let Some(manager_ref) = manager.as_mut() else {
-            return Err("系统全局快捷键管理器初始化失败".to_owned());
-        };
-        if let Err(err) = manager_ref.register(new_hotkey) {
-            self.global_hotkey = manager;
-            return Err(format!("快捷键注册失败：{err}"));
-        }
-        if let Some(old_hotkey) = self.quick_hotkey {
-            if let Err(err) = manager_ref.unregister(old_hotkey) {
-                let _ = manager_ref.unregister(new_hotkey);
-                self.global_hotkey = manager;
-                return Err(format!("释放旧快捷键失败：{err}"));
-            }
-        }
-        self.global_hotkey = manager;
-        self.quick_hotkey = Some(new_hotkey);
-        self.quick_hotkey_combo = requested.to_owned();
-        Ok(())
-    }
-
-    /// Settings files are shared by windows. A non-originating window can
-    /// notice a changed hotkey during its mtime reload, so drain one staged
-    /// request during the main wait cycle even when no key event follows.
-    fn flush_quick_hotkey_requests(&mut self) {
-        let mut pending = None;
-        for (window_id, window_context) in &mut self.windows {
-            if let Some(hotkey) = window_context.display.take_quick_hotkey_request() {
-                pending = Some((*window_id, hotkey));
-                break;
-            }
-        }
-        let Some((window_id, hotkey)) = pending else { return };
-        let old = self.quick_hotkey_combo.clone();
-        let result = self.apply_quick_terminal_hotkey(&hotkey);
-        if let Some(window_context) = self.windows.get_mut(&window_id) {
-            match result {
-                Ok(()) => {
-                    window_context.display.quick_hotkey_registration_done(&hotkey, true, None, &old)
-                },
-                Err(err) => window_context.display.quick_hotkey_registration_done(
-                    &hotkey,
-                    false,
-                    Some(&err),
-                    &old,
-                ),
-            }
-            window_context.dirty = true;
-            window_context.display.window.request_redraw();
-        }
-    }
-
     /// Show/hide the quick (Quake) terminal with a slide animation, creating it
     /// on first use.
     fn toggle_quick_terminal(&mut self, event_loop: &ActiveEventLoop) {
@@ -1571,10 +1468,10 @@ impl<'a, N: Notify + 'a, T: EventListener> input::ActionContext<T> for ActionCon
         *self.dirty = true;
     }
 
-    fn nebula_completion_popup_take(&mut self) -> Option<String> {
+    fn nebula_completion_popup_take(&mut self) -> Option<crate::display::NebulaCompletionItem> {
         let state = &mut self.nebula_state;
         let index = state.completion_selected?;
-        let insert = state.completion_items.get(index)?.insert.clone();
+        let insert = state.completion_items.get(index)?.clone();
         state.completion_items.clear();
         state.completion_selected = None;
         *self.dirty = true;
diff --git a/nebula_app/src/event/quick_hotkey.rs b/nebula_app/src/event/quick_hotkey.rs
new file mode 100644
index 0000000..ef81c0c
--- /dev/null
+++ b/nebula_app/src/event/quick_hotkey.rs
@@ -0,0 +1,120 @@
+//! Legacy shell global shortcut registration and live replacement.
+
+use super::*;
+
+impl Processor {
+    /// Create the global hotkey manager and register the quick-terminal toggle
+    /// (Ctrl+`). Returns `(None, None)` if the platform rejects it, so the rest
+    /// of the terminal keeps working without a quick terminal.
+    pub(super) fn init_quick_hotkey(combo: &str) -> (Option<GlobalHotKeyManager>, Option<HotKey>) {
+        if combo.trim().is_empty() {
+            return (None, None);
+        }
+        let manager = match GlobalHotKeyManager::new() {
+            Ok(manager) => manager,
+            Err(err) => {
+                warn!("Quick terminal disabled: global hotkey init failed: {err}");
+                return (None, None);
+            },
+        };
+        let hotkey = combo
+            .parse::<HotKey>()
+            .unwrap_or_else(|_| HotKey::new(Some(HotKeyModifiers::CONTROL), Code::Backquote));
+        match manager.register(hotkey) {
+            Ok(()) => (Some(manager), Some(hotkey)),
+            Err(err) => {
+                // Non-fatal and common in dev: a hard-killed previous instance
+                // never ran Drop to release Ctrl+`, or another app already owns
+                // it. The terminal works fine without the quick-terminal hotkey,
+                // so log quietly instead of nagging the on-screen message bar.
+                debug!("Quick terminal hotkey (Ctrl+`) not registered: {err}");
+                (Some(manager), None)
+            },
+        }
+    }
+
+    /// Drain global-hotkey events and toggle the quick terminal on a press.
+    pub(super) fn poll_quick_hotkey(&mut self, event_loop: &ActiveEventLoop) {
+        let Some(hotkey_id) = self.quick_hotkey.map(|hotkey| hotkey.id()) else { return };
+        let mut toggle = false;
+        while let Ok(event) = GlobalHotKeyEvent::receiver().try_recv() {
+            if event.id == hotkey_id && event.state == HotKeyState::Pressed {
+                toggle = true;
+            }
+        }
+        if toggle {
+            self.toggle_quick_terminal(event_loop);
+        }
+    }
+
+    /// Replace the global quick-terminal shortcut transactionally. Registering
+    /// the candidate before releasing the old key keeps the existing shortcut
+    /// alive when the OS rejects a conflicting or malformed candidate.
+    pub(super) fn apply_quick_terminal_hotkey(&mut self, requested: &str) -> Result<(), String> {
+        if requested.trim().is_empty() {
+            if let (Some(manager), Some(hotkey)) = (&self.global_hotkey, self.quick_hotkey) {
+                manager.unregister(hotkey).map_err(|error| error.to_string())?;
+            }
+            self.quick_hotkey = None;
+            self.quick_hotkey_combo.clear();
+            return Ok(());
+        }
+        let new_hotkey =
+            requested.parse::<HotKey>().map_err(|err| format!("快捷键格式无效：{err}"))?;
+        if self.quick_hotkey == Some(new_hotkey) {
+            self.quick_hotkey_combo = requested.to_owned();
+            return Ok(());
+        }
+
+        let mut manager = self.global_hotkey.take().or_else(|| GlobalHotKeyManager::new().ok());
+        let Some(manager_ref) = manager.as_mut() else {
+            return Err("系统全局快捷键管理器初始化失败".to_owned());
+        };
+        if let Err(err) = manager_ref.register(new_hotkey) {
+            self.global_hotkey = manager;
+            return Err(format!("快捷键注册失败：{err}"));
+        }
+        if let Some(old_hotkey) = self.quick_hotkey {
+            if let Err(err) = manager_ref.unregister(old_hotkey) {
+                let _ = manager_ref.unregister(new_hotkey);
+                self.global_hotkey = manager;
+                return Err(format!("释放旧快捷键失败：{err}"));
+            }
+        }
+        self.global_hotkey = manager;
+        self.quick_hotkey = Some(new_hotkey);
+        self.quick_hotkey_combo = requested.to_owned();
+        Ok(())
+    }
+
+    /// Settings files are shared by windows. A non-originating window can
+    /// notice a changed hotkey during its mtime reload, so drain one staged
+    /// request during the main wait cycle even when no key event follows.
+    pub(super) fn flush_quick_hotkey_requests(&mut self) {
+        let mut pending = None;
+        for (window_id, window_context) in &mut self.windows {
+            if let Some(hotkey) = window_context.display.take_quick_hotkey_request() {
+                pending = Some((*window_id, hotkey));
+                break;
+            }
+        }
+        let Some((window_id, hotkey)) = pending else { return };
+        let old = self.quick_hotkey_combo.clone();
+        let result = self.apply_quick_terminal_hotkey(&hotkey);
+        if let Some(window_context) = self.windows.get_mut(&window_id) {
+            match result {
+                Ok(()) => {
+                    window_context.display.quick_hotkey_registration_done(&hotkey, true, None, &old)
+                },
+                Err(err) => window_context.display.quick_hotkey_registration_done(
+                    &hotkey,
+                    false,
+                    Some(&err),
+                    &old,
+                ),
+            }
+            window_context.dirty = true;
+            window_context.display.window.request_redraw();
+        }
+    }
+}
diff --git a/nebula_app/src/gpui_shell/config.rs b/nebula_app/src/gpui_shell/config.rs
index 1632b76..e87af53 100644
--- a/nebula_app/src/gpui_shell/config.rs
+++ b/nebula_app/src/gpui_shell/config.rs
@@ -59,6 +59,8 @@ pub struct Settings {
     pub cursor_blink: Option<bool>,
     /// 选区完成即复制（旧壳 `copy_on_select` 设置）。
     pub copy_on_select: bool,
+    /// Cached in-app toast preference, independent of native system notifications.
+    pub ai_toasts: bool,
     /// 标签关闭按钮与标签插入动画都在渲染热路径读取，必须随全局设置驻留内存。
     pub tab_close_visible: bool,
     pub tab_reveal: nebula_settings::TabRevealName,
@@ -92,6 +94,10 @@ pub(crate) fn ui_language(cx: &App) -> UiLanguage {
     cx.try_global::<Settings>().map(|settings| settings.ui_language).unwrap_or(UiLanguage::EnUs)
 }
 
+pub(crate) fn ai_toasts_enabled(cx: &App) -> bool {
+    cx.try_global::<Settings>().is_none_or(|settings| settings.ai_toasts)
+}
+
 #[inline]
 fn resolve_ui_language(preference: nebula_settings::LanguagePref) -> UiLanguage {
     LanguagePreference::from(preference).resolved()
@@ -170,6 +176,7 @@ impl Settings {
             }),
             cursor_blink: runtime.cursor_blink,
             copy_on_select: runtime.copy_on_select,
+            ai_toasts: runtime.ai_toasts,
             tab_close_visible: runtime.tab_close_visible,
             tab_reveal: runtime.tab_reveal,
             ghost: runtime.ghost,
diff --git a/nebula_app/src/gpui_shell/copy_feedback.rs b/nebula_app/src/gpui_shell/copy_feedback.rs
new file mode 100644
index 0000000..006dda3
--- /dev/null
+++ b/nebula_app/src/gpui_shell/copy_feedback.rs
@@ -0,0 +1,117 @@
+//! Short-lived visual feedback for clipboard actions.
+//!
+//! Copy controls use this state for the small, local "copy → check" transition.
+//! It deliberately lives with the control's GPUI entity instead of in a global
+//! toast or application singleton: dropping the control also drops its timer.
+
+use std::time::Duration;
+
+use gpui::{Context, Task};
+
+/// How long a successful copy control remains in its checked state.
+pub(crate) const COPY_FEEDBACK_TTL: Duration = Duration::from_millis(1500);
+
+/// Per-control copy confirmation state.
+///
+/// The clipboard API currently reports writes as a best-effort `()`. Callers
+/// should only invoke [`Self::mark_copied`] after they have produced a valid
+/// clipboard payload; error/unavailable paths must leave the state unchanged.
+#[derive(Default)]
+pub(crate) struct CopyFeedback {
+    copied: bool,
+    pending: bool,
+    generation: u64,
+    expiry: Option<Task<()>>,
+}
+
+impl CopyFeedback {
+    pub(crate) fn new() -> Self {
+        Self::default()
+    }
+
+    pub(crate) fn is_copied(&self) -> bool {
+        self.copied
+    }
+
+    pub(crate) fn is_pending(&self) -> bool {
+        self.pending
+    }
+
+    /// Keep the action visible while an asynchronous clipboard payload is
+    /// being prepared.  Starting a new operation also cancels any old
+    /// success expiry owned by this control.
+    pub(crate) fn mark_pending(&mut self, cx: &mut Context<Self>) {
+        self.expiry = None;
+        self.generation = self.generation.wrapping_add(1);
+        self.pending = true;
+        self.copied = false;
+        cx.notify();
+    }
+
+    /// Enter the checked state and schedule its bounded automatic reset.
+    ///
+    /// A generation guard prevents an older timer from clearing a newer copy
+    /// confirmation when the user clicks repeatedly. Replacing `expiry` also
+    /// drops the previous task, so repeated clicks do not accumulate timers.
+    pub(crate) fn mark_copied(&mut self, cx: &mut Context<Self>) {
+        self.expiry = None;
+        self.pending = false;
+        self.copied = true;
+        self.generation = self.generation.wrapping_add(1);
+        let generation = self.generation;
+        self.expiry = Some(cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(COPY_FEEDBACK_TTL).await;
+            let _ = this.update(cx, |feedback, cx| {
+                if feedback.generation == generation {
+                    feedback.copied = false;
+                    feedback.expiry = None;
+                    cx.notify();
+                }
+            });
+        }));
+        cx.notify();
+    }
+
+    /// Leave the pending/success state without showing a false success result.
+    pub(crate) fn clear(&mut self, cx: &mut Context<Self>) {
+        self.expiry = None;
+        self.generation = self.generation.wrapping_add(1);
+        self.pending = false;
+        self.copied = false;
+        cx.notify();
+    }
+}
+
+#[cfg(all(test, feature = "gpui-test-support"))]
+mod tests {
+    use super::*;
+    use gpui::{AppContext as _, TestAppContext};
+
+    #[gpui::test]
+    fn copy_feedback_uses_controlled_clock_for_success_expiry(cx: &mut TestAppContext) {
+        let feedback = cx.update(|cx| cx.new(|_| CopyFeedback::new()));
+        cx.update(|cx| {
+            feedback.update(cx, |feedback, cx| feedback.mark_copied(cx));
+        });
+        assert!(cx.read(|cx| feedback.read(cx).is_copied()));
+
+        cx.executor().advance_clock(COPY_FEEDBACK_TTL - Duration::from_millis(1));
+        cx.run_until_parked();
+        assert!(cx.read(|cx| feedback.read(cx).is_copied()));
+
+        cx.executor().advance_clock(Duration::from_millis(1));
+        cx.run_until_parked();
+        assert!(!cx.read(|cx| feedback.read(cx).is_copied()));
+    }
+
+    #[gpui::test]
+    fn starting_async_copy_clears_old_success_state(cx: &mut TestAppContext) {
+        let feedback = cx.update(|cx| cx.new(|_| CopyFeedback::new()));
+        cx.update(|cx| {
+            feedback.update(cx, |feedback, cx| feedback.mark_copied(cx));
+            feedback.update(cx, |feedback, cx| feedback.mark_pending(cx));
+        });
+        assert!(cx.read(|cx| feedback.read(cx).is_pending()));
+        assert!(!cx.read(|cx| feedback.read(cx).is_copied()));
+    }
+}
diff --git a/nebula_app/src/gpui_shell/file_drop.rs b/nebula_app/src/gpui_shell/file_drop.rs
index a9610a8..ace4a23 100644
--- a/nebula_app/src/gpui_shell/file_drop.rs
+++ b/nebula_app/src/gpui_shell/file_drop.rs
@@ -17,6 +17,8 @@ use crate::gpui_shell::prelude::*;
 /// 一次从文件树拖向终端的条目。
 #[derive(Clone, Debug)]
 pub struct FileTreeDrag {
+    /// Host filesystem identity for file transfers, distinct from shell spelling.
+    pub local_path: std::path::PathBuf,
     /// 落进 PTY 的路径**原文**。
     ///
     /// WSL 行带的是来宾路径（`/home/x`）而不是那个只用作展开键的 `PathBuf`：
diff --git a/nebula_app/src/gpui_shell/file_editor/chrome.rs b/nebula_app/src/gpui_shell/file_editor/chrome.rs
new file mode 100644
index 0000000..d808297
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/chrome.rs
@@ -0,0 +1,301 @@
+//! Compact document chrome, separate from the buffer and document lifecycle.
+use super::reader_presentation as design;
+use super::*;
+
+impl TextFileView {
+    pub(super) fn render_toolbar(
+        &self,
+        editable: bool,
+        window: &Window,
+        cx: &mut Context<Self>,
+    ) -> gpui::AnyElement {
+        let language = super::super::config::ui_language(cx);
+        let muted = cx.theme().muted_foreground;
+        let parent = self
+            .path
+            .parent()
+            .and_then(|path| path.file_name())
+            .map(|name| name.to_string_lossy().into_owned())
+            .unwrap_or_default();
+        h_flex()
+            .h(px(design::TOOLBAR_HEIGHT))
+            .flex_shrink_0()
+            .px(px(design::PANEL_PADDING))
+            .gap(px(9.0))
+            .border_b_1()
+            .border_color(cx.theme().border)
+            .child(
+                h_flex()
+                    .flex_1()
+                    .min_w_0()
+                    .gap(px(7.0))
+                    .child(Icon::new(IconName::File).size(px(design::ICON_SIZE)).text_color(muted))
+                    .when(!parent.is_empty(), |row| {
+                        row.child(
+                            div()
+                                .max_w(px(140.0))
+                                .truncate()
+                                .text_size(px(design::SECONDARY_SIZE))
+                                .text_color(muted)
+                                .child(parent),
+                        )
+                        .child(
+                            div()
+                                .text_size(px(design::SECONDARY_SIZE))
+                                .text_color(muted)
+                                .child("/"),
+                        )
+                    })
+                    .child(
+                        div()
+                            .min_w_0()
+                            .truncate()
+                            .text_size(px(design::CHROME_SIZE))
+                            .font_semibold()
+                            .child(self.title.clone()),
+                    )
+                    .when(self.dirty, |row| {
+                        row.child(
+                            div()
+                                .size(px(5.0))
+                                .flex_shrink_0()
+                                .rounded_full()
+                                .bg(cx.theme().warning),
+                        )
+                    }),
+            )
+            .when(self.markdown, |bar| bar.child(self.render_mode_switch(cx)))
+            .child(div().w(px(1.0)).h(px(18.0)).mx_1().bg(cx.theme().border))
+            .child(
+                Button::new("file-details-toggle")
+                    .ghost()
+                    .size(px(design::CONTROL_HEIGHT))
+                    .flex_shrink_0()
+                    .icon(Icon::new(IconName::PanelRight).size(px(design::ICON_SIZE)))
+                    .selected(self.show_details)
+                    .tooltip(language.text(Message::EditorDetailsToggle))
+                    .on_click(cx.listener(|this, _, _, cx| {
+                        this.show_details = !this.show_details;
+                        if !this.markdown {
+                            this.info = true;
+                        }
+                        cx.notify();
+                    })),
+            )
+            .when((self.loading || self.saving) && self.source.is_remote(), |bar| {
+                bar.child(
+                    Button::new("file-cancel-operation")
+                        .ghost()
+                        .xsmall()
+                        .label(language.text(Message::TransferCancel))
+                        .on_click(cx.listener(|this, _, _, cx| {
+                            if let Some(operation) = &this.operation {
+                                operation.cancel();
+                            }
+                            this.notice = Some((Message::TransferCancelling, None));
+                            cx.notify();
+                        })),
+                )
+            })
+            .child(
+                Button::new("file-fullscreen")
+                    .ghost()
+                    .size(px(design::CONTROL_HEIGHT))
+                    .flex_shrink_0()
+                    .icon(
+                        Icon::new(if self.markdown {
+                            if self.reader_focus { IconName::Minimize } else { IconName::Maximize }
+                        } else if window.is_fullscreen() {
+                            IconName::Minimize
+                        } else {
+                            IconName::Maximize
+                        })
+                        .size(px(design::ICON_SIZE)),
+                    )
+                    .tooltip(language.text(if self.markdown {
+                        if self.reader_focus {
+                            Message::EditorExitFocusReading
+                        } else {
+                            Message::EditorFocusReading
+                        }
+                    } else if window.is_fullscreen() {
+                        Message::EditorExitFullscreen
+                    } else {
+                        Message::EditorFullscreen
+                    }))
+                    .on_click(cx.listener(|this, _, window, cx| {
+                        if this.markdown {
+                            this.toggle_reader_focus(cx);
+                        } else {
+                            window.toggle_fullscreen();
+                            cx.notify();
+                        }
+                    })),
+            )
+            .child(
+                Button::new("file-save")
+                    .ghost()
+                    .xsmall()
+                    .h(px(design::CONTROL_HEIGHT))
+                    .px(px(12.0))
+                    .flex_shrink_0()
+                    .text_size(px(design::CHROME_SIZE))
+                    .label(language.text(if self.saving {
+                        Message::EditorSaving
+                    } else {
+                        Message::EditorSave
+                    }))
+                    .tooltip(language.text(Message::EditorSaveShortcut))
+                    .disabled(!editable || !self.dirty || self.saving)
+                    .on_click(cx.listener(|this, _, _, cx| {
+                        this.save(cx).detach();
+                    })),
+            )
+            .into_any_element()
+    }
+
+    fn render_mode_switch(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let language = super::super::config::ui_language(cx);
+        h_flex()
+            .flex_shrink_0()
+            .p(px(3.0))
+            .gap(px(2.0))
+            .rounded(px(6.0))
+            .border_1()
+            .border_color(cx.theme().border)
+            .bg(cx.theme().muted)
+            .children(
+                [
+                    (true, "file-mode-read", Message::EditorReading),
+                    (false, "file-mode-edit", Message::EditorEdit),
+                ]
+                .into_iter()
+                .map(|(preview, id, label)| {
+                    div().debug_selector(move || id.to_owned()).child(
+                        Button::new(id)
+                            .ghost()
+                            .xsmall()
+                            .h(px(design::CONTROL_HEIGHT))
+                            .rounded(px(4.0))
+                            .px(px(10.0))
+                            .text_size(px(design::SECONDARY_SIZE))
+                            .label(language.text(label))
+                            .when(self.preview == preview, |button| {
+                                button.bg(cx.theme().background).text_color(cx.theme().foreground)
+                            })
+                            .when(self.preview != preview, |button| {
+                                button.text_color(cx.theme().muted_foreground)
+                            })
+                            .on_click(cx.listener(move |this, _, window, cx| {
+                                if this.preview != preview {
+                                    this.toggle_preview(window, cx);
+                                }
+                            })),
+                    )
+                }),
+            )
+            .into_any_element()
+    }
+
+    pub(super) fn render_details_header(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let language = super::super::config::ui_language(cx);
+        h_flex()
+            .h(px(design::PANEL_HEADER_HEIGHT))
+            .flex_shrink_0()
+            .px(px(design::PANEL_PADDING))
+            .gap(px(20.0))
+            .border_b_1()
+            .border_color(cx.theme().border)
+            .children(
+                [
+                    (false, "file-toggle-outline", Message::EditorOutline),
+                    (true, "file-info", Message::EditorInfo),
+                ]
+                .into_iter()
+                .filter(|(info, _, _)| *info || self.markdown)
+                .map(|(info, id, label)| {
+                    div()
+                        .debug_selector(move || id.to_owned())
+                        .relative()
+                        .h_full()
+                        .flex_shrink_0()
+                        .flex()
+                        .items_center()
+                        .child(
+                            Button::new(id)
+                                .ghost()
+                                .xsmall()
+                                .h_full()
+                                .min_w(px(48.0))
+                                .px(px(8.0))
+                                .rounded(px(0.0))
+                                .text_size(px(design::SECONDARY_SIZE))
+                                .label(language.text(label))
+                                .text_color(if self.info == info {
+                                    cx.theme().foreground
+                                } else {
+                                    cx.theme().muted_foreground
+                                })
+                                .when(self.info == info, |button| button.font_semibold())
+                                .on_click(cx.listener(move |this, _, _, cx| {
+                                    this.info = info;
+                                    this.show_details = true;
+                                    cx.notify();
+                                })),
+                        )
+                        .when(self.info == info, |tab| {
+                            tab.child(
+                                div()
+                                    .debug_selector(|| "file-details-indicator".to_owned())
+                                    .absolute()
+                                    .bottom_0()
+                                    .left_0()
+                                    .right_0()
+                                    .h(px(2.0))
+                                    .bg(cx.theme().foreground.opacity(0.55)),
+                            )
+                        })
+                }),
+            )
+            .child(div().flex_1())
+            .child(
+                Button::new("file-details-close")
+                    .ghost()
+                    .size(px(design::CONTROL_HEIGHT))
+                    .flex_shrink_0()
+                    .icon(Icon::new(IconName::Close).size(px(design::ICON_SIZE)))
+                    .tooltip(language.text(Message::EditorDetailsClose))
+                    .on_click(cx.listener(|this, _, _, cx| {
+                        this.show_details = false;
+                        cx.notify();
+                    })),
+            )
+            .into_any_element()
+    }
+
+    /// An 8px hit target centered on the one-pixel panel divider. The actual
+    /// panel width is shared by outline and file-info, so both views resize in
+    /// exactly the same way.
+    pub(super) fn render_details_resize_handle(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let hover_line = cx.theme().border.opacity(0.45);
+        div()
+            .id("file-details-resize-handle")
+            .debug_selector(|| "file-details-resize-handle".to_owned())
+            .absolute()
+            .top_0()
+            .bottom_0()
+            .left(px(-(design::DETAILS_RESIZE_HIT_WIDTH * 0.5)))
+            .w(px(design::DETAILS_RESIZE_HIT_WIDTH))
+            .cursor_col_resize()
+            .hover(move |handle| handle.bg(hover_line))
+            .on_mouse_down(
+                MouseButton::Left,
+                cx.listener(|this, event, _, cx| {
+                    gpui_component::GlobalState::suppress_text_selection(cx);
+                    this.begin_details_resize(event, cx);
+                    cx.stop_propagation();
+                }),
+            )
+            .into_any_element()
+    }
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/code_actions.rs b/nebula_app/src/gpui_shell/file_editor/code_actions.rs
new file mode 100644
index 0000000..ec12484
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/code_actions.rs
@@ -0,0 +1,568 @@
+//! Visible-block-scoped language picker and code clipboard actions.
+use super::*;
+use gpui::{ClickEvent, ClipboardItem, FocusHandle, Hsla, RenderOnce, Window, anchored, deferred};
+use gpui_component::Size;
+use gpui_component::list::{List, ListDelegate, ListEvent, ListState};
+use gpui_component::text::{MarkdownExtensions, MarkdownNode, TextView, TextViewStyle};
+
+use super::super::copy_feedback::CopyFeedback;
+
+#[derive(Clone)]
+pub(super) struct CodeSpec {
+    pub source: SharedString,
+    pub language: Option<SharedString>,
+    pub span: Option<(usize, usize)>,
+}
+
+struct CodeLanguage {
+    list: Entity<ListState<LanguageListDelegate>>,
+    focus: FocusHandle,
+    open: bool,
+    plain: SharedString,
+    selected: SharedString,
+    copy_feedback: Entity<CopyFeedback>,
+    _copy_feedback_subscription: Subscription,
+    span: Option<(usize, usize)>,
+    _subscription: Subscription,
+    content: Entity<TextViewState>,
+    markdown: String,
+}
+
+/// Colors used by the approved code-block prototype. The light
+/// values are the Paper prototype's actual roles; the dark values are its
+/// Nord companion roles. Keeping these roles together prevents the code block
+/// from falling back to a generic component card when the surrounding theme
+/// changes.
+#[derive(Clone, Copy)]
+struct CodeUiColors {
+    ink: Hsla,
+    secondary: Hsla,
+    code: Hsla,
+    hover: Hsla,
+    popup: Hsla,
+    line: Hsla,
+    accent: Hsla,
+}
+
+fn code_ui_colors(cx: &App) -> CodeUiColors {
+    let theme = cx.theme();
+    CodeUiColors {
+        ink: super::super::theme::code_block_foreground(cx),
+        secondary: theme.muted_foreground,
+        code: super::super::theme::code_block_background(cx),
+        hover: theme.list_hover,
+        popup: theme.popover,
+        line: theme.border,
+        accent: theme.ring,
+    }
+}
+
+#[derive(Clone)]
+struct LanguageOption {
+    name: SharedString,
+    glyph: SharedString,
+    aliases: SharedString,
+}
+
+impl LanguageOption {
+    fn new(name: SharedString) -> Self {
+        let lower = name.to_lowercase();
+        let (glyph, aliases) = match lower.as_str() {
+            "rust" | "rs" => ("Rs", "rust rs"),
+            "javascript" | "js" => ("JS", "javascript js"),
+            "typescript" | "ts" => ("TS", "typescript ts"),
+            "python" | "py" => ("Py", "python py"),
+            "c" => ("C", "c"),
+            "cpp" | "c++" => ("C+", "cpp c++"),
+            "csharp" | "c#" => ("C#", "csharp c#"),
+            "html" | "xml" => ("<> ", "html xml"),
+            "css" => ("#{}", "css"),
+            "json" => ("{}", "json"),
+            "bash" | "shell" | "sh" | "zsh" => ("$", "bash shell sh zsh"),
+            "markdown" | "md" => ("M↓", "markdown md"),
+            "plaintext" | "text" | "纯文本" => ("≡", "plaintext text 纯文本"),
+            _ => ("<> ", lower.as_str()),
+        };
+        Self { name, glyph: glyph.trim().into(), aliases: aliases.into() }
+    }
+
+    fn matches(&self, query: &str) -> bool {
+        let query = query.trim().to_lowercase();
+        query.is_empty()
+            || self.name.to_lowercase().contains(&query)
+            || self.aliases.to_lowercase().contains(&query)
+    }
+}
+
+struct LanguageListDelegate {
+    items: Vec<LanguageOption>,
+    filtered: Vec<LanguageOption>,
+    selected: SharedString,
+}
+
+impl LanguageListDelegate {
+    fn new(items: Vec<LanguageOption>, selected: SharedString) -> Self {
+        Self { filtered: items.clone(), items, selected }
+    }
+
+    fn set_selected(&mut self, selected: SharedString) {
+        self.selected = selected;
+    }
+}
+
+#[derive(Clone, IntoElement)]
+struct LanguageRow {
+    option: LanguageOption,
+    highlighted: bool,
+    checked: bool,
+}
+
+impl gpui_component::Selectable for LanguageRow {
+    fn selected(mut self, selected: bool) -> Self {
+        self.highlighted = selected;
+        self
+    }
+
+    fn is_selected(&self) -> bool {
+        self.highlighted
+    }
+
+    fn secondary_selected(self, _: bool) -> Self {
+        self
+    }
+}
+
+impl RenderOnce for LanguageRow {
+    fn render(self, _: &mut Window, cx: &mut App) -> impl IntoElement {
+        let colors = code_ui_colors(cx);
+        let selector = format!("markdown-language-option-{}", self.option.name);
+        h_flex()
+            .debug_selector(move || selector.clone())
+            .h(px(32.0))
+            .w_full()
+            .gap(px(9.0))
+            .px(px(8.0))
+            .rounded(px(3.0))
+            .items_center()
+            .text_size(px(12.0))
+            .text_color(colors.ink)
+            .when(self.highlighted, |row| row.bg(colors.hover))
+            .when(!self.highlighted, |row| row.hover(|row| row.bg(colors.hover)))
+            .child(
+                div()
+                    .w(px(18.0))
+                    .h(px(18.0))
+                    .flex_shrink_0()
+                    .flex()
+                    .items_center()
+                    .justify_center()
+                    .text_size(px(11.0))
+                    .text_color(colors.secondary)
+                    .child(self.option.glyph),
+            )
+            // Keep the label as real text instead of an ellipsis-bearing
+            // flex child. This matters for localized/CJK language names.
+            .child(div().flex_none().child(self.option.name))
+            .when(self.checked, |row| {
+                row.child(Icon::new(IconName::Check).size(px(14.0)).text_color(colors.accent))
+            })
+    }
+}
+
+impl ListDelegate for LanguageListDelegate {
+    type Item = LanguageRow;
+
+    fn items_count(&self, _: usize, _: &App) -> usize {
+        self.filtered.len()
+    }
+
+    fn render_item(
+        &mut self,
+        ix: IndexPath,
+        _: &mut Window,
+        _: &mut Context<ListState<Self>>,
+    ) -> Option<Self::Item> {
+        self.filtered.get(ix.row).cloned().map(|option| LanguageRow {
+            checked: option.name == self.selected,
+            highlighted: false,
+            option,
+        })
+    }
+
+    fn perform_search(
+        &mut self,
+        query: &str,
+        _: &mut Window,
+        _: &mut Context<ListState<Self>>,
+    ) -> Task<()> {
+        self.filtered = self.items.iter().filter(|item| item.matches(query)).cloned().collect();
+        Task::ready(())
+    }
+
+    fn set_selected_index(
+        &mut self,
+        _: Option<IndexPath>,
+        _: &mut Window,
+        _: &mut Context<ListState<Self>>,
+    ) {
+    }
+
+    fn confirm(&mut self, _: bool, _: &mut Window, _: &mut Context<ListState<Self>>) {}
+
+    fn cancel(&mut self, _: &mut Window, _: &mut Context<ListState<Self>>) {}
+}
+
+fn standalone_markdown(code: &CodeSpec) -> String {
+    let longest = code.source.split(|c| c != '`').map(str::len).max().unwrap_or(0);
+    let fence = "`".repeat(3.max(longest + 1));
+    format!("{fence}{}\n{}\n{fence}", code.language.as_deref().unwrap_or(""), code.source)
+}
+
+impl CodeLanguage {
+    fn toggle(&mut self, _: &ClickEvent, window: &mut Window, cx: &mut Context<Self>) {
+        if self.open {
+            self.close(window, cx);
+        } else {
+            self.open = true;
+            self.list.update(cx, |list, cx| list.focus(window, cx));
+            cx.notify();
+        }
+    }
+
+    fn close(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if !self.open {
+            return;
+        }
+        self.open = false;
+        self.focus.focus(window, cx);
+        cx.notify();
+    }
+
+    fn close_from_outside(
+        &mut self,
+        _: &gpui::MouseDownEvent,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        self.close(window, cx);
+    }
+}
+
+fn render_language_picker(
+    state: Entity<CodeLanguage>,
+    list: Entity<ListState<LanguageListDelegate>>,
+    current: SharedString,
+    open: bool,
+    focus: FocusHandle,
+    search_placeholder: &'static str,
+    window: &mut Window,
+    cx: &mut App,
+) -> impl IntoElement {
+    let colors = code_ui_colors(cx);
+    let picker = div()
+        .id("markdown-language-picker")
+        .debug_selector(|| "markdown-language-picker".to_owned())
+        .relative()
+        .w_auto()
+        .min_w(px(48.0))
+        .h(px(28.0))
+        .child(
+            div()
+                .group("markdown-language-trigger")
+                .id("markdown-language-trigger")
+                .w_full()
+                .h_full()
+                .track_focus(&focus)
+                .tab_stop(true)
+                .px(px(7.0))
+                .rounded(px(3.0))
+                .text_size(px(11.0))
+                .text_color(colors.secondary)
+                .flex()
+                .items_center()
+                .gap(px(5.0))
+                // GPUI keeps mouse focus and keyboard focus separate. The
+                // former must not leave the black component outline behind;
+                // the latter remains discoverable through focus-visible.
+                .focus_visible(|trigger| trigger.border_1().border_color(colors.accent))
+                .hover(move |trigger| trigger.bg(colors.hover))
+                .child(div().flex_none().child(current))
+                .child(
+                    div()
+                        .w(px(16.0))
+                        .h(px(28.0))
+                        .flex_shrink_0()
+                        .flex()
+                        .items_center()
+                        .justify_center()
+                        .text_color(colors.secondary)
+                        .when(!open, |icon| icon.opacity(0.0))
+                        .group_hover("markdown-language-trigger", |icon| icon.opacity(1.0))
+                        .child(Icon::new(IconName::ChevronDown).size(px(10.0))),
+                )
+                .on_click(window.listener_for(&state, CodeLanguage::toggle)),
+        );
+    if !open {
+        return picker;
+    }
+    picker.child(
+        deferred(
+            anchored().snap_to_window_with_margin(px(8.0)).child(
+                div()
+                    .id("markdown-language-popup")
+                    .occlude()
+                    .w(px(224.0))
+                    .max_h(px(280.0))
+                    .bg(colors.popup)
+                    .text_color(colors.ink)
+                    .border_1()
+                    .border_color(colors.line)
+                    .rounded(px(6.0))
+                    .shadow_lg()
+                    .p(px(6.0))
+                    .child(
+                        div().debug_selector(|| "markdown-language-search".to_owned()).child(
+                            List::new(&list)
+                                    // Small also shrinks the query field. The
+                                    // approved prototype gives the search
+                                    // field and every menu row independent
+                                    // 32px proportions.
+                                    .with_size(Size::Medium)
+                                    .search_placeholder(search_placeholder)
+                                    .scrollbar_visible(false)
+                                    .max_h(px(264.0))
+                                    .text_color(colors.ink),
+                        ),
+                    )
+                    .on_mouse_down_out(
+                        window.listener_for(&state, CodeLanguage::close_from_outside),
+                    ),
+            ),
+        )
+        .with_priority(1),
+    )
+}
+
+/// Construct once per visible root block, not once per frame: extension revisions
+/// participate in the Markdown parse cache's identity.
+pub(super) fn extensions(
+    base: MarkdownExtensions,
+    owner: gpui::WeakEntity<TextFileView>,
+    block: usize,
+) -> MarkdownExtensions {
+    base.block_parser(|node, parse| {
+        let markdown::mdast::Node::Code(code) = node else { return None };
+        // Keep scientific fenced-block ownership with the existing renderer.
+        if matches!(code.lang.as_deref(), Some("math" | "latex" | "tex")) {
+            return None;
+        }
+        let position = node.position()?;
+        let spec = CodeSpec {
+            source: code.value.clone().into(),
+            language: code.lang.clone().map(Into::into),
+            span: Some((
+                position.start.offset + parse.offset(),
+                position.end.offset + parse.offset(),
+            )),
+        };
+        Some(
+            MarkdownNode::new("pebrel-code-block", spec)
+                .text(code.value.clone())
+                .markdown(parse.node_source(node).unwrap_or_default().to_owned()),
+        )
+    })
+    .block_renderer("pebrel-code-block", move |node, window, cx| {
+        let spec = node.data::<CodeSpec>().expect("registered code block data").clone();
+        let hover_group = format!("code-{block}-{}", spec.span.map_or(0, |span| span.0)).into();
+        render(owner.clone(), block, spec, hover_group, window, cx)
+    })
+}
+
+pub(super) fn render(
+    owner: gpui::WeakEntity<TextFileView>,
+    block: usize,
+    code: CodeSpec,
+    hover_group: SharedString,
+    window: &mut Window,
+    cx: &mut App,
+) -> gpui::AnyElement {
+    let language = super::super::config::ui_language(cx);
+    let markdown = standalone_markdown(&code);
+    let plain = SharedString::from(language.text(Message::MarkdownPlainText));
+    let current = code
+        .language
+        .clone()
+        .filter(|value| !matches!(value.as_ref(), "text" | "plaintext"))
+        .unwrap_or_else(|| plain.clone());
+    let current_for_state = current.clone();
+    let span = code.span;
+    let state = window.use_keyed_state(
+        ("code-language-picker", span.map_or(0, |span| span.0)),
+        cx,
+        |window, cx| {
+            let mut choices =
+                gpui_component::highlighter::LanguageRegistry::singleton().languages();
+            choices.sort();
+            choices.insert(0, plain.clone());
+            if !choices.contains(&current) {
+                choices.push(current.clone());
+            }
+            let choices = choices.into_iter().map(LanguageOption::new).collect::<Vec<_>>();
+            let selected = current_for_state.clone();
+            let list = cx.new(|cx| {
+                ListState::new(LanguageListDelegate::new(choices, selected.clone()), window, cx)
+                    .searchable(true)
+            });
+            let subscription = cx.subscribe_in(
+                &list,
+                window,
+                move |state: &mut CodeLanguage, _, event, window, cx| match event {
+                    ListEvent::Confirm(ix) => {
+                        let choice = state
+                            .list
+                            .read(cx)
+                            .delegate()
+                            .filtered
+                            .get(ix.row)
+                            .map(|item| item.name.clone());
+                        if let Some(choice) = choice {
+                            if let Some((start, end)) = state.span {
+                                let choice =
+                                    if choice == state.plain { "" } else { choice.as_ref() };
+                                let _ = owner.update(cx, |view, cx| {
+                                    view.set_preview_language(block, start, end, choice, cx)
+                                });
+                            }
+                        }
+                        state.close(window, cx);
+                    },
+                    ListEvent::Cancel => state.close(window, cx),
+                    ListEvent::Select(_) => {},
+                },
+            );
+            let content = cx.new(|cx| TextViewState::markdown(&markdown, cx));
+            let copy_feedback = cx.new(|_| CopyFeedback::new());
+            let copy_feedback_subscription =
+                cx.observe_in(&copy_feedback, window, |_, _, _, cx| cx.notify());
+            CodeLanguage {
+                list,
+                // This handle is explicitly tab-reachable because the
+                // trigger tracks it instead of letting the Div create an
+                // implicit, non-tab-stop handle.
+                focus: cx.focus_handle().tab_stop(true),
+                open: false,
+                plain,
+                selected: current_for_state,
+                copy_feedback,
+                _copy_feedback_subscription: copy_feedback_subscription,
+                span,
+                _subscription: subscription,
+                content,
+                markdown: markdown.clone(),
+            }
+        },
+    );
+    // Spans can move after changing a fence; callbacks use the current frame's span.
+    state.update(cx, |state, cx| {
+        state.span = span;
+        if state.selected != current {
+            state.selected = current.clone();
+            state.list.update(cx, |list, cx| {
+                list.delegate_mut().set_selected(current.clone());
+                cx.notify();
+            });
+        }
+        if state.markdown != markdown {
+            state.content.update(cx, |content, cx| content.set_text(&markdown, cx));
+            state.markdown = markdown;
+        }
+    });
+    let content = state.read(cx).content.clone();
+    let list = state.read(cx).list.clone();
+    let picker_open = state.read(cx).open;
+    let picker_focus = state.read(cx).focus.clone();
+    let copy_feedback = state.read(cx).copy_feedback.clone();
+    let copied = copy_feedback.read(cx).is_copied();
+    let source = code.source;
+    let colors = code_ui_colors(cx);
+    let mut surface = div()
+        .id("code-surface")
+        .px(px(18.0))
+        .py(px(16.0))
+        .rounded(px(3.0))
+        .bg(colors.code)
+        .text_color(colors.ink)
+        .text_size(px(13.0))
+        .line_height(gpui::relative(1.8))
+        .whitespace_nowrap()
+        .overflow_x_scroll();
+    let style = TextViewStyle {
+        code_block: surface.style().clone(),
+        highlight_theme: cx.theme().highlight_theme.clone(),
+        is_dark: cx.theme().is_dark(),
+        ..Default::default()
+    };
+    v_flex()
+        .relative()
+        .group(hover_group.clone())
+        .w_full()
+        .min_w_0()
+        .debug_selector(|| "pebrel-code-block".to_owned())
+        .child(
+            div().w_full().min_w_0().debug_selector(|| "pebrel-code-text".to_owned()).child(
+                TextView::new(&content)
+                    .w_full()
+                    .min_w_0()
+                    .max_w_full()
+                    .selectable(true)
+                    .scrollable(false)
+                    .style(style),
+            ),
+        )
+        .child(h_flex().w_full().h(px(28.0)).justify_end().child(render_language_picker(
+            state.clone(),
+            list,
+            current,
+            picker_open,
+            picker_focus,
+            language.text(Message::EditorSearchCodeLanguage),
+            window,
+            cx,
+        )))
+        .child(
+            div()
+                .debug_selector(|| "markdown-copy-code".to_owned())
+                .absolute()
+                .top(px(8.0))
+                .right(px(8.0))
+                .invisible()
+                .when(copied, |slot| slot.visible())
+                .group_hover(hover_group, |slot| slot.visible())
+                .child({
+                    let feedback = copy_feedback.clone();
+                    let button = Button::new("copy-code")
+                        .custom(
+                            gpui_component::button::ButtonCustomVariant::new(cx)
+                                .hover(colors.hover)
+                                .active(colors.hover),
+                        )
+                        .size(px(32.0))
+                        .icon(if copied { IconName::Check } else { IconName::Copy })
+                        .tooltip(language.text(Message::EditorCopyCode))
+                        .on_click(move |_, _, cx| {
+                            cx.write_to_clipboard(ClipboardItem::new_string(source.to_string()));
+                            feedback.update(cx, |feedback, cx| feedback.mark_copied(cx));
+                        });
+                    div()
+                            // This selector exists only while the checked
+                            // state is actually rendered; unlike the outer
+                            // invisible hit target it is useful for asserting
+                            // feedback expiry in interaction tests.
+                            .when(copied, |control| {
+                                control.debug_selector(|| "markdown-copy-code-success".to_owned())
+                            })
+                            .child(button)
+                }),
+        )
+        .into_any_element()
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/code_actions_tests.rs b/nebula_app/src/gpui_shell/file_editor/code_actions_tests.rs
new file mode 100644
index 0000000..5775bf8
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/code_actions_tests.rs
@@ -0,0 +1,127 @@
+//! Dedicated code-block picker and clipboard feedback coverage.
+
+use super::*;
+use std::time::Duration;
+
+use gpui::{Modifiers, TestAppContext, VisualTestContext, point, px};
+use gpui_component::Root;
+
+use crate::gpui_shell::copy_feedback::{COPY_FEEDBACK_TTL, CopyFeedback};
+
+fn open(path: PathBuf, cx: &mut TestAppContext) -> (Entity<TextFileView>, VisualTestContext) {
+    cx.update(|cx| {
+        gpui_component::init(cx);
+        super::super::math_view::register(cx);
+        init(cx);
+    });
+    let mut file = None;
+    let (_, window) = cx.add_window_view(|window, cx| {
+        let view = cx.new(|cx| TextFileView::new(path, window, cx));
+        file = Some(view.clone());
+        Root::new(view, window, cx)
+    });
+    window.run_until_parked();
+    (file.unwrap(), window.clone())
+}
+
+#[gpui::test]
+fn picker_trigger_popup_search_and_rows_keep_html_geometry(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("picker.md");
+    std::fs::write(&path, "```text\nlet x = 42;\n```\n").unwrap();
+    let (_file, mut cx) = open(path, cx);
+
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let trigger = cx.debug_bounds("markdown-language-picker").unwrap();
+    assert_eq!(trigger.size.height, px(28.0));
+    let point = trigger.center();
+    cx.simulate_mouse_down(point, MouseButton::Left, Modifiers::default());
+    cx.simulate_mouse_up(point, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    assert!(cx.debug_bounds("markdown-language-popup").is_some());
+    assert!(cx.debug_bounds("markdown-language-search").unwrap().size.height >= px(32.0));
+    cx.simulate_input("rust");
+    cx.run_until_parked();
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    assert!(cx.debug_bounds("markdown-language-option-rust").is_some());
+}
+
+#[gpui::test]
+fn code_copy_feedback_keeps_control_visible_after_pointer_leaves(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("copy.md");
+    std::fs::write(&path, "```rust\nlet x = 42;\n```\n").unwrap();
+    let (_file, mut cx) = open(path, cx);
+
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let block = cx.debug_bounds("pebrel-code-block").unwrap();
+    cx.simulate_mouse_move(block.center(), None, Modifiers::default());
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let copy = cx.debug_bounds("markdown-copy-code").unwrap();
+    let click_point = copy.center();
+    cx.simulate_mouse_down(click_point, MouseButton::Left, Modifiers::default());
+    cx.simulate_mouse_up(click_point, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    cx.simulate_mouse_move(point(px(0.0), px(0.0)), None, Modifiers::default());
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    assert!(cx.debug_bounds("markdown-copy-code-success").is_some());
+    assert_eq!(
+        cx.read_from_clipboard().unwrap().text().unwrap().trim_end_matches('\n'),
+        "let x = 42;"
+    );
+}
+
+#[gpui::test]
+fn language_picker_keeps_mouse_and_keyboard_activation_distinct(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("picker-focus.md");
+    std::fs::write(&path, "```text\nlet x = 42;\n```\n").unwrap();
+    let (_file, mut cx) = open(path, cx);
+
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let trigger = cx.debug_bounds("markdown-language-picker").unwrap().center();
+    cx.simulate_mouse_down(trigger, MouseButton::Left, Modifiers::default());
+    cx.simulate_mouse_up(trigger, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    assert!(!cx.update(|window, _| window.last_input_was_keyboard()));
+
+    // Closing by Escape restores the trigger focus. Enter must then activate
+    // the same control through its keyboard click path, not through a mouse
+    // focus side effect.
+    cx.simulate_keystrokes("escape");
+    assert!(cx.update(|window, _| window.last_input_was_keyboard()));
+    cx.simulate_keystrokes("enter");
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    assert!(cx.debug_bounds("markdown-language-popup").is_some());
+}
+
+#[gpui::test]
+fn copy_feedback_state_expires_after_its_shared_ttl(cx: &mut TestAppContext) {
+    let feedback = cx.update(|cx| cx.new(|_| CopyFeedback::new()));
+    cx.update(|cx| feedback.update(cx, |feedback, cx| feedback.mark_copied(cx)));
+    assert!(feedback.read_with(cx, |feedback, _| feedback.is_copied()));
+    cx.run_until_parked();
+
+    // The test dispatcher owns the clock, so this does not sleep or make the
+    // test depend on wall-clock scheduling.
+    cx.executor().advance_clock(COPY_FEEDBACK_TTL + Duration::from_millis(1));
+    cx.run_until_parked();
+    assert!(!feedback.read_with(cx, |feedback, _| feedback.is_copied()));
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/document.rs b/nebula_app/src/gpui_shell/file_editor/document.rs
index 1786502..259c410 100644
--- a/nebula_app/src/gpui_shell/file_editor/document.rs
+++ b/nebula_app/src/gpui_shell/file_editor/document.rs
@@ -1,62 +1,41 @@
 //! File snapshots and conditional, atomic saves. No GPUI state or disk I/O in rendering.
 
+use crate::text_document::TextSnapshot;
+pub(super) use crate::text_document::{MAX_BYTES, SaveError};
 use std::fs;
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-pub(super) const MAX_BYTES: usize = 8 * 1024 * 1024;
 
 #[derive(Clone, Debug)]
 pub(super) struct Document {
-    pub(super) text: String,
-    pub(super) read_only: bool,
-    pub(super) truncated: bool,
-    pub(super) invalid_encoding: bool,
+    snapshot: TextSnapshot,
     target: PathBuf,
-    pub(super) bytes: Arc<[u8]>,
-    pub(super) bom: bool,
-    pub(super) crlf: bool,
+    pub(super) total_bytes: u64,
     pub(super) modified: Option<std::time::SystemTime>,
 }
 
-#[derive(Debug)]
-pub(super) enum SaveError {
-    Changed,
-    ReadOnly,
-    Io(std::io::Error),
-}
-
-impl From<std::io::Error> for SaveError {
-    fn from(error: std::io::Error) -> Self {
-        Self::Io(error)
+impl std::ops::Deref for Document {
+    type Target = TextSnapshot;
+    fn deref(&self) -> &Self::Target {
+        &self.snapshot
     }
 }
 
 impl Document {
     pub(super) fn load(path: &Path) -> std::io::Result<Self> {
         let target = path.canonicalize()?;
-        let file = fs::File::open(&target)?;
+        let mut file = fs::File::open(&target)?;
         let metadata = file.metadata()?;
-        let mut bytes = Vec::new();
-        file.take(MAX_BYTES as u64 + 1).read_to_end(&mut bytes)?;
-        let truncated = bytes.len() > MAX_BYTES;
-        bytes.truncate(MAX_BYTES);
-        let bom = bytes.starts_with(b"\xef\xbb\xbf");
-        let body = if bom { &bytes[3..] } else { &bytes };
-        let invalid_encoding = std::str::from_utf8(body).is_err() || body.contains(&0);
-        let text = String::from_utf8_lossy(body);
-        let crlf = text.contains("\r\n") && !text.replace("\r\n", "").contains('\n');
-        let text = text.replace("\r\n", "\n");
+        let (bytes, truncated) =
+            crate::document_io::read_prefix(&mut file, metadata.len(), MAX_BYTES)?;
         Ok(Self {
-            text,
-            read_only: metadata.permissions().readonly() || truncated || invalid_encoding,
-            truncated,
-            invalid_encoding,
+            snapshot: TextSnapshot::decode_prefix(
+                bytes,
+                metadata.permissions().readonly(),
+                truncated,
+            ),
             target,
-            bytes: bytes.into(),
-            bom,
-            crlf,
+            total_bytes: metadata.len(),
             modified: metadata.modified().ok(),
         })
     }
@@ -75,10 +54,7 @@ impl Document {
         }
         let mut current = Vec::new();
         file.take(MAX_BYTES as u64 + 1).read_to_end(&mut current)?;
-        if current.as_slice() != self.bytes.as_ref() {
-            return Err(SaveError::Changed);
-        }
-        Ok(())
+        self.snapshot.verify(&current)
     }
 
     pub(super) fn save(&self, path: &Path, text: String) -> Result<Self, SaveError> {
@@ -89,9 +65,7 @@ impl Document {
         if text == self.text {
             return Ok(self.clone());
         }
-        let mut bytes = if self.bom { b"\xef\xbb\xbf".to_vec() } else { Vec::new() };
-        let encoded = if self.crlf { text.replace('\n', "\r\n") } else { text.clone() };
-        bytes.extend_from_slice(encoded.as_bytes());
+        let bytes = self.snapshot.encode(&text)?;
         let parent = self.target.parent().ok_or_else(|| {
             std::io::Error::new(std::io::ErrorKind::InvalidInput, "file has no parent")
         })?;
@@ -104,8 +78,8 @@ impl Document {
         self.check_current(path)?;
         staged.persist(&self.target).map_err(|error| SaveError::Io(error.error))?;
         Ok(Self {
-            text,
-            bytes: bytes.into(),
+            total_bytes: bytes.len() as u64,
+            snapshot: TextSnapshot::decode(bytes, false),
             modified: fs::metadata(&self.target).and_then(|meta| meta.modified()).ok(),
             ..self.clone()
         })
diff --git a/nebula_app/src/gpui_shell/file_editor/focus_tests.rs b/nebula_app/src/gpui_shell/file_editor/focus_tests.rs
new file mode 100644
index 0000000..8425b44
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/focus_tests.rs
@@ -0,0 +1,101 @@
+//! Focus-mode and details-panel geometry contracts.
+
+use super::*;
+use gpui::{Modifiers, TestAppContext, VisualTestContext, point, px};
+use gpui_component::Root;
+
+fn open(path: PathBuf, cx: &mut TestAppContext) -> (Entity<TextFileView>, VisualTestContext) {
+    cx.update(|cx| {
+        gpui_component::init(cx);
+        super::super::math_view::register(cx);
+        init(cx);
+    });
+    let mut file = None;
+    let (_, window) = cx.add_window_view(|window, cx| {
+        let view = cx.new(|cx| TextFileView::new(path, window, cx));
+        file = Some(view.clone());
+        Root::new(view, window, cx)
+    });
+    window.run_until_parked();
+    (file.unwrap(), window.clone())
+}
+
+#[test]
+fn details_width_clamps_to_the_reader_panel_contract() {
+    assert_eq!(
+        reader_presentation::clamp_details_width(-1.0),
+        reader_presentation::DETAILS_MIN_WIDTH
+    );
+    assert_eq!(
+        reader_presentation::clamp_details_width(reader_presentation::OUTLINE_WIDTH),
+        reader_presentation::OUTLINE_WIDTH
+    );
+    assert_eq!(
+        reader_presentation::clamp_details_width(f32::MAX),
+        reader_presentation::DETAILS_MAX_WIDTH
+    );
+}
+
+#[gpui::test]
+fn reader_focus_round_trip_restores_details_and_draft_state(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("focus.md");
+    std::fs::write(&path, "# Focus\n\nDraft stays local.\n").unwrap();
+    let (file, mut cx) = open(path, cx);
+
+    cx.update(|window, cx| {
+        file.update(cx, |view, cx| {
+            view.info = true;
+            view.show_details = true;
+            view.input.update(cx, |input, cx| {
+                input.replace_all("draft", window, cx);
+            });
+            view.toggle_reader_focus(cx);
+            assert!(view.reader_focus);
+            assert!(!view.show_details);
+        });
+    });
+    assert_eq!(file.read_with(&cx, |view, cx| view.input.read(cx).value().to_string()), "draft");
+
+    cx.update(|window, cx| {
+        file.update(cx, |view, cx| {
+            view.toggle_reader_focus(cx);
+            assert!(!view.reader_focus);
+            assert!(view.show_details);
+            assert!(view.info);
+            view.input.update(cx, |input, cx| input.focus(window, cx));
+        });
+    });
+    assert_eq!(file.read_with(&cx, |view, cx| view.input.read(cx).value().to_string()), "draft");
+}
+
+#[gpui::test]
+fn details_panel_drag_updates_shared_width_and_releases_on_mouse_up(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("resize.md");
+    std::fs::write(&path, "# Resize\n\nBody\n").unwrap();
+    let (file, mut cx) = open(path, cx);
+
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let handle = cx.debug_bounds("file-details-resize-handle").unwrap();
+    let start = handle.center();
+    cx.simulate_mouse_down(start, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+
+    let target = point(start.x - px(32.0), start.y);
+    cx.simulate_mouse_move(target, Some(MouseButton::Left), Modifiers::default());
+    cx.run_until_parked();
+    let width = file.read_with(&cx, |view, _| view.details_width);
+    assert!(width > reader_presentation::OUTLINE_WIDTH);
+    cx.simulate_mouse_up(target, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    assert!(file.read_with(&cx, |view, _| view.details_resize_anchor.is_none()));
+    cx.update(|window, cx| {
+        assert!(window.selected_text(cx).is_empty(), "resizing must not select reader text");
+    });
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/images.rs b/nebula_app/src/gpui_shell/file_editor/images.rs
index 0de4329..f103b15 100644
--- a/nebula_app/src/gpui_shell/file_editor/images.rs
+++ b/nebula_app/src/gpui_shell/file_editor/images.rs
@@ -30,6 +30,12 @@ fn flatten_local_image_url(url: &str, base: Option<&Path>) -> String {
     if lower.starts_with("http://") || lower.starts_with("https://") || lower.starts_with("data:") {
         return url.to_owned();
     }
+    // Static images do not need animation flattening. In particular, do not
+    // reread every large PNG/JPEG occurrence while parsing a long document.
+    let extension = Path::new(url).extension().and_then(|ext| ext.to_str()).unwrap_or_default();
+    if !extension.eq_ignore_ascii_case("gif") && !extension.eq_ignore_ascii_case("webp") {
+        return url.to_owned();
+    }
     let path = Path::new(url);
     let resolved = if path.is_absolute() {
         path.to_path_buf()
diff --git a/nebula_app/src/gpui_shell/file_editor/info.rs b/nebula_app/src/gpui_shell/file_editor/info.rs
index 8f473da..58cf6fb 100644
--- a/nebula_app/src/gpui_shell/file_editor/info.rs
+++ b/nebula_app/src/gpui_shell/file_editor/info.rs
@@ -1,3 +1,4 @@
+use super::reader_presentation as design;
 use super::*;
 
 impl TextFileView {
@@ -5,13 +6,10 @@ impl TextFileView {
         let language = super::super::config::ui_language(cx);
         let muted = cx.theme().muted_foreground;
         let text = self.input.read(cx).value();
-        let mut rows = vec![
-            (
-                Message::EditorType,
-                self.path.extension().unwrap_or_default().to_string_lossy().to_uppercase(),
-            ),
-            (Message::EditorLineCount, text.lines().count().to_string()),
+        let kind = self.path.extension().unwrap_or_default().to_string_lossy().to_uppercase();
+        let statistics = vec![
             (Message::EditorCharacters, text.chars().count().to_string()),
+            (Message::EditorLineCount, text.lines().count().to_string()),
             (
                 Message::EditorStatus,
                 language
@@ -19,16 +17,10 @@ impl TextFileView {
                     .to_owned(),
             ),
         ];
+        let mut properties = Vec::new();
         if let Some(document) = &self.document {
-            rows.insert(1, (Message::EditorSize, format!("{} B", document.bytes.len())));
-            if let Some(modified) = document.modified {
-                let date: chrono::DateTime<chrono::Local> = modified.into();
-                rows.insert(
-                    2,
-                    (Message::EditorModified, date.format("%Y-%m-%d %H:%M").to_string()),
-                );
-            }
-            rows.push((
+            properties.push((Message::EditorSize, format!("{} B", document.size())));
+            properties.push((
                 Message::EditorEncodingLabel,
                 if document.invalid_encoding {
                     "—"
@@ -37,82 +29,162 @@ impl TextFileView {
                 } else {
                     "UTF-8"
                 }
-                .into(),
+                .to_owned(),
             ));
-            rows.push((
+            properties.push((
                 Message::EditorLineEnding,
-                if document.crlf { "CRLF" } else { "LF" }.into(),
+                if document.crlf { "CRLF" } else { "LF" }.to_owned(),
             ));
+            if let Some(modified) = document.modified() {
+                let date: chrono::DateTime<chrono::Local> = modified.into();
+                properties
+                    .push((Message::EditorModified, date.format("%Y-%m-%d %H:%M").to_string()));
+            }
         }
-        let path = self.path.clone();
-        let name = self.title.clone();
+        let section = |title, rows: Vec<(Message, String)>| {
+            v_flex()
+                .gap(px(4.0))
+                .mt(px(24.0))
+                .child(
+                    div()
+                        .mb(px(10.0))
+                        .text_size(px(design::SECONDARY_SIZE))
+                        .text_color(muted)
+                        .child(language.text(title)),
+                )
+                .children(rows.into_iter().map(|(label, value)| {
+                    h_flex()
+                        .w_full()
+                        .items_start()
+                        .gap_2()
+                        .py(px(5.0))
+                        .text_size(px(design::SECONDARY_SIZE))
+                        .child(div().flex_shrink_0().text_color(muted).child(language.text(label)))
+                        .child(div().flex_1().min_w_0().text_right().child(value))
+                }))
+        };
+        let path = self.source.display();
+        let name = self.path.file_name().unwrap_or_default().to_string_lossy().into_owned();
         let reveal = self.path.clone();
         let external = self.path.clone();
+        let action = |id: &'static str, icon: IconName, label: Message| {
+            Button::new(id).ghost().w_full().h(px(design::ACTION_HEIGHT)).px(px(6.0)).child(
+                h_flex()
+                    .debug_selector(move || id.to_owned())
+                    .w_full()
+                    .h_full()
+                    .gap(px(10.0))
+                    .text_size(px(design::SECONDARY_SIZE))
+                    .text_color(muted)
+                    .child(Icon::new(icon).size(px(design::ICON_SIZE)))
+                    .child(language.text(label)),
+            )
+        };
+        let actions = v_flex()
+            .gap(px(3.0))
+            .mt(px(24.0))
+            .pt(px(14.0))
+            .border_t_1()
+            .border_color(cx.theme().border)
+            .child(action("info-copy-path", IconName::Copy, Message::EditorCopyPath).on_click(
+                move |_, _, cx| {
+                    cx.write_to_clipboard(gpui::ClipboardItem::new_string(path.clone()))
+                },
+            ))
+            .child(action("info-copy-name", IconName::File, Message::EditorCopyName).on_click(
+                move |_, _, cx| {
+                    cx.write_to_clipboard(gpui::ClipboardItem::new_string(name.clone()))
+                },
+            ))
+            .when(!self.source.is_remote(), |panel| {
+                panel
+                    .child(
+                        action("info-reveal", IconName::FolderOpen, Message::EditorReveal)
+                            .on_click(move |_, _, _| {
+                                super::super::workspace::reveal_in_file_manager(&reveal)
+                            }),
+                    )
+                    .child(
+                        action("info-open", IconName::ExternalLink, Message::EditorOpenExternal)
+                            .on_click(move |_, _, _| {
+                                super::super::workspace::open_in_file_manager(&external)
+                            }),
+                    )
+            });
+        let body = v_flex()
+            .id("file-info-body")
+            .flex_1()
+            .min_h_0()
+            .px(px(design::PANEL_PADDING))
+            .py(px(22.0))
+            .overflow_y_scroll()
+            .child(
+                h_flex()
+                    .gap(px(10.0))
+                    .items_center()
+                    .child(
+                        div()
+                            .w(px(32.0))
+                            .h(px(38.0))
+                            .flex_shrink_0()
+                            .rounded(px(5.0))
+                            .border_1()
+                            .border_color(cx.theme().border)
+                            .bg(cx.theme().muted)
+                            .flex()
+                            .items_center()
+                            .justify_center()
+                            .text_size(px(10.0))
+                            .font_semibold()
+                            .text_color(muted)
+                            .child(kind.clone()),
+                    )
+                    .child(
+                        v_flex()
+                            .min_w_0()
+                            .gap(px(3.0))
+                            .child(
+                                div()
+                                    .text_size(px(design::CHROME_SIZE))
+                                    .font_semibold()
+                                    .child(self.title.clone()),
+                            )
+                            .child(
+                                div()
+                                    .text_size(px(design::SECONDARY_SIZE))
+                                    .text_color(muted)
+                                    .child(if self.markdown {
+                                        language.text(Message::EditorMarkdownDocument).to_owned()
+                                    } else {
+                                        kind
+                                    }),
+                            ),
+                    ),
+            )
+            .child(
+                div()
+                    .mt(px(12.0))
+                    .text_size(px(design::SECONDARY_SIZE))
+                    .line_height(gpui::relative(1.7))
+                    .text_color(muted)
+                    .child(self.source.display()),
+            )
+            .child(section(Message::EditorStatistics, statistics))
+            .child(section(Message::EditorProperties, properties))
+            .child(actions);
         v_flex()
             .id("file-info-panel")
-            .w(px(250.0))
-            .max_w(gpui::relative(0.38))
+            .relative()
+            .w(px(design::clamp_details_width(self.details_width)))
+            .min_w(px(design::DETAILS_MIN_WIDTH))
+            .max_w(gpui::relative(0.42))
             .h_full()
             .flex_shrink_0()
             .border_l_1()
             .border_color(cx.theme().border)
-            .p_3()
-            .gap_3()
-            .overflow_y_scroll()
-            .child(div().text_xs().font_semibold().child(language.text(Message::EditorInfo)))
-            .child(div().text_sm().font_semibold().child(self.title.clone()))
-            .child(div().text_xs().text_color(muted).child(self.path.display().to_string()))
-            .children(rows.into_iter().map(|(label, value)| {
-                h_flex()
-                    .w_full()
-                    .items_start()
-                    .gap_2()
-                    .text_xs()
-                    .child(div().flex_shrink_0().text_color(muted).child(language.text(label)))
-                    .child(div().flex_1().min_w_0().text_right().child(value))
-            }))
-            .child(
-                Button::new("info-copy-path")
-                    .ghost()
-                    .small()
-                    .justify_start()
-                    .label(language.text(Message::EditorCopyPath))
-                    .on_click(move |_, _, cx| {
-                        cx.write_to_clipboard(gpui::ClipboardItem::new_string(
-                            path.display().to_string(),
-                        ))
-                    }),
-            )
-            .child(
-                Button::new("info-copy-name")
-                    .ghost()
-                    .small()
-                    .justify_start()
-                    .label(language.text(Message::EditorCopyName))
-                    .on_click(move |_, _, cx| {
-                        cx.write_to_clipboard(gpui::ClipboardItem::new_string(name.clone()))
-                    }),
-            )
-            .child(
-                Button::new("info-reveal")
-                    .ghost()
-                    .small()
-                    .justify_start()
-                    .label(language.text(Message::EditorReveal))
-                    .on_click(move |_, _, _| {
-                        super::super::workspace::reveal_in_file_manager(&reveal)
-                    }),
-            )
-            .child(
-                Button::new("info-open")
-                    .ghost()
-                    .small()
-                    .justify_start()
-                    .label(language.text(Message::EditorOpenExternal))
-                    .on_click(move |_, _, _| {
-                        super::super::workspace::open_in_file_manager(&external)
-                    }),
-            )
+            .child(self.render_details_header(cx))
+            .child(body)
+            .child(self.render_details_resize_handle(cx))
             .into_any_element()
     }
 }
diff --git a/nebula_app/src/gpui_shell/file_editor/mod.rs b/nebula_app/src/gpui_shell/file_editor/mod.rs
index be33b49..dc5e6a6 100644
--- a/nebula_app/src/gpui_shell/file_editor/mod.rs
+++ b/nebula_app/src/gpui_shell/file_editor/mod.rs
@@ -1,29 +1,41 @@
 //! Editable local text files shared by Markdown and code tabs.
 
+mod chrome;
+mod code_actions;
+#[cfg(all(test, feature = "gpui-test-support"))]
+mod code_actions_tests;
 mod document;
+#[cfg(all(test, feature = "gpui-test-support"))]
+mod focus_tests;
 mod images;
 mod info;
 mod outline;
+mod outline_view;
+mod preview;
+mod reader_presentation;
+mod source;
 #[cfg(all(test, feature = "gpui-test-support"))]
 mod tests;
 
+use std::cell::RefCell;
 use std::path::PathBuf;
-use std::sync::Arc;
+use std::rc::Rc;
 use std::time::Duration;
 
 use gpui::prelude::*;
 use gpui::{
-    App, Context, Entity, EventEmitter, FocusHandle, Focusable, KeyBinding, ListAlignment,
-    ListState, MouseButton, Pixels, Point, PromptLevel, SharedString, Subscription, Task, Window,
-    actions, div, px,
+    App, Bounds, Context, Entity, EventEmitter, FocusHandle, Focusable, KeyBinding, ListAlignment,
+    ListState, MouseButton, MouseDownEvent, MouseMoveEvent, MouseUpEvent, Pixels, Point,
+    PromptLevel, ScrollHandle, SharedString, Subscription, Task, Window, actions, div, px,
 };
-use gpui_component::WindowExt as _;
-use gpui_component::text::{TextView, TextViewState, TextViewStyle};
+use gpui_component::text::TextViewState;
 
 use super::prelude::*;
 use crate::i18n::Message;
-use document::{Document, SaveError};
+use crate::ssh_sftp::document::{DocumentOperation, RemoteLocation};
+use document::SaveError;
 use outline::Outline;
+use source::{DocumentSource, LoadedDocument};
 
 actions!(file_editor, [SaveFile]);
 
@@ -41,6 +53,7 @@ pub(super) fn init(cx: &mut App) {
 pub enum TextFileEvent {
     Changed,
     SelectionContextMenuRequested { position: Point<Pixels>, text: String },
+    ReaderFocusChanged { focused: bool },
 }
 
 pub struct TextFileView {
@@ -48,7 +61,9 @@ pub struct TextFileView {
     pub title: String,
     input: Entity<InputState>,
     focus: FocusHandle,
-    document: Option<Document>,
+    source: DocumentSource,
+    document: Option<LoadedDocument>,
+    operation: Option<DocumentOperation>,
     dirty: bool,
     loading: bool,
     saving: bool,
@@ -58,8 +73,20 @@ pub struct TextFileView {
     show_details: bool,
     info: bool,
     outline: Outline,
-    blocks: Vec<Entity<TextViewState>>,
+    blocks: Rc<RefCell<Vec<Option<Entity<TextViewState>>>>>,
+    preview_extensions: gpui_component::text::MarkdownExtensions,
     scroll: ListState,
+    preview_bounds: Rc<RefCell<Bounds<Pixels>>>,
+    preview_selection_scroll_epoch: u64,
+    preview_selection_scroll_active: bool,
+    outline_scroll: ScrollHandle,
+    preview_scrollbar_hovered: bool,
+    outline_scrollbar_hovered: bool,
+    reader_focus: bool,
+    reader_focus_restore: Option<(bool, bool)>,
+    details_width: f32,
+    details_resize_anchor: Option<(f32, f32)>,
+    collapsed_headings: std::collections::HashSet<usize>,
     selected_heading: Option<usize>,
     all_selected: bool,
     revision: u64,
@@ -77,8 +104,39 @@ impl Focusable for TextFileView {
 
 impl TextFileView {
     pub fn new(path: PathBuf, window: &mut Window, cx: &mut Context<Self>) -> Self {
+        Self::new_with_source(DocumentSource::Local(path), window, cx)
+    }
+
+    pub(crate) fn new_remote(
+        location: RemoteLocation,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        Self::new_with_source(DocumentSource::Remote(location), window, cx)
+    }
+
+    pub(crate) fn source_label(&self) -> String {
+        self.source.display()
+    }
+
+    pub(crate) fn is_local_path(&self, path: &std::path::Path) -> bool {
+        matches!(&self.source, DocumentSource::Local(local) if local == path)
+    }
+
+    pub(crate) fn is_remote_location(&self, location: &RemoteLocation) -> bool {
+        matches!(&self.source, DocumentSource::Remote(remote) if remote == location)
+    }
+
+    fn new_with_source(
+        source: DocumentSource,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Self {
+        let path = source.path().to_owned();
         let language = super::code_tab::language_for_path(&path.to_string_lossy());
-        let markdown = matches!(language, "markdown");
+        // Remote Markdown is edited as source. It must not resolve remote image
+        // paths through the local document preview's filesystem loader.
+        let markdown = matches!(language, "markdown") && !source.is_remote();
         let input = cx.new(|cx| {
             InputState::new(window, cx)
                 .code_editor(language)
@@ -99,13 +157,21 @@ impl TextFileView {
                 cx.notify();
             }
         });
-        let title = path.file_name().unwrap_or_default().to_string_lossy().into_owned();
+        let name = path.file_name().unwrap_or_default().to_string_lossy().into_owned();
+        let title = match &source {
+            DocumentSource::Local(_) => name,
+            DocumentSource::Remote(location) => format!("{name} · {}", location.destination),
+        };
+        let preview_extensions = preview::extensions(path.parent().map(PathBuf::from));
         let mut this = Self {
+            preview_extensions,
             path,
             title,
             input,
             focus: cx.focus_handle(),
+            source,
             document: None,
+            operation: None,
             dirty: false,
             loading: false,
             saving: false,
@@ -115,8 +181,19 @@ impl TextFileView {
             show_details: markdown,
             info: false,
             outline: Outline::default(),
-            blocks: vec![],
+            blocks: Rc::default(),
             scroll: ListState::new(0, ListAlignment::Top, px(500.0)),
+            preview_bounds: Rc::default(),
+            preview_selection_scroll_epoch: 0,
+            preview_selection_scroll_active: false,
+            outline_scroll: ScrollHandle::new(),
+            preview_scrollbar_hovered: false,
+            outline_scrollbar_hovered: false,
+            reader_focus: false,
+            reader_focus_restore: None,
+            details_width: reader_presentation::OUTLINE_WIDTH,
+            details_resize_anchor: None,
+            collapsed_headings: Default::default(),
             selected_heading: None,
             all_selected: false,
             revision: 0,
@@ -138,6 +215,74 @@ impl TextFileView {
         self.saving
     }
 
+    pub(super) fn reader_focus(&self) -> bool {
+        self.reader_focus
+    }
+
+    /// Clear reader focus while switching tabs or closing a document. The
+    /// workspace owns the outer sidebar snapshot, so this method only restores
+    /// this document's own details panel and intentionally emits no event.
+    pub(super) fn clear_reader_focus(&mut self, cx: &mut Context<Self>) -> bool {
+        if !self.reader_focus {
+            return false;
+        }
+        self.reader_focus = false;
+        if let Some((show_details, info)) = self.reader_focus_restore.take() {
+            self.show_details = show_details;
+            self.info = info;
+        }
+        self.details_resize_anchor = None;
+        cx.notify();
+        true
+    }
+
+    fn toggle_reader_focus(&mut self, cx: &mut Context<Self>) {
+        if !self.markdown {
+            return;
+        }
+        if self.reader_focus {
+            self.clear_reader_focus(cx);
+        } else {
+            self.reader_focus = true;
+            self.reader_focus_restore = Some((self.show_details, self.info));
+            self.show_details = false;
+            self.details_resize_anchor = None;
+        }
+        cx.emit(TextFileEvent::ReaderFocusChanged { focused: self.reader_focus });
+        cx.notify();
+    }
+
+    fn begin_details_resize(&mut self, event: &MouseDownEvent, cx: &mut Context<Self>) {
+        if !self.show_details || !self.markdown {
+            return;
+        }
+        self.details_resize_anchor = Some((f32::from(event.position.x), self.details_width));
+        cx.notify();
+    }
+
+    fn update_details_resize(&mut self, event: &MouseMoveEvent, cx: &mut Context<Self>) {
+        let Some((start_x, start_width)) = self.details_resize_anchor else { return };
+        if event.pressed_button != Some(MouseButton::Left) {
+            self.details_resize_anchor = None;
+            cx.notify();
+            return;
+        }
+        // The divider is on the panel's left edge: moving left grows the panel.
+        let width = reader_presentation::clamp_details_width(
+            start_width + (start_x - f32::from(event.position.x)),
+        );
+        if (width - self.details_width).abs() >= 0.5 {
+            self.details_width = width;
+            cx.notify();
+        }
+    }
+
+    fn finish_details_resize(&mut self, _event: &MouseUpEvent, cx: &mut Context<Self>) {
+        if self.details_resize_anchor.take().is_some() {
+            cx.notify();
+        }
+    }
+
     pub fn tab_title(&self) -> String {
         if self.dirty { format!("{} •", self.title) } else { self.title.clone() }
     }
@@ -155,9 +300,16 @@ impl TextFileView {
         self.revision += 1;
         self.preview_task = None;
         let path = self.path.clone();
+        let source = self.source.clone();
+        let operation = DocumentOperation::default();
+        if let Some(previous) = self.operation.replace(operation.clone()) {
+            previous.cancel();
+        }
         let markdown = self.markdown;
+        let resources = super::scientific_render::assets(cx);
         let task = cx.background_executor().spawn(async move {
-            Document::load(&path).map(|doc| {
+            let _permit = resources.document_permit().await;
+            source.load(operation).await.map(|doc| {
                 let outline = markdown
                     .then(|| Outline::parse(&images::rewrite_doc_images(&doc.text, path.parent())));
                 (doc, outline)
@@ -169,6 +321,7 @@ impl TextFileView {
             let _ = handle.update(cx, |_, window, cx| {
                 let _ = this.update(cx, |view, cx| {
                     view.loading = false;
+                    view.operation = None;
                     match loaded {
                         Ok((document, outline)) => {
                             view.input.update(cx, |input, cx| {
@@ -182,7 +335,11 @@ impl TextFileView {
                             }
                         },
                         Err(error) => {
-                            view.notice = Some((Message::EditorReadFailed, Some(error.to_string())))
+                            view.notice = Some(if error.kind() == std::io::ErrorKind::Interrupted {
+                                (Message::TransferCancelled, None)
+                            } else {
+                                (Message::EditorReadFailed, Some(error.to_string()))
+                            })
                         },
                     }
                     cx.emit(TextFileEvent::Changed);
@@ -206,7 +363,7 @@ impl TextFileView {
         let answer = window.prompt(
             PromptLevel::Warning,
             language.text(Message::EditorDiscardTitle),
-            Some(&self.path.display().to_string()),
+            Some(&self.source.display()),
             &[language.text(Message::EditorCancel), language.text(Message::EditorDiscard)],
             cx,
         );
@@ -233,15 +390,20 @@ impl TextFileView {
         }
         let Some(document) = self.document.clone() else { return Task::ready(false) };
         let text = self.input.read(cx).value().to_string();
-        let path = self.path.clone();
+        let source = self.source.clone();
+        let operation = DocumentOperation::default();
+        self.operation = Some(operation.clone());
         self.saving = true;
         self.notice = None;
-        let task = cx.background_executor().spawn(async move { document.save(&path, text) });
+        let task = cx
+            .background_executor()
+            .spawn(async move { document.save(source, text, operation).await });
         cx.notify();
         cx.spawn(async move |this, cx| {
             let result = task.await;
             this.update(cx, |view, cx| {
                 view.saving = false;
+                view.operation = None;
                 let success = match result {
                     Ok(document) => {
                         view.dirty = view.input.read(cx).value().as_ref() != document.text;
@@ -253,6 +415,11 @@ impl TextFileView {
                         view.notice = Some(match error {
                             SaveError::Changed => (Message::EditorConflict, None),
                             SaveError::ReadOnly => (Message::EditorReadOnly, None),
+                            SaveError::Io(error)
+                                if error.kind() == std::io::ErrorKind::Interrupted =>
+                            {
+                                (Message::TransferCancelled, None)
+                            },
                             SaveError::Io(error) => {
                                 (Message::EditorSaveFailed, Some(error.to_string()))
                             },
@@ -272,6 +439,7 @@ impl TextFileView {
         self.revision += 1;
         let revision = self.revision;
         let executor = cx.background_executor().clone();
+        let resources = super::scientific_render::assets(cx);
         self.preview_task = Some(cx.spawn(async move |this, cx| {
             executor.timer(Duration::from_millis(250)).await;
             let Ok((source, path)) =
@@ -281,6 +449,7 @@ impl TextFileView {
             };
             let outline = executor
                 .spawn(async move {
+                    let _permit = resources.document_permit().await;
                     Outline::parse(&images::rewrite_doc_images(&source, path.parent()))
                 })
                 .await;
@@ -293,18 +462,28 @@ impl TextFileView {
     }
 
     fn apply_outline(&mut self, outline: Outline, cx: &mut Context<Self>) {
-        self.blocks = outline
-            .blocks
-            .iter()
-            .map(|text| cx.new(|cx| TextViewState::markdown(text, cx)))
-            .collect();
-        self.scroll.reset(self.blocks.len());
+        self.blocks = Rc::new(RefCell::new(vec![None; outline.blocks.len()]));
+        self.scroll.reset(outline.blocks.len());
         self.outline = outline;
+        self.collapsed_headings.clear();
         self.selected_heading = None;
         self.all_selected = false;
         cx.notify();
     }
 
+    fn toggle_preview(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        self.preview = !self.preview;
+        if !self.preview {
+            self.stop_preview_selection_scroll();
+            for block in self.blocks.borrow_mut().iter_mut() {
+                *block = None;
+            }
+            self.all_selected = false;
+            self.input.update(cx, |input, cx| input.focus(window, cx));
+        }
+        cx.notify();
+    }
+
     fn jump_to_heading(&mut self, index: usize, window: &mut Window, cx: &mut Context<Self>) {
         let Some(heading) = self.outline.headings.get(index) else { return };
         self.selected_heading = Some(index);
@@ -323,87 +502,14 @@ impl TextFileView {
         }
         cx.notify();
     }
-
-    fn render_outline(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
-        let language = super::config::ui_language(cx);
-        let muted = cx.theme().muted_foreground;
-        v_flex()
-            .id("markdown-outline")
-            .w(px(210.0))
-            .min_w(px(110.0))
-            .max_w(gpui::relative(0.32))
-            .h_full()
-            .flex_shrink_0()
-            .border_l_1()
-            .border_color(cx.theme().border)
-            .child(
-                div().p_3().text_xs().font_semibold().child(language.text(Message::EditorOutline)),
-            )
-            .child(
-                v_flex()
-                    .id("markdown-headings")
-                    .flex_1()
-                    .min_h_0()
-                    .overflow_y_scroll()
-                    .px_2()
-                    .when(self.outline.headings.is_empty(), |list| {
-                        list.child(
-                            div()
-                                .text_xs()
-                                .text_color(muted)
-                                .child(language.text(Message::EditorNoHeadings)),
-                        )
-                    })
-                    .children(self.outline.headings.iter().enumerate().map(|(index, heading)| {
-                        let copied = heading.label.clone();
-                        div()
-                            .id(("markdown-heading", index))
-                            .min_h(px(28.0))
-                            .py_1()
-                            .pr_2()
-                            .pl(px(8.0 + heading.depth.saturating_sub(1) as f32 * 12.0))
-                            .rounded_md()
-                            .text_xs()
-                            .cursor_pointer()
-                            .text_color(if self.selected_heading == Some(index) {
-                                cx.theme().link
-                            } else {
-                                muted
-                            })
-                            .hover(|style| style.bg(cx.theme().list_hover))
-                            .child(heading.label.clone())
-                            .on_click(cx.listener(move |this, _, window, cx| {
-                                this.jump_to_heading(index, window, cx)
-                            }))
-                            .context_menu(move |menu, _, _| {
-                                let copied = copied.clone();
-                                menu.item(
-                                    gpui_component::menu::PopupMenuItem::new(
-                                        language.text(Message::EditorCopyHeading),
-                                    )
-                                    .icon(IconName::Copy)
-                                    .on_click(
-                                        move |_, _, cx| {
-                                            cx.write_to_clipboard(gpui::ClipboardItem::new_string(
-                                                copied.clone(),
-                                            ));
-                                        },
-                                    ),
-                                )
-                            })
-                    })),
-            )
-            .into_any_element()
-    }
 }
 
 impl Render for TextFileView {
-    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
         let language = super::config::ui_language(cx);
         let muted = cx.theme().muted_foreground;
         let editable = !self.loading && self.document.as_ref().is_some_and(|doc| !doc.read_only);
-        let path = self.path.display().to_string();
-        let notice = if self.loading {
+        let mut notice = if self.loading {
             Some(language.text(Message::EditorLoading).to_owned())
         } else if let Some((message, error)) = &self.notice {
             Some(language.format(*message, &[("error", error.as_deref().unwrap_or_default())]))
@@ -421,48 +527,14 @@ impl Render for TextFileView {
                 Some(language.text(message).to_owned())
             })
         };
+        if self.preview && self.outline.limited {
+            let detail = language.text(Message::EditorPreviewLimited);
+            notice = Some(
+                notice.map_or_else(|| detail.to_owned(), |notice| format!("{notice} {detail}")),
+            );
+        }
         let content = if self.preview {
-            let blocks = self.blocks.clone();
-            let style = TextViewStyle {
-                image_base: self.path.parent().map(Arc::from),
-                highlight_theme: cx.theme().highlight_theme.clone(),
-                is_dark: cx.theme().is_dark(),
-                ..Default::default()
-            };
-            div()
-                .flex_1()
-                .min_w_0()
-                .h_full()
-                .px_4()
-                .on_mouse_down(
-                    MouseButton::Right,
-                    cx.listener(|_, event: &gpui::MouseDownEvent, window, cx| {
-                        let text = window.selected_text(cx).to_string();
-                        if !text.trim().is_empty() {
-                            cx.emit(TextFileEvent::SelectionContextMenuRequested {
-                                position: event.position,
-                                text,
-                            });
-                            cx.stop_propagation();
-                        }
-                    }),
-                )
-                .child(
-                    gpui::list(self.scroll.clone(), move |index, _, _| {
-                        div()
-                            .w_full()
-                            .py_1()
-                            .child(
-                                TextView::new(&blocks[index])
-                                    .selectable(true)
-                                    .scrollable(false)
-                                    .style(style.clone()),
-                            )
-                            .into_any_element()
-                    })
-                    .size_full(),
-                )
-                .into_any_element()
+            self.render_markdown_preview(cx)
         } else {
             div()
                 .flex_1()
@@ -488,14 +560,32 @@ impl Render for TextFileView {
             .key_context("FileEditor")
             .track_focus(&self.focus)
             .size_full()
+            .relative()
             .overflow_hidden()
+            .on_mouse_move(cx.listener(|this, event: &MouseMoveEvent, _, cx| {
+                // GPUI can deliver a move after the pointer leaves the
+                // divider with no pressed button. Clear only an active resize;
+                // normal reader selection remains untouched.
+                if this.details_resize_anchor.is_some()
+                    && event.pressed_button != Some(MouseButton::Left)
+                {
+                    this.details_resize_anchor = None;
+                    cx.notify();
+                }
+            }))
+            .capture_any_mouse_up(cx.listener(|this, event: &MouseUpEvent, _, cx| {
+                if this.details_resize_anchor.is_some() && event.button == MouseButton::Left {
+                    this.finish_details_resize(event, cx);
+                    cx.stop_propagation();
+                }
+            }))
             .on_action(cx.listener(|this, _: &SaveFile, _, cx| {
                 this.save(cx).detach();
             }))
             .when(self.preview, |root| {
                 root.capture_action(cx.listener(
                     |this, _: &gpui_component::input::SelectAll, _, cx| {
-                        for block in &this.blocks {
+                        for block in this.blocks.borrow().iter().flatten() {
                             block.update(cx, |state, cx| state.select_all(cx));
                         }
                         this.all_selected = true;
@@ -505,12 +595,8 @@ impl Render for TextFileView {
                 ))
                 .capture_action(cx.listener(|this, _: &gpui_component::input::Copy, _, cx| {
                     if this.all_selected {
-                        let text = this
-                            .blocks
-                            .iter()
-                            .map(|block| block.read(cx).selected_text())
-                            .collect::<Vec<_>>()
-                            .join("\n\n");
+                        // Do not materialize off-screen preview blocks for copy.
+                        let text = this.input.read(cx).value().to_string();
                         cx.write_to_clipboard(gpui::ClipboardItem::new_string(text));
                         cx.stop_propagation();
                     } else {
@@ -525,94 +611,7 @@ impl Render for TextFileView {
                     }),
                 )
             })
-            .child(
-                h_flex()
-                    .h(px(36.0))
-                    .flex_shrink_0()
-                    .px_3()
-                    .gap_2()
-                    .border_b_1()
-                    .border_color(cx.theme().border)
-                    .child(
-                        div().flex_1().min_w_0().truncate().text_xs().text_color(muted).child(path),
-                    )
-                    .when(self.dirty, |bar| {
-                        bar.child(
-                            div()
-                                .text_xs()
-                                .text_color(cx.theme().warning)
-                                .child(language.text(Message::EditorUnsaved)),
-                        )
-                    })
-                    .when(self.markdown, |bar| {
-                        bar.child(
-                            Button::new("file-toggle-preview")
-                                .ghost()
-                                .xsmall()
-                                .label(language.text(if self.preview {
-                                    Message::EditorEdit
-                                } else {
-                                    Message::EditorPreview
-                                }))
-                                .on_click(cx.listener(|this, _, window, cx| {
-                                    this.preview = !this.preview;
-                                    if !this.preview {
-                                        this.input.update(cx, |input, cx| input.focus(window, cx));
-                                    }
-                                    cx.notify();
-                                })),
-                        )
-                        .child(
-                            Button::new("file-toggle-outline")
-                                .ghost()
-                                .xsmall()
-                                .selected(self.show_details)
-                                .label(language.text(Message::EditorOutline))
-                                .on_click(cx.listener(|this, _, _, cx| {
-                                    this.show_details = !this.show_details || this.info;
-                                    this.info = false;
-                                    cx.notify();
-                                })),
-                        )
-                    })
-                    .child(
-                        Button::new("file-info")
-                            .ghost()
-                            .xsmall()
-                            .label(language.text(Message::EditorInfo))
-                            .selected(self.show_details && self.info)
-                            .on_click(cx.listener(|this, _, _, cx| {
-                                this.show_details = !this.show_details || !this.info;
-                                this.info = true;
-                                cx.notify();
-                            })),
-                    )
-                    .child(
-                        Button::new("file-reload")
-                            .ghost()
-                            .xsmall()
-                            .icon(IconName::Redo2)
-                            .tooltip(language.text(Message::EditorReload))
-                            .disabled(self.saving || self.loading)
-                            .on_click(
-                                cx.listener(|this, _, window, cx| this.request_reload(window, cx)),
-                            ),
-                    )
-                    .child(
-                        Button::new("file-save")
-                            .small()
-                            .label(language.text(if self.saving {
-                                Message::EditorSaving
-                            } else {
-                                Message::EditorSave
-                            }))
-                            .tooltip(language.text(Message::EditorSaveShortcut))
-                            .disabled(!editable || !self.dirty || self.saving)
-                            .on_click(cx.listener(|this, _, _, cx| {
-                                this.save(cx).detach();
-                            })),
-                    ),
-            )
+            .child(self.render_toolbar(editable, window, cx))
             .when_some(notice, |root, notice| {
                 root.child(div().px_3().py_1().text_xs().text_color(muted).child(notice))
             })
@@ -626,5 +625,32 @@ impl Render for TextFileView {
                     })
                 },
             ))
+            .when(self.details_resize_anchor.is_some(), |root| {
+                root.child(
+                    div()
+                        .id("file-details-resize-overlay")
+                        .absolute()
+                        .inset_0()
+                        .occlude()
+                        .cursor_col_resize()
+                        .on_mouse_move(cx.listener(|this, event: &MouseMoveEvent, _, cx| {
+                            this.update_details_resize(event, cx);
+                        }))
+                        .on_mouse_up(
+                            MouseButton::Left,
+                            cx.listener(|this, event: &MouseUpEvent, _, cx| {
+                                this.finish_details_resize(event, cx);
+                            }),
+                        ),
+                )
+            })
+    }
+}
+
+impl Drop for TextFileView {
+    fn drop(&mut self) {
+        if let Some(operation) = &self.operation {
+            operation.cancel();
+        }
     }
 }
diff --git a/nebula_app/src/gpui_shell/file_editor/outline.rs b/nebula_app/src/gpui_shell/file_editor/outline.rs
index 9e2e110..af9f442 100644
--- a/nebula_app/src/gpui_shell/file_editor/outline.rs
+++ b/nebula_app/src/gpui_shell/file_editor/outline.rs
@@ -2,6 +2,10 @@
 //! Split only at root block boundaries; fenced code, lists and quotes remain intact.
 
 use markdown::mdast::Node;
+use std::collections::{HashMap, HashSet};
+
+const MAX_PREVIEW_BYTES: usize = 512 * 1024;
+const MAX_BLOCK_BYTES: usize = 32 * 1024;
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub(super) struct Heading {
@@ -9,36 +13,136 @@ pub(super) struct Heading {
     pub(super) depth: u8,
     pub(super) row: u32,
     pub(super) block: usize,
+    pub(super) number: String,
+    pub(super) parent: Option<usize>,
+    pub(super) indent: usize,
+    text_offset: Option<usize>,
+}
+
+impl Heading {
+    fn prefix(&self) -> String {
+        let token = self.label.split_whitespace().next().unwrap_or_default();
+        let numeric = token.trim_end_matches(['.', '、']);
+        let authored = (token.contains('.') || token.ends_with('、'))
+            && numeric
+                .split('.')
+                .all(|part| !part.is_empty() && part.bytes().all(|b| b.is_ascii_digit()));
+        if authored { String::new() } else { format!("{} ", self.number) }
+    }
+
+    pub(super) fn display_label(&self) -> String {
+        format!("{}{}", self.prefix(), self.label)
+    }
 }
 
 #[derive(Default)]
 pub(super) struct Outline {
     pub(super) headings: Vec<Heading>,
     pub(super) blocks: Vec<String>,
+    pub(super) limited: bool,
+    definitions: HashMap<String, (String, Vec<String>)>,
+    references: Vec<Vec<String>>,
+    heading_ranges: Vec<std::ops::Range<usize>>,
 }
 
 impl Outline {
+    fn block_headings(&self, block: usize) -> &[Heading] {
+        self.heading_ranges.get(block).map_or(&[], |range| &self.headings[range.clone()])
+    }
+
+    pub(super) fn block_source(&self, index: usize) -> String {
+        let Some(block) = self.blocks.get(index) else { return String::new() };
+        let Some(definitions) = self.reference_sources(index) else {
+            return literal_preview(block);
+        };
+        let mut text = block.clone();
+        for heading in self.block_headings(index).iter().rev() {
+            if let Some(offset) =
+                heading.text_offset.filter(|offset| text.is_char_boundary(*offset))
+            {
+                text.insert_str(offset, &heading.prefix());
+            }
+        }
+        for definition in definitions {
+            text.push_str("\n\n");
+            text.push_str(definition);
+        }
+        text
+    }
+
+    fn reference_sources(&self, index: usize) -> Option<Vec<&str>> {
+        let mut bytes = self.blocks.get(index)?.len();
+        bytes += self
+            .block_headings(index)
+            .iter()
+            .filter(|h| h.text_offset.is_some())
+            .map(|h| h.prefix().len())
+            .sum::<usize>();
+        if bytes > MAX_BLOCK_BYTES {
+            return None;
+        }
+        let mut result = Vec::new();
+        let mut visited = HashSet::new();
+        let mut pending: Vec<&str> =
+            self.references.get(index).into_iter().flatten().map(String::as_str).collect();
+        while let Some(reference) = pending.pop() {
+            if !visited.insert(reference) {
+                continue;
+            }
+            if let Some((definition, references)) = self.definitions.get(reference) {
+                bytes = bytes.saturating_add(definition.len() + 2);
+                if bytes > MAX_BLOCK_BYTES {
+                    return None;
+                }
+                result.push(definition.as_str());
+                pending.extend(references.iter().map(String::as_str));
+            }
+        }
+        Some(result)
+    }
+
     pub(super) fn parse(source: &str) -> Self {
+        let limited = source.len() > MAX_PREVIEW_BYTES;
+        let source = &source[..source.floor_char_boundary(MAX_PREVIEW_BYTES.min(source.len()))];
         let mut options = markdown::ParseOptions::gfm();
         options.constructs.math_flow = true;
         options.constructs.math_text = true;
         let Ok(Node::Root(root)) = markdown::to_mdast(source, &options) else {
-            return Self { headings: vec![], blocks: vec![source.to_owned()] };
+            return Self {
+                headings: vec![],
+                blocks: vec![source.to_owned()],
+                limited,
+                ..Self::default()
+            };
         };
         // Resolve reference links/images from any part of the original document.
         let definitions = root
             .children
             .iter()
             .filter_map(|node| {
-                if !matches!(node, Node::Definition(_) | Node::FootnoteDefinition(_)) {
+                if limited && node.position().is_some_and(|p| p.end.offset == source.len()) {
                     return None;
                 }
+                let key = match node {
+                    Node::Definition(definition) => {
+                        format!("link:{}", identifier(&definition.identifier))
+                    },
+                    Node::FootnoteDefinition(definition) => {
+                        format!("note:{}", identifier(&definition.identifier))
+                    },
+                    _ => return None,
+                };
                 let position = node.position()?;
-                source.get(position.start.offset..position.end.offset)
+                let text = source.get(position.start.offset..position.end.offset)?.to_owned();
+                let mut references = Vec::new();
+                collect_references(node, &mut references);
+                Some((key, (text, references)))
             })
-            .collect::<Vec<_>>()
-            .join("\n\n");
-        let mut result = Self::default();
+            .fold(HashMap::new(), |mut definitions, (key, value)| {
+                definitions.entry(key).or_insert(value);
+                definitions
+            });
+        let mut result = Self { definitions, limited, ..Self::default() };
         for node in &root.children {
             if matches!(node, Node::Definition(_) | Node::FootnoteDefinition(_)) {
                 continue;
@@ -47,15 +151,145 @@ impl Outline {
             let Some(text) = source.get(position.start.offset..position.end.offset) else {
                 continue;
             };
-            collect_headings(node, result.blocks.len(), &mut result.headings);
-            result.blocks.push(if definitions.is_empty() {
-                text.to_owned()
+            let heading_start = result.headings.len();
+            collect_headings(
+                node,
+                result.blocks.len(),
+                position.start.offset,
+                &mut result.headings,
+            );
+            result.heading_ranges.push(heading_start..result.headings.len());
+            let mut references = Vec::new();
+            collect_references(node, &mut references);
+            result.references.push(references);
+            let unfinished =
+                limited && node.position().is_some_and(|p| p.end.offset == source.len());
+            if unfinished || text.len() > MAX_BLOCK_BYTES {
+                result.limited = true;
+                result.references.last_mut().unwrap().clear();
+                result.blocks.push(literal_preview(text));
             } else {
-                format!("{text}\n\n{definitions}")
-            });
+                result.blocks.push(text.to_owned());
+            }
         }
+        number_headings(&mut result.headings);
+        let references_limited =
+            (0..result.blocks.len()).any(|index| result.reference_sources(index).is_none());
+        result.limited |= references_limited;
         result
     }
+
+    pub(super) fn visible_headings<'a>(
+        &'a self,
+        collapsed: &'a HashSet<usize>,
+    ) -> impl Iterator<Item = (usize, &'a Heading)> + 'a {
+        let mut hidden_below = None;
+        self.headings.iter().enumerate().filter(move |(index, heading)| {
+            if hidden_below.is_some_and(|depth| heading.depth > depth) {
+                return false;
+            }
+            hidden_below = collapsed.contains(index).then_some(heading.depth);
+            true
+        })
+    }
+
+    pub(super) fn has_children(&self, index: usize) -> bool {
+        self.headings.get(index + 1).is_some_and(|next| next.parent == Some(index))
+    }
+
+    /// Map code-action offsets from numbered presentation back to its raw block.
+    pub(super) fn source_span(
+        &self,
+        block: usize,
+        start: usize,
+        end: usize,
+    ) -> Option<(usize, usize)> {
+        let map = |offset: usize| {
+            let mut added = 0;
+            for heading in self.block_headings(block) {
+                let Some(at) = heading.text_offset else { continue };
+                let length = heading.prefix().len();
+                if offset < at + added {
+                    break;
+                }
+                if offset < at + added + length {
+                    return None;
+                }
+                added += length;
+            }
+            offset.checked_sub(added)
+        };
+        Some((map(start)?, map(end)?))
+    }
+
+    pub(super) fn replace_block(&mut self, block: usize, next: String, changed_end: usize) {
+        let Some(source) = self.blocks.get_mut(block) else { return };
+        let delta = next.len() as isize - source.len() as isize;
+        *source = next;
+        if let Some(range) = self.heading_ranges.get(block) {
+            for heading in &mut self.headings[range.clone()] {
+                if let Some(offset) = heading.text_offset.filter(|offset| *offset >= changed_end) {
+                    heading.text_offset = offset.checked_add_signed(delta);
+                }
+            }
+        }
+    }
+}
+
+fn number_headings(headings: &mut [Heading]) {
+    let mut stack: Vec<(usize, u32)> = Vec::new();
+    let mut roots = 0;
+    for index in 0..headings.len() {
+        while stack
+            .last()
+            .is_some_and(|(parent, _)| headings[*parent].depth >= headings[index].depth)
+        {
+            stack.pop();
+        }
+        let (parent, number) = if let Some((parent, children)) = stack.last_mut() {
+            *children += 1;
+            (Some(*parent), format!("{}.{}", headings[*parent].number, children))
+        } else {
+            roots += 1;
+            (None, roots.to_string())
+        };
+        headings[index].parent = parent;
+        headings[index].indent = stack.len();
+        headings[index].number = number;
+        stack.push((index, 0));
+    }
+}
+
+fn literal_preview(source: &str) -> String {
+    let end = source.floor_char_boundary(MAX_BLOCK_BYTES.min(source.len()));
+    let source = &source[..end];
+    let fence =
+        "`".repeat(source.split(|ch| ch != '`').map(str::len).max().unwrap_or(0).max(2) + 1);
+    format!("{fence}text\n{source}\n{fence}")
+}
+
+fn identifier(value: &str) -> String {
+    value.split_whitespace().collect::<Vec<_>>().join(" ").to_uppercase()
+}
+
+fn collect_references(node: &Node, output: &mut Vec<String>) {
+    match node {
+        Node::LinkReference(reference) => {
+            output.push(format!("link:{}", identifier(&reference.identifier)))
+        },
+        Node::ImageReference(reference) => {
+            output.push(format!("link:{}", identifier(&reference.identifier)))
+        },
+        Node::FootnoteReference(reference) => {
+            output.push(format!("note:{}", identifier(&reference.identifier)))
+        },
+        _ => {},
+    }
+    if let Some(children) = node.children() {
+        for child in children {
+            collect_references(child, output);
+        }
+    }
 }
 
 fn label(node: &Node, text: &mut String) {
@@ -76,7 +310,7 @@ fn label(node: &Node, text: &mut String) {
     }
 }
 
-fn collect_headings(node: &Node, block: usize, headings: &mut Vec<Heading>) {
+fn collect_headings(node: &Node, block: usize, block_start: usize, headings: &mut Vec<Heading>) {
     if let Node::Heading(heading) = node {
         let mut text = String::new();
         label(node, &mut text);
@@ -85,11 +319,19 @@ fn collect_headings(node: &Node, block: usize, headings: &mut Vec<Heading>) {
             depth: heading.depth,
             row: heading.position.as_ref().map_or(0, |p| p.start.line.saturating_sub(1) as u32),
             block,
+            number: String::new(),
+            parent: None,
+            indent: 0,
+            text_offset: heading
+                .children
+                .first()
+                .and_then(Node::position)
+                .and_then(|position| position.start.offset.checked_sub(block_start)),
         });
     }
     if let Some(children) = node.children() {
         for child in children {
-            collect_headings(child, block, headings);
+            collect_headings(child, block, block_start, headings);
         }
     }
 }
@@ -98,6 +340,46 @@ fn collect_headings(node: &Node, block: usize, headings: &mut Vec<Heading>) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn numbering_and_nested_folds_share_one_tree_without_rewriting_source() {
+        let source = "# First\n\n## Sub\n\n### Deep\n\n## Other\n\n# Next\n";
+        let outline = Outline::parse(source);
+        assert_eq!(
+            outline.headings.iter().map(|h| h.number.as_str()).collect::<Vec<_>>(),
+            ["1", "1.1", "1.1.1", "1.2", "2"]
+        );
+        assert_eq!(outline.blocks[0], "# First");
+        assert_eq!(outline.block_source(0), "# 1 First");
+        assert_eq!(outline.headings[1].display_label(), "1.1 Sub");
+        let mut collapsed = HashSet::from([0, 1]);
+        assert_eq!(
+            outline.visible_headings(&collapsed).map(|(i, _)| i).collect::<Vec<_>>(),
+            [0, 4]
+        );
+        collapsed.remove(&0);
+        assert_eq!(
+            outline.visible_headings(&collapsed).map(|(i, _)| i).collect::<Vec<_>>(),
+            [0, 1, 3, 4]
+        );
+        assert!(outline.has_children(1));
+        assert!(!outline.has_children(2));
+    }
+
+    #[test]
+    fn numbering_preserves_setext_and_inline_markup_and_maps_action_offsets() {
+        let outline = Outline::parse(
+            "Title\n===\n\n## **Bold**\n\n> ### Quote\n>\n> ```rust\n> old\n> ```\n",
+        );
+        assert_eq!(outline.block_source(0), "1 Title\n===");
+        assert_eq!(outline.block_source(1), "## 1.1 **Bold**");
+        let shown = outline.block_source(2);
+        assert!(shown.starts_with("> ### 1.1.1 Quote"));
+        let displayed = shown.find("```rust").unwrap();
+        let raw = outline.blocks[2].find("```rust").unwrap();
+        assert_eq!(outline.source_span(2, displayed, displayed + 7), Some((raw, raw + 7)));
+        assert_eq!(Outline::parse("# 1. Existing").block_source(0), "# 1. Existing");
+    }
+
     #[test]
     fn headings_keep_hierarchy_source_rows_and_duplicate_targets() {
         let outline = Outline::parse(
@@ -119,7 +401,70 @@ mod tests {
         assert_eq!(outline.headings[0].label, "linked");
         assert_eq!(outline.headings[0].block, 0);
         assert!(outline.blocks[0].starts_with("> ##"));
-        assert!(outline.blocks[0].contains("[ref]: https://example.com"));
-        assert!(outline.blocks[1].contains("[img]: images/test.png"));
+        assert!(outline.block_source(0).contains("[ref]: https://example.com"));
+        assert!(outline.block_source(1).contains("[img]: images/test.png"));
+    }
+}
+
+#[cfg(test)]
+mod resource_tests {
+    use super::*;
+    #[test]
+    fn unrelated_reference_definitions_are_not_copied_into_every_block() {
+        let mut source = (0..500).map(|id| format!("paragraph {id}\n\n")).collect::<String>();
+        source.push_str("![selected][img-499]\n\n");
+        for id in 0..500 {
+            source.push_str(&format!("[img-{id}]: local-{id}.png\n"));
+        }
+        let outline = Outline::parse(&source);
+        assert!(outline.block_source(0).len() < 30);
+        let referenced = outline.block_source(outline.blocks.len() - 1);
+        assert!(referenced.contains("local-499.png"));
+        assert!(!referenced.contains("local-0.png"));
+        assert!(outline.blocks.iter().map(String::len).sum::<usize>() < source.len());
+    }
+}
+
+#[cfg(test)]
+mod preview_budget_tests {
+    use super::*;
+    #[test]
+    fn large_document_is_bounded_before_ast_construction_and_partial_math_is_literal() {
+        let source = "paragraph\n\n".repeat(MAX_PREVIEW_BYTES / 11 + 100);
+        let outline = Outline::parse(&source);
+        assert!(outline.limited);
+        assert!(outline.blocks.iter().map(String::len).sum::<usize>() <= MAX_PREVIEW_BYTES + 128);
+        let source = format!("$$\n{}\n$$", "x+".repeat(MAX_BLOCK_BYTES));
+        let outline = Outline::parse(&source);
+        assert!(outline.limited);
+        assert!(outline.blocks[0].starts_with("```text"));
+    }
+
+    #[test]
+    fn first_reference_definition_keeps_markdown_precedence() {
+        let outline = Outline::parse("[label][ref]\n\n[ref]: first.png\n[ref]: second.png\n");
+        assert!(outline.block_source(0).contains("first.png"));
+        assert!(!outline.block_source(0).contains("second.png"));
+    }
+}
+
+#[cfg(test)]
+mod reference_budget_tests {
+    use super::*;
+    #[test]
+    fn transitive_footnotes_cannot_bypass_the_preview_block_budget() {
+        let mut source = String::from("body[^n0]\n\n");
+        for index in 0..100 {
+            source.push_str(&format!(
+                "[^n{index}]: {} [^n{}]\n\n",
+                "x".repeat(512),
+                (index + 1) % 100
+            ));
+        }
+        let outline = Outline::parse(&source);
+        assert!(outline.limited);
+        let preview = outline.block_source(0);
+        assert!(preview.starts_with("```text"));
+        assert!(preview.len() < 128);
     }
 }
diff --git a/nebula_app/src/gpui_shell/file_editor/outline_view.rs b/nebula_app/src/gpui_shell/file_editor/outline_view.rs
new file mode 100644
index 0000000..f7bd6e8
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/outline_view.rs
@@ -0,0 +1,156 @@
+//! Document navigation belongs to Pebrel: numbering, folding and row feedback
+//! share the same heading model as the reader and source navigation.
+
+use super::*;
+use gpui_component::Sizable as _;
+
+impl TextFileView {
+    pub(super) fn render_outline(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let language = super::super::config::ui_language(cx);
+        let scroll = self.outline_scroll.clone();
+        let headings = v_flex()
+            .id("markdown-headings")
+            .debug_selector(|| "markdown-outline-list".to_owned())
+            .size_full()
+            .min_h_0()
+            .overflow_y_scroll()
+            .track_scroll(&scroll)
+            .px_2()
+            .pr(px(18.0))
+            .py_2()
+            .when(self.outline.headings.is_empty(), |list| {
+                list.child(
+                    div()
+                        .text_xs()
+                        .text_color(cx.theme().muted_foreground)
+                        .child(language.text(Message::EditorNoHeadings)),
+                )
+            })
+            .children(self.outline.visible_headings(&self.collapsed_headings).map(
+                |(index, heading)| {
+                    let collapsed = self.collapsed_headings.contains(&index);
+                    let copied = heading.label.clone();
+                    let slot = || {
+                        div()
+                            .w(px(20.0))
+                            .h(px(28.0))
+                            .flex_shrink_0()
+                            .flex()
+                            .items_center()
+                            .justify_center()
+                    };
+                    let arrow = if self.outline.has_children(index) {
+                        slot()
+                            .id(("outline-fold", index))
+                            .cursor_pointer()
+                            .debug_selector(move || format!("outline-fold-{index}"))
+                            .child(
+                                Icon::new(if collapsed {
+                                    IconName::ChevronRight
+                                } else {
+                                    IconName::ChevronDown
+                                })
+                                .size(px(12.0)),
+                            )
+                            .on_mouse_down(MouseButton::Left, |_, _, cx| {
+                                gpui_component::GlobalState::suppress_text_selection(cx);
+                            })
+                            .on_click(cx.listener(move |view, _, _, cx| {
+                                cx.stop_propagation();
+                                if !view.collapsed_headings.remove(&index) {
+                                    view.collapsed_headings.insert(index);
+                                }
+                                cx.notify();
+                            }))
+                            .into_any_element()
+                    } else {
+                        slot().into_any_element()
+                    };
+                    h_flex()
+                        .id(("markdown-heading", index))
+                        .min_h(px(28.0))
+                        .items_start()
+                        .pl(px(heading.indent as f32 * reader_presentation::OUTLINE_INDENT))
+                        .pr_1()
+                        .rounded(px(3.0))
+                        .text_size(px(reader_presentation::CHROME_SIZE))
+                        .cursor_pointer()
+                        .debug_selector(move || format!("outline-row-{index}"))
+                        .text_color(cx.theme().muted_foreground)
+                        .when(self.selected_heading == Some(index), |row| {
+                            row.bg(cx.theme().list_hover)
+                                .text_color(cx.theme().foreground)
+                                .font_semibold()
+                        })
+                        .hover(|row| row.bg(cx.theme().list_hover).underline())
+                        .on_mouse_down(MouseButton::Left, |_, _, cx| {
+                            gpui_component::GlobalState::suppress_text_selection(cx)
+                        })
+                        .child(arrow)
+                        .child(
+                            div()
+                                .flex_1()
+                                .min_w_0()
+                                .py_1()
+                                .whitespace_normal()
+                                .child(heading.display_label()),
+                        )
+                        .on_click(cx.listener(move |view, _, window, cx| {
+                            view.jump_to_heading(index, window, cx)
+                        }))
+                        .context_menu(move |menu, _, _| {
+                            let copied = copied.clone();
+                            menu.item(
+                                gpui_component::menu::PopupMenuItem::new(
+                                    language.text(Message::EditorCopyHeading),
+                                )
+                                .icon(IconName::Copy)
+                                .on_click(move |_, _, cx| {
+                                    cx.write_to_clipboard(gpui::ClipboardItem::new_string(
+                                        copied.clone(),
+                                    ))
+                                }),
+                            )
+                        })
+                },
+            ));
+        v_flex()
+            .id("markdown-outline")
+            .relative()
+            .w(px(reader_presentation::clamp_details_width(self.details_width)))
+            .min_w(px(reader_presentation::DETAILS_MIN_WIDTH))
+            .max_w(gpui::relative(0.42))
+            .h_full()
+            .flex_shrink_0()
+            .border_l_1()
+            .border_color(cx.theme().border)
+            .child(self.render_details_header(cx))
+            .child(
+                div().relative().flex_1().min_h_0().overflow_hidden().child(headings).child(
+                    div()
+                        .id("markdown-outline-scrollbar-host")
+                        .absolute()
+                        .top_0()
+                        .right_0()
+                        .bottom_0()
+                        .w(px(16.0))
+                        .debug_selector(|| "markdown-outline-scrollbar".to_owned())
+                        .on_hover(cx.listener(|view, hovered: &bool, _, cx| {
+                            view.outline_scrollbar_hovered = *hovered;
+                            cx.notify();
+                        }))
+                        .child(
+                            gpui_component::scroll::Scrollbar::vertical(&scroll).scrollbar_show(
+                                if self.outline_scrollbar_hovered {
+                                    gpui_component::scroll::ScrollbarShow::Hover
+                                } else {
+                                    gpui_component::scroll::ScrollbarShow::Scrolling
+                                },
+                            ),
+                        ),
+                ),
+            )
+            .child(self.render_details_resize_handle(cx))
+            .into_any_element()
+    }
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/preview.rs b/nebula_app/src/gpui_shell/file_editor/preview.rs
new file mode 100644
index 0000000..3cba98f
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/preview.rs
@@ -0,0 +1,485 @@
+//! Reading layout and per-block presentation choices for the Markdown preview.
+
+use super::*;
+use crate::i18n::Message;
+use gpui::prelude::*;
+use gpui::{IntoElement, ObjectFit, SharedString, Window, div, img, px};
+use gpui_component::{
+    ActiveTheme, ElementExt as _, WindowExt as _,
+    text::{MarkdownExtensions, MarkdownNode, TextView, TextViewStyle},
+};
+use std::{
+    path::PathBuf,
+    sync::{Arc, LazyLock},
+    time::Duration,
+};
+
+const SELECTION_SCROLL_INTERVAL: Duration = Duration::from_millis(16);
+
+fn selection_scroll_delta(
+    has_selection: bool,
+    pointer_y: Pixels,
+    bounds: Bounds<Pixels>,
+) -> Option<Pixels> {
+    if !has_selection || bounds.size.height <= px(0.0) {
+        return None;
+    }
+    gpui_component::scroll::AutoScroll::compute_delta(pointer_y, bounds)
+}
+
+#[derive(Clone, Debug)]
+struct CenteredHtml {
+    source: String,
+    images: Option<Vec<HtmlImage>>,
+}
+#[derive(Clone, Debug)]
+struct HtmlImage {
+    source: String,
+    link: Option<String>,
+    width: Option<f32>,
+    height: Option<f32>,
+}
+
+fn attribute(tag: &str, name: &str) -> Option<String> {
+    static ATTRIBUTES: LazyLock<regex::Regex> = LazyLock::new(|| {
+        regex::Regex::new(r#"(?is)\b([\w-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))"#).unwrap()
+    });
+    ATTRIBUTES.captures_iter(tag).find_map(|capture| {
+        if !capture[1].eq_ignore_ascii_case(name) {
+            return None;
+        }
+        let value = capture.get(2).or_else(|| capture.get(3)).or_else(|| capture.get(4))?;
+        Some(html_escape::decode_html_entities(value.as_str()).into_owned())
+    })
+}
+
+fn centered_html(source: &str) -> Option<CenteredHtml> {
+    static OUTER: LazyLock<regex::Regex> = LazyLock::new(|| {
+        regex::Regex::new(r"(?is)^\s*<(p|div|h[1-6])\b([^>]*)>(.*)</([a-z0-9]+)>\s*$").unwrap()
+    });
+    static TAGS: LazyLock<regex::Regex> =
+        LazyLock::new(|| regex::Regex::new(r"(?is)<!--.*?-->|<[^>]*>").unwrap());
+    static IMAGE: LazyLock<regex::Regex> =
+        LazyLock::new(|| regex::Regex::new(r"(?is)<img\b[^>]*>").unwrap());
+    let outer = OUTER.captures(source)?;
+    if !outer[1].eq_ignore_ascii_case(&outer[4]) {
+        return None;
+    }
+    let centered = attribute(&outer[2], "align")
+        .is_some_and(|value| value.eq_ignore_ascii_case("center"))
+        || attribute(&outer[2], "style").is_some_and(|style| {
+            style.split(';').any(|property| {
+                property.split_once(':').is_some_and(|(name, value)| {
+                    name.trim().eq_ignore_ascii_case("text-align")
+                        && value.trim().eq_ignore_ascii_case("center")
+                })
+            })
+        });
+    if !centered {
+        return None;
+    }
+    let body = &outer[3];
+    let images = if TAGS.replace_all(body, "").trim().is_empty() && IMAGE.is_match(body) {
+        let mut images = Vec::new();
+        for image in IMAGE.find_iter(body) {
+            let tag = image.as_str();
+            let Some(source) = attribute(tag, "src") else { return None };
+            let prefix = &body[..image.start()];
+            let link = prefix
+                .rfind("<a ")
+                .filter(|start| prefix.rfind("</a>").is_none_or(|end| *start > end))
+                .and_then(|start| attribute(&prefix[start..], "href"));
+            let dimension = |name| {
+                attribute(tag, name)
+                    .and_then(|value| value.parse::<f32>().ok())
+                    .filter(|value| value.is_finite() && *value > 0.0)
+            };
+            images.push(HtmlImage {
+                source,
+                link,
+                width: dimension("width"),
+                height: dimension("height"),
+            });
+        }
+        Some(images)
+    } else {
+        None
+    };
+    Some(CenteredHtml { source: source.to_owned(), images })
+}
+
+pub(super) fn extensions(base: Option<PathBuf>) -> MarkdownExtensions {
+    super::super::molecule_view::markdown_extensions()
+        .block_parser(|node, _| {
+            let markdown::mdast::Node::Html(html) = node else { return None };
+            let centered = centered_html(&html.value)?;
+            Some(
+                MarkdownNode::new("pebrel-centered-html", centered)
+                    .text(html.value.clone())
+                    .markdown(html.value.clone()),
+            )
+        })
+        .block_renderer("pebrel-centered-html", move |node, _, cx| {
+            let data = node.data::<CenteredHtml>().unwrap();
+            if let Some(images) = &data.images {
+                let mut row =
+                    h_flex().w_full().min_w_0().flex_wrap().justify_center().items_center().gap_1();
+                for (index, image) in images.iter().enumerate() {
+                    let source: gpui::ImageSource = if image.source.starts_with("https://")
+                        || image.source.starts_with("http://")
+                        || image.source.starts_with("data:")
+                    {
+                        image.source.clone().into()
+                    } else {
+                        base.as_ref()
+                            .map(|base| base.join(&image.source))
+                            .unwrap_or_else(|| PathBuf::from(&image.source))
+                            .into()
+                    };
+                    row = row.child(
+                        img(source)
+                            .id(("centered-image", index))
+                            .max_w_full()
+                            .object_fit(ObjectFit::Contain)
+                            .when_some(image.width, |image, width| image.w(px(width)))
+                            .when_some(image.height, |image, height| image.h(px(height)))
+                            .when_some(image.link.clone(), |image, link| {
+                                image.cursor_pointer().on_click(move |_, _, cx| cx.open_url(&link))
+                            }),
+                    );
+                }
+                row.into_any_element()
+            } else {
+                div()
+                    .w_full()
+                    .min_w_0()
+                    .max_w_full()
+                    .text_center()
+                    .whitespace_normal()
+                    .child(
+                        TextView::html("centered-text", data.source.clone())
+                            .w_full()
+                            .min_w_0()
+                            .selectable(true)
+                            .style(TextViewStyle {
+                                image_base: base.clone().map(Arc::from),
+                                highlight_theme: cx.theme().highlight_theme.clone(),
+                                is_dark: cx.theme().is_dark(),
+                                ..Default::default()
+                            }),
+                    )
+                    .into_any_element()
+            }
+        })
+}
+
+/// Change only the fence's language token. Code, indentation, fence lengths,
+/// trailing metadata and every other block remain byte-for-byte intact.
+fn fence_language(source: &str, start: usize, end: usize, language: &str) -> Option<String> {
+    if language.chars().any(|ch| ch.is_whitespace() || matches!(ch, '`' | '~')) {
+        return None;
+    }
+    let block = source.get(start..end)?;
+    let line = block.split('\n').next()?;
+    let trimmed = line.trim_start();
+    let marker = trimmed.chars().next()?;
+    if !matches!(marker, '`' | '~') {
+        return None;
+    }
+    let count = trimmed.chars().take_while(|ch| *ch == marker).count();
+    if count < 3 {
+        return None;
+    }
+    let info = start + (line.len() - trimmed.len()) + count;
+    let old = &source[info..start + line.len()];
+    let token_start = info + old.len() - old.trim_start().len();
+    let token_end = token_start
+        + source[token_start..start + line.len()]
+            .find(char::is_whitespace)
+            .unwrap_or(start + line.len() - token_start);
+    let language = if language.is_empty() { "text" } else { language };
+    Some(format!("{}{}{}", &source[..token_start], language, &source[token_end..]))
+}
+
+impl TextFileView {
+    fn start_preview_selection_scroll(&mut self, window: &Window, cx: &mut Context<Self>) {
+        if self.preview_selection_scroll_active {
+            return;
+        }
+        self.preview_selection_scroll_active = true;
+        self.preview_selection_scroll_epoch = self.preview_selection_scroll_epoch.wrapping_add(1);
+        let epoch = self.preview_selection_scroll_epoch;
+        let executor = cx.background_executor().clone();
+        cx.spawn_in(window, async move |this, cx| {
+            let mut refresh_selection = false;
+            loop {
+                executor.timer(SELECTION_SCROLL_INTERVAL).await;
+                let tick = this.update_in(cx, |view, window, cx| {
+                    view.preview_selection_scroll_tick(epoch, window, cx)
+                });
+                let Ok(Some(scrolled)) = tick else { break };
+
+                // The list reflows after the previous tick. Re-dispatching the
+                // current pointer position makes the window-level selection
+                // endpoint follow the newly visible Markdown block.
+                if refresh_selection {
+                    let _ = cx.update(|window, cx| {
+                        let _ = window.dispatch_event(
+                            gpui::PlatformInput::MouseMove(gpui::MouseMoveEvent {
+                                position: window.mouse_position(),
+                                pressed_button: Some(MouseButton::Left),
+                                modifiers: window.modifiers(),
+                            }),
+                            cx,
+                        );
+                    });
+                }
+                refresh_selection = scrolled;
+            }
+        })
+        .detach();
+    }
+
+    pub(super) fn stop_preview_selection_scroll(&mut self) {
+        if !self.preview_selection_scroll_active {
+            return;
+        }
+        self.preview_selection_scroll_active = false;
+        self.preview_selection_scroll_epoch = self.preview_selection_scroll_epoch.wrapping_add(1);
+    }
+
+    fn preview_selection_scroll_tick(
+        &mut self,
+        epoch: u64,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) -> Option<bool> {
+        if epoch != self.preview_selection_scroll_epoch || !self.preview_selection_scroll_active {
+            return None;
+        }
+        let bounds = *self.preview_bounds.borrow();
+        let Some(delta) = selection_scroll_delta(
+            window.has_text_selection(cx),
+            window.mouse_position().y,
+            bounds,
+        ) else {
+            return Some(false);
+        };
+        let before = self.scroll.scroll_px_offset_for_scrollbar();
+        self.scroll.scroll_by(delta);
+        let scrolled = self.scroll.scroll_px_offset_for_scrollbar() != before;
+        if scrolled {
+            cx.notify();
+        }
+        Some(scrolled)
+    }
+
+    pub(super) fn render_markdown_preview(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let blocks = self.blocks.clone();
+        let owner = cx.entity().downgrade();
+        let extensions = self.preview_extensions.clone();
+        let scroll = self.scroll.clone();
+        let bounds = self.preview_bounds.clone();
+        let style = TextViewStyle {
+            image_base: self.path.parent().map(Arc::from),
+            highlight_theme: cx.theme().highlight_theme.clone(),
+            is_dark: cx.theme().is_dark(),
+            paragraph_gap: gpui::rems(0.7),
+            heading_base_font_size: px(reader_presentation::HEADING_BASE),
+            code_block: {
+                let mut style = gpui::StyleRefinement::default();
+                style.padding.top = Some(px(16.0).into());
+                style.background = Some(super::super::theme::code_block_background(cx).into());
+                style
+            },
+            ..Default::default()
+        };
+        div()
+            .flex_1()
+            .min_w_0()
+            .h_full()
+            .relative()
+            .overflow_hidden()
+            .px(px(reader_presentation::PAGE_MARGIN))
+            .pt(px(reader_presentation::TOP_MARGIN))
+            .debug_selector(|| "markdown-preview-viewport".to_owned())
+            .on_prepaint(move |viewport, _, _| *bounds.borrow_mut() = viewport)
+            .on_mouse_down(
+                MouseButton::Left,
+                cx.listener(|this, _, window, cx| {
+                    this.start_preview_selection_scroll(window, cx);
+                }),
+            )
+            .on_mouse_up(
+                MouseButton::Left,
+                cx.listener(|this, _, _, _| {
+                    this.stop_preview_selection_scroll();
+                }),
+            )
+            .on_mouse_up_out(
+                MouseButton::Left,
+                cx.listener(|this, _, _, _| {
+                    this.stop_preview_selection_scroll();
+                }),
+            )
+            .on_mouse_down(
+                MouseButton::Right,
+                cx.listener(|_, event: &gpui::MouseDownEvent, window, cx| {
+                    let text = window.selected_text(cx).to_string();
+                    if !text.trim().is_empty() {
+                        cx.emit(TextFileEvent::SelectionContextMenuRequested {
+                            position: event.position,
+                            text,
+                        });
+                        cx.stop_propagation();
+                    }
+                }),
+            )
+            .child(
+                gpui::list(scroll.clone(), move |index, window, cx| {
+                    let cached = blocks.borrow().get(index).cloned().flatten();
+                    let block = cached.unwrap_or_else(|| {
+                        let (source, selected) = owner
+                            .upgrade()
+                            .map(|owner| {
+                                let owner = owner.read(cx);
+                                (owner.outline.block_source(index), owner.all_selected)
+                            })
+                            .unwrap_or_default();
+                        let state = cx.new(|cx| TextViewState::markdown(&source, cx));
+                        if selected {
+                            state.update(cx, |state, cx| state.select_all(cx));
+                        }
+                        blocks.borrow_mut()[index] = Some(state.clone());
+                        state
+                    });
+                    let owner = owner.clone();
+                    let block_extensions = window
+                        .use_keyed_state(("reader-code-extensions", index), cx, |_, _| {
+                            super::code_actions::extensions(
+                                extensions.clone(),
+                                owner.clone(),
+                                index,
+                            )
+                        })
+                        .read(cx)
+                        .clone();
+                    div()
+                        .w_full()
+                        .min_w_0()
+                        .py_1()
+                        .child(
+                            div()
+                                .w_full()
+                                .max_w(px(reader_presentation::PAGE_WIDTH))
+                                .mx_auto()
+                                .min_w_0()
+                                .debug_selector(move || format!("markdown-preview-block-{index}"))
+                                .text_size(px(reader_presentation::BODY_SIZE))
+                                .line_height(gpui::relative(reader_presentation::LINE_HEIGHT))
+                                .whitespace_normal()
+                                .child(
+                                    TextView::new(&block)
+                                        .w_full()
+                                        .min_w_0()
+                                        .max_w_full()
+                                        .selectable(true)
+                                        .scrollable(false)
+                                        .style(style.clone())
+                                        .markdown_extensions(block_extensions),
+                                ),
+                        )
+                        .into_any_element()
+                })
+                .size_full(),
+            )
+            .child(
+                div()
+                    .id("markdown-preview-scrollbar-host")
+                    .absolute()
+                    .top_0()
+                    .right_0()
+                    .bottom_0()
+                    .w(px(16.0))
+                    .debug_selector(|| "markdown-preview-scrollbar".to_owned())
+                    .on_hover(cx.listener(|view, hovered: &bool, _, cx| {
+                        view.preview_scrollbar_hovered = *hovered;
+                        cx.notify();
+                    }))
+                    .child(gpui_component::scroll::Scrollbar::vertical(&scroll).scrollbar_show(
+                        if self.preview_scrollbar_hovered {
+                            gpui_component::scroll::ScrollbarShow::Hover
+                        } else {
+                            gpui_component::scroll::ScrollbarShow::Scrolling
+                        },
+                    )),
+            )
+            .into_any_element()
+    }
+
+    pub(super) fn set_preview_language(
+        &mut self,
+        block: usize,
+        start: usize,
+        end: usize,
+        language: &str,
+        cx: &mut Context<Self>,
+    ) {
+        let Some((start, end)) = self.outline.source_span(block, start, end) else { return };
+        let Some(source) = self.outline.blocks.get(block) else { return };
+        let Some(next) = fence_language(source, start, end, language) else { return };
+        self.outline.replace_block(block, next, end);
+        let source = self.outline.block_source(block);
+        if let Some(state) = self.blocks.borrow().get(block).cloned().flatten() {
+            state.update(cx, |state, cx| state.set_text(&source, cx));
+        }
+        cx.notify();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn selection_auto_scroll_requires_a_selection_near_a_viewport_edge() {
+        let bounds = Bounds::new(gpui::point(px(0.0), px(100.0)), gpui::size(px(600.0), px(300.0)));
+        assert!(selection_scroll_delta(false, px(399.0), bounds).is_none());
+        assert!(selection_scroll_delta(true, px(250.0), bounds).is_none());
+        assert!(
+            selection_scroll_delta(true, px(101.0), bounds).is_some_and(|delta| delta < px(0.0))
+        );
+        assert!(
+            selection_scroll_delta(true, px(399.0), bounds).is_some_and(|delta| delta > px(0.0))
+        );
+    }
+
+    #[test]
+    fn readme_centered_badges_keep_links_dimensions_and_entities() {
+        let source = r#"<p ALIGN="center"><img src="one.png?a=1&amp;b=2" width="148" height="148"><a href="https://example.com"><img src="two.svg"></a></p>"#;
+        let parsed = centered_html(source).unwrap();
+        let images = parsed.images.unwrap();
+        assert_eq!(images.len(), 2);
+        assert_eq!(images[0].source, "one.png?a=1&b=2");
+        assert_eq!(images[0].width, Some(148.0));
+        assert_eq!(images[1].link.as_deref(), Some("https://example.com"));
+        assert!(centered_html("<p>ordinary</p>").is_none());
+        assert!(
+            centered_html("<div style='text-align: center'><b>Centered</b></div>")
+                .unwrap()
+                .images
+                .is_none()
+        );
+    }
+    #[test]
+    fn language_switch_changes_one_fence_without_rewriting_code() {
+        let source =
+            "before\n\n```wrong title=demo\nprint('你好')\n```\n\n```js\nconst x = 1;\n```";
+        let start = source.find("```wrong").unwrap();
+        let end = source.find("\n\n```js").unwrap();
+        let changed = fence_language(source, start, end, "python").unwrap();
+        assert_eq!(changed, source.replacen("```wrong", "```python", 1));
+        assert!(fence_language(source, start, end, "bad\nlang").is_none());
+        assert_eq!(fence_language("~~~\nx\n~~~", 0, 9, "rust").unwrap(), "~~~rust\nx\n~~~");
+    }
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/reader_presentation.rs b/nebula_app/src/gpui_shell/file_editor/reader_presentation.rs
new file mode 100644
index 0000000..f0d4282
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/reader_presentation.rs
@@ -0,0 +1,30 @@
+//! Pebrel-owned reader geometry. GPUI supplies drawing, not document design.
+
+pub(super) const PAGE_WIDTH: f32 = 720.0;
+pub(super) const PAGE_MARGIN: f32 = 40.0;
+pub(super) const TOP_MARGIN: f32 = 24.0;
+pub(super) const BODY_SIZE: f32 = 14.0;
+pub(super) const HEADING_BASE: f32 = 12.0;
+pub(super) const LINE_HEIGHT: f32 = 1.7;
+pub(super) const OUTLINE_WIDTH: f32 = 248.0;
+pub(super) const OUTLINE_INDENT: f32 = 16.0;
+/// The outline and file-info views share one panel width. Keep a readable
+/// navigation column while leaving enough horizontal space for the document.
+pub(super) const DETAILS_MIN_WIDTH: f32 = 216.0;
+pub(super) const DETAILS_MAX_WIDTH: f32 = 360.0;
+/// The visible divider is one pixel, but the pointer target is deliberately
+/// wider so resizing does not depend on landing on an exact edge.
+pub(super) const DETAILS_RESIZE_HIT_WIDTH: f32 = 8.0;
+// Match the file-tree's 13px labels; secondary chrome is one step quieter.
+pub(super) const CHROME_SIZE: f32 = 13.0;
+pub(super) const SECONDARY_SIZE: f32 = 12.0;
+pub(super) const ICON_SIZE: f32 = 16.0;
+pub(super) const TOOLBAR_HEIGHT: f32 = 52.0;
+pub(super) const PANEL_HEADER_HEIGHT: f32 = 44.0;
+pub(super) const CONTROL_HEIGHT: f32 = 32.0;
+pub(super) const ACTION_HEIGHT: f32 = 36.0;
+pub(super) const PANEL_PADDING: f32 = 20.0;
+
+pub(super) fn clamp_details_width(width: f32) -> f32 {
+    width.clamp(DETAILS_MIN_WIDTH, DETAILS_MAX_WIDTH)
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/source.rs b/nebula_app/src/gpui_shell/file_editor/source.rs
new file mode 100644
index 0000000..55db4d6
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_editor/source.rs
@@ -0,0 +1,112 @@
+//! Local and remote adapters share the editor's buffer and save lifecycle.
+
+use super::document::Document;
+use crate::ssh_sftp::document::{DocumentOperation, RemoteDocument, RemoteLocation};
+use crate::text_document::{SaveError, TextSnapshot};
+use std::io;
+use std::path::{Path, PathBuf};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) enum DocumentSource {
+    Local(PathBuf),
+    Remote(RemoteLocation),
+}
+
+impl DocumentSource {
+    pub(super) fn path(&self) -> &Path {
+        match self {
+            Self::Local(path) => path,
+            Self::Remote(location) => Path::new(&location.path),
+        }
+    }
+
+    pub(super) fn display(&self) -> String {
+        match self {
+            Self::Local(path) => path.display().to_string(),
+            Self::Remote(location) => location.display(),
+        }
+    }
+
+    pub(super) fn is_remote(&self) -> bool {
+        matches!(self, Self::Remote(_))
+    }
+
+    pub(super) async fn load(self, operation: DocumentOperation) -> io::Result<LoadedDocument> {
+        match self {
+            Self::Local(path) => Document::load(&path).map(LoadedDocument::Local),
+            Self::Remote(location) => on_network(async move {
+                RemoteDocument::load(location, operation)
+                    .await
+                    .map(LoadedDocument::Remote)
+                    .map_err(SaveError::Io)
+            })
+            .await
+            .map_err(|error| match error {
+                SaveError::Io(error) => error,
+                error => io::Error::other(error),
+            }),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub(super) enum LoadedDocument {
+    Local(Document),
+    Remote(RemoteDocument),
+}
+
+impl std::ops::Deref for LoadedDocument {
+    type Target = TextSnapshot;
+    fn deref(&self) -> &Self::Target {
+        match self {
+            Self::Local(document) => document,
+            Self::Remote(document) => &document.snapshot,
+        }
+    }
+}
+
+impl LoadedDocument {
+    pub(super) fn modified(&self) -> Option<std::time::SystemTime> {
+        match self {
+            Self::Local(document) => document.modified,
+            Self::Remote(document) => document.modified,
+        }
+    }
+
+    pub(super) fn size(&self) -> u64 {
+        match self {
+            Self::Local(document) => document.total_bytes,
+            Self::Remote(document) => document.size(),
+        }
+    }
+
+    pub(super) async fn save(
+        self,
+        source: DocumentSource,
+        text: String,
+        operation: DocumentOperation,
+    ) -> Result<Self, SaveError> {
+        match (self, source) {
+            (Self::Local(document), DocumentSource::Local(path)) => {
+                document.save(&path, text).map(Self::Local)
+            },
+            (Self::Remote(document), DocumentSource::Remote(location))
+                if document.location == location =>
+            {
+                on_network(async move { document.save(text, operation).await.map(Self::Remote) })
+                    .await
+            },
+            _ => Err(SaveError::Changed),
+        }
+    }
+}
+
+async fn on_network<T: Send + 'static>(
+    future: impl std::future::Future<Output = Result<T, SaveError>> + Send + 'static,
+) -> Result<T, SaveError> {
+    let (send, receive) = tokio::sync::oneshot::channel();
+    crate::ssh_session::runtime()?.spawn(async move {
+        let _ = send.send(future.await);
+    });
+    receive.await.map_err(|_| io::Error::other("Remote document operation ended"))?
+}
diff --git a/nebula_app/src/gpui_shell/file_editor/tests.rs b/nebula_app/src/gpui_shell/file_editor/tests.rs
index 4bc25dc..02cef52 100644
--- a/nebula_app/src/gpui_shell/file_editor/tests.rs
+++ b/nebula_app/src/gpui_shell/file_editor/tests.rs
@@ -5,6 +5,7 @@ use gpui_component::Root;
 fn open(path: PathBuf, cx: &mut TestAppContext) -> (Entity<TextFileView>, VisualTestContext) {
     cx.update(|cx| {
         gpui_component::init(cx);
+        super::super::math_view::register(cx);
         init(cx);
     });
     let mut file = None;
@@ -17,6 +18,35 @@ fn open(path: PathBuf, cx: &mut TestAppContext) -> (Entity<TextFileView>, Visual
     (file.unwrap(), window.clone())
 }
 
+#[gpui::test]
+fn source_mode_releases_preview_views_without_changing_the_document(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("preview.md");
+    let source = "# Title\n\n$x^2$\n";
+    std::fs::write(&path, source).unwrap();
+    let (file, mut cx) = open(path, cx);
+    cx.update(|window, cx| {
+        file.update(cx, |view, cx| {
+            assert!(view.preview && !view.loading);
+            let block = cx.new(|cx| TextViewState::markdown("cached preview", cx));
+            view.blocks.borrow_mut()[0] = Some(block);
+            view.all_selected = true;
+            view.preview_selection_scroll_active = true;
+            let count = view.outline.blocks.len();
+            view.toggle_preview(window, cx);
+            assert!(!view.preview && !view.all_selected);
+            assert!(!view.preview_selection_scroll_active);
+            assert!(view.blocks.borrow().iter().all(Option::is_none));
+            assert_eq!(view.input.read(cx).value().as_ref(), source);
+            assert_eq!(view.outline.blocks.len(), count);
+            assert!(!view.dirty);
+            view.toggle_preview(window, cx);
+            assert!(view.preview);
+            assert!(view.blocks.borrow().iter().all(Option::is_none));
+        });
+    });
+}
+
 #[gpui::test]
 fn keyboard_save_writes_the_file_and_conflicts_preserve_the_draft(cx: &mut TestAppContext) {
     let directory = tempfile::tempdir().unwrap();
@@ -55,6 +85,142 @@ fn keyboard_save_writes_the_file_and_conflicts_preserve_the_draft(cx: &mut TestA
         && matches!(view.notice, Some((Message::EditorConflict, _)))));
 }
 
+#[gpui::test]
+fn outline_arrow_folds_without_navigating_or_rewriting_the_document(cx: &mut TestAppContext) {
+    use gpui::Modifiers;
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("tree.md");
+    let text = "# Root\n\n## Child\n\n### Leaf\n\n## Sibling\n";
+    std::fs::write(&path, text).unwrap();
+    let (file, mut cx) = open(path.clone(), cx);
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let arrow = cx.debug_bounds("outline-fold-0").unwrap().center();
+    cx.simulate_mouse_down(arrow, MouseButton::Left, Modifiers::default());
+    cx.simulate_mouse_up(arrow, MouseButton::Left, Modifiers::default());
+    cx.run_until_parked();
+    assert!(file.read_with(&cx, |view, _| view.collapsed_headings.contains(&0)));
+    assert_eq!(file.read_with(&cx, |view, _| view.selected_heading), None);
+    assert_eq!(std::fs::read_to_string(path).unwrap(), text);
+    assert_eq!(file.read_with(&cx, |view, cx| view.input.read(cx).value().to_string()), text);
+}
+
+#[gpui::test]
+fn document_chrome_modes_are_idempotent_and_sidebar_tabs_are_exclusive(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("chrome.md");
+    let source = "# Title\n\nOriginal text\n";
+    std::fs::write(&path, source).unwrap();
+    let (file, mut cx) = open(path, cx);
+    for (selector, preview) in [
+        ("file-mode-read", true),
+        ("file-mode-edit", false),
+        ("file-mode-edit", false),
+        ("file-mode-read", true),
+    ] {
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let point = cx.debug_bounds(selector).unwrap().center();
+        cx.simulate_mouse_down(point, MouseButton::Left, gpui::Modifiers::default());
+        cx.simulate_mouse_up(point, MouseButton::Left, gpui::Modifiers::default());
+        cx.run_until_parked();
+        assert_eq!(file.read_with(&cx, |view, _| view.preview), preview);
+        assert_eq!(file.read_with(&cx, |view, cx| view.input.read(cx).value().to_string()), source);
+        assert!(!file.read_with(&cx, |view, _| view.dirty));
+    }
+    for (selector, info) in
+        [("file-info", true), ("file-info", true), ("file-toggle-outline", false)]
+    {
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        let bounds = cx.debug_bounds(selector).unwrap();
+        assert!(bounds.size.height >= px(reader_presentation::PANEL_HEADER_HEIGHT - 1.0));
+        assert!(bounds.size.width >= px(48.0));
+        // Click the padding above the text, not only the label center.
+        let point = gpui::point(bounds.center().x, bounds.origin.y + px(4.0));
+        cx.simulate_mouse_down(point, MouseButton::Left, gpui::Modifiers::default());
+        cx.simulate_mouse_up(point, MouseButton::Left, gpui::Modifiers::default());
+        cx.run_until_parked();
+        assert!(file.read_with(&cx, |view, _| view.show_details));
+        assert_eq!(file.read_with(&cx, |view, _| view.info), info);
+        cx.update(|window, cx| {
+            let _ = window.draw(cx);
+        });
+        assert_eq!(cx.debug_bounds("file-details-indicator").unwrap().size.height, px(2.0));
+        if info {
+            for action in ["info-copy-path", "info-copy-name", "info-reveal", "info-open"] {
+                assert!(cx.debug_bounds(action).unwrap().size.height >= px(32.0));
+            }
+        }
+    }
+}
+
+#[gpui::test]
+fn code_actions_copy_raw_source_and_search_languages(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("code.md");
+    let source = "```text\nlet x = 42;\n```\n";
+    std::fs::write(&path, source).unwrap();
+    let (file, mut cx) = open(path, cx);
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let block = cx.debug_bounds("markdown-preview-block-0").unwrap();
+    let surface = cx.debug_bounds("pebrel-code-block").unwrap();
+    let text = cx.debug_bounds("pebrel-code-text").unwrap();
+    let language = cx.debug_bounds("markdown-language-picker").unwrap();
+    assert_eq!(
+        surface.size.height,
+        text.size.height + px(28.0),
+        "copy must not reserve a layout row"
+    );
+    assert!(language.origin.y >= text.bottom(), "language belongs below the code");
+    assert!(f32::from(surface.right() - language.right()).abs() < 1.0, "language aligns right");
+    cx.simulate_mouse_move(block.center(), None, gpui::Modifiers::default());
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let copy = cx.debug_bounds("markdown-copy-code").unwrap().center();
+    cx.simulate_mouse_move(copy, None, gpui::Modifiers::default());
+    cx.simulate_mouse_down(copy, MouseButton::Left, gpui::Modifiers::default());
+    cx.simulate_mouse_up(copy, MouseButton::Left, gpui::Modifiers::default());
+    cx.run_until_parked();
+    let copied = cx.read_from_clipboard().unwrap().text().unwrap();
+    assert_eq!(copied.trim_end_matches('\n'), "let x = 42;");
+    let picker = cx.debug_bounds("markdown-language-picker").unwrap().center();
+    cx.simulate_mouse_down(picker, MouseButton::Left, gpui::Modifiers::default());
+    cx.simulate_mouse_up(picker, MouseButton::Left, gpui::Modifiers::default());
+    cx.run_until_parked();
+    cx.simulate_input("rust");
+    cx.run_until_parked();
+    cx.simulate_keystrokes("enter");
+    cx.run_until_parked();
+    assert!(file.read_with(&cx, |view, _| view.outline.block_source(0).starts_with("```rust")));
+    assert_eq!(file.read_with(&cx, |view, cx| view.input.read(cx).value().to_string()), source);
+}
+
+#[gpui::test]
+fn long_code_line_does_not_expand_the_reader_or_reserve_a_toolbar(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("long-code.md");
+    std::fs::write(&path, format!("```text\n{}\n```\n", "x".repeat(2000))).unwrap();
+    let (_, mut cx) = open(path, cx);
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    let surface = cx.debug_bounds("pebrel-code-block").unwrap();
+    let viewport = cx.debug_bounds("markdown-preview-viewport").unwrap();
+    assert!(surface.size.width <= px(reader_presentation::PAGE_WIDTH));
+    assert!(surface.right() <= viewport.right());
+    assert!(
+        surface.size.height < px(120.0),
+        "one logical code line must scroll horizontally, not grow into a wrapped wall"
+    );
+}
+
 #[gpui::test]
 fn editing_during_a_save_stays_dirty_and_markdown_jumps_to_source(cx: &mut TestAppContext) {
     let directory = tempfile::tempdir().unwrap();
@@ -85,3 +251,21 @@ fn editing_during_a_save_stays_dirty_and_markdown_jumps_to_source(cx: &mut TestA
         "next draft"
     );
 }
+
+#[gpui::test]
+fn markdown_preview_and_outline_keep_visible_scrollbar_hosts(cx: &mut TestAppContext) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("outline.md");
+    std::fs::write(
+        &path,
+        (0..40).map(|index| format!("## Heading {index}\n\nBody {index}\n\n")).collect::<String>(),
+    )
+    .unwrap();
+    let (_, mut cx) = open(path, cx);
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+
+    assert_eq!(cx.debug_bounds("markdown-preview-scrollbar").unwrap().size.width, px(16.0));
+    assert_eq!(cx.debug_bounds("markdown-outline-scrollbar").unwrap().size.width, px(16.0));
+}
diff --git a/nebula_app/src/gpui_shell/file_preview.rs b/nebula_app/src/gpui_shell/file_preview.rs
new file mode 100644
index 0000000..7c077bf
--- /dev/null
+++ b/nebula_app/src/gpui_shell/file_preview.rs
@@ -0,0 +1,85 @@
+//! A file tooltip owns its background request; closing it discards the result.
+
+use crate::i18n::Message;
+use gpui::prelude::*;
+use gpui::{Context, Image, ImageFormat, IntoElement, ObjectFit, Render, Window, div, img, px};
+use gpui_component::ActiveTheme;
+use std::{path::PathBuf, sync::Arc};
+
+pub(super) struct FilePreview {
+    path: PathBuf,
+    image: Option<Arc<Image>>,
+    info: Option<String>,
+    failed: bool,
+}
+
+impl FilePreview {
+    pub(super) fn new(path: PathBuf, cx: &mut Context<Self>) -> Self {
+        let source = path.clone();
+        let task = cx
+            .background_executor()
+            .spawn(async move { crate::platform::file_preview::load(&source) });
+        cx.spawn(async move |this, cx| {
+            let result = task.await;
+            let _ = this.update(cx, |view, cx| {
+                match result {
+                    Ok(preview) => {
+                        view.image = Some(Arc::new(Image::from_bytes(
+                            ImageFormat::Png,
+                            preview.png.to_vec(),
+                        )));
+                        view.info = Some(match preview.pages {
+                            Some(pages) => super::config::ui_language(cx).format(
+                                Message::FilesPreviewPages,
+                                &[("pages", &pages.to_string())],
+                            ),
+                            None => format!("{} × {}", preview.width, preview.height),
+                        });
+                    },
+                    Err(error) => {
+                        log::debug!("file preview unavailable: {error}");
+                        view.failed = true;
+                    },
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+        Self { path, image: None, info: None, failed: false }
+    }
+}
+
+impl Render for FilePreview {
+    fn render(&mut self, _: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let language = super::config::ui_language(cx);
+        div()
+            .w(px(300.0))
+            .p_3()
+            .flex()
+            .flex_col()
+            .gap_2()
+            .rounded_lg()
+            .border_1()
+            .border_color(cx.theme().border)
+            .bg(cx.theme().popover)
+            .shadow_md()
+            .child(
+                div().text_xs().truncate().child(
+                    self.path.file_name().unwrap_or_default().to_string_lossy().into_owned(),
+                ),
+            )
+            .when_some(self.image.clone(), |root, image| {
+                root.child(img(image).w_full().h(px(220.0)).object_fit(ObjectFit::Contain))
+            })
+            .when(self.image.is_none(), |root| {
+                root.child(div().h(px(60.0)).text_xs().child(language.text(if self.failed {
+                    Message::FilesPreviewUnavailable
+                } else {
+                    Message::FilesPreviewLoading
+                })))
+            })
+            .when_some(self.info.clone(), |root, info| {
+                root.child(div().text_xs().text_color(cx.theme().muted_foreground).child(info))
+            })
+    }
+}
diff --git a/nebula_app/src/gpui_shell/math_view.rs b/nebula_app/src/gpui_shell/math_view.rs
index 9e3617a..4a2a885 100644
--- a/nebula_app/src/gpui_shell/math_view.rs
+++ b/nebula_app/src/gpui_shell/math_view.rs
@@ -13,131 +13,116 @@
 //! 失败合同与旧壳一致：编译失败/超预算/缩到 [`MIN_READABLE_MATH_PX`] 之下
 //! 的公式回退为源码文本（组件库侧代码样式），不撑破阅读列。
 
-use std::cell::RefCell;
-use std::collections::HashMap;
+mod source_fallback;
+use source_fallback::SourceFallback;
+
+use std::cell::{Cell, RefCell};
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
+use std::io;
 use std::rc::Rc;
 use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
 
+use gpui::prelude::*;
 use gpui::{
-    App, AvailableSpace, Bounds, Corners, Element, ElementId, GlobalElementId, InspectorElementId,
-    IntoElement, LayoutId, Pixels, Rgba, ShapedLine, SharedString, Size, Style, Window, point, px,
-    size,
+    App, AvailableSpace, Bounds, ClipboardItem, Context, Corners, Element, ElementId, Entity,
+    GlobalElementId, Image, ImageFormat, InspectorElementId, IntoElement, LayoutId, Pixels, Render,
+    RenderImage, Rgba, SharedString, Size, Style, Subscription, Task, Window, div, point, px, size,
+};
+use gpui_component::{
+    ActiveTheme as _, Disableable as _, Sizable as _, StyledExt as _, button::ButtonVariants as _,
 };
 use image::Frame;
+use image::ImageEncoder as _;
 
+use super::copy_feedback::CopyFeedback;
+use super::prelude::{Button, IconName, h_flex};
+use super::scientific_render::{self, FormulaKey, ScientificRender};
+use crate::display::ToastKind;
+use crate::i18n::Message;
+use crate::math::MIN_READABLE_MATH_PX;
 use crate::math::layout::MathLayout;
 use crate::math::rasterizer::MathGlyphRasterizer;
-use crate::math::{DEFAULT_LIMITS, MIN_READABLE_MATH_PX, compile_formula, compile_formula_source};
 
 /// 探针编译字号：注册的渲染闭包用它判定"这条公式能否编译"，失败即让
 /// 组件库走源码文本回退。解析/预算类失败与字号无关，任意正值等价。
 const PROBE_PX: f32 = 16.0;
 
-/// 布局缓存条数上限。键含字号与 DPI，同一公式 fit 前后各占一条；超限
-/// 整体清空，单条重建是亚毫秒级 compile，不值得上 LRU。
-const MAX_LAYOUTS: usize = 1024;
-
-/// 公式位图缓存的字节预算；超限整体清空，可见公式下一帧按需重建。
-const IMAGE_BUDGET_BYTES: usize = 32 * 1024 * 1024;
-
-/// 单条公式位图的物理边长/字节上限；超限回退源码文本，与旧壳"fit 不进
-/// 列宽即回退"同一精神，防止病态长公式吃掉显存。
-const MAX_IMAGE_EDGE_PX: u32 = 8192;
-const MAX_IMAGE_BYTES: usize = 24 * 1024 * 1024;
-
-/// 位图四周的出血余量（物理 px）：字形位图的 bearing 可以越出公式度量
-/// 包围盒 1–2px（`GLYPH_PADDING` + 抗锯齿），出血兜住后仍越界的按行裁剪。
-const CANVAS_PAD: u32 = 2;
-
 /// 与旧壳 `fit_math_run` 相同的收缩余量：布局对字号线性，留 2% 吸收
 /// 取整误差，保证最右侧抗锯齿像素不越出阅读列。
 const FIT_MARGIN: f32 = 0.98;
 
+/// Clipboard export is a transient conversion from the existing cached BGRA
+/// image to PNG. Keep that conversion bounded independently of the shared
+/// scientific cache; a pathological formula should disable image copy rather
+/// than allocate another 24 MiB buffer on the UI thread.
+const MAX_CLIPBOARD_IMAGE_BYTES: usize = 8 * 1024 * 1024;
+
+/// A copy needs one transformed raw frame and one encoded PNG at the same
+/// time. Keep all simultaneous formula-copy work below a small, independent
+/// transient budget; this is separate from (and does not raise) the shared
+/// 48 MiB scientific cache.
+const MAX_CLIPBOARD_WORK_BYTES: usize = MAX_CLIPBOARD_IMAGE_BYTES * 2;
+static CLIPBOARD_WORK_BYTES: AtomicUsize = AtomicUsize::new(0);
+
 /// 注册 TextView 的公式渲染器；`gpui_shell::init` 调用一次。
 pub fn register(cx: &mut App) {
-    cx.set_global(MathAssets::new());
-    gpui_component::text::set_math_renderer(cx, |spec, _, cx| {
+    scientific_render::init(cx);
+    cx.set_global(MathAssets::new(scientific_render::assets(cx)));
+    gpui_component::text::set_math_renderer(cx, |spec, window, cx| {
         let assets = source_assets(cx);
-        if assets.rasterizer.is_none() {
-            return None;
-        }
         // 探针编译：失败的公式仍是文档文本，交回组件库按代码样式排版。
         assets.layout(&spec.source, spec.display, PROBE_PX, 1.0)?;
-        Some(MathView { source: spec.source.clone(), display: spec.display }.into_any_element())
+        let source = spec.source.clone();
+        let display = spec.display;
+        let key = ("markdown-math-actions", math_element_key(&source, display));
+        let state = window
+            .use_keyed_state(key, cx, |_, cx| MathFormulaView::new(source.clone(), display, cx));
+        Some(state.into_any_element())
     });
 }
 
-// ---- 全局缓存 ----
-
-#[derive(Clone, Debug, Eq, Hash, PartialEq)]
-struct LayoutKey {
-    source: SharedString,
-    display: bool,
-    pixel_size_bits: u32,
-    pixels_per_point_bits: u32,
-}
-
-#[derive(Clone, Debug, Eq, Hash, PartialEq)]
-struct ImageKey {
-    source: SharedString,
-    display: bool,
-    pixel_size_bits: u32,
-    raster_scale_bits: u32,
-    color: u32,
-}
+// ---- Application-owned background resources ----
 
 /// 位图内的定位信息（物理 px）：paint 时把位图基线吸附到元素基线。
 #[derive(Clone, Copy, Debug)]
-struct ImageGeometry {
+pub(super) struct ImageGeometry {
     /// 位图顶边到公式基线的距离。
-    baseline: u32,
+    pub(super) baseline: u32,
     /// 位图左边相对公式盒左缘的外扩（出血）。
-    pad: u32,
-    width: u32,
-    height: u32,
+    pub(super) pad: u32,
+    pub(super) width: u32,
+    pub(super) height: u32,
 }
 
 pub(crate) struct MathAssets {
     verbatim_source: bool,
-    /// 字体解析失败时为 None：探针直接失败，所有公式回退源码文本。
-    rasterizer: Option<MathGlyphRasterizer>,
-    layouts: HashMap<LayoutKey, Option<Arc<MathLayout>>>,
-    images: HashMap<ImageKey, Option<(Arc<gpui::RenderImage>, ImageGeometry)>>,
-    image_bytes: usize,
+    engine: Arc<ScientificRender>,
 }
 
 impl gpui::Global for MathAssets {}
-
 struct SourceMathAssets(MathAssets);
-
 impl gpui::Global for SourceMathAssets {}
 
 fn source_assets(cx: &mut App) -> &mut MathAssets {
     if cx.try_global::<SourceMathAssets>().is_none() {
-        cx.set_global(SourceMathAssets(MathAssets { verbatim_source: true, ..MathAssets::new() }));
+        let mut assets = MathAssets::new(scientific_render::assets(cx));
+        assets.verbatim_source = true;
+        cx.set_global(SourceMathAssets(assets));
     }
     &mut cx.global_mut::<SourceMathAssets>().0
 }
 
 impl MathAssets {
-    fn new() -> Self {
-        Self {
-            verbatim_source: false,
-            rasterizer: MathGlyphRasterizer::new().ok(),
-            layouts: HashMap::new(),
-            images: HashMap::new(),
-            image_bytes: 0,
-        }
+    fn new(engine: Arc<ScientificRender>) -> Self {
+        Self { verbatim_source: false, engine }
     }
 
-    /// 数学字体加载失败时终端覆盖层必须保留源码，不能先跳格再画空位图。
     pub(crate) fn can_rasterize(&self) -> bool {
-        self.rasterizer.is_some()
+        true // Actual font/bitmap failures remain a source fallback in the worker cache.
     }
 
-    /// 这条公式能不能真的合成出位图。终端覆盖层在跳过源格**之前**问一次：
-    /// 位图合成失败（缺字形、超出位图上限）时源格必须留在屏幕上，否则那块
-    /// 区域既没有原文也没有公式。命中的位图进缓存，随后的绘制取同一份。
     pub(crate) fn can_compose(
         &mut self,
         source: &SharedString,
@@ -150,7 +135,6 @@ impl MathAssets {
         self.image(source, display, pixel_size, pixels_per_point, raster_scale, color).is_some()
     }
 
-    /// 编排（含负缓存：失败公式不逐帧重试）。
     pub(crate) fn layout(
         &mut self,
         source: &SharedString,
@@ -158,25 +142,13 @@ impl MathAssets {
         pixel_size: f32,
         pixels_per_point: f32,
     ) -> Option<Arc<MathLayout>> {
-        let key = LayoutKey {
-            source: source.clone(),
+        self.engine.layout(FormulaKey::new(
+            source.clone(),
             display,
-            pixel_size_bits: pixel_size.to_bits(),
-            pixels_per_point_bits: pixels_per_point.to_bits(),
-        };
-        if !self.layouts.contains_key(&key) {
-            if self.layouts.len() >= MAX_LAYOUTS {
-                self.layouts.clear();
-            }
-            let compile =
-                if self.verbatim_source { compile_formula_source } else { compile_formula };
-            let compiled =
-                compile(source.as_ref(), display, pixel_size, pixels_per_point, DEFAULT_LIMITS)
-                    .ok()
-                    .map(Arc::new);
-            self.layouts.insert(key.clone(), compiled);
-        }
-        self.layouts.get(&key).and_then(Clone::clone)
+            self.verbatim_source,
+            pixel_size,
+            pixels_per_point,
+        ))
     }
 
     /// 旧壳 `fit_math_run` 的等价物：超宽公式按线性比例缩字号，缩到
@@ -211,147 +183,395 @@ impl MathAssets {
         raster_scale: f32,
         color: Rgba,
     ) -> Option<(Arc<gpui::RenderImage>, ImageGeometry)> {
-        let color_bits = ((color.r * 255.0) as u32) << 16
-            | ((color.g * 255.0) as u32) << 8
-            | (color.b * 255.0) as u32;
-        let key = ImageKey {
-            source: source.clone(),
-            display,
-            pixel_size_bits: pixel_size.to_bits(),
-            raster_scale_bits: raster_scale.to_bits(),
-            color: color_bits,
-        };
-        if let Some(cached) = self.images.get(&key) {
-            return cached.clone();
-        }
-
-        let layout = self.layout(source, display, pixel_size, pixels_per_point)?;
-        let composed = self
-            .rasterizer
-            .as_ref()
-            .and_then(|rasterizer| compose_image(rasterizer, &layout, raster_scale, color));
-        if let Some((_, geometry)) = &composed {
-            let bytes = geometry.width as usize * geometry.height as usize * 4;
-            if self.image_bytes.saturating_add(bytes) > IMAGE_BUDGET_BYTES {
-                self.images.clear();
-                self.image_bytes = 0;
-            }
-            self.image_bytes += bytes;
-        }
-        self.images.insert(key, composed.clone());
-        composed
+        self.engine.image(
+            FormulaKey::new(
+                source.clone(),
+                display,
+                self.verbatim_source,
+                pixel_size,
+                pixels_per_point,
+            ),
+            raster_scale,
+            color,
+        )
     }
 }
 
-/// 把整条公式（字形 + 分数线等矩形）按物理像素合成为一张直通 alpha 的
-/// BGRA 位图。字形位图原点吸附整数物理像素（旧壳同款），advance 保持
-/// 全精度。
-fn compose_image(
+/// Adapt the shared CPU bitmap to GPUI without copying its pixel buffer.
+pub(super) fn compose_image(
     rasterizer: &MathGlyphRasterizer,
     layout: &MathLayout,
     raster_scale: f32,
     color: Rgba,
 ) -> Option<(Arc<gpui::RenderImage>, ImageGeometry)> {
-    let content_width = (layout.metrics.width * raster_scale).ceil().max(1.0) as u32;
-    let ascent = (layout.metrics.height * raster_scale).ceil().max(0.0) as u32;
-    let descent = (layout.metrics.depth * raster_scale).ceil().max(0.0) as u32;
-    let width = content_width.checked_add(CANVAS_PAD * 2)?;
-    let height = ascent.checked_add(descent)?.checked_add(CANVAS_PAD * 2)?.max(1);
-    if width > MAX_IMAGE_EDGE_PX || height > MAX_IMAGE_EDGE_PX {
-        return None;
-    }
-    let bytes = width as usize * height as usize * 4;
-    if bytes > MAX_IMAGE_BYTES {
-        return None;
-    }
-    let baseline = (ascent + CANVAS_PAD) as i64;
-
-    // 先在 alpha 平面上合成（Porter-Duff over），最后一次性染色。
-    let mut coverage = vec![0u8; width as usize * height as usize];
-    for op in &layout.glyphs {
-        let glyph = rasterizer.rasterize(op.glyph_id, op.pixel_size * raster_scale).ok()?;
-        if glyph.width == 0 || glyph.height == 0 {
-            continue;
-        }
-        let origin_x = (op.x * raster_scale).round() as i64 + glyph.left as i64 + CANVAS_PAD as i64;
-        let origin_y = baseline + (op.baseline_y * raster_scale).round() as i64 - glyph.top as i64;
-        blit_over(
-            &mut coverage,
-            width,
-            height,
-            origin_x,
-            origin_y,
-            glyph.width as u32,
-            glyph.height as u32,
-            |x, y| glyph.rgba[(y * glyph.width as usize + x) * 4 + 3],
-        );
-    }
-    for rule in &layout.rules {
-        let x0 = (rule.x * raster_scale).round() as i64 + CANVAS_PAD as i64;
-        let y0 = baseline + (rule.y * raster_scale).round() as i64;
-        let w = (rule.width * raster_scale).round().max(1.0) as u32;
-        let h = (rule.height * raster_scale).round().max(1.0) as u32;
-        blit_over(&mut coverage, width, height, x0, y0, w, h, |_, _| u8::MAX);
-    }
-
-    // gpui 图像管线吃直通 alpha 的 BGRA（与 DirectWrite 字形同一约定）。
-    let mut bgra = vec![0u8; bytes];
-    let (r, g, b) = (
+    let color = [
         (color.r * 255.0).round() as u8,
         (color.g * 255.0).round() as u8,
         (color.b * 255.0).round() as u8,
-    );
-    for (pixel, alpha) in bgra.chunks_exact_mut(4).zip(&coverage) {
-        pixel[0] = b;
-        pixel[1] = g;
-        pixel[2] = r;
-        pixel[3] = *alpha;
-    }
-    let buffer = image::RgbaImage::from_raw(width, height, bgra)?;
-    let geometry = ImageGeometry { baseline: baseline as u32, pad: CANVAS_PAD, width, height };
+    ];
+    let bitmap = crate::math::bitmap::compose(rasterizer, layout, raster_scale, color)?;
+    let geometry = ImageGeometry {
+        baseline: bitmap.baseline,
+        pad: bitmap.pad,
+        width: bitmap.width,
+        height: bitmap.height,
+    };
+    let buffer = image::RgbaImage::from_raw(bitmap.width, bitmap.height, bitmap.pixels)?;
     Some((Arc::new(gpui::RenderImage::new([Frame::new(buffer)])), geometry))
 }
 
-/// alpha 平面上的 Porter-Duff over 合成；目标越界的像素按行列裁剪。
-#[allow(clippy::too_many_arguments)]
-fn blit_over(
-    canvas: &mut [u8],
-    canvas_width: u32,
-    canvas_height: u32,
-    origin_x: i64,
-    origin_y: i64,
-    width: u32,
-    height: u32,
-    sample: impl Fn(usize, usize) -> u8,
-) {
-    for row in 0..height as i64 {
-        let y = origin_y + row;
-        if y < 0 || y >= canvas_height as i64 {
-            continue;
+// ---- 公式元素 ----
+
+fn math_element_key(source: &SharedString, display: bool) -> u64 {
+    let mut hasher = DefaultHasher::new();
+    source.hash(&mut hasher);
+    display.hash(&mut hasher);
+    hasher.finish()
+}
+
+fn latex_clipboard_text(source: &SharedString) -> String {
+    source.to_string()
+}
+
+fn image_copy_is_complete(layout: &MathLayout) -> bool {
+    layout.text.is_empty()
+}
+
+/// Return a ready-to-copy image from the same scientific cache used by the
+/// visible formula. A formula with text fallback is intentionally rejected:
+/// `MathLayout.text` is painted separately by [`MathView::paint_math`], so its
+/// `RenderImage` alone would be an incomplete copy.
+fn ready_formula_image(
+    source: &SharedString,
+    display: bool,
+    pixel_size: f32,
+    window: &Window,
+    cx: &mut App,
+) -> Option<Arc<RenderImage>> {
+    let text_style = window.text_style();
+    let pixels_per_point = crate::math::pixels_per_point(window.scale_factor());
+    let color = Rgba::from(text_style.color);
+    let raster_scale = window.scale_factor();
+    let assets = source_assets(cx);
+    let layout = assets.layout(source, display, pixel_size, pixels_per_point)?;
+    if !image_copy_is_complete(&layout) {
+        return None;
+    }
+    let (image, _) =
+        assets.image(source, display, pixel_size, pixels_per_point, raster_scale, color)?;
+    let size = image.size(0);
+    let width = u32::from(size.width) as usize;
+    let height = u32::from(size.height) as usize;
+    let expected = width.checked_mul(height)?.checked_mul(4)?;
+    (expected > 0
+        && expected <= MAX_CLIPBOARD_IMAGE_BYTES
+        && image.as_bytes(0).is_some_and(|bytes| bytes.len() == expected))
+    .then_some(image)
+}
+
+struct ClipboardWorkReservation {
+    bytes: usize,
+}
+
+impl Drop for ClipboardWorkReservation {
+    fn drop(&mut self) {
+        CLIPBOARD_WORK_BYTES.fetch_sub(self.bytes, Ordering::AcqRel);
+    }
+}
+
+fn reserve_clipboard_work(input_bytes: usize) -> Option<ClipboardWorkReservation> {
+    let bytes = input_bytes.checked_add(MAX_CLIPBOARD_IMAGE_BYTES)?;
+    if bytes > MAX_CLIPBOARD_WORK_BYTES {
+        return None;
+    }
+    let mut used = CLIPBOARD_WORK_BYTES.load(Ordering::Acquire);
+    loop {
+        let next = used.checked_add(bytes)?;
+        if next > MAX_CLIPBOARD_WORK_BYTES {
+            return None;
         }
-        for column in 0..width as i64 {
-            let x = origin_x + column;
-            if x < 0 || x >= canvas_width as i64 {
-                continue;
-            }
-            let source = sample(column as usize, row as usize) as u32;
-            if source == 0 {
-                continue;
-            }
-            let target = &mut canvas[y as usize * canvas_width as usize + x as usize];
-            let existing = *target as u32;
-            *target = (existing + source * (255 - existing) / 255).min(255) as u8;
+        match CLIPBOARD_WORK_BYTES.compare_exchange_weak(
+            used,
+            next,
+            Ordering::AcqRel,
+            Ordering::Acquire,
+        ) {
+            Ok(_) => return Some(ClipboardWorkReservation { bytes }),
+            Err(actual) => used = actual,
         }
     }
 }
 
-// ---- 公式元素 ----
+/// A writer which fails before the output vector can grow beyond the
+/// clipboard budget.  `PngEncoder` writes incrementally, so this bounds the
+/// encoded allocation rather than encoding an oversized PNG and discarding it
+/// afterwards.
+struct BoundedPngWriter {
+    bytes: Vec<u8>,
+    limit: usize,
+}
+
+impl BoundedPngWriter {
+    fn new(limit: usize, capacity: usize) -> Self {
+        Self { bytes: Vec::with_capacity(capacity.min(limit)), limit }
+    }
+}
+
+impl io::Write for BoundedPngWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let remaining = self.limit.saturating_sub(self.bytes.len());
+        if bytes.len() > remaining {
+            return Err(io::Error::new(io::ErrorKind::WriteZero, "PNG clipboard budget exceeded"));
+        }
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+/// Convert GPUI's cached BGRA frame into a bounded RGBA PNG for the system
+/// clipboard. The cached frame is straight-alpha (coverage in A, source color
+/// in RGB), so only the channel order changes; no un-premultiplication is
+/// required here. This function is called by a background task for UI copies.
+fn formula_png(image: &RenderImage) -> Option<Vec<u8>> {
+    let size = image.size(0);
+    let width = u32::from(size.width);
+    let height = u32::from(size.height);
+    let expected = (width as usize).checked_mul(height as usize)?.checked_mul(4)?;
+    if expected == 0 || expected > MAX_CLIPBOARD_IMAGE_BYTES {
+        return None;
+    }
+    let source = image.as_bytes(0)?;
+    if source.len() != expected {
+        return None;
+    }
+    let _reservation = reserve_clipboard_work(expected)?;
+    formula_png_from_bgra(width, height, source)
+}
+
+fn formula_png_from_bgra(width: u32, height: u32, source: &[u8]) -> Option<Vec<u8>> {
+    let expected = (width as usize).checked_mul(height as usize)?.checked_mul(4)?;
+    if expected == 0 || expected > MAX_CLIPBOARD_IMAGE_BYTES || source.len() != expected {
+        return None;
+    }
+    let mut rgba = source.to_vec();
+    for pixel in rgba.chunks_exact_mut(4) {
+        pixel.swap(0, 2);
+    }
+    let mut writer = BoundedPngWriter::new(MAX_CLIPBOARD_IMAGE_BYTES, expected);
+    image::codecs::png::PngEncoder::new(&mut writer)
+        .write_image(&rgba, width, height, image::ExtendedColorType::Rgba8)
+        .ok()?;
+    Some(writer.bytes)
+}
+
+/// Stateful wrapper around the layout element. The action controls are
+/// absolutely positioned and only become visible while the formula group is
+/// hovered, so inline baselines and display-math spacing remain unchanged.
+struct MathFormulaView {
+    source: SharedString,
+    display: bool,
+    visible_pixel_size: Rc<Cell<Option<f32>>>,
+    latex_feedback: Entity<CopyFeedback>,
+    image_feedback: Entity<CopyFeedback>,
+    image_copy_task: Option<Task<()>>,
+    _latex_feedback_subscription: Subscription,
+    _image_feedback_subscription: Subscription,
+}
+
+impl MathFormulaView {
+    fn new(source: SharedString, display: bool, cx: &mut Context<Self>) -> Self {
+        let latex_feedback = cx.new(|_| CopyFeedback::new());
+        let image_feedback = cx.new(|_| CopyFeedback::new());
+        let latex_feedback_subscription = cx.observe(&latex_feedback, |_, _, cx| cx.notify());
+        let image_feedback_subscription = cx.observe(&image_feedback, |_, _, cx| cx.notify());
+        Self {
+            source,
+            display,
+            visible_pixel_size: Rc::new(Cell::new(None)),
+            latex_feedback,
+            image_feedback,
+            image_copy_task: None,
+            _latex_feedback_subscription: latex_feedback_subscription,
+            _image_feedback_subscription: image_feedback_subscription,
+        }
+    }
+
+    fn copy_formula_image(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.image_copy_task.is_some() {
+            return;
+        }
+        let language = super::config::ui_language(cx);
+        let Some(pixel_size) = self.visible_pixel_size.get() else {
+            crate::gpui_shell::toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                language.text(Message::EditorMathImageUnavailable),
+            );
+            return;
+        };
+        let Some(image) = ready_formula_image(&self.source, self.display, pixel_size, window, cx)
+        else {
+            crate::gpui_shell::toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                language.text(Message::EditorMathImageUnavailable),
+            );
+            return;
+        };
+
+        let executor = cx.background_executor().clone();
+        let encode = executor.spawn(async move { formula_png(&image) });
+        self.image_feedback.update(cx, |feedback, cx| feedback.mark_pending(cx));
+
+        let window_handle = window.window_handle();
+        self.image_copy_task = Some(cx.spawn(async move |this, cx| {
+            let png = encode.await;
+            let succeeded = png.is_some();
+            let applied = this.update(cx, move |view, cx| {
+                view.image_copy_task = None;
+                match png {
+                    Some(png) => {
+                        cx.write_to_clipboard(ClipboardItem::new_image(&Image::from_bytes(
+                            ImageFormat::Png,
+                            png,
+                        )));
+                        view.image_feedback.update(cx, |feedback, cx| feedback.mark_copied(cx));
+                    },
+                    None => view.image_feedback.update(cx, |feedback, cx| feedback.clear(cx)),
+                }
+            });
+            if applied.is_ok() {
+                let _ = window_handle.update(cx, |_, window, cx| {
+                    let (kind, message) = if succeeded {
+                        (ToastKind::Success, Message::EditorMathImageCopied)
+                    } else {
+                        (ToastKind::Warning, Message::EditorMathImageUnavailable)
+                    };
+                    crate::gpui_shell::toast::toast(window, cx, kind, language.text(message));
+                });
+            }
+        }));
+        cx.notify();
+    }
+}
+
+impl Render for MathFormulaView {
+    fn render(&mut self, window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let source = self.source.clone();
+        let source_for_latex = source.clone();
+        let display = self.display;
+        let key = math_element_key(&source, display);
+        let group = format!("markdown-math-actions-{key:x}");
+        let language = super::config::ui_language(cx);
+        let latex_feedback = self.latex_feedback.clone();
+        let image_feedback = self.image_feedback.clone();
+        let latex_copied = latex_feedback.read(cx).is_copied();
+        let image_copied = image_feedback.read(cx).is_copied();
+        let image_pending = image_feedback.read(cx).is_pending();
+        let visible_pixel_size = self.visible_pixel_size.get();
+        let image_ready = !image_pending
+            && visible_pixel_size.is_some_and(|pixel_size| {
+                ready_formula_image(&source, display, pixel_size, window, cx).is_some()
+            });
+        let owner = cx.weak_entity();
+
+        let latex_button = Button::new(("markdown-copy-math-latex", key))
+            .custom(
+                gpui_component::button::ButtonCustomVariant::new(cx)
+                    .hover(cx.theme().list_hover)
+                    .active(cx.theme().list_active),
+            )
+            .compact()
+            .size(px(28.0))
+            .icon(if latex_copied { IconName::Check } else { IconName::Copy })
+            .tooltip(language.text(Message::EditorCopyMathLatex))
+            .on_click(move |_, window, cx| {
+                // The GPUI clipboard API is best-effort and returns `()`. The
+                // payload is always valid here, so mark the visual action
+                // complete immediately after submitting it.
+                cx.write_to_clipboard(ClipboardItem::new_string(latex_clipboard_text(
+                    &source_for_latex,
+                )));
+                latex_feedback.update(cx, |feedback, cx| feedback.mark_copied(cx));
+                crate::gpui_shell::toast::toast(
+                    window,
+                    cx,
+                    ToastKind::Success,
+                    language.text(Message::EditorMathLatexCopied),
+                );
+            });
+
+        let owner_for_image = owner.clone();
+        let image_button = Button::new(("markdown-copy-math-image", key))
+            .custom(
+                gpui_component::button::ButtonCustomVariant::new(cx)
+                    .hover(cx.theme().list_hover)
+                    .active(cx.theme().list_active),
+            )
+            .compact()
+            .size(px(28.0))
+            .icon(if image_pending {
+                IconName::Loader
+            } else if image_copied {
+                IconName::Check
+            } else {
+                IconName::File
+            })
+            .loading(image_pending)
+            .disabled(!image_ready || image_pending)
+            .tooltip(if image_ready {
+                language.text(Message::EditorCopyMathImage)
+            } else {
+                language.text(Message::EditorMathImageUnavailable)
+            })
+            .on_click(move |_, window, cx| {
+                let _ = owner_for_image.update(cx, |view, cx| view.copy_formula_image(window, cx));
+            });
+
+        div()
+            .relative()
+            .flex_shrink_0()
+            .group(group.clone())
+            .child(MathView {
+                source,
+                display,
+                visible_pixel_size: self.visible_pixel_size.clone(),
+            })
+            .child(
+                h_flex()
+                    .absolute()
+                    .top(px(-4.0))
+                    .right(px(0.0))
+                    .invisible()
+                    .when(latex_copied || image_copied || image_pending, |actions| {
+                        actions.visible()
+                    })
+                    .group_hover(group, |actions| actions.visible())
+                    .gap(px(2.0))
+                    .p(px(2.0))
+                    .rounded(cx.theme().radius)
+                    .border_1()
+                    .border_color(cx.theme().border)
+                    .bg(cx.theme().popover)
+                    .shadow_sm()
+                    .child(latex_button)
+                    .child(image_button),
+            )
+    }
+}
 
 /// 一条公式的 GPUI 元素。行内公式由组件库放进换行 flex 行（底边对齐），
 /// 自身用底部留白把公式基线补齐到文本基线；块级公式由组件库水平居中。
 struct MathView {
     source: SharedString,
     display: bool,
+    visible_pixel_size: Rc<Cell<Option<f32>>>,
 }
 
 /// measure 闭包与 paint 之间的当帧交接。taffy 可能以不同可用宽度多次
@@ -367,9 +587,8 @@ enum FitSlot {
         /// 元素底边到公式基线的距离（行内基线补偿；块级为 depth）。
         baseline_from_bottom: f32,
     },
-    /// fit 放弃后的退化形态：单行源码文本（探针已保证可编译，只有
-    /// 极窄列会走到这里）。
-    Text(ShapedLine),
+    /// 排版等待或 fit 放弃时保留有界的多行源码预览。
+    Text(SourceFallback),
 }
 
 impl IntoElement for MathView {
@@ -420,6 +639,7 @@ impl Element for MathView {
         let color = Rgba::from(text_style.color);
         let measure_slot = slot.clone();
         let style = Style { flex_shrink: 0.0, ..Style::default() };
+        let visible_pixel_size = self.visible_pixel_size.clone();
         let layout_id = window.request_measured_layout(style, move |_, available, window, cx| {
             let max_width = match available.width {
                 AvailableSpace::Definite(width) => f32::from(width).max(8.0),
@@ -440,6 +660,7 @@ impl Element for MathView {
                 });
             match fitted {
                 Some((layout, pixel_size)) => {
+                    visible_pixel_size.set(Some(pixel_size));
                     let bottom_pad = if display {
                         0.0
                     } else {
@@ -453,15 +674,18 @@ impl Element for MathView {
                     size(px(width), px(height))
                 },
                 None => {
-                    let line = window.text_system().shape_line(
-                        source.clone(),
+                    visible_pixel_size.set(None);
+                    let fallback = SourceFallback::shape(
+                        &source,
                         px(nominal_px),
-                        std::slice::from_ref(&run),
-                        None,
+                        run.clone(),
+                        max_width,
+                        px(line_height),
+                        window,
                     );
-                    let width = f32::from(line.width).min(max_width.max(8.0));
-                    *measure_slot.borrow_mut() = FitSlot::Text(line);
-                    size(px(width), px(line_height))
+                    let measured = fallback.size;
+                    *measure_slot.borrow_mut() = FitSlot::Text(fallback);
+                    measured
                 },
             }
         });
@@ -493,10 +717,7 @@ impl Element for MathView {
         let line_height = text_style.line_height_in_pixels(window.rem_size());
         match &*slot.borrow() {
             FitSlot::Pending => {},
-            FitSlot::Text(line) => {
-                let _ =
-                    line.paint(bounds.origin, line_height, gpui::TextAlign::Left, None, window, cx);
-            },
+            FitSlot::Text(text) => text.paint(bounds, line_height, window, cx),
             FitSlot::Math { layout, pixel_size, baseline_from_bottom } => {
                 let bounds_width = f32::from(bounds.size.width);
                 // taffy 最终宽度与最后一次 measure 不一致（罕见）：按实际
@@ -512,9 +733,11 @@ impl Element for MathView {
                         pixels_per_point,
                         bounds_width,
                     ) else {
+                        self.visible_pixel_size.set(None);
                         self.paint_source(bounds, window, cx);
                         return;
                     };
+                    self.visible_pixel_size.set(Some(pixel_size));
                     let baseline = bounds.bottom() - px(layout.metrics.depth);
                     self.paint_math(layout.as_ref(), pixel_size, baseline, bounds, window, cx);
                     return;
@@ -530,20 +753,16 @@ impl Element for MathView {
 impl MathView {
     fn paint_source(&self, bounds: Bounds<Pixels>, window: &mut Window, cx: &mut App) {
         let style = window.text_style();
-        let line = window.text_system().shape_line(
-            self.source.clone(),
+        let line_height = style.line_height_in_pixels(window.rem_size());
+        let fallback = SourceFallback::shape(
+            &self.source,
             style.font_size.to_pixels(window.rem_size()),
-            &[style.to_run(self.source.len())],
-            None,
-        );
-        let _ = line.paint(
-            bounds.origin,
-            style.line_height_in_pixels(window.rem_size()),
-            gpui::TextAlign::Left,
-            None,
+            style.to_run(self.source.len()),
+            f32::from(bounds.size.width),
+            line_height,
             window,
-            cx,
         );
+        fallback.paint(bounds, line_height, window, cx);
     }
 
     /// 位图贴到基线上（物理像素吸附），数学字体缺字的字符用 gpui 文本
@@ -647,3 +866,57 @@ fn paint_cached_image(
         false,
     );
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::math::layout::MathTextOp;
+    use std::io::Write as _;
+
+    #[test]
+    fn formula_png_converts_gpui_bgra_to_rgba_without_changing_alpha() {
+        let frame = image::RgbaImage::from_raw(
+            2,
+            1,
+            vec![
+                0x33, 0x22, 0x11, 0x80, // BGRA -> RGBA (11,22,33,80)
+                0xCC, 0xBB, 0xAA, 0xFF,
+            ],
+        )
+        .unwrap();
+        let image = RenderImage::new([Frame::new(frame)]);
+        let png = formula_png(&image).expect("small formula frame is exportable");
+        let decoded = image::load_from_memory(&png).unwrap().into_rgba8();
+        assert_eq!(decoded.as_raw(), &[0x11, 0x22, 0x33, 0x80, 0xAA, 0xBB, 0xCC, 0xFF]);
+    }
+
+    #[test]
+    fn formula_png_rejects_empty_frames() {
+        let image = RenderImage::new([Frame::new(image::RgbaImage::new(0, 0))]);
+        assert!(formula_png(&image).is_none());
+    }
+
+    #[test]
+    fn formula_image_export_rejects_layouts_with_font_fallback_text() {
+        let mut layout = MathLayout::default();
+        assert!(image_copy_is_complete(&layout));
+        layout
+            .text
+            .push(MathTextOp { character: '中', x: 0.0, baseline_y: 0.0, pixel_size: 16.0 });
+        assert!(!image_copy_is_complete(&layout));
+    }
+
+    #[test]
+    fn latex_copy_preserves_the_current_formula_source_verbatim() {
+        let source: SharedString = "  x^2 + y^2  \r\n".into();
+        assert_eq!(latex_clipboard_text(&source), "  x^2 + y^2  \r\n");
+    }
+
+    #[test]
+    fn png_writer_rejects_output_past_the_clipboard_budget() {
+        let mut writer = BoundedPngWriter::new(4, 0);
+        assert!(writer.write_all(b"1234").is_ok());
+        assert!(writer.write_all(b"5").is_err());
+        assert_eq!(writer.bytes, b"1234");
+    }
+}
diff --git a/nebula_app/src/gpui_shell/math_view/source_fallback.rs b/nebula_app/src/gpui_shell/math_view/source_fallback.rs
new file mode 100644
index 0000000..9d105f0
--- /dev/null
+++ b/nebula_app/src/gpui_shell/math_view/source_fallback.rs
@@ -0,0 +1,73 @@
+//! Multiline source presentation while a formula is pending or cannot fit.
+
+use gpui::{
+    App, Bounds, ContentMask, Pixels, SharedString, Size, TextRun, Window, WrappedLine, px, size,
+};
+
+pub(super) struct SourceFallback {
+    lines: Vec<WrappedLine>,
+    pub(super) size: Size<Pixels>,
+}
+
+impl SourceFallback {
+    pub(super) fn shape(
+        source: &SharedString,
+        font_size: Pixels,
+        mut run: TextRun,
+        max_width: f32,
+        line_height: Pixels,
+        window: &Window,
+    ) -> Self {
+        let text = match crate::text_preview::multiline_source(source) {
+            std::borrow::Cow::Borrowed(_) => source.clone(),
+            std::borrow::Cow::Owned(text) => text.into(),
+        };
+        run.len = text.len();
+        let wrap_width = max_width.is_finite().then(|| px(max_width.max(8.0)));
+        let lines = window
+            .text_system()
+            .shape_text(
+                text,
+                font_size,
+                &[run],
+                wrap_width,
+                Some(crate::text_preview::MAX_SOURCE_PREVIEW_LINES),
+            )
+            .map(|lines| lines.into_vec())
+            .unwrap_or_default();
+        let mut measured = size(px(0.0), px(0.0));
+        for line in &lines {
+            let line_size = line.size(line_height);
+            measured.width = measured.width.max(line_size.width);
+            measured.height += line_size.height;
+        }
+        measured.height = measured.height.max(line_height);
+        Self { lines, size: measured }
+    }
+
+    pub(super) fn paint(
+        &self,
+        bounds: Bounds<Pixels>,
+        line_height: Pixels,
+        window: &mut Window,
+        cx: &mut App,
+    ) {
+        window.with_content_mask(Some(ContentMask { bounds }), |window| {
+            let mut origin = bounds.origin;
+            for line in &self.lines {
+                if origin.y >= bounds.bottom() {
+                    break;
+                }
+                let _ = line.paint(
+                    origin,
+                    line_height,
+                    gpui::TextAlign::Left,
+                    Some(bounds),
+                    window,
+                    cx,
+                );
+                origin.y += line.size(line_height).height;
+            }
+        });
+    }
+}
diff --git a/nebula_app/src/gpui_shell/mod.rs b/nebula_app/src/gpui_shell/mod.rs
index 6370edb..69a55c6 100644
--- a/nebula_app/src/gpui_shell/mod.rs
+++ b/nebula_app/src/gpui_shell/mod.rs
@@ -25,13 +25,17 @@ macro_rules! eprintln {
 mod assets;
 pub mod code_tab;
 pub mod config;
+pub(crate) mod copy_feedback;
 pub mod doc_tabs;
 pub mod file_drop;
 mod file_editor;
+mod file_preview;
 pub mod http;
 pub mod math_view;
+mod molecule_view;
 pub mod network_settings;
 pub mod prelude;
+mod scientific_render;
 pub mod session_restore;
 pub mod settings_pane;
 pub mod ssh_hosts;
@@ -172,6 +176,7 @@ fn init(cx: &mut App) {
     let settings = config::Settings::load(theme::effective_theme_name(cx));
     gpui_component::set_locale(settings.ui_language.gpui_component_locale());
     cx.set_global(settings);
+    toast::init(cx);
 }
 
 fn register_bundled_fonts(cx: &App) {
diff --git a/nebula_app/src/gpui_shell/molecule_view.rs b/nebula_app/src/gpui_shell/molecule_view.rs
new file mode 100644
index 0000000..fe96220
--- /dev/null
+++ b/nebula_app/src/gpui_shell/molecule_view.rs
@@ -0,0 +1,88 @@
+//! Markdown and tooltip adapter for the shared SMILES depiction engine.
+
+use crate::i18n::Message;
+use gpui::prelude::*;
+use gpui::{App, Context, IntoElement, ObjectFit, Render, SharedString, Window, div, img, px};
+use gpui_component::ActiveTheme;
+
+pub(crate) struct MoleculeView {
+    source: SharedString,
+}
+
+impl MoleculeView {
+    pub(crate) fn new(source: SharedString, _: &mut Context<Self>) -> Self {
+        Self { source }
+    }
+}
+
+impl Render for MoleculeView {
+    fn render(&mut self, _: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let result = super::scientific_render::assets(cx)
+            .molecule(self.source.clone(), cx.theme().is_dark());
+        let loading = result.is_none();
+        let invalid = matches!(result, Some(None));
+        let image = result.flatten();
+        let language = super::config::ui_language(cx);
+        div()
+            .w_full()
+            .min_w_0()
+            .max_w(px(600.0))
+            .flex()
+            .flex_col()
+            .gap_2()
+            .p_3()
+            .rounded_lg()
+            .border_1()
+            .border_color(cx.theme().border)
+            .bg(cx.theme().muted)
+            .child(div().text_xs().text_color(cx.theme().muted_foreground).child("SMILES"))
+            .when_some(image, |root, image| {
+                root.child(img(image).w_full().h(px(240.0)).object_fit(ObjectFit::Contain))
+            })
+            .when(loading, |root| {
+                root.child(div().h(px(240.0)).child(language.text(Message::ChemistryLoading)))
+            })
+            .when(invalid, |root| {
+                root.child(
+                    div()
+                        .text_xs()
+                        .text_color(cx.theme().muted_foreground)
+                        .child(language.text(Message::ChemistryInvalid)),
+                )
+            })
+            .child(
+                div()
+                    .text_xs()
+                    .font_family(cx.theme().mono_font_family.clone())
+                    .whitespace_normal()
+                    .child(self.source.clone()),
+            )
+    }
+}
+
+pub(super) fn markdown_extensions() -> gpui_component::text::MarkdownExtensions {
+    use gpui_component::text::{MarkdownExtensions, MarkdownNode};
+    if !crate::chemistry::STRUCTURE_RENDERING_ENABLED {
+        // No custom parser: SMILES fences remain ordinary, copyable code blocks.
+        return MarkdownExtensions::default();
+    }
+    MarkdownExtensions::default()
+        .block_parser(|node, _| {
+            let markdown::mdast::Node::Code(code) = node else { return None };
+            if !code.lang.as_deref().is_some_and(|lang| lang.eq_ignore_ascii_case("smiles")) {
+                return None;
+            }
+            Some(
+                MarkdownNode::new("pebrel-smiles", code.value.clone())
+                    .text(code.value.clone())
+                    .markdown(format!("```smiles\n{}\n```", code.value)),
+            )
+        })
+        .block_renderer("pebrel-smiles", |node, window, cx: &mut App| {
+            let source: SharedString = node.data::<String>().cloned().unwrap_or_default().into();
+            let state = window.use_keyed_state(source.clone(), cx, |_, cx| {
+                cx.new(|cx| MoleculeView::new(source, cx))
+            });
+            state.read(cx).clone()
+        })
+}
diff --git a/nebula_app/src/gpui_shell/scientific_render.rs b/nebula_app/src/gpui_shell/scientific_render.rs
new file mode 100644
index 0000000..d9a952c
--- /dev/null
+++ b/nebula_app/src/gpui_shell/scientific_render.rs
@@ -0,0 +1,417 @@
+//! Application-scoped scientific assets. Only bounded background jobs compile
+//! formulas, rasterize glyphs or depict molecules; views retain source identities.
+
+use std::collections::{HashSet, VecDeque};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use futures::{StreamExt as _, channel::mpsc};
+use gpui::{App, BackgroundExecutor, RenderImage, Rgba, SharedString, SvgRenderer};
+
+use super::math_view::{ImageGeometry, compose_image};
+use crate::math::layout::MathLayout;
+use crate::math::{DEFAULT_LIMITS, compile_formula, compile_formula_source};
+use crate::render_cache::RenderCache;
+
+const CACHE_BYTES: usize = 48 * 1024 * 1024;
+const CACHE_ENTRIES: usize = 1024;
+const MAX_PENDING: usize = 64;
+const PENDING_BYTES: usize = 4 * 1024 * 1024;
+const MAX_RUNNING: usize = 2;
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+pub(super) struct FormulaKey {
+    source: SharedString,
+    display: bool,
+    verbatim: bool,
+    size: u32,
+    points: u32,
+}
+
+impl FormulaKey {
+    pub(super) fn new(
+        source: SharedString,
+        display: bool,
+        verbatim: bool,
+        size: f32,
+        points: f32,
+    ) -> Self {
+        Self { source, display, verbatim, size: size.to_bits(), points: points.to_bits() }
+    }
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+enum Key {
+    Layout(FormulaKey),
+    Image(FormulaKey, u32, [u32; 4]),
+    Molecule(SharedString, bool),
+}
+
+impl Key {
+    fn bytes(&self) -> usize {
+        256 + match self {
+            Self::Layout(formula) | Self::Image(formula, ..) => formula.source.len(),
+            Self::Molecule(source, _) => source.len(),
+        }
+    }
+}
+
+#[derive(Clone)]
+enum Resource {
+    Layout(Arc<MathLayout>),
+    Image(Arc<RenderImage>, ImageGeometry),
+    Molecule(Arc<RenderImage>),
+    Failed,
+}
+
+impl Resource {
+    fn bytes(&self) -> usize {
+        match self {
+            Self::Layout(layout) => layout_bytes(layout),
+            // SVG rasterization may supersample. Charge actual pixel storage,
+            // never logical SVG dimensions or assumed scale factors.
+            Self::Image(image, _) | Self::Molecule(image) => {
+                image.as_bytes(0).map_or(0, |bytes| bytes.len())
+            },
+            Self::Failed => 1,
+        }
+    }
+}
+
+fn layout_bytes(layout: &MathLayout) -> usize {
+    layout.allocated_bytes()
+}
+
+struct Job {
+    key: Key,
+    layout: Option<Arc<MathLayout>>,
+    charge: usize,
+    bitmap_reservation: usize,
+}
+
+struct State {
+    cache: RenderCache<Key, Resource>,
+    pending: HashSet<Key>,
+    queue: VecDeque<Job>,
+    pending_bytes: usize,
+    running: usize,
+    reserved_bitmap_bytes: usize,
+}
+
+impl Default for State {
+    fn default() -> Self {
+        Self {
+            cache: RenderCache::new(CACHE_BYTES, CACHE_ENTRIES),
+            pending: HashSet::new(),
+            queue: VecDeque::new(),
+            pending_bytes: 0,
+            running: 0,
+            reserved_bitmap_bytes: 0,
+        }
+    }
+}
+
+impl State {
+    fn admit(&mut self, job: Job) -> bool {
+        if self.pending.contains(&job.key)
+            || self.pending.len() >= MAX_PENDING
+            || self.pending_bytes.saturating_add(job.charge) > PENDING_BYTES
+            || job.bitmap_reservation > CACHE_BYTES
+        {
+            return false;
+        }
+        self.pending_bytes += job.charge;
+        self.pending.insert(job.key.clone());
+        self.queue.push_back(job);
+        true
+    }
+
+    fn start(&mut self) -> Option<Job> {
+        if self.running >= MAX_RUNNING {
+            return None;
+        }
+        let reservation = self.queue.front()?.bitmap_reservation;
+        if self.reserved_bitmap_bytes.saturating_add(reservation) > CACHE_BYTES {
+            return None;
+        }
+        self.reserved_bitmap_bytes += reservation;
+        // Evict before the worker allocates, not after its image already exists.
+        self.cache.set_byte_budget(CACHE_BYTES - self.reserved_bitmap_bytes);
+        let job = self.queue.pop_front()?;
+        self.running += 1;
+        Some(job)
+    }
+
+    fn finish(&mut self, job: &Job, result: Resource) {
+        self.running -= 1;
+        self.reserved_bitmap_bytes -= job.bitmap_reservation;
+        self.cache.set_byte_budget(CACHE_BYTES - self.reserved_bitmap_bytes);
+        self.pending_bytes -= job.charge;
+        self.pending.remove(&job.key);
+        let charge = job.key.bytes().saturating_add(result.bytes());
+        self.cache.insert(job.key.clone(), result, charge);
+    }
+}
+
+pub(super) struct ScientificRender {
+    state: Mutex<State>,
+    executor: BackgroundExecutor,
+    svg: SvgRenderer,
+    changed: mpsc::UnboundedSender<()>,
+    wake_pending: AtomicBool,
+    document_jobs: AtomicUsize,
+}
+
+struct Assets(Arc<ScientificRender>);
+impl gpui::Global for Assets {}
+
+pub(super) fn init(cx: &mut App) {
+    let (changed, mut receiver) = mpsc::unbounded();
+    let renderer = Arc::new(ScientificRender {
+        state: Mutex::new(State::default()),
+        executor: cx.background_executor().clone(),
+        svg: cx.svg_renderer(),
+        changed,
+        wake_pending: AtomicBool::new(false),
+        document_jobs: AtomicUsize::new(0),
+    });
+    cx.set_global(Assets(renderer.clone()));
+    cx.spawn(async move |cx| {
+        while receiver.next().await.is_some() {
+            renderer.wake_pending.store(false, Ordering::Release);
+            cx.update(|cx| cx.refresh_windows());
+        }
+    })
+    .detach();
+}
+
+pub(super) fn assets(cx: &App) -> Arc<ScientificRender> {
+    cx.global::<Assets>().0.clone()
+}
+
+pub(super) struct DocumentPermit(Arc<ScientificRender>);
+impl Drop for DocumentPermit {
+    fn drop(&mut self) {
+        self.0.document_jobs.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+impl ScientificRender {
+    pub(super) async fn document_permit(self: &Arc<Self>) -> DocumentPermit {
+        loop {
+            if self
+                .document_jobs
+                .fetch_update(Ordering::AcqRel, Ordering::Acquire, |count| {
+                    (count < 2).then_some(count + 1)
+                })
+                .is_ok()
+            {
+                return DocumentPermit(self.clone());
+            }
+            self.executor.timer(std::time::Duration::from_millis(10)).await;
+        }
+    }
+
+    fn request(self: &Arc<Self>, key: Key, layout: Option<Arc<MathLayout>>) -> Option<Resource> {
+        let mut state = self.state.lock().unwrap_or_else(|e| e.into_inner());
+        if let Some(resource) = state.cache.get(&key) {
+            return Some(resource.clone());
+        }
+        let charge = key.bytes() + layout.as_deref().map_or(0, layout_bytes);
+        let bitmap_reservation = match (&key, layout.as_deref()) {
+            (Key::Image(_, scale, _), Some(layout)) => {
+                crate::math::bitmap::required_bytes(layout, f32::from_bits(*scale))
+                    .map_or(0, |bytes| bytes.saturating_add(key.bytes()))
+            },
+            _ => 0,
+        };
+        let admitted = state.admit(Job { key, layout, charge, bitmap_reservation });
+        drop(state);
+        if admitted {
+            self.drive();
+        }
+        None
+    }
+
+    fn drive(self: &Arc<Self>) {
+        loop {
+            let mut state = self.state.lock().unwrap_or_else(|e| e.into_inner());
+            if self.changed.is_closed() {
+                state.queue.clear();
+                return;
+            }
+            let Some(job) = state.start() else { return };
+            drop(state);
+            let engine = self.clone();
+            self.executor
+                .spawn(async move {
+                    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                        engine.build(&job)
+                    }))
+                    .unwrap_or(Resource::Failed);
+                    engine.state.lock().unwrap_or_else(|e| e.into_inner()).finish(&job, result);
+                    if !engine.wake_pending.swap(true, Ordering::AcqRel) {
+                        let _ = engine.changed.unbounded_send(());
+                    }
+                    engine.drive();
+                })
+                .detach();
+        }
+    }
+
+    fn build(&self, job: &Job) -> Resource {
+        match &job.key {
+            Key::Layout(key) => {
+                let compile = if key.verbatim { compile_formula_source } else { compile_formula };
+                compile(
+                    &key.source,
+                    key.display,
+                    f32::from_bits(key.size),
+                    f32::from_bits(key.points),
+                    DEFAULT_LIMITS,
+                )
+                .map(|layout| Resource::Layout(Arc::new(layout)))
+                .unwrap_or(Resource::Failed)
+            },
+            Key::Image(_, scale, color) => {
+                let Some(layout) = &job.layout else { return Resource::Failed };
+                let Ok(rasterizer) = crate::math::rasterizer::MathGlyphRasterizer::new() else {
+                    return Resource::Failed;
+                };
+                let color = Rgba {
+                    r: f32::from_bits(color[0]),
+                    g: f32::from_bits(color[1]),
+                    b: f32::from_bits(color[2]),
+                    a: f32::from_bits(color[3]),
+                };
+                compose_image(&rasterizer, layout, f32::from_bits(*scale), color)
+                    .map(|(image, geometry)| Resource::Image(image, geometry))
+                    .unwrap_or(Resource::Failed)
+            },
+            Key::Molecule(source, dark) => crate::chemistry::render_smiles(source, *dark)
+                .ok()
+                .and_then(|svg| self.svg.render_single_frame(svg.as_bytes(), 1.0).ok())
+                .map(Resource::Molecule)
+                .unwrap_or(Resource::Failed),
+        }
+    }
+
+    pub(super) fn layout(self: &Arc<Self>, key: FormulaKey) -> Option<Arc<MathLayout>> {
+        match self.request(Key::Layout(key), None)? {
+            Resource::Layout(layout) => Some(layout),
+            _ => None,
+        }
+    }
+
+    pub(super) fn image(
+        self: &Arc<Self>,
+        key: FormulaKey,
+        scale: f32,
+        color: Rgba,
+    ) -> Option<(Arc<RenderImage>, ImageGeometry)> {
+        let image_key = Key::Image(
+            key.clone(),
+            scale.to_bits(),
+            [color.r.to_bits(), color.g.to_bits(), color.b.to_bits(), color.a.to_bits()],
+        );
+        // A hit never needs to look up or rebuild the corresponding layout.
+        if let Some(resource) =
+            self.state.lock().unwrap_or_else(|e| e.into_inner()).cache.get(&image_key).cloned()
+        {
+            return match resource {
+                Resource::Image(image, geometry) => Some((image, geometry)),
+                _ => None,
+            };
+        }
+        let layout = self.layout(key)?;
+        match self.request(image_key, Some(layout))? {
+            Resource::Image(image, geometry) => Some((image, geometry)),
+            _ => None,
+        }
+    }
+
+    /// Outer None is pending; Some(None) is a cached source-text fallback.
+    pub(super) fn molecule(
+        self: &Arc<Self>,
+        source: SharedString,
+        dark: bool,
+    ) -> Option<Option<Arc<RenderImage>>> {
+        if !crate::chemistry::STRUCTURE_RENDERING_ENABLED {
+            return Some(None);
+        }
+        match self.request(Key::Molecule(source, dark), None)? {
+            Resource::Molecule(image) => Some(Some(image)),
+            _ => Some(None),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn job(id: usize) -> Job {
+        Job {
+            key: Key::Molecule(format!("C{id}").into(), false),
+            layout: None,
+            charge: 1024,
+            bitmap_reservation: 0,
+        }
+    }
+
+    #[test]
+    fn bitmap_workers_reserve_before_start_and_release_on_failure() {
+        let mut state = State::default();
+        state.cache.insert(job(99).key, Resource::Failed, CACHE_BYTES);
+        for id in 0..2 {
+            let mut work = job(id);
+            work.bitmap_reservation = CACHE_BYTES / 2 + 1;
+            assert!(state.admit(work));
+        }
+        let first = state.start().unwrap();
+        assert!(state.cache.used_bytes() + state.reserved_bitmap_bytes <= CACHE_BYTES);
+        assert_eq!(state.cache.len(), 0, "old image must be released before allocation");
+        assert!(state.start().is_none(), "worker count alone cannot bound image memory");
+        state.finish(&first, Resource::Failed);
+        assert_eq!(state.reserved_bitmap_bytes, 0);
+        let second = state.start().unwrap();
+        assert!(state.cache.used_bytes() + state.reserved_bitmap_bytes <= CACHE_BYTES);
+        state.finish(&second, Resource::Failed);
+        assert_eq!(state.reserved_bitmap_bytes, 0);
+        assert_eq!(state.pending_bytes, 0);
+    }
+
+    #[test]
+    fn eighty_session_floods_have_bounded_work_without_duplicate_jobs() {
+        let mut state = State::default();
+        for _ in 0..20 {
+            for session in 0..80 {
+                state.admit(job(session));
+            }
+        }
+        assert_eq!(state.pending.len(), MAX_PENDING);
+        assert_eq!(state.queue.len(), MAX_PENDING);
+        assert_eq!(state.pending_bytes, MAX_PENDING * 1024);
+        let first = state.start().unwrap();
+        let second = state.start().unwrap();
+        assert!(state.start().is_none());
+        assert!(!state.admit(job(0)));
+        state.finish(&first, Resource::Failed);
+        assert!(state.start().is_some());
+        state.finish(&second, Resource::Failed);
+        assert!(state.running <= MAX_RUNNING);
+    }
+
+    #[test]
+    fn queued_layout_bytes_are_bounded_even_when_entry_count_is_small() {
+        let mut state = State::default();
+        let mut large = job(0);
+        large.charge = PENDING_BYTES + 1;
+        assert!(!state.admit(large));
+        assert_eq!(state.pending_bytes, 0);
+        assert!(state.queue.is_empty());
+    }
+}
+
+#[cfg(test)]
+mod corpus_tests;
diff --git a/nebula_app/src/gpui_shell/scientific_render/corpus_tests.rs b/nebula_app/src/gpui_shell/scientific_render/corpus_tests.rs
new file mode 100644
index 0000000..f0f7f6d
--- /dev/null
+++ b/nebula_app/src/gpui_shell/scientific_render/corpus_tests.rs
@@ -0,0 +1,95 @@
+//! GPUI adapter checks complement the renderer-independent document corpus.
+use super::*;
+use crate::scientific_corpus::{DOCUMENTS, cases, read_document};
+
+#[test]
+fn corpus_molecular_svg_is_rasterized_by_the_actual_gpui_adapter() {
+    let renderer = SvgRenderer::new(Arc::new(()));
+    let mut cache = crate::render_cache::RenderCache::new(4 * 1024 * 1024, 64);
+    let mut images = Vec::new();
+    for (name, _, _) in DOCUMENTS {
+        for case in
+            cases(&read_document(name)).into_iter().filter(|case| case.molecule && !case.fallback)
+        {
+            let svg = crate::chemistry::render_smiles(&case.source, false).unwrap();
+            let image = renderer
+                .render_single_frame(svg.as_bytes(), 1.0)
+                .unwrap_or_else(|error| panic!("{name}:{}: {error}", case.line));
+            let bytes = image.as_bytes(0).unwrap();
+            let size = image.size(0);
+            assert_eq!(
+                bytes.len(),
+                u32::from(size.width) as usize * u32::from(size.height) as usize * 4
+            );
+            assert!(
+                bytes.chunks_exact(4).any(|pixel| pixel[3] != 0),
+                "{name}:{} is blank",
+                case.line
+            );
+            images.push(Arc::downgrade(&image));
+            let resource = Resource::Molecule(image);
+            let charge = resource.bytes() + 256;
+            cache.insert((name, case.line), resource, charge);
+            let retained_bytes: usize = images
+                .iter()
+                .filter_map(|image| image.upgrade())
+                .map(|image| image.as_bytes(0).unwrap().len())
+                .sum();
+            assert!(
+                retained_bytes <= 4 * 1024 * 1024,
+                "physical image bytes exceeded the shared budget"
+            );
+        }
+    }
+}
+
+#[test]
+fn mathematical_gpui_adapter_keeps_the_shared_pixel_buffer_and_geometry() {
+    let rasterizer = crate::math::rasterizer::MathGlyphRasterizer::new().unwrap();
+    for case in cases(&read_document("scientific-rendering-acceptance-paper.md"))
+        .into_iter()
+        .filter(|case| !case.molecule && !case.fallback)
+        .take(12)
+    {
+        let layout =
+            compile_formula_source(&case.source, case.display, 18.0, 1.0, DEFAULT_LIMITS).unwrap();
+        let expected = crate::math::bitmap::compose(&rasterizer, &layout, 1.25, [0, 0, 0]).unwrap();
+        let (image, geometry) =
+            compose_image(&rasterizer, &layout, 1.25, Rgba { r: 0.0, g: 0.0, b: 0.0, a: 1.0 })
+                .unwrap();
+        assert_eq!(image.as_bytes(0).unwrap(), expected.pixels);
+        assert_eq!(geometry.baseline, expected.baseline);
+        assert_eq!(geometry.width, expected.width);
+        assert_eq!(geometry.height, expected.height);
+    }
+}
+
+#[test]
+#[ignore = "bounded native SVG raster benchmark; no window or real AI processes"]
+fn measure_molecular_raster_stages() {
+    let renderer = SvgRenderer::new(Arc::new(()));
+    let warm = crate::chemistry::render_smiles("CCO", false).unwrap();
+    drop(renderer.render_single_frame(warm.as_bytes(), 1.0).unwrap());
+    for (name, _, _) in DOCUMENTS {
+        let mut samples = Vec::new();
+        for case in
+            cases(&read_document(name)).into_iter().filter(|case| case.molecule && !case.fallback)
+        {
+            let svg = crate::chemistry::render_smiles(&case.source, false).unwrap();
+            let start = std::time::Instant::now();
+            std::hint::black_box(renderer.render_single_frame(svg.as_bytes(), 1.0).unwrap());
+            samples.push(start.elapsed().as_secs_f64() * 1000.0);
+        }
+        if !samples.is_empty() {
+            samples.sort_by(f64::total_cmp);
+            let p = |n: usize| samples[(samples.len() * n).div_ceil(100) - 1];
+            crate::gpui_shell::try_write_stderr(format_args!(
+                "{name}:gpui_svg_raster,samples={},median_ms={:.4},p95_ms={:.4},p99_ms={:.4}",
+                samples.len(),
+                p(50),
+                p(95),
+                p(99)
+            ));
+        }
+    }
+}
diff --git a/nebula_app/src/gpui_shell/settings_pane.rs b/nebula_app/src/gpui_shell/settings_pane.rs
index c07826e..0420c20 100644
--- a/nebula_app/src/gpui_shell/settings_pane.rs
+++ b/nebula_app/src/gpui_shell/settings_pane.rs
@@ -129,6 +129,7 @@ pub struct SettingsPane {
     provider_codex_confirm: Option<String>,
     /// SSH 主机列表（共享三键 + merge 权威）；操作后整体重载防漂移。
     /// SSH 区的行为实现拆在 `ssh_settings.rs`（同类型第二个 impl 块）。
+    pub(super) ssh_library: super::ssh_settings::library::HostLibraryState,
     pub(super) ssh_hosts: crate::gpui_shell::ssh_hosts::SshHostLists,
     /// SSH 编辑器的文本字段常驻，以便所有文本改动都能使进行中的测试失效。
     pub(super) ssh_username_input: Entity<InputState>,
@@ -297,6 +298,22 @@ impl SettingsPane {
             self.request_cover_chrome(value, window, cx);
             return;
         }
+        if key == "ai_toasts" {
+            if let Err(error) = self.try_persist(&[(key, (value as u8).to_string())], cx) {
+                let language = crate::gpui_shell::config::ui_language(cx);
+                super::toast::toast(
+                    window,
+                    cx,
+                    super::toast::ToastKind::Warning,
+                    language.format(
+                        crate::i18n::Message::SettingsNotificationsSaveFailed,
+                        &[("error", &error.to_string())],
+                    ),
+                );
+                cx.notify();
+            }
+            return;
+        }
         self.persist(&[(key, (value as u8).to_string())], cx);
     }
 
@@ -646,6 +663,7 @@ impl SettingsPane {
             "terminal_proxy" => flag!(terminal_proxy),
             "powerline" => flag!(powerline),
             "ghost" => flag!(ghost),
+            "ai_toasts" => flag!(ai_toasts),
             "cjk_bold_regular" => flag!(cjk_bold_regular),
             "fetch" => flag!(fetch),
             "keep_session" => flag!(keep_session),
@@ -982,12 +1000,21 @@ impl SettingsPane {
             .group(language.pick("启动", "Startup"), cx)
             .child(self.shell_select_row(cx))
             .child(self.startup_directory_row(cx));
-        let alerts = self.group(language.pick("提醒", "Alerts"), cx).child(self.select_row(
-            "bell",
-            language.pick("终端铃声", "Terminal bell"),
-            help("bell", language),
-            cx,
-        ));
+        let alerts = self
+            .group(language.pick("提醒", "Alerts"), cx)
+            .child(self.switch_row(
+                "ai_toasts",
+                language.text(crate::i18n::Message::SettingsNotificationsAiMessages),
+                help("ai_toasts", language),
+                self.runtime.ai_toasts,
+                cx,
+            ))
+            .child(self.select_row(
+                "bell",
+                language.pick("终端铃声", "Terminal bell"),
+                help("bell", language),
+                cx,
+            ));
         let completion = self
             .group(language.pick("补全", "Completion"), cx)
             .child(self.switch_row(
diff --git a/nebula_app/src/gpui_shell/settings_pane/initialization.rs b/nebula_app/src/gpui_shell/settings_pane/initialization.rs
index 830b708..98f1589 100644
--- a/nebula_app/src/gpui_shell/settings_pane/initialization.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/initialization.rs
@@ -347,6 +347,17 @@ impl SettingsPane {
         let backup_remote_inputs: Vec<Entity<InputState>> =
             (0..4).map(|_| cx.new(|cx| InputState::new(window, cx))).collect();
 
+        let ssh_library =
+            crate::gpui_shell::ssh_settings::library::HostLibraryState::new(window, cx);
+        subscriptions.push(cx.subscribe(
+            &ssh_library.search,
+            |this: &mut Self, _, event: &InputEvent, cx| {
+                if matches!(event, InputEvent::Change) {
+                    this.ssh_library.reset_scroll();
+                    cx.notify();
+                }
+            },
+        ));
         let ssh_username_input = cx.new(|cx| InputState::new(window, cx).placeholder("root"));
         // 地址框现在只承担 host/IP；仍兼容粘贴整段 user@host，由共享 helper
         // 在保存/测试时拆出内嵌用户名。
@@ -392,6 +403,9 @@ impl SettingsPane {
                 .placeholder(localized_input_placeholder("ssh_jump_host", language))
         });
         for input in [
+            ssh_library.group.clone(),
+            ssh_library.tags.clone(),
+            ssh_library.notes.clone(),
             ssh_username_input.clone(),
             ssh_destination_input.clone(),
             ssh_port_input.clone(),
@@ -503,6 +517,7 @@ impl SettingsPane {
             provider_test_seq: 0,
             provider_test_running: false,
             provider_codex_confirm: None,
+            ssh_library,
             ssh_hosts: crate::gpui_shell::ssh_hosts::SshHostLists::load(),
             ssh_username_input,
             ssh_destination_input,
diff --git a/nebula_app/src/gpui_shell/settings_pane/keymap.rs b/nebula_app/src/gpui_shell/settings_pane/keymap.rs
index 20c9c2b..147332e 100644
--- a/nebula_app/src/gpui_shell/settings_pane/keymap.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/keymap.rs
@@ -141,21 +141,33 @@ impl SettingsPane {
         self.persist_keybinds(cx);
     }
 
-    /// 捕获态裸 Backspace：删除自定义绑定，回落内置默认。
+    /// Bare Backspace and the clear button both disable the binding.
     fn keymap_clear_custom(&mut self, row: usize, cx: &mut Context<Self>) {
+        use crate::display::keymap;
+        self.keymap_capture = None;
+        self.keymap_capture_preview.clear();
+        if row == keymap::QUICK_TERMINAL_ROW {
+            self.persist(&[("quick_terminal_hotkey", String::new())], cx);
+            return;
+        }
+        let Some((action, ..)) = keymap::EDITABLE_ACTIONS.get(row - 1) else { return };
+        keymap::clear_action(&mut self.keymap_binds, action);
+        self.persist_keybinds(cx);
+    }
+
+    fn keymap_reset_binding(&mut self, row: usize, cx: &mut Context<Self>) {
         use crate::display::keymap;
         self.keymap_capture = None;
         self.keymap_capture_preview.clear();
         if row == keymap::QUICK_TERMINAL_ROW {
             self.persist(
-                &[("quick_terminal_hotkey", keymap::DEFAULT_QUICK_TERMINAL_HOTKEY.to_owned())],
+                &[("quick_terminal_hotkey", keymap::DEFAULT_QUICK_TERMINAL_HOTKEY.into())],
                 cx,
             );
             return;
         }
         let Some((action, ..)) = keymap::EDITABLE_ACTIONS.get(row - 1) else { return };
-        let name = keymap::action_storage_name(action);
-        self.keymap_binds.retain(|(_, a)| !a.eq_ignore_ascii_case(&name));
+        keymap::reset_action(&mut self.keymap_binds, action);
         self.persist_keybinds(cx);
     }
 
@@ -289,6 +301,14 @@ impl SettingsPane {
             )
             .child(div().flex_1().min_w_0().pl_4().child(label))
             .child(self.keymap_keycap(&cap_text, is_custom, clash, capturing, cx))
+            .child(h_flex().gap_1()
+                .on_mouse_down(MouseButton::Left, |_, _, cx| cx.stop_propagation())
+                .child(Button::new(("keymap-clear", flat)).ghost().xsmall().icon(IconName::Close)
+                    .tooltip(language.text(crate::i18n::Message::SettingsKeymapClear))
+                    .on_click(cx.listener(move |this, _, _, cx| this.keymap_clear_custom(flat, cx))))
+                .child(Button::new(("keymap-reset", flat)).ghost().xsmall().icon(IconName::Redo2)
+                    .tooltip(language.text(crate::i18n::Message::SettingsKeymapRestore))
+                    .on_click(cx.listener(move |this, _, _, cx| this.keymap_reset_binding(flat, cx)))))
     }
 
     pub(super) fn section_keymap(&mut self, cx: &mut Context<Self>) -> gpui::Div {
@@ -301,6 +321,14 @@ impl SettingsPane {
         // 分组渲染（旧壳无框分组裁定）：组内可见行为空的组整组隐藏；组
         // 标题 0.86× 小字压在行块上方。
         let mut groups_block = v_flex().w_full().gap_1();
+        if crate::platform::CAPABILITIES.quick_terminal_hotkey {
+            groups_block = groups_block.child(self.select_row(
+                "quick_terminal_mode",
+                language.text(crate::i18n::Message::SettingsQuickTerminalMode),
+                language.text(crate::i18n::Message::SettingsQuickTerminalDescription),
+                cx,
+            ));
+        }
         let mut start = 0usize;
         for (zh, en, count) in keymap::GROUPS {
             let end = start + count;
diff --git a/nebula_app/src/gpui_shell/settings_pane/navigation.rs b/nebula_app/src/gpui_shell/settings_pane/navigation.rs
index 44c77fc..6c3dc66 100644
--- a/nebula_app/src/gpui_shell/settings_pane/navigation.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/navigation.rs
@@ -1,21 +1,7 @@
 use super::*;
 
 /// 主题下拉（展示名 = 持久化名，与旧壳一致）。
-pub(super) const THEME_VALUES: [&str; 13] = [
-    "Nebula",
-    "SilverLight",
-    "SteelDark",
-    "LimestoneLight",
-    "CoalDark",
-    "LinenLight",
-    "MossDark",
-    "Nord",
-    "Paper",
-    "BreezeLight",
-    "BreezeDark",
-    "MintLight",
-    "MintDark",
-];
+pub(super) const THEME_VALUES: [&str; 13] = ThemeName::BUILTIN_NAMES;
 
 pub(super) const REPOSITORY_URL: &str = "https://github.com/Kuddev/pebrel";
 pub(super) const BUG_REPORT_TEMPLATE: &str = "bug_report.yml";
@@ -42,7 +28,7 @@ pub(super) const SECTION_IDS: [&str; 10] = [
 pub(super) const SECTION_SEARCH_TERMS: [&str; 10] = [
     "application app 应用 update 更新 version 版本 github support 支持",
     "appearance 外观 theme 主题 font 字体 opacity 透明度 background 背景 cursor 光标 icon 图标",
-    "profiles 配置文件 shell terminal 终端 completion 补全 startup 启动",
+    "profiles 配置文件 shell terminal 终端 completion 补全 startup 启动 ai message notifications toast alerts bell 提醒 通知 弹窗 消息 右下角 ai消息通知 ai 消息通知 ai消息弹窗 ai 消息弹窗 铃声",
     "providers provider ai 供应商 模型 api",
     "ssh host 主机 remote 远程 connection 连接",
     "network 网络 proxy 代理 connectivity 连接",
@@ -135,22 +121,7 @@ pub(super) fn section_icon(index: usize) -> SharedString {
 }
 
 pub(super) fn chrome_theme(theme: ThemeName) -> crate::display::NebulaTheme {
-    use crate::display::NebulaTheme;
-    match theme {
-        ThemeName::Nebula => NebulaTheme::Nebula,
-        ThemeName::SilverLight => NebulaTheme::SilverLight,
-        ThemeName::SteelDark => NebulaTheme::SteelDark,
-        ThemeName::LimestoneLight => NebulaTheme::LimestoneLight,
-        ThemeName::CoalDark => NebulaTheme::CoalDark,
-        ThemeName::LinenLight => NebulaTheme::LinenLight,
-        ThemeName::MossDark => NebulaTheme::MossDark,
-        ThemeName::Nord => NebulaTheme::Nord,
-        ThemeName::Paper => NebulaTheme::Paper,
-        ThemeName::BreezeLight => NebulaTheme::BreezeLight,
-        ThemeName::BreezeDark => NebulaTheme::BreezeDark,
-        ThemeName::MintLight => NebulaTheme::MintLight,
-        ThemeName::MintDark => NebulaTheme::MintDark,
-    }
+    crate::gpui_shell::theme::chrome_theme(theme)
 }
 
 pub(super) fn rgb_hsla(r: u8, g: u8, b: u8) -> Hsla {
diff --git a/nebula_app/src/gpui_shell/settings_pane/search_header.rs b/nebula_app/src/gpui_shell/settings_pane/search_header.rs
index 8f3f9f4..6d6353b 100644
--- a/nebula_app/src/gpui_shell/settings_pane/search_header.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/search_header.rs
@@ -75,4 +75,14 @@ mod tests {
         assert_eq!(matching_sections("", en), visible_nav_sections().collect::<Vec<_>>());
         assert!(!matching_sections("AI", en).contains(&3));
     }
+
+    #[test]
+    fn ai_toast_search_opens_the_terminal_alert_controls() {
+        for query in ["AI 消息弹窗", "AI消息通知", "右下角", "ai toast", "notifications"]
+        {
+            for language in [crate::display::UiLanguage::ZhCn, crate::display::UiLanguage::EnUs] {
+                assert_eq!(matching_sections(query, language), vec![2], "{query}");
+            }
+        }
+    }
 }
diff --git a/nebula_app/src/gpui_shell/settings_pane/setting_help.rs b/nebula_app/src/gpui_shell/settings_pane/setting_help.rs
index 136f839..c73d6ba 100644
--- a/nebula_app/src/gpui_shell/settings_pane/setting_help.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/setting_help.rs
@@ -87,6 +87,10 @@ pub(super) fn help(key: &str, language: UiLanguage) -> SettingHelp {
             language.pick("程序提示时，选择声音或闪烁提醒。", "Chooses sound or visual feedback for terminal alerts."),
             None,
         ),
+        "ai_toasts" => (
+            language.text(crate::i18n::Message::SettingsNotificationsAiMessagesDescription),
+            Some(language.text(crate::i18n::Message::SettingsNotificationsAiMessagesDetails)),
+        ),
         "font_family" => (
             language.pick("按字体组顺序查找可用字形。", "Uses the font group in order to find available glyphs."),
             Some(language.pick("前面的字体缺少字形时，会继续尝试后面的字体。", "When a font lacks a glyph, the next font in the group is tried.")),
@@ -183,6 +187,7 @@ mod tests {
             "shell",
             "startup_directory",
             "bell",
+            "ai_toasts",
             "font_family",
             "ghost",
             "accept",
diff --git a/nebula_app/src/gpui_shell/settings_pane/status.rs b/nebula_app/src/gpui_shell/settings_pane/status.rs
index c28ba99..5792754 100644
--- a/nebula_app/src/gpui_shell/settings_pane/status.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/status.rs
@@ -198,6 +198,11 @@ impl TerminalImportError {
 
 #[derive(Clone, Debug)]
 pub(in crate::gpui_shell) enum SshStatus {
+    LibraryProcessing,
+    LibraryReloaded,
+    LibraryExported,
+    LibraryImported { added: usize, skipped: usize },
+    LibraryImportedPartial { added: usize, error: String },
     Saved(String),
     Pinned,
     Imported(usize),
@@ -222,7 +227,8 @@ impl SshStatus {
     pub(in crate::gpui_shell) fn is_error(&self) -> bool {
         matches!(
             self,
-            Self::CleanupPartial(_)
+            Self::LibraryImportedPartial { .. }
+                | Self::CleanupPartial(_)
                 | Self::Validation(_)
                 | Self::PersistFailed(_)
                 | Self::DeleteFailed(_)
@@ -239,6 +245,14 @@ impl SshStatus {
 
     pub(in crate::gpui_shell) fn text(&self, language: crate::display::UiLanguage) -> String {
         match self {
+            Self::LibraryImportedPartial { added, error } => language.format(crate::i18n::Message::HostsImportedPartial,
+                &[("added", &added.to_string()), ("error", error)]),
+            Self::LibraryProcessing => language.text(crate::i18n::Message::HostsProcessing).to_owned(),
+            Self::LibraryReloaded => language.text(crate::i18n::Message::HostsReloaded).to_owned(),
+            Self::LibraryExported => language.text(crate::i18n::Message::HostsExported).to_owned(),
+            Self::LibraryImported { added, skipped } => language.format(crate::i18n::Message::HostsImported,
+                &[("added", &added.to_string()), ("skipped", &skipped.to_string())]),
+
             Self::Saved(destination) => {
                 format!("{} {destination}", language.pick("已保存", "Saved"))
             },
diff --git a/nebula_app/src/gpui_shell/settings_pane/tests.rs b/nebula_app/src/gpui_shell/settings_pane/tests.rs
index 26895c5..f4c39b5 100644
--- a/nebula_app/src/gpui_shell/settings_pane/tests.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/tests.rs
@@ -1,5 +1,45 @@
 use super::*;
 
+#[cfg(feature = "gpui-test-support")]
+#[gpui::test]
+fn ai_toast_setting_is_searchable_and_has_a_visible_switch(cx: &mut gpui::TestAppContext) {
+    cx.update(|cx| {
+        gpui_component::init(cx);
+        let mut settings = crate::gpui_shell::config::Settings::load(ThemeName::Nord);
+        settings.ai_toasts = true;
+        cx.set_global(settings);
+    });
+    let mut pane = None;
+    let (_, cx) = cx.add_window_view(|window, cx| {
+        let view = cx.new(|cx| SettingsPane::new(window, cx));
+        view.update(cx, |pane, _| {
+            pane.runtime = RuntimeSettings::from_raw(&nebula_settings::RawSettings::default());
+        });
+        pane = Some(view.clone());
+        gpui_component::Root::new(view, window, cx)
+    });
+    let pane = pane.unwrap();
+    cx.simulate_resize(gpui::size(px(1280.0), px(1600.0)));
+    cx.update(|window, cx| {
+        pane.update(cx, |pane, cx| {
+            pane.settings_search_input
+                .update(cx, |input, cx| input.replace_all("AI 消息弹窗", window, cx));
+        });
+    });
+    cx.run_until_parked();
+    cx.update(|window, cx| {
+        let _ = window.draw(cx);
+    });
+    assert_eq!(pane.read_with(cx, |pane, _| pane.active_section), 2);
+    let bounds = cx.debug_bounds("nebula-switch-ai_toasts").expect("AI toast switch is rendered");
+    assert!(bounds.size.width > px(0.0) && bounds.size.height > px(0.0));
+    assert!(bounds.origin.y >= px(0.0) && bounds.bottom() <= px(1600.0));
+    assert_eq!(
+        pane.read_with(cx, |pane, _| pane.setting_override("ai_toasts")),
+        Some((false, "1".to_owned()))
+    );
+}
+
 #[test]
 fn settings_nav_visibility_keeps_stable_routes_but_hides_two_entries() {
     let visibility: Vec<_> = (0..SECTION_IDS.len()).map(is_nav_section_visible).collect();
diff --git a/nebula_app/src/gpui_shell/settings_pane/theme_picker.rs b/nebula_app/src/gpui_shell/settings_pane/theme_picker.rs
index 92fd7ac..1c4482e 100644
--- a/nebula_app/src/gpui_shell/settings_pane/theme_picker.rs
+++ b/nebula_app/src/gpui_shell/settings_pane/theme_picker.rs
@@ -1,21 +1,7 @@
 use super::appearance_picker::{AppearanceColors, AppearanceSelection, picker_columns};
 use super::*;
 
-pub(super) const THEME_ORDER: [ThemeName; 13] = [
-    ThemeName::BreezeLight,
-    ThemeName::BreezeDark,
-    ThemeName::MintLight,
-    ThemeName::MintDark,
-    ThemeName::SilverLight,
-    ThemeName::Nebula,
-    ThemeName::SteelDark,
-    ThemeName::Nord,
-    ThemeName::Paper,
-    ThemeName::MossDark,
-    ThemeName::LimestoneLight,
-    ThemeName::CoalDark,
-    ThemeName::LinenLight,
-];
+pub(super) const THEME_ORDER: [ThemeName; 13] = ThemeName::BUILTIN;
 
 fn theme_foreground(name: ThemeName) -> [u8; 3] {
     let theme = name.term_theme();
@@ -50,7 +36,7 @@ pub(super) fn theme_sample(name: ThemeName, token: bool, compact: bool) -> gpui:
         } else {
             76.0
         }))
-        .p(px(if token || compact { 4.0 } else { 6.0 }))
+        .p(px(0.0))
         .rounded(px(8.0))
         .bg(chrome)
         .child(
@@ -59,7 +45,7 @@ pub(super) fn theme_sample(name: ThemeName, token: bool, compact: bool) -> gpui:
                 .justify_center()
                 .gap(px(if token { 4.0 } else { 6.0 }))
                 .p(px(if token { 5.0 } else { 8.0 }))
-                .rounded(px(4.0))
+                .rounded(px(0.0))
                 .bg(rgb_hsla(background[0], background[1], background[2]))
                 .child(
                     h_flex()
@@ -82,7 +68,6 @@ impl SettingsPane {
         window: &Window,
         cx: &Context<Self>,
     ) -> gpui::Div {
-        let palette = chrome_theme(name).palette();
         let term = name.term_theme();
         let background = if typography && !self.runtime.follow_system_theme {
             self.runtime.background.unwrap_or(term.background)
@@ -115,7 +100,7 @@ impl SettingsPane {
                     // GPUI's overflow mask is rectangular; each painted surface
                     // must carry the radius where it meets the outer border.
                     .rounded_t(px(8.0))
-                    .bg(rgb_hsla(palette.shell_bg.r, palette.shell_bg.g, palette.shell_bg.b))
+                    .bg(rgb_hsla(background[0], background[1], background[2]))
                     .child(
                         h_flex()
                             .gap(px(6.0))
diff --git a/nebula_app/src/gpui_shell/ssh_hosts.rs b/nebula_app/src/gpui_shell/ssh_hosts.rs
index 84103fd..6267a37 100644
--- a/nebula_app/src/gpui_shell/ssh_hosts.rs
+++ b/nebula_app/src/gpui_shell/ssh_hosts.rs
@@ -2,7 +2,7 @@
 //!
 //! 与旧壳读写同一份 `nebula_settings.txt` 的三个键（`saved_hosts` /
 //! `pinned_hosts` / `hidden_hosts`，逗号分隔），排序与隐藏策略复用
-//! `display::merge_ssh_hosts` 单一权威——两壳交替增删主机不会产生第二套
+//! `ssh_profiles::merge_host_sources` 单一权威——两壳交替增删主机不会产生第二套
 //! 次序。凭据（Credential Manager 条目）在这里**永不**触碰：删除主机只
 //! 动列表，连接路径的密码/私钥语义由 `ssh_session` 业务层负责。
 
@@ -18,6 +18,10 @@ pub struct SshHostLists {
     /// 隐藏的 `~/.ssh/config` 别名（Nebula 不改用户的 config 文件，
     /// 隐藏是对 config 源最强的"删除"）。
     pub hidden: Vec<String>,
+    /// Loaded on lifecycle changes, never while rendering individual host rows.
+    pub(crate) profiles: crate::ssh_profiles::SshProfiles,
+    pub(crate) configured: Vec<String>,
+    pub(crate) load_error: Option<String>,
 }
 
 fn parse_list(value: Option<&str>) -> Vec<String> {
@@ -33,7 +37,16 @@ fn parse_list(value: Option<&str>) -> Vec<String> {
 impl SshHostLists {
     pub fn load() -> Self {
         let raw = nebula_settings::RawSettings::load();
+        let (profiles, load_error) = match crate::ssh_profiles::SshProfiles::load(
+            &crate::display::nebula_data_dir().join("ssh_profiles.json"),
+        ) {
+            Ok(profiles) => (profiles, None),
+            Err(error) => (Default::default(), Some(error.to_string())),
+        };
         Self {
+            profiles,
+            load_error,
+            configured: crate::ssh::ssh_config_hosts(),
             saved: parse_list(raw.value("saved_hosts")),
             pinned: parse_list(raw.value("pinned_hosts")),
             hidden: parse_list(raw.value("hidden_hosts")),
@@ -42,12 +55,18 @@ impl SshHostLists {
 
     /// 展示顺序的单一权威（saved ∪ config − hidden，置顶浮头）。
     pub fn merged(&self) -> Vec<String> {
-        crate::display::merge_ssh_hosts(&self.saved, &self.pinned, &self.hidden)
+        crate::ssh_profiles::merge_host_sources(
+            &self.saved,
+            &self.pinned,
+            &self.hidden,
+            &self.configured,
+            self.profiles.destinations(),
+        )
     }
 
     /// 隐藏区（设置页"已隐藏"折叠列表的数据源）。
-    pub fn hidden_hosts(&self) -> &[String] {
-        &self.hidden
+    pub fn hidden_hosts(&self) -> Vec<String> {
+        self.hidden.iter().filter(|host| self.configured.contains(host)).cloned().collect()
     }
 
     pub fn is_pinned(&self, host: &str) -> bool {
@@ -56,7 +75,7 @@ impl SshHostLists {
 
     /// 该主机是否来自 `~/.ssh/config`（决定删除语义：隐藏 vs 移除）。
     pub fn is_from_config(&self, host: &str) -> bool {
-        crate::ssh::ssh_config_hosts().iter().any(|entry| entry == host)
+        self.configured.iter().any(|entry| entry == host)
     }
 
     /// 新增/提升一个保存的目的地（头插、去重、截断到容量上限）。
@@ -81,7 +100,9 @@ impl SshHostLists {
         let from_config = self.is_from_config(host);
         self.saved.retain(|entry| entry != host);
         self.pinned.retain(|entry| entry != host);
-        if from_config && !self.hidden.iter().any(|entry| entry == host) {
+        if (from_config || self.profiles.contains(host))
+            && !self.hidden.iter().any(|entry| entry == host)
+        {
             self.hidden.push(host.to_owned());
         }
     }
@@ -139,6 +160,7 @@ mod tests {
             saved: vec!["a@b".into(), "c@d".into()],
             pinned: vec!["a@b".into()],
             hidden: Vec::new(),
+            ..Default::default()
         };
         lists.remove("a@b");
         assert!(!lists.saved.iter().any(|entry| entry == "a@b"));
diff --git a/nebula_app/src/gpui_shell/ssh_settings.rs b/nebula_app/src/gpui_shell/ssh_settings.rs
index 92fa954..497d954 100644
--- a/nebula_app/src/gpui_shell/ssh_settings.rs
+++ b/nebula_app/src/gpui_shell/ssh_settings.rs
@@ -29,6 +29,8 @@ use crate::gpui_shell::widgets::NebulaButton;
 
 mod advanced;
 mod editor;
+pub(super) mod library;
+use crate::i18n::Message;
 
 /// 删除撤销窗口时长，旧壳 Undo 条同值。
 const SSH_DELETE_UNDO_SECS: u64 = 8;
@@ -217,9 +219,13 @@ impl SettingsPane {
     ) {
         // 列表将被改写，未决删除的快照会过期：先提交它。
         self.commit_pending_ssh_delete();
-        mutate(&mut self.ssh_hosts);
-        match self.ssh_hosts.persist() {
-            Ok(()) => self.ssh_status = Some(status),
+        let mut updated = self.ssh_hosts.clone();
+        mutate(&mut updated);
+        match updated.persist() {
+            Ok(()) => {
+                self.ssh_hosts = updated;
+                self.ssh_status = Some(status);
+            },
             Err(err) => self.ssh_status = Some(SshStatus::PersistFailed(err.to_string())),
         }
         self.ssh_delete_confirm = None;
@@ -305,9 +311,12 @@ impl SettingsPane {
                 profiles.remove(&host);
                 if let Err(error) = profiles.save(&profile_path) {
                     cleanup_errors.push(format!("Profile: {error}"));
-                } else if let Some(target) = proxy_credential {
-                    if let Err(error) = crate::ssh_credentials::delete_generic_secret(&target) {
-                        cleanup_errors.push(format!("Proxy credential: {error}"));
+                } else {
+                    self.ssh_hosts.profiles = profiles;
+                    if let Some(target) = proxy_credential {
+                        if let Err(error) = crate::ssh_credentials::delete_generic_secret(&target) {
+                            cleanup_errors.push(format!("Proxy credential: {error}"));
+                        }
                     }
                 }
             },
@@ -403,6 +412,17 @@ impl SettingsPane {
             editor.connection = profile.connection.clone();
             editor.original_connection = profile.connection.clone();
         }
+        let organization =
+            profiles.organization(editor.original_destination.as_deref().unwrap_or_default());
+        self.ssh_library
+            .group
+            .update(cx, |input, cx| input.set_value(organization.group.clone(), window, cx));
+        self.ssh_library
+            .tags
+            .update(cx, |input, cx| input.set_value(organization.tags.join(", "), window, cx));
+        self.ssh_library
+            .notes
+            .update(cx, |input, cx| input.set_value(organization.notes.clone(), window, cx));
         let connection = &editor.connection;
         self.ssh_proxy_host_input
             .update(cx, |input, cx| input.set_value(connection.proxy_host.clone(), window, cx));
@@ -660,6 +680,24 @@ impl SettingsPane {
             cx.notify();
             return;
         }
+        if self.ssh_library.busy {
+            return;
+        }
+        let organization = match crate::ssh_profiles::HostOrganization::from_inputs(
+            &self.ssh_library.group.read(cx).value(),
+            &self.ssh_library.tags.read(cx).value(),
+            &self.ssh_library.notes.read(cx).value(),
+        ) {
+            Ok(value) => value,
+            Err(error) => {
+                self.ssh_status = Some(SshStatus::Error(
+                    crate::gpui_shell::config::ui_language(cx)
+                        .format(Message::HostsInvalid, &[("error", &error)]),
+                ));
+                cx.notify();
+                return;
+            },
+        };
         let Some(mut editor) = self.ssh_editor.take() else { return };
         let original = editor.original_destination.clone();
         let profile_path = crate::display::nebula_data_dir().join("ssh_profiles.json");
@@ -699,12 +737,19 @@ impl SettingsPane {
             icon: editor.icon.clone(),
             connection: connection.clone(),
         });
+        if let Err(error) = profiles.set_organization(&destination, organization) {
+            self.ssh_status = Some(SshStatus::Error(error));
+            self.ssh_editor = Some(editor);
+            cx.notify();
+            return;
+        }
         if let Err(error) = profiles.save(&profile_path) {
             self.ssh_status = Some(SshStatus::ProfileSaveFailed(error.to_string()));
             self.ssh_editor = Some(editor);
             cx.notify();
             return;
         }
+        hosts.profiles = profiles.clone();
         hosts.remember(&destination);
         if let Err(error) = hosts.persist() {
             self.ssh_status = Some(SshStatus::HostListSaveFailed(error.to_string()));
@@ -1216,402 +1261,6 @@ impl SettingsPane {
     }
 
     // ---- UI：设置页 SSH 分区 ----
-
-    /// 主机列表：一个圆角卡片，行间细分隔线，操作按钮 hover 显形（连接为
-    /// 文本按钮，编辑/置顶/删除为图标按钮）。删除走 8 秒撤销窗口。
-    pub(super) fn section_ssh(&mut self, cx: &mut Context<Self>) -> gpui::Div {
-        let language = crate::gpui_shell::config::ui_language(cx);
-        let theme = cx.theme();
-        let hover_bg = crate::gpui_shell::theme::settings_hover_bg(cx, false);
-        let muted = theme.muted_foreground;
-        let hosts = self.ssh_hosts.merged();
-        let host_count = hosts.len();
-        let profiles = crate::ssh_profiles::SshProfiles::load(
-            &crate::display::nebula_data_dir().join("ssh_profiles.json"),
-        )
-        .ok();
-        let labels = profiles.as_ref().map(|profiles| profiles.labels()).unwrap_or_default();
-        let icons = profiles.as_ref().map(|profiles| profiles.icons()).unwrap_or_default();
-        let symbol_family: SharedString = crate::font_install::REQUIRED_FONT_FAMILY.into();
-        let font_px = cx
-            .try_global::<crate::gpui_shell::config::Settings>()
-            .map(|settings| settings.base_font_size_px)
-            .unwrap_or(15.0);
-        // 只保留标题→地址的行距（旧壳 title_y + 0.95*cell_h / 副行 0.78）。
-        // 图标槽、行内 gap、卡片描边退回改前那套：整行重排后观感反而不如原来。
-        let title_h = font_px;
-        let subtitle_h = font_px * 0.78;
-        let hidden: Vec<String> = self.ssh_hosts.hidden_hosts().to_vec();
-        let delete_confirm = self.ssh_delete_confirm.clone();
-
-        let host_rows = hosts.into_iter().enumerate().map(|(ix, host)| {
-            let pinned = self.ssh_hosts.is_pinned(&host);
-            let from_config = self.ssh_hosts.is_from_config(&host);
-            let confirm = delete_confirm.as_deref() == Some(host.as_str());
-            let label = labels.get(&host).cloned().unwrap_or_else(|| host.clone());
-            // 行首 OS 图标（旧壳裁定 2026-08-09）：id 取自 ssh_profiles 存储，
-            // 未认出回落通用终端形状；mono 字体渲染 Nerd Font 字位。
-            let os_icon =
-                crate::display::ui::os_icons::resolve(icons.get(&host).map(String::as_str));
-            let connect_host = host.clone();
-            let edit_host = host.clone();
-            let pin_host = host.clone();
-            let delete_host = host.clone();
-            let row_group = SharedString::from(format!("ssh-host-actions-{ix}"));
-            h_flex()
-                .id(SharedString::from(format!("ssh-host-row-{ix}")))
-                .group(row_group.clone())
-                // 旧壳 `SSH_HOST_ROW_H` 固定 58px；两行文字与 OS 图标在
-                // 这个高度里共用中线，不能压成普通 48px 设置行。
-                .h(px(SSH_HOST_ROW_H))
-                .w_full()
-                .px_3()
-                .items_center()
-                .gap_3()
-                .when(ix == 0, |row| row.rounded_t(px(8.0)))
-                .when(ix + 1 == host_count, |row| row.rounded_b(px(8.0)))
-                .when(ix + 1 < host_count, |row| {
-                    row.border_b_1().border_color(theme.border.opacity(0.5))
-                })
-                .hover(move |row| row.bg(hover_bg))
-                .child(
-                    div()
-                        .w(px(22.0))
-                        .h_full()
-                        .flex_shrink_0()
-                        .relative()
-                        .flex()
-                        .items_center()
-                        .justify_center()
-                        .font_family(symbol_family.clone())
-                        .text_size(px(18.0))
-                        .text_color(muted)
-                        .text_center()
-                        .child(os_icon.glyph.to_string()),
-                )
-                .child(
-                    v_flex()
-                        .flex_1()
-                        .min_w_0()
-                        .justify_center()
-                        .child(
-                            div()
-                                .h(px(title_h * 0.95))
-                                .flex()
-                                .items_center()
-                                .text_size(px(title_h))
-                                .line_height(px(title_h))
-                                .truncate()
-                                .child(label),
-                        )
-                        .child(
-                            h_flex()
-                                .h(px(subtitle_h))
-                                .gap_2()
-                                .items_center()
-                                // 副行与旧壳同合同：只放目的地本身；来源用
-                                // 小徽章表达（config 源的删除语义是隐藏）。
-                                .child(
-                                    div()
-                                        .text_size(px(subtitle_h))
-                                        .line_height(px(subtitle_h))
-                                        .text_color(muted)
-                                        .truncate()
-                                        .child(host.clone()),
-                                )
-                                .when(from_config, |line| {
-                                    line.child(
-                                        div()
-                                            .flex_shrink_0()
-                                            .px(px(5.0))
-                                            .rounded_sm()
-                                            .text_xs()
-                                            .text_color(muted)
-                                            .border_1()
-                                            .border_color(theme.border)
-                                            .child("config"),
-                                    )
-                                }),
-                        ),
-                )
-                .child(
-                    Button::new(SharedString::from(format!("ssh-connect-{ix}")))
-                        .label(language.pick("连接", "Connect"))
-                        .small()
-                        .primary()
-                        .invisible()
-                        .group_hover(row_group.clone(), |button| button.visible())
-                        .on_click(cx.listener(move |this, _, _, cx| {
-                            cx.emit(SettingsPaneEvent::LaunchSsh(connect_host.clone()));
-                            this.ssh_status = Some(SshStatus::Opening(connect_host.clone()));
-                            cx.notify();
-                        })),
-                )
-                .child(
-                    Button::new(SharedString::from(format!("ssh-edit-{ix}")))
-                        .icon(IconName::Settings2)
-                        .ghost()
-                        .small()
-                        .tooltip(language.pick("编辑主机", "Edit host"))
-                        .invisible()
-                        .group_hover(row_group.clone(), |button| button.visible())
-                        .on_click(cx.listener(move |this, _, window, cx| {
-                            this.open_ssh_editor(Some(edit_host.clone()), window, cx);
-                        })),
-                )
-                .child(
-                    Button::new(SharedString::from(format!("ssh-pin-{ix}")))
-                        .icon(Icon::default().path(crate::gpui_shell::assets::nav::PIN))
-                        .ghost()
-                        .small()
-                        .selected(pinned)
-                        .toggled(pinned)
-                        .tooltip(if pinned {
-                            language.pick("取消置顶", "Unpin")
-                        } else {
-                            language.pick("置顶", "Pin")
-                        })
-                        .when(!pinned, |button| button.invisible())
-                        .group_hover(row_group.clone(), |button| button.visible())
-                        .on_click(cx.listener(move |this, _, _, cx| {
-                            this.ssh_apply(
-                                |lists| lists.toggle_pin(&pin_host),
-                                SshStatus::Pinned,
-                                cx,
-                            );
-                        })),
-                )
-                .child(
-                    Button::new(SharedString::from(format!("ssh-delete-{ix}")))
-                        .map(|button| {
-                            if confirm {
-                                button
-                                    .label(language.pick("确认删除", "Confirm delete"))
-                                    .danger()
-                                    .small()
-                            } else {
-                                button
-                                    .icon(IconName::Delete)
-                                    .ghost()
-                                    .small()
-                                    .tooltip(if from_config {
-                                        language.tr("settings.ssh.hide_config_host")
-                                    } else {
-                                        language.pick("删除", "Delete")
-                                    })
-                            }
-                        })
-                        // 进了确认态就常显：指针移开还让它隐形，等于把「再点
-                        // 一次才真删」这个状态藏起来。
-                        .when(!confirm, |button| {
-                            button
-                                .invisible()
-                                .group_hover(row_group.clone(), |button| button.visible())
-                        })
-                        .on_click(cx.listener(move |this, _, _, cx| {
-                            if this.ssh_delete_confirm.as_deref() == Some(delete_host.as_str()) {
-                                this.delete_ssh_host(&delete_host, cx);
-                            } else {
-                                this.ssh_delete_confirm = Some(delete_host.clone());
-                                cx.notify();
-                            }
-                        })),
-                )
-        });
-
-        let hidden_rows = self.ssh_show_hidden.then(|| {
-            hidden
-                .iter()
-                .enumerate()
-                .map(|(ix, host)| {
-                    let restore_host = host.clone();
-                    h_flex()
-                        .h(px(32.0))
-                        .w_full()
-                        .px_3()
-                        .items_center()
-                        .gap_2()
-                        .when(ix + 1 < hidden.len(), |row| {
-                            row.border_b_1().border_color(theme.border.opacity(0.5))
-                        })
-                        .child(
-                            div()
-                                .flex_1()
-                                .min_w_0()
-                                .text_sm()
-                                .text_color(muted)
-                                .truncate()
-                                .child(host.clone()),
-                        )
-                        .child(
-                            NebulaButton::new(SharedString::from(format!("ssh-restore-{ix}")))
-                                .label(language.pick("恢复", "Restore"))
-                                .on_click(cx.listener(move |this, _, _, cx| {
-                                    this.ssh_apply(
-                                        |lists| lists.restore_hidden(&restore_host),
-                                        SshStatus::Restored(restore_host.clone()),
-                                        cx,
-                                    );
-                                })),
-                        )
-                })
-                .collect::<Vec<_>>()
-        });
-
-        let hidden_count = self.ssh_hosts.hidden_hosts().len();
-        let undo_bar = self.ssh_delete_undo.as_ref().map(|undo| (undo.host.clone(), undo.seq));
-
-        self.group(language.pick("SSH 主机", "SSH hosts"), cx)
-            .child(
-                h_flex()
-                    .h(px(32.0))
-                    .items_center()
-                    .gap_2()
-                    .child(
-                        div()
-                            .text_color(theme.foreground)
-                            .child(language.pick("已保存主机", "Saved hosts")),
-                    )
-                    .when(host_count > 0, |header| {
-                        header.child(
-                            div()
-                                .px(px(6.0))
-                                .rounded_sm()
-                                .text_xs()
-                                .text_color(muted)
-                                .bg(theme.muted)
-                                .child(SharedString::from(host_count.to_string())),
-                        )
-                    })
-                    .child(div().flex_1())
-                    .child(
-                        NebulaButton::new("ssh-add-host")
-                            .label(language.pick("+ 添加主机", "+ Add host"))
-                            .primary()
-                            .on_click(cx.listener(|this, _, window, cx| {
-                                this.open_ssh_editor(None, window, cx);
-                            })),
-                    ),
-            )
-            .child(div().h(px(SSH_HOST_GAP)))
-            .child(
-                v_flex()
-                    .w_full()
-                    .rounded(px(8.0))
-                    .border_1()
-                    .border_color(theme.border)
-                    .overflow_hidden()
-                    .children(host_rows)
-                    .when(host_count == 0, |card| {
-                        card.child(
-                            v_flex()
-                                .py_6()
-                                .gap_1()
-                                .items_center()
-                                .child(
-                                    div().text_color(muted).child(
-                                        language.pick("还没有保存的主机", "No saved hosts yet"),
-                                    ),
-                                )
-                                .child(
-                                    div()
-                                        .text_xs()
-                                        .text_color(muted)
-                                        .child(language.tr("settings.ssh.empty_hint")),
-                                ),
-                        )
-                    }),
-            )
-            .child(div().h(px(SSH_HOST_GAP)))
-            .child(
-                h_flex()
-                    .gap_2()
-                    .items_center()
-                    .child(
-                        NebulaButton::new("ssh-import")
-                            .label(language.pick("导入 ~/.ssh/config", "Import ~/.ssh/config"))
-                            .on_click(cx.listener(|this, _, _, cx| {
-                                this.ssh_hosts = crate::gpui_shell::ssh_hosts::SshHostLists::load();
-                                let count = crate::ssh::ssh_config_hosts().len();
-                                this.ssh_status = Some(SshStatus::Imported(count));
-                                cx.notify();
-                            })),
-                    )
-                    .when(hidden_count > 0, |row| {
-                        let show = self.ssh_show_hidden;
-                        row.child(
-                            NebulaButton::new("ssh-toggle-hidden")
-                                .label(if show {
-                                    SharedString::from(
-                                        language.pick("收起已隐藏", "Collapse hidden"),
-                                    )
-                                } else {
-                                    SharedString::from(format!(
-                                        "{} {hidden_count}",
-                                        language.pick("已隐藏", "Hidden")
-                                    ))
-                                })
-                                .on_click(cx.listener(|this, _, _, cx| {
-                                    this.ssh_show_hidden = !this.ssh_show_hidden;
-                                    cx.notify();
-                                })),
-                        )
-                    })
-                    .child(div().flex_1())
-                    .child(
-                        div()
-                            .text_xs()
-                            .text_color(muted)
-                            .child(language.tr("settings.ssh.shared_data_hint")),
-                    ),
-            )
-            .when_some(hidden_rows, |group, rows| {
-                group.child(div().h(px(8.0))).child(
-                    v_flex()
-                        .w_full()
-                        .rounded(px(8.0))
-                        .border_1()
-                        .border_color(theme.border)
-                        .overflow_hidden()
-                        .children(rows),
-                )
-            })
-            .when_some(undo_bar, |group, (host, _)| {
-                group.child(div().h(px(8.0))).child(
-                    h_flex()
-                        .h(px(36.0))
-                        .px_3()
-                        .items_center()
-                        .gap_2()
-                        .rounded(px(6.0))
-                        .bg(theme.muted)
-                        .child(Icon::new(IconName::Undo2).xsmall().text_color(muted))
-                        .child(div().flex_1().text_sm().child(SharedString::from(format!(
-                            "{} {host}; {} {SSH_DELETE_UNDO_SECS} {}",
-                            language.pick("已删除", "Deleted"),
-                            language.pick("可在", "undo within"),
-                            language.pick("秒", "seconds")
-                        ))))
-                        .child(
-                            NebulaButton::new("ssh-undo-delete")
-                                .label(language.pick("撤销", "Undo"))
-                                .outline()
-                                .on_click(cx.listener(|this, _, _, cx| this.undo_ssh_delete(cx))),
-                        ),
-                )
-            })
-            .when_some(self.ssh_status.clone(), |group, status| {
-                let error = status.is_error();
-                let message = status.text(language);
-                group.child(
-                    div()
-                        .pt(px(6.0))
-                        .text_sm()
-                        .text_color(if error { theme.danger } else { theme.success })
-                        .child(message),
-                )
-            })
-    }
 }
 
 /// 在 UI 线程捕获 owner HWND（以 usize 传递给后台线程；HWND 裸指针不是
diff --git a/nebula_app/src/gpui_shell/ssh_settings/editor.rs b/nebula_app/src/gpui_shell/ssh_settings/editor.rs
index 3ef49d6..cb70915 100644
--- a/nebula_app/src/gpui_shell/ssh_settings/editor.rs
+++ b/nebula_app/src/gpui_shell/ssh_settings/editor.rs
@@ -372,6 +372,7 @@ impl SettingsPane {
                         cx,
                     )),
             )
+            .child(self.host_organization_fields(window, cx))
             .child(
                 h_flex()
                     .mt_5()
diff --git a/nebula_app/src/gpui_shell/ssh_settings/library.rs b/nebula_app/src/gpui_shell/ssh_settings/library.rs
new file mode 100644
index 0000000..65ea75c
--- /dev/null
+++ b/nebula_app/src/gpui_shell/ssh_settings/library.rs
@@ -0,0 +1,637 @@
+//! Cached host search, grouping, virtual rows and credential-free exchange.
+
+use super::*;
+use gpui::AppContext as _;
+use gpui_component::menu::PopupMenuItem;
+
+mod exchange;
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(in crate::gpui_shell) enum HostScope {
+    All,
+    Managed,
+    Recent,
+}
+
+pub(in crate::gpui_shell) struct HostLibraryState {
+    pub search: Entity<InputState>,
+    pub group: Entity<InputState>,
+    pub tags: Entity<InputState>,
+    pub notes: Entity<InputState>,
+    scope: HostScope,
+    group_filter: Option<String>,
+    scroll: gpui::UniformListScrollHandle,
+    pub(super) busy: bool,
+    sequence: u64,
+}
+
+impl HostLibraryState {
+    pub(in crate::gpui_shell) fn new(window: &mut Window, cx: &mut Context<SettingsPane>) -> Self {
+        let language = crate::gpui_shell::config::ui_language(cx);
+        Self {
+            search: cx.new(|cx| {
+                InputState::new(window, cx).placeholder(language.text(Message::HostsSearch))
+            }),
+            group: cx.new(|cx| {
+                InputState::new(window, cx).placeholder(language.text(Message::HostsGroup))
+            }),
+            tags: cx.new(|cx| {
+                InputState::new(window, cx).placeholder(language.text(Message::HostsTagsHint))
+            }),
+            notes: cx.new(|cx| InputState::new(window, cx).multi_line(true).soft_wrap(true)),
+            scope: HostScope::All,
+            group_filter: None,
+            scroll: Default::default(),
+            busy: false,
+            sequence: 0,
+        }
+    }
+
+    pub(in crate::gpui_shell) fn reset_scroll(&self) {
+        self.scroll.scroll_to_item(0, gpui::ScrollStrategy::Top);
+    }
+}
+
+impl SettingsPane {
+    fn filtered_library_hosts(&self, cx: &gpui::App) -> Vec<String> {
+        let query = self.ssh_library.search.read(cx).value();
+        let hosts = if self.ssh_library.scope == HostScope::Recent {
+            self.ssh_hosts
+                .saved
+                .iter()
+                .filter(|host| !self.ssh_hosts.hidden.contains(host))
+                .cloned()
+                .collect()
+        } else {
+            self.ssh_hosts.merged()
+        };
+        self.ssh_hosts.profiles.filter_hosts(
+            hosts,
+            &query,
+            self.ssh_library.scope == HostScope::Managed,
+            self.ssh_library.group_filter.as_deref(),
+        )
+    }
+
+    fn library_controls(&self, cx: &mut Context<Self>) -> gpui::AnyElement {
+        let language = crate::gpui_shell::config::ui_language(cx);
+        let weak = cx.entity().downgrade();
+        let group_filter = self.ssh_library.group_filter.clone();
+        let groups = self.ssh_hosts.profiles.groups();
+        let group_label = match group_filter.as_deref() {
+            None => language.text(Message::HostsAllGroups).to_owned(),
+            Some("") => language.text(Message::HostsUngrouped).to_owned(),
+            Some(group) => group.to_owned(),
+        };
+        v_flex()
+            .gap_2()
+            .mb_3()
+            .child(Input::new(&self.ssh_library.search).w_full())
+            .child(
+                h_flex()
+                    .gap_2()
+                    .flex_wrap()
+                    .children(
+                        [
+                            (HostScope::All, Message::HostsAll),
+                            (HostScope::Managed, Message::HostsManaged),
+                            (HostScope::Recent, Message::HostsRecent),
+                        ]
+                        .into_iter()
+                        .enumerate()
+                        .map(|(index, (scope, label))| {
+                            Button::new(("host-scope", index))
+                                .label(language.text(label))
+                                .small()
+                                .selected(self.ssh_library.scope == scope)
+                                .on_click(cx.listener(move |this, _, _, cx| {
+                                    this.ssh_library.scope = scope;
+                                    this.ssh_library.reset_scroll();
+                                    cx.notify();
+                                }))
+                        }),
+                    )
+                    .child(
+                        Button::new("host-group-filter").label(group_label).small().dropdown_menu(
+                            move |mut menu, _, _| {
+                                let choices = std::iter::once((
+                                    None,
+                                    language.text(Message::HostsAllGroups).to_owned(),
+                                ))
+                                .chain(std::iter::once((
+                                    Some(String::new()),
+                                    language.text(Message::HostsUngrouped).to_owned(),
+                                )))
+                                .chain(
+                                    groups.iter().map(|group| (Some(group.clone()), group.clone())),
+                                );
+                                for (choice, label) in choices {
+                                    let owner = weak.clone();
+                                    menu = menu.item(
+                                        PopupMenuItem::new(label)
+                                            .checked(choice == group_filter)
+                                            .on_click(move |_, _, cx| {
+                                                let _ = owner.update(cx, |this, cx| {
+                                                    this.ssh_library.group_filter = choice.clone();
+                                                    this.ssh_library.reset_scroll();
+                                                    cx.notify();
+                                                });
+                                            }),
+                                    );
+                                }
+                                menu
+                            },
+                        ),
+                    )
+                    .child(div().flex_1())
+                    .child(
+                        Button::new("hosts-import-csv")
+                            .label(language.text(Message::HostsImport))
+                            .small()
+                            .disabled(self.ssh_library.busy)
+                            .on_click(
+                                cx.listener(|this, _, window, cx| this.import_host_csv(window, cx)),
+                            ),
+                    )
+                    .child(
+                        Button::new("hosts-export-csv")
+                            .label(language.text(Message::HostsExport))
+                            .small()
+                            .disabled(self.ssh_library.busy)
+                            .on_click(
+                                cx.listener(|this, _, window, cx| this.export_host_csv(window, cx)),
+                            ),
+                    ),
+            )
+            .into_any_element()
+    }
+
+    pub(super) fn host_organization_fields(
+        &self,
+        window: &Window,
+        cx: &gpui::App,
+    ) -> gpui::AnyElement {
+        let language = crate::gpui_shell::config::ui_language(cx);
+        v_flex()
+            .mt_4()
+            .gap_2()
+            .child(
+                h_flex()
+                    .gap_3()
+                    .child(
+                        v_flex()
+                            .flex_1()
+                            .min_w_0()
+                            .gap_1()
+                            .child(div().text_xs().child(language.text(Message::HostsGroup)))
+                            .child(editor::editor_input(
+                                &self.ssh_library.group,
+                                language.text(Message::HostsGroup),
+                                window,
+                                cx,
+                            )),
+                    )
+                    .child(
+                        v_flex()
+                            .flex_1()
+                            .min_w_0()
+                            .gap_1()
+                            .child(div().text_xs().child(language.text(Message::HostsTags)))
+                            .child(editor::editor_input(
+                                &self.ssh_library.tags,
+                                language.text(Message::HostsTags),
+                                window,
+                                cx,
+                            )),
+                    ),
+            )
+            .child(div().text_xs().child(language.text(Message::HostsNotes)))
+            .child(Input::new(&self.ssh_library.notes).w_full().h(px(80.0)))
+            .into_any_element()
+    }
+
+    fn render_library_host(
+        &self,
+        host: String,
+        ix: usize,
+        host_count: usize,
+        labels: &std::collections::HashMap<String, String>,
+        icons: &std::collections::HashMap<String, String>,
+        cx: &mut Context<Self>,
+    ) -> gpui::AnyElement {
+        let language = crate::gpui_shell::config::ui_language(cx);
+        let theme = cx.theme();
+        let hover_bg = crate::gpui_shell::theme::settings_hover_bg(cx, false);
+        let muted = theme.muted_foreground;
+        let symbol_family: SharedString = crate::font_install::REQUIRED_FONT_FAMILY.into();
+        let font_px = cx
+            .try_global::<crate::gpui_shell::config::Settings>()
+            .map(|s| s.base_font_size_px)
+            .unwrap_or(15.0);
+        let title_h = font_px;
+        let subtitle_h = font_px * 0.78;
+        let delete_confirm = self.ssh_delete_confirm.clone();
+
+        let pinned = self.ssh_hosts.is_pinned(&host);
+        let from_config = self.ssh_hosts.is_from_config(&host);
+        let confirm = delete_confirm.as_deref() == Some(host.as_str());
+        let label = labels.get(&host).cloned().unwrap_or_else(|| host.clone());
+        // 行首 OS 图标（旧壳裁定 2026-08-09）：id 取自 ssh_profiles 存储，
+        // 未认出回落通用终端形状；mono 字体渲染 Nerd Font 字位。
+        let os_icon = crate::display::ui::os_icons::resolve(icons.get(&host).map(String::as_str));
+        let connect_host = host.clone();
+        let edit_host = host.clone();
+        let pin_host = host.clone();
+        let delete_host = host.clone();
+        let row_group = SharedString::from(format!("ssh-host-actions-{ix}"));
+        h_flex()
+                .id(SharedString::from(format!("ssh-host-row-{ix}")))
+                .group(row_group.clone())
+                // 旧壳 `SSH_HOST_ROW_H` 固定 58px；两行文字与 OS 图标在
+                // 这个高度里共用中线，不能压成普通 48px 设置行。
+                .h(px(SSH_HOST_ROW_H))
+                .w_full()
+                .px_3()
+                .items_center()
+                .gap_3()
+                .when(ix == 0, |row| row.rounded_t(px(8.0)))
+                .when(ix + 1 == host_count, |row| row.rounded_b(px(8.0)))
+                .when(ix + 1 < host_count, |row| {
+                    row.border_b_1().border_color(theme.border.opacity(0.5))
+                })
+                .hover(move |row| row.bg(hover_bg))
+                .child(
+                    div()
+                        .w(px(22.0))
+                        .h_full()
+                        .flex_shrink_0()
+                        .relative()
+                        .flex()
+                        .items_center()
+                        .justify_center()
+                        .font_family(symbol_family.clone())
+                        .text_size(px(18.0))
+                        .text_color(muted)
+                        .text_center()
+                        .child(os_icon.glyph.to_string()),
+                )
+                .child(
+                    v_flex()
+                        .flex_1()
+                        .min_w_0()
+                        .justify_center()
+                        .child(
+                            div()
+                                .h(px(title_h * 0.95))
+                                .flex()
+                                .items_center()
+                                .text_size(px(title_h))
+                                .line_height(px(title_h))
+                                .truncate()
+                                .gap_2()
+                                .child(label)
+                                .child(div().text_xs().text_color(muted)
+                                    .child(self.ssh_hosts.profiles.organization(&host).group.clone())),
+                        )
+                        .child(
+                            h_flex()
+                                .h(px(subtitle_h))
+                                .gap_2()
+                                .items_center()
+                                // 副行与旧壳同合同：只放目的地本身；来源用
+                                // 小徽章表达（config 源的删除语义是隐藏）。
+                                .child(
+                                    div()
+                                        .text_size(px(subtitle_h))
+                                        .line_height(px(subtitle_h))
+                                        .text_color(muted)
+                                        .truncate()
+                                        .child(host.clone()),
+                                )
+                                .when(from_config, |line| {
+                                    line.child(
+                                        div()
+                                            .flex_shrink_0()
+                                            .px(px(5.0))
+                                            .rounded_sm()
+                                            .text_xs()
+                                            .text_color(muted)
+                                            .border_1()
+                                            .border_color(theme.border)
+                                            .child("config"),
+                                    )
+                                }),
+                        ),
+                )
+                .child(
+                    Button::new(SharedString::from(format!("ssh-connect-{ix}")))
+                        .label(language.pick("连接", "Connect"))
+                        .small()
+                        .primary()
+                        .on_click(cx.listener(move |this, _, _, cx| {
+                            cx.emit(SettingsPaneEvent::LaunchSsh(connect_host.clone()));
+                            this.ssh_status = Some(SshStatus::Opening(connect_host.clone()));
+                            cx.notify();
+                        })),
+                )
+                .child(
+                    Button::new(SharedString::from(format!("ssh-edit-{ix}")))
+                        .icon(IconName::Settings2)
+                        .ghost()
+                        .small()
+                        .tooltip(language.pick("编辑主机", "Edit host"))
+                        .on_click(cx.listener(move |this, _, window, cx| {
+                            this.open_ssh_editor(Some(edit_host.clone()), window, cx);
+                        })),
+                )
+                .child(
+                    Button::new(SharedString::from(format!("ssh-pin-{ix}")))
+                        .icon(Icon::default().path(crate::gpui_shell::assets::nav::PIN))
+                        .ghost()
+                        .small()
+                        .selected(pinned)
+                        .toggled(pinned)
+                        .tooltip(if pinned {
+                            language.pick("取消置顶", "Unpin")
+                        } else {
+                            language.pick("置顶", "Pin")
+                        })
+                        .on_click(cx.listener(move |this, _, _, cx| {
+                            this.ssh_apply(
+                                |lists| lists.toggle_pin(&pin_host),
+                                SshStatus::Pinned,
+                                cx,
+                            );
+                        })),
+                )
+                .child(
+                    Button::new(SharedString::from(format!("ssh-delete-{ix}")))
+                        .map(|button| {
+                            if confirm {
+                                button
+                                    .label(language.pick("确认删除", "Confirm delete"))
+                                    .danger()
+                                    .small()
+                            } else {
+                                button
+                                    .icon(IconName::Delete)
+                                    .ghost()
+                                    .small()
+                                    .tooltip(if from_config {
+                                        language.tr("settings.ssh.hide_config_host")
+                                    } else {
+                                        language.pick("删除", "Delete")
+                                    })
+                            }
+                        })
+                        // 进了确认态就常显：指针移开还让它隐形，等于把「再点
+                        // 一次才真删」这个状态藏起来。
+                        .when(!confirm, |button| {
+                            button
+                                        })
+                        .on_click(cx.listener(move |this, _, _, cx| {
+                            if this.ssh_delete_confirm.as_deref() == Some(delete_host.as_str()) {
+                                this.delete_ssh_host(&delete_host, cx);
+                            } else {
+                                this.ssh_delete_confirm = Some(delete_host.clone());
+                                cx.notify();
+                            }
+                        })),
+                )
+
+        .into_any_element()
+    }
+
+    pub(in crate::gpui_shell) fn section_ssh(&mut self, cx: &mut Context<Self>) -> gpui::Div {
+        let language = crate::gpui_shell::config::ui_language(cx);
+        let controls = self.library_controls(cx);
+        let theme = cx.theme();
+        let muted = theme.muted_foreground;
+        let hosts = self.filtered_library_hosts(cx);
+        let host_count = hosts.len();
+        let labels = self.ssh_hosts.profiles.labels();
+        let icons = self.ssh_hosts.profiles.icons();
+        let hidden: Vec<String> = self.ssh_hosts.hidden_hosts().to_vec();
+
+        let row_hosts = hosts.clone();
+        let host_rows = gpui::uniform_list(
+            "ssh-library-hosts",
+            host_count,
+            cx.processor(move |this, range: std::ops::Range<usize>, _, cx| {
+                range
+                    .map(|index| {
+                        this.render_library_host(
+                            row_hosts[index].clone(),
+                            index,
+                            host_count,
+                            &labels,
+                            &icons,
+                            cx,
+                        )
+                    })
+                    .collect::<Vec<_>>()
+            }),
+        )
+        .track_scroll(&self.ssh_library.scroll)
+        .w_full()
+        .h(px(SSH_HOST_ROW_H * host_count.clamp(1, 8) as f32));
+
+        let hidden_rows = self.ssh_show_hidden.then(|| {
+            hidden
+                .iter()
+                .enumerate()
+                .map(|(ix, host)| {
+                    let restore_host = host.clone();
+                    h_flex()
+                        .h(px(32.0))
+                        .w_full()
+                        .px_3()
+                        .items_center()
+                        .gap_2()
+                        .when(ix + 1 < hidden.len(), |row| {
+                            row.border_b_1().border_color(theme.border.opacity(0.5))
+                        })
+                        .child(
+                            div()
+                                .flex_1()
+                                .min_w_0()
+                                .text_sm()
+                                .text_color(muted)
+                                .truncate()
+                                .child(host.clone()),
+                        )
+                        .child(
+                            NebulaButton::new(SharedString::from(format!("ssh-restore-{ix}")))
+                                .label(language.pick("恢复", "Restore"))
+                                .on_click(cx.listener(move |this, _, _, cx| {
+                                    this.ssh_apply(
+                                        |lists| lists.restore_hidden(&restore_host),
+                                        SshStatus::Restored(restore_host.clone()),
+                                        cx,
+                                    );
+                                })),
+                        )
+                })
+                .collect::<Vec<_>>()
+        });
+
+        let hidden_count = self.ssh_hosts.hidden_hosts().len();
+        let undo_bar = self.ssh_delete_undo.as_ref().map(|undo| (undo.host.clone(), undo.seq));
+
+        self.group(language.pick("SSH 主机", "SSH hosts"), cx)
+            .child(controls)
+            .children(
+                self.ssh_hosts
+                    .load_error
+                    .as_ref()
+                    .map(|error| div().text_sm().text_color(theme.danger).child(error.clone())),
+            )
+            .child(
+                h_flex()
+                    .h(px(32.0))
+                    .items_center()
+                    .gap_2()
+                    .child(
+                        div()
+                            .text_color(theme.foreground)
+                            .child(language.pick("已保存主机", "Saved hosts")),
+                    )
+                    .when(host_count > 0, |header| {
+                        header.child(
+                            div()
+                                .px(px(6.0))
+                                .rounded_sm()
+                                .text_xs()
+                                .text_color(muted)
+                                .bg(theme.muted)
+                                .child(SharedString::from(host_count.to_string())),
+                        )
+                    })
+                    .child(div().flex_1())
+                    .child(
+                        NebulaButton::new("ssh-add-host")
+                            .label(language.pick("+ 添加主机", "+ Add host"))
+                            .primary()
+                            .disabled(self.ssh_library.busy)
+                            .on_click(cx.listener(|this, _, window, cx| {
+                                this.open_ssh_editor(None, window, cx);
+                            })),
+                    ),
+            )
+            .child(div().h(px(SSH_HOST_GAP)))
+            .child(
+                v_flex()
+                    .w_full()
+                    .rounded(px(8.0))
+                    .border_1()
+                    .border_color(theme.border)
+                    .overflow_hidden()
+                    .when(host_count > 0, |card| card.child(host_rows))
+                    .when(host_count == 0, |card| {
+                        card.child(
+                            v_flex()
+                                .py_6()
+                                .gap_1()
+                                .items_center()
+                                .child(
+                                    div()
+                                        .text_color(muted)
+                                        .child(language.text(Message::HostsNoMatches)),
+                                )
+                                .child(
+                                    div()
+                                        .text_xs()
+                                        .text_color(muted)
+                                        .child(language.tr("settings.ssh.empty_hint")),
+                                ),
+                        )
+                    }),
+            )
+            .child(div().h(px(SSH_HOST_GAP)))
+            .child(
+                h_flex()
+                    .gap_2()
+                    .items_center()
+                    .child(
+                        NebulaButton::new("ssh-import")
+                            .label(language.pick("导入 ~/.ssh/config", "Import ~/.ssh/config"))
+                            .on_click(cx.listener(|this, _, _, cx| {
+                                this.reload_host_library(cx);
+                            })),
+                    )
+                    .when(hidden_count > 0, |row| {
+                        let show = self.ssh_show_hidden;
+                        row.child(
+                            NebulaButton::new("ssh-toggle-hidden")
+                                .label(if show {
+                                    SharedString::from(
+                                        language.pick("收起已隐藏", "Collapse hidden"),
+                                    )
+                                } else {
+                                    SharedString::from(format!(
+                                        "{} {hidden_count}",
+                                        language.pick("已隐藏", "Hidden")
+                                    ))
+                                })
+                                .on_click(cx.listener(|this, _, _, cx| {
+                                    this.ssh_show_hidden = !this.ssh_show_hidden;
+                                    cx.notify();
+                                })),
+                        )
+                    })
+                    .child(div().flex_1())
+                    .child(
+                        div()
+                            .text_xs()
+                            .text_color(muted)
+                            .child(language.tr("settings.ssh.shared_data_hint")),
+                    ),
+            )
+            .when_some(hidden_rows, |group, rows| {
+                group.child(div().h(px(8.0))).child(
+                    v_flex()
+                        .w_full()
+                        .rounded(px(8.0))
+                        .border_1()
+                        .border_color(theme.border)
+                        .overflow_hidden()
+                        .children(rows),
+                )
+            })
+            .when_some(undo_bar, |group, (host, _)| {
+                group.child(div().h(px(8.0))).child(
+                    h_flex()
+                        .h(px(36.0))
+                        .px_3()
+                        .items_center()
+                        .gap_2()
+                        .rounded(px(6.0))
+                        .bg(theme.muted)
+                        .child(Icon::new(IconName::Undo2).xsmall().text_color(muted))
+                        .child(div().flex_1().text_sm().child(SharedString::from(format!(
+                            "{} {host}; {} {SSH_DELETE_UNDO_SECS} {}",
+                            language.pick("已删除", "Deleted"),
+                            language.pick("可在", "undo within"),
+                            language.pick("秒", "seconds")
+                        ))))
+                        .child(
+                            NebulaButton::new("ssh-undo-delete")
+                                .label(language.pick("撤销", "Undo"))
+                                .outline()
+                                .on_click(cx.listener(|this, _, _, cx| this.undo_ssh_delete(cx))),
+                        ),
+                )
+            })
+            .when_some(self.ssh_status.clone(), |group, status| {
+                let error = status.is_error();
+                let message = status.text(language);
+                group.child(
+                    div()
+                        .pt(px(6.0))
+                        .text_sm()
+                        .text_color(if error { theme.danger } else { theme.success })
+                        .child(message),
+                )
+            })
+    }
+}
diff --git a/nebula_app/src/gpui_shell/ssh_settings/library/exchange.rs b/nebula_app/src/gpui_shell/ssh_settings/library/exchange.rs
new file mode 100644
index 0000000..1fc598e
--- /dev/null
+++ b/nebula_app/src/gpui_shell/ssh_settings/library/exchange.rs
@@ -0,0 +1,244 @@
+//! Native dialogs and background I/O for the host library.
+
+use super::*;
+use crate::ssh_profiles::SshProfiles;
+use std::io::Read;
+
+enum Completion {
+    Cancelled,
+    Reloaded(crate::gpui_shell::ssh_hosts::SshHostLists),
+    Imported {
+        profiles: SshProfiles,
+        added: usize,
+        skipped: usize,
+        restored: Vec<String>,
+        visibility_error: Option<String>,
+    },
+    Exported,
+}
+
+impl SettingsPane {
+    fn begin_host_exchange(&mut self, cx: &mut Context<Self>) -> Option<u64> {
+        if self.ssh_library.busy || self.ssh_editor.is_some() {
+            return None;
+        }
+        self.commit_pending_ssh_delete();
+        self.ssh_library.sequence = self.ssh_library.sequence.wrapping_add(1);
+        self.ssh_library.busy = true;
+        self.ssh_status = Some(SshStatus::LibraryProcessing);
+        cx.notify();
+        Some(self.ssh_library.sequence)
+    }
+
+    fn finish_host_exchange(
+        &mut self,
+        sequence: u64,
+        result: Result<Completion, String>,
+        cx: &mut Context<Self>,
+    ) {
+        if self.ssh_library.sequence != sequence {
+            return;
+        }
+        self.ssh_library.busy = false;
+        match result {
+            Ok(Completion::Cancelled) => self.ssh_status = None,
+            Ok(Completion::Reloaded(hosts)) => {
+                self.ssh_hosts = hosts;
+                self.ssh_status = Some(SshStatus::LibraryReloaded);
+                cx.emit(SettingsPaneEvent::Changed);
+            },
+            Ok(Completion::Imported { profiles, added, skipped, restored, visibility_error }) => {
+                self.ssh_hosts.profiles = profiles;
+                self.ssh_hosts.load_error = None;
+                self.ssh_hosts.hidden.retain(|host| !restored.contains(host));
+                self.ssh_status = Some(match visibility_error {
+                    Some(error) => SshStatus::LibraryImportedPartial { added, error },
+                    None => SshStatus::LibraryImported { added, skipped },
+                });
+                cx.emit(SettingsPaneEvent::Changed);
+            },
+            Ok(Completion::Exported) => self.ssh_status = Some(SshStatus::LibraryExported),
+            Err(error) => self.ssh_status = Some(SshStatus::Error(error)),
+        }
+        cx.notify();
+    }
+
+    pub(super) fn reload_host_library(&mut self, cx: &mut Context<Self>) {
+        let Some(sequence) = self.begin_host_exchange(cx) else {
+            return;
+        };
+        let task = cx.background_executor().spawn(async {
+            let hosts = crate::gpui_shell::ssh_hosts::SshHostLists::load();
+            if let Some(error) = hosts.load_error.clone() {
+                return Err(error);
+            }
+            Ok(Completion::Reloaded(hosts))
+        });
+        cx.spawn(async move |this, cx| {
+            let result = task.await;
+            let _ = this.update(cx, |this, cx| this.finish_host_exchange(sequence, result, cx));
+        })
+        .detach();
+    }
+
+    pub(super) fn import_host_csv(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let Some(sequence) = self.begin_host_exchange(cx) else {
+            return;
+        };
+        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
+            files: true,
+            directories: false,
+            multiple: false,
+            prompt: None,
+        });
+        let executor = cx.background_executor().clone();
+        cx.spawn_in(window, async move |this, cx| {
+            let path = match picked.await {
+                Ok(Ok(Some(paths))) => paths.into_iter().next(),
+                Ok(Err(error)) => {
+                    let _ = this.update(cx, |this, cx| {
+                        this.finish_host_exchange(sequence, Err(error.to_string()), cx)
+                    });
+                    return;
+                },
+                _ => None,
+            };
+            let Some(path) = path else {
+                let _ = this.update(cx, |this, cx| {
+                    this.finish_host_exchange(sequence, Ok(Completion::Cancelled), cx)
+                });
+                return;
+            };
+            let records = executor
+                .spawn(async move {
+                    let mut bytes = Vec::new();
+                    std::fs::File::open(&path)
+                        .map_err(|e| e.to_string())?
+                        .take(8 * 1024 * 1024 + 1)
+                        .read_to_end(&mut bytes)
+                        .map_err(|e| e.to_string())?;
+                    let text = String::from_utf8(bytes).map_err(|e| e.to_string())?;
+                    crate::ssh_profiles::exchange::parse_csv(&text)
+                })
+                .await;
+            let records = match records {
+                Ok(records) => records,
+                Err(error) => {
+                    let _ = this
+                        .update(cx, |this, cx| this.finish_host_exchange(sequence, Err(error), cx));
+                    return;
+                },
+            };
+            let review = this
+                .update_in(cx, |this, window, cx| {
+                    if this.ssh_library.sequence != sequence {
+                        return None;
+                    }
+                    let language = crate::gpui_shell::config::ui_language(cx);
+                    let added = records
+                        .iter()
+                        .filter(|record| !this.ssh_hosts.profiles.contains(&record.destination))
+                        .count();
+                    let detail = language.format(
+                        Message::HostsImportPreview,
+                        &[
+                            ("added", &added.to_string()),
+                            ("skipped", &(records.len() - added).to_string()),
+                        ],
+                    );
+                    Some(window.prompt(
+                        gpui::PromptLevel::Info,
+                        language.text(Message::HostsImport),
+                        Some(&detail),
+                        &[
+                            language.text(Message::TransferCancel),
+                            language.text(Message::HostsImport),
+                        ],
+                        cx,
+                    ))
+                })
+                .ok()
+                .flatten();
+            let Some(review) = review else {
+                return;
+            };
+            if review.await != Ok(1) {
+                let _ = this.update(cx, |this, cx| {
+                    this.finish_host_exchange(sequence, Ok(Completion::Cancelled), cx)
+                });
+                return;
+            }
+            let result = executor
+                .spawn(async move {
+                    let path = crate::display::nebula_data_dir().join("ssh_profiles.json");
+                    let mut profiles = SshProfiles::load(&path).map_err(|e| e.to_string())?;
+                    let mut restored: Vec<_> =
+                        records.iter().map(|record| record.destination.clone()).collect();
+                    let added = profiles.import_missing(&records)?;
+                    profiles.save(&path).map_err(|e| e.to_string())?;
+                    let raw = nebula_settings::RawSettings::load();
+                    let old_hidden = raw.value("hidden_hosts").unwrap_or_default();
+                    let hidden = old_hidden
+                        .split(',')
+                        .map(str::trim)
+                        .filter(|host| !restored.iter().any(|restored| restored == host))
+                        .collect::<Vec<_>>()
+                        .join(",");
+                    let visibility_error = if hidden != old_hidden {
+                        nebula_settings::persist_keys(&[("hidden_hosts", hidden)])
+                            .err()
+                            .map(|error| error.to_string())
+                    } else {
+                        None
+                    };
+                    if visibility_error.is_some() {
+                        restored.clear();
+                    }
+                    Ok(Completion::Imported {
+                        profiles,
+                        added,
+                        skipped: records.len() - added,
+                        restored,
+                        visibility_error,
+                    })
+                })
+                .await;
+            let _ = this.update(cx, |this, cx| this.finish_host_exchange(sequence, result, cx));
+        })
+        .detach();
+    }
+
+    pub(super) fn export_host_csv(&mut self, _window: &mut Window, cx: &mut Context<Self>) {
+        if let Some(error) = self.ssh_hosts.load_error.clone() {
+            self.ssh_status = Some(SshStatus::Error(error));
+            cx.notify();
+            return;
+        }
+        let Some(sequence) = self.begin_host_exchange(cx) else {
+            return;
+        };
+        let directory = std::env::var_os("USERPROFILE")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(std::env::temp_dir);
+        let picked = cx.prompt_for_new_path(&directory, Some("pebrel-hosts.csv"));
+        let profiles = self.ssh_hosts.profiles.clone();
+        let executor = cx.background_executor().clone();
+        cx.spawn(async move |this, cx| {
+            let result = match picked.await {
+                Ok(Ok(Some(path))) => {
+                    executor
+                        .spawn(async move {
+                            crate::atomic_file::write(&path, profiles.export_csv().as_bytes())
+                                .map_err(|e| e.to_string())?;
+                            Ok(Completion::Exported)
+                        })
+                        .await
+                },
+                Ok(Err(error)) => Err(error.to_string()),
+                _ => Ok(Completion::Cancelled),
+            };
+            let _ = this.update(cx, |this, cx| this.finish_host_exchange(sequence, result, cx));
+        })
+        .detach();
+    }
+}
diff --git a/nebula_app/src/gpui_shell/terminal/completion_viewport.rs b/nebula_app/src/gpui_shell/terminal/completion_viewport.rs
index c5deac3..3d64724 100644
--- a/nebula_app/src/gpui_shell/terminal/completion_viewport.rs
+++ b/nebula_app/src/gpui_shell/terminal/completion_viewport.rs
@@ -169,6 +169,7 @@ mod tests {
         let mut state = NebulaPaneState::default();
         state.completion_items = (0..30)
             .map(|index| NebulaCompletionItem {
+                replace_chars: 0,
                 label: format!("candidate-{index}"),
                 insert: index.to_string(),
                 kind: NebulaCompletionKind::Command,
@@ -185,7 +186,10 @@ mod tests {
         assert_eq!(viewport.hovered, None);
         assert_eq!(viewport.scrollbar_grab, None);
         assert_eq!(state.completion_selected, Some(3));
-        assert_eq!(super::super::suggest::popup_take(&mut state).as_deref(), Some("3"));
+        assert_eq!(
+            super::super::suggest::popup_take(&mut state).map(|item| item.insert).as_deref(),
+            Some("3")
+        );
     }
 
     #[test]
diff --git a/nebula_app/src/gpui_shell/terminal/element.rs b/nebula_app/src/gpui_shell/terminal/element.rs
index 9e0f0e3..437a9a5 100644
--- a/nebula_app/src/gpui_shell/terminal/element.rs
+++ b/nebula_app/src/gpui_shell/terminal/element.rs
@@ -127,8 +127,8 @@ impl TerminalElement {
     /// 部同源。没有这一步，codex/cc 用 truecolor 写死的配色在切主题后原样留在屏
     /// 幕上——它们只在启动那一刻用 OSC 11 问过一次底色。
     ///
-    /// 主题自己的颜色（ANSI 0-15、powerline 16-23）不进这条路：`is_fixed_color`
-    /// 把它们判成非 fixed，它们本来就跟着 palette 走。
+    /// Palette entries stay unchanged. Ordinary text, including ANSI gray/white,
+    /// is checked against its actual cell background; readable pairs are preserved.
     ///
     /// 三个实现选择：
     /// - **写回 `Color::Spec` 而不是另开一张色表**：下游 `theme.resolve` 对 `Spec`
@@ -306,12 +306,13 @@ impl Element for TerminalElement {
                 (fg.g * 255.0).round() as u8,
                 (fg.b * 255.0).round() as u8,
             );
-            self.view.update(cx, |view, _| {
+            self.view.update(cx, |view, cx| {
+                view.math.bind_resources(cx);
                 let size_info =
                     super::math_overlay::grid_size_info(layout.cols, layout.rows, cell_w, line_h);
-                if view.uses_source_reader_math() {
-                    return view.math.clear_frame(&size_info, math_pixels_per_point);
-                }
+                // CLI identity must not disable grid math. The answer reader
+                // replaces TerminalElement in TerminalView::render only while
+                // actually open; merely detecting Codex/Claude is not a handoff.
                 let Some(term) = view.session.as_ref().map(|session| session.term.clone()) else {
                     return view.math.clear_frame(&size_info, math_pixels_per_point);
                 };
@@ -526,8 +527,8 @@ impl Element for TerminalElement {
                 continue;
             };
             let origin = point(
-                bounds.origin.x + layout.cell_width * visual_col as f32,
-                bounds.origin.y + layout.line_height * glyph.row as f32,
+                snap_to_device(bounds.origin.x + layout.cell_width * visual_col as f32, scale),
+                snap_to_device(bounds.origin.y + layout.line_height * glyph.row as f32, scale),
             );
             let at = |p: &[f32; 2]| point(origin.x + px(p[0]), origin.y + px(p[1]));
             for prim in prims {
@@ -632,6 +633,17 @@ impl Element for TerminalElement {
             );
         }
 
+        super::molecule_overlay::paint(
+            &self.view,
+            &snap,
+            bounds,
+            layout.cell_width,
+            layout.line_height,
+            !theme_is_light,
+            window,
+            cx,
+        );
+
         // Terminal images are ordinary scrollback content: the PTY reader
         // reserved rows when it saw the protocol sequence, while this pass
         // paints only images intersecting the current viewport. GPUI caches
@@ -787,6 +799,7 @@ impl Element for TerminalElement {
             let marked = self.view.read(cx).marked_text.clone();
             self.view.update(cx, |view, _| view.ime_bounds = anchor);
             if let Some(marked) = marked.filter(|m| !m.is_empty()) {
+                let marked = crate::text_preview::single_line_label(&marked).into_owned();
                 let run = TextRun {
                     len: marked.len(),
                     font: font.clone(),
@@ -887,6 +900,16 @@ fn paint_dashed_underline(
     }
 }
 
+/// Align geometry-only terminal primitives to the device pixel grid. Cell
+/// widths/heights are already measured in device pixels and converted back to
+/// logical units, but a pane origin can still be fractional after a split or
+/// DPI-scaled layout. Rounding the absolute origin keeps box-drawing fills and
+/// polygon edges on the same physical pixels as their neighbouring cells.
+fn snap_to_device(value: Pixels, scale: f32) -> Pixels {
+    let scale = scale.max(0.5);
+    px((value.as_f32() * scale).round() / scale)
+}
+
 #[allow(clippy::too_many_arguments)]
 fn paint_link_preview(
     window: &mut Window,
@@ -899,6 +922,7 @@ fn paint_link_preview(
     font: &gpui::Font,
     font_size: Pixels,
 ) {
+    let preview = crate::text_preview::single_line_label(preview);
     let line =
         if anchor_row + 1 < layout.rows { anchor_row + 1 } else { anchor_row.saturating_sub(1) };
     let label_size = px(font_size.as_f32() * 0.85);
@@ -911,7 +935,7 @@ fn paint_link_preview(
         strikethrough: None,
     };
     let shaped = window.text_system().shape_line(
-        SharedString::from(preview.to_owned()),
+        SharedString::from(preview.into_owned()),
         label_size,
         &[run],
         None,
@@ -1552,9 +1576,8 @@ fn resolve_app_colors_into(
     use crate::display::content::is_terminal_graphic;
     use crate::display::terminal_color::is_fixed_color;
 
-    let named = |name| rgb_from_rgba(theme.resolve(Color::Named(name), overrides, false));
-    let theme_fg = named(NamedColor::Foreground);
-    let theme_bg = named(NamedColor::Background);
+    let theme_fg = rgb_from_rgba(theme.foreground);
+    let theme_bg = rgb_from_rgba(theme.background);
 
     for run in &mut snap.bg_runs {
         let base = rgb_from_rgba(theme.resolve(run.color, overrides, false));
@@ -1567,7 +1590,7 @@ fn resolve_app_colors_into(
         // 图形字符的颜色表达图形本身，不是正文对比度——图标被「矫正」成另一个
         // 颜色就是另一张图了。
         let graphic = cell.text.chars().next().is_some_and(is_terminal_graphic);
-        if graphic || !is_fixed_color(cell.fg, overrides) {
+        if graphic {
             continue;
         }
         // 对比度是一对颜色的属性：这个前景可不可读，取决于它**这一格**底下是
@@ -1608,7 +1631,7 @@ fn themed_anchor(palette: &super::colors::Palette, cx: &App) -> (crate::display:
 
 #[cfg(test)]
 mod tests {
-    use super::completion_popup_layout;
+    use super::{completion_popup_layout, snap_to_device};
     use crate::display::{NebulaCompletionItem, NebulaCompletionKind};
 
     mod app_color_resolution {
@@ -1661,14 +1684,37 @@ mod tests {
             );
         }
 
-        /// 主题自己的 ANSI 色一根手指都不许动：它们本来就跟着 palette 走，
-        /// 换主题时会自动变。碰了就等于把用户的配色改掉。
+        /// Readable ANSI text keeps its original color identity.
         #[test]
         fn theme_owned_ansi_colors_are_left_alone() {
             let (fg, _) = resolved(b"\x1b[31mred text");
             assert_eq!(fg, Color::Named(NamedColor::Red));
         }
 
+        #[test]
+        fn ansi_input_and_osc_foreground_are_readable_on_light_surfaces() {
+            let mut theme = Palette::default();
+            theme.background = gpui::rgb(0xfcfbf9);
+            theme.foreground = gpui::rgb(0x1a1a1a);
+            theme.ansi[7] = gpui::rgb(0xdddddd);
+            theme.ansi[15] = gpui::rgb(0xffffff);
+            for bytes in [b"\x1b[37m/seagull".as_slice(), b"\x1b[97mURL", b"\x1b[38;5;7mtext"] {
+                let mut snap = snapshot_of(bytes);
+                let mut resolver = TerminalColorResolver::default();
+                resolve_app_colors_into(&mut snap, &theme, &Colors::default(), &mut resolver);
+                let fg =
+                    rgb_from_rgba(theme.resolve(first_cell_fg(&snap), &Colors::default(), false));
+                assert!(fg.contrast(*rgb_from_rgba(theme.background)) >= FIXED_TEXT_MIN_CONTRAST);
+            }
+            let mut overrides = Colors::default();
+            overrides[NamedColor::Foreground] = Some(ansi::Rgb { r: 238, g: 238, b: 238 });
+            let mut snap = snapshot_of("你好".as_bytes());
+            let mut resolver = TerminalColorResolver::default();
+            resolve_app_colors_into(&mut snap, &theme, &overrides, &mut resolver);
+            let fg = rgb_from_rgba(theme.resolve(first_cell_fg(&snap), &overrides, false));
+            assert!(fg.contrast(*rgb_from_rgba(theme.background)) >= FIXED_TEXT_MIN_CONTRAST);
+        }
+
         /// 图形字符（Nerd Font 私用区、emoji）的颜色表达图形本身。哪怕它写死了
         /// 一个在当前底色上很淡的色，也不能矫正——图标被改色就是另一张图了。
         #[test]
@@ -1687,6 +1733,7 @@ mod tests {
     #[test]
     fn popup_keeps_a_single_short_exact_command_visible() {
         let items = [NebulaCompletionItem {
+            replace_chars: 0,
             label: "cat".to_owned(),
             insert: " ".to_owned(),
             kind: NebulaCompletionKind::Command,
@@ -1711,6 +1758,7 @@ mod tests {
     #[test]
     fn popup_layout_preserves_the_unselected_state() {
         let items = [NebulaCompletionItem {
+            replace_chars: 0,
             label: "git pull upstream".to_owned(),
             insert: " upstream".to_owned(),
             kind: NebulaCompletionKind::History,
@@ -1727,6 +1775,7 @@ mod tests {
     fn scrolling_is_independent_of_selection_and_popup_position() {
         let items = (0..30)
             .map(|index| NebulaCompletionItem {
+                replace_chars: 0,
                 label: format!("command-{index}"),
                 insert: format!("{index}"),
                 kind: NebulaCompletionKind::Command,
@@ -1758,6 +1807,7 @@ mod tests {
     #[test]
     fn popup_flips_above_the_cursor_near_the_bottom_edge() {
         let items = [NebulaCompletionItem {
+            replace_chars: 0,
             label: "completion.rs".to_owned(),
             insert: "ompletion.rs".to_owned(),
             kind: NebulaCompletionKind::File,
@@ -1780,4 +1830,13 @@ mod tests {
         let cursor_top = line_height * cursor_row;
         assert!(popup.content_y + popup.row_height < cursor_top);
     }
+
+    #[test]
+    fn boxdraw_origin_snaps_in_absolute_device_pixels() {
+        let snapped = snap_to_device(gpui::px(10.2), 2.0);
+        assert!((snapped.as_f32() - 10.0).abs() < 1e-5);
+
+        let snapped = snap_to_device(gpui::px(10.25), 1.5);
+        assert!((snapped.as_f32() - 10.0).abs() < 1e-5);
+    }
 }
diff --git a/nebula_app/src/gpui_shell/terminal/event_mailbox.rs b/nebula_app/src/gpui_shell/terminal/event_mailbox.rs
new file mode 100644
index 0000000..7448665
--- /dev/null
+++ b/nebula_app/src/gpui_shell/terminal/event_mailbox.rs
@@ -0,0 +1,116 @@
+//! Coalesce repaint wakeups before enqueueing; retain every semantic event.
+
+use std::pin::Pin;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::task::{Context, Poll};
+
+use futures::{Stream, channel::mpsc};
+use nebula_terminal::event::Event;
+
+#[derive(Clone)]
+pub(super) struct EventSender {
+    sender: mpsc::UnboundedSender<Event>,
+    wake_pending: Arc<AtomicBool>,
+}
+
+pub(super) struct EventReceiver {
+    receiver: mpsc::UnboundedReceiver<Event>,
+    wake_pending: Arc<AtomicBool>,
+}
+
+pub(super) fn channel() -> (EventSender, EventReceiver) {
+    let (sender, receiver) = mpsc::unbounded();
+    let wake_pending = Arc::new(AtomicBool::new(false));
+    (
+        EventSender { sender, wake_pending: wake_pending.clone() },
+        EventReceiver { receiver, wake_pending },
+    )
+}
+
+impl EventSender {
+    pub(super) fn send(&self, event: Event) {
+        let wake = matches!(event, Event::Wakeup);
+        if wake && self.wake_pending.swap(true, Ordering::AcqRel) {
+            return;
+        }
+        if self.sender.unbounded_send(event).is_err() && wake {
+            self.wake_pending.store(false, Ordering::Release);
+        }
+    }
+}
+
+impl EventReceiver {
+    fn acknowledge(&self, event: &Event) {
+        if matches!(event, Event::Wakeup) {
+            // Clear before processing: output arriving during UI work must
+            // still enqueue a subsequent repaint, even on an inactive tab.
+            self.wake_pending.store(false, Ordering::Release);
+        }
+    }
+
+    pub(super) fn try_recv(&mut self) -> Result<Event, mpsc::TryRecvError> {
+        let event = self.receiver.try_recv()?;
+        self.acknowledge(&event);
+        Ok(event)
+    }
+}
+
+impl Stream for EventReceiver {
+    type Item = Event;
+    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Event>> {
+        let result = Pin::new(&mut self.receiver).poll_next(cx);
+        if let Poll::Ready(Some(event)) = &result {
+            self.acknowledge(event);
+        }
+        result
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn eighty_sessions_keep_all_agent_edges_through_a_repaint_flood() {
+        let mut sessions: Vec<_> = (0..80).map(|_| channel()).collect();
+        for (id, (sender, _)) in sessions.iter().enumerate() {
+            sender.send(Event::CommandStart);
+            for _ in 0..1000 {
+                sender.send(Event::Wakeup);
+            }
+            sender.send(Event::AiHookEnvelope(format!("working:{id}").into_bytes()));
+            sender.send(Event::AiHookEnvelope(format!("attention:{id}").into_bytes()));
+            sender.send(Event::AiHookEnvelope(format!("done:{id}").into_bytes()));
+            sender.send(Event::CommandDone { exit_code: Some(0) });
+        }
+        for (id, (sender, receiver)) in sessions.iter_mut().enumerate() {
+            assert!(matches!(receiver.try_recv().unwrap(), Event::CommandStart));
+            assert!(matches!(receiver.try_recv().unwrap(), Event::Wakeup));
+            for edge in ["working", "attention", "done"] {
+                let Event::AiHookEnvelope(bytes) = receiver.try_recv().unwrap() else {
+                    panic!("lost agent edge")
+                };
+                assert_eq!(bytes, format!("{edge}:{id}").into_bytes());
+            }
+            assert!(matches!(
+                receiver.try_recv().unwrap(),
+                Event::CommandDone { exit_code: Some(0) }
+            ));
+            assert!(receiver.try_recv().is_err());
+            sender.send(Event::Wakeup);
+            assert!(matches!(receiver.try_recv().unwrap(), Event::Wakeup));
+        }
+    }
+
+    #[test]
+    fn sender_clones_share_wakeup_state_but_retain_exit() {
+        let (sender, mut receiver) = channel();
+        sender.send(Event::Wakeup);
+        sender.clone().send(Event::Wakeup);
+        sender.send(Event::Exit);
+        assert!(matches!(receiver.try_recv().unwrap(), Event::Wakeup));
+        assert!(matches!(receiver.try_recv().unwrap(), Event::Exit));
+        assert!(receiver.try_recv().is_err());
+    }
+}
diff --git a/nebula_app/src/gpui_shell/terminal/math_overlay.rs b/nebula_app/src/gpui_shell/terminal/math_overlay.rs
index 4bc54a5..73d10e9 100644
--- a/nebula_app/src/gpui_shell/terminal/math_overlay.rs
+++ b/nebula_app/src/gpui_shell/terminal/math_overlay.rs
@@ -37,6 +37,8 @@ use crate::gpui_shell::math_view;
 #[derive(Default)]
 pub struct MathOverlay {
     state: TerminalMathState,
+    resources_bound: bool,
+    pub(super) molecules: super::molecule_overlay::MoleculeOverlay,
 }
 
 /// 一条通过几何计划的公式：源码 + 绘制计划（坐标系 = 网格局部逻辑 px）。
@@ -174,6 +176,23 @@ fn plan_color(plan: &OverlayDrawPlan) -> Rgba {
 impl MathOverlay {
     /// session 暂不可用时也要立即清掉上一帧投影；输入命中发生在 paint 之外，
     /// 不能等下一次有 term 的扫描再修正旧坐标。
+    pub(super) fn bind_resources(&mut self, cx: &App) {
+        if self.resources_bound {
+            return;
+        }
+        let engine = super::super::scientific_render::assets(cx);
+        self.state.set_layout_resolver(Arc::new(move |source, size, points, display| {
+            engine.layout(super::super::scientific_render::FormulaKey::new(
+                source.into(),
+                display,
+                false,
+                size,
+                points,
+            ))
+        }));
+        self.resources_bound = true;
+    }
+
     pub fn clear_frame(&mut self, size: &SizeInfo, pixels_per_point: f32) -> PendingMathFrame {
         self.state.update_projection(&[], &[], false);
         PendingMathFrame::empty(*size, pixels_per_point)
@@ -819,6 +838,56 @@ mod tests {
         assert!(frame.covers(2, 0));
     }
 
+    #[cfg(feature = "gpui-test-support")]
+    #[gpui::test]
+    fn cli_screenshot_formulas_reach_async_bitmaps_without_new_terminal_output(
+        cx: &mut gpui::TestAppContext,
+    ) {
+        cx.update(crate::gpui_shell::math_view::register);
+        let mut overlay = MathOverlay::default();
+        cx.update(|cx| overlay.bind_resources(cx));
+        let term = term_with(
+            100,
+            24,
+            &[
+                "1. quadratic",
+                "",
+                "  [",
+                r"  x=\frac{-b\pm\sqrt{b^2-4ac}}{2a}",
+                "  ]",
+                "",
+                "2. euler",
+                "",
+                "  [",
+                r"  e^{i\pi}+1=0",
+                "  ]",
+                "",
+                "3. integral",
+                "",
+                "  [",
+                r"  \int_a^b f(x),\mathrm{d}x=F(b)-F(a)",
+                "  ]",
+                "",
+                "prompt",
+            ],
+        );
+        let size = grid_size_info(100, 24, 8.0, 18.0);
+        let mut counts = Vec::new();
+        for _ in 0..12 {
+            let frame = cx.update(|cx| {
+                let pending =
+                    overlay.plan_frame(&term, &size, Rgb::new(0xec, 0xef, 0xf4), 16.0, 1.0);
+                overlay.finalize_frame(pending, 1.0, cx)
+            });
+            counts.push(frame.formulas.len());
+            if frame.formulas.len() == 3 {
+                break;
+            }
+            cx.run_until_parked();
+        }
+        assert_eq!(counts.last(), Some(&3), "async pipeline frame counts: {counts:?}");
+    }
+
     #[test]
     fn markdown_unescaped_bare_paren_inline_overlays() {
         let mut overlay = MathOverlay::default();
diff --git a/nebula_app/src/gpui_shell/terminal/mod.rs b/nebula_app/src/gpui_shell/terminal/mod.rs
index 212ee89..ae8a345 100644
--- a/nebula_app/src/gpui_shell/terminal/mod.rs
+++ b/nebula_app/src/gpui_shell/terminal/mod.rs
@@ -8,12 +8,15 @@ pub mod colors;
 mod completion_viewport;
 pub(super) mod confirmation;
 pub mod element;
+mod event_mailbox;
 mod inline_image;
 pub mod keymap;
 pub mod math_overlay;
+mod molecule_overlay;
 pub mod mouse_protocol;
 mod osc_links;
 pub mod session;
+mod session_pump;
 mod ssh_connect_overlay;
 pub mod suggest;
 pub mod view;
diff --git a/nebula_app/src/gpui_shell/terminal/molecule_overlay.rs b/nebula_app/src/gpui_shell/terminal/molecule_overlay.rs
new file mode 100644
index 0000000..7ffc979
--- /dev/null
+++ b/nebula_app/src/gpui_shell/terminal/molecule_overlay.rs
@@ -0,0 +1,223 @@
+//! SMILES blocks use the same depiction as Markdown, within their source rows.
+//! The terminal grid remains the copy/selection authority.
+
+use super::view::TerminalView;
+use gpui::{App, Bounds, Corners, Entity, Pixels, Window, fill, point, px, size};
+use nebula_terminal::{render::RenderSnapshot, term::TermMode};
+use std::{
+    hash::{DefaultHasher, Hash, Hasher},
+    ops::Range,
+    sync::Arc,
+};
+
+#[derive(Default)]
+pub(super) struct MoleculeOverlay {
+    fingerprint: Option<u64>,
+    blocks: Arc<Vec<Block>>,
+}
+
+impl MoleculeOverlay {
+    fn scan(&mut self, snapshot: &RenderSnapshot) -> Arc<Vec<Block>> {
+        let mut hash = DefaultHasher::new();
+        snapshot.cols.hash(&mut hash);
+        snapshot.rows.hash(&mut hash);
+        for segment in &snapshot.segments {
+            segment.row.hash(&mut hash);
+            for cell in &segment.cells {
+                cell.col.hash(&mut hash);
+                cell.text.hash(&mut hash);
+            }
+        }
+        let fingerprint = hash.finish();
+        if self.fingerprint == Some(fingerprint) {
+            return self.blocks.clone();
+        }
+        let mut grid = vec![vec![' '; snapshot.cols as usize]; snapshot.rows as usize];
+        for segment in &snapshot.segments {
+            if let Some(row) = grid.get_mut(segment.row as usize) {
+                for cell in &segment.cells {
+                    if let Some(slot) = row.get_mut(cell.col as usize) {
+                        *slot = cell.text.chars().next().unwrap_or(' ');
+                    }
+                }
+            }
+        }
+        let lines: Vec<String> = grid.into_iter().map(|row| row.into_iter().collect()).collect();
+        self.fingerprint = Some(fingerprint);
+        self.blocks = Arc::new(blocks(&lines));
+        self.blocks.clone()
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+struct Block {
+    rows: Range<usize>,
+    column: usize,
+    source: String,
+}
+
+fn blocks(lines: &[String]) -> Vec<Block> {
+    let mut result = Vec::new();
+    let mut row = 0;
+    while row < lines.len() && result.len() < 8 {
+        let title = lines[row].trim();
+        // Several AI CLIs display the fence language as a heading and omit
+        // Markdown delimiters. Only an explicit SMILES label enables this path.
+        let labeled = if title.eq_ignore_ascii_case("smiles") {
+            lines.get(row + 1).map(|line| (line.trim(), row + 2))
+        } else {
+            title
+                .split_once(':')
+                .filter(|(label, _)| label.eq_ignore_ascii_case("smiles"))
+                .map(|(_, source)| (source.trim(), row + 1))
+        };
+        if let Some((source, mut end)) = labeled {
+            while end < lines.len() && end - row < 6 && lines[end].trim().is_empty() {
+                end += 1;
+            }
+            if !source.is_empty() && source.len() <= crate::chemistry::MAX_SOURCE_BYTES {
+                result.push(Block {
+                    rows: row..end,
+                    column: lines[row].len() - lines[row].trim_start().len(),
+                    source: source.to_owned(),
+                });
+            }
+            row = end;
+            continue;
+        }
+        let marker = if title.eq_ignore_ascii_case("```smiles") {
+            "```"
+        } else if title.eq_ignore_ascii_case("~~~smiles") {
+            "~~~"
+        } else {
+            row += 1;
+            continue;
+        };
+        let start = row;
+        row += 1;
+        let mut source = None;
+        let mut valid = true;
+        while row < lines.len() && lines[row].trim() != marker {
+            let line = lines[row].trim();
+            if !line.is_empty() {
+                if source.is_some() {
+                    valid = false;
+                }
+                source = Some(line.to_owned());
+            }
+            if row - start > 12 {
+                valid = false;
+                break;
+            }
+            row += 1;
+        }
+        if valid && row < lines.len() && lines[row].trim() == marker {
+            if let Some(source) =
+                source.filter(|source| source.len() <= crate::chemistry::MAX_SOURCE_BYTES)
+            {
+                result.push(Block {
+                    rows: start..row + 1,
+                    column: lines[start].len() - lines[start].trim_start().len(),
+                    source,
+                });
+            }
+        }
+        row += 1;
+    }
+    result
+}
+
+pub(super) fn paint(
+    view: &Entity<TerminalView>,
+    snapshot: &RenderSnapshot,
+    bounds: Bounds<Pixels>,
+    cell_width: Pixels,
+    line_height: Pixels,
+    dark: bool,
+    window: &mut Window,
+    cx: &mut App,
+) {
+    if !crate::chemistry::STRUCTURE_RENDERING_ENABLED {
+        // Leave source cells intact and avoid scanning or scheduling depiction.
+        return;
+    }
+    if !snapshot.selection_runs.is_empty()
+        || view
+            .read(cx)
+            .session
+            .as_ref()
+            .is_some_and(|session| session.term.lock().mode().contains(TermMode::VI))
+    {
+        return;
+    }
+    if !snapshot.segments.iter().any(|segment| {
+        segment.cells.iter().any(|cell| matches!(cell.text.as_str(), "`" | "~"))
+            || segment.cells.windows(6).any(|cells| {
+                cells
+                    .iter()
+                    .zip(["s", "m", "i", "l", "e", "s"])
+                    .all(|(cell, letter)| cell.text.eq_ignore_ascii_case(letter))
+            })
+    }) {
+        return;
+    }
+    let blocks = view.update(cx, |view, _| view.math.molecules.scan(snapshot));
+    let resources = super::super::scientific_render::assets(cx);
+    for block in blocks.iter() {
+        if snapshot
+            .cursor
+            .as_ref()
+            .is_some_and(|cursor| block.rows.contains(&(cursor.row as usize)))
+        {
+            continue;
+        }
+        let Some(Some(image)) = resources.molecule(block.source.clone().into(), dark) else {
+            continue;
+        };
+        let x = cell_width * block.column as f32;
+        let available = bounds.size.width - x;
+        let height = line_height * block.rows.len() as f32;
+        if available < px(64.0) || height < px(40.0) {
+            continue;
+        }
+        let area = Bounds::new(
+            point(bounds.origin.x + x, bounds.origin.y + line_height * block.rows.start as f32),
+            size(available, height),
+        );
+        let target_width = available.min(height * 2.0);
+        let target_height = target_width / 2.0;
+        let target = Bounds::new(
+            point(area.origin.x, area.origin.y + (height - target_height) / 2.0),
+            size(target_width, target_height),
+        );
+        window.paint_quad(fill(area, view.read(cx).palette.background));
+        let _ = window.paint_image(target, target, Corners::all(px(0.0)), image, 0, false);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn rendered_cli_labels_use_only_source_and_available_blank_rows() {
+        let lines = ["smiles", "c1ccccc1", "", "next paragraph"].map(str::to_owned);
+        assert_eq!(
+            blocks(&lines),
+            vec![Block { rows: 0..3, column: 0, source: "c1ccccc1".into() }]
+        );
+        let lines = ["SMILES: CCO", "", "prompt"].map(str::to_owned);
+        assert_eq!(blocks(&lines), vec![Block { rows: 0..2, column: 0, source: "CCO".into() }]);
+        assert!(blocks(&["The word smiles is ordinary prose.".into()]).is_empty());
+    }
+    #[test]
+    fn only_complete_explicit_blocks_are_replaced() {
+        let lines =
+            ["ordinary CCO", "  ```SMILES", "  c1ccccc1", "  ```", "after"].map(str::to_owned);
+        assert_eq!(
+            blocks(&lines),
+            vec![Block { rows: 1..4, column: 2, source: "c1ccccc1".into() }]
+        );
+        assert!(blocks(&lines[..3]).is_empty());
+        assert!(blocks(&["```smiles".into(), "CCO".into(), "CC".into(), "```".into()]).is_empty());
+    }
+}
diff --git a/nebula_app/src/gpui_shell/terminal/session.rs b/nebula_app/src/gpui_shell/terminal/session.rs
index c37af4e..254c34b 100644
--- a/nebula_app/src/gpui_shell/terminal/session.rs
+++ b/nebula_app/src/gpui_shell/terminal/session.rs
@@ -23,13 +23,13 @@ use nebula_terminal::tty::EventedPty as _;
 /// 视图层只有一种，SSH 不需要平行的第二套会话结构。
 #[derive(Clone)]
 pub struct EventProxy {
-    events: UnboundedSender<Event>,
+    events: super::event_mailbox::EventSender,
     stages: UnboundedSender<crate::ssh_session::SshStage>,
 }
 
 impl EventListener for EventProxy {
     fn send_event(&self, event: Event) {
-        let _ = self.events.unbounded_send(event);
+        self.events.send(event);
     }
 }
 
@@ -70,8 +70,11 @@ pub struct TerminalSession {
 
 /// 一次会话 spawn 的完整出口：会话句柄 + 终端事件流 + SSH 阶段流
 /// （本地会话的阶段流永远安静，接收端可以直接丢弃）。
-pub type SpawnedSession =
-    (TerminalSession, UnboundedReceiver<Event>, UnboundedReceiver<crate::ssh_session::SshStage>);
+pub type SpawnedSession = (
+    TerminalSession,
+    super::event_mailbox::EventReceiver,
+    UnboundedReceiver<crate::ssh_session::SshStage>,
+);
 
 /// 启动一个本地 shell 会话。尺寸随后由首帧 prepaint 按真实布局重设；
 /// `term_config` 携带运行时设置（默认光标形状/闪烁等）。
@@ -132,7 +135,7 @@ pub fn spawn(
     term_config: Config,
     options: tty::Options,
 ) -> std::io::Result<SpawnedSession> {
-    let (tx, rx) = unbounded();
+    let (tx, rx) = super::event_mailbox::channel();
     let (stage_tx, stage_rx) = unbounded();
     let proxy = EventProxy { events: tx, stages: stage_tx };
 
@@ -166,7 +169,7 @@ pub fn spawn_ssh(
     term_config: Config,
 ) -> std::io::Result<SpawnedSession> {
     let term_config = crate::ssh_session::terminal_config(term_config);
-    let (tx, rx) = unbounded();
+    let (tx, rx) = super::event_mailbox::channel();
     let (stage_tx, stage_rx) = unbounded();
     let proxy = EventProxy { events: tx, stages: stage_tx };
 
diff --git a/nebula_app/src/gpui_shell/terminal/session_pump.rs b/nebula_app/src/gpui_shell/terminal/session_pump.rs
new file mode 100644
index 0000000..ab2a677
--- /dev/null
+++ b/nebula_app/src/gpui_shell/terminal/session_pump.rs
@@ -0,0 +1,59 @@
+//! Fair delivery of terminal and connection events to their owning view.
+use super::view::TerminalView;
+use futures::StreamExt as _;
+use gpui::Context;
+use nebula_terminal::event::Event as TermEvent;
+
+pub(super) fn attach(
+    mut rx: super::event_mailbox::EventReceiver,
+    mut stage_rx: futures::channel::mpsc::UnboundedReceiver<crate::ssh_session::SshStage>,
+    is_ssh: bool,
+    cx: &mut Context<TerminalView>,
+) {
+    cx.spawn(async move |this, cx| {
+        while let Some(event) = rx.next().await {
+            // 合并同一批到达的事件，避免每个 Wakeup 都独立触发一帧。
+            let mut batch = vec![event];
+            while batch.len() < 128 {
+                match rx.try_recv() {
+                    Ok(event) => batch.push(event),
+                    _ => break,
+                }
+            }
+            let full_batch = batch.len() == 128;
+            let done = batch.iter().any(|e| matches!(e, TermEvent::Exit));
+            if this
+                .update(cx, |view: &mut TerminalView, cx| {
+                    for event in batch {
+                        view.process_event(event, cx);
+                    }
+                })
+                .is_err()
+                || done
+            {
+                break;
+            }
+            if full_batch {
+                cx.background_executor().timer(std::time::Duration::from_millis(1)).await;
+            }
+        }
+    })
+    .detach();
+    if is_ssh {
+        // SSH 连接阶段泵：横幅数据源（与旧壳连接卡片同一
+        // 上报流，350ms 门槛之类的视觉策略交给渲染端）。
+        cx.spawn(async move |this, cx| {
+            while let Some(stage) = stage_rx.next().await {
+                if this
+                    .update(cx, |view: &mut TerminalView, cx| {
+                        view.apply_ssh_stage(stage, cx);
+                    })
+                    .is_err()
+                {
+                    break;
+                }
+            }
+        })
+        .detach();
+    }
+}
diff --git a/nebula_app/src/gpui_shell/terminal/suggest.rs b/nebula_app/src/gpui_shell/terminal/suggest.rs
index 948b449..2305030 100644
--- a/nebula_app/src/gpui_shell/terminal/suggest.rs
+++ b/nebula_app/src/gpui_shell/terminal/suggest.rs
@@ -100,9 +100,9 @@ pub fn popup_move(state: &mut NebulaPaneState, delta: isize) {
 }
 
 /// 取走选中候选要键入的余量并关闭列表。
-pub fn popup_take(state: &mut NebulaPaneState) -> Option<String> {
+pub fn popup_take(state: &mut NebulaPaneState) -> Option<crate::display::NebulaCompletionItem> {
     let index = state.completion_selected?;
-    let insert = state.completion_items.get(index)?.insert.clone();
+    let insert = state.completion_items.get(index)?.clone();
     state.completion_items.clear();
     state.completion_selected = None;
     Some(insert)
@@ -132,11 +132,13 @@ mod tests {
         let mut state = NebulaPaneState::default();
         state.completion_items = vec![
             NebulaCompletionItem {
+                replace_chars: 0,
                 label: "git pull upstream".to_owned(),
                 insert: " upstream".to_owned(),
                 kind: NebulaCompletionKind::History,
             },
             NebulaCompletionItem {
+                replace_chars: 0,
                 label: "git pull --rebase".to_owned(),
                 insert: " --rebase".to_owned(),
                 kind: NebulaCompletionKind::Command,
@@ -150,7 +152,7 @@ mod tests {
         let mut state = popup_state();
         assert!(popup_active(&state));
         assert_eq!(state.completion_selected, None);
-        assert_eq!(popup_take(&mut state), None);
+        assert!(popup_take(&mut state).is_none());
         assert!(popup_active(&state));
     }
 
@@ -160,7 +162,10 @@ mod tests {
             let mut state = popup_state();
             popup_move(&mut state, delta);
             assert_eq!(state.completion_selected, Some(0));
-            assert_eq!(popup_take(&mut state).as_deref(), Some(" upstream"));
+            assert_eq!(
+                popup_take(&mut state).map(|item| item.insert).as_deref(),
+                Some(" upstream")
+            );
             assert!(!popup_active(&state));
         }
     }
@@ -174,7 +179,7 @@ mod tests {
         viewport.scroll(-28.0, 28.0, state.completion_items.len(), 1);
         assert_eq!(viewport.offset, 1);
         assert_eq!(state.completion_selected, Some(0));
-        assert_eq!(popup_take(&mut state).as_deref(), Some(" upstream"));
+        assert_eq!(popup_take(&mut state).map(|item| item.insert).as_deref(), Some(" upstream"));
     }
 }
 
diff --git a/nebula_app/src/gpui_shell/terminal/view.rs b/nebula_app/src/gpui_shell/terminal/view.rs
index 652ba43..4619d4c 100644
--- a/nebula_app/src/gpui_shell/terminal/view.rs
+++ b/nebula_app/src/gpui_shell/terminal/view.rs
@@ -5,6 +5,7 @@ mod confirmation;
 mod cwd_report;
 mod image_paste;
 mod notifications;
+mod path_drop;
 mod pointer;
 mod runtime;
 
@@ -41,7 +42,6 @@ use super::{KEY_CONTEXT, TerminalBackTab, TerminalTab};
 use crate::gpui_shell::config::Settings;
 use crate::gpui_shell::prelude::{ActiveTheme as _, Colorize as _};
 use crate::{config::UiConfig, font_install::REQUIRED_FONT_FAMILY};
-use futures::StreamExt as _;
 
 /// 等宽字体描述。GPUI 的 Windows 后端收到空 feature 列表会在
 /// `apply_font_features` 里提前返回，Maple 的 contextual ligature 因而不会
@@ -258,7 +258,6 @@ pub struct TerminalView {
     pub(super) answers: crate::assistant_answer::AnswerInbox,
     confirmation: super::confirmation::ConfirmationState,
     pub(super) answer_reader: Option<gpui::Entity<super::answer_reader::AnswerReader>>,
-    preserve_agent_math_source: bool,
     pub pane_id: u64,
     pub session: Option<TerminalSession>,
     pub focus_handle: FocusHandle,
@@ -340,6 +339,7 @@ pub struct TerminalView {
     /// 只用事件携带的绝对行锚定到对应的 scrollback 位置。
     pub(super) inline_images: super::inline_image::InlineImageStore,
     image_paste: image_paste::ImagePasteState,
+    path_drop: path_drop::PathDropState,
     /// SSH 直连目的地（`user@host[:port]`）；本地会话为 None。
     pub ssh_destination: Option<String>,
     /// 创建本地 PTY 时冻结的受控环境，供独立 `pane.exec` child 复用。
@@ -354,6 +354,12 @@ pub struct TerminalView {
     /// Hook-reported identity for exact resume/fork. Process/title inference is
     /// never accepted here because a wrong id would continue the wrong chat.
     pub ai_session: Option<crate::display::AiSessionIdentity>,
+    /// A hook is not guaranteed to be present when a pane starts. The Codex
+    /// rollout probe runs in the background and uses this generation to reject
+    /// a result from a previous foreground command.
+    pub(super) ai_session_probe_pending: bool,
+    pub(super) ai_session_probe_epoch: u64,
+    pub(super) last_ai_session_probe: Option<std::time::Instant>,
     error: Option<String>,
     exited: Option<String>,
     /// 滚动条拖拽中：按下时记下的「指针在拇指内的 y 偏移」，拖动全程据此
@@ -684,7 +690,7 @@ impl TerminalView {
             };
         let is_ssh = ssh_destination.is_some();
         let (session, error) = match spawned {
-            Ok((session, mut rx, mut stage_rx)) => {
+            Ok((session, rx, stage_rx)) => {
                 // 新会话欢迎屏（设置 fetch=1，旧壳 fastfetch 同一入口）：
                 // 命令先进 conhost 输入队列，shell 出提示符即执行。宽度按
                 // 出生网格裁定双列/堆叠版式；bash/WSL id 走 fastfetch 回退
@@ -714,48 +720,7 @@ impl TerminalView {
                         ),
                     );
                 }
-                cx.spawn(async move |this, cx| {
-                    while let Some(event) = rx.next().await {
-                        // 合并同一批到达的事件，避免每个 Wakeup 都独立触发一帧。
-                        let mut batch = vec![event];
-                        while batch.len() < 128 {
-                            match rx.try_recv() {
-                                Ok(event) => batch.push(event),
-                                _ => break,
-                            }
-                        }
-                        let done = batch.iter().any(|e| matches!(e, TermEvent::Exit));
-                        if this
-                            .update(cx, |view: &mut Self, cx| {
-                                for event in batch {
-                                    view.process_event(event, cx);
-                                }
-                            })
-                            .is_err()
-                            || done
-                        {
-                            break;
-                        }
-                    }
-                })
-                .detach();
-                if is_ssh {
-                    // SSH 连接阶段泵：横幅数据源（与旧壳连接卡片同一
-                    // 上报流，350ms 门槛之类的视觉策略交给渲染端）。
-                    cx.spawn(async move |this, cx| {
-                        while let Some(stage) = stage_rx.next().await {
-                            if this
-                                .update(cx, |view: &mut Self, cx| {
-                                    view.apply_ssh_stage(stage, cx);
-                                })
-                                .is_err()
-                            {
-                                break;
-                            }
-                        }
-                    })
-                    .detach();
-                }
+                super::session_pump::attach(rx, stage_rx, is_ssh, cx);
                 (Some(session), None)
             },
             Err(err) => {
@@ -802,7 +767,6 @@ impl TerminalView {
             answers: crate::assistant_answer::AnswerInbox::default(),
             answer_reader: None,
             confirmation: super::confirmation::ConfirmationState::default(),
-            preserve_agent_math_source: false,
             font: mono_font(&families[0], FontWeight::NORMAL, FontStyle::Normal),
             font_bold: mono_font(&families[1], FontWeight::BOLD, FontStyle::Normal),
             font_italic: mono_font(&families[2], FontWeight::NORMAL, FontStyle::Italic),
@@ -837,12 +801,16 @@ impl TerminalView {
             pending_runtime_submit: None,
             inline_images: super::inline_image::InlineImageStore::default(),
             image_paste: image_paste::ImagePasteState::default(),
+            path_drop: path_drop::PathDropState::default(),
             ssh_destination,
             exec_context,
             ssh_stage: None,
             ssh_connect: None,
             ssh_connect_last_step: std::time::Instant::now(),
             ai_session: None,
+            ai_session_probe_pending: false,
+            ai_session_probe_epoch: 0,
+            last_ai_session_probe: None,
             error,
             exited: None,
             scrollbar_drag: None,
@@ -903,7 +871,7 @@ impl TerminalView {
         view
     }
 
-    fn process_event(&mut self, event: TermEvent, cx: &mut Context<Self>) {
+    pub(super) fn process_event(&mut self, event: TermEvent, cx: &mut Context<Self>) {
         let cwd_changed = cwd_report::apply(&mut self.cwd, &event);
         // Both shell metadata channels update completion and directory history.
         if cwd_changed
@@ -1014,8 +982,13 @@ impl TerminalView {
                     crate::ai_agents::AgentKind::parse_command(&self.suggest.last_committed)
                         .map(|agent| agent.slug().to_owned())
                         .or_else(|| crate::display::extract_program(&self.suggest.last_committed));
+                // A probe belongs to one foreground command. Invalidate it
+                // before replacing the command identity so a slow WSL result
+                // from Codex A cannot become the identity of Codex B.
+                self.invalidate_ai_session_probe();
                 if identity != self.running_program {
                     self.running_program = identity;
+                    self.ai_session = None;
                     cx.emit(TerminalViewEvent::TitleChanged);
                 }
                 if self
@@ -1029,6 +1002,7 @@ impl TerminalView {
                     self.agent_status_rule = None;
                 }
                 self.mark_command_running();
+                self.probe_missing_codex_session(cx);
                 // 首个词就是一个交互式 shell（`cmd`、`wsl`、裸 `bash`）：133;C
                 // 是真的，但这条「命令」其实是一个新提示符，133;D 永远不会来
                 // ——那个 shell 接管了终端，而我们的集成不在它里面。立刻按「已被
@@ -1133,22 +1107,6 @@ impl TerminalView {
         }
     }
 
-    /// 旧壳 `WindowContext::busy_process_in` 的单 Pane 形态：进程树只负责
-    /// 判断 shell 下面是否仍有子进程；展示名称优先采用终端协议识别出的
-    /// 程序名，避免把 Claude Code 一律显示成承载它的 `node.exe`。
-    pub fn busy_process(&self) -> Option<String> {
-        let shell_pid = self.session.as_ref()?.shell_pid;
-        if shell_pid == 0 {
-            return None;
-        }
-        let executable = crate::process_tree::busy_child(shell_pid)?;
-        Some(
-            self.running_program
-                .clone()
-                .unwrap_or_else(|| crate::process_tree::display_name(&executable)),
-        )
-    }
-
     fn write_bytes(&self, bytes: Vec<u8>) {
         if let Some(session) = &self.session {
             session.notifier.notify(bytes);
@@ -1157,6 +1115,7 @@ impl TerminalView {
 
     /// 输入后回到底部并请求重绘。
     fn write_input(&mut self, bytes: Vec<u8>, cx: &mut Context<Self>) {
+        self.path_drop.invalidate();
         self.image_paste.observe_input(&bytes);
         self.confirmation.observe_input(&bytes);
         self.awaiting_input = false;
@@ -2184,6 +2143,11 @@ impl Render for TerminalView {
             .on_mouse_up(MouseButton::Right, cx.listener(Self::on_right_up))
             .on_mouse_up(MouseButton::Middle, cx.listener(Self::on_middle_up))
             .on_scroll_wheel(cx.listener(Self::on_scroll))
+            .drag_over::<gpui::ExternalPaths>(move |style, _, _, _| style.bg(drop_highlight))
+            .on_drop(cx.listener(|this, paths: &gpui::ExternalPaths, window, cx| {
+                cx.stop_propagation();
+                this.drop_external_paths(paths.paths(), window, cx);
+            }))
             // 文件树拖进来 = 把路径粘进 shell（旧壳 `FileDrag` 同一合同：只
             // 粘贴，绝不代按 Enter）。`drag_over` 给一层落点高亮，否则用户拖
             // 到一半不知道松手会不会生效。
@@ -2195,17 +2159,8 @@ impl Render for TerminalView {
                  drag: &crate::gpui_shell::file_drop::FileTreeDrag,
                  window: &mut Window,
                  cx| {
-                    let Some(bytes) =
-                        crate::display::side_panel::drop_text_for_path(&drag.path_text)
-                    else {
-                        // 含控制字符的路径写进 PTY 等于替用户执行命令。
-                        return;
-                    };
-                    this.write_bytes(bytes);
-                    // 粘完把焦点交回终端：用户接着就要敲命令，还要先点一下
-                    // 才能输入的话，这个手势就白省了。
-                    window.focus(&this.focus_handle, cx);
-                    cx.notify();
+                    cx.stop_propagation();
+                    this.paste_dropped_paths(&[drag.path_text.clone()], window, cx);
                 },
             ))
             .on_hover(cx.listener(|this, hovered: &bool, _, cx| {
@@ -2311,18 +2266,6 @@ impl TerminalView {
         self.answer_reader = Some(reader);
         cx.notify();
     }
-
-    pub(super) fn uses_source_reader_math(&mut self) -> bool {
-        self.preserve_agent_math_source |= self
-            .running_program
-            .as_deref()
-            .is_some_and(|program| matches!(program, "claude" | "codex"))
-            || self
-                .ai_session
-                .as_ref()
-                .is_some_and(|session| matches!(session.source.as_str(), "claude" | "codex"));
-        self.preserve_agent_math_source
-    }
 }
 
 #[cfg(test)]
diff --git a/nebula_app/src/gpui_shell/terminal/view/path_drop.rs b/nebula_app/src/gpui_shell/terminal/view/path_drop.rs
new file mode 100644
index 0000000..bb60ca1
--- /dev/null
+++ b/nebula_app/src/gpui_shell/terminal/view/path_drop.rs
@@ -0,0 +1,204 @@
+//! External file paths enter the same bounded, paste-only path as clipboard text.
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Duration;
+
+use gpui::{Context, Window};
+
+use super::{TerminalView, ui_language};
+use crate::display::side_panel::{PathQuote, drop_text_for_paths};
+use crate::gpui_shell::toast::{self, ToastKind};
+use crate::i18n::Message;
+
+#[derive(Default)]
+pub(super) struct PathDropState {
+    generation: u64,
+    pending: bool,
+}
+
+impl PathDropState {
+    pub(super) fn invalidate(&mut self) {
+        self.generation = self.generation.wrapping_add(1);
+    }
+}
+
+impl TerminalView {
+    fn path_quote(&self) -> PathQuote {
+        if self.ssh_destination.is_some()
+            || self.exec_context.as_ref().and_then(|context| context.wsl_distribution()).is_some()
+        {
+            return PathQuote::Posix;
+        }
+        let program = self
+            .exec_context
+            .as_ref()
+            .and_then(|context| context.shell_program())
+            .unwrap_or("")
+            .rsplit(['/', '\\'])
+            .next()
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        if matches!(program.as_str(), "pwsh" | "pwsh.exe" | "powershell" | "powershell.exe") {
+            PathQuote::PowerShell
+        } else if cfg!(windows) && matches!(program.as_str(), "" | "cmd" | "cmd.exe") {
+            PathQuote::CommandPrompt
+        } else {
+            PathQuote::Posix
+        }
+    }
+
+    pub(super) fn paste_dropped_paths(
+        &mut self,
+        paths: &[String],
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if self.session.is_none() || self.exited.is_some() {
+            return;
+        }
+        if let Some(text) = drop_text_for_paths(paths, self.path_quote()) {
+            // A file path belongs to this pane, including bracketed-paste framing.
+            self.paste_now_impl(&text, false, cx);
+            window.focus(&self.focus_handle, cx);
+        } else {
+            toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                ui_language().text(Message::CommonDropPathsInvalid),
+            );
+        }
+    }
+
+    pub(super) fn drop_external_paths(
+        &mut self,
+        paths: &[PathBuf],
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if self.session.is_none() || self.exited.is_some() {
+            return;
+        }
+        if self.ssh_destination.is_some() {
+            toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                ui_language().text(Message::CommonDropPathsRemote),
+            );
+            return;
+        }
+        let paths: Option<Vec<String>> =
+            paths.iter().map(|path| path.to_str().map(str::to_owned)).collect();
+        let Some(paths) =
+            paths.filter(|paths| drop_text_for_paths(paths, PathQuote::Posix).is_some())
+        else {
+            toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                ui_language().text(Message::CommonDropPathsInvalid),
+            );
+            return;
+        };
+        let distro = self
+            .exec_context
+            .as_ref()
+            .and_then(|context| context.wsl_distribution())
+            .map(|distro| distro.map(str::to_owned));
+        let Some(distro) = distro else {
+            self.paste_dropped_paths(&paths, window, cx);
+            return;
+        };
+        if self.path_drop.pending {
+            toast::toast(
+                window,
+                cx,
+                ToastKind::Warning,
+                ui_language().text(Message::CommonDropPathsBusy),
+            );
+            return;
+        }
+        let user =
+            self.exec_context.as_ref().and_then(|context| context.wsl_user()).map(str::to_owned);
+        self.path_drop.pending = true;
+        let generation = self.path_drop.generation;
+        let term = Arc::downgrade(&self.session.as_ref().unwrap().term);
+        window.focus(&self.focus_handle, cx);
+        let job = cx.background_executor().spawn(async move { wsl_paths(paths, distro, user) });
+        cx.spawn_in(window, async move |this, cx| {
+            let result = job.await;
+            let _ = this.update_in(cx, |this, window, cx| {
+                this.path_drop.pending = false;
+                let same_session = this.session.as_ref().is_some_and(|session| {
+                    term.upgrade().is_some_and(|term| Arc::ptr_eq(&term, &session.term))
+                });
+                if !same_session
+                    || this.exited.is_some()
+                    || generation != this.path_drop.generation
+                    || !this.focus_handle.is_focused(window)
+                {
+                    toast::toast(
+                        window,
+                        cx,
+                        ToastKind::Warning,
+                        ui_language().text(Message::CommonDropPathsExpired),
+                    );
+                    return;
+                }
+                match result {
+                    Ok(paths) => this.paste_dropped_paths(&paths, window, cx),
+                    Err(error) => {
+                        log::warn!("external path translation failed: {error}");
+                        toast::toast(
+                            window,
+                            cx,
+                            ToastKind::Warning,
+                            ui_language().text(Message::CommonDropPathsFailed),
+                        );
+                    },
+                }
+            });
+        })
+        .detach();
+    }
+}
+
+fn wsl_paths(
+    paths: Vec<String>,
+    distro: Option<String>,
+    user: Option<String>,
+) -> Result<Vec<String>, String> {
+    let mut command = std::process::Command::new("wsl.exe");
+    if let Some(distro) = distro {
+        command.args(["-d", &distro]);
+    }
+    if let Some(user) = user {
+        command.args(["-u", &user]);
+    }
+    command.args([
+        "--exec",
+        "sh",
+        "-c",
+        "for p; do wslpath -a -u \"$p\" || exit; done",
+        "pebrel-paths",
+    ]);
+    command.args(&paths);
+    let output = crate::display::side_panel::command_output_with_timeout(
+        command,
+        Some(Duration::from_secs(10)),
+    )
+    .map_err(|error| error.to_string())?;
+    if !output.status.success() {
+        return Err("wslpath failed".to_owned());
+    }
+    let output = String::from_utf8(output.stdout).map_err(|error| error.to_string())?;
+    let translated: Vec<String> = output.lines().map(str::to_owned).collect();
+    if translated.len() != paths.len()
+        || translated.iter().any(|path| !path.starts_with('/'))
+        || drop_text_for_paths(&translated, PathQuote::Posix).is_none()
+    {
+        return Err("invalid translated paths".to_owned());
+    }
+    Ok(translated)
+}
diff --git a/nebula_app/src/gpui_shell/terminal/view/pointer.rs b/nebula_app/src/gpui_shell/terminal/view/pointer.rs
index e21300e..8d165ef 100644
--- a/nebula_app/src/gpui_shell/terminal/view/pointer.rs
+++ b/nebula_app/src/gpui_shell/terminal/view/pointer.rs
@@ -305,13 +305,30 @@ impl TerminalView {
     /// 接受当前候选时只写入补全余量。即使余量为空也算已处理，Enter 不能
     /// 继续透传成一次命令执行。
     pub(super) fn accept_completion_popup(&mut self, cx: &mut Context<Self>) -> bool {
-        let Some(insert) = suggest::popup_take(&mut self.suggest) else { return false };
+        let Some(item) = suggest::popup_take(&mut self.suggest) else { return false };
+        let insert = item.insert;
         self.completion_viewport.clear();
-        let before = if self.suggest.screen_line.is_empty() {
+        let mut before = if self.suggest.screen_line.is_empty() {
             self.suggest.line_buf.clone()
         } else {
             self.suggest.screen_line.clone()
         };
+        if item.replace_chars > 0 {
+            let backspace = super::super::keymap::encode(
+                &gpui::Keystroke::parse("backspace").unwrap(),
+                &self
+                    .session
+                    .as_ref()
+                    .map(|session| *session.term.lock().mode())
+                    .unwrap_or_default(),
+            )
+            .unwrap_or_else(|| vec![0x7f]);
+            self.write_bytes(backspace.repeat(item.replace_chars));
+            for _ in 0..item.replace_chars {
+                before.pop();
+                crate::display::nebula_input_backspace(&mut self.suggest);
+            }
+        }
         for c in insert.chars() {
             crate::display::nebula_input_char(&mut self.suggest, c);
         }
diff --git a/nebula_app/src/gpui_shell/terminal/view/runtime.rs b/nebula_app/src/gpui_shell/terminal/view/runtime.rs
index 74277da..144b95b 100644
--- a/nebula_app/src/gpui_shell/terminal/view/runtime.rs
+++ b/nebula_app/src/gpui_shell/terminal/view/runtime.rs
@@ -27,7 +27,37 @@ fn progress_sidebar_activity(
 }
 
 impl TerminalView {
-    pub(super) fn apply_ssh_stage(
+    pub(crate) fn is_remote_session(&self) -> bool {
+        !self.suggest.suggest_env.is_this_machine()
+    }
+
+    /// Remote foreground identity comes from the terminal protocol/screen.
+    /// A host process snapshot cannot disprove work inside WSL or built-in SSH.
+    pub fn busy_process(&self) -> Option<String> {
+        let session = self.session.as_ref()?;
+        if self.exited.is_some()
+            || matches!(self.ssh_stage, Some(crate::ssh_session::SshStage::Failed(_)))
+        {
+            return None;
+        }
+        let remote = !self.suggest.suggest_env.is_this_machine();
+        let child = (session.shell_pid != 0)
+            .then(|| crate::process_tree::busy_child(session.shell_pid))
+            .flatten();
+        crate::process_tree::close_warning_process(
+            remote,
+            self.running_program.as_deref(),
+            child.as_deref(),
+        )
+    }
+
+    pub(super) fn invalidate_ai_session_probe(&mut self) {
+        self.ai_session_probe_epoch = self.ai_session_probe_epoch.wrapping_add(1);
+        self.ai_session_probe_pending = false;
+        self.last_ai_session_probe = None;
+    }
+
+    pub(in crate::gpui_shell::terminal) fn apply_ssh_stage(
         &mut self,
         stage: crate::ssh_session::SshStage,
         cx: &mut Context<Self>,
@@ -59,6 +89,7 @@ impl TerminalView {
         self.answers.close();
         let title_changed =
             self.running_program.take().is_some() || self.ai_session.take().is_some();
+        self.invalidate_ai_session_probe();
         self.primary_agent_pid = None;
         self.agent_status = crate::ai_agents::AgentStatus::Unknown;
         self.agent_status_source = crate::ai_agents::AgentStatusSource::Unknown;
@@ -626,6 +657,63 @@ impl TerminalView {
         cx.notify();
     }
 
+    /// Fill a missing Codex identity from the active rollout file. Hook events
+    /// remain authoritative; this only repairs panes whose Codex process was
+    /// already running before the hook was installed or before Nebula saw its
+    /// first event. The blocking probe is isolated on GPUI's background
+    /// executor and its result is accepted only for the same foreground epoch.
+    pub(super) fn probe_missing_codex_session(&mut self, cx: &mut Context<Self>) {
+        if self.exited.is_some()
+            || self.ai_session.is_some()
+            || self.ai_session_probe_pending
+            || !self
+                .running_program
+                .as_deref()
+                .and_then(crate::ai_agents::AgentKind::parse)
+                .is_some_and(|agent| agent == crate::ai_agents::AgentKind::Codex)
+        {
+            return;
+        }
+        if self
+            .last_ai_session_probe
+            .is_some_and(|at| at.elapsed() < std::time::Duration::from_secs(2))
+        {
+            return;
+        }
+        let Some(exec_context) = self.exec_context.clone() else { return };
+        let epoch = self.ai_session_probe_epoch;
+        let pane_id = self.pane_id;
+        self.ai_session_probe_pending = true;
+        self.last_ai_session_probe = Some(std::time::Instant::now());
+        let work = cx.background_executor().spawn(async move {
+            crate::platform::ai_session_identity::probe_codex_session(pane_id, Some(&exec_context))
+        });
+        cx.spawn(async move |this, cx| {
+            let session_id = work.await;
+            let _ = this.update(cx, |view, cx| {
+                if !probe_result_is_current(
+                    view.ai_session_probe_epoch,
+                    epoch,
+                    view.ai_session.is_some(),
+                    view.running_program.as_deref(),
+                ) {
+                    return;
+                }
+                view.ai_session_probe_pending = false;
+                if let Some(session_id) = session_id {
+                    log::debug!("agent session identity from active rollout: pane={pane_id}");
+                    view.ai_session = Some(crate::display::AiSessionIdentity {
+                        source: "codex".to_owned(),
+                        session_id,
+                    });
+                    cx.emit(TerminalViewEvent::TitleChanged);
+                    cx.notify();
+                }
+            });
+        })
+        .detach();
+    }
+
     /// Queue a full shell command. Like cold resume, input may arrive before
     /// the first prompt; ConPTY preserves ordering until the shell reads it.
     pub fn run_command(&mut self, command: String, cx: &mut Context<Self>) {
@@ -861,6 +949,7 @@ impl TerminalView {
         // 进程树对账必须排在下面那道早退之前：身份认不出来就早退，等于让
         // 这个 pane 永远退出屏幕检测。
         self.reconcile_shell_activity(cx);
+        self.probe_missing_codex_session(cx);
         let Some(session) = &self.session else { return };
         let (prompt_restored, screen) = {
             let term = session.term.lock();
@@ -1037,6 +1126,9 @@ impl TerminalView {
     /// 那是脆弱推断：会话恢复、shell 别名、`npx codex` 这类间接启动都会让它
     /// 落空。进程树是客观事实，只是慢一拍——而慢一拍在 1 Hz 看门狗里无所谓。
     fn reconcile_shell_activity(&mut self, cx: &mut Context<Self>) {
+        if !self.suggest.suggest_env.is_this_machine() {
+            return;
+        }
         if !self.command_running {
             self.command_running_disproved = false;
             return;
@@ -1129,6 +1221,19 @@ impl TerminalView {
     }
 }
 
+fn probe_result_is_current(
+    current_epoch: u64,
+    result_epoch: u64,
+    has_session: bool,
+    running_program: Option<&str>,
+) -> bool {
+    current_epoch == result_epoch
+        && !has_session
+        && running_program
+            .and_then(crate::ai_agents::AgentKind::parse)
+            .is_some_and(|agent| agent == crate::ai_agents::AgentKind::Codex)
+}
+
 /// 一次写入是谁发起的。安全判定不看写了什么，看谁让写的。
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum InputOrigin {
@@ -1166,8 +1271,8 @@ fn runtime_chat_agent_kind(
 #[cfg(test)]
 mod tests {
     use super::{
-        InputOrigin, SidebarActivity, local_context_refusal, progress_sidebar_activity,
-        runtime_chat_agent_kind,
+        InputOrigin, SidebarActivity, local_context_refusal, probe_result_is_current,
+        progress_sidebar_activity, runtime_chat_agent_kind,
     };
 
     #[test]
@@ -1215,6 +1320,14 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_probe_from_an_older_command_cannot_claim_a_new_codex_process() {
+        assert!(!probe_result_is_current(8, 7, false, Some("codex")));
+        assert!(!probe_result_is_current(8, 8, true, Some("codex")));
+        assert!(!probe_result_is_current(8, 8, false, Some("claude")));
+        assert!(probe_result_is_current(8, 8, false, Some("codex")));
+    }
+
     /// 强制层的判据：本地内容不得由程序自动送进远端 pane，用户当场选中则放行。
     #[test]
     fn program_writes_never_carry_local_context_to_a_remote_pane() {
diff --git a/nebula_app/src/gpui_shell/theme.rs b/nebula_app/src/gpui_shell/theme.rs
index e364c68..3d6bc44 100644
--- a/nebula_app/src/gpui_shell/theme.rs
+++ b/nebula_app/src/gpui_shell/theme.rs
@@ -6,43 +6,31 @@ use crate::display::ui::theme::NebulaTheme;
 use crate::renderer::ui::Rgba;
 use nebula_settings::ThemeName;
 
-/// settings 的 [`ThemeName`] → 旧壳 chrome 主题。变体一一同名；chrome
-/// 色表的权威在 `display::ui::theme`，GPUI 壳与旧壳取同一份数据。
-fn chrome_theme(name: ThemeName) -> NebulaTheme {
-    match name {
-        ThemeName::Nebula => NebulaTheme::Nebula,
-        ThemeName::SilverLight => NebulaTheme::SilverLight,
-        ThemeName::SteelDark => NebulaTheme::SteelDark,
-        ThemeName::LimestoneLight => NebulaTheme::LimestoneLight,
-        ThemeName::CoalDark => NebulaTheme::CoalDark,
-        ThemeName::LinenLight => NebulaTheme::LinenLight,
-        ThemeName::MossDark => NebulaTheme::MossDark,
-        ThemeName::Nord => NebulaTheme::Nord,
-        ThemeName::Paper => NebulaTheme::Paper,
-        ThemeName::BreezeLight => NebulaTheme::BreezeLight,
-        ThemeName::BreezeDark => NebulaTheme::BreezeDark,
-        ThemeName::MintLight => NebulaTheme::MintLight,
-        ThemeName::MintDark => NebulaTheme::MintDark,
-    }
+mod syntax;
+
+struct DocumentColors {
+    background: Hsla,
+    foreground: Hsla,
+}
+impl gpui::Global for DocumentColors {}
+
+pub(crate) fn code_block_background(cx: &App) -> Hsla {
+    cx.try_global::<DocumentColors>().map_or(cx.theme().secondary, |colors| colors.background)
 }
 
-/// [`chrome_theme`] 的逆映射。两张表相邻放置：加主题时一起改。
+pub(crate) fn code_block_foreground(cx: &App) -> Hsla {
+    cx.try_global::<DocumentColors>().map_or(cx.theme().foreground, |colors| colors.foreground)
+}
+
+/// settings 的 [`ThemeName`] → 旧壳 chrome 主题。变体一一同名；chrome
+/// 色表的权威在 `display::ui::theme`，GPUI 壳与旧壳取同一份数据。
+pub(crate) fn chrome_theme(name: ThemeName) -> NebulaTheme {
+    NebulaTheme::from_prompt_name(name.available().prompt_name()).expect("shared theme identity")
+}
+
+/// Reverse the shared stable-name mapping and resolve retired preferences.
 fn settings_theme_name(theme: NebulaTheme) -> ThemeName {
-    match theme {
-        NebulaTheme::Nebula => ThemeName::Nebula,
-        NebulaTheme::SilverLight => ThemeName::SilverLight,
-        NebulaTheme::SteelDark => ThemeName::SteelDark,
-        NebulaTheme::LimestoneLight => ThemeName::LimestoneLight,
-        NebulaTheme::CoalDark => ThemeName::CoalDark,
-        NebulaTheme::LinenLight => ThemeName::LinenLight,
-        NebulaTheme::MossDark => ThemeName::MossDark,
-        NebulaTheme::Nord => ThemeName::Nord,
-        NebulaTheme::Paper => ThemeName::Paper,
-        NebulaTheme::BreezeLight => ThemeName::BreezeLight,
-        NebulaTheme::BreezeDark => ThemeName::BreezeDark,
-        NebulaTheme::MintLight => ThemeName::MintLight,
-        NebulaTheme::MintDark => ThemeName::MintDark,
-    }
+    ThemeName::from_prompt_name(theme.prompt_name()).expect("shared theme identity").available()
 }
 
 /// 当前生效的旧壳 chrome 主题（SSH 连接卡片等复用旧 Skin/palette 的
@@ -67,6 +55,7 @@ pub(crate) fn resolve_theme_name(
     follow_system: bool,
     system_is_light: bool,
 ) -> ThemeName {
+    let preference = preference.available();
     if !follow_system {
         return preference;
     }
@@ -83,11 +72,15 @@ pub fn effective_theme_name(cx: &App) -> ThemeName {
 
 /// 点选一张主题卡时要写盘的键：对齐旧壳 `select_nebula_theme`
 /// （关掉跟随系统）+ `apply_nebula_theme`（底色换成该主题 `term_bg`）。
-pub(crate) fn theme_card_persist_updates(name: ThemeName) -> [(&'static str, String); 3] {
+pub(crate) fn theme_card_persist_updates(name: ThemeName) -> [(&'static str, String); 7] {
     [
         ("theme", name.prompt_name().to_owned()),
         ("follow_system_theme", "0".to_owned()),
         ("background", nebula_settings::format_hex_rgb(name.term_theme().background)),
+        ("pane_card_radius", "0".to_owned()),
+        ("pane_card_gutter", "0".to_owned()),
+        ("pane_card_shadow", "0".to_owned()),
+        ("pane_card_divider", "1".to_owned()),
     ]
 }
 
@@ -223,15 +216,9 @@ pub struct PaneCardStyle {
 }
 
 impl Default for PaneCardStyle {
-    /// 全局设置还没装载时的回落：卡片形态 + 默认卡缝。
+    /// Before settings are installed, use the same flat shape as the presets.
     fn default() -> Self {
-        let gutter = nebula_settings::DEFAULT_PANE_CARD_GUTTER;
-        Self {
-            radius: nebula_settings::DEFAULT_PANE_CARD_RADIUS,
-            margin: gpui::Edges { top: 0.0, right: gutter, bottom: gutter, left: gutter },
-            shadow: false,
-            divider: 0.0,
-        }
+        Self { radius: 0.0, margin: gpui::Edges::default(), shadow: false, divider: 1.0 }
     }
 }
 
@@ -261,14 +248,22 @@ impl PaneCardStyle {
     }
 }
 
+/// A flush pane extends its background through the titlebar; explicit custom
+/// gutters/radii retain a surrounding shell instead.
+pub(crate) fn pane_is_flush(cx: &App) -> bool {
+    let card = PaneCardStyle::current(cx);
+    card.radius == 0.0
+        && card.margin.top == 0.0
+        && card.margin.right == 0.0
+        && card.margin.bottom == 0.0
+        && card.margin.left == 0.0
+}
+
 /// 侧栏与终端之间那条竖线的颜色。从壳色推导而不新增 palette 色位：9 个主题
 /// 一个都不用改，而且亮暗自动反向——浅色主题压暗、深色主题提亮，两边都能
 /// 读作一条分界而不是一道亮缝。
 pub fn card_divider_color(cx: &App) -> Hsla {
-    let mut color = cx.theme().background;
-    let is_light = chrome_theme_resolved(cx).palette().is_light;
-    color.l = if is_light { (color.l - 0.10).max(0.0) } else { (color.l + 0.10).min(1.0) };
-    color
+    wash(chrome_theme_resolved(cx).skin().hairline)
 }
 
 /// 终端卡圆角。默认值的权威在 `nebula_settings::DEFAULT_PANE_CARD_RADIUS`，
@@ -495,6 +490,10 @@ pub fn apply_chrome_theme(cx: &mut App) {
     let mode = if chrome.skin().is_light { ThemeMode::Light } else { ThemeMode::Dark };
     Theme::change(mode, None, cx);
     apply_skin_tokens(chrome, cx);
+    let colors = settings_theme_name(chrome).reviewed_palette();
+    let [r, g, b] = colors.code_background();
+    let [fr, fg, fb] = colors.foreground;
+    cx.set_global(DocumentColors { background: to_hsla(r, g, b), foreground: to_hsla(fr, fg, fb) });
     apply_shell_opacity(chrome, cx);
 }
 
@@ -579,17 +578,9 @@ fn apply_skin_tokens(chrome: NebulaTheme, cx: &mut App) {
     theme.overlay = wash(sk.veil);
 
     // 悬停 / 选中水洗。
-    let hover = if sk.is_light {
-        wash(Rgba::new(sk.accent.r, sk.accent.g, sk.accent.b, 10))
-    } else {
-        wash(sk.hover)
-    };
-    let selected = if sk.is_light {
-        wash(Rgba::new(sk.accent.r, sk.accent.g, sk.accent.b, 18))
-    } else {
-        wash(sk.accent_soft)
-    };
-    let list_selected = if sk.is_light { selected } else { wash(sk.hover_strong) };
+    let hover = wash(sk.hover);
+    let selected = wash(sk.accent_soft);
+    let list_selected = selected;
     theme.accent = hover;
     theme.accent_foreground = ink(sk.ink_strong);
     theme.list_hover = hover;
@@ -607,11 +598,18 @@ fn apply_skin_tokens(chrome: NebulaTheme, cx: &mut App) {
     // 按钮是成片的色块，link / caret / 焦点环是发丝级的细节。饱和度决定「刺
     // 不刺眼」，亮度差决定「看不看得见」——所以色块压饱和（暗底上 #52a8ff
     // 这种亮蓝铺开会发光，一整页只剩几个块在跳），细元素保持原值换辨识度。
-    let soft_accent = soften(sk.accent, 0.62);
+    let soft_accent = sk.accent;
     theme.primary = ink(soft_accent);
     theme.primary_hover = shift3(soft_accent.r, soft_accent.g, soft_accent.b, 0.10);
     theme.primary_active = shift3(soft_accent.r, soft_accent.g, soft_accent.b, 0.18);
     theme.primary_foreground = ink(sk.ink_on_accent);
+    theme.primary_foreground = ink(crate::display::terminal_color::ensure_contrast(
+        sk.ink_on_accent,
+        sk.accent,
+        sk.ink,
+        sk.ink_strong,
+        4.5,
+    ));
     theme.secondary = wash(sk.surface);
     theme.secondary_hover = hover;
     theme.secondary_active = list_selected;
@@ -705,6 +703,7 @@ fn apply_skin_tokens(chrome: NebulaTheme, cx: &mut App) {
     // 1.16 的 Button、Slider、Switch 等背景统一读取 ThemeTokens。Nebula 的
     // Skin 是纯色权威来源，因此在所有 ThemeColor 覆写完成后一次性解析，避免
     // 新组件悄悄回落到 gpui-component 的默认主题色。
+    syntax::apply(theme, settings_theme_name(chrome).reviewed_palette());
     theme.tokens = (&theme.colors).into();
 }
 
@@ -715,8 +714,8 @@ mod tests {
 
     #[test]
     fn follow_system_remaps_theme_family_and_manual_mode_keeps_preference() {
-        assert_eq!(resolve_theme_name(ThemeName::SilverLight, true, false), ThemeName::SteelDark);
-        assert_eq!(resolve_theme_name(ThemeName::Nebula, true, true), ThemeName::SilverLight);
+        assert_eq!(resolve_theme_name(ThemeName::SilverLight, true, false), ThemeName::Nord);
+        assert_eq!(resolve_theme_name(ThemeName::Nebula, true, true), ThemeName::CatppuccinLatte);
         assert_eq!(
             resolve_theme_name(ThemeName::SilverLight, false, false),
             ThemeName::SilverLight
diff --git a/nebula_app/src/gpui_shell/theme/syntax.rs b/nebula_app/src/gpui_shell/theme/syntax.rs
new file mode 100644
index 0000000..8fe2971
--- /dev/null
+++ b/nebula_app/src/gpui_shell/theme/syntax.rs
@@ -0,0 +1,56 @@
+//! Adapt reviewed theme colors to code highlighting once when the theme changes.
+use std::sync::Arc;
+
+use gpui_component::{Theme, highlighter::SyntaxColors};
+use nebula_settings::ReviewedPalette;
+
+use crate::display::color::Rgb;
+use crate::display::terminal_color::ensure_contrast;
+
+pub(super) fn apply(theme: &mut Theme, colors: ReviewedPalette) {
+    let background = colors.code_background();
+    let mut highlighted = (*theme.highlight_theme).clone();
+    let color = |[r, g, b]: [u8; 3]| super::to_hsla(r, g, b);
+    highlighted.style.editor_background = Some(color(background));
+    highlighted.style.editor_foreground = Some(color(colors.foreground));
+    highlighted.style.editor_line_number = Some(color(colors.muted));
+    let mut syntax =
+        serde_json::to_value(&highlighted.style.syntax).expect("syntax theme is serializable");
+    if let Some(entries) = syntax.as_object_mut() {
+        for (name, style) in entries {
+            let source = match name.as_str() {
+                "comment" | "comment_doc" | "comment.doc" | "hint" => colors.muted,
+                "keyword" | "boolean" | "enum" | "preproc" => colors.purple,
+                "function" | "constructor" | "link_text" | "link_uri" => colors.blue,
+                "number" | "constant" => colors.yellow,
+                "type" | "attribute" | "tag" => colors.cyan,
+                name if name.starts_with("string") => colors.green,
+                _ => colors.foreground,
+            };
+            let rgb = |[r, g, b]: [u8; 3]| Rgb::new(r, g, b);
+            let resolved = ensure_contrast(
+                rgb(source),
+                rgb(background),
+                rgb(colors.foreground),
+                rgb(colors.background),
+                4.5,
+            );
+            if style.is_null() {
+                *style = serde_json::json!({});
+            }
+            if let Some(style) = style.as_object_mut() {
+                style.insert(
+                    "color".to_owned(),
+                    serde_json::json!(format!(
+                        "#{:02x}{:02x}{:02x}",
+                        resolved.r, resolved.g, resolved.b,
+                    )),
+                );
+            }
+        }
+    }
+    highlighted.style.syntax = serde_json::from_value::<SyntaxColors>(syntax)
+        .expect("reviewed syntax colors keep the schema");
+    highlighted.name = format!("Pebrel {}", theme.is_dark());
+    theme.highlight_theme = Arc::new(highlighted);
+}
diff --git a/nebula_app/src/gpui_shell/toast.rs b/nebula_app/src/gpui_shell/toast.rs
index 487f384..ffc3a0d 100644
--- a/nebula_app/src/gpui_shell/toast.rs
+++ b/nebula_app/src/gpui_shell/toast.rs
@@ -15,6 +15,7 @@
 //! 上限（5s 自动退场，溢出概率低）；重复冷却在本层补齐（600ms，同文本）。
 
 use std::sync::Mutex;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{Duration, Instant};
 
 use gpui::{AnyElement, App, IntoElement as _, ParentElement as _, Styled as _, Window, div, px};
@@ -47,6 +48,28 @@ const BANNER_TTL: Duration = Duration::from_secs(90);
 
 static LAST_TOAST: Mutex<Option<(String, Instant)>> = Mutex::new(None);
 static PANE_BANNERS: Mutex<PaneBannerGate> = Mutex::new(PaneBannerGate { recent: Vec::new() });
+static NEXT_AI_TOAST: AtomicU64 = AtomicU64::new(1);
+
+/// A component notification identity, not a separate queue or lifetime manager.
+struct AiToast;
+
+/// Apply preference changes to existing in-app notices in every open window.
+/// Native system notifications have a separate delivery path and remain intact.
+pub(crate) fn init(cx: &mut App) {
+    cx.observe_global::<super::config::Settings>(|cx| {
+        if super::config::ai_toasts_enabled(cx) {
+            return;
+        }
+        for handle in cx.windows() {
+            let _ = handle.update(cx, |_, window, cx| {
+                if window.root::<Root>().flatten().is_some() {
+                    window.remove_notification::<AiToast>(cx);
+                }
+            });
+        }
+    })
+    .detach();
+}
 
 #[derive(Default)]
 struct PaneBannerGate {
@@ -157,7 +180,7 @@ pub fn banner(window: &mut Window, cx: &mut App, kind: ToastKind, text: impl Int
         return;
     }
     log::warn!("banner [{kind:?}]: {text}");
-    push_banner(window, cx, note(kind, text));
+    push_banner(window, cx, note(kind, text), false);
 }
 
 pub(crate) fn banner_for_pane(
@@ -166,6 +189,7 @@ pub(crate) fn banner_for_pane(
     kind: ToastKind,
     text: impl Into<String>,
     pane_id: u64,
+    ai_toast: bool,
 ) {
     let text = text.into();
     if text.trim().is_empty()
@@ -179,10 +203,14 @@ pub(crate) fn banner_for_pane(
         return;
     }
     log::info!("pane banner [{kind:?}] pane={pane_id}: {text}");
-    let notification = note(kind, text).on_click(move |_, _, cx| {
+    let mut notification = note(kind, text).on_click(move |_, _, cx| {
         cx.defer(move |cx| super::workspace::windowing::focus_notification(Some(pane_id), cx));
     });
-    push_banner(window, cx, notification);
+    if ai_toast {
+        notification = notification
+            .id1::<AiToast>(("ai-banner", NEXT_AI_TOAST.fetch_add(1, Ordering::Relaxed)));
+    }
+    push_banner(window, cx, notification, ai_toast);
 }
 
 pub(crate) fn confirmation_for_pane(
@@ -192,16 +220,12 @@ pub(crate) fn confirmation_for_pane(
     pane_id: u64,
     confirmation: crate::gpui_shell::terminal::confirmation::BinaryConfirmation,
 ) {
-    struct ConfirmationNotice;
-
-    let language =
-        crate::display::LanguagePreference::from(nebula_settings::RuntimeSettings::load().language)
-            .resolved();
+    let language = super::config::ui_language(cx);
     let allow_label = language.text(crate::i18n::Message::CommonYes).to_owned();
     let deny_label = language.text(crate::i18n::Message::CommonNo).to_owned();
     let request_id = confirmation.id;
     let notification = note(ToastKind::Warning, text)
-        .id1::<ConfirmationNotice>(format!("pane-{pane_id}-request-{request_id}"))
+        .id1::<AiToast>(format!("pane-{pane_id}-request-{request_id}"))
         .on_click(move |_, _, cx| {
             cx.defer(move |cx| super::workspace::windowing::focus_notification(Some(pane_id), cx));
         })
@@ -250,7 +274,7 @@ pub(crate) fn confirmation_for_pane(
                 )
                 .into_any_element()
         });
-    push_banner(window, cx, notification);
+    push_banner(window, cx, notification, true);
 }
 
 fn reply_to_confirmation(
@@ -280,13 +304,20 @@ fn reply_to_confirmation(
     }
 }
 
-fn push_banner(window: &mut Window, cx: &mut App, notification: Notification) {
+fn push_banner(window: &mut Window, cx: &mut App, notification: Notification, ai_toast: bool) {
+    if ai_toast && !super::config::ai_toasts_enabled(cx) {
+        return;
+    }
     let note = notification.autohide(false);
     if window.root::<Root>().flatten().is_some() {
         window.push_notification(note, cx);
         schedule_banner_dismiss(window, cx);
     } else {
         window.defer(cx, move |window, cx| {
+            // The preference may change before the startup Root is installed.
+            if ai_toast && !super::config::ai_toasts_enabled(cx) {
+                return;
+            }
             if window.root::<Root>().flatten().is_some() {
                 window.push_notification(note, cx);
                 schedule_banner_dismiss(window, cx);
@@ -345,4 +376,111 @@ mod tests {
         assert!(gate.accepts(1, ToastKind::Info, "done", now + DUPLICATE_COOLDOWN));
         assert_eq!(gate.recent.len(), 1);
     }
+
+    #[cfg(feature = "gpui-test-support")]
+    mod interaction {
+        use super::*;
+        use gpui::{
+            AppContext as _, BorrowAppContext as _, Context, EntityId, Render, TestAppContext,
+            VisualTestContext,
+        };
+
+        use crate::gpui_shell::config::Settings;
+        use crate::gpui_shell::terminal::confirmation::BinaryConfirmation;
+
+        struct Empty;
+
+        impl Render for Empty {
+            fn render(&mut self, _: &mut Window, _: &mut Context<Self>) -> impl gpui::IntoElement {
+                div()
+            }
+        }
+
+        fn initialize(cx: &mut TestAppContext, enabled: bool) {
+            cx.update(|cx| {
+                gpui_component::init(cx);
+                let mut settings = Settings::load(nebula_settings::ThemeName::Nord);
+                settings.ai_toasts = enabled;
+                cx.set_global(settings);
+                init(cx);
+            });
+        }
+
+        fn ids(cx: &mut VisualTestContext) -> Vec<EntityId> {
+            cx.update(|window, cx| {
+                window.notifications(cx).iter().map(|note| note.entity_id()).collect()
+            })
+        }
+
+        fn settle_dismissal(cx: &mut VisualTestContext) {
+            cx.run_until_parked();
+            cx.background_executor.advance_clock(Duration::from_millis(200));
+            cx.run_until_parked();
+        }
+
+        #[gpui::test]
+        fn disabling_ai_toasts_removes_only_ai_cards_and_can_be_reenabled(cx: &mut TestAppContext) {
+            initialize(cx, true);
+            let (_, cx) = cx.add_window_view(|window, cx| Root::new(cx.new(|_| Empty), window, cx));
+            cx.update(|window, cx| {
+                banner_for_pane(window, cx, ToastKind::Info, "AI completed", 7101, true);
+                confirmation_for_pane(
+                    window,
+                    cx,
+                    "AI confirmation".into(),
+                    7101,
+                    BinaryConfirmation { id: 7201, question: "Continue?".into() },
+                );
+                banner(window, cx, ToastKind::Warning, "Configuration needs attention");
+            });
+            cx.run_until_parked();
+            let original = ids(cx);
+            assert_eq!(original.len(), 3);
+            cx.update(|_, cx| {
+                cx.update_global::<Settings, _>(|settings, _| settings.ai_toasts = false);
+            });
+            settle_dismissal(cx);
+            assert_eq!(ids(cx), vec![original[2]]);
+            cx.update(|_, cx| {
+                cx.update_global::<Settings, _>(|settings, _| settings.ai_toasts = true);
+            });
+            cx.run_until_parked();
+            assert_eq!(ids(cx), vec![original[2]], "reenabling must not replay old notices");
+            cx.update(|window, cx| {
+                banner_for_pane(window, cx, ToastKind::Info, "Next AI turn", 7101, true);
+            });
+            assert_eq!(ids(cx).len(), 2);
+        }
+
+        #[gpui::test]
+        fn disabled_ai_cards_cannot_reenter_the_component_queue(cx: &mut TestAppContext) {
+            initialize(cx, false);
+            let (_, cx) = cx.add_window_view(|window, cx| Root::new(cx.new(|_| Empty), window, cx));
+            cx.update(|window, cx| {
+                banner_for_pane(window, cx, ToastKind::Info, "Hidden AI turn", 7102, true);
+                confirmation_for_pane(
+                    window,
+                    cx,
+                    "Hidden AI confirmation".into(),
+                    7102,
+                    BinaryConfirmation { id: 7202, question: "Continue?".into() },
+                );
+                banner_for_pane(window, cx, ToastKind::Info, "Build finished", 7102, false);
+            });
+            cx.run_until_parked();
+            assert_eq!(ids(cx).len(), 1, "ordinary terminal notices remain available");
+        }
+
+        #[gpui::test]
+        fn deferred_startup_banner_rechecks_the_current_preference(cx: &mut TestAppContext) {
+            initialize(cx, true);
+            let (_, cx) = cx.add_window_view(|window, cx| {
+                banner_for_pane(window, cx, ToastKind::Info, "Queued AI turn", 7103, true);
+                cx.update_global::<Settings, _>(|settings, _| settings.ai_toasts = false);
+                Root::new(cx.new(|_| Empty), window, cx)
+            });
+            settle_dismissal(cx);
+            assert!(ids(cx).is_empty());
+        }
+    }
 }
diff --git a/nebula_app/src/gpui_shell/workspace.rs b/nebula_app/src/gpui_shell/workspace.rs
index 6ac31ad..ceb026d 100644
--- a/nebula_app/src/gpui_shell/workspace.rs
+++ b/nebula_app/src/gpui_shell/workspace.rs
@@ -47,6 +47,8 @@ use nebula_split::{DIVIDER_GAP, HIT_SLOP, RemoveOutcome, SplitDirection, SplitNa
 
 mod agents;
 mod command_manager;
+mod keyboard_bindings;
+use keyboard_bindings::custom_workspace_binding;
 mod documents;
 mod file_tree;
 mod key_actions;
@@ -197,48 +199,6 @@ const STATIC_DEFAULT_COMBOS: &[&str] = &[
 /// 存储格式 combo（`ctrl+shift+t`）→ gpui 绑定串（`ctrl-shift-t`）。键名
 /// 两套体系同构（小写命名键 + 单字符）；digitN 折回数字，plus/minus 折回
 /// `+`/`-`（`+` 是存储分隔符，必须先占位再替换）。
-fn custom_workspace_binding(combo: &str, action: &crate::config::Action) -> Option<KeyBinding> {
-    use crate::config::Action;
-    let combo = gpui_binding_combo(combo);
-    match action {
-        Action::ToggleCommandPalette => Some(KeyBinding::new(&combo, ToggleCommandPalette, None)),
-        Action::ToggleShellPicker => Some(KeyBinding::new(&combo, ToggleShellPicker, None)),
-        Action::CreateNewTab => Some(KeyBinding::new(&combo, NewTerminal, None)),
-        Action::CreateNewWindow => Some(KeyBinding::new(&combo, NewWindow, None)),
-        Action::CloseTab => Some(KeyBinding::new(&combo, CloseActiveTerminal, None)),
-        Action::ToggleFilesPanel => Some(KeyBinding::new(&combo, ToggleFileTree, None)),
-        Action::ToggleGitPanel => Some(KeyBinding::new(&combo, ToggleGitPanel, None)),
-        Action::SplitRight => Some(KeyBinding::new(&combo, SplitRight, None)),
-        Action::SplitDown => Some(KeyBinding::new(&combo, SplitDown, None)),
-        Action::ToggleZoom => Some(KeyBinding::new(&combo, ToggleZoom, None)),
-        Action::FocusPaneLeft => Some(KeyBinding::new(&combo, FocusPaneLeft, None)),
-        Action::FocusPaneRight => Some(KeyBinding::new(&combo, FocusPaneRight, None)),
-        Action::FocusPaneUp => Some(KeyBinding::new(&combo, FocusPaneUp, None)),
-        Action::FocusPaneDown => Some(KeyBinding::new(&combo, FocusPaneDown, None)),
-        Action::SelectNextTab => Some(KeyBinding::new(&combo, SelectNextTab, None)),
-        Action::SelectPreviousTab => Some(KeyBinding::new(&combo, SelectPreviousTab, None)),
-        Action::IncreaseFontSize => Some(KeyBinding::new(&combo, IncreaseFontSize, None)),
-        Action::DecreaseFontSize => Some(KeyBinding::new(&combo, DecreaseFontSize, None)),
-        Action::ResetFontSize => Some(KeyBinding::new(&combo, ResetFontSize, None)),
-        Action::Copy => Some(KeyBinding::new(
-            &combo,
-            CopySelection,
-            Some(crate::gpui_shell::terminal::KEY_CONTEXT),
-        )),
-        Action::Paste => Some(KeyBinding::new(
-            &combo,
-            PasteClipboard,
-            Some(crate::gpui_shell::terminal::KEY_CONTEXT),
-        )),
-        Action::ToggleFullscreen => Some(KeyBinding::new(&combo, ToggleFullscreen, None)),
-        Action::OpenQuickJump => Some(KeyBinding::new(&combo, OpenQuickJump, None)),
-        // `none` 禁用键：gpui 的 NoAction 绑定在最高优先级命中时吞掉按键，
-        // 与旧壳 keybind=combo:none 的语义一致。
-        Action::None => Some(KeyBinding::new(&combo, gpui::NoAction, None)),
-        _ => None,
-    }
-}
-
 fn gpui_binding_combo(combo: &str) -> String {
     combo
         .replace("plus", "\u{1}")
@@ -396,6 +356,13 @@ enum WorkspaceTab {
     },
 }
 
+/// Temporary reader focus state. It belongs to the active document session,
+/// not to runtime settings: entering focus hides surrounding chrome and exit
+/// restores exactly what was visible before the document took focus.
+struct ReaderFocusState {
+    file: Entity<crate::gpui_shell::doc_tabs::DocTabView>,
+}
+
 impl WorkspaceTab {
     fn is_settings(&self) -> bool {
         matches!(self, Self::Settings { .. })
@@ -1008,6 +975,9 @@ pub struct NebulaWorkspace {
     /// 进行中的侧栏拖宽（设置「面板拖拽调节」开启时才有入口）；宽度实时
     /// 生效，松手写盘 `sidebar_w`（旧壳同合同）。
     sidebar_resizing: bool,
+    /// Markdown reader focus is a temporary presentation mode. The entity key
+    /// makes it safe across tab reordering and prevents a stale global bool.
+    reader_focus: Option<ReaderFocusState>,
     /// Split 节点视口的帧记录（拖拽换算与提交吸附用）。
     split_bounds: SplitBoundsStore,
     /// pane 矩形的帧记录（ctrl+alt+方向 的最近邻导航用）。
@@ -1286,6 +1256,7 @@ impl NebulaWorkspace {
             cross_window_dock: None,
             split_drag: None,
             sidebar_resizing: false,
+            reader_focus: None,
             split_bounds: Rc::new(RefCell::new(HashMap::new())),
             pane_bounds: Rc::new(RefCell::new(HashMap::new())),
             command_palette_open: false,
@@ -1533,44 +1504,6 @@ impl NebulaWorkspace {
         }
     }
 
-    /// 把 `keybind=` 自定义表注入 gpui 键位表（两壳共读同一份文件）。gpui
-    /// 绑定按注册逆序匹配，后注即覆盖：自定义同 combo 压过静态默认、`none`
-    /// 行用 NoAction 吞键——与旧壳「后写行先匹配」的语义对齐。
-    ///
-    /// 键位表没有删除 API：撤销旧注入靠对失效 combo 后注 NoAction。排除
-    /// 两类——仍在生效集里的（后注 NoAction 会盖掉刚注入的新绑定）与静态
-    /// 默认键（误杀基础功能）。启动时与设置页每次 `Changed` 后各跑一次。
-    fn apply_custom_keybinds(&mut self, cx: &mut Context<Self>) {
-        let mut to_bind: Vec<KeyBinding> = Vec::new();
-        let mut applied: Vec<String> = Vec::new();
-        for (combo, action) in nebula_settings::keybind_pairs() {
-            // 解析失败的行（手编文件里残留）跳过：旧壳读表同样静默容错。
-            let Some(action) = crate::display::keymap::parse_action(&action) else { continue };
-            if crate::display::keymap::parse_combo(&combo).is_none() {
-                continue;
-            }
-            let Some(binding) = custom_workspace_binding(&combo, &action) else { continue };
-            let gpui_combo = gpui_binding_combo(&combo);
-            applied.push(gpui_combo.clone());
-            to_bind.push(binding);
-        }
-        let stale = self
-            .custom_keybinds_applied
-            .iter()
-            .filter(|combo| {
-                !applied.contains(combo) && !STATIC_DEFAULT_COMBOS.contains(&combo.as_str())
-            })
-            .cloned()
-            .collect::<Vec<_>>();
-        for combo in stale {
-            to_bind.push(KeyBinding::new(&combo, gpui::NoAction, None));
-        }
-        self.custom_keybinds_applied = applied;
-        if !to_bind.is_empty() {
-            cx.bind_keys(to_bind);
-        }
-    }
-
     /// 设置或系统外观变化后的统一热应用：重载全局 `Settings`（主题经
     /// follow_system 折算）、逐终端刷新、重建 chrome 令牌。
     fn apply_runtime_settings(&mut self, cx: &mut Context<Self>) {
@@ -2582,6 +2515,10 @@ impl NebulaWorkspace {
     }
 
     fn finish_close_tab(&mut self, ix: usize, window: &mut Window, cx: &mut Context<Self>) {
+        // Focus mode is scoped to the current document view. Closing any tab
+        // must first restore workspace chrome so an old entity cannot leave the
+        // next active tab in an immersive layout.
+        self.clear_reader_focus(cx);
         let Some((tab, _meta)) = self.remove_tab_at(ix) else { return };
         if let WorkspaceTab::Terminal { panes, .. } = &tab {
             let mut bounds = self.pane_bounds.borrow_mut();
@@ -2618,6 +2555,7 @@ impl NebulaWorkspace {
             self.close_settings(window, cx);
         }
         if ix < self.tabs.len() && ix != self.active {
+            self.clear_reader_focus(cx);
             self.active = ix;
             if let Some(meta) = self.tab_meta.get_mut(ix) {
                 meta.has_bell = false;
@@ -3434,7 +3372,7 @@ impl NebulaWorkspace {
                     .relative()
                     .h_full()
                     .flex_shrink_0()
-                    .pb_2()
+                    .pb(px(crate::gpui_shell::theme::PaneCardStyle::current(cx).margin.bottom))
                     .child(panel)
                     .with_animation(
                         ("side-panel-push", open as usize),
@@ -4061,6 +3999,7 @@ impl Render for NebulaWorkspace {
         // 终端卡几何取一次，布局与壳色带共用同一个实例——两处各取一次也算
         // 「各写一份」，主题在这一帧中途换掉就会出现半旧半新的卡缝。
         let card_style = crate::gpui_shell::theme::PaneCardStyle::current(cx);
+        let draw_file_divider = self.side_panel.open;
         let sidebar_logo_target_px =
             (TAB_LABEL_ICON_SIZE * window.scale_factor()).round().max(1.0) as u32;
         if sidebar_logo_target_px != self.sidebar_logo_target_px {
@@ -4069,6 +4008,9 @@ impl Render for NebulaWorkspace {
             self.sidebar_logo_images = sidebar_logo_images(sidebar_logo_target_px);
             self.sidebar_logo_target_px = sidebar_logo_target_px;
         }
+        // Some tab-open/restore paths assign `active` directly. Clear a focus
+        // record tied to a different entity before deriving layout booleans.
+        self.clear_stale_reader_focus(cx);
         let content: Option<gpui::AnyElement> = if self.settings_open {
             self.settings_surface
                 .as_ref()
@@ -4099,6 +4041,7 @@ impl Render for NebulaWorkspace {
             && self.side_panel.view == crate::display::side_panel::PanelView::Git;
         let settings_active = self.settings_open;
         let top_tabs = self.tabs_position == nebula_settings::TabsPositionName::Top;
+        let reader_focus = self.reader_focus_active(cx);
         // dock 预览：被拖 tab 悬于终端区时高亮目标半区（松手即挂到那侧）。
         let dock_preview = self
             .tab_drag
@@ -4330,7 +4273,7 @@ impl Render for NebulaWorkspace {
                     .flex_row()
                     .flex_1()
                     .min_h_0()
-                    .when(!top_tabs && !settings_active, |row| {
+                    .when(!top_tabs && !settings_active && !reader_focus, |row| {
                         row.child(self.render_sidebar_slot(window, cx)).when(
                             // 侧栏拖宽热区（旧壳 `panel_resize` 设置门控）：贴在
                             // 侧栏右缘、零布局宽，不挤压终端卡。
@@ -4432,30 +4375,22 @@ impl Render for NebulaWorkspace {
                                 .children(content),
                         )
                             .child(
-                                // 竖线必须在卡内容之后覆盖绘制：内容底色带透明度，
-                                // 若只盖住正文段，会让同一条线在标题栏下沿变色。
+                                // Both sidebar boundaries share the same snapped line and color.
                                 gpui::canvas(
                                     |_, _, _| (),
-                                    |bounds, _, window, cx| {
-                                        let card =
-                                            crate::gpui_shell::theme::PaneCardStyle::current(cx);
-                                        if let Some(divider_bounds) = pane_card_divider_bounds(
-                                            bounds,
-                                            card.divider,
-                                            window.scale_factor(),
-                                        ) {
-                                            window.paint_quad(fill(
-                                                divider_bounds,
-                                                crate::gpui_shell::theme::card_divider_color(cx),
-                                            ));
-                                        }
+                                    move |bounds, _, window, cx| {
+                                        window_titlebar::paint_pane_dividers(
+                                            bounds, draw_file_divider, window, cx,
+                                        );
                                     },
                                 )
                                 .absolute()
                                 .inset_0(),
                             ),
                     )
-                    .child(self.render_side_panel_slot(window, cx)),
+                    .when(!reader_focus, |row| {
+                        row.child(self.render_side_panel_slot(window, cx))
+                    }),
             )
             .when_some(dock_preview, |root, (x, y, w, h)| {
                 root.child(
diff --git a/nebula_app/src/gpui_shell/workspace/agents.rs b/nebula_app/src/gpui_shell/workspace/agents.rs
index 1eccd2e..ff82c2c 100644
--- a/nebula_app/src/gpui_shell/workspace/agents.rs
+++ b/nebula_app/src/gpui_shell/workspace/agents.rs
@@ -156,22 +156,34 @@ impl NebulaWorkspace {
     ) {
         let executor = cx.background_executor().clone();
         cx.spawn(async move |_this, cx| {
+            let mut backlog = false;
             loop {
-                executor.timer(Duration::from_millis(75)).await;
+                executor.timer(Duration::from_millis(if backlog { 1 } else { 75 })).await;
                 let mut events = Vec::new();
+                let mut disconnected = false;
                 while events.len() < 64 {
                     match receiver.try_recv() {
                         Ok(event) => events.push(event),
                         Err(std::sync::mpsc::TryRecvError::Empty) => break,
-                        Err(std::sync::mpsc::TryRecvError::Disconnected) => return,
+                        Err(std::sync::mpsc::TryRecvError::Disconnected) => {
+                            disconnected = true;
+                            break;
+                        },
                     }
                 }
+                backlog = events.len() == 64;
                 if events.is_empty() {
+                    if disconnected {
+                        return;
+                    }
                     continue;
                 }
                 cx.update(|cx| {
                     crate::gpui_shell::workspace::windowing::dispatch_ai_events(events, cx)
                 });
+                if disconnected {
+                    return;
+                }
             }
         })
         .detach();
@@ -184,43 +196,38 @@ impl NebulaWorkspace {
         let executor = cx.background_executor().clone();
         cx.spawn(async move |this, cx| {
             loop {
-                executor.timer(Duration::from_millis(1000)).await;
-                let retry_callbacks = this.update(cx, |workspace, cx| {
-                    let views: Vec<_> = workspace
-                        .tabs
-                        .iter()
-                        .filter_map(|tab| match tab {
-                            WorkspaceTab::Terminal { panes, .. } => Some(panes.iter()),
-                            _ => None,
-                        })
-                        .flatten()
-                        .map(|pane| pane.view.clone())
-                        .collect();
-                    for view in views {
-                        view.update(cx, |view, cx| {
-                            view.refresh_agent_screen_state(cx);
-                            // 徽章的时间轴也挂在这一拍上：认出「刚进入完成」的
-                            // 边沿、并让对勾在闪现窗口结束后沉降为圆点。
-                            view.sync_activity_badges(cx);
-                        });
-                    }
+                let Ok(views) = this.update(cx, |workspace, _| {
+                    workspace.tabs.iter().filter_map(|tab| match tab {
+                        WorkspaceTab::Terminal { panes, .. } => Some(panes),
+                        _ => None,
+                    }).flatten().map(|pane| pane.view.downgrade()).collect::<Vec<_>>()
+                }) else { return };
+                let batches = views.len().div_ceil(4).max(1);
+                let interval = Duration::from_millis((1000 / batches as u64).max(1));
+                if views.is_empty() { executor.timer(interval).await; }
+                for batch in views.chunks(4) {
+                    executor.timer(interval).await;
+                    cx.update(|cx| {
+                        for view in batch {
+                            let _ = view.update(cx, |view, cx| {
+                                view.refresh_agent_screen_state(cx);
+                                view.sync_activity_badges(cx);
+                            });
+                        }
+                    });
+                }
+                let Ok(retry_callbacks) = this.update(cx, |workspace, cx| {
                     workspace.publish_tray_agents(cx);
                     workspace.runtime_hub.has_pending_delegation_callbacks()
-                });
-                let Ok(retry_callbacks) = retry_callbacks else { return };
+                }) else { return };
                 if retry_callbacks {
                     cx.update(|cx| {
-                    // 回调可能早于发起方自己的 TurnDone 到达；每秒重投一次只会
-                    // 释放身份仍匹配且已回到 Idle/Finished 的发起方。
-                    crate::gpui_shell::workspace::windowing::publish_runtime_snapshot(cx);
-                    crate::gpui_shell::workspace::windowing::dispatch_ready_delegation_callbacks(
-                        cx,
-                    );
+                        crate::gpui_shell::workspace::windowing::publish_runtime_snapshot(cx);
+                        crate::gpui_shell::workspace::windowing::dispatch_ready_delegation_callbacks(cx);
                     });
                 }
             }
-        })
-        .detach();
+        }).detach();
     }
 
     pub(crate) fn handle_ai_hook(
diff --git a/nebula_app/src/gpui_shell/workspace/command_manager.rs b/nebula_app/src/gpui_shell/workspace/command_manager.rs
index 0c18439..f547763 100644
--- a/nebula_app/src/gpui_shell/workspace/command_manager.rs
+++ b/nebula_app/src/gpui_shell/workspace/command_manager.rs
@@ -27,6 +27,10 @@ fn custom_icon(path: &'static str) -> Icon {
     Icon::new(Icon::empty()).path(path)
 }
 
+fn command_run_icon(builtin: bool, append_enter: bool) -> IconName {
+    if builtin || append_enter { IconName::Play } else { IconName::SquareTerminal }
+}
+
 /// 多行文本直接逐行送进 PTY 时，前台程序可能把第二行当成自己的 stdin。
 /// 立即执行因此折成一条 shell 语句；仅插入模式保留用户原文供手动编辑。
 fn dispatch_text(command: &crate::saved_commands::SavedCommand) -> String {
@@ -43,66 +47,52 @@ fn dispatch_text(command: &crate::saved_commands::SavedCommand) -> String {
         .join("; ")
 }
 
-fn word_start(text: &str, needle: &str) -> bool {
-    text.split(|ch: char| !ch.is_alphanumeric()).any(|word| word.starts_with(needle))
-}
-
-fn field_score(text: &str, needle: &str, exact: i32, prefix: i32, word: i32, part: i32) -> i32 {
-    if text == needle {
-        exact
-    } else if text.starts_with(needle) {
-        prefix
-    } else if word_start(text, needle) {
-        word
-    } else if text.contains(needle) {
-        part
-    } else {
-        -1
-    }
-}
-
-/// 名称匹配始终排在命令正文匹配之前；同分保持用户保存顺序。
-fn search_score(command: &crate::saved_commands::SavedCommand, query: &str) -> Option<i32> {
-    let name = command.name.to_lowercase();
-    let body = command.command.to_lowercase();
-    let mut total = 0;
-    let mut matched = false;
-    for word in query.split_whitespace() {
-        let name_score = field_score(&name, word, 1_000, 850, 700, 550);
-        let body_score = field_score(&body, word, 400, 340, 280, 220);
-        let score = name_score.max(body_score);
-        if score < 0 {
-            return None;
-        }
-        matched = true;
-        total += score;
-    }
-    matched.then_some(total)
-}
-
 impl NebulaWorkspace {
+    fn available_saved_commands(&self, cx: &App) -> Vec<crate::saved_commands::SavedCommand> {
+        use crate::saved_commands::builtins::CommandPlatform;
+        let remote = self
+            .tabs
+            .get(self.active)
+            .and_then(WorkspaceTab::focused_view)
+            .is_some_and(|view| view.read(cx).is_remote_session());
+        let platform = if remote {
+            CommandPlatform::Posix
+        } else if cfg!(windows) {
+            CommandPlatform::Windows
+        } else if cfg!(target_os = "macos") {
+            CommandPlatform::Mac
+        } else {
+            CommandPlatform::Posix
+        };
+        let mut commands = self.saved_commands.commands().to_vec();
+        commands.extend(crate::saved_commands::builtins::commands(
+            crate::gpui_shell::config::ui_language(cx),
+            platform,
+        ));
+        commands
+    }
+
     fn filtered_saved_commands(&self, cx: &App) -> Vec<crate::saved_commands::SavedCommand> {
-        let query = self.command_manager_input.read(cx).value().trim().to_lowercase();
-        if query.is_empty() {
-            return self.saved_commands.commands().to_vec();
-        }
+        let value = self.command_manager_input.read(cx).value();
+        let query = value.trim();
         if query.len() > MAX_SEARCH_BYTES {
             return Vec::new();
         }
-
-        let mut matches = self
-            .saved_commands
-            .commands()
-            .iter()
-            .cloned()
+        let commands = self.available_saved_commands(cx);
+        if query.is_empty() {
+            return commands;
+        }
+        let mut query = nebula_completions::command_search::CommandQuery::new(query);
+        let mut matches = commands
+            .into_iter()
             .enumerate()
             .filter_map(|(index, command)| {
-                search_score(&command, &query).map(|score| (score, index, command))
+                query
+                    .score_fields(&[&command.name, &command.command])
+                    .map(|score| (score, index, command))
             })
             .collect::<Vec<_>>();
-        matches.sort_by(|(left_score, left_index, _), (right_score, right_index, _)| {
-            right_score.cmp(left_score).then_with(|| left_index.cmp(right_index))
-        });
+        matches.sort_by(|(a, ai, _), (b, bi, _)| b.cmp(a).then(ai.cmp(bi)));
         matches.into_iter().map(|(_, _, command)| command).collect()
     }
 
@@ -231,7 +221,7 @@ impl NebulaWorkspace {
         cx: &mut Context<'_, Self>,
     ) {
         let current = edit_id.as_deref().and_then(|id| {
-            self.saved_commands.commands().iter().find(|command| command.id == id).cloned()
+            self.available_saved_commands(cx).into_iter().find(|command| command.id == id)
         });
         if edit_id.is_some() && current.is_none() {
             crate::gpui_shell::toast::toast(
@@ -243,7 +233,8 @@ impl NebulaWorkspace {
             return;
         }
 
-        let language = workspace_ui_language();
+        let edit_id = edit_id.filter(|id| !id.starts_with("builtin:"));
+        let language = crate::gpui_shell::config::ui_language(cx);
         let initial_name = current.as_ref().map(|command| command.name.clone()).unwrap_or_default();
         let initial_command =
             current.as_ref().map(|command| command.command.clone()).unwrap_or_default();
@@ -413,7 +404,7 @@ impl NebulaWorkspace {
         else {
             return;
         };
-        let language = workspace_ui_language();
+        let language = crate::gpui_shell::config::ui_language(cx);
         let workspace = cx.entity().downgrade();
         let dialog_workspace = workspace.clone();
         let command_name = command.name.clone();
@@ -515,7 +506,7 @@ impl NebulaWorkspace {
         let border = theme.border;
         let accent = theme.primary;
         let mono_family = theme.mono_font_family.clone();
-        let language = workspace_ui_language();
+        let language = crate::gpui_shell::config::ui_language(cx);
         let viewport = window.viewport_size();
         let panel_width =
             PANEL_MAX_WIDTH.min((f32::from(viewport.width) - PANEL_MARGIN * 2.0).max(0.0));
@@ -526,7 +517,6 @@ impl NebulaWorkspace {
         if self.command_manager_selected >= commands.len() {
             self.command_manager_selected = commands.len().saturating_sub(1);
         }
-        let command_count = self.saved_commands.commands().len();
         let selected_index = self.command_manager_selected;
         // 固定区域只保留搜索和新增入口；命令增多时仅滚动中间列表，避免退化成大面板。
         let desired_height = if commands.is_empty() {
@@ -541,6 +531,7 @@ impl NebulaWorkspace {
         let mut rows = Vec::with_capacity(commands.len());
         for (index, command) in commands.into_iter().enumerate() {
             let selected = index == selected_index;
+            let builtin = command.id.starts_with("builtin:");
             let hover_group = SharedString::from(format!("saved-command-row-hover-{index}"));
             let preview = command
                 .command
@@ -549,7 +540,9 @@ impl NebulaWorkspace {
                 .filter(|line| !line.is_empty())
                 .collect::<Vec<_>>()
                 .join(" ");
-            let mode_label = if command.append_enter {
+            let mode_label = if builtin {
+                language.text(crate::i18n::Message::CommandsBuiltinLabel)
+            } else if command.append_enter {
                 language.pick("运行", "Run")
             } else {
                 language.pick("插入", "Insert")
@@ -559,8 +552,7 @@ impl NebulaWorkspace {
             } else {
                 language.pick("插入到当前终端", "Insert into current terminal")
             };
-            let run_icon =
-                if command.append_enter { IconName::Play } else { IconName::SquareTerminal };
+            let run_icon = command_run_icon(builtin, command.append_enter);
             let run_command = command.clone();
             let row_command = command.clone();
             let copy_command = command.clone();
@@ -670,7 +662,11 @@ impl NebulaWorkspace {
                                 .icon(custom_icon(crate::gpui_shell::assets::nav::PENCIL))
                                 .ghost()
                                 .xsmall()
-                                .tooltip(language.pick("编辑命令", "Edit command"))
+                                .tooltip(if builtin {
+                                    language.text(crate::i18n::Message::CommandsSaveCopy)
+                                } else {
+                                    language.pick("编辑命令", "Edit command")
+                                })
                                 .on_click(cx.listener(
                                     move |this, _, window, cx| {
                                         cx.stop_propagation();
@@ -682,25 +678,27 @@ impl NebulaWorkspace {
                                     },
                                 )),
                             )
-                            .child(
-                                Button::new(SharedString::from(format!(
-                                    "saved-command-delete-{index}"
-                                )))
-                                .icon(custom_icon(crate::gpui_shell::assets::nav::TRASH))
-                                .ghost()
-                                .xsmall()
-                                .tooltip(language.pick("删除命令", "Delete command"))
-                                .on_click(cx.listener(
-                                    move |this, _, window, cx| {
-                                        cx.stop_propagation();
-                                        this.open_delete_saved_command_dialog(
-                                            delete_id.clone(),
-                                            window,
-                                            cx,
-                                        );
-                                    },
-                                )),
-                            ),
+                            .when(!builtin, |actions| {
+                                actions.child(
+                                    Button::new(SharedString::from(format!(
+                                        "saved-command-delete-{index}"
+                                    )))
+                                    .icon(custom_icon(crate::gpui_shell::assets::nav::TRASH))
+                                    .ghost()
+                                    .xsmall()
+                                    .tooltip(language.pick("删除命令", "Delete command"))
+                                    .on_click(cx.listener(
+                                        move |this, _, window, cx| {
+                                            cx.stop_propagation();
+                                            this.open_delete_saved_command_dialog(
+                                                delete_id.clone(),
+                                                window,
+                                                cx,
+                                            );
+                                        },
+                                    )),
+                                )
+                            }),
                     )
                     .into_any_element(),
             );
@@ -726,7 +724,6 @@ impl NebulaWorkspace {
             );
 
         let list_content = if rows.is_empty() {
-            let has_saved_commands = command_count > 0;
             v_flex()
                 .size_full()
                 .items_center()
@@ -734,11 +731,12 @@ impl NebulaWorkspace {
                 .gap_2()
                 .text_color(muted)
                 .child(command_manager_icon().with_size(px(28.0)))
-                .child(div().text_sm().text_color(foreground).child(if has_saved_commands {
-                    language.pick("没有匹配的命令", "No matching commands")
-                } else {
-                    language.pick("还没有保存命令", "No saved commands yet")
-                }))
+                .child(
+                    div()
+                        .text_sm()
+                        .text_color(foreground)
+                        .child(language.pick("没有匹配的命令", "No matching commands")),
+                )
                 .into_any_element()
         } else {
             let scroll_handle = self.command_manager_scroll.clone();
@@ -837,3 +835,15 @@ impl NebulaWorkspace {
             .into_any_element()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn builtin_commands_keep_the_play_icon_without_changing_insert_behavior() {
+        assert!(matches!(command_run_icon(true, false), IconName::Play));
+        assert!(matches!(command_run_icon(false, true), IconName::Play));
+        assert!(matches!(command_run_icon(false, false), IconName::SquareTerminal));
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/documents.rs b/nebula_app/src/gpui_shell/workspace/documents.rs
index 1cfbb31..fc9cb26 100644
--- a/nebula_app/src/gpui_shell/workspace/documents.rs
+++ b/nebula_app/src/gpui_shell/workspace/documents.rs
@@ -5,7 +5,7 @@ use super::*;
 use crate::i18n::Message;
 
 impl WorkspaceTab {
-    fn file_editor(&self, cx: &App) -> Option<Entity<TextFileView>> {
+    pub(super) fn file_editor(&self, cx: &App) -> Option<Entity<TextFileView>> {
         match self {
             Self::Document { view, .. } => Some(view.clone()),
             Self::Code { view, .. } => view.read(cx).file_editor(),
@@ -76,7 +76,7 @@ impl NebulaWorkspace {
                     let prompt = window.prompt(
                         gpui::PromptLevel::Warning,
                         language.text(Message::EditorCloseTitle),
-                        Some(&file.read(cx).path.display().to_string()),
+                        Some(&file.read(cx).source_label()),
                         &[
                             language.text(Message::EditorSave),
                             language.text(Message::EditorDiscard),
@@ -208,6 +208,25 @@ impl NebulaWorkspace {
         cx.notify();
     }
 
+    pub(super) fn open_remote_document(
+        &mut self,
+        destination: String,
+        path: String,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let location = crate::ssh_sftp::document::RemoteLocation { destination, path };
+        if let Some(index) = self.tabs.iter().position(|tab| matches!(tab, WorkspaceTab::Document { view, .. } if view.read(cx).is_remote_location(&location))) {
+            self.activate_tab(index, window, cx);
+            return;
+        }
+        let view = cx.new(|cx| TextFileView::new_remote(location, window, cx));
+        let subscription = cx.subscribe_in(&view, window, Self::on_document_event);
+        self.insert_new_tab(WorkspaceTab::Document { view, _subscription: subscription });
+        self.focus_active(window, cx);
+        cx.notify();
+    }
+
     fn open_doc_tab(
         &mut self,
         path: std::path::PathBuf,
@@ -215,7 +234,7 @@ impl NebulaWorkspace {
         cx: &mut Context<Self>,
     ) {
         if let Some(ix) = self.tabs.iter().position(
-            |tab| matches!(tab, WorkspaceTab::Document { view, .. } if view.read(cx).path == path),
+            |tab| matches!(tab, WorkspaceTab::Document { view, .. } if view.read(cx).is_local_path(&path)),
         ) {
             if let Some(WorkspaceTab::Document { view, .. }) = self.tabs.get(ix) {
                 view.clone().update(cx, |view, cx| {
@@ -290,7 +309,7 @@ impl NebulaWorkspace {
 
     fn on_document_event(
         &mut self,
-        _: &Entity<crate::gpui_shell::doc_tabs::DocTabView>,
+        file: &Entity<crate::gpui_shell::doc_tabs::DocTabView>,
         event: &DocTabViewEvent,
         window: &mut Window,
         cx: &mut Context<Self>,
@@ -300,9 +319,100 @@ impl NebulaWorkspace {
             DocTabViewEvent::SelectionContextMenuRequested { position, text } => {
                 self.open_document_selection_context_menu(*position, text.clone(), window, cx);
             },
+            DocTabViewEvent::ReaderFocusChanged { focused: true } => {
+                self.enter_reader_focus(file.clone(), cx);
+            },
+            DocTabViewEvent::ReaderFocusChanged { focused: false } => {
+                self.exit_reader_focus_for(file, cx);
+            },
         }
     }
 
+    /// Whether the active tab is currently using the temporary reader focus
+    /// presentation. The entity check prevents a stale tab index from hiding
+    /// chrome after a reorder or close.
+    pub(super) fn reader_focus_active(&self, cx: &App) -> bool {
+        let Some(state) = self.reader_focus.as_ref() else { return false };
+        let entity_matches = self
+            .tabs
+            .get(self.active)
+            .and_then(|tab| tab.file_editor(cx))
+            .is_some_and(|file| file == state.file);
+        Self::reader_focus_should_hide_chrome(entity_matches, state.file.read(cx).reader_focus())
+    }
+
+    /// Derived presentation contract: a focus record can hide chrome only if
+    /// it still belongs to the active entity and that entity remains focused.
+    /// This is deliberately independent of sidebar persistence state.
+    pub(super) fn reader_focus_should_hide_chrome(
+        active_entity_matches: bool,
+        document_focus: bool,
+    ) -> bool {
+        active_entity_matches && document_focus
+    }
+
+    fn enter_reader_focus(
+        &mut self,
+        file: Entity<crate::gpui_shell::doc_tabs::DocTabView>,
+        cx: &mut Context<Self>,
+    ) {
+        let is_active = self
+            .tabs
+            .get(self.active)
+            .and_then(|tab| tab.file_editor(cx))
+            .is_some_and(|active| active == file);
+        if !is_active || self.reader_focus.is_some() {
+            return;
+        }
+        // Keep workspace state untouched. Render derives the immersive view
+        // from this Entity and temporarily omits surrounding chrome, so tab
+        // changes and command actions cannot strand a collapsed sidebar.
+        self.reader_focus = Some(super::ReaderFocusState { file });
+        cx.notify();
+    }
+
+    fn exit_reader_focus_for(
+        &mut self,
+        file: &Entity<crate::gpui_shell::doc_tabs::DocTabView>,
+        cx: &mut Context<Self>,
+    ) {
+        let matches = self.reader_focus.as_ref().is_some_and(|state| state.file == *file);
+        if matches {
+            self.restore_reader_focus(cx);
+        }
+    }
+
+    /// Leave focus before activating/closing/reordering another tab. The
+    /// document restores its own details panel; this restores workspace chrome.
+    pub(super) fn clear_reader_focus(&mut self, cx: &mut Context<Self>) -> bool {
+        if self.reader_focus.is_none() {
+            return false;
+        }
+        self.restore_reader_focus(cx)
+    }
+
+    /// `insert_new_tab` and a few restore paths update `active` directly. Run
+    /// this before render-derived layout so an old focused document cannot
+    /// reappear in focus after opening a new tab and later returning to it.
+    pub(super) fn clear_stale_reader_focus(&mut self, cx: &mut Context<Self>) -> bool {
+        let stale = self.reader_focus.as_ref().is_some_and(|state| {
+            let active_matches = self
+                .tabs
+                .get(self.active)
+                .and_then(|tab| tab.file_editor(cx))
+                .is_some_and(|file| file == state.file);
+            !active_matches || !state.file.read(cx).reader_focus()
+        });
+        stale && self.restore_reader_focus(cx)
+    }
+
+    fn restore_reader_focus(&mut self, cx: &mut Context<Self>) -> bool {
+        let Some(state) = self.reader_focus.take() else { return false };
+        let _ = state.file.update(cx, |file, cx| file.clear_reader_focus(cx));
+        cx.notify();
+        true
+    }
+
     fn on_code_tab_event(
         &mut self,
         _: Entity<crate::gpui_shell::code_tab::CodeTabView>,
@@ -318,3 +428,15 @@ impl NebulaWorkspace {
         }
     }
 }
+
+#[cfg(test)]
+mod reader_focus_contract_tests {
+    use super::NebulaWorkspace;
+
+    #[test]
+    fn stale_focus_record_cannot_hide_a_new_active_tab() {
+        assert!(!NebulaWorkspace::reader_focus_should_hide_chrome(false, true));
+        assert!(!NebulaWorkspace::reader_focus_should_hide_chrome(true, false));
+        assert!(NebulaWorkspace::reader_focus_should_hide_chrome(true, true));
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/file_tree.rs b/nebula_app/src/gpui_shell/workspace/file_tree.rs
index f7151c4..fbd8bc7 100644
--- a/nebula_app/src/gpui_shell/workspace/file_tree.rs
+++ b/nebula_app/src/gpui_shell/workspace/file_tree.rs
@@ -118,6 +118,7 @@ impl NebulaWorkspace {
         let guest_path = row.guest_path.clone();
         let menu_guest_path = guest_path.clone();
         let drag_guest_path = guest_path.clone();
+        let preview_path = path.clone();
         let drag_path = path.clone();
         let drag_name = row.name.clone();
         let is_dir = row.is_dir;
@@ -161,6 +162,11 @@ impl NebulaWorkspace {
                 .text_color(fg)
                 .when(selected, |item| item.bg(selected_bg).border_color(selected_ring))
                 .hover(|item| item.bg(hover))
+                .when(!is_dir && crate::platform::file_preview::supports(&preview_path), |item| {
+                    item.tooltip(move |_, cx| {
+                        cx.new(|cx| crate::gpui_shell::file_preview::FilePreview::new(preview_path.clone(), cx)).into()
+                    })
+                })
                 .child(
                     div()
                         .w(px(12.0))
@@ -198,6 +204,7 @@ impl NebulaWorkspace {
                         .text_sm()
                         .overflow_hidden()
                         .whitespace_nowrap()
+                        .when(row.ignored, |label| label.italic())
                         .child(row.name),
                 )
                 .when_some(path_hint.filter(|hint| !hint.is_empty()), |item, hint| {
@@ -256,6 +263,10 @@ impl NebulaWorkspace {
                     // WSL 行拖的是**来宾**路径：宿主那份拼写只是展开用的键，
                     // 在来宾的 shell 里不存在。
                     let drag = crate::gpui_shell::file_drop::FileTreeDrag {
+                        local_path: drag_guest_path.as_ref()
+                            .zip(self.side_panel.file_wsl_root())
+                            .map(|(guest, root)| crate::shell_detect::wsl_unc_path(&root.distro, guest))
+                            .unwrap_or_else(|| drag_path.clone()),
                         path_text: drag_guest_path
                             .clone()
                             .unwrap_or_else(|| drag_path.display().to_string()),
@@ -436,18 +447,10 @@ impl NebulaWorkspace {
             .flex_shrink_0()
             .p_2()
             .gap_2()
-            // 抽屉圆角只给左侧两角（用户 08-26 裁定「最右侧去掉圆角，左侧保留」）：
-            // 右缘贴住窗口边框，倒角只会在那里啃出两个壳色缺口；左缘隔着终端卡的
-            // 8px 卡缝、下缘隔着槽位的 8px，圆角落在壳色上才有浮板感。左侧也不画
-            // 发丝线——有卡缝就不需要线分界，只留一条线反而像把面板压在终端上。
+            // Flat presets share the tab sidebar surface; the workspace paints the seam.
             .rounded_tl(crate::gpui_shell::theme::card_radius(cx))
             .rounded_bl(crate::gpui_shell::theme::card_radius(cx))
-            .bg(theme.popover)
-            // 抽屉在窗口右侧；右键菜单常翻到左缘。Tailwind `shadow_lg`
-            //（10px 下偏移 + 15px 模糊，再加一层）会垫在菜单周围，比 Tab
-            // 右键的 `popover_shadow` 厚一截。抽屉本身也是 popover 面，跟
-            // 菜单用同一套紧凑投影。
-            .shadow(gpui_component::popover_shadow(theme.is_dark()))
+            .bg(theme.sidebar)
             .occlude()
             .child(view_switch)
             .child(
@@ -688,7 +691,9 @@ impl NebulaWorkspace {
             .as_ref()
             .and_then(|_| self.side_panel.file_wsl_root().map(|root| root.distro.clone()));
         let workspace = cx.entity().downgrade();
-        let menu = PopupMenu::build(window, cx, move |menu, window, _cx| {
+        let ignored = self.side_panel.file_rows().iter().any(|row| row.path == path && row.ignored);
+        let language = crate::gpui_shell::config::ui_language(cx);
+        let menu = PopupMenu::build(window, cx, move |menu, _window, _cx| {
             file_tree_popup_menu(
                 menu.external_link_icon(false),
                 workspace,
@@ -696,7 +701,8 @@ impl NebulaWorkspace {
                 guest_path,
                 wsl_distro,
                 is_dir,
-                window,
+                ignored,
+                language,
             )
         });
         menu.focus_handle(cx).focus(window, cx);
@@ -817,29 +823,48 @@ impl NebulaWorkspace {
             })
         });
     }
-    /// 把一条路径写进仓库根的 `.gitignore`。
-    ///
-    /// 不弹确认框：这是追加一行、随时能删掉的动作，代价远低于多一次点击的
-    /// 摩擦。但**必须回报写了什么**——忽略规则的语义（锚定到根、目录带尾斜杠、
-    /// 元字符转义过）和用户点的那个文件名并不一字不差，看不到写进去的那一行
-    /// 就没法判断范围对不对。
-    fn ignore_file_tree_path(&mut self, path: PathBuf, is_dir: bool, cx: &mut Context<Self>) {
-        use crate::display::side_panel::IgnoreOutcome;
-
-        match crate::display::side_panel::append_to_gitignore(&path, is_dir) {
-            Ok(IgnoreOutcome::Added { entry, .. }) => {
-                self.side_panel.set_notice(format!("已写入 .gitignore：{entry}"));
-                // 忽略状态由 `git check-ignore` 现算，所以重跑一次快照这一行
-                // 就会转成灰色——用户能立刻看到规则生效了。
-                self.side_panel.request_refresh();
-                self.sync_side_panel_to_active(false, cx);
-            },
-            Ok(IgnoreOutcome::AlreadyPresent { entry }) => {
-                self.side_panel.set_notice(format!(".gitignore 已有这条规则：{entry}"));
-            },
-            Err(error) => self.side_panel.set_notice(error),
-        }
-        cx.notify();
+    fn ignore_file_tree_path(
+        &mut self,
+        path: PathBuf,
+        is_dir: bool,
+        ignored: bool,
+        cx: &mut Context<Self>,
+    ) {
+        let task = cx.background_executor().spawn(async move {
+            if ignored {
+                crate::display::side_panel::remove_from_gitignore(&path, is_dir)
+            } else {
+                crate::display::side_panel::append_to_gitignore(&path, is_dir)
+            }
+        });
+        cx.spawn(async move |this, cx| {
+            let result = task.await;
+            let _ = this.update(cx, |this, cx| {
+                use crate::display::side_panel::IgnoreOutcome;
+                use crate::i18n::Message;
+                let language = crate::gpui_shell::config::ui_language(cx);
+                let notice = match result {
+                    Ok(IgnoreOutcome::Added { entry, .. }) => {
+                        language.format(Message::FilesIgnoreAdded, &[("entry", &entry)])
+                    },
+                    Ok(IgnoreOutcome::Removed { entry, .. }) => {
+                        language.format(Message::FilesIgnoreRemoved, &[("entry", &entry)])
+                    },
+                    Ok(IgnoreOutcome::AlreadyPresent { entry }) => {
+                        language.format(Message::FilesIgnorePresent, &[("entry", &entry)])
+                    },
+                    Ok(IgnoreOutcome::AlreadyVisible { entry }) => {
+                        language.format(Message::FilesIgnoreVisible, &[("entry", &entry)])
+                    },
+                    Err(error) => language.format(Message::FilesIgnoreFailed, &[("error", &error)]),
+                };
+                this.side_panel.set_notice(notice);
+                this.side_panel.request_refresh();
+                this.sync_side_panel_to_active(false, cx);
+                cx.notify();
+            });
+        })
+        .detach();
     }
 }
 
@@ -850,7 +875,8 @@ fn file_tree_popup_menu(
     guest_path: Option<String>,
     wsl_distro: Option<String>,
     is_dir: bool,
-    _window: &mut Window,
+    ignored: bool,
+    language: crate::i18n::UiLanguage,
 ) -> PopupMenu {
     if let Some(guest_path) = guest_path {
         let copy_guest = guest_path.clone();
@@ -930,13 +956,20 @@ fn file_tree_popup_menu(
     let ignore_item = crate::display::side_panel::git_repository_root(&path).map(|_| {
         let ignore = workspace.clone();
         let ignore_path = path.clone();
-        PopupMenuItem::new("加入 .gitignore").icon(IconName::EyeOff).on_click(move |_, _, cx| {
-            if let Some(workspace) = ignore.upgrade() {
-                workspace.update(cx, |this, cx| {
-                    this.ignore_file_tree_path(ignore_path.clone(), is_dir, cx);
-                });
-            }
-        })
+        let label = language.text(if ignored {
+            crate::i18n::Message::FilesIgnoreRemove
+        } else {
+            crate::i18n::Message::FilesIgnoreAdd
+        });
+        PopupMenuItem::new(label)
+            .icon(if ignored { IconName::Eye } else { IconName::EyeOff })
+            .on_click(move |_, _, cx| {
+                if let Some(workspace) = ignore.upgrade() {
+                    workspace.update(cx, |this, cx| {
+                        this.ignore_file_tree_path(ignore_path.clone(), is_dir, ignored, cx);
+                    });
+                }
+            })
     });
     let delete = workspace;
     menu.item(first)
diff --git a/nebula_app/src/gpui_shell/workspace/keyboard_bindings.rs b/nebula_app/src/gpui_shell/workspace/keyboard_bindings.rs
new file mode 100644
index 0000000..498c40c
--- /dev/null
+++ b/nebula_app/src/gpui_shell/workspace/keyboard_bindings.rs
@@ -0,0 +1,130 @@
+//! Registration and restoration of user keyboard overrides.
+
+use super::*;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn cleared_shortcut_reaches_terminal_and_can_be_restored_without_restart() {
+        use crate::config::Action;
+        use gpui::{KeyContext, Keymap, Keystroke};
+        let contexts = [
+            KeyContext::parse("Root").unwrap(),
+            KeyContext::parse(crate::gpui_shell::terminal::KEY_CONTEXT).unwrap(),
+        ];
+        let input = [Keystroke::parse("ctrl-k").unwrap()];
+        let original = custom_workspace_binding("ctrl+k", &Action::ToggleShellPicker).unwrap();
+        let clear = workspace_binding_in_context(
+            "ctrl+k",
+            &Action::ReceiveChar,
+            Some(crate::gpui_shell::terminal::KEY_CONTEXT),
+        )
+        .unwrap();
+        let disabled = Keymap::new(vec![original.clone(), clear.clone()]);
+        let (bindings, pending) = disabled.bindings_for_input(&input, &contexts);
+        assert!(bindings.is_empty() && !pending, "No app action should consume the key");
+        let restored = workspace_binding_in_context(
+            "ctrl+k",
+            &Action::ToggleShellPicker,
+            Some(crate::gpui_shell::terminal::KEY_CONTEXT),
+        )
+        .unwrap();
+        let restored = Keymap::new(vec![original, clear, restored]);
+        let (bindings, pending) = restored.bindings_for_input(&input, &contexts);
+        assert!(!pending);
+        assert!(bindings[0].action().as_any().is::<ToggleShellPicker>());
+    }
+}
+
+pub(super) fn custom_workspace_binding(
+    combo: &str,
+    action: &crate::config::Action,
+) -> Option<KeyBinding> {
+    workspace_binding_in_context(combo, action, None)
+}
+
+fn workspace_binding_in_context(
+    combo: &str,
+    action: &crate::config::Action,
+    scope: Option<&str>,
+) -> Option<KeyBinding> {
+    use crate::config::Action;
+    let combo = gpui_binding_combo(combo);
+    match action {
+        Action::ToggleCommandPalette => Some(KeyBinding::new(&combo, ToggleCommandPalette, scope)),
+        Action::ToggleShellPicker => Some(KeyBinding::new(&combo, ToggleShellPicker, scope)),
+        Action::CreateNewTab => Some(KeyBinding::new(&combo, NewTerminal, scope)),
+        Action::CreateNewWindow => Some(KeyBinding::new(&combo, NewWindow, scope)),
+        Action::CloseTab => Some(KeyBinding::new(&combo, CloseActiveTerminal, scope)),
+        Action::ToggleFilesPanel => Some(KeyBinding::new(&combo, ToggleFileTree, scope)),
+        Action::ToggleGitPanel => Some(KeyBinding::new(&combo, ToggleGitPanel, scope)),
+        Action::SplitRight => Some(KeyBinding::new(&combo, SplitRight, scope)),
+        Action::SplitDown => Some(KeyBinding::new(&combo, SplitDown, scope)),
+        Action::ToggleZoom => Some(KeyBinding::new(&combo, ToggleZoom, scope)),
+        Action::FocusPaneLeft => Some(KeyBinding::new(&combo, FocusPaneLeft, scope)),
+        Action::FocusPaneRight => Some(KeyBinding::new(&combo, FocusPaneRight, scope)),
+        Action::FocusPaneUp => Some(KeyBinding::new(&combo, FocusPaneUp, scope)),
+        Action::FocusPaneDown => Some(KeyBinding::new(&combo, FocusPaneDown, scope)),
+        Action::SelectNextTab => Some(KeyBinding::new(&combo, SelectNextTab, scope)),
+        Action::SelectPreviousTab => Some(KeyBinding::new(&combo, SelectPreviousTab, scope)),
+        Action::IncreaseFontSize => Some(KeyBinding::new(&combo, IncreaseFontSize, scope)),
+        Action::DecreaseFontSize => Some(KeyBinding::new(&combo, DecreaseFontSize, scope)),
+        Action::ResetFontSize => Some(KeyBinding::new(&combo, ResetFontSize, scope)),
+        Action::Copy => Some(KeyBinding::new(
+            &combo,
+            CopySelection,
+            scope.or(Some(crate::gpui_shell::terminal::KEY_CONTEXT)),
+        )),
+        Action::Paste => Some(KeyBinding::new(
+            &combo,
+            PasteClipboard,
+            scope.or(Some(crate::gpui_shell::terminal::KEY_CONTEXT)),
+        )),
+        Action::ToggleFullscreen => Some(KeyBinding::new(&combo, ToggleFullscreen, scope)),
+        Action::OpenQuickJump => Some(KeyBinding::new(&combo, OpenQuickJump, scope)),
+        // `none` 禁用键：gpui 的 NoAction 绑定在最高优先级命中时吞掉按键，
+        // 与旧壳 keybind=combo:none 的语义一致。
+        Action::None | Action::ReceiveChar => Some(KeyBinding::new(&combo, gpui::NoAction, scope)),
+        _ => None,
+    }
+}
+
+impl NebulaWorkspace {
+    pub(super) fn apply_custom_keybinds(&mut self, cx: &mut Context<Self>) {
+        let raw = nebula_settings::keybind_pairs();
+        let applied: Vec<_> = raw.iter().map(|(combo, _)| gpui_binding_combo(combo)).collect();
+        let defaults = crate::display::keymap::default_shortcuts();
+        let mut bindings = Vec::new();
+        for stale in self.custom_keybinds_applied.iter().filter(|combo| !applied.contains(combo)) {
+            let restored =
+                defaults.iter().rev().find(|(combo, _)| gpui_binding_combo(combo) == *stale);
+            if let Some((combo, action)) = restored {
+                for scope in [None, Some(crate::gpui_shell::terminal::KEY_CONTEXT)] {
+                    if let Some(binding) = workspace_binding_in_context(combo, action, scope) {
+                        bindings.push(binding);
+                    }
+                }
+            } else {
+                for scope in [None, Some(crate::gpui_shell::terminal::KEY_CONTEXT)] {
+                    bindings.push(KeyBinding::new(stale, gpui::NoAction, scope));
+                }
+            }
+        }
+        for (combo, action) in raw {
+            let Some(action) = crate::display::keymap::parse_action(&action) else { continue };
+            if crate::display::keymap::parse_combo(&combo).is_none() {
+                continue;
+            }
+            // Register at both workspace and terminal depth so a cleared default
+            // cannot continue to intercept input through a more specific context.
+            for scope in [None, Some(crate::gpui_shell::terminal::KEY_CONTEXT)] {
+                if let Some(binding) = workspace_binding_in_context(&combo, &action, scope) {
+                    bindings.push(binding);
+                }
+            }
+        }
+        self.custom_keybinds_applied = applied;
+        cx.bind_keys(bindings);
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/notifications.rs b/nebula_app/src/gpui_shell/workspace/notifications.rs
index 0e2667c..89397d6 100644
--- a/nebula_app/src/gpui_shell/workspace/notifications.rs
+++ b/nebula_app/src/gpui_shell/workspace/notifications.rs
@@ -7,6 +7,24 @@ fn source_is_visible(window_active: bool, source_active: bool, overlay_open: boo
     window_active && source_active && !overlay_open
 }
 
+#[derive(Debug, PartialEq, Eq)]
+struct DeliveryChannels {
+    in_app: bool,
+    system: bool,
+}
+
+fn delivery_channels(
+    notification: &Notification,
+    visible: bool,
+    ai_toasts: bool,
+) -> DeliveryChannels {
+    DeliveryChannels {
+        in_app: (!visible || notification.is_attention()) && (ai_toasts || !notification.is_ai()),
+        // Keep native notification routing independent of the in-app preference.
+        system: !visible,
+    }
+}
+
 impl NebulaWorkspace {
     pub(super) fn deliver_pane_notification(
         &mut self,
@@ -28,39 +46,53 @@ impl NebulaWorkspace {
             tab_index == self.active && *focused == pane_id,
             self.settings_open || reader_open,
         );
-        let attention = notification.is_attention();
-        let source_view =
-            panes.iter().find(|pane| pane.id == pane_id).map(|pane| pane.view.clone());
-        let confirmation = if attention {
-            source_view.and_then(|view| view.update(cx, |view, _| view.capture_confirmation()))
-        } else {
-            None
-        };
-        if visible && !attention {
+        let delivery = delivery_channels(
+            &notification,
+            visible,
+            crate::gpui_shell::config::ai_toasts_enabled(cx),
+        );
+        if !delivery.in_app && !delivery.system {
             return;
         }
+        let source_view =
+            panes.iter().find(|pane| pane.id == pane_id).map(|pane| pane.view.clone());
         if !visible && let Some(meta) = self.tab_meta.get_mut(tab_index) {
             meta.has_bell = true;
         }
-        let (title, body) = notification.toast_text();
-        let kind = if attention {
-            crate::display::ToastKind::Warning
-        } else {
-            crate::display::ToastKind::Info
-        };
-        let text = format!("{title} \u{b7} {body}");
-        if let Some(confirmation) = confirmation {
-            crate::gpui_shell::toast::confirmation_for_pane(
-                window,
-                cx,
-                text,
-                pane_id,
-                confirmation,
-            );
-        } else {
-            crate::gpui_shell::toast::banner_for_pane(window, cx, kind, text, pane_id);
+        if delivery.in_app {
+            let attention = notification.is_attention();
+            let confirmation = if attention {
+                source_view.and_then(|view| view.update(cx, |view, _| view.capture_confirmation()))
+            } else {
+                None
+            };
+            let (title, body) = notification.toast_text();
+            let kind = if attention {
+                crate::display::ToastKind::Warning
+            } else {
+                crate::display::ToastKind::Info
+            };
+            let text = format!("{title} \u{b7} {body}");
+            if let Some(confirmation) = confirmation {
+                crate::gpui_shell::toast::confirmation_for_pane(
+                    window,
+                    cx,
+                    text,
+                    pane_id,
+                    confirmation,
+                );
+            } else {
+                crate::gpui_shell::toast::banner_for_pane(
+                    window,
+                    cx,
+                    kind,
+                    text,
+                    pane_id,
+                    notification.is_ai(),
+                );
+            }
         }
-        if !visible {
+        if delivery.system {
             crate::notify::deliver_gpui(&notification, pane_id);
         }
         cx.notify();
@@ -71,6 +103,62 @@ impl NebulaWorkspace {
 mod tests {
     use super::*;
 
+    #[test]
+    fn disabling_in_app_ai_toasts_keeps_background_system_notifications() {
+        for attention in [false, true] {
+            let notification =
+                Notification::AiTurn { program: "codex".into(), message: None, attention };
+            assert_eq!(
+                delivery_channels(&notification, false, false),
+                DeliveryChannels { in_app: false, system: true }
+            );
+            assert_eq!(
+                delivery_channels(&notification, false, true),
+                DeliveryChannels { in_app: true, system: true }
+            );
+            assert_eq!(
+                delivery_channels(&notification, true, false),
+                DeliveryChannels { in_app: false, system: false }
+            );
+            assert_eq!(
+                delivery_channels(&notification, true, true),
+                DeliveryChannels { in_app: attention, system: false }
+            );
+        }
+    }
+
+    #[test]
+    fn ai_bells_and_osc_messages_obey_only_the_in_app_switch() {
+        for notification in [
+            Notification::Bell { program: Some("claude".into()) },
+            Notification::Text { program: Some("codex".into()), body: "done".into() },
+            Notification::CommandDone {
+                program: Some("gemini".into()),
+                duration: std::time::Duration::from_secs(12),
+            },
+        ] {
+            assert_eq!(
+                delivery_channels(&notification, false, false),
+                DeliveryChannels { in_app: false, system: true }
+            );
+        }
+    }
+
+    #[test]
+    fn ordinary_terminal_notifications_ignore_the_ai_toast_preference() {
+        for notification in [
+            Notification::Bell { program: None },
+            Notification::Text { program: Some("cargo".into()), body: "build finished".into() },
+        ] {
+            for visible in [false, true] {
+                assert_eq!(
+                    delivery_channels(&notification, visible, false),
+                    delivery_channels(&notification, visible, true)
+                );
+            }
+        }
+    }
+
     #[test]
     fn only_the_visible_source_pane_suppresses_completion_notifications() {
         assert!(source_is_visible(true, true, false));
diff --git a/nebula_app/src/gpui_shell/workspace/remote_files.rs b/nebula_app/src/gpui_shell/workspace/remote_files.rs
index b706406..c032a10 100644
--- a/nebula_app/src/gpui_shell/workspace/remote_files.rs
+++ b/nebula_app/src/gpui_shell/workspace/remote_files.rs
@@ -20,6 +20,12 @@
 //! 就会出现"点进 c 目录，界面却显示 b 目录的内容"。世代号对不上的响应直接
 //! 丢弃——它描述的是一个已经不存在的意图。
 
+mod drag;
+mod target;
+mod transfers;
+use target::RemoteTransferTarget;
+
+use gpui::AppContext as _;
 use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -36,8 +42,8 @@ use crate::ssh_sftp::{
     SftpSnapshot, SftpTransferOptions,
 };
 
-use super::NebulaWorkspace;
 use super::file_tree::{DRAWER_TEXT_INSET, ROW_PITCH, ROW_WASH_H, ROW_WASH_INSET};
+use super::{NebulaWorkspace, workspace_ui_language};
 
 /// 工具栏与说明文字沿用本地树的抽屉内边距。
 const TEXT_INSET: f32 = DRAWER_TEXT_INSET;
@@ -88,6 +94,9 @@ pub(super) struct RemoteBrowser {
     /// 控制器世代号。旧控制器的 wake 可能晚到，不能因此读取刚装上的新控制器。
     transfer_id: u64,
     skip_unchanged: bool,
+    preflighting: bool,
+    preflight_id: u64,
+    last_outcome: Option<crate::i18n::Message>,
     /// 远端复制载荷必须带稳定的源 destination，不能从当前标题反推源主机。
     clipboard: Option<RemoteClipboard>,
 }
@@ -105,12 +114,12 @@ enum PendingRemoteTransfer {
     Copy(RemoteClipboard),
 }
 
-#[derive(Clone, Debug, PartialEq, Eq)]
-struct RemoteTransferTarget {
-    pane: u64,
-    destination: String,
-    path: String,
-    navigation_generation: u64,
+impl Drop for RemoteBrowser {
+    fn drop(&mut self) {
+        if let Some(controller) = &self.transfer {
+            controller.cancel();
+        }
+    }
 }
 
 impl RemoteBrowser {
@@ -138,6 +147,7 @@ impl RemoteBrowser {
 
     /// 绑定 pane。返回 `true` 表示已有完整快照，调用方不得再列目录。
     fn bind(&mut self, pane: u64, destination: String) -> bool {
+        self.last_outcome = None;
         self.park_active();
         self.generation = self.generation.wrapping_add(1);
         self.pane = Some(pane);
@@ -326,6 +336,7 @@ impl NebulaWorkspace {
 
     /// 列出一个远端目录并显示它。
     pub(super) fn navigate_remote(&mut self, path: String, cx: &mut Context<'_, Self>) {
+        self.remote_browser.last_outcome = None;
         let Some(pane) = self.remote_browser.pane else { return };
         let Some(session) = self.remote_browser.browse_sessions.get(&pane).cloned() else {
             self.remote_browser.loading = false;
@@ -385,522 +396,6 @@ impl NebulaWorkspace {
         self.remote_browser.entries.iter().find(|entry| entry.path == selected).cloned()
     }
 
-    fn remote_transfer_snapshot(&self) -> Option<SftpSnapshot> {
-        self.remote_browser.transfer.as_ref().map(SftpController::snapshot)
-    }
-
-    fn remote_transfer_working(&self) -> bool {
-        self.remote_transfer_snapshot().is_some_and(|snapshot| snapshot.phase == SftpPhase::Working)
-    }
-
-    /// 为当前 pane/目录取得控制器，并启动一条常驻 wake 接收协程。
-    ///
-    /// 接收协程只持有 channel，不持有 controller；否则 controller 的 wake 闭包
-    /// 持有 sender、协程再持有 controller，会形成直到进程退出才释放的环。
-    fn remote_transfer_controller(
-        &mut self,
-        cx: &mut Context<'_, Self>,
-    ) -> Result<SftpController, String> {
-        let pane = self.remote_browser.pane.ok_or_else(|| "当前没有可用的 SSH pane".to_owned())?;
-        let destination = self.remote_browser.destination.clone();
-        let path = self.remote_browser.path.clone();
-        if destination.is_empty() || path.is_empty() {
-            return Err("远端目录尚未就绪".to_owned());
-        }
-
-        if let Some(controller) = self.remote_browser.transfer.as_ref() {
-            let snapshot = controller.snapshot();
-            if snapshot.phase == SftpPhase::Working {
-                return Err(format!("已有传输正在进行：{}", snapshot.destination));
-            }
-            if snapshot.destination == destination && snapshot.path == path {
-                return Ok(controller.clone());
-            }
-        }
-
-        self.remote_browser.transfer_id = self.remote_browser.transfer_id.wrapping_add(1).max(1);
-        let transfer_id = self.remote_browser.transfer_id;
-        let (wake_tx, mut wake_rx) = tokio::sync::mpsc::unbounded_channel();
-        let wake = Arc::new(move || {
-            let _ = wake_tx.send(());
-        });
-        let controller = SftpController::new_at(destination.clone(), path, wake)
-            .map_err(|error| error.to_string())?;
-        self.remote_browser.transfer = Some(controller.clone());
-
-        cx.spawn(async move |this, cx| {
-            while wake_rx.recv().await.is_some() {
-                let finished = this
-                    .update(cx, |workspace, cx| {
-                        workspace.sync_remote_transfer(transfer_id, pane, &destination, cx)
-                    })
-                    .unwrap_or(true);
-                if finished {
-                    break;
-                }
-            }
-        })
-        .detach();
-        Ok(controller)
-    }
-
-    /// 把 controller 快照落回 GPUI 状态。返回 true 表示接收协程可以退出。
-    fn sync_remote_transfer(
-        &mut self,
-        transfer_id: u64,
-        pane: u64,
-        destination: &str,
-        cx: &mut Context<'_, Self>,
-    ) -> bool {
-        if self.remote_browser.transfer_id != transfer_id {
-            return true;
-        }
-        let Some(controller) = self.remote_browser.transfer.as_ref() else {
-            return true;
-        };
-        let snapshot = controller.snapshot();
-        if snapshot.destination != destination {
-            return true;
-        }
-
-        let visible = self.remote_browser.pane == Some(pane)
-            && self.remote_browser.destination == destination;
-        if visible {
-            match snapshot.phase {
-                SftpPhase::Ready => {
-                    // 用户可在传输期间继续浏览；只有仍停在传输起始目录时才替换
-                    // 列表，否则完成结果会把用户从刚进入的目录拉回去。
-                    if self.remote_browser.path == snapshot.path {
-                        self.remote_browser.entries = snapshot.entries.clone();
-                        self.remote_browser.selected = None;
-                    }
-                    self.remote_browser.error = None;
-                },
-                SftpPhase::Error => self.remote_browser.error = snapshot.error.clone(),
-                SftpPhase::Working => {},
-                SftpPhase::Connecting | SftpPhase::Loading => {},
-            }
-        }
-
-        let finished = snapshot.phase == SftpPhase::Ready;
-        if finished {
-            self.remote_browser.transfer = None;
-        }
-        cx.notify();
-        finished
-    }
-
-    fn start_remote_transfer(
-        &mut self,
-        pending: PendingRemoteTransfer,
-        conflict: SftpConflictPolicy,
-        target: &RemoteTransferTarget,
-        cx: &mut Context<'_, Self>,
-    ) {
-        if !self.remote_transfer_target_matches(target) {
-            self.remote_browser.error =
-                Some("远端目标已改变，请在当前目录重新发起并确认传输".to_owned());
-            cx.notify();
-            return;
-        }
-        let controller = match self.remote_transfer_controller(cx) {
-            Ok(controller) => controller,
-            Err(message) => {
-                self.remote_browser.error = Some(message);
-                cx.notify();
-                return;
-            },
-        };
-        let options =
-            SftpTransferOptions { conflict, skip_unchanged: self.remote_browser.skip_unchanged };
-        self.remote_browser.error = None;
-        match pending {
-            PendingRemoteTransfer::Upload(paths) => {
-                controller.upload_paths_with_options(paths, options)
-            },
-            PendingRemoteTransfer::Download { entry, local_directory } => {
-                controller.download_with_options(entry, local_directory, options)
-            },
-            PendingRemoteTransfer::Copy(source) => {
-                controller.copy_from(source.source_destination, source.entry, options)
-            },
-        }
-        cx.notify();
-    }
-
-    fn current_remote_transfer_target(&self) -> Option<RemoteTransferTarget> {
-        Some(RemoteTransferTarget {
-            pane: self.remote_browser.pane?,
-            destination: self.remote_browser.destination.clone(),
-            path: self.remote_browser.path.clone(),
-            navigation_generation: self.remote_browser.generation,
-        })
-    }
-
-    fn remote_transfer_target_matches(&self, target: &RemoteTransferTarget) -> bool {
-        self.remote_browser.pane == Some(target.pane)
-            && self.remote_browser.destination == target.destination
-            && self.remote_browser.path == target.path
-            && self.remote_browser.generation == target.navigation_generation
-    }
-
-    fn remote_cancel_transfer(&mut self, cx: &mut Context<'_, Self>) {
-        if let Some(controller) = self.remote_browser.transfer.as_ref() {
-            controller.cancel();
-            cx.notify();
-        }
-    }
-
-    /// 返回根级冲突数，以及当前已知类型是否允许覆盖。
-    ///
-    /// 这里只负责决定是否询问用户；真正执行前内核还会重新 stat，防止对话框
-    /// 打开期间目标被别的进程替换。
-    fn pending_remote_conflicts(&self, pending: &PendingRemoteTransfer) -> (usize, bool, bool) {
-        match pending {
-            PendingRemoteTransfer::Upload(paths) => {
-                let mut conflicts = 0;
-                let mut overwrite_allowed = true;
-                let mut follows_symlink = false;
-                let mut root_names = HashSet::with_capacity(paths.len());
-                for path in paths {
-                    let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
-                        continue;
-                    };
-                    let collides_with_batch = !root_names.insert(name.to_owned());
-                    let target =
-                        self.remote_browser.entries.iter().find(|entry| entry.name == name);
-                    let source = std::fs::symlink_metadata(path).ok();
-                    if !collides_with_batch
-                        && self.remote_browser.skip_unchanged
-                        && source
-                            .as_ref()
-                            .zip(target)
-                            .is_some_and(|(source, target)| local_metadata_matches(source, target))
-                    {
-                        continue;
-                    }
-                    if !collides_with_batch && target.is_none() {
-                        continue;
-                    }
-                    conflicts += 1;
-                    follows_symlink |=
-                        target.is_some_and(|target| target.kind == SftpEntryKind::Symlink);
-                    if collides_with_batch {
-                        overwrite_allowed = false;
-                    }
-                    if let (Some(target), Some(source)) = (target, source) {
-                        let compatible = (source.is_dir()
-                            && target.kind == SftpEntryKind::Directory)
-                            || (source.is_file()
-                                && matches!(
-                                    target.kind,
-                                    SftpEntryKind::File | SftpEntryKind::Symlink
-                                ));
-                        overwrite_allowed &= compatible;
-                    }
-                }
-                (conflicts, overwrite_allowed, follows_symlink)
-            },
-            PendingRemoteTransfer::Download { entry, local_directory } => {
-                let target = local_directory.join(&entry.name);
-                let Ok(metadata) = std::fs::symlink_metadata(target) else {
-                    return (0, true, false);
-                };
-                if self.remote_browser.skip_unchanged && local_metadata_matches(&metadata, entry) {
-                    return (0, true, false);
-                }
-                let compatible = match entry.kind {
-                    SftpEntryKind::Directory => metadata.is_dir(),
-                    SftpEntryKind::File => metadata.is_file() || metadata.file_type().is_symlink(),
-                    // 链接的目标类型必须由远端 lstat/readlink 后才能确定，交给
-                    // 内核的执行时校验，UI 不凭列表图标猜。
-                    SftpEntryKind::Symlink => true,
-                };
-                (1, compatible, metadata.file_type().is_symlink())
-            },
-            PendingRemoteTransfer::Copy(source) => {
-                let Some(target) = self
-                    .remote_browser
-                    .entries
-                    .iter()
-                    .find(|entry| entry.name == source.entry.name)
-                else {
-                    return (0, true, false);
-                };
-                if self.remote_browser.skip_unchanged
-                    && source.entry.kind == SftpEntryKind::File
-                    && target.kind == SftpEntryKind::File
-                    && source.entry.size == target.size
-                    && source.entry.modified != 0
-                    && source.entry.modified == target.modified
-                {
-                    return (0, true, false);
-                }
-                let compatible = match source.entry.kind {
-                    SftpEntryKind::Directory => target.kind == SftpEntryKind::Directory,
-                    SftpEntryKind::File => {
-                        matches!(target.kind, SftpEntryKind::File | SftpEntryKind::Symlink)
-                    },
-                    SftpEntryKind::Symlink => true,
-                };
-                (1, compatible, target.kind == SftpEntryKind::Symlink)
-            },
-        }
-    }
-
-    fn request_remote_transfer(
-        &mut self,
-        pending: PendingRemoteTransfer,
-        window: &mut Window,
-        cx: &mut Context<'_, Self>,
-    ) {
-        let Some(target) = self.current_remote_transfer_target() else {
-            self.remote_browser.error = Some("远端目录尚未就绪".to_owned());
-            cx.notify();
-            return;
-        };
-        if self.remote_transfer_working() {
-            self.remote_browser.error = Some("已有传输正在进行，请等待完成或先取消".to_owned());
-            cx.notify();
-            return;
-        }
-        let (conflicts, overwrite_allowed, follows_symlink) =
-            self.pending_remote_conflicts(&pending);
-        if conflicts == 0 {
-            self.start_remote_transfer(pending, SftpConflictPolicy::Overwrite, &target, cx);
-            return;
-        }
-        self.open_remote_conflict_dialog(
-            pending,
-            target,
-            conflicts,
-            overwrite_allowed,
-            follows_symlink,
-            window,
-            cx,
-        );
-    }
-
-    fn open_remote_conflict_dialog(
-        &mut self,
-        pending: PendingRemoteTransfer,
-        target: RemoteTransferTarget,
-        conflicts: usize,
-        overwrite_allowed: bool,
-        follows_symlink: bool,
-        window: &mut Window,
-        cx: &mut Context<'_, Self>,
-    ) {
-        let workspace = cx.entity().downgrade();
-        window.open_dialog(cx, move |dialog, window, _cx| {
-            let skip_workspace = workspace.clone();
-            let skip_pending = pending.clone();
-            let skip_target = target.clone();
-            let keep_workspace = workspace.clone();
-            let keep_pending = pending.clone();
-            let keep_target = target.clone();
-            let overwrite_workspace = workspace.clone();
-            let overwrite_pending = pending.clone();
-            let overwrite_target = target.clone();
-            let footer = DialogFooter::new()
-                .child(DialogClose::new().child(Button::new("sftp-conflict-cancel").label("取消")))
-                .child(div().flex_1())
-                .child(DialogClose::new().child(
-                    Button::new("sftp-conflict-skip").label("跳过").on_click(move |_, _, cx| {
-                        let Some(workspace) = skip_workspace.upgrade() else { return };
-                        let _ = workspace.update(cx, |workspace, cx| {
-                            workspace.start_remote_transfer(
-                                skip_pending.clone(),
-                                SftpConflictPolicy::Skip,
-                                &skip_target,
-                                cx,
-                            );
-                        });
-                    }),
-                ))
-                .child(DialogClose::new().child(
-                    Button::new("sftp-conflict-keep-both").label("保留两者").on_click(
-                        move |_, _, cx| {
-                            let Some(workspace) = keep_workspace.upgrade() else { return };
-                            let _ = workspace.update(cx, |workspace, cx| {
-                                workspace.start_remote_transfer(
-                                    keep_pending.clone(),
-                                    SftpConflictPolicy::KeepBoth,
-                                    &keep_target,
-                                    cx,
-                                );
-                            });
-                        },
-                    ),
-                ))
-                .child(
-                    DialogClose::new().child(
-                        Button::new("sftp-conflict-overwrite")
-                            .label("覆盖")
-                            .danger()
-                            .disabled(!overwrite_allowed)
-                            .on_click(move |_, _, cx| {
-                                let Some(workspace) = overwrite_workspace.upgrade() else { return };
-                                let _ = workspace.update(cx, |workspace, cx| {
-                                    workspace.start_remote_transfer(
-                                        overwrite_pending.clone(),
-                                        SftpConflictPolicy::Overwrite,
-                                        &overwrite_target,
-                                        cx,
-                                    );
-                                });
-                            }),
-                    ),
-                );
-
-            center_modal_dialog(dialog, window, 220.0)
-                .close_button(false)
-                .overlay_closable(true)
-                .title(div().text_lg().font_semibold().child("发现同名项目"))
-                .footer(footer)
-                .child(
-                    v_flex()
-                        .w_full()
-                        .gap_2()
-                        .child(format!("目标位置已有 {conflicts} 个同名根项目。"))
-                        .when(!overwrite_allowed, |body| {
-                            body.child(
-                                div()
-                                    .text_sm()
-                                    .text_color(_cx.theme().danger)
-                                    .child("其中包含文件与目录类型不一致的项目，不能覆盖。"),
-                            )
-                        })
-                        .when(follows_symlink, |body| {
-                            body.child(
-                                div()
-                                    .text_sm()
-                                    .text_color(_cx.theme().danger)
-                                    .child(
-                                        "覆盖符号链接会直接改写链接指向的实际文件；该路径不具备原子回滚，失败或取消可能留下部分内容。",
-                                    ),
-                            )
-                        }),
-                )
-        });
-    }
-
-    fn remote_copy_selected(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
-        let Some(entry) = self.selected_remote_entry() else { return };
-        self.remote_browser.clipboard = Some(RemoteClipboard {
-            source_destination: self.remote_browser.destination.clone(),
-            entry: entry.clone(),
-        });
-        crate::gpui_shell::toast::toast(
-            window,
-            cx,
-            crate::display::ToastKind::Info,
-            format!("已复制远端项目：{}", entry.name),
-        );
-        cx.notify();
-    }
-
-    fn remote_paste(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
-        let Some(source) = self.remote_browser.clipboard.clone() else { return };
-        self.request_remote_transfer(PendingRemoteTransfer::Copy(source), window, cx);
-    }
-
-    fn remote_pick_upload_files(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
-        #[cfg(windows)]
-        let picked = pick_remote_upload_files(window);
-        #[cfg(not(windows))]
-        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
-            files: true,
-            directories: false,
-            multiple: true,
-            prompt: Some("选择要上传的文件".into()),
-        });
-
-        cx.spawn_in(window, async move |this, cx| {
-            #[cfg(windows)]
-            let Ok(paths) = picked.await else { return };
-            #[cfg(not(windows))]
-            let paths = {
-                let Ok(Ok(Some(paths))) = picked.await else { return };
-                paths
-            };
-            if paths.is_empty() {
-                return;
-            }
-            let _ = this.update_in(cx, |workspace, window, cx| {
-                workspace.request_remote_transfer(PendingRemoteTransfer::Upload(paths), window, cx);
-            });
-        })
-        .detach();
-    }
-
-    fn remote_pick_upload_directory(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
-        #[cfg(windows)]
-        let picked = pick_remote_directory(window, "选择要上传的文件夹");
-        #[cfg(not(windows))]
-        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
-            files: false,
-            directories: true,
-            multiple: false,
-            prompt: Some("选择要上传的文件夹".into()),
-        });
-
-        cx.spawn_in(window, async move |this, cx| {
-            #[cfg(windows)]
-            let Ok(Some(path)) = picked.await else { return };
-            #[cfg(not(windows))]
-            let path = {
-                let Ok(Ok(Some(paths))) = picked.await else { return };
-                let Some(path) = paths.into_iter().next() else { return };
-                path
-            };
-            let _ = this.update_in(cx, |workspace, window, cx| {
-                workspace.request_remote_transfer(
-                    PendingRemoteTransfer::Upload(vec![path]),
-                    window,
-                    cx,
-                );
-            });
-        })
-        .detach();
-    }
-
-    fn remote_pick_download_directory(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
-        let Some(entry) = self.selected_remote_entry() else { return };
-        #[cfg(windows)]
-        let picked = pick_remote_directory(window, "选择下载位置");
-        #[cfg(not(windows))]
-        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
-            files: false,
-            directories: true,
-            multiple: false,
-            prompt: Some("选择下载位置".into()),
-        });
-
-        cx.spawn_in(window, async move |this, cx| {
-            #[cfg(windows)]
-            let Ok(Some(local_directory)) = picked.await else { return };
-            #[cfg(not(windows))]
-            let local_directory = {
-                let Ok(Ok(Some(paths))) = picked.await else { return };
-                let Some(path) = paths.into_iter().next() else { return };
-                path
-            };
-            let _ = this.update_in(cx, |workspace, window, cx| {
-                workspace.request_remote_transfer(
-                    PendingRemoteTransfer::Download { entry, local_directory },
-                    window,
-                    cx,
-                );
-            });
-        })
-        .detach();
-    }
-
-    /// 当前目录里可见的行，含合成的"上一级"。
-    ///
-    /// `..` 是导航项而不是真实条目，所以必须显式标记：双击它是换目录，而下载
-    /// 或删除对它没有意义。判据和本地树的 `is_parent` 同源。
     fn remote_rows(&self) -> Vec<SftpEntry> {
         let mut rows = Vec::with_capacity(self.remote_browser.entries.len() + 1);
         if self.remote_browser.path != "/" {
@@ -919,13 +414,26 @@ impl NebulaWorkspace {
     }
 
     /// 单击选中，双击目录进入。
-    fn remote_activate(&mut self, row: SftpEntry, open: bool, cx: &mut Context<'_, Self>) {
+    fn remote_activate(
+        &mut self,
+        row: SftpEntry,
+        open: bool,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
         if open && matches!(row.kind, SftpEntryKind::Directory | SftpEntryKind::Symlink) {
             self.navigate_remote(row.path, cx);
             return;
         }
-        // 目录也必须能被选中，否则下载目录和跨主机复制目录没有入口。双击才
-        // 导航，文件双击仍只选中，传输动作统一由工具栏明确触发。
+        if open && row.kind == SftpEntryKind::File {
+            self.open_remote_document(
+                self.remote_browser.destination.clone(),
+                row.path,
+                window,
+                cx,
+            );
+            return;
+        }
         self.remote_browser.selected = Some(row.path);
         cx.notify();
     }
@@ -950,8 +458,6 @@ impl NebulaWorkspace {
         let theme = cx.theme();
         let muted = theme.muted_foreground;
         let foreground = theme.foreground;
-        let popover = theme.popover;
-        let is_dark = theme.is_dark();
         let drop_highlight = theme.accent.opacity(0.18);
         let rows = self.remote_rows();
         let row_count = rows.len();
@@ -972,23 +478,23 @@ impl NebulaWorkspace {
             .gap_2()
             .rounded_tl(crate::gpui_shell::theme::card_radius(cx))
             .rounded_bl(crate::gpui_shell::theme::card_radius(cx))
-            .bg(popover)
-            .shadow(gpui_component::popover_shadow(is_dark))
+            .bg(cx.theme().sidebar)
             .occlude()
             .drag_over::<ExternalPaths>(move |style, _, _, _| style.bg(drop_highlight))
-            .on_drop(cx.listener(
-                |this, paths: &ExternalPaths, window: &mut Window, cx| {
-                    let paths = paths.paths().to_owned();
-                    if !paths.is_empty() {
-                        this.request_remote_transfer(
-                            PendingRemoteTransfer::Upload(paths),
-                            window,
-                            cx,
-                        );
-                    }
-                },
-            ))
+            .on_drop(cx.listener(|this, paths: &ExternalPaths, window, cx| {
+                cx.stop_propagation();
+                this.drop_upload_paths(paths.paths().to_owned(), None, window, cx);
+            }))
+            .drag_over::<crate::gpui_shell::file_drop::FileTreeDrag>(move |style, _, _, _| style.bg(drop_highlight))
+            .on_drop(cx.listener(|this, file: &crate::gpui_shell::file_drop::FileTreeDrag, window, cx| {
+                cx.stop_propagation();
+                this.drop_upload_paths(vec![file.local_path.clone()], None, window, cx);
+            }))
             .child(view_switch)
+            .child(div().px(px(TEXT_INSET)).text_xs().text_color(muted)
+                .child(workspace_ui_language().text(if crate::platform::file_drag::supported() {
+                    crate::i18n::Message::TransferDragHint
+                } else { crate::i18n::Message::TransferUploadHint })))
             // 主机名单独一行：远端浏览器最危险的误操作是"以为在另一台机器上"，
             // 所以目的地必须一直在视野里，而不是只在标题栏或 tab 上。
             .child(
@@ -1233,6 +739,12 @@ impl NebulaWorkspace {
         let symbol_family: SharedString = crate::font_install::REQUIRED_FONT_FAMILY.into();
         let label = row.name.clone();
         let activate = row.clone();
+        let source = (!row.is_parent).then(|| self.current_remote_transfer_target()).flatten();
+        let native_drag = source.map(|source| drag::RemoteFileDrag { source, entry: row.clone() });
+        let weak = cx.entity().downgrade();
+        let directory = (row.kind == SftpEntryKind::Directory).then(|| row.path.clone());
+        let upload_directory = directory.clone();
+        let highlight = theme.accent.opacity(0.18);
 
         h_flex()
             .h(px(ROW_PITCH))
@@ -1274,8 +786,64 @@ impl NebulaWorkspace {
                             .whitespace_nowrap()
                             .child(label),
                     )
-                    .on_click(cx.listener(move |this, event: &gpui::ClickEvent, _, cx| {
-                        this.remote_activate(activate.clone(), event.click_count() >= 2, cx);
+                    .when_some(
+                        native_drag.filter(|_| crate::platform::file_drag::supported()),
+                        |item, drag| {
+                            item.on_drag(drag, move |drag, _, window, cx| {
+                                let preview = cx.new(|_| {
+                                    crate::gpui_shell::file_drop::FileDragGhost::new(
+                                        drag.entry.name.clone(),
+                                    )
+                                });
+                                let owner = weak.clone();
+                                let drag = drag.clone();
+                                window.defer(cx, move |window, cx| {
+                                    let _ = owner.update(cx, |workspace, cx| {
+                                        workspace.begin_native_download_drag(drag, window, cx)
+                                    });
+                                });
+                                preview
+                            })
+                        },
+                    )
+                    .when_some(directory, |item, directory| {
+                        item.drag_over::<ExternalPaths>(move |style, _, _, _| style.bg(highlight))
+                            .on_drop(cx.listener(move |this, paths: &ExternalPaths, window, cx| {
+                                cx.stop_propagation();
+                                this.drop_upload_paths(
+                                    paths.paths().to_owned(),
+                                    Some(directory.clone()),
+                                    window,
+                                    cx,
+                                );
+                            }))
+                    })
+                    .when_some(upload_directory, |item, directory| {
+                        item.drag_over::<crate::gpui_shell::file_drop::FileTreeDrag>(
+                            move |style, _, _, _| style.bg(highlight),
+                        )
+                        .on_drop(cx.listener(
+                            move |this,
+                                  file: &crate::gpui_shell::file_drop::FileTreeDrag,
+                                  window,
+                                  cx| {
+                                cx.stop_propagation();
+                                this.drop_upload_paths(
+                                    vec![file.local_path.clone()],
+                                    Some(directory.clone()),
+                                    window,
+                                    cx,
+                                );
+                            },
+                        ))
+                    })
+                    .on_click(cx.listener(move |this, event: &gpui::ClickEvent, window, cx| {
+                        this.remote_activate(
+                            activate.clone(),
+                            event.click_count() >= 2,
+                            window,
+                            cx,
+                        );
                     })),
             )
             .into_any_element()
@@ -1289,6 +857,11 @@ impl NebulaWorkspace {
         if let Some(error) = self.remote_browser.error.as_deref() {
             return Some(format!("{error}（点右上角重新读取）"));
         }
+        if self.remote_browser.preflighting {
+            return Some(
+                workspace_ui_language().text(crate::i18n::Message::TransferChecking).to_owned(),
+            );
+        }
         if let Some(snapshot) = self.remote_transfer_snapshot()
             && snapshot.phase == SftpPhase::Working
             && snapshot.destination != self.remote_browser.destination
@@ -1298,6 +871,9 @@ impl NebulaWorkspace {
         if self.remote_browser.loading {
             return Some("正在读取远端目录…".to_owned());
         }
+        if let Some(outcome) = self.remote_browser.last_outcome {
+            return Some(workspace_ui_language().text(outcome).to_owned());
+        }
         self.remote_browser.entries.is_empty().then(|| "此目录为空。".to_owned())
     }
 }
diff --git a/nebula_app/src/gpui_shell/workspace/remote_files/drag.rs b/nebula_app/src/gpui_shell/workspace/remote_files/drag.rs
new file mode 100644
index 0000000..e9ba485
--- /dev/null
+++ b/nebula_app/src/gpui_shell/workspace/remote_files/drag.rs
@@ -0,0 +1,175 @@
+//! File gesture routing and the handoff to the Windows drag worker.
+
+use super::*;
+use std::sync::{Mutex, OnceLock};
+
+struct ExportBroker {
+    receive: Mutex<
+        Option<
+            tokio::sync::oneshot::Receiver<
+                Result<Arc<crate::ssh_sftp::export::PreparedExport>, String>,
+            >,
+        >,
+    >,
+    prepared: OnceLock<Result<Arc<crate::ssh_sftp::export::PreparedExport>, String>>,
+}
+
+impl ExportBroker {
+    fn get(&self) -> std::io::Result<Arc<crate::ssh_sftp::export::PreparedExport>> {
+        self.prepared
+            .get_or_init(|| {
+                self.receive
+                    .lock()
+                    .unwrap_or_else(|e| e.into_inner())
+                    .take()
+                    .ok_or_else(|| "File drag preparation was already consumed".to_owned())?
+                    .blocking_recv()
+                    .map_err(|_| "File drag preparation ended".to_owned())?
+            })
+            .clone()
+            .map_err(std::io::Error::other)
+    }
+
+    fn finish(&self, result: &Result<DragOutcome, String>) {
+        if let Some(Ok(prepared)) = self.prepared.get() {
+            prepared.finish(match result {
+                Ok(DragOutcome::Copied) => Ok(()),
+                Ok(DragOutcome::Cancelled) => Err("File drag cancelled".into()),
+                Err(error) => Err(error.clone()),
+            });
+        }
+    }
+}
+
+use crate::i18n::Message;
+use crate::platform::file_drag::{DragFile, DragOutcome, MaterializedFile};
+
+#[derive(Clone)]
+pub(super) struct RemoteFileDrag {
+    pub(super) source: RemoteTransferTarget,
+    pub(super) entry: SftpEntry,
+}
+
+impl NebulaWorkspace {
+    pub(super) fn drop_upload_paths(
+        &mut self,
+        paths: Vec<PathBuf>,
+        directory: Option<String>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if paths.is_empty() {
+            return;
+        }
+        let Some(mut target) = self.current_remote_transfer_target() else {
+            return;
+        };
+        if let Some(directory) = directory {
+            target.path = directory;
+        }
+        self.request_remote_transfer_at(PendingRemoteTransfer::Upload(paths), target, window, cx);
+    }
+
+    pub(super) fn begin_native_download_drag(
+        &mut self,
+        drag: RemoteFileDrag,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        if !crate::platform::file_drag::supported() || !cx.stop_active_drag(window) {
+            return;
+        }
+        if !self.remote_transfer_target_matches(&drag.source) {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferTargetChanged).to_owned());
+            cx.notify();
+            return;
+        }
+        if self.remote_transfer_working() || self.remote_browser.preflighting {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferBusy).to_owned());
+            cx.notify();
+            return;
+        }
+        let controller = match self.remote_transfer_controller(&drag.source, cx) {
+            Ok(controller) => controller,
+            Err(error) => {
+                self.remote_browser.error = Some(error);
+                cx.notify();
+                return;
+            },
+        };
+        let ready = controller.prepare_export(drag.entry, self.remote_browser.entries.clone());
+        crate::platform::file_drag::release_pointer();
+        let (done, receive) = futures::channel::oneshot::channel();
+        let cancel = controller.cancellation_probe();
+        let origin = crate::platform::file_drag::DragOrigin::capture();
+        let worker_controller = controller.clone();
+        let worker = std::thread::Builder::new().name("pebrel-file-drag".into()).spawn(move || {
+            let broker = Arc::new(ExportBroker {
+                receive: Mutex::new(Some(ready)),
+                prepared: OnceLock::new(),
+            });
+            let describe = broker.clone();
+            let contents = broker.clone();
+            let stream_cancel = cancel.clone();
+            // Enter OLE immediately. Network work is requested lazily by the
+            // shell, so a short drag is not lost while SFTP prepares a directory.
+            let result = crate::platform::file_drag::run(
+                origin,
+                Arc::new(move || {
+                    Ok(describe
+                        .get()?
+                        .files
+                        .iter()
+                        .map(|file| DragFile {
+                            relative_path: file.relative_path.clone(),
+                            directory: file.directory,
+                            size: file.size,
+                        })
+                        .collect())
+                }),
+                Arc::new(move |index| {
+                    let (path, lease) = contents.get()?.materialize(index)?;
+                    Ok(MaterializedFile { path, lease, cancelled: stream_cancel.clone() })
+                }),
+                cancel,
+            )
+            .map_err(|error| error.to_string());
+            if !matches!(result, Ok(DragOutcome::Copied)) {
+                worker_controller.cancel();
+            }
+            broker.finish(&result);
+            let _ = done.send(result);
+        });
+        if let Err(error) = worker {
+            controller.cancel();
+            self.remote_browser.error = Some(error.to_string());
+            cx.notify();
+            return;
+        }
+        cx.spawn_in(window, async move |this, cx| {
+            let result = receive.await.unwrap_or_else(|_| Err("File drag worker ended".into()));
+            let _ = this.update_in(cx, |_, window, cx| {
+                let language = workspace_ui_language();
+                let (kind, message) = match result {
+                    Ok(DragOutcome::Copied) => (
+                        crate::display::ToastKind::Success,
+                        language.text(Message::TransferDownloaded).to_owned(),
+                    ),
+                    Ok(DragOutcome::Cancelled) => (
+                        crate::display::ToastKind::Info,
+                        language.text(Message::TransferCancelled).to_owned(),
+                    ),
+                    Err(error) => (
+                        crate::display::ToastKind::Warning,
+                        format!("{}: {error}", language.text(Message::TransferFailed)),
+                    ),
+                };
+                crate::gpui_shell::toast::toast(window, cx, kind, message);
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/remote_files/target.rs b/nebula_app/src/gpui_shell/workspace/remote_files/target.rs
new file mode 100644
index 0000000..bfe6cb5
--- /dev/null
+++ b/nebula_app/src/gpui_shell/workspace/remote_files/target.rs
@@ -0,0 +1,50 @@
+//! A captured file action may finish only in the browser scope that initiated it.
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct RemoteTransferTarget {
+    pub pane: u64,
+    pub destination: String,
+    pub path: String,
+    pub navigation_generation: u64,
+}
+
+impl RemoteTransferTarget {
+    pub(super) fn is_current(&self, pane: Option<u64>, destination: &str, generation: u64) -> bool {
+        pane == Some(self.pane)
+            && destination == self.destination
+            && generation == self.navigation_generation
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn target() -> RemoteTransferTarget {
+        RemoteTransferTarget {
+            pane: 12,
+            destination: "user@alpha".into(),
+            path: "/srv/subfolder".into(),
+            navigation_generation: 8,
+        }
+    }
+
+    #[test]
+    fn folder_drop_keeps_its_explicit_destination_within_the_same_browser_scope() {
+        let target = target();
+        assert!(target.is_current(Some(12), "user@alpha", 8));
+        assert_eq!(target.path, "/srv/subfolder");
+    }
+
+    #[test]
+    fn another_pane_on_the_same_host_cannot_receive_a_late_picker_result() {
+        assert!(!target().is_current(Some(13), "user@alpha", 8));
+        assert!(!target().is_current(None, "user@alpha", 8));
+    }
+
+    #[test]
+    fn switching_host_or_navigating_invalidates_conflict_confirmation() {
+        assert!(!target().is_current(Some(12), "user@beta", 8));
+        assert!(!target().is_current(Some(12), "user@alpha", 9));
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/remote_files/transfers.rs b/nebula_app/src/gpui_shell/workspace/remote_files/transfers.rs
new file mode 100644
index 0000000..565c3e7
--- /dev/null
+++ b/nebula_app/src/gpui_shell/workspace/remote_files/transfers.rs
@@ -0,0 +1,635 @@
+//! Transfer requests, conflict confirmation and native file selection.
+
+use super::*;
+use crate::i18n::Message;
+
+impl NebulaWorkspace {
+    pub(super) fn remote_transfer_snapshot(&self) -> Option<SftpSnapshot> {
+        self.remote_browser.transfer.as_ref().map(SftpController::snapshot)
+    }
+
+    pub(super) fn remote_transfer_working(&self) -> bool {
+        self.remote_transfer_snapshot().is_some_and(|snapshot| snapshot.phase == SftpPhase::Working)
+    }
+
+    /// 为当前 pane/目录取得控制器，并启动一条常驻 wake 接收协程。
+    ///
+    /// 接收协程只持有 channel，不持有 controller；否则 controller 的 wake 闭包
+    /// 持有 sender、协程再持有 controller，会形成直到进程退出才释放的环。
+    pub(super) fn remote_transfer_controller(
+        &mut self,
+        target: &RemoteTransferTarget,
+        cx: &mut Context<'_, Self>,
+    ) -> Result<SftpController, String> {
+        self.remote_browser.last_outcome = None;
+        let destination = target.destination.clone();
+        let path = target.path.clone();
+        if destination.is_empty() || path.is_empty() {
+            return Err(workspace_ui_language().text(Message::TransferNotReady).to_owned());
+        }
+
+        if let Some(controller) = self.remote_browser.transfer.as_ref() {
+            let snapshot = controller.snapshot();
+            if snapshot.phase == SftpPhase::Working {
+                return Err(workspace_ui_language()
+                    .format(Message::TransferBusyAt, &[("host", &snapshot.destination)]));
+            }
+        }
+
+        // Each request owns a fresh wake subscription. A failed transfer from
+        // another pane on the same host/path must not retain that pane's identity.
+        self.remote_browser.transfer_id = self.remote_browser.transfer_id.wrapping_add(1).max(1);
+        let transfer_id = self.remote_browser.transfer_id;
+        let (wake_tx, mut wake_rx) = tokio::sync::mpsc::unbounded_channel();
+        let wake = Arc::new(move || {
+            let _ = wake_tx.send(());
+        });
+        let controller = SftpController::new_at(destination.clone(), path, wake)
+            .map_err(|error| error.to_string())?;
+        self.remote_browser.transfer = Some(controller.clone());
+
+        let target = target.clone();
+        cx.spawn(async move |this, cx| {
+            while wake_rx.recv().await.is_some() {
+                let finished = this
+                    .update(cx, |workspace, cx| {
+                        workspace.sync_remote_transfer(transfer_id, &target, cx)
+                    })
+                    .unwrap_or(true);
+                if finished {
+                    break;
+                }
+            }
+        })
+        .detach();
+        Ok(controller)
+    }
+
+    /// 把 controller 快照落回 GPUI 状态。返回 true 表示接收协程可以退出。
+    pub(super) fn sync_remote_transfer(
+        &mut self,
+        transfer_id: u64,
+        target: &RemoteTransferTarget,
+        cx: &mut Context<'_, Self>,
+    ) -> bool {
+        if self.remote_browser.transfer_id != transfer_id {
+            return true;
+        }
+        let Some(controller) = self.remote_browser.transfer.as_ref() else {
+            return true;
+        };
+        let snapshot = controller.snapshot();
+        if snapshot.destination != target.destination {
+            return true;
+        }
+
+        let visible = self.remote_browser.pane == Some(target.pane)
+            && self.remote_browser.destination == target.destination;
+        if visible {
+            match snapshot.phase {
+                SftpPhase::Ready => {
+                    // 用户可在传输期间继续浏览；只有仍停在传输起始目录时才替换
+                    // 列表，否则完成结果会把用户从刚进入的目录拉回去。
+                    if self.remote_transfer_target_matches(target)
+                        && self.remote_browser.path == snapshot.path
+                    {
+                        self.remote_browser.entries = snapshot.entries.clone();
+                        self.remote_browser.selected = None;
+                    }
+                    self.remote_browser.error = None;
+                },
+                SftpPhase::Error => self.remote_browser.error = snapshot.error.clone(),
+                SftpPhase::Cancelled => {
+                    self.remote_browser.error = None;
+                    self.remote_browser.last_outcome = Some(Message::TransferCancelled);
+                },
+                SftpPhase::Working => {},
+                SftpPhase::Connecting | SftpPhase::Loading => {},
+            }
+        }
+
+        let finished = matches!(snapshot.phase, SftpPhase::Ready | SftpPhase::Cancelled);
+        if finished {
+            self.remote_browser.transfer = None;
+        }
+        cx.notify();
+        finished
+    }
+
+    pub(super) fn start_remote_transfer(
+        &mut self,
+        pending: PendingRemoteTransfer,
+        conflict: SftpConflictPolicy,
+        target: &RemoteTransferTarget,
+        cx: &mut Context<'_, Self>,
+    ) {
+        if !self.remote_transfer_target_matches(target) {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferTargetChanged).to_owned());
+            cx.notify();
+            return;
+        }
+        let controller = match self.remote_transfer_controller(target, cx) {
+            Ok(controller) => controller,
+            Err(message) => {
+                self.remote_browser.error = Some(message);
+                cx.notify();
+                return;
+            },
+        };
+        let options =
+            SftpTransferOptions { conflict, skip_unchanged: self.remote_browser.skip_unchanged };
+        self.remote_browser.error = None;
+        match pending {
+            PendingRemoteTransfer::Upload(paths) => {
+                controller.upload_paths_with_options(paths, options)
+            },
+            PendingRemoteTransfer::Download { entry, local_directory } => {
+                controller.download_with_options(entry, local_directory, options)
+            },
+            PendingRemoteTransfer::Copy(source) => {
+                controller.copy_from(source.source_destination, source.entry, options)
+            },
+        }
+        cx.notify();
+    }
+
+    pub(super) fn current_remote_transfer_target(&self) -> Option<RemoteTransferTarget> {
+        if self.remote_browser.loading || self.remote_browser.path.is_empty() {
+            return None;
+        }
+        Some(RemoteTransferTarget {
+            pane: self.remote_browser.pane?,
+            destination: self.remote_browser.destination.clone(),
+            path: self.remote_browser.path.clone(),
+            navigation_generation: self.remote_browser.generation,
+        })
+    }
+
+    pub(super) fn remote_transfer_target_matches(&self, target: &RemoteTransferTarget) -> bool {
+        target.is_current(
+            self.remote_browser.pane,
+            &self.remote_browser.destination,
+            self.remote_browser.generation,
+        )
+    }
+
+    pub(super) fn remote_cancel_transfer(&mut self, cx: &mut Context<'_, Self>) {
+        if let Some(controller) = self.remote_browser.transfer.as_ref() {
+            controller.cancel();
+            cx.notify();
+        }
+    }
+
+    pub(super) fn request_remote_transfer(
+        &mut self,
+        pending: PendingRemoteTransfer,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        let Some(target) = self.current_remote_transfer_target() else {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferNotReady).to_owned());
+            cx.notify();
+            return;
+        };
+        self.request_remote_transfer_at(pending, target, window, cx);
+    }
+
+    pub(super) fn request_remote_transfer_at(
+        &mut self,
+        pending: PendingRemoteTransfer,
+        target: RemoteTransferTarget,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        if !self.remote_transfer_target_matches(&target) {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferTargetChanged).to_owned());
+            cx.notify();
+            return;
+        }
+        if self.remote_transfer_working() || self.remote_browser.preflighting {
+            self.remote_browser.error =
+                Some(workspace_ui_language().text(Message::TransferBusy).to_owned());
+            cx.notify();
+            return;
+        }
+        self.remote_browser.preflight_id = self.remote_browser.preflight_id.wrapping_add(1);
+        let request = self.remote_browser.preflight_id;
+        self.remote_browser.preflighting = true;
+        self.remote_browser.last_outcome = None;
+        self.remote_browser.error = None;
+        let skip_unchanged = self.remote_browser.skip_unchanged;
+        let checked = pending.clone();
+        let check_target = target.clone();
+        let task = cx.background_executor().spawn(async move {
+            let entries = if matches!(checked, PendingRemoteTransfer::Download { .. }) {
+                Vec::new()
+            } else {
+                remote_call(move || async move {
+                    crate::ssh_sftp::list_dir(&check_target.destination, &check_target.path).await
+                })
+                .await
+                .ok_or_else(|| "Remote connection is unavailable".to_owned())??
+            };
+            Ok::<_, String>(pending_remote_conflicts(&checked, &entries, skip_unchanged))
+        });
+        cx.spawn_in(window, async move |this, cx| {
+            let result = task.await;
+            let _ = this.update_in(cx, |workspace, window, cx| {
+                if workspace.remote_browser.preflight_id != request {
+                    return;
+                }
+                workspace.remote_browser.preflighting = false;
+                if !workspace.remote_transfer_target_matches(&target) {
+                    workspace.remote_browser.error = Some(
+                        workspace_ui_language().text(Message::TransferTargetChanged).to_owned(),
+                    );
+                    cx.notify();
+                    return;
+                }
+                match result {
+                    Ok((0, _, _)) => workspace.start_remote_transfer(
+                        pending,
+                        SftpConflictPolicy::Overwrite,
+                        &target,
+                        cx,
+                    ),
+                    Ok((count, overwrite, symlink)) => workspace.open_remote_conflict_dialog(
+                        pending, target, count, overwrite, symlink, window, cx,
+                    ),
+                    Err(error) => workspace.remote_browser.error = Some(error),
+                }
+                cx.notify();
+            });
+        })
+        .detach();
+        cx.notify();
+    }
+
+    pub(super) fn open_remote_conflict_dialog(
+        &mut self,
+        pending: PendingRemoteTransfer,
+        target: RemoteTransferTarget,
+        conflicts: usize,
+        overwrite_allowed: bool,
+        follows_symlink: bool,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        let workspace = cx.entity().downgrade();
+        let language = workspace_ui_language();
+        let target_label = match &pending {
+            PendingRemoteTransfer::Download { local_directory, .. } => {
+                local_directory.display().to_string()
+            },
+            _ => format!("{}: {}", target.destination, target.path),
+        };
+        window.open_dialog(cx, move |dialog, window, _cx| {
+            let skip_workspace = workspace.clone();
+            let skip_pending = pending.clone();
+            let skip_target = target.clone();
+            let keep_workspace = workspace.clone();
+            let keep_pending = pending.clone();
+            let keep_target = target.clone();
+            let overwrite_workspace = workspace.clone();
+            let overwrite_pending = pending.clone();
+            let overwrite_target = target.clone();
+            let footer = DialogFooter::new()
+                .child(
+                    DialogClose::new().child(
+                        Button::new("sftp-conflict-cancel")
+                            .label(language.text(Message::TransferCancel)),
+                    ),
+                )
+                .child(div().flex_1())
+                .child(
+                    DialogClose::new().child(
+                        Button::new("sftp-conflict-skip")
+                            .label(language.text(Message::TransferSkip))
+                            .on_click(move |_, _, cx| {
+                                let Some(workspace) = skip_workspace.upgrade() else { return };
+                                let _ = workspace.update(cx, |workspace, cx| {
+                                    workspace.start_remote_transfer(
+                                        skip_pending.clone(),
+                                        SftpConflictPolicy::Skip,
+                                        &skip_target,
+                                        cx,
+                                    );
+                                });
+                            }),
+                    ),
+                )
+                .child(
+                    DialogClose::new().child(
+                        Button::new("sftp-conflict-keep-both")
+                            .label(language.text(Message::TransferKeepBoth))
+                            .on_click(move |_, _, cx| {
+                                let Some(workspace) = keep_workspace.upgrade() else { return };
+                                let _ = workspace.update(cx, |workspace, cx| {
+                                    workspace.start_remote_transfer(
+                                        keep_pending.clone(),
+                                        SftpConflictPolicy::KeepBoth,
+                                        &keep_target,
+                                        cx,
+                                    );
+                                });
+                            }),
+                    ),
+                )
+                .child(
+                    DialogClose::new().child(
+                        Button::new("sftp-conflict-overwrite")
+                            .label(language.text(Message::TransferOverwrite))
+                            .danger()
+                            .disabled(!overwrite_allowed)
+                            .on_click(move |_, _, cx| {
+                                let Some(workspace) = overwrite_workspace.upgrade() else { return };
+                                let _ = workspace.update(cx, |workspace, cx| {
+                                    workspace.start_remote_transfer(
+                                        overwrite_pending.clone(),
+                                        SftpConflictPolicy::Overwrite,
+                                        &overwrite_target,
+                                        cx,
+                                    );
+                                });
+                            }),
+                    ),
+                );
+
+            center_modal_dialog(dialog, window, 220.0)
+                .close_button(false)
+                .overlay_closable(true)
+                .title(
+                    div()
+                        .text_lg()
+                        .font_semibold()
+                        .child(language.text(Message::TransferConflictTitle)),
+                )
+                .footer(footer)
+                .child(
+                    v_flex()
+                        .w_full()
+                        .gap_2()
+                        .child(div().text_xs().text_color(_cx.theme().muted_foreground).child(
+                            language.format(
+                                Message::TransferDestination,
+                                &[("destination", &target_label)],
+                            ),
+                        ))
+                        .child(language.format(
+                            Message::TransferConflictBody,
+                            &[("count", &conflicts.to_string())],
+                        ))
+                        .when(!overwrite_allowed, |body| {
+                            body.child(
+                                div()
+                                    .text_sm()
+                                    .text_color(_cx.theme().danger)
+                                    .child(language.text(Message::TransferIncompatible)),
+                            )
+                        })
+                        .when(follows_symlink, |body| {
+                            body.child(
+                                div()
+                                    .text_sm()
+                                    .text_color(_cx.theme().danger)
+                                    .child(language.text(Message::TransferSymlinkWarning)),
+                            )
+                        }),
+                )
+        });
+    }
+
+    pub(super) fn remote_copy_selected(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
+        let Some(entry) = self.selected_remote_entry() else { return };
+        self.remote_browser.clipboard = Some(RemoteClipboard {
+            source_destination: self.remote_browser.destination.clone(),
+            entry: entry.clone(),
+        });
+        crate::gpui_shell::toast::toast(
+            window,
+            cx,
+            crate::display::ToastKind::Info,
+            workspace_ui_language().format(Message::TransferCopiedItem, &[("name", &entry.name)]),
+        );
+        cx.notify();
+    }
+
+    pub(super) fn remote_paste(&mut self, window: &mut Window, cx: &mut Context<'_, Self>) {
+        let Some(source) = self.remote_browser.clipboard.clone() else { return };
+        self.request_remote_transfer(PendingRemoteTransfer::Copy(source), window, cx);
+    }
+
+    pub(super) fn remote_pick_upload_files(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        let Some(target) = self.current_remote_transfer_target() else { return };
+        #[cfg(windows)]
+        let picked = pick_remote_upload_files(window);
+        #[cfg(not(windows))]
+        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
+            files: true,
+            directories: false,
+            multiple: true,
+            prompt: Some(workspace_ui_language().text(Message::TransferChooseFiles).into()),
+        });
+
+        cx.spawn_in(window, async move |this, cx| {
+            #[cfg(windows)]
+            let Ok(paths) = picked.await else { return };
+            #[cfg(not(windows))]
+            let paths = {
+                let Ok(Ok(Some(paths))) = picked.await else { return };
+                paths
+            };
+            if paths.is_empty() {
+                return;
+            }
+            let _ = this.update_in(cx, |workspace, window, cx| {
+                workspace.request_remote_transfer_at(
+                    PendingRemoteTransfer::Upload(paths),
+                    target,
+                    window,
+                    cx,
+                );
+            });
+        })
+        .detach();
+    }
+
+    pub(super) fn remote_pick_upload_directory(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        let Some(target) = self.current_remote_transfer_target() else { return };
+        #[cfg(windows)]
+        let picked = pick_remote_directory(
+            window,
+            workspace_ui_language().text(Message::TransferChooseUploadDirectory),
+        );
+        #[cfg(not(windows))]
+        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: false,
+            prompt: Some(
+                workspace_ui_language().text(Message::TransferChooseUploadDirectory).into(),
+            ),
+        });
+
+        cx.spawn_in(window, async move |this, cx| {
+            #[cfg(windows)]
+            let Ok(Some(path)) = picked.await else { return };
+            #[cfg(not(windows))]
+            let path = {
+                let Ok(Ok(Some(paths))) = picked.await else { return };
+                let Some(path) = paths.into_iter().next() else { return };
+                path
+            };
+            let _ = this.update_in(cx, |workspace, window, cx| {
+                workspace.request_remote_transfer_at(
+                    PendingRemoteTransfer::Upload(vec![path]),
+                    target,
+                    window,
+                    cx,
+                );
+            });
+        })
+        .detach();
+    }
+
+    pub(super) fn remote_pick_download_directory(
+        &mut self,
+        window: &mut Window,
+        cx: &mut Context<'_, Self>,
+    ) {
+        let Some(target) = self.current_remote_transfer_target() else { return };
+        let Some(entry) = self.selected_remote_entry() else { return };
+        #[cfg(windows)]
+        let picked = pick_remote_directory(
+            window,
+            workspace_ui_language().text(Message::TransferChooseDownloadDirectory),
+        );
+        #[cfg(not(windows))]
+        let picked = cx.prompt_for_paths(gpui::PathPromptOptions {
+            files: false,
+            directories: true,
+            multiple: false,
+            prompt: Some(
+                workspace_ui_language().text(Message::TransferChooseDownloadDirectory).into(),
+            ),
+        });
+
+        cx.spawn_in(window, async move |this, cx| {
+            #[cfg(windows)]
+            let Ok(Some(local_directory)) = picked.await else { return };
+            #[cfg(not(windows))]
+            let local_directory = {
+                let Ok(Ok(Some(paths))) = picked.await else { return };
+                let Some(path) = paths.into_iter().next() else { return };
+                path
+            };
+            let _ = this.update_in(cx, |workspace, window, cx| {
+                workspace.request_remote_transfer_at(
+                    PendingRemoteTransfer::Download { entry, local_directory },
+                    target,
+                    window,
+                    cx,
+                );
+            });
+        })
+        .detach();
+    }
+}
+
+fn pending_remote_conflicts(
+    pending: &PendingRemoteTransfer,
+    entries: &[SftpEntry],
+    skip_unchanged: bool,
+) -> (usize, bool, bool) {
+    match pending {
+        PendingRemoteTransfer::Upload(paths) => {
+            let mut conflicts = 0;
+            let mut overwrite_allowed = true;
+            let mut follows_symlink = false;
+            let mut root_names = HashSet::with_capacity(paths.len());
+            for path in paths {
+                let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+                    continue;
+                };
+                let collides_with_batch = !root_names.insert(name.to_owned());
+                let target = entries.iter().find(|entry| entry.name == name);
+                let source = std::fs::symlink_metadata(path).ok();
+                if !collides_with_batch
+                    && skip_unchanged
+                    && source
+                        .as_ref()
+                        .zip(target)
+                        .is_some_and(|(source, target)| local_metadata_matches(source, target))
+                {
+                    continue;
+                }
+                if !collides_with_batch && target.is_none() {
+                    continue;
+                }
+                conflicts += 1;
+                follows_symlink |=
+                    target.is_some_and(|target| target.kind == SftpEntryKind::Symlink);
+                if collides_with_batch {
+                    overwrite_allowed = false;
+                }
+                if let (Some(target), Some(source)) = (target, source) {
+                    let compatible = (source.is_dir() && target.kind == SftpEntryKind::Directory)
+                        || (source.is_file()
+                            && matches!(target.kind, SftpEntryKind::File | SftpEntryKind::Symlink));
+                    overwrite_allowed &= compatible;
+                }
+            }
+            (conflicts, overwrite_allowed, follows_symlink)
+        },
+        PendingRemoteTransfer::Download { entry, local_directory } => {
+            let target = local_directory.join(&entry.name);
+            let Ok(metadata) = std::fs::symlink_metadata(target) else {
+                return (0, true, false);
+            };
+            if skip_unchanged && local_metadata_matches(&metadata, entry) {
+                return (0, true, false);
+            }
+            let compatible = match entry.kind {
+                SftpEntryKind::Directory => metadata.is_dir(),
+                SftpEntryKind::File => metadata.is_file() || metadata.file_type().is_symlink(),
+                // 链接的目标类型必须由远端 lstat/readlink 后才能确定，交给
+                // 内核的执行时校验，UI 不凭列表图标猜。
+                SftpEntryKind::Symlink => true,
+            };
+            (1, compatible, metadata.file_type().is_symlink())
+        },
+        PendingRemoteTransfer::Copy(source) => {
+            let Some(target) = entries.iter().find(|entry| entry.name == source.entry.name) else {
+                return (0, true, false);
+            };
+            if skip_unchanged
+                && source.entry.kind == SftpEntryKind::File
+                && target.kind == SftpEntryKind::File
+                && source.entry.size == target.size
+                && source.entry.modified != 0
+                && source.entry.modified == target.modified
+            {
+                return (0, true, false);
+            }
+            let compatible = match source.entry.kind {
+                SftpEntryKind::Directory => target.kind == SftpEntryKind::Directory,
+                SftpEntryKind::File => {
+                    matches!(target.kind, SftpEntryKind::File | SftpEntryKind::Symlink)
+                },
+                SftpEntryKind::Symlink => true,
+            };
+            (1, compatible, target.kind == SftpEntryKind::Symlink)
+        },
+    }
+}
diff --git a/nebula_app/src/gpui_shell/workspace/sidebar.rs b/nebula_app/src/gpui_shell/workspace/sidebar.rs
index ac4734e..e0c99ec 100644
--- a/nebula_app/src/gpui_shell/workspace/sidebar.rs
+++ b/nebula_app/src/gpui_shell/workspace/sidebar.rs
@@ -921,6 +921,9 @@ impl NebulaWorkspace {
         let secondary = cx.theme().secondary;
         let settings_active_bg = cx.theme().sidebar_accent;
         let settings_active_fg = cx.theme().sidebar_accent_foreground;
+        let sidebar_visible = !self.sidebar_collapsed && !self.reader_focus_active(cx);
+        let flush_sidebar =
+            !settings_active && sidebar_visible && crate::gpui_shell::theme::pane_is_flush(cx);
         h_flex()
             .size_full()
             .items_center()
@@ -931,6 +934,13 @@ impl NebulaWorkspace {
                     // 32px，`.small()` 会把热区缩成 24px。
                     .gap_2()
                     .items_center()
+                    .when(flush_sidebar, |left| {
+                        // Keep the sidebar-colored strip aligned with the actual
+                        // sidebar, including the title bar's leading padding.
+                        let inset = if cfg!(target_os = "macos") { 80.0 } else { 12.0 };
+                        left.h_full().w(px(self.sidebar_width)).flex_shrink_0()
+                            .ml(px(-inset)).pl(px(inset)).bg(cx.theme().background)
+                    })
                     .occlude()
                     .child(
                         Button::new("toggle-sidebar")
@@ -939,13 +949,17 @@ impl NebulaWorkspace {
                             .disabled(settings_active)
                             // 侧栏是开关而非一次性动作：展开期间必须持续显示
                             // 选中底，和旧壳 `left_sidebar_visible()` 同义。
-                            .selected(!self.sidebar_collapsed)
+                            .selected(sidebar_visible)
                             // Ghost 的全局 selected 使用 hover_strong，静态底比
                             // 旧壳亮一档；仅此按钮覆写回旧壳 surface。
-                            .when(!self.sidebar_collapsed, |button| button.bg(secondary))
+                            .when(sidebar_visible, |button| button.bg(secondary))
                             .tooltip("折叠/展开侧边栏 (Ctrl+Shift+B)")
                             .on_click(cx.listener(|this, _, _, cx| {
-                                this.sidebar_collapsed = !this.sidebar_collapsed;
+                                if this.reader_focus_active(cx) {
+                                    this.clear_reader_focus(cx);
+                                } else {
+                                    this.sidebar_collapsed = !this.sidebar_collapsed;
+                                }
                                 this.sidebar_fold_armed = true;
                                 cx.notify();
                             })),
diff --git a/nebula_app/src/gpui_shell/workspace/tests.rs b/nebula_app/src/gpui_shell/workspace/tests.rs
index 0551b03..a83ab38 100644
--- a/nebula_app/src/gpui_shell/workspace/tests.rs
+++ b/nebula_app/src/gpui_shell/workspace/tests.rs
@@ -735,8 +735,13 @@ fn sidebar_resize_hot_zone_follows_the_theme_boundary() {
     assert_eq!((nord.gutter, nord.divider), (0.0, 1.0), "Nord 是铺满 + 竖线形态");
     assert_eq!(sidebar_resize_offset_for(nord.divider, nord.gutter), 0.5, "对准 1px 线心");
 
-    let floating = nebula_settings::ThemeName::Nebula.card_geometry();
-    assert_eq!((floating.gutter, floating.divider), (8.0, 0.0), "其余主题是浮起圆角卡");
+    let floating = nebula_settings::ThemeCardGeometry {
+        radius: 14.0,
+        gutter: 8.0,
+        shadow: false,
+        divider: 0.0,
+    };
+    assert_eq!((floating.gutter, floating.divider), (8.0, 0.0), "显式自定义圆角仍按外缝定位");
     assert_eq!(
         sidebar_resize_offset_for(floating.divider, floating.gutter),
         8.0,
diff --git a/nebula_app/src/gpui_shell/workspace/vcs_panel.rs b/nebula_app/src/gpui_shell/workspace/vcs_panel.rs
index be8d305..1ae224a 100644
--- a/nebula_app/src/gpui_shell/workspace/vcs_panel.rs
+++ b/nebula_app/src/gpui_shell/workspace/vcs_panel.rs
@@ -887,9 +887,7 @@ impl NebulaWorkspace {
             // 右缘贴窗口边框不倒角，四边无描边。
             .rounded_tl(crate::gpui_shell::theme::card_radius(cx))
             .rounded_bl(crate::gpui_shell::theme::card_radius(cx))
-            .bg(theme.popover)
-            // 与文件树抽屉同一套紧凑投影，避免右侧抽屉语言再出现 shadow_lg。
-            .shadow(gpui_component::popover_shadow(theme.is_dark()))
+            .bg(theme.sidebar)
             .occlude()
             .child(view_switch)
             // VCS 状态现在跟着侧栏定位走（`SidePanel::vcs_root`），所以必须在
diff --git a/nebula_app/src/gpui_shell/workspace/window_titlebar.rs b/nebula_app/src/gpui_shell/workspace/window_titlebar.rs
index 0f714db..880daf8 100644
--- a/nebula_app/src/gpui_shell/workspace/window_titlebar.rs
+++ b/nebula_app/src/gpui_shell/workspace/window_titlebar.rs
@@ -1,7 +1,37 @@
 use super::*;
 
-pub(super) fn settings_aware_title_bar(settings_active: bool, cx: &App) -> TitleBar {
-    TitleBar::new().h(px(48.0)).when(settings_active, |bar| {
-        bar.border_b_1().border_color(crate::gpui_shell::theme::settings_hairline(cx))
-    })
+/// Paint tab and file-tree seams after the terminal, including the titlebar span.
+/// Both use the same pixel snapping and theme color; the right seam stays inside
+/// the terminal edge so the subsequently painted drawer cannot cover it.
+pub(super) fn paint_pane_dividers(
+    bounds: Bounds<Pixels>,
+    file_tree: bool,
+    window: &mut Window,
+    cx: &App,
+) {
+    let card = crate::gpui_shell::theme::PaneCardStyle::current(cx);
+    let color = crate::gpui_shell::theme::card_divider_color(cx);
+    if let Some(line) = pane_card_divider_bounds(bounds, card.divider, window.scale_factor()) {
+        window.paint_quad(fill(line, color));
+    }
+    if file_tree {
+        let mut edge = bounds;
+        edge.origin.x += edge.size.width;
+        if let Some(mut line) = pane_card_divider_bounds(edge, card.divider, window.scale_factor())
+        {
+            line.origin.x -= line.size.width;
+            window.paint_quad(fill(line, color));
+        }
+    }
+}
+
+pub(super) fn settings_aware_title_bar(settings_active: bool, cx: &App) -> TitleBar {
+    TitleBar::new()
+        .h(px(48.0))
+        .when(!settings_active && crate::gpui_shell::theme::pane_is_flush(cx), |bar| {
+            bar.bg(crate::gpui_shell::theme::theme_term_background(cx)).border_b_0()
+        })
+        .when(settings_active, |bar| {
+            bar.border_b_1().border_color(crate::gpui_shell::theme::settings_hairline(cx))
+        })
 }
diff --git a/nebula_app/src/i18n/locale.rs b/nebula_app/src/i18n/locale.rs
index ef0bda4..484e320 100644
--- a/nebula_app/src/i18n/locale.rs
+++ b/nebula_app/src/i18n/locale.rs
@@ -1,21 +1,6 @@
-pub fn system_locale() -> Option<String> {
-    native_locale().or_else(|| {
-        ["LC_ALL", "LC_MESSAGES", "LANG"]
-            .into_iter()
-            .find_map(|name| std::env::var(name).ok().filter(|value| !value.is_empty()))
-    })
-}
+// Native discovery stays in the platform adapter. The independent translation
+// contract compiles this same adapter without the application shell.
+#[path = "../platform/locale.rs"]
+mod platform_locale;
 
-#[cfg(windows)]
-fn native_locale() -> Option<String> {
-    use windows_sys::Win32::Globalization::GetUserDefaultLocaleName;
-
-    let mut buffer = [0_u16; 85];
-    let length = unsafe { GetUserDefaultLocaleName(buffer.as_mut_ptr(), buffer.len() as i32) };
-    (length > 1).then(|| String::from_utf16(&buffer[..length as usize - 1]).ok()).flatten()
-}
-
-#[cfg(not(windows))]
-fn native_locale() -> Option<String> {
-    None
-}
+pub use platform_locale::system_locale;
diff --git a/nebula_app/src/input/keyboard.rs b/nebula_app/src/input/keyboard.rs
index 29b70aa..5f78f11 100644
--- a/nebula_app/src/input/keyboard.rs
+++ b/nebula_app/src/input/keyboard.rs
@@ -1020,7 +1020,12 @@ impl<T: EventListener, A: ActionContext<T>> Processor<T, A> {
                 _ => false,
             };
             if popup_accept {
-                if let Some(insert) = self.ctx.nebula_completion_popup_take() {
+                if let Some(item) = self.ctx.nebula_completion_popup_take() {
+                    for _ in 0..item.replace_chars {
+                        self.ctx.nebula_input_backspace();
+                    }
+                    self.ctx.write_to_pty(vec![0x7f; item.replace_chars]);
+                    let insert = item.insert;
                     if !insert.is_empty() {
                         for c in insert.chars() {
                             self.ctx.nebula_input_char(c);
diff --git a/nebula_app/src/input/mod.rs b/nebula_app/src/input/mod.rs
index 666db76..1d80daf 100644
--- a/nebula_app/src/input/mod.rs
+++ b/nebula_app/src/input/mod.rs
@@ -106,7 +106,7 @@ pub trait ActionContext<T: EventListener> {
     /// 弹窗补齐：高亮行上下移动（循环）。
     fn nebula_completion_popup_move(&mut self, _delta: isize) {}
     /// 弹窗补齐：取走选中候选要输入的余量并关闭列表。
-    fn nebula_completion_popup_take(&mut self) -> Option<String> {
+    fn nebula_completion_popup_take(&mut self) -> Option<crate::display::NebulaCompletionItem> {
         None
     }
     /// 弹窗补齐：Esc 关闭列表；返回是否真的关闭了（决定按键是否吞掉）。
diff --git a/nebula_app/src/main.rs b/nebula_app/src/main.rs
index 681defc..7d54501 100644
--- a/nebula_app/src/main.rs
+++ b/nebula_app/src/main.rs
@@ -46,6 +46,7 @@ mod assistant_answer;
 mod atomic_file;
 mod backup_remote;
 mod brand;
+mod chemistry;
 mod cli;
 mod clipboard;
 mod codex_config;
@@ -58,6 +59,7 @@ mod display;
 #[cfg(all(feature = "gpui-shell", not(feature = "legacy-shell")))]
 #[path = "product_ui/mod.rs"]
 mod display;
+mod document_io;
 mod encrypted_backup;
 #[cfg(feature = "legacy-shell")]
 mod event;
@@ -95,6 +97,7 @@ mod process_tree;
 mod provider_test;
 mod proxy_test;
 mod remote_dirs;
+mod render_cache;
 #[cfg(feature = "legacy-shell")]
 mod renderer;
 #[cfg(all(feature = "gpui-shell", not(feature = "legacy-shell")))]
@@ -105,6 +108,8 @@ mod runtime_exec;
 mod saved_commands;
 #[cfg(feature = "legacy-shell")]
 mod scheduler;
+#[cfg(test)]
+mod scientific_corpus;
 mod session;
 mod shell_detect;
 mod ssh;
@@ -119,6 +124,8 @@ mod svn_status;
 mod sync;
 mod taskbar;
 mod terminal_profiles;
+mod text_document;
+mod text_preview;
 mod tray;
 mod update_check;
 #[cfg(feature = "gpui-shell")]
diff --git a/nebula_app/src/math/bitmap.rs b/nebula_app/src/math/bitmap.rs
new file mode 100644
index 0000000..4250a4b
--- /dev/null
+++ b/nebula_app/src/math/bitmap.rs
@@ -0,0 +1,162 @@
+//! Bounded CPU composition shared by all formula presentation surfaces.
+use super::layout::MathLayout;
+use super::rasterizer::MathGlyphRasterizer;
+
+const MAX_IMAGE_EDGE_PX: u32 = 8192;
+const MAX_IMAGE_BYTES: usize = 24 * 1024 * 1024;
+const CANVAS_PAD: u32 = 2;
+
+pub(crate) struct MathBitmap {
+    pub(crate) pixels: Vec<u8>,
+    pub(crate) baseline: u32,
+    pub(crate) pad: u32,
+    pub(crate) width: u32,
+    pub(crate) height: u32,
+}
+
+/// Shared preflight for admission and allocation; never reserve a differently
+/// rounded size from the buffer the worker will actually create.
+pub(crate) fn required_bytes(layout: &MathLayout, scale: f32) -> Option<usize> {
+    let (width, height, _) = geometry(layout, scale)?;
+    (width as usize).checked_mul(height as usize)?.checked_mul(4)
+}
+
+fn geometry(layout: &MathLayout, scale: f32) -> Option<(u32, u32, u32)> {
+    if !scale.is_finite() || scale <= 0.0 {
+        return None;
+    }
+    let metrics = layout.metrics;
+    if [metrics.width, metrics.height, metrics.depth].iter().any(|value| !value.is_finite()) {
+        return None;
+    }
+    let content_width = (metrics.width * scale).ceil().max(1.0) as u32;
+    let ascent = (metrics.height * scale).ceil().max(0.0) as u32;
+    let descent = (metrics.depth * scale).ceil().max(0.0) as u32;
+    let width = content_width.checked_add(CANVAS_PAD * 2)?;
+    let height = ascent.checked_add(descent)?.checked_add(CANVAS_PAD * 2)?.max(1);
+    let bytes = (width as usize).checked_mul(height as usize)?.checked_mul(4)?;
+    (width <= MAX_IMAGE_EDGE_PX && height <= MAX_IMAGE_EDGE_PX && bytes <= MAX_IMAGE_BYTES)
+        .then_some((width, height, ascent + CANVAS_PAD))
+}
+
+/// 把整条公式（字形 + 分数线等矩形）按物理像素合成为一张直通 alpha 的
+/// BGRA 位图。字形位图原点吸附整数物理像素（旧壳同款），advance 保持
+/// 全精度。
+pub(crate) fn compose(
+    rasterizer: &MathGlyphRasterizer,
+    layout: &MathLayout,
+    raster_scale: f32,
+    color: [u8; 3],
+) -> Option<MathBitmap> {
+    let (width, height, baseline) = geometry(layout, raster_scale)?;
+    let bytes = width as usize * height as usize * 4;
+    let baseline = baseline as i64;
+
+    // Accumulate coverage in the final BGRA buffer's alpha channel. A separate
+    // full-size alpha plane would remain live alongside these same pixels.
+    let mut bgra = vec![0u8; bytes];
+    for op in &layout.glyphs {
+        let glyph = rasterizer.rasterize(op.glyph_id, op.pixel_size * raster_scale).ok()?;
+        if glyph.width == 0 || glyph.height == 0 {
+            continue;
+        }
+        let origin_x = (op.x * raster_scale).round() as i64 + glyph.left as i64 + CANVAS_PAD as i64;
+        let origin_y = baseline + (op.baseline_y * raster_scale).round() as i64 - glyph.top as i64;
+        blit_over(
+            &mut bgra,
+            width,
+            height,
+            origin_x,
+            origin_y,
+            glyph.width as u32,
+            glyph.height as u32,
+            |x, y| glyph.rgba[(y * glyph.width as usize + x) * 4 + 3],
+        );
+    }
+    for rule in &layout.rules {
+        let x0 = (rule.x * raster_scale).round() as i64 + CANVAS_PAD as i64;
+        let y0 = baseline + (rule.y * raster_scale).round() as i64;
+        let w = (rule.width * raster_scale).round().max(1.0) as u32;
+        let h = (rule.height * raster_scale).round().max(1.0) as u32;
+        blit_over(&mut bgra, width, height, x0, y0, w, h, |_, _| u8::MAX);
+    }
+
+    // gpui 图像管线吃直通 alpha 的 BGRA（与 DirectWrite 字形同一约定）。
+    let [r, g, b] = color;
+    for pixel in bgra.chunks_exact_mut(4) {
+        pixel[0] = b;
+        pixel[1] = g;
+        pixel[2] = r;
+    }
+    Some(MathBitmap { pixels: bgra, baseline: baseline as u32, pad: CANVAS_PAD, width, height })
+}
+
+/// alpha 平面上的 Porter-Duff over 合成；目标越界的像素按行列裁剪。
+#[allow(clippy::too_many_arguments)]
+fn blit_over(
+    canvas: &mut [u8],
+    canvas_width: u32,
+    canvas_height: u32,
+    origin_x: i64,
+    origin_y: i64,
+    width: u32,
+    height: u32,
+    sample: impl Fn(usize, usize) -> u8,
+) {
+    for row in 0..height as i64 {
+        let y = origin_y + row;
+        if y < 0 || y >= canvas_height as i64 {
+            continue;
+        }
+        for column in 0..width as i64 {
+            let x = origin_x + column;
+            if x < 0 || x >= canvas_width as i64 {
+                continue;
+            }
+            let source = sample(column as usize, row as usize) as u32;
+            if source == 0 {
+                continue;
+            }
+            let target = &mut canvas[(y as usize * canvas_width as usize + x as usize) * 4 + 3];
+            let existing = *target as u32;
+            *target = (existing + source * (255 - existing) / 255).min(255) as u8;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn overlap_blends_only_alpha_and_clips_to_the_canvas() {
+        let mut pixels = vec![0; 2 * 2 * 4];
+        blit_over(&mut pixels, 2, 2, -1, -1, 2, 2, |_, _| 128);
+        blit_over(&mut pixels, 2, 2, 0, 0, 1, 1, |_, _| 128);
+        assert_eq!(pixels[3], 191);
+        assert!(pixels.iter().enumerate().all(|(i, value)| i == 3 || *value == 0));
+    }
+
+    #[test]
+    fn preflight_matches_allocated_pixels_at_fractional_scales() {
+        let rasterizer = MathGlyphRasterizer::new().unwrap();
+        let layout = crate::math::compile_formula_source(
+            r"\frac{x^2}{\sqrt{y}}",
+            true,
+            18.0,
+            1.0,
+            crate::math::DEFAULT_LIMITS,
+        )
+        .unwrap();
+        for scale in [1.0, 1.25, 1.5, 2.0] {
+            let bitmap = compose(&rasterizer, &layout, scale, [11, 22, 33]).unwrap();
+            assert_eq!(required_bytes(&layout, scale), Some(bitmap.pixels.len()));
+            assert!(bitmap.pixels.chunks_exact(4).any(|p| p[3] != 0));
+            assert!(bitmap.pixels.chunks_exact(4).all(|p| p[..3] == [33, 22, 11]));
+        }
+        for scale in [0.0, -1.0, f32::NAN, f32::INFINITY, 10000.0] {
+            assert!(required_bytes(&layout, scale).is_none());
+            assert!(compose(&rasterizer, &layout, scale, [0, 0, 0]).is_none());
+        }
+    }
+}
diff --git a/nebula_app/src/math/compile.rs b/nebula_app/src/math/compile.rs
index e467350..e4210a1 100644
--- a/nebula_app/src/math/compile.rs
+++ b/nebula_app/src/math/compile.rs
@@ -486,3 +486,18 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+mod text_newline_regression {
+    use super::*;
+    #[test]
+    fn tex_text_newlines_never_become_single_glyph_fallback_operations() {
+        let source = "\\text{第一行\n第二行}+x";
+        for compile in [compile_formula, compile_formula_source] {
+            let layout = compile(source, true, 18.0, 1.0, crate::math::DEFAULT_LIMITS).unwrap();
+            assert!(!layout.text.iter().any(|op| matches!(op.character, '\r' | '\n')));
+            assert!(layout.text.iter().any(|op| op.character == '第'));
+        }
+        assert!(source.contains('\n'));
+    }
+}
diff --git a/nebula_app/src/math/layout.rs b/nebula_app/src/math/layout.rs
index bafb50a..60bd3cf 100644
--- a/nebula_app/src/math/layout.rs
+++ b/nebula_app/src/math/layout.rs
@@ -57,6 +57,15 @@ pub(crate) struct MathLayout {
     pub(crate) text: Vec<MathTextOp>,
 }
 
+impl MathLayout {
+    pub(crate) fn allocated_bytes(&self) -> usize {
+        std::mem::size_of::<Self>()
+            + self.glyphs.capacity() * std::mem::size_of::<MathGlyphOp>()
+            + self.rules.capacity() * std::mem::size_of::<MathRuleOp>()
+            + self.text.capacity() * std::mem::size_of::<MathTextOp>()
+    }
+}
+
 #[derive(Clone, Copy, Debug, Default)]
 struct Segment {
     start: u32,
@@ -142,7 +151,7 @@ pub(crate) fn layout_formula(
     }
 
     let font = MathFont::load().map_err(|_| MathError::new(MathErrorKind::Font, 0))?;
-    let styles = effective_styles(formula)?;
+    let (styles, reachable) = style_plan(formula)?;
     let mut builder = LayoutBuilder {
         formula,
         font,
@@ -150,6 +159,7 @@ pub(crate) fn layout_formula(
         pixels_per_point,
         limits,
         styles,
+        reachable,
         plans: Vec::with_capacity(formula.arena.nodes.len()),
         placements: Vec::with_capacity(formula.arena.nodes.len()),
         glyphs: Vec::new(),
@@ -161,8 +171,14 @@ pub(crate) fn layout_formula(
 }
 
 /// 样式先自根向下传播，随后节点可按 arena 后序顺序一次完成测量。
+#[cfg(test)]
 fn effective_styles(formula: &ParsedFormula) -> Result<Vec<MathStyle>, MathError> {
+    style_plan(formula).map(|(styles, _)| styles)
+}
+
+fn style_plan(formula: &ParsedFormula) -> Result<(Vec<MathStyle>, Vec<bool>), MathError> {
     let mut styles = vec![formula.style; formula.arena.nodes.len()];
+    let mut reachable = vec![false; formula.arena.nodes.len()];
     let mut stack = vec![(formula.root, formula.style, None::<u16>)];
     while let Some((node_id, inherited, active_scope)) = stack.pop() {
         let node = formula.arena.node(node_id);
@@ -176,6 +192,7 @@ fn effective_styles(formula: &ParsedFormula) -> Result<Vec<MathStyle>, MathError
             return Err(MathError::new(MathErrorKind::Parse, 0));
         };
         *slot = style;
+        reachable[node_id.0 as usize] = true;
 
         let mut push = |child: NodeId, child_style: MathStyle| {
             stack.push((child, child_style, active_scope));
@@ -222,7 +239,7 @@ fn effective_styles(formula: &ParsedFormula) -> Result<Vec<MathStyle>, MathError
             },
         }
     }
-    Ok(styles)
+    Ok((styles, reachable))
 }
 
 fn fraction_child_style(style: MathStyle) -> MathStyle {
@@ -247,6 +264,7 @@ struct LayoutBuilder<'a> {
     pixels_per_point: f32,
     limits: MathLimits,
     styles: Vec<MathStyle>,
+    reachable: Vec<bool>,
     plans: Vec<BoxPlan>,
     placements: Vec<PlacedChild>,
     glyphs: Vec<LocalGlyph>,
@@ -257,6 +275,12 @@ struct LayoutBuilder<'a> {
 impl LayoutBuilder<'_> {
     fn build_all(&mut self) -> Result<(), MathError> {
         for index in 0..self.formula.arena.nodes.len() {
+            // Parser rewrites can leave detached nodes (e.g. an accent glyph).
+            // They neither contribute ink nor require a font glyph or layout.
+            if !self.reachable[index] {
+                self.plans.push(BoxPlan::default());
+                continue;
+            }
             let node = self.formula.arena.nodes[index].clone();
             let child_start = self.placements.len();
             let glyph_start = self.glyphs.len();
@@ -436,6 +460,9 @@ impl LayoutBuilder<'_> {
         character: char,
         class: AtomClass,
     ) -> Result<Geometry, MathError> {
+        if matches!(character, '\r' | '\n') {
+            return Err(MathError::new(MathErrorKind::Parse, 0));
+        }
         let pixel_size = self.pixel_size(index)?;
         let columns = character.width().unwrap_or(1).max(1) as f32;
         // Match the normal terminal font's usual half-em Latin and full-em
@@ -830,6 +857,25 @@ impl LayoutBuilder<'_> {
     ) -> Result<Geometry, MathError> {
         let body_plan = self.plans[body.0 as usize];
         let pixel_size = self.pixel_size(index)?;
+        if accent == '\u{203e}' {
+            // Overbars are rules, not dependent on a U+203E font glyph.
+            let gap = self.constant(MathConstant::OverbarVerticalGap, pixel_size)?;
+            let rule = self.constant(MathConstant::OverbarRuleThickness, pixel_size)?.max(0.5);
+            self.place(body, 0.0, 0.0);
+            self.push_rule(LocalRule {
+                x: 0.0,
+                y: -body_plan.metrics.height - gap - rule,
+                width: body_plan.metrics.width,
+                height: rule,
+            })?;
+            let mut metrics = body_plan.metrics;
+            metrics.height += gap + rule;
+            return Ok(Geometry {
+                metrics,
+                class: Some(AtomClass::Ord),
+                italic_correction: body_plan.italic_correction,
+            });
+        }
         let glyph = self
             .font
             .glyph_id(accent)
diff --git a/nebula_app/src/math/mod.rs b/nebula_app/src/math/mod.rs
index 2db128e..e0fcf99 100644
--- a/nebula_app/src/math/mod.rs
+++ b/nebula_app/src/math/mod.rs
@@ -2,6 +2,7 @@
 //!
 //! 该模块不依赖窗口、OpenGL 或主题类型，保证同一份布局可被不同渲染后端复用。
 
+pub(crate) mod bitmap;
 pub(crate) mod cache;
 mod compile;
 pub(crate) mod font;
diff --git a/nebula_app/src/math/parser.rs b/nebula_app/src/math/parser.rs
index 5895ccb..935850d 100644
--- a/nebula_app/src/math/parser.rs
+++ b/nebula_app/src/math/parser.rs
@@ -37,11 +37,74 @@ pub(crate) fn parse_formula_source(
     limits: MathLimits,
 ) -> Result<ParsedFormula, MathError> {
     validate(source, limits)?;
+    reject_ambiguous_row_breaks(source)?;
     let source = super::compile::brace_unbraced_fraction_arguments(source)
         .map(Cow::Owned)
         .unwrap_or(Cow::Borrowed(source));
     let style = if display { MathStyle::Display } else { MathStyle::Text };
-    parse_normalized_formula(source.as_ref(), display, style, limits)
+    let presentation = substitute_unsupported_presentation(source.as_ref());
+    parse_normalized_formula(presentation.as_ref(), display, style, limits)
+}
+
+/// A lone line-ending backslash in a matrix can be accepted as TeX space,
+/// silently flattening several damaged rows into one. Literal documents keep
+/// that ambiguous source visible. Terminal transport repair runs separately.
+fn reject_ambiguous_row_breaks(source: &str) -> Result<(), MathError> {
+    let bytes = source.as_bytes();
+    let mut environments = Vec::new();
+    let mut at = 0;
+    while at < bytes.len() {
+        if bytes[at] == b'%' {
+            at += source[at..].find('\n').unwrap_or(bytes.len() - at);
+            continue;
+        }
+        if bytes[at] != b'\\' {
+            at += 1;
+            continue;
+        }
+        let start = at;
+        at += 1;
+        if bytes.get(at) == Some(&b'\\') {
+            at += 1;
+            continue;
+        }
+        if bytes.get(at).is_some_and(|byte| matches!(byte, b'\r' | b'\n'))
+            && environments.iter().any(|structured| *structured)
+        {
+            return Err(MathError::new(MathErrorKind::Parse, start));
+        }
+        let end = at + source[at..].bytes().take_while(u8::is_ascii_alphabetic).count();
+        match &source[at..end] {
+            "begin" | "end" => {
+                if let Some(group) = brace_group(source, end) {
+                    if &source[at..end] == "begin" {
+                        let name = &source[group.clone()];
+                        environments.push(
+                            name.contains("matrix")
+                                || name.contains("align")
+                                || matches!(
+                                    name,
+                                    "array"
+                                        | "cases"
+                                        | "rcases"
+                                        | "split"
+                                        | "gathered"
+                                        | "gather"
+                                        | "multline"
+                                ),
+                        );
+                    } else {
+                        environments.pop();
+                    }
+                    at = group.end + 1;
+                } else {
+                    at = end;
+                }
+            },
+            _ => at = end.max(at + usize::from(at < bytes.len())),
+        }
+    }
+    Ok(())
 }
 
 fn parse_normalized_formula(
@@ -722,7 +785,9 @@ impl Builder {
     ) -> Result<NodeId, MathError> {
         match content {
             Content::Text(text) => self.characters_node(
-                text.chars(),
+                text.chars().map(
+                    |character| if matches!(character, '\r' | '\n') { ' ' } else { character },
+                ),
                 AtomClass::Ord,
                 ParseState { variant: FontVariant::UpRight, ..state },
             ),
diff --git a/nebula_app/src/nebula_history.rs b/nebula_app/src/nebula_history.rs
index 9cb02f5..aa5c42e 100644
--- a/nebula_app/src/nebula_history.rs
+++ b/nebula_app/src/nebula_history.rs
@@ -165,6 +165,29 @@ impl NebulaHistory {
         ));
     }
 
+    /// Popup search retains the stored spelling and ranks ties by recency.
+    /// Inline ghost suggestions remain literal suffixes of the current input.
+    pub fn search(&self, scope: &HistoryScope, text: &str, limit: usize) -> Vec<&str> {
+        if text.trim().is_empty() || limit == 0 {
+            return Vec::new();
+        }
+        let Some(pool) = self.pools.get(&scope.clone().normalized()) else { return Vec::new() };
+        let mut query = nebula_completions::command_search::CommandQuery::new(text);
+        let mut matches: Vec<_> = pool
+            .entries
+            .iter()
+            .enumerate()
+            .filter_map(|(index, command)| {
+                (command != text)
+                    .then(|| query.score(command))
+                    .flatten()
+                    .map(|score| (score, index, command.as_str()))
+            })
+            .collect();
+        matches.sort_by(|a, b| b.0.cmp(&a.0).then(b.1.cmp(&a.1)));
+        matches.into_iter().take(limit).map(|(_, _, command)| command).collect()
+    }
+
     pub fn hint(&self, scope: &HistoryScope, prefix: &str) -> Option<&str> {
         self.pools.get(&scope.clone().normalized())?.hint(prefix)
     }
@@ -287,6 +310,44 @@ pub(crate) fn record_category_file(line: &str) -> Option<&'static str> {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn popup_search_ignores_case_and_keeps_remote_history_scoped() {
+        let local = super::HistoryScope::Local;
+        let mut history =
+            hist(local.clone(), &["Docker compose up", "docker compose logs", "git status"]);
+        history
+            .pools
+            .entry(super::HistoryScope::Wsl("ubuntu".into()))
+            .or_default()
+            .insert("docker remote-only".into());
+        assert_eq!(
+            history.search(&local, "COMPOSE DOCKER", 8),
+            vec!["docker compose logs", "Docker compose up"]
+        );
+        assert_eq!(history.search(&local, "dck cmp", 1), vec!["docker compose logs"]);
+        assert!(history.search(&local, "remote-only", 8).is_empty());
+        assert_eq!(
+            history.hint(&local, "DOCKER"),
+            None,
+            "an inline suffix cannot correct a prefix's spelling"
+        );
+    }
+
+    #[test]
+    #[ignore = "informational cost measurement with a populated local history"]
+    fn popup_search_cost_for_full_history() {
+        let scope = super::HistoryScope::Local;
+        let mut history = super::NebulaHistory::default();
+        let pool = history.pools.entry(scope.clone()).or_default();
+        for index in 0..5000 {
+            pool.insert(format!("docker compose -p service-{index} logs --tail 100"));
+        }
+        let started = std::time::Instant::now();
+        for _ in 0..100 {
+            std::hint::black_box(history.search(&scope, "DCK CMP logs", 8));
+        }
+        println!("100 popup queries over 5000 history entries: {:?}", started.elapsed());
+    }
     use super::*;
 
     fn hist(scope: HistoryScope, cmds: &[&str]) -> NebulaHistory {
diff --git a/nebula_app/src/notify.rs b/nebula_app/src/notify.rs
index 2e0be1c..571c0a7 100644
--- a/nebula_app/src/notify.rs
+++ b/nebula_app/src/notify.rs
@@ -106,6 +106,18 @@ pub enum Notification {
 }
 
 impl Notification {
+    /// Source classification only. In-app preferences must not silence native
+    /// notifications or infer an AI source from arbitrary message text.
+    pub(crate) fn is_ai(&self) -> bool {
+        let program = match self {
+            Self::AiTurn { .. } => return true,
+            Self::Bell { program }
+            | Self::CommandDone { program, .. }
+            | Self::Text { program, .. } => program.as_deref(),
+        };
+        program.is_some_and(|program| crate::ai_agents::AgentKind::parse(program).is_some())
+    }
+
     /// Toast title + body. Title names the source ("Pebrel" or the program);
     /// body carries the human detail.
     pub(crate) fn toast_text(&self) -> (String, String) {
@@ -341,6 +353,54 @@ fn toast_clickable(title: &str, body: &str, _activation: Option<ToastActivation>
 mod delivery_tests {
     use super::*;
 
+    #[test]
+    fn every_registered_ai_is_recognized_for_bell_text_and_command_events() {
+        for agent in crate::ai_agents::AgentKind::ALL {
+            let program = Some(agent.slug().to_owned());
+            assert!(Notification::Bell { program: program.clone() }.is_ai());
+            assert!(
+                Notification::Text { body: "done".to_owned(), program: program.clone() }.is_ai()
+            );
+            assert!(
+                Notification::CommandDone { duration: Duration::from_secs(12), program }.is_ai()
+            );
+        }
+    }
+
+    #[test]
+    fn typed_ai_events_and_executable_aliases_keep_their_source_identity() {
+        for attention in [false, true] {
+            assert!(
+                Notification::AiTurn {
+                    program: "custom-agent".to_owned(),
+                    message: None,
+                    attention,
+                }
+                .is_ai()
+            );
+        }
+        for program in [r"C:\tools\CODEX.EXE", "/usr/bin/claude-code", "gemini-cli"] {
+            assert!(Notification::Bell { program: Some(program.to_owned()) }.is_ai());
+        }
+    }
+
+    #[test]
+    fn ordinary_notifications_are_not_classified_from_their_text() {
+        for program in [None, Some("cargo".to_owned()), Some("powershell".to_owned())] {
+            assert!(!Notification::Bell { program: program.clone() }.is_ai());
+            assert!(
+                !Notification::Text {
+                    body: "codex claude permission required".to_owned(),
+                    program: program.clone(),
+                }
+                .is_ai()
+            );
+            assert!(
+                !Notification::CommandDone { duration: Duration::from_secs(12), program }.is_ai()
+            );
+        }
+    }
+
     #[test]
     fn pane_throttle_does_not_suppress_another_pane_or_attention() {
         let now = Instant::now();
@@ -500,7 +560,7 @@ mod win {
         set_reg_sz(&subkey, "DisplayName", crate::brand::NAME)?;
         match ensure_icon_file(variant) {
             Some(icon) => set_reg_sz(&subkey, "IconUri", &icon.display().to_string())?,
-            None => log::debug!("notify: toast icon not materialized; banner shows no logo"),
+            None => return Err("could not materialize the notification icon".into()),
         }
         Ok(())
     }
@@ -513,11 +573,17 @@ mod win {
     fn ensure_icon_file(variant: nebula_settings::AppIconName) -> Option<PathBuf> {
         let bytes = crate::app_icon::png(variant, 256)?;
         let directory = crate::platform::dirs::data_dir();
-        let path = directory.join(format!("toast_icon-{}.png", variant.settings_value()));
+        // Windows caches the attribution icon separately from the body logo.
+        // A content-addressed URI invalidates both caches after artwork changes.
+        use sha2::{Digest as _, Sha256};
+        let digest = Sha256::digest(bytes.as_ref());
+        let fingerprint = digest[..12].iter().map(|byte| format!("{byte:02x}")).collect::<String>();
+        let path =
+            directory.join(format!("pebrel-toast-{}-{fingerprint}.png", variant.settings_value()));
         let stale = std::fs::read(&path).ok().as_deref() != Some(bytes.as_ref());
         if stale {
             std::fs::create_dir_all(directory).ok()?;
-            std::fs::write(&path, bytes).ok()?;
+            crate::atomic_file::write(&path, bytes.as_ref()).ok()?;
         }
         Some(path)
     }
diff --git a/nebula_app/src/platform/ai_session_identity.rs b/nebula_app/src/platform/ai_session_identity.rs
new file mode 100644
index 0000000..7cdc85e
--- /dev/null
+++ b/nebula_app/src/platform/ai_session_identity.rs
@@ -0,0 +1,470 @@
+//! Recover an AI CLI session identity when the CLI hook was not present.
+//!
+//! Codex keeps the active rollout open, and its process environment carries
+//! the pane id injected by the PTY launcher.  That gives us an exact binding
+//! between a pane and a rollout without guessing from cwd or modification
+//! time.  The probe is intentionally small and is only called by a background
+//! task; UI code must never scan `/proc` or start `wsl.exe` synchronously.
+
+use std::io::{self, BufRead as _, Read};
+use std::path::Path;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+const PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+const MAX_PROBE_OUTPUT: usize = 64 * 1024;
+const MAX_PROBE_LINE: usize = 64 * 1024;
+const MAX_PROBE_RECORDS: usize = 128;
+
+const PROBE_SCRIPT: &str = r###"
+pane="$1"
+instance="$2"
+for proc in /proc/[0-9]*; do
+    pid=${proc##*/}
+    comm=$(cat "$proc/comm" 2>/dev/null || true)
+    case "$comm" in
+        codex|codex.exe|codex-*) ;;
+        *) continue ;;
+    esac
+    [ -r "$proc/environ" ] || continue
+    environment=$(tr "\0" "\n" < "$proc/environ" 2>/dev/null || true)
+    pane_id=$(printf '%s\n' "$environment" | sed -n "s/^PEBREL_PANE_ID=//p" | head -n 1)
+    if [ "$pane_id" != "$pane" ]; then
+        pane_id=$(printf '%s\n' "$environment" | sed -n "s/^NEBULA_PANE_ID=//p" | head -n 1)
+    fi
+    process_id=$(printf '%s\n' "$environment" | sed -n "s/^PEBREL_PROCESS_ID=//p" | head -n 1)
+    [ "$pane_id" = "$pane" ] && [ "$process_id" = "$instance" ] || continue
+    codex_root=$(printf '%s\n' "$environment" | sed -n "s/^CODEX_HOME=//p" | head -n 1)
+    if [ -z "$codex_root" ]; then
+        guest_home=$(printf '%s\n' "$environment" | sed -n "s/^HOME=//p" | head -n 1)
+        [ -n "$guest_home" ] || continue
+        codex_root="$guest_home/.codex"
+    fi
+    for fd in "$proc"/fd/*; do
+        link=$(readlink "$fd" 2>/dev/null || true)
+        case "$link" in
+            "$codex_root"/sessions/*/rollout-*.jsonl)
+                first=$(head -n 1 "$fd" 2>/dev/null || true)
+                [ -n "$first" ] || continue
+                printf '%s\t%s\t%s\t%s\n' "$pid" "${fd##*/}" "$link" "$first"
+                ;;
+        esac
+    done
+done
+"###;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct ProbeRecord {
+    _pid: u32,
+    _fd: u32,
+    link: String,
+    first_line: String,
+}
+
+/// Probe the active Codex rollout for one pane.
+///
+/// WSL panes are inspected inside the guest because Windows Toolhelp cannot
+/// see Linux descendants or their `/proc/<pid>/fd` handles.  Unix hosts use
+/// the same exact environment/fd contract directly.  Windows-native Codex is
+/// deliberately left to the hook path: there is no safe, dependency-free
+/// equivalent of `/proc/<pid>/fd` for proving which open rollout belongs to a
+/// pane.
+pub(crate) fn probe_codex_session(
+    pane_id: u64,
+    exec_context: Option<&crate::runtime_exec::PaneExecContext>,
+) -> Option<String> {
+    let pane_id = pane_id.to_string();
+    let context = exec_context?;
+    let instance = context.process_instance()?;
+    if let Some(distro) = context.wsl_distribution() {
+        return probe_wsl(distro, context.wsl_user(), &pane_id, instance);
+    }
+
+    #[cfg(unix)]
+    {
+        return probe_local_proc(&pane_id, instance);
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = (pane_id, instance);
+        None
+    }
+}
+
+fn parse_probe_records(output: &str) -> Option<String> {
+    let mut candidate = None;
+    for record in output.lines().filter_map(parse_probe_record) {
+        let Ok(meta) = serde_json::from_str::<serde_json::Value>(&record.first_line) else {
+            continue;
+        };
+        if meta.get("type").and_then(serde_json::Value::as_str) != Some("session_meta") {
+            continue;
+        }
+        let payload = meta.get("payload").unwrap_or(&meta);
+        let Some(id) = payload.get("id").and_then(serde_json::Value::as_str) else {
+            continue;
+        };
+        if !valid_uuid(id) {
+            continue;
+        }
+        // Codex's main interactive thread is marked as a CLI/user thread.
+        // Keep accepting older session_meta lines that lack these fields, but
+        // reject an explicit guardian/sub-agent marker.
+        if !matches_optional_string(payload, &meta, "source", "cli")
+            || !matches_optional_string(payload, &meta, "thread_source", "user")
+        {
+            continue;
+        }
+        let Some(filename_id) = rollout_id(Path::new(&record.link)) else { continue };
+        if filename_id != id {
+            continue;
+        }
+        if candidate.as_ref().is_some_and(|existing| existing != id) {
+            // More than one distinct main/user rollout is ambiguous.  A
+            // process can have guardian/sub-agent files open, but it must not
+            // have two possible user conversations silently choose one.
+            return None;
+        }
+        candidate = Some(id.to_owned());
+    }
+    candidate
+}
+
+fn parse_probe_record(line: &str) -> Option<ProbeRecord> {
+    let mut fields = line.splitn(4, '\t');
+    Some(ProbeRecord {
+        _pid: fields.next()?.parse().ok()?,
+        _fd: fields.next()?.parse().ok()?,
+        link: fields.next()?.to_owned(),
+        first_line: fields.next()?.to_owned(),
+    })
+}
+
+fn matches_optional_string(
+    payload: &serde_json::Value,
+    root: &serde_json::Value,
+    key: &str,
+    expected: &str,
+) -> bool {
+    payload
+        .get(key)
+        .or_else(|| root.get(key))
+        .map_or(true, |value| value.as_str() == Some(expected))
+}
+
+fn valid_uuid(id: &str) -> bool {
+    id.len() == 36
+        && id.as_bytes().iter().enumerate().all(|(index, byte)| {
+            if matches!(index, 8 | 13 | 18 | 23) { *byte == b'-' } else { byte.is_ascii_hexdigit() }
+        })
+}
+
+fn rollout_id(path: &Path) -> Option<String> {
+    let stem = path.file_stem()?.to_str()?;
+    let start = stem.len().checked_sub(36)?;
+    let id = stem.get(start..)?;
+    valid_uuid(id).then(|| id.to_owned())
+}
+
+fn probe_wsl(
+    distro: Option<&str>,
+    user: Option<&str>,
+    pane_id: &str,
+    instance: &str,
+) -> Option<String> {
+    let mut command = Command::new("wsl.exe");
+    command.args(wsl_probe_args(distro, user, pane_id, instance));
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt as _;
+        command.creation_flags(0x0800_0000); // CREATE_NO_WINDOW
+    }
+    run_probe_command(command)
+}
+
+fn wsl_probe_args(
+    distro: Option<&str>,
+    user: Option<&str>,
+    pane_id: &str,
+    instance: &str,
+) -> Vec<String> {
+    let mut args = Vec::with_capacity(9);
+    if let Some(distro) = distro {
+        args.extend(["--distribution".to_owned(), distro.to_owned()]);
+    }
+    if let Some(user) = user {
+        args.extend(["--user".to_owned(), user.to_owned()]);
+    }
+    args.extend([
+        "--exec".to_owned(),
+        "sh".to_owned(),
+        "-c".to_owned(),
+        PROBE_SCRIPT.to_owned(),
+        "pebrel-ai-session-probe".to_owned(),
+        pane_id.to_owned(),
+        instance.to_owned(),
+    ]);
+    args
+}
+
+/// Run the guest probe without allowing a broken WSL instance to hold a
+/// background executor worker forever.  stdout is drained on a helper thread
+/// so a noisy or malformed process cannot deadlock on a full pipe; the result
+/// is capped before it reaches the parser.
+fn run_probe_command(mut command: Command) -> Option<String> {
+    command.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::null());
+    let mut child = command.spawn().ok()?;
+    let Some(stdout) = child.stdout.take() else {
+        let _ = child.kill();
+        let _ = child.wait();
+        return None;
+    };
+    let (sender, receiver) = std::sync::mpsc::sync_channel(1);
+    let reader = std::thread::Builder::new().name("pebrel-ai-session-probe-read".to_owned()).spawn(
+        move || {
+            let result = read_bounded(stdout, MAX_PROBE_OUTPUT);
+            let _ = sender.send(result);
+        },
+    );
+    if reader.is_err() {
+        let _ = child.kill();
+        let _ = child.wait();
+        return None;
+    }
+    let deadline = Instant::now() + PROBE_TIMEOUT;
+    let status = loop {
+        match child.try_wait() {
+            Ok(Some(status)) => break status,
+            Ok(None) if Instant::now() < deadline => {
+                std::thread::sleep(Duration::from_millis(10));
+            },
+            Ok(None) => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            },
+            Err(_) => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            },
+        }
+    };
+    // A descendant can inherit stdout after wsl.exe itself exits.  Waiting on
+    // the reader join handle here would make a successful probe unbounded, so
+    // use the same deadline for the bounded reader result and abandon it if
+    // the pipe never closes.
+    let output =
+        receiver.recv_timeout(deadline.saturating_duration_since(Instant::now())).ok()?.ok()?;
+    status.success().then(|| parse_probe_records(&String::from_utf8_lossy(&output)))?
+}
+
+fn read_bounded(mut reader: impl Read, limit: usize) -> io::Result<Vec<u8>> {
+    let mut output = Vec::with_capacity(limit.min(8 * 1024));
+    let mut buffer = [0_u8; 8 * 1024];
+    loop {
+        let read = reader.read(&mut buffer)?;
+        if read == 0 {
+            return Ok(output);
+        }
+        let remaining = limit.saturating_sub(output.len());
+        if read > remaining {
+            return Err(io::Error::new(io::ErrorKind::InvalidData, "probe output exceeded limit"));
+        }
+        output.extend_from_slice(&buffer[..read]);
+    }
+}
+
+#[cfg(unix)]
+fn probe_local_proc(pane_id: &str, instance: &str) -> Option<String> {
+    let mut output = String::new();
+    let mut records = 0;
+    for entry in std::fs::read_dir("/proc").ok()?.flatten() {
+        let name = entry.file_name();
+        let Some(pid) = name.to_str().and_then(|name| name.parse::<u32>().ok()) else {
+            continue;
+        };
+        let proc_dir = entry.path();
+        let Ok(comm) = std::fs::read_to_string(proc_dir.join("comm")) else { continue };
+        if !is_codex_process_name(comm.trim()) {
+            continue;
+        }
+        let Ok(environment) = std::fs::read(proc_dir.join("environ")) else { continue };
+        if !environment_has_value(&environment, b"PEBREL_PANE_ID", pane_id.as_bytes())
+            && !environment_has_value(&environment, b"NEBULA_PANE_ID", pane_id.as_bytes())
+        {
+            continue;
+        }
+        if !environment_has_value(
+            &environment,
+            crate::agent_env::PROCESS_ENV.as_bytes(),
+            instance.as_bytes(),
+        ) {
+            continue;
+        }
+        let Some(codex_home) = codex_home_from_environment(&environment) else {
+            continue;
+        };
+        let Ok(fds) = std::fs::read_dir(proc_dir.join("fd")) else { continue };
+        for fd in fds.flatten() {
+            let fd_path = fd.path();
+            let Ok(link) = std::fs::read_link(&fd_path) else { continue };
+            if !is_rollout_link(&link, &codex_home) {
+                continue;
+            }
+            let Ok(first_line) = read_first_line(&fd_path) else { continue };
+            let fd_number = fd.file_name().to_string_lossy().parse::<u32>().ok();
+            let Some(fd_number) = fd_number else { continue };
+            use std::fmt::Write as _;
+            let _ = writeln!(output, "{pid}\t{fd_number}\t{}\t{first_line}", link.display());
+            records += 1;
+            if records >= MAX_PROBE_RECORDS || output.len() >= MAX_PROBE_OUTPUT {
+                break;
+            }
+        }
+        if records >= MAX_PROBE_RECORDS || output.len() >= MAX_PROBE_OUTPUT {
+            break;
+        }
+    }
+    parse_probe_records(&output)
+}
+
+#[cfg(unix)]
+fn is_codex_process_name(name: &str) -> bool {
+    matches!(name, "codex" | "codex.exe") || name.starts_with("codex-")
+}
+
+#[cfg(unix)]
+fn environment_has_value(environment: &[u8], key: &[u8], expected: &[u8]) -> bool {
+    let mut prefix = Vec::with_capacity(key.len() + 1);
+    prefix.extend_from_slice(key);
+    prefix.push(b'=');
+    environment
+        .split(|byte| *byte == 0)
+        .any(|item| item.strip_prefix(&prefix).is_some_and(|value| value == expected))
+}
+
+#[cfg(unix)]
+fn environment_value<'a>(environment: &'a [u8], key: &[u8]) -> Option<&'a [u8]> {
+    let mut prefix = Vec::with_capacity(key.len() + 1);
+    prefix.extend_from_slice(key);
+    prefix.push(b'=');
+    environment
+        .split(|byte| *byte == 0)
+        .find_map(|item| item.strip_prefix(&prefix))
+        .filter(|value| !value.is_empty())
+}
+
+#[cfg(unix)]
+fn codex_home_from_environment(environment: &[u8]) -> Option<std::path::PathBuf> {
+    use std::ffi::OsStr;
+    use std::os::unix::ffi::OsStrExt as _;
+
+    let home = environment_value(environment, b"CODEX_HOME")
+        .or_else(|| environment_value(environment, b"HOME"))?;
+    let home = std::path::PathBuf::from(OsStr::from_bytes(home));
+    if environment_value(environment, b"CODEX_HOME").is_some() {
+        Some(home)
+    } else {
+        Some(home.join(".codex"))
+    }
+}
+
+#[cfg(unix)]
+fn is_rollout_link(link: &Path, codex_home: &Path) -> bool {
+    let sessions = codex_home.join("sessions");
+    link.strip_prefix(sessions).is_ok_and(|relative| {
+        relative.components().count() >= 2
+            && link
+                .file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| name.starts_with("rollout-") && name.ends_with(".jsonl"))
+    })
+}
+
+#[cfg(unix)]
+fn read_first_line(path: &Path) -> std::io::Result<String> {
+    use std::io::BufReader;
+    let file = std::fs::File::open(path)?;
+    let mut line = String::new();
+    BufReader::new(file).take(MAX_PROBE_LINE as u64).read_line(&mut line)?;
+    if !line.ends_with(['\r', '\n']) && line.len() >= MAX_PROBE_LINE {
+        return Err(io::Error::new(io::ErrorKind::InvalidData, "session metadata line too long"));
+    }
+    Ok(line.trim_end_matches(['\r', '\n']).to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ROOT_ID: &str = "01a079fa-4a9b-7d93-8a4a-4a7a9edaf247";
+    const GUARDIAN_ID: &str = "01a079f7-7e36-7232-882b-f06d3bde9df8";
+
+    #[test]
+    fn selects_cli_user_rollout_and_rejects_guardian_thread() {
+        let output = format!(
+            "1996\t37\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{ROOT_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{ROOT_ID}\",\"source\":\"cli\",\"thread_source\":\"user\"}}}}\n1996\t80\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{GUARDIAN_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{GUARDIAN_ID}\",\"source\":\"cli\",\"thread_source\":\"guardian\"}}}}\n"
+        );
+        assert_eq!(parse_probe_records(&output).as_deref(), Some(ROOT_ID));
+    }
+
+    #[test]
+    fn rejects_a_rollout_bound_to_a_different_filename() {
+        let output = format!(
+            "1996\t37\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{ROOT_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{GUARDIAN_ID}\"}}}}\n"
+        );
+        assert_eq!(parse_probe_records(&output), None);
+    }
+
+    #[test]
+    fn accepts_legacy_session_meta_without_thread_markers() {
+        let output = format!(
+            "1996\t37\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{ROOT_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{ROOT_ID}\"}}}}\n"
+        );
+        assert_eq!(parse_probe_records(&output).as_deref(), Some(ROOT_ID));
+    }
+
+    #[test]
+    fn wsl_probe_keeps_named_distribution_and_pane_as_arguments() {
+        let full = wsl_probe_args(Some("Debian"), Some("hello"), "7", "42");
+        let named: Vec<_> = full.iter().map(String::as_str).take(5).collect();
+        assert_eq!(named, vec!["--distribution", "Debian", "--user", "hello", "--exec"]);
+        let args = wsl_probe_args(None, None, "7", "42");
+        assert_eq!(args.first().map(String::as_str), Some("--exec"));
+        assert_eq!(args[args.len() - 2], "7");
+        assert_eq!(args.last().map(String::as_str), Some("42"));
+        assert_eq!(args[args.len() - 3], "pebrel-ai-session-probe");
+    }
+
+    #[test]
+    fn explicit_subagent_markers_are_not_accepted_as_the_main_thread() {
+        let output = format!(
+            "1996\t37\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{ROOT_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{ROOT_ID}\",\"source\":\"subagent\",\"thread_source\":\"user\"}}}}\n"
+        );
+        assert_eq!(parse_probe_records(&output), None);
+    }
+
+    #[test]
+    fn multiple_distinct_main_rollouts_are_rejected_as_ambiguous() {
+        let output = format!(
+            "1996\t37\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{ROOT_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{ROOT_ID}\",\"source\":\"cli\"}}}}\n1996\t38\t/home/hello/.codex/sessions/2026/09/07/rollout-x-{GUARDIAN_ID}.jsonl\t{{\"type\":\"session_meta\",\"payload\":{{\"id\":\"{GUARDIAN_ID}\",\"source\":\"cli\"}}}}\n"
+        );
+        assert_eq!(parse_probe_records(&output), None);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn custom_codex_home_is_used_instead_of_the_default_directory() {
+        let environment = b"HOME=/home/hello\0CODEX_HOME=/srv/codex-data\0";
+        assert_eq!(
+            codex_home_from_environment(environment).as_deref(),
+            Some(Path::new("/srv/codex-data"))
+        );
+        let environment = b"HOME=/home/hello\0";
+        assert_eq!(
+            codex_home_from_environment(environment).as_deref(),
+            Some(Path::new("/home/hello/.codex"))
+        );
+    }
+}
diff --git a/nebula_app/src/platform/file_drag/mod.rs b/nebula_app/src/platform/file_drag/mod.rs
new file mode 100644
index 0000000..90aea49
--- /dev/null
+++ b/nebula_app/src/platform/file_drag/mod.rs
@@ -0,0 +1,160 @@
+//! Native outbound file drags. The source owns materialization and resource lifetime.
+
+use std::io;
+use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+
+#[cfg(windows)]
+mod windows;
+
+#[derive(Clone, Debug)]
+pub(crate) struct DragFile {
+    pub relative_path: PathBuf,
+    pub directory: bool,
+    pub size: u64,
+}
+
+pub(crate) struct MaterializedFile {
+    pub path: PathBuf,
+    /// Returned streams retain this lease, including cloned streams.
+    pub lease: Arc<dyn Send + Sync>,
+    pub cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+}
+
+pub(crate) type Manifest = Arc<dyn Fn() -> io::Result<Vec<DragFile>> + Send + Sync>;
+
+pub(crate) type Materialize = Arc<dyn Fn(usize) -> io::Result<MaterializedFile> + Send + Sync>;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum DragOutcome {
+    Copied,
+    Cancelled,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct DragOrigin {
+    thread: u32,
+}
+
+impl DragOrigin {
+    /// Capture on the source window thread before handing work to the STA worker.
+    pub(crate) fn capture() -> Self {
+        #[cfg(windows)]
+        return Self {
+            thread: unsafe { windows_sys::Win32::System::Threading::GetCurrentThreadId() },
+        };
+        #[cfg(not(windows))]
+        Self { thread: 0 }
+    }
+}
+
+pub(crate) fn supported() -> bool {
+    cfg!(windows)
+}
+
+/// Called on the window thread when GPUI hands a drag to the native adapter.
+pub(crate) fn release_pointer() {
+    #[cfg(windows)]
+    unsafe {
+        windows_sys::Win32::UI::Input::KeyboardAndMouse::ReleaseCapture();
+    }
+}
+
+/// Runs on a dedicated worker, never the GPUI or network executor thread.
+pub(crate) fn run(
+    origin: DragOrigin,
+    files: Manifest,
+    materialize: Materialize,
+    cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+) -> io::Result<DragOutcome> {
+    #[cfg(windows)]
+    return windows::run(origin, files, materialize, cancelled);
+    #[cfg(not(windows))]
+    {
+        let _ = (origin, files, materialize, cancelled);
+        Err(io::Error::new(io::ErrorKind::Unsupported, "Native file drag is unavailable"))
+    }
+}
+
+fn validate_manifest(files: &[DragFile]) -> io::Result<()> {
+    if files.is_empty() || files.len() > 100_000 {
+        return Err(io::Error::new(io::ErrorKind::InvalidInput, "Invalid drag file count"));
+    }
+    let mut names = std::collections::HashSet::new();
+    for file in files {
+        validate_relative_path(&file.relative_path)?;
+        let name = file.relative_path.to_string_lossy().replace('/', "\\").to_lowercase();
+        if !names.insert(name) {
+            return Err(io::Error::new(io::ErrorKind::InvalidInput, "Duplicate Windows file name"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_relative_path(path: &Path) -> io::Result<()> {
+    let invalid = || io::Error::new(io::ErrorKind::InvalidInput, "Invalid Windows drag file name");
+    let value = path.to_str().ok_or_else(invalid)?;
+    if value.is_empty() || value.encode_utf16().count() >= 260 || path.is_absolute() {
+        return Err(invalid());
+    }
+    if path.components().any(|part| !matches!(part, Component::Normal(_))) {
+        return Err(invalid());
+    }
+    for name in value.split(['/', '\\']) {
+        if name.is_empty()
+            || matches!(name, "." | "..")
+            || name.ends_with([' ', '.'])
+            || name.chars().any(|c| c.is_control() || "<>:\"|?*".contains(c))
+        {
+            return Err(invalid());
+        }
+        let stem = name.split('.').next().unwrap_or_default().to_ascii_uppercase();
+        if matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL")
+            || ["COM", "LPT"].iter().any(|prefix| {
+                stem.strip_prefix(prefix).is_some_and(|n| {
+                    matches!(
+                        n,
+                        "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "¹" | "²" | "³"
+                    )
+                })
+            })
+        {
+            return Err(invalid());
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_paths_that_escape_or_change_identity_on_windows() {
+        for name in [
+            "../secret",
+            "a/../b",
+            "a\\..\\b",
+            "/absolute",
+            "C:\\absolute",
+            "a:b",
+            "CON.txt",
+            "lpt1",
+            "x.",
+            "x ",
+            "a\0b",
+        ] {
+            assert!(validate_relative_path(Path::new(name)).is_err(), "{name:?}");
+        }
+        assert!(validate_relative_path(Path::new("部署资料/配置 文件.txt")).is_ok());
+    }
+
+    #[test]
+    fn rejects_case_collisions_before_a_copy_can_overwrite_another_file() {
+        let files: Vec<_> = ["a.txt", "A.TXT"]
+            .into_iter()
+            .map(|name| DragFile { relative_path: name.into(), directory: false, size: 1 })
+            .collect();
+        assert!(validate_manifest(&files).is_err());
+    }
+}
diff --git a/nebula_app/src/platform/file_drag/windows.rs b/nebula_app/src/platform/file_drag/windows.rs
new file mode 100644
index 0000000..db86781
--- /dev/null
+++ b/nebula_app/src/platform/file_drag/windows.rs
@@ -0,0 +1,340 @@
+//! OLE virtual files let Explorer choose the destination and handle copy conflicts.
+
+mod stream;
+#[cfg(test)]
+mod tests;
+
+use super::*;
+use ::windows::Win32::Foundation::*;
+use ::windows::Win32::System::Com::*;
+use ::windows::Win32::System::DataExchange::RegisterClipboardFormatW;
+use ::windows::Win32::System::Memory::*;
+use ::windows::Win32::System::Ole::*;
+use ::windows::Win32::System::SystemServices::{MK_LBUTTON, MODIFIERKEYS_FLAGS};
+use ::windows::Win32::UI::Input::KeyboardAndMouse::{GetAsyncKeyState, VK_LBUTTON};
+use ::windows::Win32::UI::Shell::{
+    FD_ATTRIBUTES, FD_FILESIZE, FILEDESCRIPTORW, SHCreateStdEnumFmtEtc,
+};
+use ::windows::core::{BOOL, HRESULT, Ref, implement, w};
+use std::mem::{ManuallyDrop, size_of};
+use std::sync::{Mutex, OnceLock};
+
+#[cfg(test)]
+static DRAG_PROBE_READY: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+fn error(code: HRESULT) -> ::windows::core::Error {
+    code.into()
+}
+
+#[implement(IDropSource)]
+struct DropSource {
+    cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+}
+
+impl IDropSource_Impl for DropSource_Impl {
+    fn QueryContinueDrag(&self, escape: BOOL, keys: MODIFIERKEYS_FLAGS) -> HRESULT {
+        #[cfg(test)]
+        {
+            DRAG_PROBE_READY.store(true, std::sync::atomic::Ordering::Release);
+        }
+        if escape.as_bool() || (self.cancelled)() {
+            DRAGDROP_S_CANCEL
+        } else if keys.0 & MK_LBUTTON.0 == 0
+            || unsafe { GetAsyncKeyState(VK_LBUTTON.0 as i32) } >= 0
+        {
+            DRAGDROP_S_DROP
+        } else {
+            S_OK
+        }
+    }
+
+    fn GiveFeedback(&self, _: DROPEFFECT) -> HRESULT {
+        DRAGDROP_S_USEDEFAULTCURSORS
+    }
+}
+
+#[implement(IDataObject)]
+struct DataObject {
+    files: OnceLock<Result<Vec<DragFile>, String>>,
+    describe: Manifest,
+    materialize: Materialize,
+    cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+    failure: Arc<Mutex<Option<String>>>,
+    descriptors_format: u16,
+    contents_format: u16,
+}
+
+impl DataObject {
+    fn formats(&self) -> [FORMATETC; 2] {
+        [
+            FORMATETC {
+                cfFormat: self.descriptors_format,
+                dwAspect: DVASPECT_CONTENT.0,
+                lindex: -1,
+                tymed: TYMED_HGLOBAL.0 as u32,
+                ..Default::default()
+            },
+            FORMATETC {
+                cfFormat: self.contents_format,
+                dwAspect: DVASPECT_CONTENT.0,
+                lindex: -1,
+                tymed: TYMED_ISTREAM.0 as u32,
+                ..Default::default()
+            },
+        ]
+    }
+
+    fn manifest(&self) -> ::windows::core::Result<&[DragFile]> {
+        let result = self.files.get_or_init(|| {
+            (self.describe)()
+                .and_then(|files| {
+                    super::validate_manifest(&files)?;
+                    Ok(files)
+                })
+                .map_err(|failure| failure.to_string())
+        });
+        match result {
+            Ok(files) => Ok(files),
+            Err(message) => {
+                *self.failure.lock().unwrap_or_else(|e| e.into_inner()) = Some(message.clone());
+                Err(error(E_FAIL))
+            },
+        }
+    }
+
+    fn query(&self, format: &FORMATETC) -> HRESULT {
+        if format.dwAspect != DVASPECT_CONTENT.0 {
+            return DV_E_DVASPECT;
+        }
+        if !format.ptd.is_null() {
+            return DV_E_DVTARGETDEVICE;
+        }
+        if format.cfFormat == self.descriptors_format && format.lindex == -1 {
+            return if format.tymed & TYMED_HGLOBAL.0 as u32 != 0 { S_OK } else { DV_E_TYMED };
+        }
+        if format.cfFormat == self.contents_format {
+            // Querying an advertised format must stay cheap and accept lindex -1.
+            // The concrete stream index is validated by GetData against the manifest.
+            if format.lindex < -1 || format.lindex >= 100_000 {
+                return DV_E_LINDEX;
+            }
+            if format.lindex >= 0
+                && self.files.get().is_some_and(|files| {
+                    files.as_ref().is_ok_and(|files| {
+                        files.get(format.lindex as usize).is_none_or(|file| file.directory)
+                    })
+                })
+            {
+                return DV_E_LINDEX;
+            }
+            return if format.tymed & TYMED_ISTREAM.0 as u32 != 0 { S_OK } else { DV_E_TYMED };
+        }
+        DV_E_FORMATETC
+    }
+
+    fn descriptors(&self) -> ::windows::core::Result<STGMEDIUM> {
+        let files = self.manifest()?;
+        let length = size_of::<u32>() + files.len() * size_of::<FILEDESCRIPTORW>();
+        unsafe {
+            let memory = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, length)?;
+            let data = GlobalLock(memory).cast::<u8>();
+            if data.is_null() {
+                let _ = GlobalFree(Some(memory));
+                return Err(error(E_OUTOFMEMORY));
+            }
+            data.cast::<u32>().write_unaligned(files.len() as u32);
+            for (index, file) in files.iter().enumerate() {
+                let mut descriptor = FILEDESCRIPTORW::default();
+                descriptor.dwFlags = FD_ATTRIBUTES.0 as u32;
+                descriptor.dwFileAttributes = if file.directory { 0x10 } else { 0x80 };
+                if !file.directory && file.size > 0 {
+                    descriptor.dwFlags |= FD_FILESIZE.0 as u32;
+                    descriptor.nFileSizeHigh = (file.size >> 32) as u32;
+                    descriptor.nFileSizeLow = file.size as u32;
+                }
+                let name: Vec<_> = file
+                    .relative_path
+                    .to_string_lossy()
+                    .replace('/', "\\")
+                    .encode_utf16()
+                    .collect();
+                if name.len() >= 260 {
+                    let _ = GlobalUnlock(memory);
+                    let _ = GlobalFree(Some(memory));
+                    return Err(error(E_INVALIDARG));
+                }
+                let mut file_name = [0u16; 260];
+                file_name[..name.len()].copy_from_slice(&name);
+                descriptor.cFileName = file_name;
+                data.add(size_of::<u32>() + index * size_of::<FILEDESCRIPTORW>())
+                    .cast::<FILEDESCRIPTORW>()
+                    .write_unaligned(descriptor);
+            }
+            let _ = GlobalUnlock(memory);
+            Ok(STGMEDIUM {
+                tymed: TYMED_HGLOBAL.0 as u32,
+                u: STGMEDIUM_0 { hGlobal: memory },
+                ..Default::default()
+            })
+        }
+    }
+}
+
+impl IDataObject_Impl for DataObject_Impl {
+    fn GetData(&self, requested: *const FORMATETC) -> ::windows::core::Result<STGMEDIUM> {
+        let requested = unsafe { requested.as_ref() }.ok_or_else(|| error(E_POINTER))?;
+        self.query(requested).ok()?;
+        if (self.cancelled)() {
+            return Err(error(E_ABORT));
+        }
+        if requested.cfFormat == self.descriptors_format {
+            return self.descriptors();
+        }
+        if requested.lindex < 0
+            || self.manifest()?.get(requested.lindex as usize).is_none_or(|file| file.directory)
+        {
+            return Err(error(DV_E_LINDEX));
+        }
+        let materialized = (self.materialize)(requested.lindex as usize).and_then(|file| {
+            stream::FileStream::open(file).map(|stream| -> IStream { stream.into() })
+        });
+        match materialized {
+            Ok(stream) => Ok(STGMEDIUM {
+                tymed: TYMED_ISTREAM.0 as u32,
+                u: STGMEDIUM_0 { pstm: ManuallyDrop::new(Some(stream)) },
+                ..Default::default()
+            }),
+            Err(failure) => {
+                *self.failure.lock().unwrap_or_else(|e| e.into_inner()) = Some(failure.to_string());
+                Err(error(E_FAIL))
+            },
+        }
+    }
+
+    fn QueryGetData(&self, requested: *const FORMATETC) -> HRESULT {
+        unsafe { requested.as_ref() }.map(|f| self.query(f)).unwrap_or(E_POINTER)
+    }
+
+    fn GetDataHere(&self, _: *const FORMATETC, _: *mut STGMEDIUM) -> ::windows::core::Result<()> {
+        Err(error(E_NOTIMPL))
+    }
+    fn GetCanonicalFormatEtc(&self, _: *const FORMATETC, out: *mut FORMATETC) -> HRESULT {
+        if let Some(out) = unsafe { out.as_mut() } {
+            out.ptd = std::ptr::null_mut();
+        }
+        DATA_S_SAMEFORMATETC
+    }
+    fn SetData(
+        &self,
+        _: *const FORMATETC,
+        _: *const STGMEDIUM,
+        _: BOOL,
+    ) -> ::windows::core::Result<()> {
+        Err(error(E_NOTIMPL))
+    }
+    fn EnumFormatEtc(&self, direction: u32) -> ::windows::core::Result<IEnumFORMATETC> {
+        if direction != DATADIR_GET.0 as u32 {
+            return Err(error(E_NOTIMPL));
+        }
+        unsafe { SHCreateStdEnumFmtEtc(&self.formats()) }
+    }
+    fn DAdvise(
+        &self,
+        _: *const FORMATETC,
+        _: u32,
+        _: Ref<'_, IAdviseSink>,
+    ) -> ::windows::core::Result<u32> {
+        Err(error(OLE_E_ADVISENOTSUPPORTED))
+    }
+    fn DUnadvise(&self, _: u32) -> ::windows::core::Result<()> {
+        Err(error(OLE_E_ADVISENOTSUPPORTED))
+    }
+    fn EnumDAdvise(&self) -> ::windows::core::Result<IEnumSTATDATA> {
+        Err(error(OLE_E_ADVISENOTSUPPORTED))
+    }
+}
+
+struct Apartment;
+impl Drop for Apartment {
+    fn drop(&mut self) {
+        unsafe { OleUninitialize() };
+    }
+}
+
+struct InputAttachment {
+    source: u32,
+    worker: u32,
+}
+
+impl Drop for InputAttachment {
+    fn drop(&mut self) {
+        if self.source != self.worker {
+            unsafe {
+                windows_sys::Win32::System::Threading::AttachThreadInput(
+                    self.worker,
+                    self.source,
+                    0,
+                );
+            }
+        }
+    }
+}
+
+pub(super) fn run(
+    origin: DragOrigin,
+    files: Manifest,
+    materialize: Materialize,
+    cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+) -> io::Result<DragOutcome> {
+    if cancelled() || unsafe { GetAsyncKeyState(VK_LBUTTON.0 as i32) } >= 0 {
+        return Ok(DragOutcome::Cancelled);
+    }
+    unsafe { OleInitialize(None) }.map_err(io::Error::other)?;
+    let _apartment = Apartment;
+    let worker = unsafe { windows_sys::Win32::System::Threading::GetCurrentThreadId() };
+    if worker != origin.thread
+        && unsafe {
+            windows_sys::Win32::System::Threading::AttachThreadInput(worker, origin.thread, 1)
+        } == 0
+    {
+        return Err(io::Error::last_os_error());
+    }
+    let _input = InputAttachment { source: origin.thread, worker };
+    // OLE initialization can outlive a very short gesture. Do not enter its
+    // modal loop with a button-up event that was delivered before it started.
+    if cancelled() || unsafe { GetAsyncKeyState(VK_LBUTTON.0 as i32) } >= 0 {
+        return Ok(DragOutcome::Cancelled);
+    }
+    let descriptors_format = unsafe { RegisterClipboardFormatW(w!("FileGroupDescriptorW")) } as u16;
+    let contents_format = unsafe { RegisterClipboardFormatW(w!("FileContents")) } as u16;
+    if descriptors_format == 0 || contents_format == 0 {
+        return Err(io::Error::last_os_error());
+    }
+    let failure = Arc::new(Mutex::new(None));
+    let source: IDropSource = DropSource { cancelled: cancelled.clone() }.into();
+    let data: IDataObject = DataObject {
+        files: OnceLock::new(),
+        describe: files,
+        materialize,
+        cancelled: cancelled.clone(),
+        failure: failure.clone(),
+        descriptors_format,
+        contents_format,
+    }
+    .into();
+    let mut effect = DROPEFFECT_NONE;
+    let result = unsafe { DoDragDrop(&data, &source, DROPEFFECT_COPY, &mut effect) };
+    drop(data);
+    drop(source);
+    if cancelled() {
+        return Ok(DragOutcome::Cancelled);
+    }
+    if let Some(failure) = failure.lock().unwrap_or_else(|e| e.into_inner()).take() {
+        return Err(io::Error::other(failure));
+    }
+    if result == DRAGDROP_S_CANCEL {
+        return Ok(DragOutcome::Cancelled);
+    }
+    result.ok().map_err(io::Error::other)?;
+    Ok(if effect.0 & DROPEFFECT_COPY.0 != 0 { DragOutcome::Copied } else { DragOutcome::Cancelled })
+}
diff --git a/nebula_app/src/platform/file_drag/windows/stream.rs b/nebula_app/src/platform/file_drag/windows/stream.rs
new file mode 100644
index 0000000..11945b7
--- /dev/null
+++ b/nebula_app/src/platform/file_drag/windows/stream.rs
@@ -0,0 +1,179 @@
+//! Each shell stream owns an independent cursor and a lease on its temporary file.
+
+use super::*;
+use std::ffi::c_void;
+use std::fs::File;
+use std::io::{Read, Seek, SeekFrom};
+
+#[implement(IStream)]
+pub(super) struct FileStream {
+    file: Mutex<File>,
+    path: PathBuf,
+    lease: Arc<dyn Send + Sync>,
+    cancelled: Arc<dyn Fn() -> bool + Send + Sync>,
+}
+
+impl FileStream {
+    pub(super) fn open(source: MaterializedFile) -> io::Result<Self> {
+        Ok(Self {
+            file: Mutex::new(File::open(&source.path)?),
+            path: source.path,
+            lease: source.lease,
+            cancelled: source.cancelled,
+        })
+    }
+}
+
+impl ISequentialStream_Impl for FileStream_Impl {
+    fn Read(&self, target: *mut c_void, count: u32, read: *mut u32) -> HRESULT {
+        if !read.is_null() {
+            unsafe { read.write(0) };
+        }
+        if (self.cancelled)() {
+            return E_ABORT;
+        }
+        if count == 0 {
+            return S_OK;
+        }
+        if target.is_null() {
+            return E_POINTER;
+        }
+        let target = unsafe { std::slice::from_raw_parts_mut(target.cast::<u8>(), count as usize) };
+        let mut file = self.file.lock().unwrap_or_else(|e| e.into_inner());
+        let mut total = 0;
+        while total < target.len() {
+            match file.read(&mut target[total..]) {
+                Ok(0) => break,
+                Ok(bytes) => total += bytes,
+                Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
+                Err(_) => return STG_E_READFAULT,
+            }
+        }
+        if !read.is_null() {
+            unsafe { read.write(total as u32) };
+        }
+        if total < target.len() { S_FALSE } else { S_OK }
+    }
+    fn Write(&self, _: *const c_void, _: u32, written: *mut u32) -> HRESULT {
+        if !written.is_null() {
+            unsafe { written.write(0) };
+        }
+        STG_E_ACCESSDENIED
+    }
+}
+
+impl IStream_Impl for FileStream_Impl {
+    fn Seek(
+        &self,
+        offset: i64,
+        origin: STREAM_SEEK,
+        position: *mut u64,
+    ) -> ::windows::core::Result<()> {
+        let from = if origin == STREAM_SEEK_SET && offset >= 0 {
+            SeekFrom::Start(offset as u64)
+        } else if origin == STREAM_SEEK_CUR {
+            SeekFrom::Current(offset)
+        } else if origin == STREAM_SEEK_END {
+            SeekFrom::End(offset)
+        } else {
+            return Err(error(STG_E_INVALIDFUNCTION));
+        };
+        let value = self
+            .file
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .seek(from)
+            .map_err(|_| error(STG_E_SEEKERROR))?;
+        if !position.is_null() {
+            unsafe { position.write(value) };
+        }
+        Ok(())
+    }
+    fn SetSize(&self, _: u64) -> ::windows::core::Result<()> {
+        Err(error(STG_E_ACCESSDENIED))
+    }
+    fn CopyTo(
+        &self,
+        target: Ref<'_, IStream>,
+        count: u64,
+        read: *mut u64,
+        written: *mut u64,
+    ) -> ::windows::core::Result<()> {
+        let target = target.as_ref().ok_or_else(|| error(E_POINTER))?;
+        let mut total = 0u64;
+        let mut buffer = [0u8; 65536];
+        if !read.is_null() {
+            unsafe { read.write(0) };
+        }
+        if !written.is_null() {
+            unsafe { written.write(0) };
+        }
+        while total < count {
+            let length = buffer.len().min((count - total).min(usize::MAX as u64) as usize);
+            let mut got = 0;
+            self.Read(buffer.as_mut_ptr().cast(), length as u32, &mut got).ok()?;
+            if got == 0 {
+                break;
+            }
+            let mut sent = 0;
+            unsafe { target.Write(buffer.as_ptr().cast(), got, Some(&mut sent)) }.ok()?;
+            if sent != got {
+                return Err(error(STG_E_WRITEFAULT));
+            }
+            total += u64::from(sent);
+            if !read.is_null() {
+                unsafe { read.write(total) };
+            }
+            if !written.is_null() {
+                unsafe { written.write(total) };
+            }
+        }
+        Ok(())
+    }
+    fn Commit(&self, _: &STGC) -> ::windows::core::Result<()> {
+        Ok(())
+    }
+    fn Revert(&self) -> ::windows::core::Result<()> {
+        Err(error(STG_E_INVALIDFUNCTION))
+    }
+    fn LockRegion(&self, _: u64, _: u64, _: &LOCKTYPE) -> ::windows::core::Result<()> {
+        Err(error(STG_E_INVALIDFUNCTION))
+    }
+    fn UnlockRegion(&self, _: u64, _: u64, _: u32) -> ::windows::core::Result<()> {
+        Err(error(STG_E_INVALIDFUNCTION))
+    }
+    fn Stat(&self, stat: *mut STATSTG, _: &STATFLAG) -> ::windows::core::Result<()> {
+        let stat = unsafe { stat.as_mut() }.ok_or_else(|| error(E_POINTER))?;
+        let size = self
+            .file
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .metadata()
+            .map_err(|_| error(STG_E_READFAULT))?
+            .len();
+        *stat = STATSTG {
+            r#type: STGTY_STREAM.0 as u32,
+            cbSize: size,
+            grfMode: STGM_READ,
+            ..Default::default()
+        };
+        Ok(())
+    }
+    fn Clone(&self) -> ::windows::core::Result<IStream> {
+        let position = self
+            .file
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .stream_position()
+            .map_err(|_| error(STG_E_SEEKERROR))?;
+        let mut file = File::open(&self.path).map_err(|_| error(STG_E_READFAULT))?;
+        file.seek(SeekFrom::Start(position)).map_err(|_| error(STG_E_SEEKERROR))?;
+        Ok(FileStream {
+            file: Mutex::new(file),
+            path: self.path.clone(),
+            lease: self.lease.clone(),
+            cancelled: self.cancelled.clone(),
+        }
+        .into())
+    }
+}
diff --git a/nebula_app/src/platform/file_drag/windows/tests.rs b/nebula_app/src/platform/file_drag/windows/tests.rs
new file mode 100644
index 0000000..613c575
--- /dev/null
+++ b/nebula_app/src/platform/file_drag/windows/tests.rs
@@ -0,0 +1,167 @@
+use super::*;
+mod ole_probe;
+use ::windows::Win32::System::Ole::ReleaseStgMedium;
+
+fn object(name: &str, contents: &[u8]) -> (IDataObject, Arc<tempfile::TempDir>, u16, u16) {
+    let directory = Arc::new(tempfile::tempdir().unwrap());
+    let path = directory.path().join(name);
+    std::fs::write(&path, contents).unwrap();
+    let descriptor = unsafe { RegisterClipboardFormatW(w!("FileGroupDescriptorW")) } as u16;
+    let content = unsafe { RegisterClipboardFormatW(w!("FileContents")) } as u16;
+    let owner = directory.clone();
+    let offered = vec![DragFile {
+        relative_path: name.into(),
+        directory: false,
+        size: contents.len() as u64,
+    }];
+    let object = DataObject {
+        files: OnceLock::new(),
+        describe: Arc::new(move || Ok(offered.clone())),
+        materialize: Arc::new(move |_| {
+            Ok(MaterializedFile {
+                path: path.clone(),
+                lease: owner.clone(),
+                cancelled: Arc::new(|| false),
+            })
+        }),
+        cancelled: Arc::new(|| false),
+        failure: Arc::new(Mutex::new(None)),
+        descriptors_format: descriptor,
+        contents_format: content,
+    }
+    .into();
+    (object, directory, descriptor, content)
+}
+
+#[test]
+fn descriptors_preserve_unicode_and_sizes_and_reject_bad_indices() {
+    let (object, _directory, descriptor, content) = object("配置 文件.txt", b"hello");
+    let format = FORMATETC {
+        cfFormat: descriptor,
+        dwAspect: DVASPECT_CONTENT.0,
+        lindex: -1,
+        tymed: TYMED_HGLOBAL.0 as u32,
+        ..Default::default()
+    };
+    unsafe {
+        let mut medium = object.GetData(&format).unwrap();
+        let memory = medium.u.hGlobal;
+        let pointer = GlobalLock(memory).cast::<u8>();
+        assert_eq!(pointer.cast::<u32>().read_unaligned(), 1);
+        let file = pointer.add(4).cast::<FILEDESCRIPTORW>().read_unaligned();
+        let name = file.cFileName;
+        let length = name.iter().position(|v| *v == 0).unwrap();
+        assert_eq!(String::from_utf16(&name[..length]).unwrap(), "配置 文件.txt");
+        let size = file.nFileSizeLow;
+        assert_eq!(size, 5);
+        let _ = GlobalUnlock(memory);
+        ReleaseStgMedium(&mut medium);
+        let invalid =
+            FORMATETC { cfFormat: content, lindex: 1, tymed: TYMED_ISTREAM.0 as u32, ..format };
+        assert_eq!(object.QueryGetData(&invalid), DV_E_LINDEX);
+    }
+}
+
+#[test]
+fn streams_and_clones_keep_temp_files_alive_and_have_independent_cursors() {
+    let (object, directory, _, content) = object("a.txt", b"abcdef");
+    let path = directory.path().to_owned();
+    let format = FORMATETC {
+        cfFormat: content,
+        dwAspect: DVASPECT_CONTENT.0,
+        lindex: 0,
+        tymed: TYMED_ISTREAM.0 as u32,
+        ..Default::default()
+    };
+    unsafe {
+        let mut medium = object.GetData(&format).unwrap();
+        let stream = medium.u.pstm.as_ref().unwrap().clone();
+        let mut first = [0u8; 2];
+        stream.Read(first.as_mut_ptr().cast(), 2, None).ok().unwrap();
+        let cloned = stream.Clone().unwrap();
+        ReleaseStgMedium(&mut medium);
+        drop(object);
+        drop(directory);
+        assert!(path.exists());
+        let mut from_clone = [0u8; 2];
+        cloned.Read(from_clone.as_mut_ptr().cast(), 2, None).ok().unwrap();
+        assert_eq!(&from_clone, b"cd");
+        let mut from_original = [0u8; 2];
+        stream.Read(from_original.as_mut_ptr().cast(), 2, None).ok().unwrap();
+        assert_eq!(&from_original, b"cd");
+        drop(stream);
+        assert!(path.exists());
+        drop(cloned);
+        assert!(!path.exists());
+    }
+}
+
+#[test]
+fn cancelled_source_does_not_materialize_data() {
+    let object: IDataObject = DataObject {
+        files: OnceLock::new(),
+        describe: Arc::new(|| panic!("cancelled description")),
+        materialize: Arc::new(|_| panic!("cancelled materialization")),
+        cancelled: Arc::new(|| true),
+        failure: Arc::new(Mutex::new(None)),
+        descriptors_format: 300,
+        contents_format: 301,
+    }
+    .into();
+    let format = FORMATETC {
+        cfFormat: 301,
+        dwAspect: DVASPECT_CONTENT.0,
+        lindex: 0,
+        tymed: TYMED_ISTREAM.0 as u32,
+        ..Default::default()
+    };
+    assert_eq!(unsafe { object.GetData(&format) }.err().unwrap().code(), E_ABORT);
+}
+
+#[test]
+fn format_queries_do_not_wait_for_network_preparation() {
+    let object: IDataObject = DataObject {
+        files: OnceLock::new(),
+        describe: Arc::new(|| panic!("format queries must not load the manifest")),
+        materialize: Arc::new(|_| panic!("format queries must not load contents")),
+        cancelled: Arc::new(|| false),
+        failure: Arc::new(Mutex::new(None)),
+        descriptors_format: 300,
+        contents_format: 301,
+    }
+    .into();
+    let format = FORMATETC {
+        cfFormat: 301,
+        dwAspect: DVASPECT_CONTENT.0,
+        lindex: -1,
+        tymed: TYMED_ISTREAM.0 as u32,
+        ..Default::default()
+    };
+    unsafe {
+        assert_eq!(object.QueryGetData(&format), S_OK);
+        assert_eq!(object.GetData(&format).err().unwrap().code(), DV_E_LINDEX);
+    }
+}
+
+#[test]
+fn an_open_stream_stops_when_the_transfer_is_cancelled() {
+    let directory = Arc::new(tempfile::tempdir().unwrap());
+    let path = directory.path().join("stream.txt");
+    std::fs::write(&path, b"data").unwrap();
+    let cancelled = Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let flag = cancelled.clone();
+    let stream: IStream = stream::FileStream::open(MaterializedFile {
+        path,
+        lease: directory,
+        cancelled: Arc::new(move || flag.load(std::sync::atomic::Ordering::Acquire)),
+    })
+    .unwrap()
+    .into();
+    cancelled.store(true, std::sync::atomic::Ordering::Release);
+    let mut byte = 0u8;
+    let mut read = 99;
+    unsafe {
+        assert_eq!(stream.Read((&mut byte as *mut u8).cast(), 1, Some(&mut read)), E_ABORT);
+    }
+    assert_eq!(read, 0);
+}
diff --git a/nebula_app/src/platform/file_drag/windows/tests/ole_probe.rs b/nebula_app/src/platform/file_drag/windows/tests/ole_probe.rs
new file mode 100644
index 0000000..71f2007
--- /dev/null
+++ b/nebula_app/src/platform/file_drag/windows/tests/ole_probe.rs
@@ -0,0 +1,305 @@
+//! Desktop-only acceptance: actual OLE routing between two owned test windows.
+
+use super::*;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::{Duration, Instant};
+use windows_sys::Win32::Foundation::{HWND as RawHwnd, LPARAM, LRESULT, POINT, RECT, WPARAM};
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::{
+    INPUT, INPUT_0, INPUT_MOUSE, MOUSEEVENTF_LEFTDOWN, MOUSEEVENTF_LEFTUP, MOUSEINPUT, SendInput,
+};
+use windows_sys::Win32::UI::WindowsAndMessaging::*;
+
+#[implement(IDropTarget)]
+struct Target {
+    directory: PathBuf,
+    copied: Arc<AtomicBool>,
+}
+
+impl IDropTarget_Impl for Target_Impl {
+    fn DragEnter(
+        &self,
+        _: Ref<'_, IDataObject>,
+        _: MODIFIERKEYS_FLAGS,
+        _: &POINTL,
+        effect: *mut DROPEFFECT,
+    ) -> ::windows::core::Result<()> {
+        eprintln!("OLE probe: target drag-enter");
+        unsafe { effect.write(DROPEFFECT_COPY) };
+        Ok(())
+    }
+    fn DragOver(
+        &self,
+        _: MODIFIERKEYS_FLAGS,
+        _: &POINTL,
+        effect: *mut DROPEFFECT,
+    ) -> ::windows::core::Result<()> {
+        unsafe { effect.write(DROPEFFECT_COPY) };
+        Ok(())
+    }
+    fn DragLeave(&self) -> ::windows::core::Result<()> {
+        Ok(())
+    }
+    fn Drop(
+        &self,
+        object: Ref<'_, IDataObject>,
+        _: MODIFIERKEYS_FLAGS,
+        _: &POINTL,
+        effect: *mut DROPEFFECT,
+    ) -> ::windows::core::Result<()> {
+        eprintln!("OLE probe: target drop");
+        let object = object.as_ref().ok_or_else(|| error(E_POINTER))?;
+        let format = FORMATETC {
+            cfFormat: unsafe { RegisterClipboardFormatW(w!("FileGroupDescriptorW")) } as u16,
+            dwAspect: DVASPECT_CONTENT.0,
+            lindex: -1,
+            tymed: TYMED_HGLOBAL.0 as u32,
+            ..Default::default()
+        };
+        unsafe {
+            let mut descriptors = object.GetData(&format)?;
+            eprintln!("OLE probe: descriptors received");
+            let memory = descriptors.u.hGlobal;
+            let bytes = GlobalLock(memory).cast::<u8>();
+            let count = bytes.cast::<u32>().read_unaligned();
+            let descriptor = bytes.add(4).cast::<FILEDESCRIPTORW>().read_unaligned();
+            let name = descriptor.cFileName;
+            let _ = GlobalUnlock(memory);
+            ReleaseStgMedium(&mut descriptors);
+            let end = name.iter().position(|unit| *unit == 0).unwrap_or(name.len());
+            // The probe only ever writes its one known fixture name.
+            if count != 1 || String::from_utf16_lossy(&name[..end]) != "拖放 fixture.txt" {
+                return Err(error(E_INVALIDARG));
+            }
+            let format = FORMATETC {
+                cfFormat: RegisterClipboardFormatW(w!("FileContents")) as u16,
+                dwAspect: DVASPECT_CONTENT.0,
+                lindex: 0,
+                tymed: TYMED_ISTREAM.0 as u32,
+                ..Default::default()
+            };
+            let mut contents = object.GetData(&format)?;
+            eprintln!("OLE probe: contents received");
+            let stream = contents.u.pstm.as_ref().ok_or_else(|| error(E_POINTER))?;
+            let mut result = Vec::new();
+            loop {
+                let mut buffer = [0u8; 1024];
+                let mut count = 0;
+                stream
+                    .Read(buffer.as_mut_ptr().cast(), buffer.len() as u32, Some(&mut count))
+                    .ok()?;
+                if count == 0 {
+                    break;
+                }
+                result.extend_from_slice(&buffer[..count as usize]);
+                if result.len() > 65536 {
+                    return Err(error(E_INVALIDARG));
+                }
+            }
+            ReleaseStgMedium(&mut contents);
+            std::fs::write(self.directory.join("拖放 fixture.txt"), result)
+                .map_err(|_| error(E_FAIL))?;
+            self.copied.store(true, Ordering::Release);
+            effect.write(DROPEFFECT_COPY);
+        }
+        Ok(())
+    }
+}
+
+unsafe extern "system" fn procedure(
+    window: RawHwnd,
+    message: u32,
+    wparam: WPARAM,
+    lparam: LPARAM,
+) -> LRESULT {
+    unsafe { DefWindowProcW(window, message, wparam, lparam) }
+}
+
+fn mouse(flags: u32) {
+    let input = INPUT {
+        r#type: INPUT_MOUSE,
+        Anonymous: INPUT_0 { mi: MOUSEINPUT { dwFlags: flags, ..unsafe { std::mem::zeroed() } } },
+    };
+    assert_eq!(unsafe { SendInput(1, &input, size_of::<INPUT>() as i32) }, 1);
+}
+
+fn center(window: RawHwnd) -> POINT {
+    let mut rectangle = RECT { left: 0, top: 0, right: 0, bottom: 0 };
+    assert_ne!(unsafe { GetWindowRect(window, &mut rectangle) }, 0);
+    POINT { x: (rectangle.left + rectangle.right) / 2, y: (rectangle.top + rectangle.bottom) / 2 }
+}
+
+struct Windows {
+    source: RawHwnd,
+    target: RawHwnd,
+    cursor: POINT,
+    foreground: RawHwnd,
+}
+
+impl Drop for Windows {
+    fn drop(&mut self) {
+        unsafe {
+            let _ = RevokeDragDrop(HWND(self.target));
+            DestroyWindow(self.source);
+            DestroyWindow(self.target);
+            SetCursorPos(self.cursor.x, self.cursor.y);
+            if !self.foreground.is_null() {
+                SetForegroundWindow(self.foreground);
+            }
+        }
+    }
+}
+
+#[test]
+#[ignore = "requires an interactive Windows desktop; drives only isolated probe windows"]
+fn native_worker_drag_reaches_an_ole_target_and_copies_unicode_file() {
+    assert!(unsafe { GetAsyncKeyState(VK_LBUTTON.0 as i32) } >= 0, "Mouse is currently in use");
+    unsafe {
+        OleInitialize(None).unwrap();
+    }
+    let _apartment = Apartment;
+    let class: Vec<u16> = "PebrelFileDragAcceptance\0".encode_utf16().collect();
+    let title: Vec<u16> = "Pebrel isolated drag acceptance\0".encode_utf16().collect();
+    let window_class = WNDCLASSW {
+        lpfnWndProc: Some(procedure),
+        lpszClassName: class.as_ptr(),
+        ..unsafe { std::mem::zeroed() }
+    };
+    unsafe {
+        RegisterClassW(&window_class);
+    }
+    let mut cursor = POINT { x: 0, y: 0 };
+    unsafe {
+        GetCursorPos(&mut cursor);
+    }
+    let foreground = unsafe { GetForegroundWindow() };
+    let create = |x| unsafe {
+        CreateWindowExW(
+            WS_EX_TOPMOST,
+            class.as_ptr(),
+            title.as_ptr(),
+            WS_OVERLAPPEDWINDOW | WS_VISIBLE,
+            x,
+            120,
+            300,
+            200,
+            std::ptr::null_mut(),
+            std::ptr::null_mut(),
+            std::ptr::null_mut(),
+            std::ptr::null(),
+        )
+    };
+    let source = create(80);
+    let target = create(420);
+    assert!(!source.is_null() && !target.is_null());
+    let _windows = Windows { source, target, cursor, foreground };
+    let input = Arc::new(tempfile::tempdir().unwrap());
+    let output = tempfile::tempdir().unwrap();
+    let input_path = input.path().join("拖放 fixture.txt");
+    std::fs::write(&input_path, "Native OLE / 中文 / preserved contents").unwrap();
+    let copied = Arc::new(AtomicBool::new(false));
+    let drop_target: IDropTarget =
+        Target { directory: output.path().to_owned(), copied: copied.clone() }.into();
+    unsafe {
+        RegisterDragDrop(HWND(target), &drop_target).unwrap();
+    }
+    let source_point = center(source);
+    let target_point = center(target);
+    let source_id = source as usize;
+    let target_id = target as usize;
+    DRAG_PROBE_READY.store(false, Ordering::Release);
+    let (send, receive) = std::sync::mpsc::channel();
+    let origin = DragOrigin::capture();
+    std::thread::spawn(move || {
+        unsafe {
+            SetCursorPos(source_point.x, source_point.y);
+        }
+        std::thread::sleep(Duration::from_millis(80));
+        assert_eq!(unsafe { WindowFromPoint(source_point) } as usize, source_id);
+        mouse(MOUSEEVENTF_LEFTDOWN);
+        eprintln!("OLE probe: mouse down");
+        std::thread::sleep(Duration::from_millis(80));
+        let motion = std::thread::spawn(move || {
+            let ready_deadline = Instant::now() + Duration::from_secs(5);
+            while !DRAG_PROBE_READY.load(Ordering::Acquire) {
+                if Instant::now() >= ready_deadline {
+                    mouse(MOUSEEVENTF_LEFTUP);
+                    return false;
+                }
+                let input = INPUT {
+                    r#type: INPUT_MOUSE,
+                    Anonymous: INPUT_0 {
+                        mi: MOUSEINPUT {
+                            dx: 1,
+                            dy: 0,
+                            dwFlags:
+                                windows_sys::Win32::UI::Input::KeyboardAndMouse::MOUSEEVENTF_MOVE,
+                            ..unsafe { std::mem::zeroed() }
+                        },
+                    },
+                };
+                unsafe {
+                    SendInput(1, &input, size_of::<INPUT>() as i32);
+                }
+                std::thread::sleep(Duration::from_millis(20));
+            }
+            unsafe {
+                SetCursorPos(target_point.x, target_point.y);
+            }
+            std::thread::sleep(Duration::from_millis(180));
+            let at_target = unsafe { WindowFromPoint(target_point) } as usize == target_id;
+            mouse(MOUSEEVENTF_LEFTUP);
+            eprintln!("OLE probe: mouse up, target={at_target}, state={}", unsafe {
+                GetAsyncKeyState(VK_LBUTTON.0 as i32)
+            });
+            at_target
+        });
+        let result = super::super::run(
+            origin,
+            Arc::new(|| {
+                std::thread::sleep(Duration::from_millis(120));
+                Ok(vec![DragFile {
+                    relative_path: "拖放 fixture.txt".into(),
+                    directory: false,
+                    size: 0,
+                }])
+            }),
+            Arc::new(move |_| {
+                Ok(MaterializedFile {
+                    path: input_path.clone(),
+                    lease: input.clone(),
+                    cancelled: Arc::new(|| false),
+                })
+            }),
+            Arc::new(|| false),
+        );
+        eprintln!("OLE probe: native returned {result:?}");
+        let at_target = motion.join().unwrap();
+        let _ = send.send((result, at_target));
+    });
+    let deadline = Instant::now() + Duration::from_secs(15);
+    let result = loop {
+        let mut message: MSG = unsafe { std::mem::zeroed() };
+        unsafe {
+            while PeekMessageW(&mut message, std::ptr::null_mut(), 0, 0, PM_REMOVE) != 0 {
+                TranslateMessage(&message);
+                DispatchMessageW(&message);
+            }
+        }
+        if let Ok(result) = receive.try_recv() {
+            break result;
+        }
+        assert!(
+            Instant::now() < deadline,
+            "Native drag did not complete; copied={}",
+            copied.load(Ordering::Acquire)
+        );
+        std::thread::sleep(Duration::from_millis(5));
+    };
+    assert!(result.1, "Pointer must land on the owned target window");
+    assert_eq!(result.0.unwrap(), DragOutcome::Copied);
+    assert!(copied.load(Ordering::Acquire));
+    assert_eq!(
+        std::fs::read_to_string(output.path().join("拖放 fixture.txt")).unwrap(),
+        "Native OLE / 中文 / preserved contents"
+    );
+}
diff --git a/nebula_app/src/platform/file_preview.rs b/nebula_app/src/platform/file_preview.rs
new file mode 100644
index 0000000..03af297
--- /dev/null
+++ b/nebula_app/src/platform/file_preview.rs
@@ -0,0 +1,218 @@
+//! Bounded local thumbnails. All filesystem, image and PDF work runs off the UI thread.
+
+use std::collections::VecDeque;
+use std::io::{Cursor, Read};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::SystemTime;
+
+const MAX_FILE_BYTES: u64 = 64 * 1024 * 1024;
+const MAX_DECODE_BYTES: u64 = 64 * 1024 * 1024;
+const MAX_EDGE: u32 = 640;
+const MAX_CACHE_ITEMS: usize = 16;
+
+#[derive(Clone, PartialEq, Eq)]
+struct FileKey {
+    path: PathBuf,
+    modified: Option<SystemTime>,
+    length: u64,
+}
+
+pub(crate) struct Thumbnail {
+    pub(crate) png: Arc<[u8]>,
+    pub(crate) width: u32,
+    pub(crate) height: u32,
+    pub(crate) pages: Option<u32>,
+}
+
+pub(crate) fn supports(path: &Path) -> bool {
+    path.extension().and_then(|ext| ext.to_str()).is_some_and(|ext| {
+        matches!(
+            ext.to_ascii_lowercase().as_str(),
+            "pdf" | "png" | "jpg" | "jpeg" | "webp" | "gif" | "bmp"
+        )
+    })
+}
+
+pub(crate) fn load(path: &Path) -> Result<Arc<Thumbnail>, String> {
+    static CACHE: OnceLock<Mutex<VecDeque<(FileKey, Arc<Thumbnail>)>>> = OnceLock::new();
+    let metadata = std::fs::metadata(path).map_err(|error| error.to_string())?;
+    if !metadata.is_file() || metadata.len() > MAX_FILE_BYTES {
+        return Err("File exceeds preview limits".into());
+    }
+    let key = FileKey {
+        path: path.to_owned(),
+        modified: metadata.modified().ok(),
+        length: metadata.len(),
+    };
+    let cache = CACHE.get_or_init(Default::default);
+    {
+        let mut cache = cache.lock().unwrap_or_else(|error| error.into_inner());
+        if let Some(index) = cache.iter().position(|(cached, _)| cached == &key) {
+            let hit = cache.remove(index).unwrap();
+            let result = hit.1.clone();
+            cache.push_back(hit);
+            return Ok(result);
+        }
+    }
+    let pdf = path.extension().is_some_and(|ext| ext.eq_ignore_ascii_case("pdf"));
+    let (bytes, pages) = if pdf {
+        pdf_first_page(path)?
+    } else {
+        let mut bytes = Vec::new();
+        std::fs::File::open(path)
+            .map_err(|error| error.to_string())?
+            .take(MAX_FILE_BYTES + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|error| error.to_string())?;
+        if bytes.len() as u64 > MAX_FILE_BYTES {
+            return Err("File exceeds preview limits".into());
+        }
+        (bytes, None)
+    };
+    let mut reader = image::ImageReader::new(Cursor::new(bytes))
+        .with_guessed_format()
+        .map_err(|error| error.to_string())?;
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(MAX_DECODE_BYTES);
+    reader.limits(limits);
+    let original = reader.decode().map_err(|error| error.to_string())?;
+    let width = original.width();
+    let height = original.height();
+    let reduced = original.thumbnail(MAX_EDGE, MAX_EDGE);
+    let mut png = Cursor::new(Vec::new());
+    reduced.write_to(&mut png, image::ImageFormat::Png).map_err(|error| error.to_string())?;
+    let thumbnail = Arc::new(Thumbnail { png: png.into_inner().into(), width, height, pages });
+    let mut cache = cache.lock().unwrap_or_else(|error| error.into_inner());
+    cache.retain(|(cached, _)| cached.path != key.path);
+    cache.push_back((key, thumbnail.clone()));
+    while cache.len() > MAX_CACHE_ITEMS {
+        cache.pop_front();
+    }
+    Ok(thumbnail)
+}
+
+#[cfg(windows)]
+fn pdf_first_page(path: &Path) -> Result<(Vec<u8>, Option<u32>), String> {
+    use windows::Data::Pdf::{PdfDocument, PdfPageRenderOptions};
+    use windows::Storage::{
+        StorageFile,
+        Streams::{DataReader, InMemoryRandomAccessStream},
+    };
+    use windows::Win32::System::WinRT::{RO_INIT_MULTITHREADED, RoInitialize, RoUninitialize};
+    struct Apartment;
+    impl Drop for Apartment {
+        fn drop(&mut self) {
+            unsafe { RoUninitialize() };
+        }
+    }
+    let render = || -> windows::core::Result<(Vec<u8>, Option<u32>)> {
+        unsafe { RoInitialize(RO_INIT_MULTITHREADED)? };
+        let _apartment = Apartment;
+        let file =
+            StorageFile::GetFileFromPathAsync(&path.to_string_lossy().as_ref().into())?.get()?;
+        let pdf = PdfDocument::LoadFromFileAsync(&file)?.get()?;
+        let pages = pdf.PageCount()?;
+        let page = pdf.GetPage(0)?;
+        let size = page.Size()?;
+        let scale = MAX_EDGE as f32 / size.Width.max(size.Height).max(1.0);
+        let options = PdfPageRenderOptions::new()?;
+        options.SetDestinationWidth((size.Width * scale).round().max(1.0) as u32)?;
+        options.SetDestinationHeight((size.Height * scale).round().max(1.0) as u32)?;
+        let stream = InMemoryRandomAccessStream::new()?;
+        page.RenderWithOptionsToStreamAsync(&stream, &options)?.get()?;
+        let length = stream.Size()?.min(8 * 1024 * 1024) as u32;
+        let reader = DataReader::CreateDataReader(&stream.GetInputStreamAt(0)?)?;
+        reader.LoadAsync(length)?.get()?;
+        let mut bytes = vec![0; length as usize];
+        reader.ReadBytes(&mut bytes)?;
+        page.Close()?;
+        Ok((bytes, Some(pages)))
+    };
+    render().map_err(|error| error.to_string())
+}
+
+#[cfg(not(windows))]
+fn pdf_first_page(path: &Path) -> Result<(Vec<u8>, Option<u32>), String> {
+    use std::process::{Command, Stdio};
+    let output = tempfile::NamedTempFile::new().map_err(|error| error.to_string())?;
+    #[cfg(target_os = "macos")]
+    let mut command = {
+        let mut command = Command::new("sips");
+        command.args(["-s", "format", "png"]).arg(path).arg("--out").arg(output.path());
+        command
+    };
+    #[cfg(not(target_os = "macos"))]
+    let mut command = {
+        let mut command = Command::new("pdftoppm");
+        command
+            .args(["-f", "1", "-l", "1", "-singlefile", "-scale-to", "640", "-png"])
+            .arg(path)
+            .stdout(Stdio::from(output.reopen().map_err(|error| error.to_string())?));
+        command
+    };
+    let mut child = command.stderr(Stdio::null()).spawn().map_err(|error| error.to_string())?;
+    let started = std::time::Instant::now();
+    loop {
+        match child.try_wait().map_err(|error| error.to_string())? {
+            Some(status) if status.success() => break,
+            Some(_) => return Err("PDF preview is unavailable".into()),
+            None if started.elapsed().as_secs() >= 5 => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err("PDF preview timed out".into());
+            },
+            None => std::thread::sleep(std::time::Duration::from_millis(20)),
+        }
+    }
+    Ok((std::fs::read(output.path()).map_err(|error| error.to_string())?, None))
+}
+
+#[cfg(test)]
+mod tests {
+    #[cfg(windows)]
+    #[test]
+    fn native_pdf_thumbnail_renders_the_first_page() {
+        let objects = [
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+            "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 120 120] /Contents 4 0 R >>",
+            "<< /Length 28 >>\nstream\n1 0 0 rg 10 10 100 100 re f\nendstream",
+        ];
+        let mut pdf = String::from("%PDF-1.4\n");
+        let mut offsets = vec![0];
+        for (index, object) in objects.iter().enumerate() {
+            offsets.push(pdf.len());
+            pdf.push_str(&format!("{} 0 obj\n{object}\nendobj\n", index + 1));
+        }
+        let xref = pdf.len();
+        pdf.push_str("xref\n0 5\n0000000000 65535 f \n");
+        for offset in &offsets[1..] {
+            pdf.push_str(&format!("{offset:010} 00000 n \n"));
+        }
+        pdf.push_str(&format!("trailer\n<< /Size 5 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n"));
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("first-page.pdf");
+        std::fs::write(&path, pdf).unwrap();
+        let preview = load(&path).unwrap();
+        assert_eq!(preview.pages, Some(1));
+        let pixels = image::load_from_memory(&preview.png).unwrap().to_rgb8();
+        let middle = pixels.get_pixel(pixels.width() / 2, pixels.height() / 2);
+        assert!(middle[0] > 200 && middle[1] < 50 && middle[2] < 50);
+    }
+    use super::*;
+    #[test]
+    fn thumbnails_are_bounded_cached_and_invalidated_by_file_changes() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("image.png");
+        image::RgbaImage::from_pixel(1600, 800, image::Rgba([255, 0, 0, 255])).save(&path).unwrap();
+        let first = load(&path).unwrap();
+        let decoded = image::load_from_memory(&first.png).unwrap();
+        assert_eq!((decoded.width(), decoded.height()), (640, 320));
+        assert!(Arc::ptr_eq(&first, &load(&path).unwrap()));
+        image::RgbaImage::from_pixel(32, 24, image::Rgba([0, 0, 255, 255])).save(&path).unwrap();
+        let second = load(&path).unwrap();
+        assert!(!Arc::ptr_eq(&first, &second));
+        assert_eq!((second.width, second.height), (32, 24));
+    }
+}
diff --git a/nebula_app/src/platform/locale.rs b/nebula_app/src/platform/locale.rs
new file mode 100644
index 0000000..47f0f3b
--- /dev/null
+++ b/nebula_app/src/platform/locale.rs
@@ -0,0 +1,81 @@
+//! Native UI-language preferences, with POSIX environment fallback.
+
+pub fn system_locale() -> Option<String> {
+    native_locale().or_else(|| {
+        ["LC_ALL", "LC_MESSAGES", "LANG"]
+            .into_iter()
+            .find_map(|name| std::env::var(name).ok().filter(|value| !value.is_empty()))
+    })
+}
+
+#[cfg(windows)]
+fn native_locale() -> Option<String> {
+    use windows_sys::Win32::Globalization::GetUserDefaultLocaleName;
+    let mut buffer = [0_u16; 85];
+    let length = unsafe { GetUserDefaultLocaleName(buffer.as_mut_ptr(), buffer.len() as i32) };
+    (length > 1).then(|| String::from_utf16(&buffer[..length as usize - 1]).ok()).flatten()
+}
+
+#[cfg(target_os = "macos")]
+fn native_locale() -> Option<String> {
+    use std::ffi::{CStr, c_char, c_void};
+    type CFRef = *const c_void;
+    #[link(name = "CoreFoundation", kind = "framework")]
+    unsafe extern "C" {
+        fn CFLocaleCopyPreferredLanguages() -> CFRef;
+        fn CFArrayGetCount(array: CFRef) -> isize;
+        fn CFArrayGetValueAtIndex(array: CFRef, index: isize) -> CFRef;
+        fn CFStringGetLength(string: CFRef) -> isize;
+        fn CFStringGetCString(string: CFRef, buffer: *mut c_char, size: isize, encoding: u32)
+        -> u8;
+        fn CFRelease(value: CFRef);
+    }
+    struct OwnedLanguages(CFRef);
+    impl Drop for OwnedLanguages {
+        fn drop(&mut self) {
+            // SAFETY: this owns the non-null reference returned by Copy.
+            unsafe { CFRelease(self.0) };
+        }
+    }
+    // Finder-launched apps often have no LANG. Read the ordered UI-language
+    // preferences directly, without a subprocess or preferences-file parsing.
+    let array = unsafe { CFLocaleCopyPreferredLanguages() };
+    if array.is_null() {
+        return None;
+    }
+    let languages = OwnedLanguages(array);
+    // SAFETY: Apple's API returns a retained CFArray of CFStrings. The strings
+    // remain valid while OwnedLanguages lives; returned text is copied to Rust.
+    unsafe {
+        let count = CFArrayGetCount(languages.0).clamp(0, 64);
+        for index in 0..count {
+            let string = CFArrayGetValueAtIndex(languages.0, index);
+            if string.is_null() {
+                continue;
+            }
+            let length = CFStringGetLength(string);
+            if !(1..=256).contains(&length) {
+                continue;
+            }
+            let mut buffer = vec![0_u8; length as usize * 4 + 1];
+            const UTF8: u32 = 0x0800_0100;
+            if CFStringGetCString(string, buffer.as_mut_ptr().cast(), buffer.len() as isize, UTF8)
+                == 0
+            {
+                continue;
+            }
+            let Ok(locale) = CStr::from_ptr(buffer.as_ptr().cast()).to_str() else {
+                continue;
+            };
+            if nebula_settings::LanguagePref::from_locale(locale).is_some() {
+                return Some(locale.to_owned());
+            }
+        }
+    }
+    None
+}
+
+#[cfg(not(any(windows, target_os = "macos")))]
+fn native_locale() -> Option<String> {
+    None
+}
diff --git a/nebula_app/src/platform/mod.rs b/nebula_app/src/platform/mod.rs
index 4ce699e..7005508 100644
--- a/nebula_app/src/platform/mod.rs
+++ b/nebula_app/src/platform/mod.rs
@@ -9,10 +9,13 @@
 //! 切模块 + 模块内 `#[cfg]` 分派」，只保留真正值钱的两点：单一入口，以及
 //! 能力探测（让 UI 隐藏入口，而不是让功能在别的平台报错）。
 
+pub(crate) mod ai_session_identity;
 pub mod capabilities;
 pub mod credentials;
 pub mod dirs;
+pub(crate) mod file_drag;
 pub mod file_manager;
+pub(crate) mod file_preview;
 #[cfg(feature = "gpui-shell")]
 pub mod fonts;
 pub mod notifications;
diff --git a/nebula_app/src/process_tree.rs b/nebula_app/src/process_tree.rs
index 65d3ce2..40510f9 100644
--- a/nebula_app/src/process_tree.rs
+++ b/nebula_app/src/process_tree.rs
@@ -90,6 +90,20 @@ pub fn display_name(exe: &str) -> String {
     name.strip_suffix(".exe").or_else(|| name.strip_suffix(".EXE")).unwrap_or(name).to_owned()
 }
 
+/// Host descendants establish local liveness; a remote pane also has terminal
+/// lifecycle evidence, since its actual foreground process is on another OS.
+pub(crate) fn close_warning_process(
+    remote: bool,
+    foreground: Option<&str>,
+    child: Option<&str>,
+) -> Option<String> {
+    let foreground = foreground.filter(|program| !is_interactive_shell_command(program));
+    if remote && let Some(program) = foreground {
+        return Some(program.to_owned());
+    }
+    child.map(|child| foreground.map(str::to_owned).unwrap_or_else(|| display_name(child)))
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProcessEntry {
     pub pid: u32,
@@ -397,6 +411,23 @@ fn resolve_agent_ancestor(
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn remote_close_uses_foreground_lifecycle_without_a_host_child() {
+        for program in ["claude", "codex", "gemini", "cargo"] {
+            assert_eq!(
+                super::close_warning_process(true, Some(program), None).as_deref(),
+                Some(program)
+            );
+        }
+        assert_eq!(super::close_warning_process(true, None, None), None);
+        assert_eq!(super::close_warning_process(true, Some("bash"), None), None);
+        assert_eq!(super::close_warning_process(false, Some("claude"), None), None);
+        assert_eq!(
+            super::close_warning_process(false, Some("claude"), Some("node.exe")).as_deref(),
+            Some("claude")
+        );
+    }
+
     use std::collections::HashMap;
 
     use super::{
diff --git a/nebula_app/src/render_cache.rs b/nebula_app/src/render_cache.rs
new file mode 100644
index 0000000..ab3c623
--- /dev/null
+++ b/nebula_app/src/render_cache.rs
@@ -0,0 +1,139 @@
+//! Byte and entry bounded LRU used by application-owned render resources.
+
+use std::collections::HashMap;
+use std::hash::Hash;
+
+struct Entry<V> {
+    value: V,
+    bytes: usize,
+    touched: u64,
+}
+
+pub(crate) struct RenderCache<K, V> {
+    entries: HashMap<K, Entry<V>>,
+    max_bytes: usize,
+    max_entries: usize,
+    used: usize,
+    clock: u64,
+}
+
+impl<K: Eq + Hash + Clone, V> RenderCache<K, V> {
+    pub(crate) fn new(max_bytes: usize, max_entries: usize) -> Self {
+        Self { entries: HashMap::new(), max_bytes, max_entries, used: 0, clock: 0 }
+    }
+
+    pub(crate) fn get(&mut self, key: &K) -> Option<&V> {
+        let entry = self.entries.get_mut(key)?;
+        self.clock = self.clock.saturating_add(1);
+        entry.touched = self.clock;
+        Some(&entry.value)
+    }
+
+    /// Reject an individually oversized value before disturbing useful entries.
+    pub(crate) fn insert(&mut self, key: K, value: V, bytes: usize) -> bool {
+        let bytes = bytes.max(1);
+        if bytes > self.max_bytes || self.max_entries == 0 {
+            return false;
+        }
+        self.remove(&key);
+        while self.entries.len() >= self.max_entries
+            || self.used.saturating_add(bytes) > self.max_bytes
+        {
+            let oldest = self.entries.iter().min_by_key(|(_, entry)| entry.touched);
+            let Some(key) = oldest.map(|(key, _)| key.clone()) else { break };
+            self.remove(&key);
+        }
+        self.clock = self.clock.saturating_add(1);
+        self.used += bytes;
+        self.entries.insert(key, Entry { value, bytes, touched: self.clock });
+        true
+    }
+
+    pub(crate) fn remove(&mut self, key: &K) {
+        if let Some(entry) = self.entries.remove(key) {
+            self.used -= entry.bytes;
+        }
+    }
+
+    /// Reserve part of the owner's budget before background allocation begins.
+    /// Growing the allowance does not eagerly allocate or resurrect evicted data.
+    pub(crate) fn set_byte_budget(&mut self, bytes: usize) {
+        self.max_bytes = bytes;
+        while self.used > bytes {
+            let oldest = self.entries.iter().min_by_key(|(_, entry)| entry.touched);
+            let Some(key) = oldest.map(|(key, _)| key.clone()) else { break };
+            self.remove(&key);
+        }
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    pub(crate) fn used_bytes(&self) -> usize {
+        self.used
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reservations_release_cold_resources_before_allocation() {
+        let mut cache = RenderCache::new(100, 8);
+        cache.insert("cold", 1, 40);
+        cache.insert("hot", 2, 40);
+        cache.set_byte_budget(50);
+        assert_eq!(cache.get(&"cold"), None);
+        assert_eq!(cache.get(&"hot"), Some(&2));
+        assert!(!cache.insert("large", 3, 51));
+        cache.set_byte_budget(100);
+        assert_eq!(cache.used_bytes(), 40);
+        cache.set_byte_budget(0);
+        assert_eq!(cache.len(), 0);
+        assert!(!cache.insert("failure", 4, 1));
+    }
+
+    #[test]
+    fn scrolling_evicts_one_cold_resource_and_keeps_hot_resources() {
+        let mut cache = RenderCache::new(64, 4);
+        for key in 0..4 {
+            cache.insert(key, key, 16);
+        }
+        assert_eq!(cache.get(&0), Some(&0));
+        cache.insert(4, 4, 16);
+        assert_eq!(cache.len(), 4);
+        assert_eq!(cache.get(&0), Some(&0));
+        assert_eq!(cache.get(&1), None);
+        assert_eq!(cache.get(&2), Some(&2));
+        assert_eq!(cache.used_bytes(), 64);
+    }
+
+    #[test]
+    fn resize_replacements_and_oversized_images_preserve_accounting() {
+        let mut cache = RenderCache::new(100, 8);
+        cache.insert("formula", 1, 40);
+        cache.insert("molecule", 2, 40);
+        assert!(!cache.insert("too large", 3, 101));
+        assert_eq!(cache.len(), 2);
+        cache.insert("formula", 4, 10);
+        assert_eq!(cache.used_bytes(), 50);
+        cache.remove(&"molecule");
+        assert_eq!(cache.used_bytes(), 10);
+    }
+
+    #[test]
+    fn eighty_logical_sessions_share_one_budget_during_repeated_resize() {
+        let mut cache = RenderCache::new(32 * 1024, 128);
+        for resize in 0..40 {
+            for session in 0..80 {
+                cache.insert((session, resize), session, 1024);
+                assert!(cache.used_bytes() <= 32 * 1024);
+                assert!(cache.len() <= 32);
+            }
+        }
+        assert_eq!(cache.get(&(79, 39)), Some(&79));
+        assert_eq!(cache.get(&(0, 0)), None);
+    }
+}
diff --git a/nebula_app/src/runtime_exec.rs b/nebula_app/src/runtime_exec.rs
index 7fc260c..4f6a474 100644
--- a/nebula_app/src/runtime_exec.rs
+++ b/nebula_app/src/runtime_exec.rs
@@ -19,7 +19,7 @@ use crate::runtime_api::{ApiError, RuntimeDispatch};
 #[derive(Clone, Debug)]
 enum ExecLocation {
     Host,
-    Wsl { distro: Option<String> },
+    Wsl { distro: Option<String>, user: Option<String> },
 }
 
 /// 创建 pane 时冻结的、可由独立 child 安全复用的上下文。
@@ -29,19 +29,37 @@ enum ExecLocation {
 #[derive(Clone, Debug)]
 pub(crate) struct PaneExecContext {
     location: ExecLocation,
+    shell_program: Option<String>,
     env: HashMap<String, String>,
     fallback_cwd: Option<PathBuf>,
 }
 
 impl PaneExecContext {
+    pub(crate) fn shell_program(&self) -> Option<&str> {
+        self.shell_program.as_deref()
+    }
     /// Distinguish a host process from WSL, including its default distribution.
     pub(crate) fn wsl_distribution(&self) -> Option<Option<&str>> {
         match &self.location {
             ExecLocation::Host => None,
-            ExecLocation::Wsl { distro } => Some(distro.as_deref()),
+            ExecLocation::Wsl { distro, .. } => Some(distro.as_deref()),
         }
     }
 
+    pub(crate) fn wsl_user(&self) -> Option<&str> {
+        match &self.location {
+            ExecLocation::Host => None,
+            ExecLocation::Wsl { user, .. } => user.as_deref(),
+        }
+    }
+
+    pub(crate) fn process_instance(&self) -> Option<&str> {
+        self.env
+            .get(crate::agent_env::PROCESS_ENV)
+            .map(String::as_str)
+            .filter(|value| !value.is_empty())
+    }
+
     pub(crate) fn from_pty_options(options: &nebula_terminal::tty::Options) -> Self {
         let location = options
             .shell
@@ -50,9 +68,12 @@ impl PaneExecContext {
             .map_or(ExecLocation::Host, |shell| ExecLocation::Wsl {
                 distro: crate::shell_detect::wsl_launch_distro(shell.program(), shell.args())
                     .map(str::to_owned),
+                user: crate::shell_detect::wsl_launch_user(shell.program(), shell.args())
+                    .map(str::to_owned),
             });
         Self {
             location,
+            shell_program: options.shell.as_ref().map(|shell| shell.program().to_owned()),
             env: options.env.clone(),
             fallback_cwd: options
                 .working_directory
@@ -63,7 +84,12 @@ impl PaneExecContext {
 
     #[cfg(test)]
     fn host(cwd: PathBuf) -> Self {
-        Self { location: ExecLocation::Host, env: HashMap::new(), fallback_cwd: Some(cwd) }
+        Self {
+            location: ExecLocation::Host,
+            shell_program: None,
+            env: HashMap::new(),
+            fallback_cwd: Some(cwd),
+        }
     }
 }
 
@@ -171,11 +197,14 @@ fn build_command(
             command.args(&argv[1..]).current_dir(&cwd);
             execution = json!({ "environment": "host", "cwd": cwd });
         },
-        ExecLocation::Wsl { distro } => {
+        ExecLocation::Wsl { distro, user } => {
             command = Command::new("wsl.exe");
             if let Some(distro) = distro {
                 command.args(["--distribution", distro]);
             }
+            if let Some(user) = user {
+                command.args(["--user", user]);
+            }
             let guest_cwd = crate::shell_detect::wsl_guest_cwd(reported_cwd);
             if let Some(cwd) = guest_cwd {
                 command.args(["--cd", cwd]);
@@ -452,12 +481,13 @@ mod tests {
         assert_eq!(PaneExecContext::from_pty_options(&options).wsl_distribution(), Some(None));
         options.shell = Some(nebula_terminal::tty::Shell::new(
             "wsl.exe".into(),
-            vec!["--distribution".into(), "Debian".into()],
+            vec!["--distribution".into(), "Debian".into(), "--user".into(), "hello".into()],
         ));
         assert_eq!(
             PaneExecContext::from_pty_options(&options).wsl_distribution(),
             Some(Some("Debian"))
         );
+        assert_eq!(PaneExecContext::from_pty_options(&options).wsl_user(), Some("hello"));
     }
 
     #[test]
diff --git a/nebula_app/src/saved_commands.rs b/nebula_app/src/saved_commands.rs
index 6943735..8745f74 100644
--- a/nebula_app/src/saved_commands.rs
+++ b/nebula_app/src/saved_commands.rs
@@ -1,5 +1,7 @@
 //! User-managed shell commands shown by the GPUI command manager.
 
+pub(crate) mod builtins;
+
 use std::collections::HashSet;
 use std::io;
 use std::path::{Path, PathBuf};
diff --git a/nebula_app/src/saved_commands/builtins.rs b/nebula_app/src/saved_commands/builtins.rs
new file mode 100644
index 0000000..644e088
--- /dev/null
+++ b/nebula_app/src/saved_commands/builtins.rs
@@ -0,0 +1,285 @@
+//! Built-in development recipes. They are templates inserted for review, never auto-executed.
+
+use super::SavedCommand;
+use crate::i18n::{Message, UiLanguage};
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum CommandPlatform {
+    Windows,
+    Mac,
+    Posix,
+}
+
+pub(crate) fn commands(language: UiLanguage, platform: CommandPlatform) -> Vec<SavedCommand> {
+    use CommandPlatform::*;
+    let mut commands = Vec::new();
+    if platform == Windows {
+        commands.push(SavedCommand {
+            id: "builtin:docker_install_windows".into(),
+            name: language.text(Message::CommandsBuiltinDockerInstallWindows).into(),
+            command: "winget install --exact --id Docker.DockerDesktop".into(),
+            append_enter: false,
+        });
+    }
+    if platform == Mac {
+        commands.push(SavedCommand {
+            id: "builtin:docker_install_mac".into(),
+            name: language.text(Message::CommandsBuiltinDockerInstallMac).into(),
+            command: "brew install --cask docker".into(),
+            append_enter: false,
+        });
+    }
+    if platform == Posix {
+        commands.push(SavedCommand {
+            id: "builtin:docker_install_ubuntu".into(),
+            name: language.text(Message::CommandsBuiltinDockerInstallUbuntu).into(),
+            command: "sudo apt-get update && sudo apt-get install docker.io docker-compose-v2"
+                .into(),
+            append_enter: false,
+        });
+    }
+    if platform == Posix {
+        commands.push(SavedCommand {
+            id: "builtin:docker_install_fedora".into(),
+            name: language.text(Message::CommandsBuiltinDockerInstallFedora).into(),
+            command: "sudo dnf install moby-engine docker-compose".into(),
+            append_enter: false,
+        });
+    }
+    commands.push(SavedCommand {
+        id: "builtin:docker_ps".into(),
+        name: language.text(Message::CommandsBuiltinDockerPs).into(),
+        command: "docker ps -a".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:docker_images".into(),
+        name: language.text(Message::CommandsBuiltinDockerImages).into(),
+        command: "docker images".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:docker_build".into(),
+        name: language.text(Message::CommandsBuiltinDockerBuild).into(),
+        command: "docker build -t my-app:dev .".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:docker_run".into(),
+        name: language.text(Message::CommandsBuiltinDockerRun).into(),
+        command: "docker run --rm -it -p 8080:8080 my-app:dev".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:docker_logs".into(),
+        name: language.text(Message::CommandsBuiltinDockerLogs).into(),
+        command: "docker logs --follow --tail 100 container_name".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:docker_exec".into(),
+        name: language.text(Message::CommandsBuiltinDockerExec).into(),
+        command: "docker exec -it container_name sh".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:compose_up".into(),
+        name: language.text(Message::CommandsBuiltinComposeUp).into(),
+        command: "docker compose up -d --build".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:compose_logs".into(),
+        name: language.text(Message::CommandsBuiltinComposeLogs).into(),
+        command: "docker compose logs --follow --tail 100".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:compose_down".into(),
+        name: language.text(Message::CommandsBuiltinComposeDown).into(),
+        command: "docker compose down".into(),
+        append_enter: false,
+    });
+    if platform == Windows {
+        commands.push(SavedCommand {
+            id: "builtin:conda_install_windows".into(),
+            name: language.text(Message::CommandsBuiltinCondaInstallWindows).into(),
+            command: "winget install --exact --id Anaconda.Miniconda3".into(),
+            append_enter: false,
+        });
+    }
+    if platform == Mac {
+        commands.push(SavedCommand {
+            id: "builtin:conda_install_mac".into(),
+            name: language.text(Message::CommandsBuiltinCondaInstallMac).into(),
+            command: "brew install --cask miniconda".into(),
+            append_enter: false,
+        });
+    }
+    if platform == Posix {
+        commands.push(SavedCommand {
+            id: "builtin:conda_install_linux".into(),
+            name: language.text(Message::CommandsBuiltinCondaInstallLinux).into(),
+            command: "curl -fL -o miniconda-installer.sh \"https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-$(uname -m).sh\" && bash miniconda-installer.sh".into(),
+            append_enter: false,
+        });
+    }
+    commands.push(SavedCommand {
+        id: "builtin:conda_list".into(),
+        name: language.text(Message::CommandsBuiltinCondaList).into(),
+        command: "conda env list".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_create".into(),
+        name: language.text(Message::CommandsBuiltinCondaCreate).into(),
+        command: "conda create -n dev python=3.12".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_activate".into(),
+        name: language.text(Message::CommandsBuiltinCondaActivate).into(),
+        command: "conda activate dev".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_deactivate".into(),
+        name: language.text(Message::CommandsBuiltinCondaDeactivate).into(),
+        command: "conda deactivate".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_install".into(),
+        name: language.text(Message::CommandsBuiltinCondaInstall).into(),
+        command: "conda install numpy pandas matplotlib".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_export".into(),
+        name: language.text(Message::CommandsBuiltinCondaExport).into(),
+        command: "conda env export --from-history > environment.yml".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:conda_restore".into(),
+        name: language.text(Message::CommandsBuiltinCondaRestore).into(),
+        command: "conda env create -f environment.yml".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:python_venv".into(),
+        name: language.text(Message::CommandsBuiltinPythonVenv).into(),
+        command: "python -m venv .venv".into(),
+        append_enter: false,
+    });
+    if platform == Windows {
+        commands.push(SavedCommand {
+            id: "builtin:python_activate_windows".into(),
+            name: language.text(Message::CommandsBuiltinPythonActivateWindows).into(),
+            command: ".\\.venv\\Scripts\\Activate.ps1".into(),
+            append_enter: false,
+        });
+    }
+    if platform != Windows {
+        commands.push(SavedCommand {
+            id: "builtin:python_activate_posix".into(),
+            name: language.text(Message::CommandsBuiltinPythonActivatePosix).into(),
+            command: "source .venv/bin/activate".into(),
+            append_enter: false,
+        });
+    }
+    commands.push(SavedCommand {
+        id: "builtin:pip_install".into(),
+        name: language.text(Message::CommandsBuiltinPipInstall).into(),
+        command: "python -m pip install -r requirements.txt".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:uv_sync".into(),
+        name: language.text(Message::CommandsBuiltinUvSync).into(),
+        command: "uv sync".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:npm_install".into(),
+        name: language.text(Message::CommandsBuiltinNpmInstall).into(),
+        command: "npm ci".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:npm_dev".into(),
+        name: language.text(Message::CommandsBuiltinNpmDev).into(),
+        command: "npm run dev".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:pnpm_install".into(),
+        name: language.text(Message::CommandsBuiltinPnpmInstall).into(),
+        command: "pnpm install".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:git_status".into(),
+        name: language.text(Message::CommandsBuiltinGitStatus).into(),
+        command: "git status --short --branch".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:git_diff".into(),
+        name: language.text(Message::CommandsBuiltinGitDiff).into(),
+        command: "git diff".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:git_log".into(),
+        name: language.text(Message::CommandsBuiltinGitLog).into(),
+        command: "git log --oneline --graph --decorate -20".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:git_branch".into(),
+        name: language.text(Message::CommandsBuiltinGitBranch).into(),
+        command: "git switch -c feature/my-change".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:cargo_test".into(),
+        name: language.text(Message::CommandsBuiltinCargoTest).into(),
+        command: "cargo test".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:cargo_check".into(),
+        name: language.text(Message::CommandsBuiltinCargoCheck).into(),
+        command: "cargo check --all-targets".into(),
+        append_enter: false,
+    });
+    commands.push(SavedCommand {
+        id: "builtin:ssh_key".into(),
+        name: language.text(Message::CommandsBuiltinSshKey).into(),
+        command: "ssh-keygen -t ed25519 -C \"developer@example.com\"".into(),
+        append_enter: false,
+    });
+    commands
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn recipes_are_unique_reviewable_and_platform_specific() {
+        for platform in [CommandPlatform::Windows, CommandPlatform::Mac, CommandPlatform::Posix] {
+            let rows = commands(UiLanguage::EnUs, platform);
+            assert!(rows.len() >= 30);
+            let ids: std::collections::HashSet<_> = rows.iter().map(|row| &row.id).collect();
+            assert_eq!(ids.len(), rows.len());
+            assert!(rows.iter().all(|row| !row.append_enter && !row.command.contains('\n')));
+            assert_eq!(
+                rows.iter().any(|row| row.command.starts_with("winget ")),
+                platform == CommandPlatform::Windows
+            );
+            assert!(rows.iter().any(|row| row.command == "conda create -n dev python=3.12"));
+            assert!(rows.iter().any(|row| row.command == "docker compose up -d --build"));
+        }
+    }
+}
diff --git a/nebula_app/src/scientific_corpus.rs b/nebula_app/src/scientific_corpus.rs
new file mode 100644
index 0000000..84f4500
--- /dev/null
+++ b/nebula_app/src/scientific_corpus.rs
@@ -0,0 +1,264 @@
+//! The maintained documents are the source of regression inputs and benchmarks.
+
+use crate::math::layout::MathLayout;
+use crate::math::{DEFAULT_LIMITS, compile_formula_source};
+use crate::render_cache::RenderCache;
+use markdown::mdast::Node;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Instant;
+
+pub(crate) const DOCUMENTS: [(&str, usize, usize); 4] = [
+    ("math-rendering-test.md", 50, 0),
+    ("chemistry-rendering-test.md", 40, 55),
+    ("biology-rendering-test.md", 64, 64),
+    ("scientific-rendering-acceptance-paper.md", 35, 10),
+];
+
+#[derive(Debug)]
+pub(crate) struct Case {
+    pub(crate) source: String,
+    pub(crate) molecule: bool,
+    pub(crate) display: bool,
+    pub(crate) fallback: bool,
+    pub(crate) preserve: bool,
+    pub(crate) line: usize,
+}
+
+fn document_path(name: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../docs").join(name)
+}
+
+pub(crate) fn read_document(name: &str) -> String {
+    let path = document_path(name);
+    let text = std::fs::read_to_string(&path)
+        .unwrap_or_else(|error| panic!("{}: {error}", path.display()));
+    assert!(text.len() <= 128 * 1024, "default regression corpus must stay small");
+    text
+}
+
+pub(crate) fn cases(source: &str) -> Vec<Case> {
+    let mut options = markdown::ParseOptions::gfm();
+    options.constructs.math_flow = true;
+    options.constructs.math_text = true;
+    let tree = markdown::to_mdast(source, &options).expect("valid Markdown corpus");
+    let mut output = Vec::new();
+    let mut expectation = (false, false);
+    collect(&tree, &mut expectation, &mut output);
+    assert_eq!(expectation, (false, false), "orphan corpus expectation");
+    output
+}
+
+fn collect(node: &Node, expectation: &mut (bool, bool), output: &mut Vec<Case>) {
+    let content = match node {
+        Node::Html(html) if html.value.trim() == "<!-- pebrel-test: source-fallback -->" => {
+            assert_eq!(*expectation, (false, false), "unconsumed expectation marker");
+            *expectation = (true, false);
+            return;
+        },
+        Node::Html(html) if html.value.trim() == "<!-- pebrel-test: preserve-source -->" => {
+            assert_eq!(*expectation, (false, false), "unconsumed expectation marker");
+            *expectation = (false, true);
+            return;
+        },
+        Node::Math(math) => Some((&math.value, false, true)),
+        Node::InlineMath(math) => Some((&math.value, false, false)),
+        Node::Code(code)
+            if code.lang.as_deref().is_some_and(|lang| lang.eq_ignore_ascii_case("smiles")) =>
+        {
+            Some((&code.value, true, true))
+        },
+        _ => None,
+    };
+    if let Some((source, molecule, display)) = content {
+        output.push(Case {
+            source: source.clone(),
+            molecule,
+            display,
+            fallback: expectation.0,
+            preserve: expectation.1,
+            line: node.position().map_or(0, |position| position.start.line),
+        });
+        *expectation = (false, false);
+    } else if let Some(children) = node.children() {
+        for child in children {
+            collect(child, expectation, output);
+        }
+    }
+}
+
+fn assert_math_pixels(layout: &MathLayout, scale: f32) {
+    assert!(layout.metrics.width.is_finite() && layout.metrics.width >= 0.0);
+    assert!(layout.metrics.height.is_finite() && layout.metrics.depth.is_finite());
+    let rasterizer = crate::math::rasterizer::MathGlyphRasterizer::new().unwrap();
+    let geometry =
+        crate::math::bitmap::compose(&rasterizer, layout, scale, [0, 0, 0]).expect("formula image");
+    let bytes = &geometry.pixels;
+    assert_eq!(bytes.len(), geometry.width as usize * geometry.height as usize * 4);
+    assert!(geometry.width > 0 && geometry.height > 0);
+    if !layout.glyphs.is_empty() || !layout.rules.is_empty() {
+        assert!(bytes.chunks_exact(4).any(|pixel| pixel[3] != 0), "empty mathematical image");
+    }
+}
+
+#[test]
+fn maintained_scientific_documents_generate_math_pixels_and_molecular_svg() {
+    let mut failures = Vec::new();
+    for (name, minimum_math, minimum_molecules) in DOCUMENTS {
+        let input = read_document(name);
+        let cases = cases(&input);
+        assert!(
+            cases.iter().filter(|case| !case.molecule && !case.fallback).count() >= minimum_math,
+            "{name}: mathematical coverage shrank"
+        );
+        assert!(
+            cases.iter().filter(|case| case.molecule && !case.fallback).count()
+                >= minimum_molecules,
+            "{name}: molecular coverage shrank"
+        );
+        for case in cases {
+            if case.molecule {
+                let result = crate::chemistry::render_smiles(&case.source, false);
+                match (case.fallback, result) {
+                    (true, Err(_)) => {},
+                    (false, Ok(svg)) => {
+                        assert!(svg.starts_with("<svg"));
+                        assert!(svg.contains("viewBox="));
+                        assert!(!svg.contains("NaN") && !svg.contains("Infinity"));
+                    },
+                    (expected, actual) => failures.push(format!(
+                        "{name}:{} expected fallback={expected}; result={:?}; source={}",
+                        case.line,
+                        actual.map(|_| "rendered"),
+                        case.source
+                    )),
+                }
+            } else {
+                let result =
+                    compile_formula_source(&case.source, case.display, 18.0, 1.0, DEFAULT_LIMITS);
+                match (case.fallback, result) {
+                    (true, Err(_)) => {},
+                    (false, Ok(layout)) => {
+                        assert_math_pixels(&layout, 1.0);
+                        if case.preserve {
+                            let font = crate::math::font::MathFont::load().unwrap();
+                            if !case.source.contains('=') {
+                                let equal = font.glyph_id('=').unwrap().0;
+                                assert!(
+                                    !layout.glyphs.iter().any(|op| op.glyph_id == equal),
+                                    "must not invent a missing equality"
+                                );
+                            }
+                            if case.source.contains(",dx") {
+                                let comma = font.glyph_id(',').unwrap().0;
+                                assert!(
+                                    layout.glyphs.iter().any(|op| op.glyph_id == comma),
+                                    "comma must not become invisible spacing"
+                                );
+                            }
+                        }
+                    },
+                    (expected, actual) => failures.push(format!(
+                        "{name}:{} expected fallback={expected}; result={:?}; source={}",
+                        case.line,
+                        actual.map(|_| "rendered"),
+                        case.source
+                    )),
+                }
+            }
+        }
+    }
+    assert!(failures.is_empty(), "Scientific corpus failures:\n{}", failures.join("\n"));
+}
+
+#[test]
+fn repeated_corpus_resize_uses_bounded_lru_and_keeps_geometry_finite() {
+    let cases = cases(&read_document("scientific-rendering-acceptance-paper.md"));
+    let cases: Vec<_> =
+        cases.iter().filter(|case| !case.molecule && !case.fallback).take(12).collect();
+    let mut cache = RenderCache::new(256 * 1024, 32);
+    for width in [880.0_f32, 320.0, 640.0, 240.0, 880.0, 320.0] {
+        for (index, case) in cases.iter().enumerate() {
+            let layout =
+                compile_formula_source(&case.source, case.display, 18.0, 1.0, DEFAULT_LIMITS)
+                    .unwrap();
+            let pixel_size =
+                (18.0 * (width / layout.metrics.width.max(1.0)).min(1.0) * 0.98).max(6.0);
+            let key = (index, pixel_size.to_bits());
+            if cache.get(&key).is_none() {
+                let layout = compile_formula_source(
+                    &case.source,
+                    case.display,
+                    pixel_size,
+                    1.0,
+                    DEFAULT_LIMITS,
+                )
+                .unwrap();
+                assert_math_pixels(&layout, 1.25);
+                let bytes = layout.allocated_bytes() + 256;
+                cache.insert(key, Arc::new(layout), bytes);
+            }
+            assert!(cache.used_bytes() <= 256 * 1024);
+            assert!(cache.len() <= 32);
+        }
+    }
+}
+
+fn print_distribution(label: &str, values: &mut [f64]) {
+    if values.is_empty() {
+        return;
+    }
+    values.sort_by(f64::total_cmp);
+    let percentile = |n: usize| values[(values.len() * n).div_ceil(100).saturating_sub(1)];
+    println!(
+        "{label},samples={},median_ms={:.4},p95_ms={:.4},p99_ms={:.4}",
+        values.len(),
+        percentile(50),
+        percentile(95),
+        percentile(99)
+    );
+}
+
+#[test]
+#[ignore = "bounded informational corpus benchmark; run separately with one test thread"]
+fn measure_scientific_document_stages() {
+    println!(
+        "Scientific document CPU stages; no real AI sessions, no 100 MB allocation, no FPS claim."
+    );
+    let rasterizer = crate::math::rasterizer::MathGlyphRasterizer::new().unwrap();
+    for (name, _, _) in DOCUMENTS {
+        let source = read_document(name);
+        let mut parsing = Vec::new();
+        for _ in 0..10 {
+            let start = Instant::now();
+            std::hint::black_box(cases(&source));
+            parsing.push(start.elapsed().as_secs_f64() * 1000.0);
+        }
+        print_distribution(&format!("{name}:markdown_parse"), &mut parsing);
+        let mut compile = Vec::new();
+        let mut raster = Vec::new();
+        let mut molecules = Vec::new();
+        for case in cases(&source).into_iter().filter(|case| !case.fallback) {
+            if case.molecule {
+                let start = Instant::now();
+                let svg = crate::chemistry::render_smiles(&case.source, false).unwrap();
+                std::hint::black_box(svg);
+                molecules.push(start.elapsed().as_secs_f64() * 1000.0);
+            } else {
+                let start = Instant::now();
+                let layout =
+                    compile_formula_source(&case.source, case.display, 18.0, 1.0, DEFAULT_LIMITS)
+                        .unwrap();
+                compile.push(start.elapsed().as_secs_f64() * 1000.0);
+                let start = Instant::now();
+                std::hint::black_box(
+                    crate::math::bitmap::compose(&rasterizer, &layout, 1.0, [0, 0, 0]).unwrap(),
+                );
+                raster.push(start.elapsed().as_secs_f64() * 1000.0);
+            }
+        }
+        print_distribution(&format!("{name}:math_compile"), &mut compile);
+        print_distribution(&format!("{name}:math_bitmap"), &mut raster);
+        print_distribution(&format!("{name}:molecule_svg"), &mut molecules);
+    }
+}
diff --git a/nebula_app/src/shell_detect.rs b/nebula_app/src/shell_detect.rs
index 6dd30fa..f314db7 100644
--- a/nebula_app/src/shell_detect.rs
+++ b/nebula_app/src/shell_detect.rs
@@ -496,6 +496,30 @@ pub fn wsl_launch_distro<'a>(program: &str, args: &'a [String]) -> Option<&'a st
     args.get(index + 1).map(String::as_str).filter(|distro| !distro.is_empty())
 }
 
+/// 一次 WSL 启动用的来宾用户：只认显式 `-u` / `--user`。探测来宾进程时必须
+/// 使用同一个用户，否则 `wsl.exe` 可能启动另一份默认用户环境，看不到目标
+/// Codex 的 `/proc`。
+pub fn wsl_launch_user<'a>(program: &str, args: &'a [String]) -> Option<&'a str> {
+    let filename = program.rsplit(['/', '\\']).next().unwrap_or(program);
+    let stem = std::path::Path::new(filename)
+        .file_stem()
+        .and_then(|stem| stem.to_str())
+        .unwrap_or_default()
+        .to_ascii_lowercase();
+    if stem != "wsl" {
+        return None;
+    }
+    for (index, arg) in args.iter().enumerate() {
+        if matches!(arg.as_str(), "-u" | "--user") {
+            return args.get(index + 1).map(String::as_str).filter(|user| !user.is_empty());
+        }
+        if let Some(user) = arg.strip_prefix("--user=") {
+            return (!user.is_empty()).then_some(user);
+        }
+    }
+    None
+}
+
 /// 终端报的 cwd 是来宾侧的绝对路径吗（`/home/x`）。宿主路径（`D:\…`）不需要
 /// 映射，交给普通路径分支即可。
 pub fn wsl_guest_cwd(cwd: &str) -> Option<&str> {
@@ -778,6 +802,11 @@ mod tests {
         assert_eq!(super::wsl_launch_distro("wsl.exe", &owned(&["-d"])), None);
         assert_eq!(super::wsl_launch_distro("wsl.exe", &owned(&["-d", ""])), None);
         assert_eq!(super::wsl_launch_distro("pwsh.exe", &owned(&["-d", "Debian"])), None);
+
+        assert_eq!(super::wsl_launch_user("wsl.exe", &owned(&["--user", "hello"])), Some("hello"));
+        assert_eq!(super::wsl_launch_user("wsl.exe", &owned(&["--user=hello"])), Some("hello"));
+        assert_eq!(super::wsl_launch_user("wsl.exe", &owned(&["--user"])), None);
+        assert_eq!(super::wsl_launch_user("pwsh.exe", &owned(&["--user", "hello"])), None);
     }
 
     /// 只有来宾绝对路径需要映射；宿主路径与空 cwd 走普通分支。
diff --git a/nebula_app/src/ssh_profiles.rs b/nebula_app/src/ssh_profiles.rs
index aaa1552..b358ea3 100644
--- a/nebula_app/src/ssh_profiles.rs
+++ b/nebula_app/src/ssh_profiles.rs
@@ -3,9 +3,15 @@ use std::path::{Path, PathBuf};
 
 use serde::{Deserialize, Deserializer, Serialize};
 
+#[path = "ssh_profiles/connection.rs"]
 mod connection;
+#[path = "ssh_profiles/exchange.rs"]
+pub(crate) mod exchange;
+#[path = "ssh_profiles/organization.rs"]
+mod organization;
 pub(crate) use connection::validate_ssh_destination;
 pub use connection::{SshConnectionOptions, SshHostJumpMode, SshHostProxyMode};
+pub(crate) use organization::{HostOrganization, merge_host_sources};
 
 const PROFILE_VERSION: u32 = 1;
 const USERNAME_HISTORY_CAP: usize = 12;
@@ -67,11 +73,21 @@ pub struct SshProfiles {
     /// Profile 一起持久化；旧文件缺少字段时由 `serde(default)` 读成空列表。
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     usernames: Vec<String>,
+    #[serde(default, skip_serializing_if = "std::collections::BTreeMap::is_empty")]
+    organization: std::collections::BTreeMap<String, HostOrganization>,
+    #[serde(skip)]
+    source_bytes: Option<Vec<u8>>,
 }
 
 impl Default for SshProfiles {
     fn default() -> Self {
-        Self { version: PROFILE_VERSION, profiles: Vec::new(), usernames: Vec::new() }
+        Self {
+            version: PROFILE_VERSION,
+            profiles: Vec::new(),
+            usernames: Vec::new(),
+            organization: Default::default(),
+            source_bytes: None,
+        }
     }
 }
 
@@ -87,23 +103,39 @@ impl SshProfiles {
         for profile in &mut profiles.profiles {
             deduplicate_key_paths(&mut profile.private_keys);
         }
+        for value in profiles.organization.values() {
+            value.validate().map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
+        }
         normalize_usernames(&mut profiles.usernames);
         profiles.version = PROFILE_VERSION;
+        profiles.source_bytes = Some(data);
         Ok(profiles)
     }
 
-    pub fn save(&self, path: &Path) -> io::Result<()> {
+    pub fn save(&mut self, path: &Path) -> io::Result<()> {
         if let Some(parent) = path.parent() {
             std::fs::create_dir_all(parent)?;
         }
-        let data = serde_json::to_vec_pretty(self).map_err(io::Error::other)?;
-        let temporary = path.with_extension(format!("nebula-tmp-{}", std::process::id()));
-        std::fs::write(&temporary, data)?;
-        let result = replace_file(&temporary, path);
-        if result.is_err() {
-            let _ = std::fs::remove_file(&temporary);
+        // Reuse the OS-handle lease, scoped to this write. A stale snapshot must
+        // never replace a profile another window has just edited.
+        let _lease = crate::atomic_file::try_lifetime_lock(path)?.ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::WouldBlock,
+                "Host profiles are being saved by another window",
+            )
+        })?;
+        let current = match std::fs::read(path) {
+            Ok(bytes) => Some(bytes),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => None,
+            Err(error) => return Err(error),
+        };
+        if current != self.source_bytes {
+            return Err(io::Error::other("Host profiles changed. Reload before saving."));
         }
-        result
+        let data = serde_json::to_vec_pretty(self).map_err(io::Error::other)?;
+        crate::atomic_file::write(path, &data)?;
+        self.source_bytes = Some(data);
+        Ok(())
     }
 
     pub fn for_destination(&self, destination: &str) -> SshProfileAuth {
@@ -203,6 +235,7 @@ impl SshProfiles {
 
     pub fn remove(&mut self, destination: &str) {
         self.profiles.retain(|profile| profile.destination != destination);
+        self.organization.remove(destination);
     }
 
     pub fn jump_dependents(&self, destination: &str) -> Vec<String> {
@@ -218,6 +251,7 @@ impl SshProfiles {
     }
 
     pub fn rename(&mut self, old: &str, new: &str) {
+        let organization = self.organization.remove(old);
         if let Some(mut profile) =
             self.profiles.iter().find(|profile| profile.destination == old).cloned()
         {
@@ -225,6 +259,9 @@ impl SshProfiles {
             profile.destination = new.to_owned();
             self.upsert(profile);
         }
+        if let Some(organization) = organization {
+            self.organization.insert(new.to_owned(), organization);
+        }
         for profile in &mut self.profiles {
             if profile.connection.jump_mode == SshHostJumpMode::Host
                 && profile.connection.jump_host.trim() == old
@@ -280,12 +317,6 @@ fn deduplicate_key_paths(paths: &mut Vec<PathBuf>) {
     });
 }
 
-/// 原子替换走 [`crate::atomic_file::replace`]：Windows `MoveFileExW`、Unix
-/// `rename`，两端语义同为「目标要么旧要么新」。此前这里复制了一份 Windows 版。
-fn replace_file(source: &Path, destination: &Path) -> io::Result<()> {
-    crate::atomic_file::replace(source, destination)
-}
-
 #[cfg(test)]
 mod tests {
     use super::{SshAuthMode, SshProfileAuth, SshProfiles};
diff --git a/nebula_app/src/ssh_profiles/connection.rs b/nebula_app/src/ssh_profiles/connection.rs
index 99c137b..032c6ab 100644
--- a/nebula_app/src/ssh_profiles/connection.rs
+++ b/nebula_app/src/ssh_profiles/connection.rs
@@ -186,4 +186,5 @@ fn normalized_destination(destination: &str) -> String {
 }
 
 #[cfg(test)]
+#[path = "connection/tests.rs"]
 mod tests;
diff --git a/nebula_app/src/ssh_profiles/exchange.rs b/nebula_app/src/ssh_profiles/exchange.rs
new file mode 100644
index 0000000..5943bb4
--- /dev/null
+++ b/nebula_app/src/ssh_profiles/exchange.rs
@@ -0,0 +1,242 @@
+//! Bounded, credential-free CSV exchange with validation before any mutation.
+
+use super::*;
+
+const MAX_IMPORT_BYTES: usize = 8 * 1024 * 1024;
+const MAX_IMPORT_HOSTS: usize = 10_000;
+
+#[derive(Clone, Debug)]
+pub(crate) struct HostRecord {
+    pub destination: String,
+    pub label: String,
+    pub organization: HostOrganization,
+}
+
+pub(crate) fn parse_csv(text: &str) -> Result<Vec<HostRecord>, String> {
+    if text.len() > MAX_IMPORT_BYTES {
+        return Err("Host import exceeds 8 MiB".into());
+    }
+    let rows = csv_rows(text.trim_start_matches('\u{feff}'))?;
+    let Some(header) = rows.first() else {
+        return Err("The host file is empty".into());
+    };
+    let header: Vec<_> = header.iter().map(|name| name.trim().to_ascii_lowercase()).collect();
+    let column = |aliases: &[&str]| header.iter().position(|name| aliases.contains(&name.as_str()));
+    let destination = column(&["destination", "host", "hostname", "address"])
+        .ok_or("The CSV needs a destination or host column")?;
+    let label = column(&["label", "name"]);
+    let group = column(&["group", "folder"]);
+    let tags = column(&["tags"]);
+    let notes = column(&["notes", "description"]);
+    let username = column(&["username", "user"]);
+    let port = column(&["port"]);
+    let secrets: Vec<_> = header
+        .iter()
+        .enumerate()
+        .filter_map(|(index, name)| {
+            matches!(name.as_str(), "password" | "privatekey" | "private_key" | "passphrase")
+                .then_some(index)
+        })
+        .collect();
+    let mut records = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+    for (index, row) in rows.iter().enumerate().skip(1) {
+        if row.iter().all(|field| field.trim().is_empty()) {
+            continue;
+        }
+        let field = |index: Option<usize>| {
+            index.and_then(|index| row.get(index)).map(|s| s.trim()).unwrap_or_default()
+        };
+        if secrets.iter().any(|column| !field(Some(*column)).is_empty()) {
+            return Err(format!(
+                "Row {} contains credentials; import host metadata only",
+                index + 1
+            ));
+        }
+        let mut target = field(Some(destination)).to_owned();
+        if !field(username).is_empty() && !target.contains('@') {
+            target = format!("{}@{target}", field(username));
+        }
+        if !field(port).is_empty() {
+            let value = field(port)
+                .parse::<u16>()
+                .ok()
+                .filter(|p| *p != 0)
+                .ok_or_else(|| format!("Invalid port on row {}", index + 1))?;
+            // An explicit port column must not silently replace a port in the destination.
+            let address = target.rsplit('@').next().unwrap_or(&target);
+            if address.contains(':') && !(address.starts_with('[') && address.ends_with(']')) {
+                return Err(format!("Ambiguous destination and port on row {}", index + 1));
+            }
+            target.push_str(&format!(":{value}"));
+        }
+        validate_ssh_destination(&target).map_err(|e| format!("Row {}: {e}", index + 1))?;
+        if !seen.insert(target.clone()) {
+            return Err(format!("Duplicate destination on row {}: {target}", index + 1));
+        }
+        let label = field(label).to_owned();
+        if label.chars().count() > 256 || label.chars().any(char::is_control) {
+            return Err(format!("Invalid host label on row {}", index + 1));
+        }
+        let organization = HostOrganization::from_inputs(field(group), field(tags), field(notes))
+            .map_err(|e| format!("Row {}: {e}", index + 1))?;
+        records.push(HostRecord { destination: target, label, organization });
+        if records.len() > MAX_IMPORT_HOSTS {
+            return Err("Host import exceeds 10000 entries".into());
+        }
+    }
+    if records.is_empty() {
+        return Err("The CSV has no host records".into());
+    }
+    Ok(records)
+}
+
+impl SshProfiles {
+    pub(crate) fn import_missing(&mut self, records: &[HostRecord]) -> Result<usize, String> {
+        let mut updated = self.clone();
+        let mut added = 0;
+        for record in records {
+            validate_ssh_destination(&record.destination)?;
+            record.organization.validate()?;
+            if updated.contains(&record.destination) {
+                continue;
+            }
+            updated.upsert(SshProfileAuth {
+                destination: record.destination.clone(),
+                auth: SshAuthMode::Auto,
+                private_keys: vec![],
+                label: (!record.label.is_empty()).then(|| record.label.clone()),
+                icon: None,
+                connection: Default::default(),
+            });
+            updated.set_organization(&record.destination, record.organization.clone())?;
+            added += 1;
+        }
+        *self = updated;
+        Ok(added)
+    }
+
+    pub(crate) fn export_csv(&self) -> String {
+        let mut csv = "destination,label,group,tags,notes\r\n".to_owned();
+        for profile in &self.profiles {
+            let meta = self.organization(&profile.destination);
+            let tags = meta.tags.join(";");
+            let fields = [
+                &profile.destination,
+                profile.label.as_deref().unwrap_or_default(),
+                &meta.group,
+                &tags,
+                &meta.notes,
+            ];
+            csv.push_str(&fields.into_iter().map(quote_csv).collect::<Vec<_>>().join(","));
+            csv.push_str("\r\n");
+        }
+        csv
+    }
+}
+
+fn quote_csv(value: &str) -> String {
+    format!("\"{}\"", value.replace('"', "\"\""))
+}
+
+fn csv_rows(text: &str) -> Result<Vec<Vec<String>>, String> {
+    let mut rows = Vec::new();
+    let mut row = Vec::new();
+    let mut value = String::new();
+    let mut quoted = false;
+    let mut closed = false;
+    let mut chars = text.chars().peekable();
+    while let Some(c) = chars.next() {
+        if quoted {
+            if c == '"' {
+                if chars.peek() == Some(&'"') {
+                    chars.next();
+                    value.push('"');
+                } else {
+                    quoted = false;
+                    closed = true;
+                }
+            } else {
+                value.push(c);
+            }
+            continue;
+        }
+        match c {
+            '"' if value.is_empty() && !closed => quoted = true,
+            ',' => {
+                row.push(std::mem::take(&mut value));
+                closed = false;
+            },
+            '\r' | '\n' => {
+                if c == '\r' && chars.peek() == Some(&'\n') {
+                    chars.next();
+                }
+                row.push(std::mem::take(&mut value));
+                rows.push(std::mem::take(&mut row));
+                closed = false;
+                if rows.len() > MAX_IMPORT_HOSTS + 1 {
+                    return Err("Too many CSV rows".into());
+                }
+            },
+            _ if closed || c == '"' => return Err("Invalid CSV quoting".into()),
+            _ => value.push(c),
+        }
+    }
+    if quoted {
+        return Err("Unclosed CSV quote".into());
+    }
+    if !row.is_empty() || !value.is_empty() || closed {
+        row.push(value);
+        rows.push(row);
+    }
+    Ok(rows)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn csv_round_trip_preserves_unicode_quotes_and_multiline_notes_without_secrets() {
+        let records = parse_csv("destination,label,group,tags,notes\nroot@a,\"主机,一\",生产,\"db;linux\",\"line 1\nline \"\"2\"\"\"\n").unwrap();
+        let mut profiles = SshProfiles::default();
+        profiles.import_missing(&records).unwrap();
+        let exported = profiles.export_csv();
+        let restored = parse_csv(&exported).unwrap();
+        assert_eq!(restored[0].label, "主机,一");
+        assert_eq!(restored[0].organization.notes, "line 1\nline \"2\"");
+        assert!(!exported.contains("password"));
+        assert!(!exported.contains("private_keys"));
+    }
+
+    #[test]
+    fn invalid_batch_never_partially_mutates_profiles() {
+        let mut records = parse_csv("host\na\nb\n").unwrap();
+        records[1].destination = "bad;command".into();
+        let mut profiles = SshProfiles::default();
+        assert!(profiles.import_missing(&records).is_err());
+        assert_eq!(profiles.destinations().count(), 0);
+    }
+
+    #[test]
+    fn importing_again_preserves_existing_credentials_and_labels() {
+        let records = parse_csv("host,label\na,Original\n").unwrap();
+        let mut profiles = SshProfiles::default();
+        assert_eq!(profiles.import_missing(&records).unwrap(), 1);
+        profiles.profiles[0].private_keys.push("private-key".into());
+        let incoming = parse_csv("host,label\na,Replacement\nb,New\n").unwrap();
+        assert_eq!(profiles.import_missing(&incoming).unwrap(), 1);
+        assert_eq!(profiles.for_destination("a").label.as_deref(), Some("Original"));
+        assert_eq!(profiles.for_destination("a").private_keys, vec![PathBuf::from("private-key")]);
+        assert!(!profiles.export_csv().contains("private-key"));
+    }
+
+    #[test]
+    fn rejects_credentials_duplicate_hosts_bad_ports_and_incomplete_quotes() {
+        for csv in
+            ["host,password\na,secret", "host\na\na", "host,port\na,0", "host\n\"a", "host\n\"a\"x"]
+        {
+            assert!(parse_csv(csv).is_err(), "{csv}");
+        }
+    }
+}
diff --git a/nebula_app/src/ssh_profiles/organization.rs b/nebula_app/src/ssh_profiles/organization.rs
new file mode 100644
index 0000000..59e28d3
--- /dev/null
+++ b/nebula_app/src/ssh_profiles/organization.rs
@@ -0,0 +1,272 @@
+//! Host organization is profile data. Recently used destinations are a separate bounded list.
+
+use super::*;
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub(crate) struct HostOrganization {
+    pub group: String,
+    pub tags: Vec<String>,
+    pub notes: String,
+}
+
+impl HostOrganization {
+    pub(crate) fn from_inputs(group: &str, tags: &str, notes: &str) -> Result<Self, String> {
+        let mut unique = Vec::new();
+        for tag in tags.split([',', ';', '，', '；']).map(str::trim).filter(|t| !t.is_empty()) {
+            if !unique.iter().any(|old: &String| old.to_lowercase() == tag.to_lowercase()) {
+                unique.push(tag.to_owned());
+            }
+        }
+        let value =
+            Self { group: group.trim().to_owned(), tags: unique, notes: notes.trim().to_owned() };
+        value.validate()?;
+        Ok(value)
+    }
+
+    pub(crate) fn validate(&self) -> Result<(), String> {
+        if self.group.chars().count() > 128 || self.group.chars().any(char::is_control) {
+            return Err("A group must contain at most 128 visible characters".into());
+        }
+        if self.tags.len() > 32
+            || self.tags.iter().any(|tag| {
+                tag.is_empty() || tag.chars().count() > 64 || tag.chars().any(char::is_control)
+            })
+        {
+            return Err("Use at most 32 tags, each containing 1–64 visible characters".into());
+        }
+        if self.notes.chars().count() > 4096
+            || self.notes.chars().any(|c| c.is_control() && !matches!(c, '\n' | '\r' | '\t'))
+        {
+            return Err("Host notes must contain at most 4096 characters".into());
+        }
+        Ok(())
+    }
+
+    fn is_empty(&self) -> bool {
+        self.group.is_empty() && self.tags.is_empty() && self.notes.is_empty()
+    }
+}
+
+impl SshProfiles {
+    pub(crate) fn destinations(&self) -> impl Iterator<Item = &str> {
+        self.profiles.iter().map(|profile| profile.destination.as_str())
+    }
+
+    pub(crate) fn contains(&self, destination: &str) -> bool {
+        self.profiles.iter().any(|profile| profile.destination == destination)
+    }
+
+    pub(crate) fn organization(&self, destination: &str) -> &HostOrganization {
+        static EMPTY: HostOrganization =
+            HostOrganization { group: String::new(), tags: Vec::new(), notes: String::new() };
+        self.organization.get(destination).unwrap_or(&EMPTY)
+    }
+
+    pub(crate) fn set_organization(
+        &mut self,
+        destination: &str,
+        value: HostOrganization,
+    ) -> Result<(), String> {
+        value.validate()?;
+        if !self.contains(destination) {
+            return Err("Save the host before its organization".into());
+        }
+        if value.is_empty() {
+            self.organization.remove(destination);
+        } else {
+            self.organization.insert(destination.to_owned(), value);
+        }
+        Ok(())
+    }
+
+    /// Filter the merged sources in their existing order. Build one borrowed
+    /// profile index per query, rather than scanning all profiles for every row.
+    pub(crate) fn filter_hosts(
+        &self,
+        hosts: Vec<String>,
+        query: &str,
+        managed_only: bool,
+        group: Option<&str>,
+    ) -> Vec<String> {
+        let profiles: std::collections::HashMap<_, _> =
+            self.profiles.iter().map(|profile| (profile.destination.as_str(), profile)).collect();
+        let terms: Vec<_> = query.split_whitespace().map(str::to_lowercase).collect();
+        hosts
+            .into_iter()
+            .filter(|destination| {
+                let profile = profiles.get(destination.as_str());
+                if managed_only && profile.is_none() {
+                    return false;
+                }
+                let organization = self.organization(destination);
+                if group.is_some_and(|group| organization.group != group) {
+                    return false;
+                }
+                if terms.is_empty() {
+                    return true;
+                }
+                let searchable = format!(
+                    "{} {} {} {} {}",
+                    destination,
+                    profile.and_then(|p| p.label.as_deref()).unwrap_or_default(),
+                    organization.group,
+                    organization.tags.join(" "),
+                    organization.notes
+                )
+                .to_lowercase();
+                terms.iter().all(|term| searchable.contains(term))
+            })
+            .collect()
+    }
+
+    pub(crate) fn groups(&self) -> Vec<String> {
+        self.organization
+            .values()
+            .map(|value| value.group.trim())
+            .filter(|group| !group.is_empty())
+            .collect::<std::collections::BTreeSet<_>>()
+            .into_iter()
+            .map(str::to_owned)
+            .collect()
+    }
+}
+
+/// Both shells adapt this rule. No filesystem reads or renderer state live here.
+pub(crate) fn merge_host_sources<'a>(
+    recent: &'a [String],
+    pinned: &[String],
+    hidden: &[String],
+    configured: &'a [String],
+    managed: impl IntoIterator<Item = &'a str>,
+) -> Vec<String> {
+    let hidden: std::collections::HashSet<_> = hidden.iter().map(String::as_str).collect();
+    let mut seen = std::collections::HashSet::new();
+    let mut hosts = Vec::new();
+    for host in recent
+        .iter()
+        .map(String::as_str)
+        .chain(managed)
+        .chain(configured.iter().map(String::as_str))
+    {
+        if !hidden.contains(host) && seen.insert(host.to_owned()) {
+            hosts.push(host.to_owned());
+        }
+    }
+    hosts.sort_by_key(|host| pinned.iter().position(|pin| pin == host).unwrap_or(usize::MAX));
+    hosts
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn host(destination: &str) -> SshProfileAuth {
+        SshProfileAuth {
+            destination: destination.into(),
+            auth: SshAuthMode::Auto,
+            private_keys: vec![],
+            label: Some("Production database".into()),
+            icon: None,
+            connection: Default::default(),
+        }
+    }
+
+    #[test]
+    fn two_hundred_managed_hosts_survive_a_twenty_entry_recent_list() {
+        let managed: Vec<_> = (0..200).map(|n| format!("root@server-{n}")).collect();
+        let recent = managed[180..].to_vec();
+        let hosts = merge_host_sources(&recent, &[], &[], &[], managed.iter().map(String::as_str));
+        assert_eq!(hosts.len(), 200);
+        assert!(hosts.contains(&managed[0]));
+        assert_eq!(hosts[0], managed[180]);
+    }
+
+    #[test]
+    fn search_preserves_source_order_and_combines_group_and_management_filters() {
+        let mut profiles = SshProfiles::default();
+        profiles.upsert(host("root@db"));
+        profiles
+            .set_organization(
+                "root@db",
+                HostOrganization::from_inputs("生产", "linux", "Owner: Alice").unwrap(),
+            )
+            .unwrap();
+        let hosts = vec!["config-only".into(), "root@db".into(), "recent-only".into()];
+        assert_eq!(profiles.filter_hosts(hosts.clone(), "  ", false, None), hosts);
+        assert_eq!(profiles.filter_hosts(hosts.clone(), "", true, None), vec!["root@db"]);
+        assert_eq!(
+            profiles.filter_hosts(hosts.clone(), "", false, Some("")),
+            vec!["config-only", "recent-only"]
+        );
+        assert_eq!(
+            profiles.filter_hosts(hosts.clone(), "DATABASE alice LINUX", false, Some("生产")),
+            vec!["root@db"]
+        );
+        assert!(profiles.filter_hosts(hosts.clone(), "alice", false, Some("")).is_empty());
+        assert_eq!(profiles.filter_hosts(hosts, "CONFIG", false, None), vec!["config-only"]);
+    }
+
+    #[test]
+    fn hidden_and_pinned_rules_apply_to_every_source_without_duplicates() {
+        let hosts = merge_host_sources(
+            &["a".into()],
+            &["b".into()],
+            &["c".into()],
+            &["a".into(), "c".into()],
+            ["a", "b", "c"],
+        );
+        assert_eq!(hosts, vec!["b", "a"]);
+    }
+
+    #[test]
+    fn organization_survives_auth_changes_rename_and_round_trip() {
+        let mut profiles = SshProfiles::default();
+        profiles.upsert(host("root@a"));
+        profiles
+            .set_organization(
+                "root@a",
+                HostOrganization::from_inputs("生产", "DB,db,linux", "负责人 Alice").unwrap(),
+            )
+            .unwrap();
+        profiles.upsert(host("root@a"));
+        profiles.rename("root@a", "root@b");
+        let restored: SshProfiles =
+            serde_json::from_str(&serde_json::to_string(&profiles).unwrap()).unwrap();
+        assert_eq!(restored.organization("root@b").tags, vec!["DB", "linux"]);
+        assert_eq!(
+            restored.filter_hosts(vec!["root@b".into()], "生产 alice", false, None),
+            vec!["root@b"]
+        );
+        assert!(restored.filter_hosts(vec!["root@b".into()], "missing", false, None).is_empty());
+        profiles.remove("root@b");
+        assert!(profiles.organization.is_empty());
+    }
+
+    #[test]
+    fn old_profiles_load_without_organization() {
+        let profiles: SshProfiles = serde_json::from_str(r#"{"version":1,"profiles":[]}"#).unwrap();
+        assert!(profiles.groups().is_empty());
+    }
+
+    #[test]
+    fn stale_profile_save_cannot_erase_another_windows_host_changes() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("hosts.json");
+        let mut initial = SshProfiles::default();
+        initial.upsert(host("a"));
+        initial.save(&path).unwrap();
+        let mut first = SshProfiles::load(&path).unwrap();
+        let mut stale = SshProfiles::load(&path).unwrap();
+        first.upsert(host("b"));
+        first.save(&path).unwrap();
+        stale.upsert(host("c"));
+        assert!(stale.save(&path).is_err());
+        let loaded = SshProfiles::load(&path).unwrap();
+        assert!(loaded.contains("b"));
+        assert!(!loaded.contains("c"));
+        first.upsert(host("d"));
+        first.save(&path).unwrap();
+        assert!(SshProfiles::load(&path).unwrap().contains("d"));
+    }
+}
diff --git a/nebula_app/src/ssh_session.rs b/nebula_app/src/ssh_session.rs
index a3ac96b..179d246 100644
--- a/nebula_app/src/ssh_session.rs
+++ b/nebula_app/src/ssh_session.rs
@@ -16,7 +16,6 @@ use nebula_terminal::event::{Event as TerminalEvent, WindowSize};
 use nebula_terminal::event_loop::{EventLoopSender, StreamProcessor};
 use nebula_terminal::sync::FairMutex;
 use nebula_terminal::term::Term;
-use russh::ChannelMsg;
 use russh::client::{self, KeyboardInteractiveAuthResponse};
 use russh::keys::ssh_key;
 use russh::keys::{HashAlg, PrivateKeyWithHashAlg};
@@ -26,6 +25,7 @@ use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
 use crate::event::EventProxy;
 use crate::proxy_test::{ProxyTestFailure, ProxyTestOutcome, ProxyTestResult, ProxyTestRoute};
 
+mod exec;
 mod lifecycle;
 mod route;
 use route::{ResolvedRoute, RouteTransport};
@@ -879,42 +879,8 @@ pub(crate) async fn exec_capture(
     .map_err(|err| format!("SSH 地址解析任务失败: {err}"))??;
 
     let session = authenticated_session(&destination, &profile, None::<&NoopSshEventHost>).await?;
-    let mut channel = lifecycle::network("exec channel", session.channel_open_session()).await?;
-    channel.exec(true, command).await?;
-    if !script.is_empty() {
-        channel.data_bytes(script.to_vec()).await?;
-        // 不发 EOF 的话远端 `sh` 会一直等更多输入，命令永远不结束。
-        channel.eof().await?;
-    }
-
-    let collect = async {
-        let mut stdout = Vec::new();
-        while let Some(message) = channel.wait().await {
-            match message {
-                ChannelMsg::Data { data } => stdout.extend_from_slice(&data),
-                // 标准错误只当诊断线索，不混进结果——远端的 `ps: not found`
-                // 之类抱怨不该被当成路径。
-                ChannelMsg::ExtendedData { data, .. } => {
-                    if let Ok(text) = std::str::from_utf8(&data) {
-                        let text = text.trim();
-                        if !text.is_empty() {
-                            log::debug!("远端命令 stderr（{raw_destination}）: {text}");
-                        }
-                    }
-                },
-                ChannelMsg::Eof | ChannelMsg::Close => break,
-                _ => {},
-            }
-        }
-        stdout
-    };
-
-    match tokio::time::timeout(budget, collect).await {
-        // 远端文件名和路径未必是合法 UTF-8。有损转换让"大部分能读"胜过
-        // "整次探测失败"；真正需要字节精度的路径操作走 SFTP，不走这里。
-        Ok(stdout) => Ok(String::from_utf8_lossy(&stdout).into_owned()),
-        Err(_) => Err(format!("远端命令超过 {} 秒未返回", budget.as_secs()).into()),
-    }
+    let channel = lifecycle::network("exec channel", session.channel_open_session()).await?;
+    exec::capture(channel, command, script, budget, raw_destination).await
 }
 
 /// 在现有认证连接上打开独立 SFTP 子系统；连接池和认证策略仍只有一份。
diff --git a/nebula_app/src/ssh_session/exec.rs b/nebula_app/src/ssh_session/exec.rs
new file mode 100644
index 0000000..2b66443
--- /dev/null
+++ b/nebula_app/src/ssh_session/exec.rs
@@ -0,0 +1,54 @@
+//! Short-lived remote probes share the shell channel's close-on-drop ownership.
+use super::{SessionError, lifecycle};
+use russh::{Channel, ChannelMsg, client};
+use std::time::Duration;
+
+pub(super) async fn capture(
+    channel: Channel<client::Msg>,
+    command: &str,
+    script: &[u8],
+    budget: Duration,
+    raw_destination: &str,
+) -> Result<String, SessionError> {
+    let mut channel = lifecycle::own_channel(channel);
+    channel.exec(true, command).await?;
+    if !script.is_empty() {
+        channel.data_bytes(script.to_vec()).await?;
+        // 不发 EOF 的话远端 `sh` 会一直等更多输入，命令永远不结束。
+        channel.eof().await?;
+    }
+
+    let collect = async {
+        let mut stdout = Vec::new();
+        while let Some(message) = channel.wait().await {
+            match message {
+                ChannelMsg::Data { data } => stdout.extend_from_slice(&data),
+                // 标准错误只当诊断线索，不混进结果——远端的 `ps: not found`
+                // 之类抱怨不该被当成路径。
+                ChannelMsg::ExtendedData { data, .. } => {
+                    if let Ok(text) = std::str::from_utf8(&data) {
+                        let text = text.trim();
+                        if !text.is_empty() {
+                            log::debug!("远端命令 stderr（{raw_destination}）: {text}");
+                        }
+                    }
+                },
+                ChannelMsg::Eof | ChannelMsg::Close => break,
+                _ => {},
+            }
+        }
+        stdout
+    };
+
+    let result = tokio::time::timeout(budget, collect).await;
+    let closed = channel.finish().await;
+    match result {
+        // 远端文件名和路径未必是合法 UTF-8。有损转换让"大部分能读"胜过
+        // "整次探测失败"；真正需要字节精度的路径操作走 SFTP，不走这里。
+        Ok(stdout) => {
+            closed?;
+            Ok(String::from_utf8_lossy(&stdout).into_owned())
+        },
+        Err(_) => Err(format!("远端命令超过 {} 秒未返回", budget.as_secs()).into()),
+    }
+}
diff --git a/nebula_app/src/ssh_session/lifecycle.rs b/nebula_app/src/ssh_session/lifecycle.rs
index 4d1912a..6505742 100644
--- a/nebula_app/src/ssh_session/lifecycle.rs
+++ b/nebula_app/src/ssh_session/lifecycle.rs
@@ -251,12 +251,28 @@ impl Drop for Opening {
     }
 }
 
-struct ShellChannel {
+pub(super) struct ShellChannel {
     channel: Option<Channel<client::Msg>>,
     pending: VecDeque<ChannelMsg>,
     pending_bytes: usize,
 }
 
+/// The same close-on-drop ownership applies to shell and short-lived exec channels.
+pub(super) fn own_channel(channel: Channel<client::Msg>) -> ShellChannel {
+    ShellChannel { channel: Some(channel), pending: VecDeque::new(), pending_bytes: 0 }
+}
+
+impl ShellChannel {
+    pub(super) async fn finish(&mut self) -> Result<(), SessionError> {
+        if let Some(channel) = &self.channel {
+            // Retain ownership across await: cancellation still runs close-on-drop.
+            network("channel close", channel.close()).await?;
+        }
+        self.channel.take();
+        Ok(())
+    }
+}
+
 impl Deref for ShellChannel {
     type Target = Channel<client::Msg>;
     fn deref(&self) -> &Self::Target {
diff --git a/nebula_app/src/ssh_session/lifecycle/tests.rs b/nebula_app/src/ssh_session/lifecycle/tests.rs
index 65e523d..1c144de 100644
--- a/nebula_app/src/ssh_session/lifecycle/tests.rs
+++ b/nebula_app/src/ssh_session/lifecycle/tests.rs
@@ -61,6 +61,8 @@ enum Mode {
     DropWithoutStatus,
     ExitAfterEof,
     HangFirstConnection,
+    ExecEof,
+    ExecHang,
 }
 
 struct Loopback {
@@ -77,6 +79,32 @@ impl server::Handler for Loopback {
         Ok(Auth::Accept)
     }
 
+    async fn exec_request(
+        &mut self,
+        channel: ChannelId,
+        _command: &[u8],
+        session: &mut Session,
+    ) -> Result<(), Self::Error> {
+        session.channel_success(channel)?;
+        if self.mode == Mode::ExecEof {
+            session.data(channel, &b"probe result\n"[..])?;
+            session.eof(channel)?;
+        }
+        Ok(())
+    }
+
+    async fn channel_close(
+        &mut self,
+        channel: ChannelId,
+        _session: &mut Session,
+    ) -> Result<(), Self::Error> {
+        self.channels.retain(|value| value.id() != channel);
+        if matches!(self.mode, Mode::ExecEof | Mode::ExecHang) {
+            let _ = self.data.send(b"closed".to_vec());
+        }
+        Ok(())
+    }
+
     async fn channel_open_session(
         &mut self,
         channel: Channel<server::Msg>,
@@ -149,6 +177,68 @@ impl server::Handler for Loopback {
     }
 }
 
+#[test]
+fn exec_probe_closes_each_channel_after_eof_on_one_connection() {
+    check(async {
+        let mut fixture = Fixture::new(Mode::ExecEof).await;
+        let acquired = fixture.connect().await;
+        for _ in 0..16 {
+            let channel = acquired.session.channel_open_session().await.unwrap();
+            let result = super::super::exec::capture(
+                channel,
+                "probe",
+                &[],
+                Duration::from_secs(1),
+                "loopback",
+            )
+            .await
+            .unwrap();
+            assert_eq!(result, "probe result\n");
+            assert_eq!(fixture.data.recv().await.unwrap(), b"closed");
+        }
+        fixture.forget(&acquired.session).await;
+    });
+}
+
+#[test]
+fn exec_probe_timeout_and_cancellation_close_the_channel() {
+    check(async {
+        let mut fixture = Fixture::new(Mode::ExecHang).await;
+        let acquired = fixture.connect().await;
+        let channel = acquired.session.channel_open_session().await.unwrap();
+        assert!(
+            super::super::exec::capture(
+                channel,
+                "probe",
+                &[],
+                Duration::from_millis(20),
+                "loopback"
+            )
+            .await
+            .is_err()
+        );
+        assert_eq!(fixture.data.recv().await.unwrap(), b"closed");
+        let channel = acquired.session.channel_open_session().await.unwrap();
+        // Dropping the whole operation models a cancelled remote-CWD request.
+        assert!(
+            tokio::time::timeout(
+                Duration::from_millis(20),
+                super::super::exec::capture(
+                    channel,
+                    "probe",
+                    &[],
+                    Duration::from_secs(5),
+                    "loopback",
+                )
+            )
+            .await
+            .is_err()
+        );
+        assert_eq!(fixture.data.recv().await.unwrap(), b"closed");
+        fixture.forget(&acquired.session).await;
+    });
+}
+
 #[test]
 fn ssh_first_capability_query_receives_reply_and_input_keeps_flowing() {
     check(async {
diff --git a/nebula_app/src/ssh_sftp.rs b/nebula_app/src/ssh_sftp.rs
index 533c73f..128e6be 100644
--- a/nebula_app/src/ssh_sftp.rs
+++ b/nebula_app/src/ssh_sftp.rs
@@ -1,6 +1,14 @@
+#[path = "ssh_sftp/document.rs"]
+pub(crate) mod document;
+#[path = "ssh_sftp/export.rs"]
+pub(crate) mod export;
+#[path = "ssh_sftp/limits.rs"]
 pub(crate) mod limits;
+#[path = "ssh_sftp/remote_cwd.rs"]
 pub(crate) mod remote_cwd;
+#[path = "ssh_sftp/transaction.rs"]
 mod transaction;
+#[path = "ssh_sftp/transfer.rs"]
 mod transfer;
 
 use std::collections::HashSet;
@@ -102,6 +110,7 @@ pub enum SftpPhase {
     Ready,
     Working,
     Error,
+    Cancelled,
 }
 
 #[derive(Clone, Debug)]
@@ -382,6 +391,14 @@ impl SftpController {
         (self.wake)();
     }
 
+    pub(crate) fn cancellation_probe(&self) -> Arc<dyn Fn() -> bool + Send + Sync> {
+        let current = lock(&self.task_control);
+        let expected = self.generation.load(Ordering::Acquire);
+        let control = current.clone();
+        let generation = self.generation.clone();
+        Arc::new(move || task_cancelled(&control, &generation, expected))
+    }
+
     fn start_job<J, F>(&self, phase: SftpPhase, progress: Option<TransferProgress>, job: J)
     where
         J: FnOnce(TaskContext) -> F + Send + 'static,
@@ -475,7 +492,7 @@ impl TransferObserver for TaskContext {
     }
 
     fn cancelled(&self) -> bool {
-        self.task_control.load(Ordering::Acquire) & CANCEL_REQUESTED != 0 || !self.is_current()
+        task_cancelled(&self.task_control, &self.generation, self.task_generation)
     }
 }
 
@@ -567,6 +584,11 @@ impl TaskContext {
                 state.error = None;
                 state.progress = None;
             },
+            Err(_) if self.cancelled() => {
+                state.phase = SftpPhase::Cancelled;
+                state.error = None;
+                state.progress = None;
+            },
             Err(err) => {
                 state.phase = SftpPhase::Error;
                 state.error = Some(err.to_string());
@@ -578,6 +600,11 @@ impl TaskContext {
     }
 }
 
+fn task_cancelled(control: &AtomicUsize, generation: &AtomicU64, expected: u64) -> bool {
+    control.load(Ordering::Acquire) & CANCEL_REQUESTED != 0
+        || generation.load(Ordering::Acquire) != expected
+}
+
 fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
     mutex.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
 }
diff --git a/nebula_app/src/ssh_sftp/document.rs b/nebula_app/src/ssh_sftp/document.rs
new file mode 100644
index 0000000..b72a9c1
--- /dev/null
+++ b/nebula_app/src/ssh_sftp/document.rs
@@ -0,0 +1,222 @@
+//! Remote documents pin an authenticated SFTP channel and keep bounded text snapshots.
+
+use super::*;
+use crate::text_document::{MAX_BYTES, SaveError, TextSnapshot};
+use tokio::io::AsyncReadExt as _;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct RemoteLocation {
+    pub destination: String,
+    pub path: String,
+}
+
+impl RemoteLocation {
+    pub(crate) fn display(&self) -> String {
+        format!("ssh://{}{}", self.destination, self.path)
+    }
+}
+
+#[derive(Clone, Default)]
+pub(crate) struct DocumentOperation {
+    control: TaskControl,
+    wake: Arc<tokio::sync::Notify>,
+}
+
+impl DocumentOperation {
+    pub(crate) fn cancel(&self) {
+        self.control.fetch_or(CANCEL_REQUESTED, Ordering::AcqRel);
+        self.wake.notify_one();
+    }
+
+    async fn cancelled(&self) {
+        loop {
+            if self.control.load(Ordering::Acquire) & CANCEL_REQUESTED != 0 {
+                return;
+            }
+            self.wake.notified().await;
+        }
+    }
+
+    fn context(&self, location: &RemoteLocation) -> TaskContext {
+        TaskContext {
+            state: Arc::new(Mutex::new(SftpSnapshot {
+                destination: location.destination.clone(),
+                path: location.path.clone(),
+                entries: vec![],
+                phase: SftpPhase::Working,
+                error: None,
+                progress: None,
+            })),
+            task_control: self.control.clone(),
+            generation: Arc::new(AtomicU64::new(1)),
+            task_generation: 1,
+            wake: Arc::new(|| {}),
+            last_wake: Arc::new(Mutex::new(Instant::now())),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct RemoteDocument {
+    pub location: RemoteLocation,
+    pub snapshot: TextSnapshot,
+    pub modified: Option<std::time::SystemTime>,
+    target: String,
+    metadata: russh_sftp::protocol::FileAttributes,
+    // Reconnecting through a newly edited SSH alias must never redirect a draft.
+    session: Arc<SftpSession>,
+}
+
+impl RemoteDocument {
+    pub(crate) fn size(&self) -> u64 {
+        self.metadata.len()
+    }
+
+    pub(crate) async fn load(
+        location: RemoteLocation,
+        operation: DocumentOperation,
+    ) -> io::Result<Self> {
+        let load = async {
+            let sftp = Arc::new(
+                crate::ssh_session::open_sftp(&location.destination)
+                    .await
+                    .map_err(io::Error::other)?,
+            );
+            Self::load_from_session(location, sftp, &operation).await
+        };
+        tokio::select! {
+            result = tokio::time::timeout(Duration::from_secs(45), load) => result.map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "Remote document read timed out"))?,
+            _ = operation.cancelled() => Err(io::Error::new(io::ErrorKind::Interrupted, "Remote document read cancelled")),
+        }
+    }
+
+    async fn load_from_session(
+        location: RemoteLocation,
+        session: Arc<SftpSession>,
+        operation: &DocumentOperation,
+    ) -> io::Result<Self> {
+        let context = operation.context(&location);
+        context.check_cancelled().map_err(io::Error::other)?;
+        let target = session.canonicalize(location.path.clone()).await.map_err(io::Error::other)?;
+        let metadata = session.metadata(target.clone()).await.map_err(io::Error::other)?;
+        if !metadata.is_regular() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "The remote item is not a regular file",
+            ));
+        }
+        let bytes =
+            read_bounded(&session, &target, Some(&context)).await.map_err(io::Error::other)?;
+        let after = session.metadata(target.clone()).await.map_err(io::Error::other)?;
+        if metadata.size != after.size
+            || metadata.mtime != after.mtime
+            || metadata.permissions != after.permissions
+        {
+            return Err(io::Error::other(SaveError::Changed));
+        }
+        let modified = metadata
+            .mtime
+            .map(|value| std::time::UNIX_EPOCH + Duration::from_secs(u64::from(value)));
+        Ok(Self {
+            location,
+            snapshot: TextSnapshot::decode(bytes, false),
+            modified,
+            target,
+            metadata,
+            session,
+        })
+    }
+
+    pub(crate) async fn save(
+        &self,
+        text: String,
+        operation: DocumentOperation,
+    ) -> Result<Self, SaveError> {
+        let bytes = self.snapshot.encode(&text)?;
+        let context = operation.context(&self.location);
+        context.check_cancelled().map_err(map_error)?;
+        let expected = transaction::RemotePrecondition {
+            requested: self.location.path.clone(),
+            canonical: self.target.clone(),
+            bytes: self.snapshot.bytes.clone(),
+            metadata: self.metadata.clone(),
+        };
+        if text == self.snapshot.text {
+            transaction::verify_remote_precondition(&self.session, &expected, &context)
+                .await
+                .map_err(map_error)?;
+            return Ok(self.clone());
+        }
+        let staged = tempfile::NamedTempFile::new()?;
+        tokio::fs::write(staged.path(), &bytes).await?;
+        let stamp = transaction::FileStamp {
+            len: bytes.len() as u64,
+            modified: None,
+            permissions: self.metadata.permissions,
+        };
+        // Do not abort the future during publication. The shared transaction
+        // observes cancellation before publication and finishes/rolls back after it.
+        transaction::upload_file_checked(
+            &self.session,
+            staged.path(),
+            &self.target,
+            stamp,
+            false,
+            &context,
+            Some(&expected),
+        )
+        .await
+        .map_err(map_error)?;
+        let metadata = self.session.metadata(self.target.clone()).await.unwrap_or_else(|_| {
+            let mut metadata = self.metadata.clone();
+            metadata.size = Some(bytes.len() as u64);
+            metadata.mtime = None;
+            metadata
+        });
+        let modified = metadata
+            .mtime
+            .map(|value| std::time::UNIX_EPOCH + Duration::from_secs(u64::from(value)));
+        Ok(Self {
+            snapshot: TextSnapshot::decode(bytes, false),
+            metadata,
+            modified,
+            ..self.clone()
+        })
+    }
+}
+
+fn map_error(error: SftpError) -> SaveError {
+    match error.downcast::<SaveError>() {
+        Ok(error) => *error,
+        Err(error) => match error.downcast::<io::Error>() {
+            Ok(error) => SaveError::Io(*error),
+            Err(error) => SaveError::Io(io::Error::other(error)),
+        },
+    }
+}
+
+pub(super) async fn read_bounded(
+    sftp: &SftpSession,
+    path: &str,
+    context: Option<&TaskContext>,
+) -> SftpResult<Vec<u8>> {
+    let mut file = sftp.open(path.to_owned()).await?;
+    let mut bytes = Vec::new();
+    let mut buffer = [0u8; 65536];
+    while bytes.len() <= MAX_BYTES {
+        if let Some(context) = context {
+            context.check_cancelled()?;
+        }
+        let limit = buffer.len().min(MAX_BYTES + 1 - bytes.len());
+        let count = file.read(&mut buffer[..limit]).await?;
+        if count == 0 {
+            break;
+        }
+        bytes.extend_from_slice(&buffer[..count]);
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+#[path = "document/tests.rs"]
+mod tests;
diff --git a/nebula_app/src/ssh_sftp/document/tests.rs b/nebula_app/src/ssh_sftp/document/tests.rs
new file mode 100644
index 0000000..ca6a1b3
--- /dev/null
+++ b/nebula_app/src/ssh_sftp/document/tests.rs
@@ -0,0 +1,160 @@
+use super::*;
+#[path = "tests/peer.rs"]
+mod peer;
+
+fn run(future: impl std::future::Future<Output = ()>) {
+    tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .build()
+        .unwrap()
+        .block_on(future);
+}
+
+async fn open(session: Arc<SftpSession>) -> RemoteDocument {
+    RemoteDocument::load_from_session(
+        RemoteLocation { destination: "test-host".into(), path: "/config".into() },
+        session,
+        &DocumentOperation::default(),
+    )
+    .await
+    .unwrap()
+}
+
+#[test]
+fn remote_save_preserves_bom_crlf_permissions_and_ownership() {
+    run(async {
+        let (store, session) = peer::connect("\u{feff}原文\r\n".as_bytes()).await;
+        let document = open(session).await;
+        let saved = document.save("修改\n".into(), DocumentOperation::default()).await.unwrap();
+        assert_eq!(saved.snapshot.text, "修改\n");
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, "\u{feff}修改\r\n".as_bytes());
+        assert_eq!(store.files["/config"].permissions, 0o100640);
+        assert_eq!((store.files["/config"].uid, store.files["/config"].gid), (1001, 1002));
+        assert_eq!(store.files.len(), 1);
+    });
+}
+
+#[test]
+fn same_size_same_timestamp_external_change_is_never_overwritten() {
+    run(async {
+        let (store, session) = peer::connect(b"first").await;
+        let document = open(session).await;
+        store.lock().unwrap().files.get_mut("/config").unwrap().data = b"other".to_vec();
+        assert!(matches!(
+            document.save("draft".into(), DocumentOperation::default()).await,
+            Err(SaveError::Changed)
+        ));
+        assert_eq!(store.lock().unwrap().files["/config"].data, b"other");
+    });
+}
+
+#[test]
+fn a_change_in_the_rename_gap_is_restored_without_losing_external_data() {
+    run(async {
+        let (store, session) = peer::connect(b"first").await;
+        let document = open(session).await;
+        store.lock().unwrap().edit_before_backup = Some(b"other".to_vec());
+        assert!(matches!(
+            document.save("draft".into(), DocumentOperation::default()).await,
+            Err(SaveError::Changed)
+        ));
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"other");
+        assert_eq!(store.files.len(), 1);
+    });
+}
+
+#[test]
+fn failed_publication_restores_the_original_file() {
+    run(async {
+        let (store, session) = peer::connect(b"original").await;
+        let document = open(session).await;
+        store.lock().unwrap().fail_publish_once = true;
+        assert!(document.save("draft".into(), DocumentOperation::default()).await.is_err());
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"original");
+        assert_eq!(store.files.len(), 1);
+    });
+}
+
+#[test]
+fn rollback_never_overwrites_a_new_destination_created_by_another_writer() {
+    run(async {
+        let (store, session) = peer::connect(b"original").await;
+        let document = open(session).await;
+        store.lock().unwrap().create_after_backup = Some(b"external".to_vec());
+        let result = document.save("draft".into(), DocumentOperation::default()).await;
+        assert!(result.is_err());
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"external");
+        assert!(
+            store
+                .files
+                .iter()
+                .any(|(path, node)| path.contains("nebula-backup") && node.data == b"original")
+        );
+        assert!(
+            store
+                .files
+                .iter()
+                .any(|(path, node)| path.contains("nebula-upload") && node.data == b"draft")
+        );
+    });
+}
+
+#[test]
+fn permission_failure_and_prepublication_cancellation_leave_original_intact() {
+    run(async {
+        let (store, session) = peer::connect(b"original").await;
+        let document = open(session).await;
+        let cancelled = DocumentOperation::default();
+        cancelled.cancel();
+        assert!(document.save("draft".into(), cancelled).await.is_err());
+        store.lock().unwrap().fail_writes = true;
+        assert!(document.save("draft".into(), DocumentOperation::default()).await.is_err());
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"original");
+        assert_eq!(store.files.len(), 1);
+    });
+}
+
+#[test]
+fn cancellation_after_publication_starts_finishes_the_file_transaction() {
+    run(async {
+        let (store, session) = peer::connect(b"original").await;
+        let document = open(session).await;
+        let operation = DocumentOperation::default();
+        store.lock().unwrap().cancel_after_backup = Some(operation.clone());
+        assert!(document.save("draft".into(), operation).await.is_ok());
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"draft");
+        assert_eq!(store.files.len(), 1);
+    });
+}
+
+#[test]
+fn retargeted_symlinks_cannot_redirect_an_existing_document_save() {
+    run(async {
+        let (store, session) = peer::connect(b"original").await;
+        {
+            let mut store = store.lock().unwrap();
+            store.files.insert("/other".into(), peer::Node::new(b"original"));
+            store.aliases.insert("/link".into(), "/config".into());
+        }
+        let location = RemoteLocation { destination: "test-host".into(), path: "/link".into() };
+        let document =
+            RemoteDocument::load_from_session(location, session, &DocumentOperation::default())
+                .await
+                .unwrap();
+        store.lock().unwrap().aliases.insert("/link".into(), "/other".into());
+        assert!(matches!(
+            document.save("draft".into(), DocumentOperation::default()).await,
+            Err(SaveError::Changed)
+        ));
+        let store = store.lock().unwrap();
+        assert_eq!(store.files["/config"].data, b"original");
+        assert_eq!(store.files["/other"].data, b"original");
+    });
+}
diff --git a/nebula_app/src/ssh_sftp/document/tests/peer.rs b/nebula_app/src/ssh_sftp/document/tests/peer.rs
new file mode 100644
index 0000000..0f93980
--- /dev/null
+++ b/nebula_app/src/ssh_sftp/document/tests/peer.rs
@@ -0,0 +1,240 @@
+//! An in-memory filesystem behind the real SFTP codec, with deterministic I/O faults.
+
+use crate::ssh_sftp::document::DocumentOperation;
+use russh_sftp::protocol::{
+    Attrs, Data, File, FileAttributes, Handle, Name, OpenFlags, Status, StatusCode,
+};
+use std::collections::BTreeMap;
+use std::sync::{Arc, Mutex};
+
+#[derive(Clone)]
+pub(super) struct Node {
+    pub data: Vec<u8>,
+    pub permissions: u32,
+    pub uid: u32,
+    pub gid: u32,
+    pub modified: u32,
+}
+
+impl Node {
+    pub(super) fn new(data: &[u8]) -> Self {
+        Self { data: data.to_vec(), permissions: 0o100640, uid: 1001, gid: 1002, modified: 10 }
+    }
+
+    fn attributes(&self) -> FileAttributes {
+        FileAttributes {
+            size: Some(self.data.len() as u64),
+            permissions: Some(self.permissions),
+            uid: Some(self.uid),
+            gid: Some(self.gid),
+            mtime: Some(self.modified),
+            ..FileAttributes::empty()
+        }
+    }
+}
+
+#[derive(Default)]
+pub(super) struct Store {
+    pub files: BTreeMap<String, Node>,
+    pub aliases: BTreeMap<String, String>,
+    pub fail_writes: bool,
+    pub fail_publish_once: bool,
+    pub edit_before_backup: Option<Vec<u8>>,
+    pub create_after_backup: Option<Vec<u8>>,
+    pub cancel_after_backup: Option<DocumentOperation>,
+}
+
+struct Peer {
+    store: Arc<Mutex<Store>>,
+    handles: BTreeMap<String, String>,
+}
+
+fn success(id: u32) -> Status {
+    Status {
+        id,
+        status_code: StatusCode::Ok,
+        error_message: String::new(),
+        language_tag: String::new(),
+    }
+}
+
+impl Peer {
+    fn attributes(&self, path: &str) -> Result<FileAttributes, StatusCode> {
+        let store = self.store.lock().unwrap();
+        let path = store.aliases.get(path).map(String::as_str).unwrap_or(path);
+        store.files.get(path).map(Node::attributes).ok_or(StatusCode::NoSuchFile)
+    }
+}
+
+impl russh_sftp::server::Handler for Peer {
+    type Error = StatusCode;
+    fn unimplemented(&self) -> Self::Error {
+        StatusCode::OpUnsupported
+    }
+
+    async fn realpath(&mut self, id: u32, path: String) -> Result<Name, StatusCode> {
+        let path = self.store.lock().unwrap().aliases.get(&path).cloned().unwrap_or(path);
+        Ok(Name { id, files: vec![File::dummy(path)] })
+    }
+
+    async fn stat(&mut self, id: u32, path: String) -> Result<Attrs, StatusCode> {
+        Ok(Attrs { id, attrs: self.attributes(&path)? })
+    }
+
+    async fn lstat(&mut self, id: u32, path: String) -> Result<Attrs, StatusCode> {
+        self.stat(id, path).await
+    }
+
+    async fn fstat(&mut self, id: u32, handle: String) -> Result<Attrs, StatusCode> {
+        let path = self.handles.get(&handle).ok_or(StatusCode::NoSuchFile)?.clone();
+        self.stat(id, path).await
+    }
+
+    async fn open(
+        &mut self,
+        id: u32,
+        filename: String,
+        flags: OpenFlags,
+        _: FileAttributes,
+    ) -> Result<Handle, StatusCode> {
+        let mut store = self.store.lock().unwrap();
+        if flags.contains(OpenFlags::CREATE) {
+            if flags.contains(OpenFlags::EXCLUDE) && store.files.contains_key(&filename) {
+                return Err(StatusCode::Failure);
+            }
+            store.files.entry(filename.clone()).or_insert_with(|| Node {
+                uid: 0,
+                gid: 0,
+                ..Node::new(&[])
+            });
+        }
+        if !store.files.contains_key(&filename) {
+            return Err(StatusCode::NoSuchFile);
+        }
+        let handle = format!("handle-{id}");
+        self.handles.insert(handle.clone(), filename);
+        Ok(Handle { id, handle })
+    }
+
+    async fn read(
+        &mut self,
+        id: u32,
+        handle: String,
+        offset: u64,
+        length: u32,
+    ) -> Result<Data, StatusCode> {
+        let path = self.handles.get(&handle).ok_or(StatusCode::NoSuchFile)?;
+        let store = self.store.lock().unwrap();
+        let node = store.files.get(path).ok_or(StatusCode::NoSuchFile)?;
+        let offset = usize::try_from(offset).map_err(|_| StatusCode::Failure)?;
+        if offset >= node.data.len() {
+            return Err(StatusCode::Eof);
+        }
+        let end = node.data.len().min(offset + length as usize);
+        Ok(Data { id, data: node.data[offset..end].to_vec() })
+    }
+
+    async fn write(
+        &mut self,
+        id: u32,
+        handle: String,
+        offset: u64,
+        data: Vec<u8>,
+    ) -> Result<Status, StatusCode> {
+        let path = self.handles.get(&handle).ok_or(StatusCode::NoSuchFile)?;
+        let mut store = self.store.lock().unwrap();
+        if store.fail_writes {
+            return Err(StatusCode::PermissionDenied);
+        }
+        let node = store.files.get_mut(path).ok_or(StatusCode::NoSuchFile)?;
+        let start = usize::try_from(offset).map_err(|_| StatusCode::Failure)?;
+        let end = start
+            .checked_add(data.len())
+            .filter(|end| *end <= 16 * 1024 * 1024)
+            .ok_or(StatusCode::Failure)?;
+        if end > node.data.len() {
+            node.data.resize(end, 0);
+        }
+        node.data[start..end].copy_from_slice(&data);
+        node.modified = 20;
+        Ok(success(id))
+    }
+
+    async fn close(&mut self, id: u32, handle: String) -> Result<Status, StatusCode> {
+        self.handles.remove(&handle);
+        Ok(success(id))
+    }
+
+    async fn setstat(
+        &mut self,
+        id: u32,
+        path: String,
+        attrs: FileAttributes,
+    ) -> Result<Status, StatusCode> {
+        let mut store = self.store.lock().unwrap();
+        let node = store.files.get_mut(&path).ok_or(StatusCode::NoSuchFile)?;
+        if let Some(value) = attrs.permissions {
+            node.permissions = value;
+        }
+        if let Some(value) = attrs.uid {
+            node.uid = value;
+        }
+        if let Some(value) = attrs.gid {
+            node.gid = value;
+        }
+        if let Some(value) = attrs.mtime {
+            node.modified = value;
+        }
+        Ok(success(id))
+    }
+
+    async fn rename(&mut self, id: u32, old: String, new: String) -> Result<Status, StatusCode> {
+        let mut store = self.store.lock().unwrap();
+        if old.contains("nebula-upload") && new == "/config" && store.fail_publish_once {
+            store.fail_publish_once = false;
+            return Err(StatusCode::Failure);
+        }
+        if store.files.contains_key(&new) {
+            return Err(StatusCode::Failure);
+        }
+        let backup = old == "/config" && new.contains("nebula-backup");
+        if backup && let Some(data) = store.edit_before_backup.take() {
+            store.files.get_mut(&old).unwrap().data = data;
+        }
+        let node = store.files.remove(&old).ok_or(StatusCode::NoSuchFile)?;
+        store.files.insert(new, node);
+        if backup {
+            if let Some(data) = store.create_after_backup.take() {
+                store.files.insert(old, Node::new(&data));
+            }
+            if let Some(operation) = store.cancel_after_backup.take() {
+                operation.cancel();
+            }
+        }
+        Ok(success(id))
+    }
+
+    async fn remove(&mut self, id: u32, path: String) -> Result<Status, StatusCode> {
+        self.store.lock().unwrap().files.remove(&path).ok_or(StatusCode::NoSuchFile)?;
+        Ok(success(id))
+    }
+}
+
+pub(super) async fn connect(
+    data: &[u8],
+) -> (Arc<Mutex<Store>>, Arc<russh_sftp::client::SftpSession>) {
+    let store = Arc::new(Mutex::new(Store::default()));
+    store.lock().unwrap().files.insert("/config".into(), Node::new(data));
+    let (client, server) = tokio::io::duplex(128 * 1024);
+    tokio::spawn(russh_sftp::server::run(
+        server,
+        Peer { store: store.clone(), handles: BTreeMap::new() },
+    ));
+    let session = russh_sftp::client::SftpSession::new_with_config(
+        client,
+        crate::ssh_sftp::limits::session_config(),
+    )
+    .await
+    .unwrap();
+    (store, Arc::new(session))
+}
diff --git a/nebula_app/src/ssh_sftp/export.rs b/nebula_app/src/ssh_sftp/export.rs
new file mode 100644
index 0000000..c4b5d3a
--- /dev/null
+++ b/nebula_app/src/ssh_sftp/export.rs
@@ -0,0 +1,185 @@
+//! A drag owns its download plan and temporary directory until every consumer releases it.
+
+use super::*;
+use std::sync::OnceLock;
+
+#[derive(Clone, Debug)]
+pub(crate) struct ExportFile {
+    pub relative_path: PathBuf,
+    pub directory: bool,
+    pub size: u64,
+}
+
+pub(crate) struct PreparedExport {
+    pub files: Vec<ExportFile>,
+    directory: Arc<tempfile::TempDir>,
+    plan: Mutex<Option<DownloadPlan>>,
+    destination: String,
+    context: TaskContext,
+    materialized: OnceLock<Result<(), String>>,
+    completion: Mutex<Option<tokio::sync::oneshot::Sender<Result<(), String>>>>,
+}
+
+impl PreparedExport {
+    /// Only the native worker calls this blocking bridge. Directory entries are
+    /// downloaded once, even if Explorer requests or clones several streams.
+    pub(crate) fn materialize(
+        &self,
+        index: usize,
+    ) -> io::Result<(PathBuf, Arc<tempfile::TempDir>)> {
+        let file = self.files.get(index).filter(|f| !f.directory).ok_or_else(|| {
+            io::Error::new(io::ErrorKind::InvalidInput, "Invalid drag file index")
+        })?;
+        let result = self.materialized.get_or_init(|| {
+            let runtime = crate::ssh_session::runtime().map_err(|e| e.to_string())?;
+            let plan =
+                lock(&self.plan).take().ok_or("The drag download plan was already consumed")?;
+            runtime
+                .block_on(async {
+                    self.context.check_cancelled()?;
+                    let sftp = crate::ssh_session::open_sftp(&self.destination).await?;
+                    for file in &plan.files {
+                        self.context.check_cancelled()?;
+                        let metadata = sftp.metadata(file.remote.clone()).await?;
+                        if !metadata.is_regular()
+                            || metadata.len() != file.size
+                            || (file.modified != 0
+                                && u64::from(metadata.mtime.unwrap_or(0)) != file.modified)
+                        {
+                            return Err(
+                                io::Error::other("Remote file changed; start a new drag").into()
+                            );
+                        }
+                    }
+                    execute_download_plan(&sftp, plan, false, &self.context).await
+                })
+                .map_err(|e: SftpError| e.to_string())
+        });
+        result.as_ref().map_err(|e| io::Error::other(e.clone()))?;
+        self.context.check_cancelled().map_err(|e| io::Error::other(e.to_string()))?;
+        Ok((self.directory.path().join(&file.relative_path), self.directory.clone()))
+    }
+
+    pub(crate) fn finish(&self, result: Result<(), String>) {
+        if let Some(done) = lock(&self.completion).take() {
+            let _ = done.send(result);
+        }
+    }
+}
+
+impl Drop for PreparedExport {
+    fn drop(&mut self) {
+        self.finish(Err("File drag cancelled".to_owned()));
+    }
+}
+
+impl SftpController {
+    pub(crate) fn prepare_export(
+        &self,
+        entry: SftpEntry,
+        source_entries: Vec<SftpEntry>,
+    ) -> tokio::sync::oneshot::Receiver<Result<Arc<PreparedExport>, String>> {
+        let snapshot = self.snapshot();
+        let (ready, receive) = tokio::sync::oneshot::channel();
+        self.start_job(
+            SftpPhase::Working,
+            Some(TransferProgress::new(entry.name.clone(), 0)),
+            move |context| async move {
+                let prepare = async {
+                    context.check_cancelled()?;
+                    let directory =
+                        Arc::new(tempfile::Builder::new().prefix("pebrel-drag-").tempdir()?);
+                    let sftp = crate::ssh_session::open_sftp(&snapshot.destination).await?;
+                    let plan =
+                        build_download_plan(&sftp, entry, directory.path().to_owned(), &context)
+                            .await?;
+                    context.set_total(plan.total);
+                    let files = export_manifest(&plan, directory.path())?;
+                    let (done, wait) = tokio::sync::oneshot::channel();
+                    let prepared = Arc::new(PreparedExport {
+                        files,
+                        directory,
+                        plan: Mutex::new(Some(plan)),
+                        destination: snapshot.destination.clone(),
+                        context: context.clone(),
+                        materialized: OnceLock::new(),
+                        completion: Mutex::new(Some(done)),
+                    });
+                    Ok::<_, SftpError>((prepared, wait, sftp))
+                }
+                .await;
+                let (prepared, done, sftp) = match prepare {
+                    Ok(value) => value,
+                    Err(error) => {
+                        let message = error.to_string();
+                        let _ = ready.send(Err(message.clone()));
+                        return Err(io::Error::other(message).into());
+                    },
+                };
+                if ready.send(Ok(prepared)).is_err() {
+                    return Err(io::Error::other("File drag cancelled").into());
+                }
+                done.await
+                    .map_err(|_| io::Error::other("File drag ended"))?
+                    .map_err(io::Error::other)?;
+                // A completed download does not depend on another network round-trip.
+                // Preserve the captured source listing when the source is still visible.
+                drop(sftp);
+                Ok((snapshot.path, source_entries))
+            },
+        );
+        receive
+    }
+}
+
+fn export_manifest(plan: &DownloadPlan, root: &Path) -> io::Result<Vec<ExportFile>> {
+    let relative = |path: &Path| -> io::Result<PathBuf> {
+        path.strip_prefix(root).map(Path::to_owned).map_err(|_| {
+            io::Error::new(io::ErrorKind::InvalidData, "Drag path escaped its temporary directory")
+        })
+    };
+    let mut files = Vec::with_capacity(plan.directories.len() + plan.files.len());
+    for directory in &plan.directories {
+        files.push(ExportFile { relative_path: relative(directory)?, directory: true, size: 0 });
+    }
+    for file in &plan.files {
+        files.push(ExportFile {
+            relative_path: relative(&file.local)?,
+            directory: false,
+            size: file.size,
+        });
+    }
+    Ok(files)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn export_keeps_empty_directories_and_relative_tree_identity() {
+        let root = PathBuf::from("staging");
+        let plan = DownloadPlan {
+            directories: vec![root.join("site"), root.join("site/empty")],
+            files: vec![DownloadFile {
+                remote: "/site/a.txt".into(),
+                local: root.join("site/a.txt"),
+                size: 7,
+                modified: 0,
+            }],
+            total: 7,
+        };
+        let files = export_manifest(&plan, &root).unwrap();
+        assert_eq!(files.len(), 3);
+        assert!(files[1].directory);
+        assert_eq!(files[1].relative_path, PathBuf::from("site/empty"));
+        assert_eq!(files[2].size, 7);
+    }
+
+    #[test]
+    fn export_rejects_files_outside_its_owned_directory() {
+        let plan =
+            DownloadPlan { directories: vec![PathBuf::from("elsewhere")], files: vec![], total: 0 };
+        assert!(export_manifest(&plan, Path::new("staging")).is_err());
+    }
+}
diff --git a/nebula_app/src/ssh_sftp/transaction.rs b/nebula_app/src/ssh_sftp/transaction.rs
index 9699f7a..a584bf2 100644
--- a/nebula_app/src/ssh_sftp/transaction.rs
+++ b/nebula_app/src/ssh_sftp/transaction.rs
@@ -15,8 +15,59 @@ use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
 
 use super::transfer::TransferObserver as _;
 use super::{SftpError, SftpResult, TRANSFER_NONCE, TaskContext, normalize_remote_path, transfer};
+use crate::text_document::SaveError;
 use std::sync::atomic::Ordering;
 
+pub(super) struct RemotePrecondition {
+    pub requested: String,
+    pub canonical: String,
+    pub bytes: std::sync::Arc<[u8]>,
+    pub metadata: FileAttributes,
+}
+
+fn metadata_matches(expected: &FileAttributes, current: &FileAttributes) -> bool {
+    current.is_regular()
+        && expected.size == current.size
+        && (expected.mtime.is_none() || expected.mtime == current.mtime)
+        && expected.permissions == current.permissions
+        && expected.uid == current.uid
+        && expected.gid == current.gid
+}
+
+pub(super) async fn verify_remote_precondition(
+    sftp: &SftpSession,
+    expected: &RemotePrecondition,
+    context: &TaskContext,
+) -> SftpResult<()> {
+    let metadata = remote_metadata_optional(sftp, &expected.canonical).await?;
+    if metadata.as_ref().is_none_or(|current| !metadata_matches(&expected.metadata, current)) {
+        return Err(SaveError::Changed.into());
+    }
+    if sftp.canonicalize(expected.requested.clone()).await? != expected.canonical {
+        return Err(SaveError::Changed.into());
+    }
+    let current = super::document::read_bounded(sftp, &expected.canonical, Some(context)).await?;
+    if current != expected.bytes.as_ref() {
+        return Err(SaveError::Changed.into());
+    }
+    Ok(())
+}
+
+async fn restore_remote_backup(
+    sftp: &SftpSession,
+    backup: &str,
+    destination: &str,
+) -> SftpResult<()> {
+    if remote_metadata_optional(sftp, destination).await?.is_some() {
+        return Err(io::Error::other(format!(
+            "A new file exists at {destination}; the previous file remains at {backup}"
+        ))
+        .into());
+    }
+    sftp.rename(backup.to_owned(), destination.to_owned()).await?;
+    Ok(())
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(super) struct FileStamp {
     pub len: u64,
@@ -142,12 +193,17 @@ async fn set_remote_staging_metadata(
     staging: &str,
     source: FileStamp,
     existing: Option<&FileAttributes>,
+    preserve_owner: bool,
 ) -> SftpResult<()> {
     if let Some(permissions) =
         existing.and_then(|metadata| metadata.permissions).or(source.permissions)
     {
         let mut attributes = FileAttributes::empty();
         attributes.permissions = Some(permissions);
+        if preserve_owner {
+            attributes.uid = existing.and_then(|metadata| metadata.uid);
+            attributes.gid = existing.and_then(|metadata| metadata.gid);
+        }
         sftp.set_metadata(staging.to_owned(), attributes).await?;
     }
     if let Some(modified) = source.modified {
@@ -171,6 +227,24 @@ pub(super) async fn upload_file(
     skip_unchanged: bool,
     context: &TaskContext,
 ) -> SftpResult<()> {
+    upload_file_checked(sftp, local, destination, source, skip_unchanged, context, None).await
+}
+
+pub(super) async fn upload_file_checked(
+    sftp: &SftpSession,
+    local: &Path,
+    destination: &str,
+    source: FileStamp,
+    skip_unchanged: bool,
+    context: &TaskContext,
+    expected: Option<&RemotePrecondition>,
+) -> SftpResult<()> {
+    if let Some(expected) = expected {
+        if expected.canonical != destination {
+            return Err(SaveError::Changed.into());
+        }
+        verify_remote_precondition(sftp, expected, context).await?;
+    }
     let existing = remote_metadata_optional(sftp, destination).await?;
     if skip_unchanged {
         let comparable = match existing.as_ref() {
@@ -192,6 +266,9 @@ pub(super) async fn upload_file(
         );
     }
     if existing.as_ref().is_some_and(FileAttributes::is_symlink) {
+        if expected.is_some() {
+            return Err(SaveError::Changed.into());
+        }
         // rename 会替换链接节点本身。原地写让服务器沿链接打开真实目标，保留
         // 链接身份；代价是这条路径无法提供 rename 级原子性。
         transfer::upload_stream(sftp, local, destination, context).await?;
@@ -204,7 +281,8 @@ pub(super) async fn upload_file(
     let mut preserve_staging = false;
     let result = async {
         transfer::upload_stream(sftp, local, &staging, context).await?;
-        set_remote_staging_metadata(sftp, &staging, source, existing.as_ref()).await?;
+        set_remote_staging_metadata(sftp, &staging, source, existing.as_ref(), expected.is_some()).await?;
+        if let Some(expected) = expected { verify_remote_precondition(sftp, expected, context).await?; }
         let _publish = context.begin_publish()?;
 
         if existing.is_none() {
@@ -213,8 +291,27 @@ pub(super) async fn upload_file(
         }
 
         sftp.rename(destination.to_owned(), backup.clone()).await?;
+        if let Some(expected) = expected {
+            // Once publication begins, cancellation waits for this bounded
+            // verification and the publish/rollback decision to finish.
+            let verify_backup = async {
+                let metadata = sftp.symlink_metadata(backup.clone()).await?;
+                let bytes = super::document::read_bounded(sftp, &backup, None).await?;
+                if !metadata_matches(&expected.metadata, &metadata) || bytes != expected.bytes.as_ref() {
+                    return Err(SftpError::from(SaveError::Changed));
+                }
+                Ok(())
+            }.await;
+            if let Err(error) = verify_backup {
+                if let Err(restore_error) = restore_remote_backup(sftp, &backup, destination).await {
+                    preserve_staging = true;
+                    return Err(io::Error::other(format!("{error}; {restore_error}; draft data remains at {staging}")).into());
+                }
+                return Err(error);
+            }
+        }
         if let Err(publish_error) = sftp.rename(staging.clone(), destination.to_owned()).await {
-            if let Err(restore_error) = sftp.rename(backup.clone(), destination.to_owned()).await {
+            if let Err(restore_error) = restore_remote_backup(sftp, &backup, destination).await {
                 preserve_staging = true;
                 return Err(io::Error::other(format!(
                     "替换远端文件失败，且旧文件自动恢复失败；旧文件位于 {backup}，新文件位于 {staging}。发布错误: {publish_error}；恢复错误: {restore_error}"
diff --git a/nebula_app/src/text_document.rs b/nebula_app/src/text_document.rs
new file mode 100644
index 0000000..4b23bef
--- /dev/null
+++ b/nebula_app/src/text_document.rs
@@ -0,0 +1,129 @@
+//! Renderer-independent text snapshots shared by local and SFTP documents.
+
+use std::io;
+use std::sync::Arc;
+
+pub(crate) const MAX_BYTES: usize = 8 * 1024 * 1024;
+
+#[derive(Clone, Debug)]
+pub(crate) struct TextSnapshot {
+    pub text: String,
+    pub bytes: Arc<[u8]>,
+    pub bom: bool,
+    pub crlf: bool,
+    pub truncated: bool,
+    pub invalid_encoding: bool,
+    pub read_only: bool,
+}
+
+#[derive(Debug)]
+pub(crate) enum SaveError {
+    Changed,
+    ReadOnly,
+    Io(io::Error),
+}
+
+impl From<io::Error> for SaveError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(error)
+    }
+}
+
+impl std::fmt::Display for SaveError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Changed => formatter.write_str("The file changed since it was opened"),
+            Self::ReadOnly => formatter.write_str("The document is read-only"),
+            Self::Io(error) => error.fmt(formatter),
+        }
+    }
+}
+
+impl std::error::Error for SaveError {}
+
+impl TextSnapshot {
+    /// Preserve the read-only contract when the bounded reader already removed
+    /// the overflow byte instead of handing decode an oversized allocation.
+    pub(crate) fn decode_prefix(bytes: Vec<u8>, read_only: bool, truncated: bool) -> Self {
+        let mut snapshot = Self::decode(bytes, read_only);
+        snapshot.truncated |= truncated;
+        snapshot.read_only |= truncated;
+        snapshot
+    }
+
+    pub(crate) fn decode(mut bytes: Vec<u8>, read_only: bool) -> Self {
+        let truncated = bytes.len() > MAX_BYTES;
+        bytes.truncate(MAX_BYTES);
+        let bom = bytes.starts_with(b"\xef\xbb\xbf");
+        let body = if bom { &bytes[3..] } else { &bytes };
+        let invalid_encoding = std::str::from_utf8(body).is_err() || body.contains(&0);
+        let text = String::from_utf8_lossy(body);
+        let crlf = text.contains("\r\n") && !text.replace("\r\n", "").contains('\n');
+        let text = text.replace("\r\n", "\n");
+        Self {
+            text,
+            bytes: bytes.into(),
+            bom,
+            crlf,
+            truncated,
+            invalid_encoding,
+            read_only: read_only || truncated || invalid_encoding,
+        }
+    }
+
+    pub(crate) fn encode(&self, text: &str) -> Result<Vec<u8>, SaveError> {
+        if self.read_only {
+            return Err(SaveError::ReadOnly);
+        }
+        let mut bytes = if self.bom { b"\xef\xbb\xbf".to_vec() } else { Vec::new() };
+        let encoded = if self.crlf { text.replace('\n', "\r\n") } else { text.to_owned() };
+        bytes.extend_from_slice(encoded.as_bytes());
+        if bytes.len() > MAX_BYTES {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "Editable text is limited to 8 MiB",
+            )
+            .into());
+        }
+        Ok(bytes)
+    }
+
+    pub(crate) fn verify(&self, current: &[u8]) -> Result<(), SaveError> {
+        if current == self.bytes.as_ref() { Ok(()) } else { Err(SaveError::Changed) }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_already_bounded_prefix_remains_read_only() {
+        let snapshot = TextSnapshot::decode_prefix(b"valid prefix".to_vec(), false, true);
+        assert!(snapshot.truncated && snapshot.read_only);
+        assert!(matches!(snapshot.encode("replacement"), Err(SaveError::ReadOnly)));
+    }
+
+    #[test]
+    fn both_backends_preserve_bom_crlf_and_unicode() {
+        let snapshot = TextSnapshot::decode("\u{feff}标题\r\n内容\r\n".as_bytes().to_vec(), false);
+        assert_eq!(snapshot.text, "标题\n内容\n");
+        assert_eq!(snapshot.encode("新标题\n").unwrap(), "\u{feff}新标题\r\n".as_bytes());
+        assert_eq!(snapshot.encode("").unwrap(), b"\xef\xbb\xbf");
+    }
+
+    #[test]
+    fn same_length_external_edits_are_conflicts() {
+        let snapshot = TextSnapshot::decode(b"first".to_vec(), false);
+        assert!(snapshot.verify(b"first").is_ok());
+        assert!(matches!(snapshot.verify(b"other"), Err(SaveError::Changed)));
+    }
+
+    #[test]
+    fn binary_and_partial_snapshots_never_become_writable() {
+        for bytes in [vec![b'a', 0, b'b'], vec![0xff], vec![b'x'; MAX_BYTES + 1]] {
+            let snapshot = TextSnapshot::decode(bytes, false);
+            assert!(matches!(snapshot.encode("replacement"), Err(SaveError::ReadOnly)));
+        }
+    }
+}
diff --git a/nebula_app/src/text_preview.rs b/nebula_app/src/text_preview.rs
new file mode 100644
index 0000000..1daab33
--- /dev/null
+++ b/nebula_app/src/text_preview.rs
@@ -0,0 +1,71 @@
+//! Display-only text bounds. Original document/input text stays authoritative.
+
+use std::borrow::Cow;
+
+pub(crate) const MAX_SOURCE_PREVIEW_LINES: usize = 32;
+const MAX_SOURCE_PREVIEW_BYTES: usize = 4096;
+
+pub(crate) fn multiline_source(source: &str) -> Cow<'_, str> {
+    let normalized = if source.contains('\r') {
+        Cow::Owned(source.replace("\r\n", "\n").replace('\r', "\n"))
+    } else {
+        Cow::Borrowed(source)
+    };
+    let text = normalized.as_ref();
+    let mut end = text.floor_char_boundary(text.len().min(MAX_SOURCE_PREVIEW_BYTES));
+    if text.match_indices('\n').nth(MAX_SOURCE_PREVIEW_LINES - 1).is_some() {
+        end = end.min(text.match_indices('\n').nth(MAX_SOURCE_PREVIEW_LINES - 2).unwrap().0);
+    }
+    if end < text.len() {
+        Cow::Owned(format!("{}\n…", text[..end].trim_end_matches('\n')))
+    } else {
+        normalized
+    }
+}
+
+/// A single-line surface such as an IME bubble or link tooltip must never
+/// forward a line terminator to the font system's single-line API.
+pub(crate) fn single_line_label(source: &str) -> Cow<'_, str> {
+    if source.contains(['\r', '\n']) {
+        Cow::Owned(source.replace(['\r', '\n'], " "))
+    } else {
+        Cow::Borrowed(source)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn multiline_formula_keeps_rows_without_rewriting_the_source() {
+        let source = "A=\r\n\\begin{pmatrix}\r\n1&2\\\\\r\n3&4\r\n\\end{pmatrix}";
+        let preview = multiline_source(source);
+        assert_eq!(preview.lines().count(), 5);
+        assert!(preview.contains("1&2\\\\\n3&4"));
+        assert!(source.contains("\r\n"));
+        assert!(matches!(multiline_source("x=1\ny=2"), Cow::Borrowed(_)));
+    }
+
+    #[test]
+    fn pending_preview_is_bounded_in_lines_and_unicode_bytes() {
+        let source = "公式\n".repeat(1000);
+        let preview = multiline_source(&source);
+        assert!(preview.lines().count() <= MAX_SOURCE_PREVIEW_LINES);
+        assert!(preview.ends_with('…'));
+        let source = "α".repeat(4096);
+        let preview = multiline_source(&source);
+        assert!(preview.len() <= MAX_SOURCE_PREVIEW_BYTES + 4);
+        assert!(preview.ends_with('…'));
+    }
+
+    #[test]
+    fn single_line_bubbles_preserve_committed_input_separately() {
+        let source = "第一行\r\nsecond line\n";
+        let label = single_line_label(source);
+        assert!(!label.contains(['\r', '\n']));
+        assert_eq!(label, "第一行  second line ");
+        assert!(source.contains('\n'));
+        assert!(matches!(single_line_label("普通输入"), Cow::Borrowed(_)));
+    }
+}
diff --git a/nebula_settings/src/lib.rs b/nebula_settings/src/lib.rs
index 6a7882f..4c5f323 100644
--- a/nebula_settings/src/lib.rs
+++ b/nebula_settings/src/lib.rs
@@ -22,7 +22,7 @@ mod quick_terminal;
 mod themes;
 pub use language::{LanguageInfo, LanguagePref};
 pub use quick_terminal::{QuickTerminalMode, QuickTerminalSize};
-pub use themes::FreshPalette;
+pub use themes::{FreshPalette, ReviewedPalette};
 mod reset;
 pub use reset::restore_default_settings;
 mod paths;
@@ -204,6 +204,10 @@ pub enum ThemeName {
     BreezeDark,
     MintLight,
     MintDark,
+    CatppuccinMocha,
+    CatppuccinLatte,
+    GlassLight,
+    GlassDark,
 }
 
 impl ThemeName {
@@ -222,12 +226,16 @@ impl ThemeName {
             "BreezeDark" => Self::BreezeDark,
             "MintLight" => Self::MintLight,
             "MintDark" => Self::MintDark,
+            "CatppuccinMocha" => Self::CatppuccinMocha,
+            "CatppuccinLatte" => Self::CatppuccinLatte,
+            "GlassLight" => Self::GlassLight,
+            "GlassDark" => Self::GlassDark,
 
             _ => return None,
         })
     }
 
-    pub fn prompt_name(self) -> &'static str {
+    pub const fn prompt_name(self) -> &'static str {
         match self {
             Self::Nebula => "Nebula",
             Self::SilverLight => "SilverLight",
@@ -242,6 +250,10 @@ impl ThemeName {
             Self::BreezeDark => "BreezeDark",
             Self::MintLight => "MintLight",
             Self::MintDark => "MintDark",
+            Self::CatppuccinMocha => "CatppuccinMocha",
+            Self::CatppuccinLatte => "CatppuccinLatte",
+            Self::GlassLight => "GlassLight",
+            Self::GlassDark => "GlassDark",
         }
     }
 
@@ -250,9 +262,14 @@ impl ThemeName {
         // 背景与 is_light 来自各主题 palette()；powerline 为提示符段色
         // （icon bg/fg、path bg/fg、branch bg/fg、time bg/fg）。
         match self {
-            Self::BreezeLight | Self::BreezeDark | Self::MintLight | Self::MintDark => {
-                themes::fresh_terminal(self)
-            },
+            Self::BreezeLight
+            | Self::BreezeDark
+            | Self::MintLight
+            | Self::MintDark
+            | Self::CatppuccinMocha
+            | Self::CatppuccinLatte
+            | Self::GlassLight
+            | Self::GlassDark => themes::fresh_terminal(self),
             Self::Nebula => TermTheme {
                 background: [15, 17, 26],
                 is_light: false,
@@ -445,28 +462,10 @@ impl ThemeName {
         }
     }
 
-    /// 主题自带的终端卡几何。
-    ///
-    /// 归属裁定：卡几何跟**主题**走，不跟全局设置走。于是「浮起的圆角卡」和
-    /// 「铺满到边 + 一条竖线」不是两条渲染路径、也不是两套页面，只是同一条
-    /// 路径在不同主题下的取值。切主题即换形态；用户的显式设置覆盖这里。
-    ///
-    /// [`ThemeName::Nord`] 是这套抽象的第一个实验者：半径与卡缝双双归零，
-    /// 终端铺满整个右侧区域，侧栏与终端之间靠一条 1px 竖线分界——卡缝归零后
-    /// 两块深色面板会糊成一片，竖线是这种形态下唯一的结构分界。
+    /// Built-in themes share a flat terminal surface. Window/widget radii are separate.
+    /// Explicit user geometry remains configurable; choosing a preset restores its geometry.
     pub fn card_geometry(self) -> ThemeCardGeometry {
-        match self {
-            Self::Nord => {
-                ThemeCardGeometry { radius: 0.0, gutter: 0.0, shadow: false, divider: 1.0 }
-            },
-            _ => ThemeCardGeometry {
-                radius: DEFAULT_PANE_CARD_RADIUS,
-                gutter: DEFAULT_PANE_CARD_GUTTER,
-                shadow: false,
-                // 有卡缝就已经把两块面板分开了，再加竖线是重复的分界。
-                divider: 0.0,
-            },
-        }
+        ThemeCardGeometry { radius: 0.0, gutter: 0.0, shadow: false, divider: 1.0 }
     }
 }
 
@@ -968,6 +967,9 @@ pub struct RuntimeSettings {
     pub vcs_display: VcsDisplayName,
     /// 终端 BEL：关 / 闪烁 / 声音 / 两者（缺省两者）。
     pub bell: BellModeName,
+    /// AI message toasts inside the application. System notifications and
+    /// terminal/tab state are independent. Default on for existing users.
+    pub ai_toasts: bool,
     /// 新会话欢迎屏 fastfetch（默认关：启动速度优先于观感，旧壳裁定）。
     pub fetch: bool,
     /// Check GitHub Releases after startup. Manual checks remain available
@@ -1130,6 +1132,7 @@ impl RuntimeSettings {
                 .and_then(VcsDisplayName::from_settings)
                 .unwrap_or_default(),
             bell: raw.value("bell").and_then(BellModeName::from_settings).unwrap_or_default(),
+            ai_toasts: raw.bool_on("ai_toasts").unwrap_or(true),
             fetch: raw.bool_on("fetch").unwrap_or(false),
             auto_check_updates: raw.bool_on("auto_check_updates").unwrap_or(true),
             keep_session: raw.bool_on("keep_session").unwrap_or(false),
@@ -1215,6 +1218,14 @@ pub fn format_hex_rgb(rgb: Rgb8) -> String {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn empty_quick_terminal_hotkey_is_distinct_from_an_unset_preference() {
+        let unset = RuntimeSettings::from_raw(&RawSettings::from_text("theme=Nord\n"));
+        let cleared =
+            RuntimeSettings::from_raw(&RawSettings::from_text("quick_terminal_hotkey=\n"));
+        assert_eq!(unset.quick_terminal_hotkey, DEFAULT_QUICK_TERMINAL_HOTKEY);
+        assert_eq!(cleared.quick_terminal_hotkey, "");
+    }
     use super::*;
 
     #[test]
@@ -1247,23 +1258,24 @@ mod tests {
     }
 
     #[test]
-    fn nord_carries_the_flush_card_geometry() {
+    fn nord_and_paper_carry_the_flush_card_geometry() {
         // Nord 是卡几何抽象的第一个实验者：半径与卡缝双双归零、靠一条竖线分界。
         // 这四个数一起构成「终端铺满整个右侧区域」的形态，任一项退回默认都会
         // 让它变回浮起的圆角卡——所以逐项钉死，而不是只断言 radius。
-        let nord = ThemeName::Nord.card_geometry();
-        assert_eq!(nord.radius, 0.0);
-        assert_eq!(nord.gutter, 0.0);
-        assert_eq!(nord.divider, 1.0);
-        assert!(!nord.shadow);
-
-        // 其余主题保持卡片形态，且**不画**竖线：有卡缝时两块面板已经分开了，
-        // 再加一条线是重复的分界。
-        for theme in [ThemeName::Nebula, ThemeName::Paper, ThemeName::CoalDark] {
+        for theme in ThemeName::BUILTIN {
             let geometry = theme.card_geometry();
-            assert_eq!(geometry.radius, DEFAULT_PANE_CARD_RADIUS);
-            assert_eq!(geometry.gutter, DEFAULT_PANE_CARD_GUTTER);
-            assert_eq!(geometry.divider, 0.0);
+            assert_eq!(geometry.radius, 0.0);
+            assert_eq!(geometry.gutter, 0.0);
+            assert_eq!(geometry.divider, 1.0);
+            assert!(!geometry.shadow);
+        }
+
+        // Retired identifiers also resolve to the flat geometry contract.
+        for theme in [ThemeName::Nebula, ThemeName::CoalDark] {
+            let geometry = theme.card_geometry();
+            assert_eq!(geometry.radius, 0.0);
+            assert_eq!(geometry.gutter, 0.0);
+            assert_eq!(geometry.divider, 1.0);
         }
     }
 
@@ -1421,6 +1433,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ai_toasts_default_on_and_accept_all_boolean_spellings() {
+        for value in ["", "invalid", "1", "true", "YES", "On"] {
+            let raw = RawSettings::from_text(&format!("ai_toasts={value}\n"));
+            assert!(RuntimeSettings::from_raw(&raw).ai_toasts, "{value:?}");
+        }
+        assert!(RuntimeSettings::from_raw(&RawSettings::default()).ai_toasts);
+        for value in ["0", "false", "NO", "Off"] {
+            let raw = RawSettings::from_text(&format!("ai_toasts={value}\n"));
+            let settings = RuntimeSettings::from_raw(&raw);
+            assert!(!settings.ai_toasts, "{value:?}");
+            assert_eq!(settings.bell, BellModeName::Both);
+            assert!(settings.auto_check_updates);
+            assert!(settings.resume_ai);
+        }
+    }
+
+    #[test]
+    fn ai_toast_toggle_round_trips_without_replacing_other_settings() {
+        let original = "# preferences\nshell=zsh\ncustom_key=keep\nAI_TOASTS=1\n";
+        let disabled = apply_updates(original, &[("ai_toasts", "0".to_owned())]);
+        let restored = RuntimeSettings::from_raw(&RawSettings::from_text(&disabled));
+        assert!(!restored.ai_toasts);
+        assert_eq!(restored.shell.as_deref(), Some("zsh"));
+        assert!(disabled.contains("# preferences\n"));
+        assert!(disabled.contains("custom_key=keep\n"));
+        let enabled = apply_updates(&disabled, &[("ai_toasts", "1".to_owned())]);
+        assert!(RuntimeSettings::from_raw(&RawSettings::from_text(&enabled)).ai_toasts);
+        assert_eq!(enabled.matches("ai_toasts=").count(), 1);
+    }
+
     #[test]
     fn bell_mode_parses_known_values_and_rejects_junk() {
         assert_eq!(BellModeName::from_settings("none"), Some(BellModeName::None));
diff --git a/nebula_settings/src/reset.rs b/nebula_settings/src/reset.rs
index 7d28162..f48470f 100644
--- a/nebula_settings/src/reset.rs
+++ b/nebula_settings/src/reset.rs
@@ -33,6 +33,7 @@ const RESET_KEYS: &[&str] = &[
     "cell_width_mode",
     "vcs_display",
     "bell",
+    "ai_toasts",
     "fetch",
     "auto_check_updates",
     "keep_session",
@@ -115,6 +116,15 @@ mod tests {
     use super::*;
     use crate::{RawSettings, RuntimeSettings};
 
+    #[test]
+    fn resetting_preferences_reenables_ai_toasts_without_erasing_other_data() {
+        let original = "ai_toasts=0\ncustom_data=keep\n";
+        assert!(!RuntimeSettings::from_raw(&RawSettings::from_text(original)).ai_toasts);
+        let restored = default_settings_text(original);
+        assert_eq!(restored, "custom_data=keep\n");
+        assert!(RuntimeSettings::from_raw(&RawSettings::from_text(&restored)).ai_toasts);
+    }
+
     #[test]
     fn reset_removes_all_overrides_and_keeps_user_data() {
         let text = "# preferences\r\n THEME = Nord\r\ncopy_on_select=1\nkeybind=ctrl+x:Copy\nFONT_SIZE=30\nexecutor=custom\nssh_hosts=saved-host\nai_provider=custom\nfuture_setting=keep\n";
diff --git a/nebula_settings/src/themes.rs b/nebula_settings/src/themes.rs
index 293353f..d4eaf06 100644
--- a/nebula_settings/src/themes.rs
+++ b/nebula_settings/src/themes.rs
@@ -1,4 +1,4 @@
-//! Four quiet built-in palettes, shared by terminal and chrome adapters.
+//! Static built-in theme catalog, shared by terminal and chrome adapters.
 use crate::{ExactTermColors, Rgb8, TermTheme, ThemeName};
 
 #[derive(Clone, Copy, Debug)]
@@ -12,21 +12,62 @@ pub struct FreshPalette {
 }
 
 impl ThemeName {
+    /// The only catalog of selectable built-ins. Retired identifiers remain readable.
+    pub const BUILTIN: [Self; 13] = [
+        Self::BreezeLight,
+        Self::BreezeDark,
+        Self::MintLight,
+        Self::MintDark,
+        Self::SilverLight,
+        Self::Nord,
+        Self::Paper,
+        Self::LimestoneLight,
+        Self::LinenLight,
+        Self::CatppuccinMocha,
+        Self::CatppuccinLatte,
+        Self::GlassLight,
+        Self::GlassDark,
+    ];
+
+    pub const BUILTIN_NAMES: [&'static str; 13] = {
+        let mut names = [""; 13];
+        let mut index = 0;
+        while index < Self::BUILTIN.len() {
+            names[index] = Self::BUILTIN[index].prompt_name();
+            index += 1;
+        }
+        names
+    };
+
+    /// Retired names keep existing settings readable without reappearing in the picker.
+    pub const fn available(self) -> Self {
+        match self {
+            Self::Nebula => Self::CatppuccinMocha,
+            Self::SteelDark | Self::CoalDark => Self::Nord,
+            Self::MossDark => Self::MintDark,
+            other => other,
+        }
+    }
+
     pub fn fresh_palette(self) -> Option<FreshPalette> {
-        let (shell, surface, accent, foreground, muted, is_light) = match self {
-            Self::BreezeLight => (0xeaf0f6, 0xf9fbff, 0x306592, 0x26384a, 0x576c80, true),
-            Self::BreezeDark => (0x18232e, 0x202e3b, 0x91bcdf, 0xe0eaf3, 0xa5b6c7, false),
-            Self::MintLight => (0xeaf2ee, 0xf8fcf9, 0x28745e, 0x263c33, 0x587365, true),
-            Self::MintDark => (0x192a26, 0x213730, 0x8bcbb3, 0xdfeee7, 0xa6bfb2, false),
-            _ => return None,
-        };
+        let palette = self.reviewed_palette();
         Some(FreshPalette {
-            shell: rgb(shell),
-            surface: rgb(surface),
-            accent: rgb(accent),
-            foreground: rgb(foreground),
-            muted: rgb(muted),
-            is_light,
+            shell: palette.shell,
+            surface: palette.background,
+            accent: palette.accent,
+            foreground: palette.foreground,
+            muted: palette.muted,
+            is_light: matches!(
+                self.available(),
+                Self::BreezeLight
+                    | Self::MintLight
+                    | Self::SilverLight
+                    | Self::Paper
+                    | Self::LimestoneLight
+                    | Self::LinenLight
+                    | Self::CatppuccinLatte
+                    | Self::GlassLight
+            ),
         })
     }
 }
@@ -35,18 +76,286 @@ const fn rgb(value: u32) -> Rgb8 {
     [(value >> 16) as u8, (value >> 8) as u8, value as u8]
 }
 
+/// Exact semantic colors of the reviewed terminal HTML. These values are static;
+/// color adapters must not desaturate accents or synthesize a second selected ramp.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct ReviewedPalette {
+    pub shell: Rgb8,
+    pub background: Rgb8,
+    pub foreground: Rgb8,
+    pub muted: Rgb8,
+    pub accent: Rgb8,
+    pub selected: [u8; 4],
+    pub line: [u8; 4],
+    pub red: Rgb8,
+    pub green: Rgb8,
+    pub yellow: Rgb8,
+    pub blue: Rgb8,
+    pub purple: Rgb8,
+    pub cyan: Rgb8,
+    pub frame: Rgb8,
+}
+
+impl ReviewedPalette {
+    /// CSS-style alpha composition of the reviewed secondary surface on the pane.
+    pub const fn code_background(self) -> Rgb8 {
+        let alpha = self.selected[3] as u32;
+        let mut color = [0; 3];
+        let mut index = 0;
+        while index < 3 {
+            color[index] = ((self.selected[index] as u32 * alpha
+                + self.background[index] as u32 * (255 - alpha)
+                + 127)
+                / 255) as u8;
+            index += 1;
+        }
+        color
+    }
+}
+
+impl ThemeName {
+    pub const fn reviewed_palette(self) -> ReviewedPalette {
+        match self.available() {
+            Self::BreezeLight => ReviewedPalette {
+                shell: [0xea, 0xf0, 0xf6],
+                background: [0xf9, 0xfb, 0xff],
+                foreground: [0x26, 0x38, 0x4a],
+                muted: [0x57, 0x6c, 0x80],
+                accent: [0x30, 0x65, 0x92],
+                selected: [0xdf, 0xe9, 0xf2, 255],
+                line: [0xd4, 0xdf, 0xe9, 255],
+                red: [0xa3, 0x42, 0x48],
+                green: [0x28, 0x74, 0x5e],
+                yellow: [0x88, 0x62, 0x1f],
+                blue: [0x30, 0x65, 0x92],
+                purple: [0x77, 0x56, 0x9b],
+                cyan: [0x24, 0x77, 0x82],
+                frame: [0x95, 0xa7, 0xb8],
+            },
+            Self::BreezeDark => ReviewedPalette {
+                shell: [0x18, 0x23, 0x2e],
+                background: [0x20, 0x2e, 0x3b],
+                foreground: [0xe0, 0xea, 0xf3],
+                muted: [0xa5, 0xb6, 0xc7],
+                accent: [0x91, 0xbc, 0xdf],
+                selected: [0x2b, 0x3c, 0x4b, 255],
+                line: [0x34, 0x46, 0x54, 255],
+                red: [0xe4, 0x9a, 0x9d],
+                green: [0x9b, 0xc5, 0xa6],
+                yellow: [0xe0, 0xc3, 0x8b],
+                blue: [0x91, 0xbc, 0xdf],
+                purple: [0xc5, 0xad, 0xdd],
+                cyan: [0x91, 0xce, 0xcf],
+                frame: [0x50, 0x65, 0x79],
+            },
+            Self::MintLight => ReviewedPalette {
+                shell: [0xea, 0xf2, 0xee],
+                background: [0xf8, 0xfc, 0xf9],
+                foreground: [0x26, 0x3c, 0x33],
+                muted: [0x58, 0x73, 0x65],
+                accent: [0x28, 0x74, 0x5e],
+                selected: [0xdc, 0xeb, 0xe2, 255],
+                line: [0xd0, 0xe0, 0xd6, 255],
+                red: [0xa3, 0x42, 0x48],
+                green: [0x28, 0x74, 0x5e],
+                yellow: [0x88, 0x62, 0x1f],
+                blue: [0x30, 0x65, 0x92],
+                purple: [0x77, 0x56, 0x9b],
+                cyan: [0x24, 0x77, 0x82],
+                frame: [0x94, 0xaa, 0x9d],
+            },
+            Self::MintDark => ReviewedPalette {
+                shell: [0x19, 0x2a, 0x26],
+                background: [0x21, 0x37, 0x30],
+                foreground: [0xdf, 0xee, 0xe7],
+                muted: [0xa6, 0xbf, 0xb2],
+                accent: [0x8b, 0xcb, 0xb3],
+                selected: [0x2d, 0x44, 0x3b, 255],
+                line: [0x3a, 0x50, 0x46, 255],
+                red: [0xe4, 0x9a, 0x9d],
+                green: [0x9b, 0xc5, 0xa6],
+                yellow: [0xe0, 0xc3, 0x8b],
+                blue: [0x91, 0xbc, 0xdf],
+                purple: [0xc5, 0xad, 0xdd],
+                cyan: [0x91, 0xce, 0xcf],
+                frame: [0x52, 0x6f, 0x62],
+            },
+            Self::SilverLight => ReviewedPalette {
+                shell: [0xf3, 0xf4, 0xf6],
+                background: [0xff, 0xff, 0xff],
+                foreground: [0x24, 0x29, 0x2f],
+                muted: [0x60, 0x67, 0x71],
+                accent: [0x49, 0x50, 0x57],
+                selected: [0xe6, 0xe8, 0xec, 255],
+                line: [0xdf, 0xe2, 0xe6, 255],
+                red: [0xcf, 0x22, 0x2e],
+                green: [0x1a, 0x7f, 0x37],
+                yellow: [0x9a, 0x67, 0x00],
+                blue: [0x09, 0x69, 0xda],
+                purple: [0x82, 0x50, 0xdf],
+                cyan: [0x1b, 0x7c, 0x83],
+                frame: [0xa7, 0xac, 0xb4],
+            },
+            Self::Nord => ReviewedPalette {
+                shell: [0x2e, 0x34, 0x40],
+                background: [0x2e, 0x34, 0x40],
+                foreground: [0xe5, 0xe9, 0xf0],
+                muted: [0xab, 0xb5, 0xc7],
+                accent: [0x88, 0xc0, 0xd0],
+                selected: [0x3b, 0x42, 0x52, 255],
+                line: [0x43, 0x4c, 0x5e, 255],
+                red: [0xbf, 0x61, 0x6a],
+                green: [0xa3, 0xbe, 0x8c],
+                yellow: [0xeb, 0xcb, 0x8b],
+                blue: [0x81, 0xa1, 0xc1],
+                purple: [0xb4, 0x8e, 0xad],
+                cyan: [0x88, 0xc0, 0xd0],
+                frame: [0x65, 0x72, 0x86],
+            },
+            Self::Paper => ReviewedPalette {
+                shell: [0xf5, 0xf4, 0xf0],
+                background: [0xfc, 0xfb, 0xf9],
+                foreground: [0x1a, 0x1a, 0x1a],
+                muted: [0x73, 0x73, 0x69],
+                accent: [0x2b, 0x5a, 0x38],
+                selected: [0xe9, 0xe8, 0xe1, 255],
+                line: [0xde, 0xdd, 0xd4, 255],
+                red: [0xa3, 0x3a, 0x3a],
+                green: [0x2b, 0x5a, 0x38],
+                yellow: [0xa8, 0x5a, 0x20],
+                blue: [0x4a, 0x7a, 0x8a],
+                purple: [0x4a, 0x3a, 0x6a],
+                cyan: [0x3a, 0x7a, 0x6a],
+                frame: [0xb2, 0xb0, 0xa3],
+            },
+            Self::LimestoneLight => ReviewedPalette {
+                shell: [0xf0, 0xef, 0xeb],
+                background: [0xff, 0xff, 0xff],
+                foreground: [0x24, 0x29, 0x2f],
+                muted: [0x70, 0x6c, 0x63],
+                accent: [0x58, 0x55, 0x4c],
+                selected: [0xe6, 0xe3, 0xdc, 255],
+                line: [0xde, 0xdb, 0xd2, 255],
+                red: [0xcf, 0x22, 0x2e],
+                green: [0x1a, 0x7f, 0x37],
+                yellow: [0x9a, 0x67, 0x00],
+                blue: [0x09, 0x69, 0xda],
+                purple: [0x82, 0x50, 0xdf],
+                cyan: [0x1b, 0x7c, 0x83],
+                frame: [0xaa, 0xa4, 0x96],
+            },
+            Self::LinenLight => ReviewedPalette {
+                shell: [0xf2, 0xf2, 0xec],
+                background: [0xff, 0xff, 0xff],
+                foreground: [0x24, 0x29, 0x2f],
+                muted: [0x6b, 0x70, 0x66],
+                accent: [0x5f, 0x63, 0x5f],
+                selected: [0xe5, 0xe7, 0xde, 255],
+                line: [0xdc, 0xdf, 0xd3, 255],
+                red: [0xcf, 0x22, 0x2e],
+                green: [0x1a, 0x7f, 0x37],
+                yellow: [0x9a, 0x67, 0x00],
+                blue: [0x09, 0x69, 0xda],
+                purple: [0x82, 0x50, 0xdf],
+                cyan: [0x1b, 0x7c, 0x83],
+                frame: [0xa4, 0xaa, 0x9b],
+            },
+            Self::CatppuccinMocha => ReviewedPalette {
+                shell: [0x18, 0x18, 0x25],
+                background: [0x1e, 0x1e, 0x2e],
+                foreground: [0xcd, 0xd6, 0xf4],
+                muted: [0xa6, 0xad, 0xc8],
+                accent: [0xb4, 0xbe, 0xfe],
+                selected: [0x31, 0x32, 0x44, 255],
+                line: [0x45, 0x47, 0x5a, 255],
+                red: [0xf3, 0x8b, 0xa8],
+                green: [0xa6, 0xe3, 0xa1],
+                yellow: [0xf9, 0xe2, 0xaf],
+                blue: [0x89, 0xb4, 0xfa],
+                purple: [0xcb, 0xa6, 0xf7],
+                cyan: [0x94, 0xe2, 0xd5],
+                frame: [0x6c, 0x70, 0x86],
+            },
+            Self::CatppuccinLatte => ReviewedPalette {
+                shell: [0xe6, 0xe9, 0xef],
+                background: [0xef, 0xf1, 0xf5],
+                foreground: [0x4c, 0x4f, 0x69],
+                muted: [0x5c, 0x5f, 0x77],
+                accent: [0x72, 0x87, 0xfd],
+                selected: [0xcc, 0xd0, 0xda, 255],
+                line: [0xbc, 0xc0, 0xcc, 255],
+                red: [0xd2, 0x0f, 0x39],
+                green: [0x40, 0xa0, 0x2b],
+                yellow: [0xdf, 0x8e, 0x1d],
+                blue: [0x1e, 0x66, 0xf5],
+                purple: [0x88, 0x39, 0xef],
+                cyan: [0x17, 0x92, 0x99],
+                frame: [0x9c, 0xa0, 0xb0],
+            },
+            Self::GlassLight => ReviewedPalette {
+                shell: [0xe9, 0xec, 0xef],
+                background: [0xef, 0xf1, 0xf5],
+                foreground: [0x30, 0x30, 0x30],
+                muted: [0x56, 0x61, 0x6b],
+                accent: [0x74, 0x5a, 0xa5],
+                selected: [0xff, 0xff, 0xff, 0x55],
+                line: [0x56, 0x6b, 0x7c, 0x30],
+                red: [0xa3, 0x17, 0x00],
+                green: [0x0a, 0x7f, 0x3d],
+                yellow: [0xaf, 0x55, 0x1d],
+                blue: [0x00, 0x6c, 0xd8],
+                purple: [0x58, 0x3c, 0xac],
+                cyan: [0x00, 0x79, 0x8a],
+                frame: [0xa4, 0xb4, 0xbd],
+            },
+            Self::GlassDark => ReviewedPalette {
+                shell: [0x44, 0x44, 0x45],
+                background: [0x40, 0x43, 0x4b],
+                foreground: [0xf7, 0xf8, 0xff],
+                muted: [0xc4, 0xca, 0xd6],
+                accent: [0xbb, 0xc9, 0xed],
+                selected: [0xff, 0xff, 0xff, 0x15],
+                line: [0x6b, 0x72, 0x86, 0x40],
+                red: [0xff, 0x8a, 0x8a],
+                green: [0xa8, 0xd4, 0x6f],
+                yellow: [0xe8, 0xc7, 0x78],
+                blue: [0x8d, 0xb7, 0xff],
+                purple: [0xd1, 0xa3, 0xff],
+                cyan: [0x7f, 0xd6, 0xc2],
+                frame: [0x7e, 0x8b, 0x9d],
+            },
+            _ => panic!("retired themes map to the active catalog"),
+        }
+    }
+}
+
 pub(crate) fn fresh_terminal(name: ThemeName) -> TermTheme {
     let palette = name.fresh_palette().expect("fresh theme");
-    let ansi = if palette.is_light {
-        [
+    let ansi = match name {
+        ThemeName::CatppuccinMocha => [
+            0x45475a, 0xf38ba8, 0xa6e3a1, 0xf9e2af, 0x89b4fa, 0xf5c2e7, 0x94e2d5, 0xbac2de,
+            0x585b70, 0xf38ba8, 0xa6e3a1, 0xf9e2af, 0x89b4fa, 0xf5c2e7, 0x94e2d5, 0xa6adc8,
+        ],
+        ThemeName::CatppuccinLatte => [
+            0x5c5f77, 0xd20f39, 0x40a02b, 0xdf8e1d, 0x1e66f5, 0xea76cb, 0x179299, 0xacb0be,
+            0x6c6f85, 0xd20f39, 0x40a02b, 0xdf8e1d, 0x1e66f5, 0xea76cb, 0x179299, 0xbcc0cc,
+        ],
+        ThemeName::GlassLight => [
+            0x303030, 0xa31700, 0x0a7f3d, 0xaf551d, 0x006cd8, 0x583cac, 0x00798a, 0x494949,
+            0x8c8c8c, 0xa31700, 0x0a7f3d, 0xaf551d, 0x006cd8, 0x583cac, 0x00798a, 0x1c1c1c,
+        ],
+        ThemeName::GlassDark => [
+            0x252a35, 0xff8a8a, 0xa8d46f, 0xe8c778, 0x8db7ff, 0xd1a3ff, 0x7fd6c2, 0xe3e6f0,
+            0x747b8e, 0xffb0a8, 0xc8ea90, 0xf2da9a, 0xb2ccff, 0xe0c2ff, 0xa3e6d8, 0xffffff,
+        ],
+        _ if palette.is_light => [
             0x26384a, 0xa34248, 0x28745e, 0x88621f, 0x306592, 0x77569b, 0x247782, 0x526375,
             0x667788, 0xb13d48, 0x247052, 0x826013, 0x295e9b, 0x80529a, 0x19717d, 0x34485c,
-        ]
-    } else {
-        [
+        ],
+        _ => [
             0x263b49, 0xe49a9d, 0x9bc5a6, 0xe0c38b, 0x91bcdf, 0xc5addd, 0x91cecf, 0xdfeaf1,
             0x90a5b5, 0xf0b2b3, 0xb1dcc0, 0xeed4a5, 0xb0d1ed, 0xd9c4ed, 0xb0e1dc, 0xf2f7fa,
-        ]
+        ],
     }
     .map(rgb);
     TermTheme {
diff --git a/nebula_terminal/src/render/boxdraw.rs b/nebula_terminal/src/render/boxdraw.rs
index 1d0e3a9..182325a 100644
--- a/nebula_terminal/src/render/boxdraw.rs
+++ b/nebula_terminal/src/render/boxdraw.rs
@@ -132,6 +132,22 @@ impl Geom {
         self.out.push(Primitive::Poly { points });
     }
 
+    /// 把一个凸多边形裁到当前 cell。圆角框线是把扩展的圆角矩形裁回
+    /// cell 后得到的可见弧段；如果让这些顶点越过 cell，GPUI 会把圆角
+    /// 的外半径泄漏到相邻字符里。对角线和 Powerline 仍使用 [`Self::poly`]
+    /// 保留跨 cell 的连接语义。
+    fn poly_clipped(&mut self, mut points: Vec<[f32; 2]>) {
+        for (axis, bound, keep_greater) in
+            [(0, 0.0, true), (0, self.w, false), (1, 0.0, true), (1, self.h, false)]
+        {
+            points = clip_polygon_axis(points, axis, bound, keep_greater);
+            if points.len() < 3 {
+                return;
+            }
+        }
+        self.out.push(Primitive::Poly { points });
+    }
+
     /// 设备像素 → 逻辑像素。
     fn finish(self, scale: f32) -> Vec<Primitive> {
         let inv = 1.0 / scale;
@@ -155,6 +171,41 @@ impl Geom {
     }
 }
 
+/// Sutherland–Hodgman clipping for the four axis-aligned cell edges.
+fn clip_polygon_axis(
+    points: Vec<[f32; 2]>,
+    axis: usize,
+    bound: f32,
+    keep_greater: bool,
+) -> Vec<[f32; 2]> {
+    let Some(mut previous) = points.last().copied() else {
+        return Vec::new();
+    };
+    let mut previous_inside =
+        if keep_greater { previous[axis] >= bound } else { previous[axis] <= bound };
+    let mut clipped = Vec::with_capacity(points.len() + 1);
+    for current in points {
+        let current_inside =
+            if keep_greater { current[axis] >= bound } else { current[axis] <= bound };
+        if current_inside != previous_inside {
+            let delta = current[axis] - previous[axis];
+            if delta.abs() > f32::EPSILON {
+                let t = (bound - previous[axis]) / delta;
+                clipped.push([
+                    previous[0] + (current[0] - previous[0]) * t,
+                    previous[1] + (current[1] - previous[1]) * t,
+                ]);
+            }
+        }
+        if current_inside {
+            clipped.push(current);
+        }
+        previous = current;
+        previous_inside = current_inside;
+    }
+    clipped
+}
+
 fn draw(c: char, g: &mut Geom) {
     let stroke = g.stroke;
     let heavy = stroke * 2.0;
@@ -383,47 +434,105 @@ fn draw(c: char, g: &mut Geom) {
             g.v_line(v_lines.0, left_bot_y, bottom_size, stroke);
             g.v_line(v_lines.1, right_bot_y, bottom_size, stroke);
         },
-        // 圆角 '╭','╮','╯','╰'：两段直臂 + 四分之一圆环（凸四边形分段）。
+        // 圆角 '╭','╮','╯','╰'：按 WT BuiltinGlyphs 的扩展 rounded-rect
+        // 语义生成两段直臂和一段四分之一圆环。rounded-rect 故意延伸到
+        // cell 外，再裁回当前 cell；这样相邻的 `╭─╮`/`╰─╯` 连接点与
+        // 普通框线共享同一条像素边界，不会在圆角处留下毛刺或多出一列墨迹。
+        // 笔画宽继续沿用 Nebula 的 `/8` 合同，只有圆角的位置和裁剪规则
+        // 对齐 WT。
         '\u{256d}'..='\u{2570}' => {
-            // 臂方向：sh=+1 右臂，sv=+1 下臂。
-            let (sh, sv): (f32, f32) = match c {
-                '\u{256d}' => (1.0, 1.0),
-                '\u{256e}' => (-1.0, 1.0),
-                '\u{256f}' => (-1.0, -1.0),
-                '\u{2570}' => (1.0, -1.0),
+            // Direct2D 的原实现先把路径坐标按半笔画修正，再对绝对坐标
+            // round；在设备像素域复刻同一计算，避免奇数 cell 宽度下圆角
+            // 比相邻直线偏半个像素。
+            let t = stroke;
+            let half = t / 2.0;
+            let snap_beg = |base: f32| (base - half).round() + half;
+            let snap_end = |base: f32| (base + half).round() - half;
+            let (left, top, right, bottom, start_angle, end_angle) = match c {
+                '\u{256d}' => (
+                    snap_beg(w * 0.5),
+                    snap_beg(h * 0.5),
+                    snap_end(w * 1.5),
+                    snap_end(h * 1.5),
+                    PI,
+                    PI + FRAC_PI_2,
+                ),
+                '\u{256e}' => (
+                    snap_beg(w * -0.5),
+                    snap_beg(h * 0.5),
+                    snap_end(w * 0.5),
+                    snap_end(h * 1.5),
+                    -FRAC_PI_2,
+                    0.0,
+                ),
+                '\u{256f}' => (
+                    snap_beg(w * -0.5),
+                    snap_beg(h * -0.5),
+                    snap_end(w * 0.5),
+                    snap_end(h * 0.5),
+                    0.0,
+                    FRAC_PI_2,
+                ),
+                '\u{2570}' => (
+                    snap_beg(w * 0.5),
+                    snap_beg(h * -0.5),
+                    snap_end(w * 1.5),
+                    snap_end(h * 0.5),
+                    FRAC_PI_2,
+                    PI,
+                ),
                 _ => unreachable!(),
             };
-            let t = stroke;
-            // 外半径与旧实现一致；圆心落在两臂中线的交汇几何位上。
-            let outer = (w.min(h) + t) / 2.0;
-            let inner = outer - t;
-            let d = outer - t / 2.0;
-            let (kx, ky) = (g.x_center() + sh * d, g.y_center() + sv * d);
-
-            // 直臂：竖臂从上/下边缘到圆心高度，横臂从左/右边缘到圆心横位。
-            let (vx0, vx1) = g.v_line_bounds(g.x_center(), t);
-            let (hy0, hy1) = g.h_line_bounds(g.y_center(), t);
-            if sv > 0.0 {
-                g.rect(vx0, ky, vx1 - vx0, h - ky);
-            } else {
-                g.rect(vx0, 0.0, vx1 - vx0, ky);
-            }
-            if sh > 0.0 {
-                g.rect(kx, hy0, w - kx, hy1 - hy0);
-            } else {
-                g.rect(0.0, hy0, kx, hy1 - hy0);
-            }
-
-            // 圆弧朝单元格中心一侧弯曲：象限方向 (-sh, -sv)。
-            let (u, v) = (-sh, -sv);
-            const SEGMENTS: usize = 8;
-            let at = |angle: f32, radius: f32| {
-                [kx + u * radius * angle.cos(), ky + v * radius * angle.sin()]
+            let radius = (t * 5.0).min(w.min(h) * 0.5);
+            let (cx, cy, vertical_start, vertical_len, horizontal_start, horizontal_len) = match c {
+                '\u{256d}' => (
+                    left + radius,
+                    top + radius,
+                    left,
+                    h - (top + radius),
+                    left + radius,
+                    w - (left + radius),
+                ),
+                '\u{256e}' => {
+                    (right - radius, top + radius, right, h - (top + radius), 0.0, right - radius)
+                },
+                '\u{256f}' => {
+                    (right - radius, bottom - radius, right, bottom - radius, 0.0, right - radius)
+                },
+                '\u{2570}' => (
+                    left + radius,
+                    bottom - radius,
+                    left,
+                    bottom - radius,
+                    left + radius,
+                    w - (left + radius),
+                ),
+                _ => unreachable!(),
             };
+
+            match c {
+                '\u{256d}' | '\u{256e}' => {
+                    g.v_line(vertical_start, top + radius, vertical_len, t);
+                    g.h_line(horizontal_start, top, horizontal_len, t);
+                },
+                '\u{256f}' | '\u{2570}' => {
+                    g.v_line(vertical_start, 0.0, vertical_len, t);
+                    g.h_line(horizontal_start, bottom, horizontal_len, t);
+                },
+                _ => unreachable!(),
+            }
+
+            // A stroked rounded rectangle has a centerline radius `radius`; its
+            // filled annulus therefore uses +/- half the stroke width. Clip
+            // every convex segment to the cell like WT's aliased clip.
+            let outer = radius + half;
+            let inner = (radius - half).max(0.0);
+            const SEGMENTS: usize = 8;
             for i in 0..SEGMENTS {
-                let a0 = FRAC_PI_2 * i as f32 / SEGMENTS as f32;
-                let a1 = FRAC_PI_2 * (i + 1) as f32 / SEGMENTS as f32;
-                g.poly(vec![at(a0, outer), at(a1, outer), at(a1, inner), at(a0, inner)]);
+                let a0 = start_angle + (end_angle - start_angle) * i as f32 / SEGMENTS as f32;
+                let a1 = start_angle + (end_angle - start_angle) * (i + 1) as f32 / SEGMENTS as f32;
+                let at = |angle: f32, r: f32| [cx + r * angle.cos(), cy + r * angle.sin()];
+                g.poly_clipped(vec![at(a0, outer), at(a1, outer), at(a1, inner), at(a0, inner)]);
             }
         },
         // 局部块：上/下 n/8、左/右 n/8（含 Legacy Computing 上部块）。
@@ -816,17 +925,76 @@ mod tests {
         }
     }
 
-    /// 圆角 '╭' 输出直臂 + 圆环分段，全部落在单元格附近（允许亚像素越界）。
+    /// 圆角 '╭' 输出直臂 + 圆环分段，并像 WT 的 aliased cell clip 一样
+    /// 把扩展 rounded-rect 裁回当前单元格。
     #[test]
-    fn rounded_corner_stays_near_cell() {
-        let prims = prims('\u{256d}');
-        let polys = prims.iter().filter(|p| matches!(p, Primitive::Poly { .. })).count();
-        assert_eq!(polys, 8, "四分之一圆环按 8 段近似");
-        for prim in &prims {
-            if let Primitive::Poly { points } = prim {
-                for [x, y] in points {
-                    assert!((-1.0..=W + 1.0).contains(x), "x={x}");
-                    assert!((-1.0..=H + 1.0).contains(y), "y={y}");
+    fn rounded_corner_is_clipped_to_cell() {
+        for c in ['\u{256d}', '\u{256e}', '\u{256f}', '\u{2570}'] {
+            let prims = prims(c);
+            let polys = prims.iter().filter(|p| matches!(p, Primitive::Poly { .. })).count();
+            assert_eq!(polys, 8, "{c:?} 四分之一圆环按 8 段近似");
+            for prim in &prims {
+                if let Primitive::Poly { points } = prim {
+                    for [x, y] in points {
+                        assert!((0.0..=W).contains(x), "{c:?} x={x}");
+                        assert!((0.0..=H).contains(y), "{c:?} y={y}");
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn rounded_corner_arms_follow_the_corner_direction() {
+        for (c, extends_down) in
+            [('\u{256d}', true), ('\u{256e}', true), ('\u{256f}', false), ('\u{2570}', false)]
+        {
+            let rects = rects(c);
+            let vertical = rects.iter().find(|(rect, _)| rect.h > rect.w).expect("竖直臂").0;
+            if extends_down {
+                assert!(vertical.y >= H / 2.0, "{c:?} 的竖臂应向下");
+                assert_eq!(vertical.y + vertical.h, H);
+            } else {
+                assert_eq!(vertical.y, 0.0);
+                assert!(vertical.y + vertical.h <= H / 2.0, "{c:?} 的竖臂应向上");
+            }
+        }
+    }
+
+    #[test]
+    fn rounded_corners_keep_clipped_geometry_at_narrow_dpi_sizes() {
+        for c in ['\u{256d}', '\u{256e}', '\u{256f}', '\u{2570}'] {
+            for width in [2.0, 3.0, 4.0, 7.0, 9.0] {
+                for height in [3.0, 5.0, 8.0, 20.0] {
+                    for scale in [1.0, 1.25, 1.5, 2.0] {
+                        let prims = primitives(c, width, height, scale).expect("圆角应为内建");
+                        // The public geometry contract first rounds the cell
+                        // to physical pixels. Compare against that cell, not
+                        // the unsnapped logical input (e.g. 3 * 1.5 -> 5 px).
+                        let cell_width = (width * scale).round().max(1.0) / scale;
+                        let cell_height = (height * scale).round().max(1.0) / scale;
+                        for prim in prims {
+                            match prim {
+                                Primitive::Rect { rect, .. } => {
+                                    for value in [rect.x, rect.y, rect.x + rect.w, rect.y + rect.h]
+                                    {
+                                        assert!(value.is_finite(), "{c:?} 非有限矩形边界");
+                                    }
+                                    assert!(rect.x >= 0.0 && rect.y >= 0.0, "{c:?} 越过左/上边");
+                                    assert!(rect.x + rect.w <= cell_width + 1e-4);
+                                    assert!(rect.y + rect.h <= cell_height + 1e-4);
+                                },
+                                Primitive::Poly { points } => {
+                                    assert!(!points.is_empty(), "{c:?} 不应产生空多边形");
+                                    for [x, y] in points {
+                                        assert!(x.is_finite() && y.is_finite(), "{c:?} 非有限弧点");
+                                        assert!((-1e-4..=cell_width + 1e-4).contains(&x));
+                                        assert!((-1e-4..=cell_height + 1e-4).contains(&y));
+                                    }
+                                },
+                            }
+                        }
+                    }
                 }
             }
         }
diff --git a/packaging/macos/Info.plist b/packaging/macos/Info.plist
index 94cfeac..3943054 100644
--- a/packaging/macos/Info.plist
+++ b/packaging/macos/Info.plist
@@ -4,6 +4,20 @@
 <dict>
   <key>CFBundleDevelopmentRegion</key>
   <string>en</string>
+  <key>CFBundleLocalizations</key>
+  <array>
+    <string>en</string>
+    <string>zh-Hans</string>
+    <string>zh-Hant</string>
+    <string>fr</string>
+    <string>de</string>
+    <string>es</string>
+    <string>pt-BR</string>
+    <string>it</string>
+    <string>ru</string>
+    <string>ja</string>
+    <string>ko</string>
+  </array>
   <key>CFBundleDisplayName</key>
   <string>Pebrel Preview</string>
   <key>CFBundleExecutable</key>