pinokiod 8.0.39 → 8.0.41

package/test/vault-ui.test.js

@@ -4,6 +4,8 @@ const fs = require('fs')
 const os = require('os')
 const path = require('path')
 const crypto = require('crypto')
+const ejs = require('ejs')
+const { JSDOM } = require('jsdom')
 const Vault = require('../kernel/vault')
 
 const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex')
@@ -14,6 +16,29 @@ const writeFile = async (p, content) => {
   return p
 }
 
+const duplicateEntry = async (filePath, entry) => {
+  const st = await fs.promises.stat(filePath)
+  return Object.assign({}, entry, {
+    dev: st.dev,
+    ino: st.ino,
+    mtime: st.mtimeMs,
+    ctime: st.ctimeMs
+  })
+}
+
+const vaultPageSource = async () => {
+  const root = path.resolve(__dirname, '..', 'server')
+  const files = ['views/vault.ejs', 'views/partials/vault_workspace.ejs', 'public/vault.css', 'public/storage-size.js', 'public/vault.js']
+  return (await Promise.all(files.map((file) => fs.promises.readFile(path.resolve(root, file), 'utf8')))).join('\n')
+}
+
+const runVaultScript = async (dom) => {
+  const publicRoot = path.resolve(__dirname, '..', 'server', 'public')
+  const scripts = await Promise.all(['storage-size.js', 'vault.js']
+    .map((file) => fs.promises.readFile(path.resolve(publicRoot, file), 'utf8')))
+  dom.window.eval(scripts.join('\n'))
+}
+
 describe('vault dashboard backend (phase 4)', () => {
   let homes = []
   const makeEnv = async () => {
@@ -44,20 +69,89 @@ describe('vault dashboard backend (phase 4)', () => {
   test('item 15: undo of a conversion batch restores independent files', async () => {
     const { home, vault } = await makeEnv()
     const { content, a, b } = await makeSharedPair(home, vault)
-    const savedBefore = vault.registry.totals.lifetime_bytes_saved
 
     const result = await vault.undoBatch('batch-m.bin')
     assert.strictEqual(result.undone, 1)
     assert.strictEqual((await fs.promises.stat(b)).nlink, 1, 'independent file again')
     assert.deepStrictEqual(await fs.promises.readFile(b), content)
     assert.strictEqual((await fs.promises.stat(a)).nlink, 2, 'other names untouched')
-    assert.strictEqual(vault.registry.totals.lifetime_bytes_saved, savedBefore - content.length)
     assert.ok(vault.registry.duplicates.has(b), 'undone file is pending again')
     const events = await vault.registry.readEvents()
     assert.ok(events.some((e) => e.kind === 'undo' && e.batch_id === 'batch-m.bin'))
   })
 
-  test('detach makes one name independent and pins it against future scans', async () => {
+  test('undo remains available after its activity event is compacted away', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault, 'retained.bin')
+    vault.registry.maxEvents = 2
+    vault.registry.compactEvery = 1
+
+    for (let index = 0; index < 3; index += 1) {
+      await vault.registry.appendEvent({ kind: 'scan', marker: index })
+    }
+
+    const compactedEvents = await vault.registry.readEvents()
+    assert.strictEqual(compactedEvents.some((event) => event.batch_id === 'batch-retained.bin'), false)
+    await vault.sweeper.scan()
+    assert.strictEqual(vault.registry.links.get(b).batch_id, 'batch-retained.bin')
+    const status = await vault.status()
+    assert.deepStrictEqual(status.undo_batches, [{
+      batch_id: 'batch-retained.bin', files: 1, bytes: 4096, ts: null
+    }])
+
+    const result = await vault.undoBatch('batch-retained.bin')
+    assert.strictEqual(result.undone, 1)
+    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
+  })
+
+  test('a replaced file never inherits an old compacted undo batch', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault, 'replaced.bin')
+    const oldBatch = 'batch-replaced.bin'
+    vault.registry.maxEvents = 2
+    vault.registry.compactEvery = 1
+
+    for (let index = 0; index < 3; index += 1) {
+      await vault.registry.appendEvent({ kind: 'scan', marker: index })
+    }
+    assert.strictEqual((await vault.registry.readEvents())
+      .some((event) => event.batch_id === oldBatch), false)
+
+    const replacement = crypto.randomBytes(4096)
+    const replacementPath = await writeFile(`${b}.replacement`, replacement)
+    await fs.promises.rename(replacementPath, b)
+    await vault.sweeper.scan()
+
+    const replacementStat = await fs.promises.stat(b)
+    const replacementEntry = vault.registry.links.get(b)
+    assert.strictEqual(replacementEntry.hash, sha256(replacement))
+    assert.strictEqual(replacementEntry.batch_id, undefined)
+
+    const result = await vault.undoBatch(oldBatch)
+    assert.deepStrictEqual(result, { undone: 0, bytes: 0, failed: 0 })
+    assert.deepStrictEqual(await fs.promises.readFile(b), replacement)
+    assert.strictEqual((await fs.promises.stat(b)).ino, replacementStat.ino)
+  })
+
+  test('an old activity batch cannot undo a newer conversion of the same path', async () => {
+    const { home, vault } = await makeEnv()
+    const { hash, b } = await makeSharedPair(home, vault, 'reconverted.bin')
+    assert.strictEqual((await vault.undoBatch('batch-reconverted.bin')).undone, 1)
+    assert.strictEqual((await vault.convert(b, hash, { app: 'appB', batch_id: 'batch-new' })).status, 'converted')
+
+    const oldUndo = await vault.undoBatch('batch-reconverted.bin')
+    assert.strictEqual(oldUndo.undone, 0)
+    assert.strictEqual(vault.registry.links.get(b).batch_id, 'batch-new')
+    assert.ok((await fs.promises.stat(b)).nlink > 1)
+
+    const status = await vault.status()
+    const oldEvent = status.events.find((event) => event.kind === 'convert' && event.batch_id === 'batch-reconverted.bin')
+    const newEvent = status.events.find((event) => event.kind === 'convert' && event.batch_id === 'batch-new')
+    assert.strictEqual(oldEvent.undoable, false)
+    assert.strictEqual(newEvent.undoable, true)
+  })
+
+  test('detach makes one shared name independent and immediately pending again', async () => {
     const { home, vault } = await makeEnv()
     const { content, a, b } = await makeSharedPair(home, vault)
 
@@ -66,24 +160,405 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
     assert.deepStrictEqual(await fs.promises.readFile(b), content)
     assert.strictEqual((await fs.promises.stat(a)).nlink, 2)
-    assert.ok(vault.registry.excluded.has(b))
-    assert.strictEqual(vault.registry.excluded.get(b).size, content.length)
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+    assert.ok(vault.registry.duplicates.has(b))
+    assert.strictEqual(vault.registry.duplicates.get(b).size, content.length)
+    assert.ok(vault.registry.scanIndex.has(b))
     assert.strictEqual(fs.existsSync(b + '.pinokio-dedup-tmp'), false)
 
-    // A scan neither re-adopts nor re-lists the pinned path.
+    // No re-share action or extra scan is required to review it again.
+    const status = await vault.status()
+    assert.ok(status.duplicates.some((item) => item.path === b))
+
+    // A later scan preserves the pending duplicate.
     await vault.sweeper.scan()
     assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
+    assert.ok(vault.registry.duplicates.has(b))
+  })
+
+  test('detach reports actual copied bytes and clears progress after the atomic replacement', async () => {
+    const { home, vault } = await makeEnv()
+    const size = (17 * 1024 * 1024) + 123
+    const content = Buffer.alloc(size, 0x5a)
+    const hash = sha256(content)
+    const a = await writeFile(path.resolve(home, 'api', 'appA', 'large.bin'), content)
+    const b = await writeFile(path.resolve(home, 'api', 'appB', 'large.bin'), content)
+    await vault.refreshSources()
+    const appA = vault.sources().find((source) => source.kind === 'app' && source.app === 'appA')
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    await vault.adopt(a, hash, { app: 'appA', source_id: appA.id })
+    assert.strictEqual((await vault.convert(b, hash, {
+      app: 'appB', source_id: appB.id, batch_id: 'large'
+    })).status, 'converted')
+
+    const samples = []
+    const realCopyOut = vault.copyOut.bind(vault)
+    vault.copyOut = async (...args) => {
+      const options = args[4]
+      const onProgress = options.onProgress
+      args[4] = Object.assign({}, options, {
+        onProgress: (copied, total) => {
+          onProgress(copied, total)
+          samples.push(vault.progressStatus(appB.id).file_action)
+          assert.strictEqual(vault.progressStatus(appA.id).file_action, null)
+        }
+      })
+      return realCopyOut(...args)
+    }
+
+    const result = await vault.detach(b)
+
+    assert.strictEqual(result.status, 'detached')
+    assert.ok(samples.length >= 4)
+    assert.strictEqual(samples[0].bytes_copied, 0)
+    assert.strictEqual(samples.at(-1).bytes_copied, size)
+    assert.ok(samples.every((sample) =>
+      sample.kind === 'detach' &&
+      sample.path === b &&
+      sample.source_id === appB.id &&
+      sample.bytes_total === size))
+    for (let index = 1; index < samples.length; index += 1) {
+      assert.ok(samples[index].bytes_copied > samples[index - 1].bytes_copied)
+    }
+    assert.strictEqual(vault.progressStatus(appB.id).file_action, null)
+    assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
+  })
+
+  test('detach removes its partial copy and preserves sharing when the disk write fails', async () => {
+    const { home, vault } = await makeEnv()
+    const size = (9 * 1024 * 1024) + 17
+    const content = Buffer.alloc(size, 0x39)
+    const hash = sha256(content)
+    const a = await writeFile(path.resolve(home, 'api', 'appA', 'no-space.bin'), content)
+    await vault.adopt(a, hash, { app: 'appA' })
+    const b = await writeFile(path.resolve(home, 'api', 'appB', 'no-space.bin'), content)
+    assert.strictEqual((await vault.convert(b, hash, {
+      app: 'appB', batch_id: 'no-space'
+    })).status, 'converted')
+    const before = await fs.promises.stat(b)
+    const tmp = b + Vault.TMP_SUFFIX
+    const realOpen = fs.promises.open
+    fs.promises.open = async (...args) => {
+      const handle = await realOpen(...args)
+      if (args[0] !== tmp) return handle
+      return {
+        stat: (...callArgs) => handle.stat(...callArgs),
+        chmod: (...callArgs) => handle.chmod(...callArgs),
+        close: (...callArgs) => handle.close(...callArgs),
+        write: async (...callArgs) => {
+          await handle.write(...callArgs)
+          const error = new Error('no space left on device')
+          error.code = 'ENOSPC'
+          throw error
+        }
+      }
+    }
+
+    try {
+      await assert.rejects(vault.detach(b), (error) => error && error.code === 'ENOSPC')
+    } finally {
+      fs.promises.open = realOpen
+    }
+
+    const after = await fs.promises.stat(b)
+    assert.strictEqual(after.dev, before.dev)
+    assert.strictEqual(after.ino, before.ino)
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
+    assert.strictEqual(fs.existsSync(tmp), false)
+    assert.ok(vault.registry.links.has(b))
     assert.strictEqual(vault.registry.duplicates.has(b), false)
+    assert.strictEqual(vault.fileAction, null)
+  })
 
-    // Re-share un-pins; the next scan lists it as pending again (no auto-convert).
-    const reshared = await vault.reshare(b)
-    assert.strictEqual(reshared.status, 'resharable')
-    await vault.sweeper.scan()
+  test('a committed file action reports a persistence warning instead of a false failure', async () => {
+    const { home, vault } = await makeEnv()
+    const { content, b } = await makeSharedPair(home, vault, 'persist-warning.bin')
+    const before = await fs.promises.stat(b)
+    const realFlush = vault.registry.flush.bind(vault.registry)
+    vault.registry.persistDelay = 60000
+    vault.registry.flush = async () => {
+      const error = new Error('temporary snapshot write failure')
+      error.code = 'EIO'
+      throw error
+    }
+
+    let result
+    try {
+      result = await vault.perform('detach', { path: b })
+    } finally {
+      vault.registry.flush = realFlush
+    }
+
+    const after = await fs.promises.stat(b)
+    assert.strictEqual(result.status, 'detached')
+    assert.strictEqual(result.persistence_warning, true)
+    assert.notStrictEqual(after.ino, before.ino)
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
     assert.ok(vault.registry.duplicates.has(b))
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+    await vault.registry.flush()
+  })
+
+  test('duplicate queued detach requests cannot turn a pending file into Skip', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault, 'queued-twice.bin')
+
+    const [first, second] = await Promise.all([
+      vault.perform('detach', { path: b }),
+      vault.perform('detach', { path: b })
+    ])
+
+    assert.strictEqual(first.status, 'detached')
+    assert.strictEqual(second.status, 'not-found')
+    assert.ok(vault.registry.duplicates.has(b))
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+  })
+
+  test('detach and undo preserve an unrelated temporary-name collision', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    const tmp = b + Vault.TMP_SUFFIX
+    await fs.promises.writeFile(tmp, 'user data')
+
+    const detached = await vault.detach(b)
+    const undone = await vault.undoBatch('batch-m.bin')
+
+    assert.strictEqual(detached.status, 'conflict')
+    assert.strictEqual(undone.undone, 0)
+    assert.strictEqual(undone.failed, 1)
+    assert.strictEqual(await fs.promises.readFile(tmp, 'utf8'), 'user data')
+    assert.ok(vault.registry.links.has(b))
+  })
+
+  test('detach never overwrites a file replaced while its independent copy is being made', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    const replacement = Buffer.from('newer-writer-content')
+    const realLstat = fs.promises.lstat
+    let replaced = false
+    fs.promises.lstat = async (target, options) => {
+      if (!replaced && path.resolve(String(target)) === b + Vault.TMP_SUFFIX) {
+        replaced = true
+        const writerPath = b + '.writer-replacement'
+        await fs.promises.writeFile(writerPath, replacement)
+        await fs.promises.rename(writerPath, b)
+      }
+      return realLstat(target, options)
+    }
+    let result
+    try {
+      result = await vault.detach(b)
+    } finally {
+      fs.promises.lstat = realLstat
+    }
+
+    assert.strictEqual(result.status, 'stale')
+    assert.deepStrictEqual(await fs.promises.readFile(b), replacement)
+    assert.strictEqual(fs.existsSync(b + Vault.TMP_SUFFIX), false)
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+  })
+
+  test('detach preserves a temporary path replaced before rename', async () => {
+    const { home, vault } = await makeEnv()
+    const { content, b } = await makeSharedPair(home, vault)
+    const tmp = b + Vault.TMP_SUFFIX
+    const savedCopy = tmp + '.saved-copy'
+    const realLstat = fs.promises.lstat
+    let tmpReads = 0
+    fs.promises.lstat = async (target, options) => {
+      if (path.resolve(String(target)) === tmp) {
+        tmpReads += 1
+        if (tmpReads === 2) {
+          await fs.promises.rename(tmp, savedCopy)
+          await fs.promises.writeFile(tmp, 'unrelated')
+        }
+      }
+      return realLstat(target, options)
+    }
+    let result
+    try {
+      result = await vault.detach(b)
+    } finally {
+      fs.promises.lstat = realLstat
+    }
+
+    assert.strictEqual(result.status, 'stale')
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
+    assert.strictEqual(await fs.promises.readFile(tmp, 'utf8'), 'unrelated')
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+  })
+
+  test('detach and undo stop when the owning app starts during the copy', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    const realLstat = fs.promises.lstat
+    let startDuringCopy = true
+    fs.promises.lstat = async (target, options) => {
+      if (startDuringCopy && path.resolve(String(target)) === b + Vault.TMP_SUFFIX) {
+        startDuringCopy = false
+        vault.kernel.api = {
+          running: { started: true },
+          running_paths: { started: path.resolve(home, 'api', 'appB', 'start.js') }
+        }
+      }
+      return realLstat(target, options)
+    }
+    let detached
+    try {
+      detached = await vault.detach(b)
+      vault.kernel.api = null
+      startDuringCopy = true
+      const undone = await vault.undoBatch('batch-m.bin')
+      assert.strictEqual(undone.undone, 0)
+      assert.strictEqual(undone.failed, 1)
+    } finally {
+      fs.promises.lstat = realLstat
+    }
+
+    assert.strictEqual(detached.status, 'locked')
+    assert.ok((await fs.promises.stat(b)).nlink > 1)
+    assert.strictEqual(fs.existsSync(b + Vault.TMP_SUFFIX), false)
+  })
+
+  test('detach does not register a writer replacement that wins after the atomic rename', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    const replacement = Buffer.from('newer-writer-content')
+    const realRename = fs.promises.rename
+    fs.promises.rename = async (source, target) => {
+      const result = await realRename(source, target)
+      if (source === b + Vault.TMP_SUFFIX && target === b) {
+        const writerPath = b + '.writer-replacement'
+        await fs.promises.writeFile(writerPath, replacement)
+        await realRename(writerPath, b)
+      }
+      return result
+    }
+    let result
+    try {
+      result = await vault.detach(b)
+    } finally {
+      fs.promises.rename = realRename
+    }
+
+    assert.strictEqual(result.status, 'stale')
+    assert.deepStrictEqual(await fs.promises.readFile(b), replacement)
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+    assert.strictEqual(fs.existsSync(b + Vault.TMP_SUFFIX), false)
+  })
+
+  test('detach stays registered when metadata fails after the atomic replacement', async () => {
+    const { home, vault } = await makeEnv()
+    const { content, b } = await makeSharedPair(home, vault)
+    const realRename = fs.promises.rename
+    const realLstat = fs.promises.lstat
+    let committed = false
+    let failedRead = false
+    fs.promises.rename = async (source, target) => {
+      const result = await realRename(source, target)
+      if (source === b + Vault.TMP_SUFFIX && target === b) committed = true
+      return result
+    }
+    fs.promises.lstat = async (target, options) => {
+      if (committed && !failedRead && path.resolve(String(target)) === b) {
+        failedRead = true
+        const error = new Error('temporary post-rename metadata failure')
+        error.code = 'EIO'
+        throw error
+      }
+      return realLstat(target, options)
+    }
+    let result
+    try {
+      result = await vault.detach(b)
+    } finally {
+      fs.promises.rename = realRename
+      fs.promises.lstat = realLstat
+    }
+
+    assert.strictEqual(failedRead, true)
+    assert.strictEqual(result.status, 'detached')
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
     assert.strictEqual((await fs.promises.stat(b)).nlink, 1)
+    assert.strictEqual(vault.registry.links.has(b), false)
+    assert.strictEqual(vault.registry.duplicates.get(b).size, content.length)
+    assert.strictEqual(vault.registry.duplicates.get(b).unverified, true)
+    assert.strictEqual(vault.registry.scanIndex.has(b), false)
+    assert.strictEqual(vault.registry.duplicates.get(b).ctime, undefined)
+    assert.strictEqual(vault.registry.excluded.has(b), false)
   })
 
-  test('detach on a pending duplicate just ignores it', async () => {
+  test('undo never overwrites a file replaced while bytes are being copied out', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    const replacement = Buffer.from('newer-writer-content')
+    const realLstat = fs.promises.lstat
+    let replaced = false
+    fs.promises.lstat = async (target, options) => {
+      if (!replaced && path.resolve(String(target)) === b + Vault.TMP_SUFFIX) {
+        replaced = true
+        const writerPath = b + '.writer-replacement'
+        await fs.promises.writeFile(writerPath, replacement)
+        await fs.promises.rename(writerPath, b)
+      }
+      return realLstat(target, options)
+    }
+    let result
+    try {
+      result = await vault.undoBatch('batch-m.bin')
+    } finally {
+      fs.promises.lstat = realLstat
+    }
+
+    assert.strictEqual(result.undone, 0)
+    assert.strictEqual(result.failed, 1)
+    assert.deepStrictEqual(await fs.promises.readFile(b), replacement)
+    assert.strictEqual(fs.existsSync(b + Vault.TMP_SUFFIX), false)
+  })
+
+  test('detach and undo use the current owning app even with a stale broad source id', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault)
+    vault.registry.links.get(b).source_id = 'pinokio'
+    vault.kernel.api = {
+      running: { custom: true },
+      running_paths: { custom: path.resolve(home, 'api', 'appB', 'start.js') }
+    }
+
+    assert.strictEqual((await vault.detach(b)).status, 'locked')
+    const undone = await vault.undoBatch('batch-m.bin')
+    assert.strictEqual(undone.undone, 0)
+    assert.strictEqual(undone.failed, 1)
+    assert.ok((await fs.promises.stat(b)).nlink > 1)
+  })
+
+  test('detach and undo never follow a parent-directory link outside the source', {
+    skip: process.platform === 'win32'
+  }, async () => {
+    const { home, vault } = await makeEnv()
+    const { content, b } = await makeSharedPair(home, vault, 'nested/m.bin')
+    const outsideParent = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-detach-outside-'))
+    homes.push(outsideParent)
+    const moved = path.resolve(outsideParent, 'moved')
+    const nested = path.dirname(b)
+    await fs.promises.rename(nested, moved)
+    await fs.promises.symlink(moved, nested)
+    const before = await fs.promises.stat(b)
+
+    assert.strictEqual((await vault.detach(b)).status, 'stale')
+    const undone = await vault.undoBatch('batch-nested/m.bin')
+
+    assert.strictEqual(undone.undone, 0)
+    assert.strictEqual(undone.failed, 1)
+    assert.deepStrictEqual(await fs.promises.readFile(b), content)
+    const after = await fs.promises.stat(b)
+    assert.strictEqual(after.dev, before.dev)
+    assert.strictEqual(after.ino, before.ino)
+    assert.strictEqual(vault.registry.excluded.has(b), false)
+  })
+
+  test('Skip records a pending duplicate as kept separate', async () => {
     const { home, vault } = await makeEnv()
     const content = crypto.randomBytes(4096)
     const hash = sha256(content)
@@ -92,27 +567,191 @@ describe('vault dashboard backend (phase 4)', () => {
     const b = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
     vault.registry.duplicates.set(b, { hash, size: content.length, app: 'appB' })
 
-    const result = await vault.detach(b)
+    const result = await vault.perform('skip', { path: b })
     assert.strictEqual(result.status, 'ignored')
     assert.strictEqual(vault.registry.duplicates.has(b), false)
     assert.ok(vault.registry.excluded.has(b))
     assert.strictEqual(vault.registry.excluded.get(b).size, content.length)
+    assert.ok((await vault.registry.readEvents()).some((event) => event.kind === 'skip' && event.path === b))
   })
 
   test('status(): disk figures, scan metadata, excluded list', async () => {
     const { home, vault } = await makeEnv()
     const { content, hash } = await makeSharedPair(home, vault)
-    await vault.detach(path.resolve(home, 'api', 'appB', 'm.bin'))
+    const detached = path.resolve(home, 'api', 'appB', 'm.bin')
+    await vault.detach(detached)
+    await vault.skip(detached)
     await vault.sweeper.scan()
     const status = await vault.status()
     assert.strictEqual(status.enabled, true)
-    assert.strictEqual(status.bytes_on_disk, content.length)
+    assert.strictEqual(status.bytes_on_disk, content.length * 2)
     assert.ok(status.last_scan && status.last_scan.files > 0)
     assert.strictEqual(status.excluded.length, 1)
     assert.strictEqual(status.excluded[0].size, content.length)
     assert.strictEqual(status.blobs.length, 1)
     assert.deepStrictEqual(status.blobs[0].apps, ['appA'])
     assert.ok(status.scan && status.scan.active === false)
+
+    await fs.promises.rm(path.resolve(home, 'api', 'appB'), { recursive: true })
+    await vault.refreshSources()
+    const afterSourceRemoval = await vault.status()
+    assert.strictEqual(afterSourceRemoval.excluded.length, 1, 'user-owned exclusions survive source removal')
+    assert.strictEqual(afterSourceRemoval.excluded[0].size, content.length)
+  })
+
+  test('an overlapping status response keeps the sequence of its older snapshot', async () => {
+    const { home, vault } = await makeEnv()
+    const { b } = await makeSharedPair(home, vault, 'status-sequence.bin')
+    const realReadEvents = vault.registry.readEvents.bind(vault.registry)
+    let releaseStatus
+    let statusWaiting
+    const gate = new Promise((resolve) => { releaseStatus = resolve })
+    const waiting = new Promise((resolve) => { statusWaiting = resolve })
+    vault.registry.readEvents = async () => {
+      statusWaiting()
+      await gate
+      return realReadEvents()
+    }
+
+    const sequenceBefore = vault.actionSequence
+    const pendingStatus = vault.status()
+    await waiting
+    try {
+      const detached = await vault.perform('detach', { path: b })
+      assert.strictEqual(detached.status, 'detached')
+    } finally {
+      releaseStatus()
+      vault.registry.readEvents = realReadEvents
+    }
+    const stale = await pendingStatus
+
+    assert.strictEqual(stale.action_sequence, sequenceBefore)
+    assert.ok(stale.action_sequence < vault.actionSequence)
+    assert.ok(stale.blobs.some((blob) => blob.names.some((name) => name.path === b)))
+  })
+
+  test('tracked storage metrics include physical pending duplicates', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const original = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
+    await vault.adopt(original, hash, { app: 'appA' })
+    await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
+    await vault.sweeper.scan()
+
+    const status = await vault.status()
+    assert.strictEqual(status.pending_bytes, content.length)
+    assert.strictEqual(status.bytes_on_disk, content.length * 2)
+    assert.strictEqual(status.bytes_without_sharing, content.length * 2)
+    assert.strictEqual(status.saved_by_sharing, 0)
+  })
+
+  test('app status exposes only that app while retaining its matching locations', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const appAFile = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
+    const appBFile = await writeFile(path.resolve(home, 'api', 'appB', 'model.bin'), content)
+    await vault.sweeper.scan()
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+
+    const status = await vault.status(appB.id)
+
+    assert.strictEqual(status.scope_id, appB.id)
+    assert.deepStrictEqual(status.sources.map((source) => source.id), [appB.id])
+    assert.strictEqual(status.sources[0].parent_id, null)
+    assert.deepStrictEqual(status.duplicates.map((item) => item.path), [appBFile])
+    assert.strictEqual(status.blobs.length, 1)
+    assert.deepStrictEqual(new Set(status.blobs[0].names.map((name) => name.path)),
+      new Set([appAFile]))
+    assert.strictEqual(status.pending_bytes, content.length)
+    assert.strictEqual(status.bytes_without_sharing, content.length)
+    assert.strictEqual(status.bytes_on_disk, content.length)
+    assert.ok(status.last_scan && status.last_scan.files === 1)
+
+    const converted = await vault.perform('deduplicate', {
+      scope_id: appB.id,
+      paths: [appBFile]
+    })
+    assert.strictEqual(converted.converted, 1)
+    const sharedStatus = await vault.status(appB.id)
+    assert.strictEqual(sharedStatus.bytes_on_disk, content.length / 2)
+  })
+
+  test('app effective usage divides shared files across locations and fully counts other files', async () => {
+    const { home, vault } = await makeEnv()
+    const shared = crypto.randomBytes(4096)
+    const small = crypto.randomBytes(512)
+    const hash = sha256(shared)
+    const appAFile = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), shared)
+    const appBFile = await writeFile(path.resolve(home, 'api', 'appB', 'model.bin'), shared)
+    const appCFile = await writeFile(path.resolve(home, 'api', 'appC', 'model.bin'), shared)
+    await writeFile(path.resolve(home, 'api', 'appA', 'config.bin'), small)
+    await vault.sweeper.scan()
+    const sources = Object.fromEntries(vault.sources()
+      .filter((source) => source.kind === 'app')
+      .map((source) => [source.app, source]))
+
+    assert.strictEqual((await vault.convert(appBFile, hash, {
+      app: 'appB', source_id: sources.appB.id
+    })).status, 'converted')
+    assert.strictEqual((await vault.convert(appCFile, hash, {
+      app: 'appC', source_id: sources.appC.id
+    })).status, 'converted')
+
+    const status = await vault.status(sources.appA.id)
+    assert.strictEqual(status.last_scan.bytes_total, shared.length + small.length)
+    assert.strictEqual(status.bytes_without_sharing, shared.length + small.length)
+    assert.ok(Math.abs(status.bytes_on_disk - (small.length + (shared.length / 3))) < 1e-9)
+    assert.strictEqual((await fs.promises.stat(appAFile)).nlink, 4, 'three locations plus the hidden store name')
+  })
+
+  test('activity exposes source-relative paths instead of bare filenames', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const first = await writeFile(path.resolve(home, 'api', 'appA', 'models', 'm.bin'), content)
+    const second = await writeFile(path.resolve(home, 'api', 'appB', 'models', 'm.bin'), content)
+    await vault.refreshSources()
+    const appA = vault.sources().find((source) => source.kind === 'app' && source.app === 'appA')
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    await vault.adopt(first, hash, { app: 'appA', source_id: appA.id })
+    await vault.convert(second, hash, { app: 'appB', source_id: appB.id, batch_id: 'activity-path' })
+
+    const status = await vault.status()
+    const conversion = status.events.find((event) => event.kind === 'convert')
+    assert.strictEqual(conversion.source_label, 'appB')
+    assert.strictEqual(conversion.relative_path, 'models/m.bin')
+
+    const vaultPage = await vaultPageSource()
+    assert.match(vaultPage, /event\.relative_path \|\| event\.path/)
+    assert.doesNotMatch(vaultPage, /event\.path \? basename\(event\.path\)/)
+  })
+
+  test('activity keeps its source-relative context after a source disappears', async () => {
+    const { home, vault } = await makeEnv()
+    const file = await writeFile(path.resolve(home, 'api', 'appA', 'models', 'm.bin'), crypto.randomBytes(4096))
+    await vault.refreshSources()
+    const source = vault.sources().find((item) => item.kind === 'app' && item.app === 'appA')
+    await vault.recordEvent({ kind: 'found', path: file, source_id: source.id, size: 4096 })
+    await fs.promises.rm(path.resolve(home, 'api', 'appA'), { recursive: true, force: true })
+    await vault.refreshSources()
+
+    const status = await vault.status()
+    const event = status.events.find((item) => item.kind === 'found')
+    assert.strictEqual(event.source_label, 'appA')
+    assert.strictEqual(event.relative_path, 'models/m.bin')
+  })
+
+  test('activity exposes the complete retained bounded event window', async () => {
+    const { vault } = await makeEnv()
+    for (let index = 0; index < 110; index += 1) {
+      await vault.registry.appendEvent({ kind: 'found', index })
+    }
+
+    const status = await vault.status()
+    assert.strictEqual(status.events.length, 110)
+    assert.strictEqual(status.events[0].index, 109)
+    assert.strictEqual(status.events[109].index, 0)
   })
 
   test('reclaimAll frees every orphan and nothing else', async () => {
@@ -132,18 +771,158 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.strictEqual(vault.registry.blobs.has(sha256(drop)), false)
   })
 
+  test('reclaimAll records earlier deletions if a later reclaim fails', async () => {
+    const { home, vault } = await makeEnv()
+    const first = crypto.randomBytes(4096)
+    const second = crypto.randomBytes(4096)
+    const firstHash = sha256(first)
+    const secondHash = sha256(second)
+    const firstFile = await writeFile(path.resolve(home, 'api', 'appA', 'first.bin'), first)
+    const secondFile = await writeFile(path.resolve(home, 'api', 'appA', 'second.bin'), second)
+    await vault.adopt(firstFile, firstHash, { app: 'appA' })
+    await vault.adopt(secondFile, secondHash, { app: 'appA' })
+    await fs.promises.unlink(firstFile)
+    await fs.promises.unlink(secondFile)
+    await vault.verify()
+    const realReclaim = vault.reclaim.bind(vault)
+    let calls = 0
+    vault.reclaim = async (...args) => {
+      calls += 1
+      if (calls === 2) {
+        const error = new Error('transient unlink failure')
+        error.code = 'EIO'
+        throw error
+      }
+      return realReclaim(...args)
+    }
+    try {
+      await assert.rejects(vault.reclaimAll(), (error) => error.code === 'EIO')
+    } finally {
+      vault.reclaim = realReclaim
+    }
+
+    assert.strictEqual(fs.existsSync(vault.storePathFor(firstHash)), false)
+    assert.strictEqual(vault.registry.blobs.has(firstHash), false)
+    assert.strictEqual(fs.existsSync(vault.storePathFor(secondHash)), true)
+    assert.strictEqual(vault.registry.blobs.has(secondHash), true)
+  })
+
+  test('status fails closed on a non-missing store metadata error', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const file = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
+    await vault.adopt(file, hash, { app: 'appA' })
+    const storePath = vault.storePathFor(hash)
+    const realStat = fs.promises.lstat
+    fs.promises.lstat = async (target, options) => {
+      if (path.resolve(target) === storePath) {
+        const error = new Error('transient metadata failure')
+        error.code = 'EIO'
+        throw error
+      }
+      return realStat(target, options)
+    }
+    try {
+      await assert.rejects(vault.status(), (error) => error.code === 'EIO')
+    } finally {
+      fs.promises.lstat = realStat
+    }
+
+    assert.strictEqual(vault.registry.blobs.has(hash), true)
+    assert.strictEqual(vault.registry.links.has(file), true)
+  })
+
+  test('queued and failed scans remain visible to progress polling', async () => {
+    const { vault } = await makeEnv()
+    let release
+    const blocker = vault.runExclusive(() => new Promise((resolve) => { release = resolve }))
+    await new Promise((resolve) => setImmediate(resolve))
+    assert.strictEqual(vault.startScan().started, true)
+    const queuedScan = vault.scanPromise
+    const queuedStatus = vault.scanStatus()
+    assert.strictEqual(queuedStatus.pending, true)
+    assert.strictEqual(queuedStatus.active, false)
+    assert.strictEqual(queuedStatus.phase, 'queued')
+    assert.strictEqual(queuedStatus.files, 0)
+    release()
+    await blocker
+    await queuedScan
+    assert.strictEqual(vault.scanStatus().pending, false)
+
+    const realScan = vault.sweeper.scan.bind(vault.sweeper)
+    vault.sweeper.scan = async () => {
+      throw new Error('scan read failed')
+    }
+    assert.strictEqual(vault.startScan().started, true)
+    const failedScan = vault.scanPromise
+    await assert.rejects(failedScan, /scan read failed/)
+    vault.sweeper.scan = realScan
+    assert.strictEqual(vault.scanStatus().pending, false)
+    assert.strictEqual(vault.scanStatus().error, 'scan read failed')
+
+    const source = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'vault.js'), 'utf8')
+    assert.match(source, /scan\.pending \|\| scan\.active/)
+    assert.match(source, /\|\| state\.scanRequested\) delay = 1500/)
+  })
+
+  test('partial scans remain visible with their inaccessible paths and do not masquerade as complete', async () => {
+    const vaultPage = await vaultPageSource()
+    assert.match(vaultPage, /scan_incomplete:\s*"Scan incomplete"/)
+    assert.match(vaultPage, /const incomplete = contextualScan && !scanning && !!data\.incomplete/)
+    assert.match(vaultPage, /id="btn-scan-problems" aria-expanded=/)
+    assert.match(vaultPage, /id="vault-result-paths"/)
+    assert.match(vaultPage, /paths\.hidden = !state\.scanProblemsOpen/)
+    assert.match(vaultPage, /info\.inaccessiblePaths\.map\(\(filePath\) =>/)
+    assert.match(vaultPage, /class="vault-result-path"/)
+    assert.match(vaultPage, /\.vault-result\.incomplete \{[\s\S]*?flex:\s*0 0 auto/)
+    assert.match(vaultPage, /\.vault-result-path span \{[\s\S]*?overflow-wrap:\s*anywhere/)
+    assert.match(vaultPage, /\.vault-result-paths \{[\s\S]*?max-height:\s*144px[\s\S]*?overflow-y:\s*auto/)
+    assert.doesNotMatch(vaultPage, /inaccessiblePaths\.map\(esc\)\.join\(" · "\)/)
+  })
+
+  test('progress remains active and below completion while scan verification runs', async () => {
+    const { vault } = await makeEnv()
+    const realVerify = vault.verify.bind(vault)
+    let entered
+    let release
+    const verifyEntered = new Promise((resolve) => { entered = resolve })
+    const verifyRelease = new Promise((resolve) => { release = resolve })
+    vault.verify = async () => {
+      entered()
+      await verifyRelease
+      return realVerify()
+    }
+    assert.strictEqual(vault.startScan().started, true)
+    const scan = vault.scanPromise
+    try {
+      await verifyEntered
+      const status = vault.progressStatus().scan
+      assert.strictEqual(status.active, true)
+      assert.strictEqual(status.phase, 'verifying')
+      const source = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'vault.js'), 'utf8')
+      assert.match(source, /verifying\s*\?\s*0\.99/)
+    } finally {
+      release()
+      await scan
+      vault.verify = realVerify
+    }
+  })
+
   test('item 16: vocabulary lint — vault page copy avoids forbidden terms', async () => {
-    const forbidden = /hard.?link|junction|symlink|inode|\bblob\b|\bstore\b|\bdedupe\b/i
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
+    const forbidden = /hard.?link|junction|symlink|inode|\bblob\b|\bstore\b|\bdedupe\b|\bvault\b/i
+    const vaultPage = await vaultPageSource()
     const copyBlock = vaultPage.match(/const COPY = \{[\s\S]*?\n\}/)
     assert.ok(copyBlock, 'vault.ejs must keep user copy in a COPY object')
     for (const m of copyBlock[0].matchAll(/:\s*"([^"]*)"/g)) {
       assert.ok(!forbidden.test(m[1]), `forbidden term in vault page copy: "${m[1]}"`)
     }
+    const outsideCopy = vaultPage.replace(copyBlock[0], '')
+    assert.doesNotMatch(outsideCopy, /Add external folder|folder picker could not be opened|Couldn’t load Save space status|Search in \$\{/)
   })
 
   test('duplicate matches show complete filesystem paths without ellipsis', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
+    const vaultPage = await vaultPageSource()
     assert.match(vaultPage, /class="vault-match-path">\$\{esc\(match\.path\)\}/)
     const style = vaultPage.match(/\.vault-match-path \{[\s\S]*?\n\}/)
     assert.ok(style, 'match path must have dedicated wrapping styles')
@@ -152,38 +931,46 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.doesNotMatch(style[0], /text-overflow:\s*ellipsis/)
   })
 
-  test('copy-mode tracking never claims physical sharing savings', async () => {
-    const { home, vault } = await makeEnv()
-    const content = crypto.randomBytes(4096)
-    const hash = sha256(content)
-    const first = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
-    const second = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
-    const firstStat = await fs.promises.stat(first)
-    const secondStat = await fs.promises.stat(second)
-    vault.registry.addBlob(hash, { size: content.length })
-    vault.registry.addLink(first, { hash, app: 'appA', dev: firstStat.dev, ino: firstStat.ino, mode: 'copy' })
-    vault.registry.addLink(second, { hash, app: 'appB', dev: secondStat.dev, ino: secondStat.ino, mode: 'copy' })
-
-    const status = await vault.status()
-    assert.strictEqual(status.bytes_on_disk, content.length * 2)
-    assert.strictEqual(status.saved_by_sharing, 0)
-  })
-
   test('repair is advanced, metrics distinguish detected and explicit savings, and refresh retries', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
-    assert.match(vaultPage, /already_shared:\s*"Already shared"/)
-    assert.match(vaultPage, /saved_by_vault:\s*"Saved by Vault"/)
-    assert.match(vaultPage, /repair_index:\s*"Repair Vault index"/)
+    const vaultPage = await vaultPageSource()
+    assert.match(vaultPage, /disk_space_saved:\s*"of disk space saved"/)
+    assert.match(vaultPage, /before_help:\s*"Estimated space if every app stored its own copy\."/)
+    assert.match(vaultPage, /no_more_matches:\s*"No more matches in files \{size\} and larger"/)
+    assert.match(vaultPage, /more_can_be_saved:\s*"\{size\} more can be saved"/)
+    assert.match(vaultPage, /available_to_save:\s*"\{size\} available to save"/)
+    assert.match(vaultPage, /Number\.isFinite\(data\.saved_by_sharing\)/)
+    assert.match(vaultPage, /fmt\(savedBytes\)/)
+    assert.match(vaultPage, /Number\.isFinite\(data\.bytes_without_sharing\)/)
+    assert.match(vaultPage, /Number\.isFinite\(data\.bytes_on_disk\)/)
+    assert.match(vaultPage, /Number\(data\.pending_bytes\)/)
+    assert.match(vaultPage, /id="btn-review-metric"/)
+    assert.match(vaultPage, /\.vault-button\.review-primary \{[\s\S]*?background:\s*var\(--task-accent-contrast\)[\s\S]*?color:\s*#101828/)
+    assert.match(vaultPage, /class="vault-button primary review-primary" type="button" id="btn-review-result"/)
+    assert.match(vaultPage, /class="vault-button primary" type="button" data-deduplicate-scope=/)
+    assert.match(vaultPage, /id='vault-storage-details'/)
+    assert.doesNotMatch(vaultPage, /lifetime_bytes_saved/)
+    assert.match(vaultPage, /repair_index:\s*"Repair index"/)
     assert.match(vaultPage, /<details class='vault-advanced'/)
     assert.doesNotMatch(vaultPage, /id='btn-rebuild'/)
     const refreshBlock = vaultPage.match(/const refresh = async \(\) => \{[\s\S]*?\n\}/)
     assert.ok(refreshBlock)
     assert.match(refreshBlock[0], /finally/)
+    assert.match(refreshBlock[0], /requestId !== state\.refreshRequestId/)
     assert.doesNotMatch(vaultPage, /priorScanning/)
+    assert.match(vaultPage, /const deduplicateFeedback = \(result\) =>/)
+    assert.match(vaultPage, /\(result\.locked \|\| 0\) \+ \(result\.incompatible \|\| 0\) \+ \(result\.unavailable \|\| 0\) \+ \(result\.failed \|\| 0\)/)
+    assert.match(refreshBlock[0], /delay == null \? null : setTimeout/)
+    assert.match(vaultPage, /if \(!response\.ok\)/)
+    assert.match(vaultPage, /item\.unavailable_reason === "different_disk" \? COPY\.different_disk : COPY\.sharing_unavailable/)
+    assert.match(vaultPage, /role='status' aria-live='polite'/)
+    assert.match(vaultPage, /if \(state\.view === "activity"\) return activityItems\(\)/)
+    assert.match(vaultPage, /if \(state\.view === "reclaimable"\) return state\.data\.blobs\.filter/)
+    assert.match(vaultPage, /hashTotal - \(scan\.queued \|\| 0\)/)
+    assert.doesNotMatch(vaultPage, /item\.saved/)
   })
 
   test('vault uses compact desktop density without truncating duplicate matches', async () => {
-    const vaultPage = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
+    const vaultPage = await vaultPageSource()
     assert.match(vaultPage, /--vault-control-height:\s*28px/)
     assert.match(vaultPage, /--vault-row-height:\s*44px/)
     assert.match(vaultPage, /--vault-tree-row:\s*26px/)
@@ -194,26 +981,55 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.match(vaultPage, /\.vault-match-path \{[\s\S]*?overflow-wrap:\s*anywhere/)
     assert.doesNotMatch(vaultPage, /<header class='task-shell-header'>/)
     assert.doesNotMatch(vaultPage, /id='vault-(?:title|subtitle)'/)
-    assert.match(vaultPage, /\.vault-overview \{[\s\S]*?padding:\s*7px var\(--vault-inline\)/)
-    assert.match(vaultPage, /\.vault-metric \{[\s\S]*?border:\s*0;[\s\S]*?border-left:\s*1px solid var\(--task-border\)/)
-    assert.match(vaultPage, /button\.vault-metric \{[\s\S]*?font:\s*inherit/)
+    assert.match(vaultPage, /body\[data-vault-mode="global"\] \.vault-overview,[\s\S]*?min-height:\s*104px/)
+    assert.match(vaultPage, /\.vault-metrics\.summary \{[\s\S]*?grid-template-columns:\s*minmax\(430px, 620px\) minmax\(230px, 1fr\)/)
+    assert.match(vaultPage, /\.vault-compare-row \{[\s\S]*?grid-template-columns:\s*54px minmax\(180px, 1fr\) 68px/)
+    assert.match(vaultPage, /\.vault-compare-fill\.after \{[\s\S]*?width:\s*var\(--vault-after-ratio\)/)
+    assert.match(vaultPage, /class="vault-compare-info" type="button" aria-describedby="\$\{helpId\}"/)
+    assert.match(vaultPage, /document\.body\.appendChild\(tooltip\)/)
+    assert.match(vaultPage, /\.vault-compare-tooltip \{[\s\S]*?position:\s*fixed/)
+    assert.doesNotMatch(vaultPage, /vault-compare-info[^}]*vault-compare-tooltip/)
+    assert.doesNotMatch(vaultPage, /\.vault-metric \{/)
+    assert.match(vaultPage, /\.vault-table\.inventory \.vault-columns,[\s\S]*?grid-template-columns:\s*minmax\(260px, 1\.7fr\) minmax\(72px, \.4fr\) minmax\(240px, 1fr\)/)
+    assert.match(vaultPage, /\.vault-table\.activity \.vault-columns,[\s\S]*?grid-template-columns:[^;]+;/)
+    assert.match(vaultPage, /\.vault-table\.flat \.vault-columns,[\s\S]*?grid-template-columns:[^;]+;/)
+    assert.match(vaultPage, /\.vault-display-mode \{[\s\S]*?height:\s*30px/)
+    assert.match(vaultPage, /\.vault-flat-location \{[\s\S]*?overflow-wrap:\s*anywhere;[\s\S]*?white-space:\s*normal/)
+    assert.match(vaultPage, /\.vault-sharing-switch::before \{[\s\S]*?width:\s*32px;[\s\S]*?height:\s*18px;/)
+    assert.match(vaultPage, /\.vault-sharing-switch\.on \.vault-sharing-thumb \{[\s\S]*?transform:\s*translateX\(14px\)/)
+    assert.match(vaultPage, /\.vault-sharing-switch:focus-visible/)
     assert.match(vaultPage, /id='btn-add-source'/)
     assert.match(vaultPage, /<script src="\/Socket\.js"><\/script>/)
     assert.match(vaultPage, /action:\s*"add_source"/)
+    assert.match(vaultPage, /data-remove-source=/)
+    assert.match(vaultPage, /action:\s*"remove_source"/)
     assert.match(vaultPage, /identical_contents_at:\s*"Identical contents at"/)
     assert.doesNotMatch(vaultPage, /Matching locations/)
     assert.match(vaultPage, /scan_waiting:\s*"Waiting for scan results"/)
-    assert.match(vaultPage, /view === "all" && !scanning \? `<button class="vault-button" type="button" id="btn-empty-scan"/)
+    assert.match(vaultPage, /view === "all" && !activeScan \? `<button class="vault-button" type="button" id="btn-empty-scan"/)
     assert.match(vaultPage, /class="vault-progress-track"/)
     assert.match(vaultPage, /role="progressbar"/)
-    assert.match(vaultPage, /scan\.walk_duration_ms == null/)
+    assert.match(vaultPage, /const counting = scanPhase === "counting"/)
     assert.match(vaultPage, /const hashTotal = scan\.hash_total/)
-    assert.match(vaultPage, /const hasEstimate = Number\.isFinite\(scan\.estimated_files\)/)
-    assert.match(vaultPage, /scan_estimate_help:\s*"Estimated from your last completed scan"/)
-    assert.match(vaultPage, /\$\{estimated \? "~" : ""\}\$\{progressValue\}%/)
+    assert.match(vaultPage, /const totalFiles = Number\.isFinite\(scan\.total_files\)/)
+    assert.match(vaultPage, /scan_counting_help:\s*"The first scan cannot know its total until this pass finishes"/)
+    assert.match(vaultPage, /scan_count_estimate_help:\s*"Estimated from the exact file total and timing of the last completed scan"/)
+    assert.match(vaultPage, /const countEstimate = Number\.isFinite\(scan\.count_estimate_files\)/)
+    assert.match(vaultPage, /const countRatio = countEstimate === null/)
+    assert.match(vaultPage, /counting\s*\? countRatio \* countWeight/)
+    assert.match(vaultPage, /pinokio:vault:reviewed-scan/)
+    assert.match(vaultPage, /completed \|\| incomplete \|\| \(!state\.scanResult && unreviewed\)/)
+    assert.match(vaultPage, /state\.data\.undo_batches/)
+    assert.match(vaultPage, /data-undo="\$\{attr\(batch\.batch_id\)\}"/)
+    assert.match(vaultPage, /lastAttempt\.hash_failures > 0/)
+    assert.match(vaultPage, /scan_not_analyzed:\s*"could not be analyzed"/)
+    assert.match(vaultPage, /percent = `~\$\{progressValue\}%`/)
+    assert.match(vaultPage, /COPY\.scan_checked\.replace\("\{done\}", hashDone\)\.replace\("\{total\}", hashTotal\)/)
     assert.match(vaultPage, /\.vault-progress-bar\.determinate \{[\s\S]*?transform:\s*scaleX/)
-    assert.match(vaultPage, /\.vault-progress-bar\.indeterminate \{[\s\S]*?transform:\s*scaleX\(1\)[\s\S]*?animation:\s*vault-progress-pulse/)
-    assert.doesNotMatch(vaultPage, /vault-progress-sweep/)
+    assert.match(vaultPage, /\.vault-progress-bar\.indeterminate \{[\s\S]*?animation:\s*vault-progress-discovery/)
+    assert.match(vaultPage, /COPY\.scan_files_checked\.replace\("\{done\}", scan\.files \|\| 0\)\.replace\("\{total\}", totalFiles\)/)
+    assert.match(vaultPage, /if \(!scanState\.querySelector\("\.vault-progress-track"\)\)/)
+    assert.doesNotMatch(vaultPage, /scanState\.innerHTML = `<i[^\n]*\$\{progress\}/)
     assert.match(vaultPage, /body\.vault-page \.task-container \{[\s\S]*?overflow:\s*hidden/)
     assert.match(vaultPage, /\.vault-explorer \{[\s\S]*?flex:\s*1 1 auto[\s\S]*?overflow:\s*hidden/)
     assert.match(vaultPage, /\.vault-rail \{[\s\S]*?overflow-y:\s*auto[\s\S]*?overscroll-behavior:\s*contain/)
@@ -222,11 +1038,1166 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.match(vaultPage, /const toolbarSummary = \(visibleItems\) =>/)
     assert.match(vaultPage, /id="vault-toolbar-summary"/)
     assert.match(vaultPage, /\.vault-table-wrap \{[\s\S]*?overflow:\s*auto[\s\S]*?overscroll-behavior:\s*contain/)
+    assert.match(vaultPage, /@media \(pointer:\s*coarse\) \{[\s\S]*?--vault-control-height:\s*44px/)
+    assert.match(vaultPage, /aria-expanded=/)
     assert.match(vaultPage, /#vault-locations \{[\s\S]*?flex-direction:\s*column[\s\S]*?justify-content:\s*flex-start[\s\S]*?gap:\s*0/)
     assert.match(vaultPage, /\.vault-source-line\.depth-2 \{ padding-left:\s*24px; \}/)
     assert.match(vaultPage, /vault-source-line depth-\$\{Math\.min\(depth, 2\)\} \$\{pathText \? "has-path" : ""\}/)
   })
 
+  test('vault template keeps behavior and styling in dedicated assets', async () => {
+    const template = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'vault.ejs'), 'utf8')
+    assert.match(template, /<link href="\/vault\.css" rel="stylesheet"\/>/)
+    assert.match(template, /<script src="\/vault\.js"><\/script>/)
+    assert.doesNotMatch(template, /<style>/)
+    assert.doesNotMatch(template, /<script>\s*const COPY/)
+  })
+
+  test('app Save space reuses the Vault workspace in the retained app frame', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const [appTemplate, globalTemplate, embeddedTemplate] = await Promise.all([
+      fs.promises.readFile(path.resolve(views, 'app.ejs'), 'utf8'),
+      fs.promises.readFile(path.resolve(views, 'vault.ejs'), 'utf8'),
+      fs.promises.readFile(path.resolve(views, 'vault_app.ejs'), 'utf8')
+    ])
+    assert.match(appTemplate, /id='save-space-tab'[\s\S]*?target="app-vault"[\s\S]*?class="btn header-item frame-link"/)
+    assert.match(appTemplate, /class="btn header-item frame-link"[^>]*data-tab-link-popover="false"/)
+    assert.ok(appTemplate.indexOf("id='save-space-tab'") < appTemplate.indexOf('class="app-autolaunch"'))
+    const foregroundSyncStart = appTemplate.indexOf('const foreground_frame =')
+    const foregroundSyncEnd = appTemplate.indexOf('}, 1000)', foregroundSyncStart)
+    const foregroundSync = appTemplate.slice(foregroundSyncStart, foregroundSyncEnd)
+    assert.ok(foregroundSyncStart >= 0 && foregroundSyncEnd > foregroundSyncStart)
+    assert.match(foregroundSync, /match\.classList\.add\("selected"\)/)
+    assert.doesNotMatch(foregroundSync, /match\.click\(\)/)
+    assert.strictEqual((foregroundSync.match(/selected_tab\.click\(\)/g) || []).length, 1)
+    assert.match(globalTemplate, /include\('partials\/vault_workspace', \{ appMode: false \}\)/)
+    assert.match(embeddedTemplate, /include\('partials\/vault_workspace', \{ appMode: true \}\)/)
+
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    assert.match(html, /data-vault-mode="app"/)
+    assert.match(html, /data-vault-scope="app:appB"/)
+    assert.match(html, /id='btn-scan'/)
+    assert.match(html, /id='vault-explorer'/)
+    assert.doesNotMatch(html, /id='btn-add-source'/)
+    assert.doesNotMatch(html, /id='btn-repair'/)
+    assert.doesNotMatch(html, /src="\/Socket\.js"/)
+
+    const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
+    const routeStart = serverSource.indexOf('this.app.get("/vault/app/:name"')
+    const routeEnd = serverSource.indexOf('this.app.post("/vault/action"', routeStart)
+    const route = serverSource.slice(routeStart, routeEnd)
+    assert.ok(routeStart >= 0 && routeEnd > routeStart)
+    assert.match(route, /isSameOriginRequest/)
+    assert.match(route, /item\.kind === "app" && item\.app === req\.params\.name && item\.available/)
+    assert.match(route, /res\.render\("vault_app"/)
+    const infoRoute = serverSource.slice(
+      serverSource.indexOf('this.app.get("/info/dedup"'),
+      serverSource.indexOf('this.app.get("/vault"')
+    )
+    assert.match(infoRoute, /req\.query\.scope_id/)
+    assert.match(infoRoute, /vault\.status\(scopeId\)/)
+    assert.match(infoRoute, /vault\.progressStatus\(scopeId\)/)
+  })
+
+  test('fixed Save space navigation opts out of dynamic tab actions', async () => {
+    const script = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'tab-link-popover.js'), 'utf8')
+    const dom = new JSDOM(`
+      <div class="appcanvas"><aside><div class="menu-container">
+        <a id="save-space" class="frame-link" href="/vault/app/example" data-tab-link-popover="false">Save space</a>
+        <a id="dynamic-tab" class="frame-link" href="http://localhost:8000">Web UI</a>
+      </div></aside></div>
+    `, { url: 'http://localhost/app/example', runScripts: 'dangerously' })
+    dom.window.eval(script)
+    dom.window.setupTabLinkHover()
+
+    assert.strictEqual(dom.window.document.querySelector('#save-space .tab-link-popover-trigger'), null)
+    assert.ok(dom.window.document.querySelector('#dynamic-tab .tab-link-popover-trigger'))
+    dom.window.close()
+  })
+
+  test('Save space navigation promotes first use and then shows scoped status', async () => {
+    const script = await fs.promises.readFile(
+      path.resolve(__dirname, '..', 'server', 'public', 'vault-nav.js'), 'utf8')
+    let payload = { any_scan: false, scanned: false, scanning: false, pending_bytes: 0 }
+    const requests = []
+    const settle = () => new Promise((resolve) => setImmediate(resolve))
+    const response = async (url) => {
+      requests.push(String(url))
+      return { ok: true, json: async () => Object.assign({}, payload) }
+    }
+
+    const globalDom = new JSDOM(`
+      <a data-main-sidebar-vault-tab>
+        <span data-main-sidebar-vault-status hidden></span>
+      </a>
+    `, { url: 'http://localhost/home', runScripts: 'dangerously' })
+    globalDom.window.fetch = response
+    globalDom.window.eval(script)
+    globalDom.window.document.dispatchEvent(new globalDom.window.Event('DOMContentLoaded'))
+    await settle()
+    const globalTab = globalDom.window.document.querySelector('[data-main-sidebar-vault-tab]')
+    const globalBadge = globalDom.window.document.querySelector('[data-main-sidebar-vault-status]')
+    assert.strictEqual(globalTab.dataset.vaultState, 'new')
+    assert.strictEqual(globalBadge.textContent, 'NEW')
+    assert.strictEqual(globalBadge.hidden, false)
+
+    payload = { any_scan: true, scanned: false, scanning: false, pending_bytes: 0 }
+    globalDom.window.document.dispatchEvent(new globalDom.window.CustomEvent('pinokio:vault-status-changed'))
+    await settle()
+    assert.strictEqual(globalTab.dataset.vaultState, 'not-scanned')
+    assert.strictEqual(globalBadge.textContent, 'Not scanned')
+
+    payload = { any_scan: true, scanned: true, scanning: true, pending_bytes: 0 }
+    globalDom.window.document.dispatchEvent(new globalDom.window.CustomEvent('pinokio:vault-status-changed'))
+    await settle()
+    assert.strictEqual(globalTab.dataset.vaultState, 'scanning')
+    assert.strictEqual(globalBadge.textContent, 'Scanning')
+
+    payload = { any_scan: true, scanned: true, scanning: false, pending_bytes: 12e9 }
+    globalDom.window.document.dispatchEvent(new globalDom.window.CustomEvent('pinokio:vault-status-changed'))
+    await settle()
+    assert.strictEqual(globalTab.dataset.vaultState, 'pending')
+    assert.strictEqual(globalBadge.textContent, '12 GB')
+    globalDom.window.close()
+
+    payload = { any_scan: false, scanned: false, scanning: false, pending_bytes: 0 }
+    const appDom = new JSDOM(`
+      <a data-app-vault-tab data-app-vault-name="demo app">
+        <span data-app-vault-prompt hidden>Find duplicate files and use less disk</span>
+        <span data-app-vault-status hidden></span>
+      </a>
+    `, { url: 'http://localhost/app/demo', runScripts: 'dangerously' })
+    appDom.window.fetch = response
+    appDom.window.eval(script)
+    appDom.window.document.dispatchEvent(new appDom.window.Event('DOMContentLoaded'))
+    await settle()
+    const appTab = appDom.window.document.querySelector('[data-app-vault-tab]')
+    const appPrompt = appDom.window.document.querySelector('[data-app-vault-prompt]')
+    const appBadge = appDom.window.document.querySelector('[data-app-vault-status]')
+    assert.strictEqual(requests.at(-1), '/info/dedup/nav?app=demo%20app')
+    assert.strictEqual(appTab.dataset.vaultState, 'new')
+    assert.strictEqual(appPrompt.hidden, false)
+    assert.strictEqual(appBadge.textContent, 'NEW')
+
+    payload = { any_scan: true, scanned: false, scanning: false, pending_bytes: 0 }
+    appDom.window.document.dispatchEvent(new appDom.window.CustomEvent('pinokio:vault-status-changed'))
+    await settle()
+    assert.strictEqual(appTab.dataset.vaultState, 'not-scanned')
+    assert.strictEqual(appPrompt.hidden, true)
+    assert.strictEqual(appBadge.textContent, 'Not scanned')
+    appDom.window.close()
+  })
+
+  test('navigation status endpoint is same-origin, memory-only, and non-initializing', async () => {
+    const serverSource = await fs.promises.readFile(
+      path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
+    const routeStart = serverSource.indexOf('this.app.get("/info/dedup/nav"')
+    const routeEnd = serverSource.indexOf('this.app.get("/info/dedup"', routeStart)
+    const route = serverSource.slice(routeStart, routeEnd)
+    assert.ok(routeStart >= 0 && routeEnd > routeStart)
+    assert.match(route, /isSameOriginRequest/)
+    assert.match(route, /res\.sendStatus\(404\)/)
+    assert.match(route, /Cache-Control", "no-store"/)
+    assert.match(route, /vault\.navigationStatusForApp\(appName\)/)
+    assert.match(route, /vault\.navigationStatus\(\)/)
+    assert.doesNotMatch(route, /ensureInitialized/)
+
+    const [sidebar, appTemplate, vaultScript] = await Promise.all([
+      fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'partials', 'main_sidebar.ejs'), 'utf8'),
+      fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'app.ejs'), 'utf8'),
+      fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'vault.js'), 'utf8')
+    ])
+    assert.match(sidebar, /data-main-sidebar-vault-tab/)
+    assert.match(sidebar, /src="\/vault-nav\.js"/)
+    assert.match(appTemplate, /data-app-vault-tab/)
+    assert.match(appTemplate, /Find duplicate files and use less disk/)
+    assert.match(appTemplate, /src="\/vault-nav\.js" defer/)
+    const promptRule = appTemplate.match(/#save-space-tab \.save-space-prompt \{[\s\S]*?\n\}/)
+    assert.ok(promptRule)
+    assert.match(promptRule[0], /white-space:\s*normal/)
+    assert.match(promptRule[0], /overflow-wrap:\s*break-word/)
+    assert.doesNotMatch(promptRule[0], /text-overflow:\s*ellipsis/)
+    assert.match(vaultScript, /notifyNavigationStatus\(\)/)
+    assert.match(vaultScript, /pinokio:vault-status-changed/)
+  })
+
+  test('app Vault workspace loads scoped data without global-only controls', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, { url: 'http://localhost/vault/app/appB', runScripts: 'dangerously' })
+    const requests = []
+    dom.window.fetch = async (url) => {
+      requests.push(String(url))
+      return {
+        ok: true,
+        json: async () => ({
+          enabled: true,
+          mode: 'link',
+          scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+          last_scan: null,
+          bytes_on_disk: null,
+          pending_bytes: 0,
+          activity_error: null,
+          cloud_sync_warning: null,
+          sources: [{
+            id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+            display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+          }],
+          blobs: [], duplicates: [], excluded: [], events: [], undo_batches: []
+        })
+      }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    assert.deepStrictEqual(requests, ['/info/dedup?scope_id=app%3AappB'])
+    assert.match(dom.window.document.getElementById('btn-scan').textContent, /Scan this app/)
+    assert.strictEqual(dom.window.document.getElementById('vault-candidate-size-label').textContent, 'Check files')
+    assert.strictEqual(dom.window.document.getElementById('vault-candidate-size').value,
+      String(100 * 1000 * 1000))
+    assert.match(dom.window.document.querySelector('.vault-summary-side').textContent, /Not scanned yet/)
+    assert.doesNotMatch(dom.window.document.querySelector('.vault-summary-side').textContent, /No more matches/)
+    assert.strictEqual(dom.window.document.querySelector('[data-source="app:appB"]').getAttribute('aria-current'), 'page')
+    assert.strictEqual(dom.window.document.getElementById('btn-add-source'), null)
+    assert.strictEqual(dom.window.document.getElementById('btn-repair'), null)
+    dom.window.close()
+  })
+
+  test('app Save space header shows proportional effective disk usage', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, { url: 'http://localhost/vault/app/appB', runScripts: 'dangerously' })
+    const gb = 1024 ** 3
+    dom.window.fetch = async () => ({
+      ok: true,
+      json: async () => ({
+        enabled: true,
+        mode: 'link',
+        scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+        last_scan: { ts: Date.now(), bytes_total: 6.6 * gb },
+        bytes_on_disk: 2.4 * gb,
+        pending_bytes: 0,
+        activity_error: null,
+        cloud_sync_warning: null,
+        sources: [{
+          id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+          display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+        }],
+        blobs: [], duplicates: [], excluded: [], events: [], undo_batches: []
+      })
+    })
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    assert.strictEqual(dom.window.document.querySelector('.vault-summary-value').textContent, '4.51 GB saved for this app')
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-compare-value')].map((node) => node.textContent), ['7.09 GB', '2.58 GB'])
+    assert.match(dom.window.document.querySelector('.vault-compare-fill.after').getAttribute('style'), /--vault-after-ratio:36\.36%/)
+    assert.strictEqual(dom.window.document.getElementById('vault-after-help').textContent,
+      'Shared files are divided evenly among every location using them.')
+    assert.strictEqual(dom.window.document.getElementById('vault-after-help').parentElement,
+      dom.window.document.body)
+    const helpButton = dom.window.document.querySelector('.vault-compare-info')
+    helpButton.dispatchEvent(new dom.window.MouseEvent('mouseover', { bubbles: true }))
+    assert.strictEqual(dom.window.document.getElementById('vault-after-help').hidden, false)
+    helpButton.dispatchEvent(new dom.window.MouseEvent('mouseout', { bubbles: true }))
+    assert.strictEqual(dom.window.document.getElementById('vault-after-help').hidden, true)
+    assert.match(dom.window.document.querySelector('.vault-summary-side').textContent,
+      /No more matches in files 100 MB and larger/)
+    dom.window.close()
+  })
+
+  test('candidate minimum is visible and changes only through Apply & scan', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const workspace = await ejs.renderFile(path.resolve(views, 'partials', 'vault_workspace.ejs'), { appMode: false })
+    const dom = new JSDOM(`<body data-vault-mode="global">${workspace}</body>`, {
+      url: 'http://localhost/vault', runScripts: 'dangerously'
+    })
+    const actions = []
+    const status = {
+      enabled: true,
+      mode: 'link',
+      candidate_min_bytes: 100 * 1000 * 1000,
+      candidate_size_options: [10, 50, 100, 500, 1000].map((value) => value * 1000 * 1000),
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: {
+        ts: Date.now(), bytes_total: 1000, home_bytes_total: 1000,
+        candidate_min_bytes: 100 * 1000 * 1000
+      },
+      bytes_on_disk: 1000,
+      bytes_without_sharing: 1000,
+      saved_by_sharing: 0,
+      pending_bytes: 0,
+      reclaimable: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [],
+      blobs: [], duplicates: [], excluded: [], events: [], undo_batches: []
+    }
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        actions.push(JSON.parse(options.body))
+        return { ok: true, json: async () => ({ started: true }) }
+      }
+      return { ok: true, json: async () => status }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    const select = dom.window.document.getElementById('vault-candidate-size')
+    assert.strictEqual(dom.window.document.getElementById('vault-candidate-size-label').textContent, 'Check files')
+    assert.strictEqual(select.value, String(100 * 1000 * 1000))
+    assert.deepStrictEqual([...select.options].map((option) => option.textContent), [
+      '10 MB and larger', '50 MB and larger', '100 MB and larger',
+      '500 MB and larger', '1 GB and larger'
+    ])
+    assert.match(dom.window.document.querySelector('.vault-summary-side').textContent,
+      /No more matches in files 100 MB and larger/)
+    assert.match(dom.window.document.getElementById('vault-pane-footer').textContent,
+      /Scans check files 100 MB and larger/)
+
+    select.value = String(10 * 1000 * 1000)
+    select.dispatchEvent(new dom.window.Event('change', { bubbles: true }))
+    assert.match(dom.window.document.getElementById('btn-scan').textContent, /Apply & scan/)
+    assert.deepStrictEqual(actions, [], 'changing the selector alone does not start a scan')
+
+    dom.window.document.getElementById('btn-scan').click()
+    await new Promise((resolve) => setTimeout(resolve, 25))
+    assert.deepStrictEqual(actions, [{
+      action: 'scan',
+      scope_id: null,
+      candidate_min_bytes: 10 * 1000 * 1000
+    }])
+    dom.window.close()
+  })
+
+  test('app header and Save space share decimal storage units', async () => {
+    const dom = new JSDOM('', { runScripts: 'dangerously' })
+    const formatter = await fs.promises.readFile(
+      path.resolve(__dirname, '..', 'server', 'public', 'storage-size.js'), 'utf8')
+    dom.window.eval(formatter)
+    assert.strictEqual(dom.window.PinokioFormatStorageSize(7.05e9), '7.05 GB')
+    assert.strictEqual(dom.window.PinokioFormatStorageSize(5.3e9), '5.3 GB')
+
+    const appView = await fs.promises.readFile(
+      path.resolve(__dirname, '..', 'server', 'views', 'app.ejs'), 'utf8')
+    assert.match(appView, /<script src="\/storage-size\.js"><\/script>/)
+    assert.match(appView, /PinokioFormatStorageSize\(res\.du\)/)
+    dom.window.close()
+  })
+
+  test('global Save space header explains current savings and keeps pending savings actionable', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const workspace = await ejs.renderFile(path.resolve(views, 'partials', 'vault_workspace.ejs'), { appMode: false })
+    const dom = new JSDOM(`<body data-vault-mode="global">${workspace}</body>`, {
+      url: 'http://localhost/vault', runScripts: 'dangerously'
+    })
+    const gb = 1024 ** 3
+    dom.window.fetch = async () => ({
+      ok: true,
+      json: async () => ({
+        enabled: true,
+        mode: 'link',
+        scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+        last_scan: { ts: Date.now(), bytes_total: 154.8 * gb, home_bytes_total: 154.8 * gb },
+        bytes_on_disk: 377 * gb,
+        bytes_without_sharing: 616.3 * gb,
+        saved_by_sharing: 239.3 * gb,
+        pending_bytes: 12.4 * gb,
+        reclaimable: 2048,
+        activity_error: null,
+        cloud_sync_warning: null,
+        sources: [{
+          id: 'pinokio', kind: 'pinokio', label: 'Pinokio', root: '/pinokio',
+          display_path: '/pinokio', parent_id: null, available: true, shareable: true
+        }],
+        blobs: [{ hash: 'c'.repeat(64), size: 2048, orphan: true, nlink: 1, names: [] }],
+        duplicates: [], excluded: [], events: [], undo_batches: []
+      })
+    })
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    assert.strictEqual(dom.window.document.querySelector('.vault-summary-value').textContent, '256.95 GB of disk space saved')
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-compare-label')].map((node) => node.firstChild.textContent.trim()), ['Before', 'After'])
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-compare-value')].map((node) => node.textContent), ['661.75 GB', '404.8 GB'])
+    assert.match(dom.window.document.querySelector('.vault-compare-fill.after').getAttribute('style'), /--vault-after-ratio:61\.17%/)
+    assert.strictEqual(dom.window.document.getElementById('vault-before-help').textContent, 'Estimated space if every app stored its own copy.')
+    assert.strictEqual(dom.window.document.querySelector('.vault-compare-info').tagName, 'BUTTON')
+    assert.match(dom.window.document.querySelector('.vault-summary-side').textContent, /13\.31 GB more can be saved/)
+    assert.strictEqual(dom.window.document.getElementById('btn-review-metric').textContent, 'Review files')
+    assert.strictEqual(dom.window.document.getElementById('btn-review-metric').classList.contains('primary'), true)
+    assert.strictEqual(dom.window.document.getElementById('btn-review-metric').classList.contains('review-primary'), true)
+    assert.strictEqual(dom.window.document.getElementById('btn-scan').classList.contains('primary'), false)
+    assert.match(dom.window.document.getElementById('vault-storage-details').textContent, /Pinokio folder\s*166\.22 GB/)
+    assert.doesNotMatch(dom.window.document.getElementById('vault-storage-details').textContent, /Saved by your actions/)
+    const unusedView = dom.window.document.querySelector('[data-view="reclaimable"]')
+    assert.strictEqual(unusedView.querySelector('.vault-nav-name').textContent, 'Unused files')
+    unusedView.click()
+    assert.strictEqual(dom.window.document.getElementById('btn-reclaim-all').textContent, 'Delete all')
+    assert.strictEqual(dom.window.document.querySelector('[data-reclaim]').textContent, 'Delete')
+    assert.match(dom.window.document.getElementById('vault-pane-footer').textContent, /Deleting them frees disk space/)
+    dom.window.close()
+  })
+
+  test('undo sharing explains each safe refusal instead of showing a generic failure', async () => {
+    const source = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'vault.js'), 'utf8')
+    assert.match(source, /const detachFeedback = \(result\) =>/)
+    assert.match(source, /result\.status === "detached"\) return COPY\.sharing_undone/)
+    assert.match(source, /locked:\s*COPY\.separate_locked/)
+    assert.match(source, /stale:\s*COPY\.separate_changed/)
+    assert.match(source, /conflict:\s*COPY\.separate_conflict/)
+    assert.match(source, /"not-found":\s*COPY\.separate_not_found/)
+    assert.match(source, /action: "detach", path: target\.dataset\.detach[\s\S]*?detachFeedback[\s\S]*?filePath: sharingSwitch/)
+  })
+
+  test('inventory puts sharing switches in status and keeps duplicate Skip inline', async () => {
+    const source = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'public', 'vault.js'), 'utf8')
+    assert.match(source, /const duplicateAction = \(item\) => \{[\s\S]*?data-skip[\s\S]*?COPY\.skip/)
+    assert.match(source, /action: "skip", path: target\.dataset\.skip/)
+    assert.match(source, /item\.status === "shared"[\s\S]*?role="switch" aria-checked="true"[\s\S]*?data-detach/)
+    assert.match(source, /item\.status === "independent"[\s\S]*?role="switch" aria-checked="false"[\s\S]*?data-reshare/)
+    assert.match(source, /class="vault-status-cell"/)
+    assert.doesNotMatch(source, /separate:\s*"Separate"/)
+    assert.doesNotMatch(source, /include_in_scans:\s*"Include in scans"/)
+    assert.match(source, /headers = \[COPY\.name, COPY\.size, COPY\.status\]/)
+    assert.match(source, /headers = \[COPY\.name, COPY\.size, COPY\.matches, COPY\.can_save, ""\]/)
+    assert.match(source, /headers = \[COPY\.name, COPY\.size, COPY\.can_free, ""\]/)
+    assert.match(source, /headers = \[COPY\.name, COPY\.size, COPY\.last_scanned, ""\]/)
+    assert.match(source, /reclaimable:\s*"Unused files"/)
+    assert.match(source, /reclaim:\s*"Delete"/)
+    assert.match(source, /reclaim_all:\s*"Delete all"/)
+    assert.match(source, /data-sort-size/)
+    assert.match(source, /data-display-mode="folders"/)
+    assert.match(source, /data-display-mode="files"/)
+    assert.match(source, /headers = \[COPY\.name, COPY\.location_column, COPY\.size, COPY\.status\]/)
+    assert.match(source, /aria-sort="\$\{state\.sizeSort === "desc" \? "descending" : state\.sizeSort === "asc" \? "ascending" : "none"\}"/)
+  })
+
+  test('app inventory renders real sharing switches without empty columns', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, { url: 'http://localhost/vault/app/appB', runScripts: 'dangerously' })
+    const actions = []
+    const status = {
+      enabled: true,
+      mode: 'link',
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 2048 },
+      bytes_on_disk: 1536,
+      pending_bytes: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [{
+        id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+        display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+      }],
+      blobs: [{
+        hash: 'a'.repeat(64), size: 1024, orphan: false, nlink: 3,
+        names: [
+          { path: '/pinokio/api/appB/shared.bin', relative_path: 'shared.bin', source_id: 'app:appB', source_label: 'appB', mode: 'link' },
+          { path: '/pinokio/api/appA/shared.bin', relative_path: 'shared.bin', source_id: 'app:appA', source_label: 'appA', mode: 'link' }
+        ]
+      }],
+      duplicates: [],
+      excluded: [{
+        path: '/pinokio/api/appB/own.bin', relative_path: 'own.bin',
+        source_id: 'app:appB', source_label: 'appB', size: 1024
+      }],
+      events: [], undo_batches: []
+    }
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        const action = JSON.parse(options.body)
+        actions.push(action)
+        return { ok: true, json: async () => action.action === 'reshare' ? { status: 'resharable' } : { status: 'detached' } }
+      }
+      return { ok: true, json: async () => status }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-table.inventory .vault-columns span')]
+      .map((node) => node.textContent), ['Name', 'Size', 'Sharing status'])
+    assert.strictEqual(dom.window.document.querySelector('.vault-table.inventory .vault-space'), null)
+    assert.strictEqual(dom.window.document.querySelector('.vault-table.inventory .vault-row-action'), null)
+    const on = dom.window.document.querySelector('.vault-sharing-switch[aria-checked="true"]')
+    const off = dom.window.document.querySelector('.vault-sharing-switch[aria-checked="false"]')
+    assert.ok(on && on.classList.contains('on'))
+    assert.ok(off && !off.classList.contains('on'))
+    assert.strictEqual(on.getAttribute('role'), 'switch')
+    assert.strictEqual(on.getAttribute('aria-label'), 'Undo sharing for shared.bin')
+    assert.strictEqual(off.getAttribute('aria-label'), 'Allow own.bin to share storage')
+    assert.match(off.closest('.vault-status-cell').textContent, /Kept separate/)
+
+    on.click()
+    await new Promise((resolve) => setTimeout(resolve, 25))
+    dom.window.document.querySelector('.vault-sharing-switch[aria-checked="false"]').click()
+    await new Promise((resolve) => setTimeout(resolve, 25))
+    assert.deepStrictEqual(actions, [
+      { action: 'detach', path: '/pinokio/api/appB/shared.bin' },
+      { action: 'reshare', path: '/pinokio/api/appB/own.bin' }
+    ])
+    dom.window.close()
+  })
+
+  test('turning sharing off queues immediately, then shows determinate row progress', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, {
+      url: 'http://localhost/vault/app/appB', runScripts: 'dangerously'
+    })
+    const sharedPath = '/pinokio/api/appB/shared.bin'
+    const status = {
+      enabled: true,
+      mode: 'link',
+      candidate_min_bytes: 100000000,
+      candidate_size_options: [100000000],
+      file_action: null,
+      action_sequence: 0,
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 2048, candidate_min_bytes: 100000000 },
+      bytes_on_disk: 512,
+      pending_bytes: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [{
+        id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+        display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+      }],
+      blobs: [{
+        hash: 'a'.repeat(64), size: 1024, orphan: false, nlink: 3,
+        names: [
+          {
+            path: sharedPath, relative_path: 'shared.bin',
+            source_id: 'app:appB', source_label: 'appB', mode: 'link'
+          },
+          {
+            path: '/pinokio/api/appA/shared.bin', relative_path: 'shared.bin',
+            source_id: 'app:appA', source_label: 'appA', mode: 'link'
+          }
+        ]
+      }],
+      duplicates: [], excluded: [], events: [], undo_batches: []
+    }
+    let finishDetach
+    let finishStaleProgress
+    const detachGate = new Promise((resolve) => { finishDetach = resolve })
+    const staleProgressGate = new Promise((resolve) => { finishStaleProgress = resolve })
+    let detachFinished = false
+    let progressReads = 0
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        await detachGate
+        detachFinished = true
+        return { ok: true, json: async () => ({ status: 'detached' }) }
+      }
+      if (String(url).includes('progress=1')) {
+        progressReads += 1
+        if (progressReads === 2) await staleProgressGate
+        return {
+          ok: true,
+          json: async () => ({
+            enabled: true,
+            action_sequence: 1,
+            file_action: {
+              kind: 'detach',
+              path: sharedPath,
+              source_id: 'app:appB',
+              bytes_copied: 512,
+              bytes_total: 1024
+            },
+            scan: status.scan,
+            last_scan: status.last_scan
+          })
+        }
+      }
+      return {
+        ok: true,
+        json: async () => Object.assign({}, status, {
+          action_sequence: detachFinished ? 2 : 0,
+          file_action: null,
+          file_actions: []
+        })
+      }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    dom.window.document.querySelector('.vault-sharing-switch[aria-checked="true"]').click()
+    assert.match(dom.window.document.querySelector('.vault-file-action-queued').textContent,
+      /Queued to undo/)
+    const queuedRow = dom.window.document.querySelector(`[data-file-path="${sharedPath}"]`)
+
+    await new Promise((resolve) => setTimeout(resolve, 240))
+    let progress = dom.window.document.querySelector('.vault-file-action-track')
+    assert.strictEqual(dom.window.document.querySelector(`[data-file-path="${sharedPath}"]`), queuedRow,
+      'progress polling updates the action cell without rebuilding the row')
+    assert.strictEqual(progress.getAttribute('aria-valuenow'), '512')
+    assert.strictEqual(progress.getAttribute('aria-valuemax'), '1024')
+    assert.match(progress.closest('.vault-file-action-progress').textContent, /512 B of 1\.02 KB/)
+
+    finishDetach()
+    await new Promise((resolve) => setTimeout(resolve, 30))
+    finishStaleProgress()
+    await new Promise((resolve) => setTimeout(resolve, 30))
+    assert.strictEqual(dom.window.document.querySelector('.vault-file-action-track'), null)
+    dom.window.close()
+  })
+
+  test('multiple sharing switches keep queued feedback while copies run serially', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, {
+      url: 'http://localhost/vault/app/appB', runScripts: 'dangerously'
+    })
+    const firstPath = '/pinokio/api/appB/first.bin'
+    const secondPath = '/pinokio/api/appB/second.bin'
+    const status = {
+      enabled: true,
+      mode: 'link',
+      candidate_min_bytes: 100000000,
+      candidate_size_options: [100000000],
+      file_action: null,
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 4096, candidate_min_bytes: 100000000 },
+      bytes_on_disk: 1024,
+      pending_bytes: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [{
+        id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+        display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+      }],
+      blobs: [
+        {
+          hash: 'a'.repeat(64), size: 1024, orphan: false, nlink: 3,
+          names: [
+            {
+              path: firstPath, relative_path: 'first.bin',
+              source_id: 'app:appB', source_label: 'appB', mode: 'link'
+            },
+            {
+              path: '/pinokio/api/appA/first.bin', relative_path: 'first.bin',
+              source_id: 'app:appA', source_label: 'appA', mode: 'link'
+            }
+          ]
+        },
+        {
+          hash: 'b'.repeat(64), size: 1024, orphan: false, nlink: 3,
+          names: [
+            {
+              path: secondPath, relative_path: 'second.bin',
+              source_id: 'app:appB', source_label: 'appB', mode: 'link'
+            },
+            {
+              path: '/pinokio/api/appA/second.bin', relative_path: 'second.bin',
+              source_id: 'app:appA', source_label: 'appA', mode: 'link'
+            }
+          ]
+        }
+      ],
+      duplicates: [], excluded: [], events: [], undo_batches: []
+    }
+    let finishFirst
+    let finishSecond
+    let finishStaleRefresh
+    let markFirstDone
+    const firstGate = new Promise((resolve) => { finishFirst = resolve })
+    const secondGate = new Promise((resolve) => { finishSecond = resolve })
+    const staleRefreshGate = new Promise((resolve) => { finishStaleRefresh = resolve })
+    const firstDone = new Promise((resolve) => { markFirstDone = resolve })
+    let activePath = null
+    let fullReads = 0
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        const action = JSON.parse(options.body)
+        if (action.path === firstPath) {
+          activePath = firstPath
+          await firstGate
+          activePath = null
+          markFirstDone()
+        } else {
+          await firstDone
+          activePath = secondPath
+          await secondGate
+          activePath = null
+        }
+        return { ok: true, json: async () => ({ status: 'detached' }) }
+      }
+      if (String(url).includes('progress=1')) {
+        return {
+          ok: true,
+          json: async () => ({
+            enabled: true,
+            file_action: activePath
+              ? {
+                  kind: 'detach',
+                  path: activePath,
+                  source_id: 'app:appB',
+                  bytes_copied: 512,
+                  bytes_total: 1024
+                }
+              : null,
+            scan: status.scan,
+            last_scan: status.last_scan
+          })
+        }
+      }
+      const read = ++fullReads
+      if (read === 2) await staleRefreshGate
+      const currentStatus = read >= 3
+        ? Object.assign({}, status, {
+            bytes_on_disk: 4096,
+            pending_bytes: 2048
+          })
+        : status
+      return {
+        ok: true,
+        json: async () => Object.assign({}, currentStatus, {
+          file_action: activePath
+            ? {
+                kind: 'detach',
+                path: activePath,
+                source_id: 'app:appB',
+                bytes_copied: 512,
+                bytes_total: 1024
+              }
+            : null
+        })
+      }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    try {
+      const switchFor = (filePath) => [...dom.window.document.querySelectorAll('.vault-sharing-switch')]
+        .find((button) => button.dataset.detach === filePath)
+      switchFor(firstPath).click()
+      switchFor(secondPath).click()
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-queued').length, 2)
+
+      await new Promise((resolve) => setTimeout(resolve, 240))
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-progress').length, 1)
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-queued').length, 1)
+
+      finishFirst()
+      await new Promise((resolve) => setTimeout(resolve, 240))
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-progress').length, 1)
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-queued').length, 1)
+
+      finishSecond()
+      await new Promise((resolve) => setTimeout(resolve, 30))
+      assert.strictEqual(dom.window.document.querySelector('.vault-summary-value').textContent,
+        'No disk space is currently being saved')
+      assert.match(dom.window.document.querySelector('.vault-summary-side').textContent,
+        /2\.05 KB available to save/)
+
+      finishStaleRefresh()
+      await new Promise((resolve) => setTimeout(resolve, 30))
+      assert.strictEqual(dom.window.document.querySelector('.vault-summary-value').textContent,
+        'No disk space is currently being saved')
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-progress').length, 0)
+      assert.strictEqual(dom.window.document.querySelectorAll('.vault-file-action-queued').length, 0)
+    } finally {
+      finishFirst()
+      finishSecond()
+      finishStaleRefresh()
+      await new Promise((resolve) => setTimeout(resolve, 50))
+      dom.window.close()
+    }
+  })
+
+  test('Shared defaults to a globally size-sorted Files mode and can return to Folders', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, { url: 'http://localhost/vault/app/appB', runScripts: 'dangerously' })
+    const sharedBlob = (hash, size, name) => ({
+      hash, size, orphan: false, nlink: 3,
+      names: [
+        { path: `/pinokio/api/appB/${name}`, relative_path: name, source_id: 'app:appB', source_label: 'appB', mode: 'link' },
+        { path: `/pinokio/api/appA/${name}`, relative_path: name, source_id: 'app:appA', source_label: 'appA', mode: 'link' }
+      ]
+    })
+    const status = {
+      enabled: true,
+      mode: 'link',
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 5120 },
+      bytes_on_disk: 2560,
+      pending_bytes: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [{
+        id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+        display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+      }],
+      blobs: [
+        sharedBlob('a'.repeat(64), 1024, 'a-small/a-small.bin'),
+        sharedBlob('b'.repeat(64), 4096, 'z-large/z-large.bin')
+      ],
+      duplicates: [], excluded: [], events: [], undo_batches: []
+    }
+    dom.window.fetch = async () => ({ ok: true, json: async () => status })
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    dom.window.document.querySelector('[data-view="shared"]').click()
+    const names = () => [...dom.window.document.querySelectorAll('.vault-file-row:not(.directory) .vault-file-name')]
+      .map((node) => node.textContent)
+    const directories = () => [...dom.window.document.querySelectorAll('.vault-file-row.directory .vault-file-name')]
+      .map((node) => node.textContent)
+    const locations = () => [...dom.window.document.querySelectorAll('.vault-flat-location')]
+      .map((node) => node.textContent)
+    const sort = () => dom.window.document.querySelector('[data-sort-size]')
+    const mode = (name) => dom.window.document.querySelector(`[data-display-mode="${name}"]`)
+    assert.strictEqual(mode('files').getAttribute('aria-pressed'), 'true')
+    assert.strictEqual(mode('folders').getAttribute('aria-pressed'), 'false')
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-columns > span')]
+      .map((node) => node.textContent), ['Name', 'Location', 'Size', 'Sharing status'])
+    assert.deepStrictEqual(names(), ['z-large.bin', 'a-small.bin'])
+    assert.deepStrictEqual(directories(), [])
+    assert.match(locations()[0], /appB \/ z-large\/z-large\.bin/)
+    assert.match(locations()[1], /appB \/ a-small\/a-small\.bin/)
+    assert.strictEqual(sort().getAttribute('aria-label'), 'Sort by size, smallest first')
+    assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'descending')
+    assert.strictEqual(dom.window.document.getElementById('vault-pane-footer').textContent,
+      '2 shared files · sorted largest first')
+
+    sort().click()
+    assert.deepStrictEqual(names(), ['a-small.bin', 'z-large.bin'])
+    assert.strictEqual(sort().getAttribute('aria-label'), 'Sort by size, largest first')
+    assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'ascending')
+    assert.strictEqual(dom.window.document.getElementById('vault-pane-footer').textContent,
+      '2 shared files · sorted smallest first')
+
+    sort().click()
+    assert.deepStrictEqual(names(), ['z-large.bin', 'a-small.bin'])
+    assert.strictEqual(sort().getAttribute('aria-label'), 'Sort by size, smallest first')
+    assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'descending')
+
+    mode('folders').click()
+    assert.strictEqual(mode('folders').getAttribute('aria-pressed'), 'true')
+    assert.strictEqual(mode('files').getAttribute('aria-pressed'), 'false')
+    assert.deepStrictEqual([...dom.window.document.querySelectorAll('.vault-columns > span')]
+      .map((node) => node.textContent), ['Name', 'Size', 'Sharing status'])
+    assert.deepStrictEqual(directories(), ['a-small', 'z-large'])
+    assert.strictEqual(sort(), null)
+
+    mode('files').click()
+    assert.deepStrictEqual(names(), ['z-large.bin', 'a-small.bin'])
+    assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'descending')
+    dom.window.close()
+  })
+
+  test('Duplicates uses one two-state Size control for groups and their files', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const workspace = await ejs.renderFile(
+      path.resolve(views, 'partials', 'vault_workspace.ejs'),
+      { appMode: false }
+    )
+    const dom = new JSDOM(`<body data-vault-mode="global">${workspace}</body>`, {
+      url: 'http://localhost/vault',
+      runScripts: 'dangerously'
+    })
+    const duplicate = (sourceId, name, size) => ({
+      path: `/pinokio/api/${sourceId.slice(4)}/${name}`,
+      relative_path: name,
+      source_id: sourceId,
+      source_label: sourceId.slice(4),
+      size,
+      shareable: true,
+      match: { path: `/pinokio/cache/${name}` }
+    })
+    const status = {
+      enabled: true,
+      mode: 'link',
+      candidate_min_bytes: 100 * 1000 * 1000,
+      candidate_size_options: [100 * 1000 * 1000],
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 1400, home_bytes_total: 1400 },
+      last_attempt: null,
+      bytes_without_sharing: 1400,
+      bytes_on_disk: 1400,
+      saved_by_sharing: 0,
+      pending_bytes: 1400,
+      reclaimable: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [
+        { id: 'pinokio', kind: 'pinokio', label: 'Pinokio', root: '/pinokio', parent_id: null, available: true, shareable: true },
+        { id: 'apps', kind: 'virtual', label: 'Apps', root: '/pinokio/api', parent_id: 'pinokio', available: true, shareable: null },
+        { id: 'app:appA', kind: 'app', label: 'appA', root: '/pinokio/api/appA', parent_id: 'apps', available: true, shareable: true },
+        { id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB', parent_id: 'apps', available: true, shareable: true }
+      ],
+      blobs: [],
+      duplicates: [
+        duplicate('app:appA', 'a-small.bin', 100),
+        duplicate('app:appA', 'a-large.bin', 300),
+        duplicate('app:appB', 'b-largest.bin', 1000)
+      ],
+      excluded: [],
+      events: [],
+      undo_batches: [],
+      file_action: null,
+      file_actions: [],
+      action_sequence: 0
+    }
+    let finishDeduplicateAll
+    const deduplicateAllGate = new Promise((resolve) => { finishDeduplicateAll = resolve })
+    let deduplicateAllFinished = false
+    let submittedAction = null
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        submittedAction = JSON.parse(options.body)
+        await deduplicateAllGate
+        deduplicateAllFinished = true
+        status.duplicates = []
+        status.pending_bytes = 0
+        return { ok: true, json: async () => ({ converted: 3, bytes_saved: 1400 }) }
+      }
+      if (String(url).includes('progress=1')) {
+        const action = deduplicateAllFinished ? null : {
+          id: 'action-all',
+          kind: 'deduplicate_all',
+          phase: 'deduplicating',
+          path: null,
+          source_id: null,
+          bytes_copied: 0,
+          bytes_total: 0,
+          files_completed: 2,
+          files_total: 3
+        }
+        return {
+          ok: true,
+          json: async () => ({
+            enabled: true,
+            action_sequence: deduplicateAllFinished ? 2 : 1,
+            file_action: action,
+            file_actions: action ? [action] : [],
+            scan: status.scan,
+            last_scan: status.last_scan
+          })
+        }
+      }
+      return {
+        ok: true,
+        json: async () => Object.assign({}, status, {
+          action_sequence: deduplicateAllFinished ? 2 : 0,
+          file_action: null,
+          file_actions: []
+        })
+      }
+    }
+    await runVaultScript(dom)
+    await new Promise((resolve) => setTimeout(resolve, 25))
+
+    try {
+      dom.window.document.querySelector('[data-view="duplicates"]').click()
+      const groupNames = () => [...dom.window.document.querySelectorAll('.vault-group-title span')]
+        .map((node) => node.textContent)
+      const fileNames = () => [...dom.window.document.querySelectorAll('.vault-file-row .vault-file-name')]
+        .map((node) => node.textContent)
+      const sort = () => dom.window.document.querySelector('[data-sort-size]')
+
+      assert.deepStrictEqual(groupNames(), ['Pinokio / Apps / appB', 'Pinokio / Apps / appA'])
+      assert.deepStrictEqual(fileNames(), ['b-largest.bin', 'a-large.bin', 'a-small.bin'])
+      assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'descending')
+
+      sort().click()
+      assert.deepStrictEqual(groupNames(), ['Pinokio / Apps / appA', 'Pinokio / Apps / appB'])
+      assert.deepStrictEqual(fileNames(), ['a-small.bin', 'a-large.bin', 'b-largest.bin'])
+      assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'ascending')
+
+      sort().click()
+      assert.deepStrictEqual(groupNames(), ['Pinokio / Apps / appB', 'Pinokio / Apps / appA'])
+      assert.strictEqual(sort().parentElement.getAttribute('aria-sort'), 'descending')
+
+      const search = dom.window.document.getElementById('vault-search')
+      search.value = 'a-small'
+      search.dispatchEvent(new dom.window.Event('input', { bubbles: true }))
+      assert.match(dom.window.document.getElementById('btn-deduplicate-all').textContent, /Deduplicate all 1 file/)
+      search.value = 'missing'
+      search.dispatchEvent(new dom.window.Event('input', { bubbles: true }))
+      assert.strictEqual(dom.window.document.querySelector('[data-deduplicate-all-action]'), null)
+      search.value = ''
+      search.dispatchEvent(new dom.window.Event('input', { bubbles: true }))
+
+      const all = dom.window.document.getElementById('btn-deduplicate-all')
+      assert.match(all.textContent, /Deduplicate all 3 files/)
+      all.click()
+      assert.match(dom.window.document.querySelector('[data-deduplicate-all-action]').textContent, /Queued/)
+      assert.ok([...dom.window.document.querySelectorAll('[data-deduplicate-scope]')]
+        .every((button) => button.disabled))
+
+      await new Promise((resolve) => setTimeout(resolve, 240))
+      const progress = dom.window.document.querySelector('[data-deduplicate-all-action] .vault-deduplicate-progress')
+      assert.match(progress.closest('button').textContent, /Deduplicating 2 of 3/)
+      assert.strictEqual(progress.getAttribute('aria-valuenow'), '2')
+      assert.deepStrictEqual(submittedAction, {
+        action: 'deduplicate_all',
+        groups: [
+          {
+            scope_id: 'app:appA',
+            paths: ['/pinokio/api/appA/a-small.bin', '/pinokio/api/appA/a-large.bin']
+          },
+          {
+            scope_id: 'app:appB',
+            paths: ['/pinokio/api/appB/b-largest.bin']
+          }
+        ]
+      })
+    } finally {
+      finishDeduplicateAll()
+      await new Promise((resolve) => setTimeout(resolve, 50))
+      dom.window.close()
+    }
+  })
+
+  test('Deduplicate shows queued state and exact group progress without rebuilding the explorer', async () => {
+    const views = path.resolve(__dirname, '..', 'server', 'views')
+    const html = await ejs.renderFile(path.resolve(views, 'vault_app.ejs'), {
+      theme: 'light', agent: 'electron', scope_id: 'app:appB'
+    })
+    const dom = new JSDOM(html, {
+      url: 'http://localhost/vault/app/appB',
+      runScripts: 'dangerously'
+    })
+    const duplicate = (name) => ({
+      path: `/pinokio/api/appB/${name}`,
+      relative_path: name,
+      source_id: 'app:appB',
+      source_label: 'appB',
+      size: 1024,
+      shareable: true,
+      match: { path: `/pinokio/api/appA/${name}` }
+    })
+    const status = {
+      enabled: true,
+      mode: 'link',
+      candidate_min_bytes: 100000000,
+      candidate_size_options: [100000000],
+      scan: { active: false, pending: false, queued: 0, phase: 'idle', scope_id: null },
+      last_scan: { ts: Date.now(), bytes_total: 2048, candidate_min_bytes: 100000000 },
+      last_attempt: null,
+      bytes_without_sharing: 2048,
+      bytes_on_disk: 2048,
+      saved_by_sharing: 0,
+      pending_bytes: 2048,
+      reclaimable: 0,
+      activity_error: null,
+      cloud_sync_warning: null,
+      sources: [{
+        id: 'app:appB', kind: 'app', label: 'appB', root: '/pinokio/api/appB',
+        display_path: '/pinokio/api/appB', parent_id: null, available: true, shareable: true
+      }],
+      blobs: [],
+      duplicates: [duplicate('first.bin'), duplicate('second.bin')],
+      excluded: [],
+      events: [],
+      undo_batches: [],
+      file_action: null,
+      file_actions: [],
+      action_sequence: 0
+    }
+    let finishDeduplicate
+    const deduplicateGate = new Promise((resolve) => { finishDeduplicate = resolve })
+    let finished = false
+    dom.window.fetch = async (url, options = {}) => {
+      if (options.method === 'POST') {
+        await deduplicateGate
+        finished = true
+        status.duplicates = []
+        status.pending_bytes = 0
+        return {
+          ok: true,
+          json: async () => ({ converted: 2, bytes_saved: 2048 })
+        }
+      }
+      if (String(url).includes('progress=1')) {
+        return {
+          ok: true,
+          json: async () => ({
+            enabled: true,
+            action_sequence: finished ? 2 : 1,
+            file_action: finished ? null : {
+              id: 'action-1',
+              kind: 'deduplicate',
+              phase: 'deduplicating',
+              path: null,
+              source_id: 'app:appB',
+              bytes_copied: 0,
+              bytes_total: 0,
+              files_completed: 1,
+              files_total: 2
+            },
+            file_actions: finished ? [] : [{
+              id: 'action-1',
+              kind: 'deduplicate',
+              phase: 'deduplicating',
+              path: null,
+              source_id: 'app:appB',
+              bytes_copied: 0,
+              bytes_total: 0,
+              files_completed: 1,
+              files_total: 2
+            }],
+            scan: status.scan,
+            last_scan: status.last_scan
+          })
+        }
+      }
+      return {
+        ok: true,
+        json: async () => Object.assign({}, status, {
+          action_sequence: finished ? 2 : 0,
+          file_action: null,
+          file_actions: []
+        })
+      }
+    }
+
+    try {
+      await runVaultScript(dom)
+      await new Promise((resolve) => setTimeout(resolve, 25))
+      dom.window.document.querySelector('[data-view="duplicates"]').click()
+      assert.strictEqual(dom.window.document.getElementById('btn-deduplicate-all'), null)
+      const group = dom.window.document.querySelector('[data-deduplicate-action-scope="app:appB"]')
+      const row = dom.window.document.querySelector('[data-file-path="/pinokio/api/appB/first.bin"]')
+
+      group.querySelector('[data-deduplicate-scope]').click()
+      assert.match(group.textContent, /Queued/)
+
+      await new Promise((resolve) => setTimeout(resolve, 240))
+      const progress = group.querySelector('.vault-deduplicate-progress')
+      assert.strictEqual(
+        dom.window.document.querySelector('[data-file-path="/pinokio/api/appB/first.bin"]'),
+        row,
+        'progress polling updates only the group action'
+      )
+      assert.match(group.textContent, /Deduplicating 1 of 2/)
+      assert.strictEqual(progress.getAttribute('aria-valuenow'), '1')
+      assert.strictEqual(progress.getAttribute('aria-valuemax'), '2')
+    } finally {
+      finishDeduplicate()
+      await new Promise((resolve) => setTimeout(resolve, 50))
+      dom.window.close()
+    }
+  })
+
   test('vault route provisions the dev requirements needed by its folder picker', async () => {
     const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
     const routeStart = serverSource.indexOf('this.app.get("/vault"')
@@ -240,6 +2211,113 @@ describe('vault dashboard backend (phase 4)', () => {
     assert.ok(route.indexOf('res.redirect') < route.indexOf('res.render("vault"'), 'requirements redirect must happen before rendering Vault')
   })
 
+  test('disabled Vault routes return no data and the sidebar entry can be hidden', async () => {
+    const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
+    const kernelSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'kernel', 'index.js'), 'utf8')
+    const sidebar = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'views', 'partials', 'main_sidebar.ejs'), 'utf8')
+    const infoRoute = serverSource.slice(serverSource.indexOf('this.app.get("/info/dedup"'), serverSource.indexOf('this.app.get("/vault"'))
+    const pageRoute = serverSource.slice(serverSource.indexOf('this.app.get("/vault"'), serverSource.indexOf('this.app.post("/vault/action"'))
+    const actionRoute = serverSource.slice(serverSource.indexOf('this.app.post("/vault/action"'), serverSource.indexOf('this.app.get("/info/scripts"'))
+    assert.match(infoRoute, /res\.sendStatus\(404\)/)
+    assert.match(pageRoute, /res\.sendStatus\(404\)/)
+    assert.match(actionRoute, /res\.sendStatus\(404\)/)
+    assert.match(infoRoute, /isSameOriginRequest/)
+    assert.match(actionRoute, /isSameOriginRequest/)
+    assert.match(sidebar, /vaultEnabled/)
+    assert.match(sidebar, /fa-solid fa-hard-drive[^\n]*<div class='caption'>Save space<\/div>/)
+    assert.doesNotMatch(sidebar, /<div class='caption'>Vault<\/div>/)
+    assert.ok(sidebar.indexOf("<div class='caption'>Save space</div>") < sidebar.indexOf("<div class='caption'>Checkpoints</div>"))
+    assert.doesNotMatch(kernelSource, /catch\(\(err\) => \{\s*this\.vault\.enabled = false/)
+  })
+
+  test('dashboard actions delegate to the engine and deduplication requires a scope', async () => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const original = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
+    const pending = await writeFile(path.resolve(home, 'api', 'appB', 'model.bin'), content)
+    await vault.adopt(original, hash, { app: 'appA' })
+    vault.registry.duplicates.set(pending, { hash, size: content.length, app: 'appB' })
+
+    const result = await vault.perform('deduplicate', {})
+
+    assert.match(result.error, /location/i)
+    assert.strictEqual((await fs.promises.stat(pending)).nlink, 1)
+    const serverSource = await fs.promises.readFile(path.resolve(__dirname, '..', 'server', 'index.js'), 'utf8')
+    const actionRoute = serverSource.slice(serverSource.indexOf('this.app.post("/vault/action"'), serverSource.indexOf('this.app.get("/info/scripts"'))
+    assert.match(actionRoute, /vault\.perform\(body\.action, body\)/)
+    assert.doesNotMatch(actionRoute, /convertPending|runExclusive/)
+  })
+
+  test('a stale external source id cannot authorize files outside its configured root', async () => {
+    const { home, vault } = await makeEnv()
+    const firstTarget = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-scope-old-'))
+    const secondTarget = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-scope-new-'))
+    homes.push(firstTarget, secondTarget)
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const original = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
+    const outside = await writeFile(path.resolve(firstTarget, 'model.bin'), content)
+    const externalSource = (await vault.addExternalSource(firstTarget)).source
+    const originalSource = vault.sources().find((source) => source.kind === 'app' && source.app === 'appA')
+    await vault.adopt(original, hash, { app: 'appA', source_id: originalSource.id })
+    const outsideStat = await fs.promises.stat(outside)
+    vault.registry.duplicates.set(outside, {
+      hash, size: content.length, source_id: externalSource.id,
+      dev: outsideStat.dev, ino: outsideStat.ino,
+      mtime: outsideStat.mtimeMs, ctime: outsideStat.ctimeMs
+    })
+    vault.registry.settings.external_sources = [await fs.promises.realpath(secondTarget)]
+    await vault.refreshSources()
+
+    const result = await vault.perform('deduplicate', { scope_id: externalSource.id })
+
+    assert.match(result.error, /no longer available/i)
+    assert.strictEqual((await fs.promises.stat(outside)).nlink, 1)
+    assert.ok(vault.registry.duplicates.has(outside))
+  })
+
+  test('deduplication rejects a lexically in-scope path that now resolves outside its app', async (t) => {
+    const { home, vault } = await makeEnv()
+    const content = crypto.randomBytes(4096)
+    const original = await writeFile(path.resolve(home, 'api', 'appA', 'model.bin'), content)
+    const appDirectory = path.resolve(home, 'api', 'appB', 'models')
+    const pending = await writeFile(path.resolve(appDirectory, 'model.bin'), content)
+    await vault.sweeper.scan()
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    assert.ok(vault.registry.duplicates.has(pending))
+
+    const relocated = path.resolve(home, 'relocated-models')
+    await fs.promises.rename(appDirectory, relocated)
+    try {
+      await fs.promises.symlink(relocated, appDirectory, process.platform === 'win32' ? 'junction' : 'dir')
+    } catch (error) {
+      t.skip(`directory links unavailable: ${error.message}`)
+      return
+    }
+
+    const result = await vault.deduplicateScope(appB.id, { batch_id: 'canonical-boundary' })
+    assert.strictEqual(result.converted, 0)
+    assert.strictEqual(result.stale, 1)
+    assert.strictEqual((await fs.promises.stat(pending)).nlink, 1)
+    assert.notStrictEqual((await fs.promises.stat(pending)).ino, (await fs.promises.stat(original)).ino)
+    assert.ok(vault.registry.duplicates.has(pending))
+  })
+
+  test('known cloud-synced homes get a dismissible dashboard warning', async () => {
+    const kernel = {
+      homedir: path.resolve(path.sep, 'Users', 'person', 'Library', 'Mobile Documents', 'com~apple~CloudDocs', 'pinokio'),
+      platform: process.platform,
+      path: (...parts) => path.resolve(path.sep, ...parts)
+    }
+    const vault = new Vault(kernel)
+    assert.strictEqual(vault.cloudSyncProvider(), 'iCloud Drive')
+    const vaultPage = await vaultPageSource()
+    assert.match(vaultPage, /cloud_sync_warning/)
+    assert.match(vaultPage, /btn-dismiss-cloud/)
+    assert.match(vaultPage, /localStorage\.setItem/)
+  })
+
   test('deduplicate batches share a batch id and are undoable as one', async () => {
     const { home, vault } = await makeEnv()
     const c1 = crypto.randomBytes(4096)
@@ -250,10 +2328,12 @@ describe('vault dashboard backend (phase 4)', () => {
     await vault.adopt(a2, sha256(c2), { app: 'appA' })
     const b1 = await writeFile(path.resolve(home, 'api', 'appB', 'm1.bin'), c1)
     const b2 = await writeFile(path.resolve(home, 'api', 'appB', 'm2.bin'), c2)
-    vault.registry.duplicates.set(b1, { hash: sha256(c1), size: c1.length, app: 'appB' })
-    vault.registry.duplicates.set(b2, { hash: sha256(c2), size: c2.length, app: 'appB' })
+    await vault.refreshSources()
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    vault.registry.duplicates.set(b1, await duplicateEntry(b1, { hash: sha256(c1), size: c1.length, app: 'appB', source_id: appB.id }))
+    vault.registry.duplicates.set(b2, await duplicateEntry(b2, { hash: sha256(c2), size: c2.length, app: 'appB', source_id: appB.id }))
 
-    const summary = await vault.sweeper.convertPending('appB', { batch_id: 'batch-x' })
+    const summary = await vault.deduplicateScope(appB.id, { batch_id: 'batch-x' })
     assert.strictEqual(summary.converted, 2)
     assert.strictEqual(summary.bytes_saved, c1.length + c2.length)
 
@@ -275,10 +2355,10 @@ describe('vault dashboard backend (phase 4)', () => {
     const appB = vault.sources().find((item) => item.kind === 'app' && item.app === 'appB')
     const cache = vault.sources().find((item) => item.kind === 'folder' && item.label === 'cache')
     await vault.adopt(original, hash, { app: 'appA', source_id: appA.id })
-    vault.registry.duplicates.set(appCopy, { hash, size: content.length, app: 'appB', source_id: appB.id })
-    vault.registry.duplicates.set(cacheCopy, { hash, size: content.length, app: null, source_id: cache.id })
+    vault.registry.duplicates.set(appCopy, await duplicateEntry(appCopy, { hash, size: content.length, app: 'appB', source_id: appB.id }))
+    vault.registry.duplicates.set(cacheCopy, await duplicateEntry(cacheCopy, { hash, size: content.length, app: null, source_id: cache.id }))
 
-    const result = await vault.sweeper.convertPending(undefined, { scope_id: appB.id, batch_id: 'scope-app-b' })
+    const result = await vault.deduplicateScope(appB.id, { batch_id: 'scope-app-b' })
     assert.strictEqual(result.converted, 1)
     assert.strictEqual((await fs.promises.stat(appCopy)).ino, (await fs.promises.stat(original)).ino)
     assert.strictEqual((await fs.promises.stat(cacheCopy)).nlink, 1)
@@ -292,33 +2372,72 @@ describe('vault dashboard backend (phase 4)', () => {
     const original = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
     const pending = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
     await vault.adopt(original, hash, { app: 'appA' })
-    vault.registry.duplicates.set(pending, { hash, size: content.length, app: 'appB' })
+    await vault.refreshSources()
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    vault.registry.duplicates.set(pending, await duplicateEntry(pending, { hash, size: content.length, app: 'appB', source_id: appB.id }))
     const realConvert = vault.convert.bind(vault)
     vault.convert = async () => ({ status: 'unavailable' })
-    const result = await vault.sweeper.convertPending('appB')
+    const result = await vault.deduplicateScope(appB.id)
     vault.convert = realConvert
     assert.strictEqual(result.unavailable, 1)
     assert.ok(vault.registry.duplicates.has(pending))
     assert.strictEqual(vault.registry.links.has(pending), false)
   })
 
-  test('status separates app, Pinokio folder, and external source metadata', async (t) => {
+  test('deduplication rechecks a running app immediately before replacement', async () => {
     const { home, vault } = await makeEnv()
-    const external = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-ui-external-'))
-    homes.push(external)
+    const content = crypto.randomBytes(4096)
+    const hash = sha256(content)
+    const original = await writeFile(path.resolve(home, 'api', 'appA', 'm.bin'), content)
+    const pending = await writeFile(path.resolve(home, 'api', 'appB', 'm.bin'), content)
+    await vault.refreshSources()
+    const appA = vault.sources().find((source) => source.kind === 'app' && source.app === 'appA')
+    const appB = vault.sources().find((source) => source.kind === 'app' && source.app === 'appB')
+    await vault.adopt(original, hash, { app: 'appA', source_id: appA.id })
+    const pendingEntry = await duplicateEntry(pending, {
+      hash, size: content.length, app: 'appB', source_id: appB.id
+    })
+    vault.registry.setDuplicate(pending, pendingEntry)
+    vault.registry.scanIndex.set(pending, Object.assign({}, pendingEntry))
+    const realVerify = vault.verifyStoreContent.bind(vault)
+    vault.verifyStoreContent = async (...args) => {
+      const result = await realVerify(...args)
+      vault.kernel.api = {
+        running: { started_during_validation: true },
+        running_paths: { started_during_validation: path.resolve(home, 'api', 'appB', 'start.js') }
+      }
+      return result
+    }
+    let result
     try {
-      await fs.promises.symlink(external, path.resolve(home, 'api', 'linked-models'), process.platform === 'win32' ? 'junction' : 'dir')
-    } catch (error) {
-      t.skip(`directory links unavailable: ${error.message}`)
-      return
+      result = await vault.deduplicateScope(appB.id)
+    } finally {
+      vault.verifyStoreContent = realVerify
     }
+
+    assert.strictEqual(result.locked, 1)
+    assert.strictEqual((await fs.promises.stat(pending)).nlink, 1)
+    assert.strictEqual(vault.registry.duplicates.has(pending), true)
+    assert.strictEqual(vault.registry.links.has(pending), false)
+  })
+
+  test('status separates app, Pinokio folder, and configured external source metadata', async () => {
+    const { home, vault } = await makeEnv()
+    const external = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'pinokio-ui-external-'))
+    homes.push(external)
+    await vault.addExternalSource(external)
     await fs.promises.mkdir(path.resolve(home, 'api', 'local-app'), { recursive: true })
     await fs.promises.mkdir(path.resolve(home, 'cache'), { recursive: true })
     await vault.refreshSources()
     const status = await vault.status()
+    const canonicalExternal = await fs.promises.realpath(external)
     const byKind = new Map(status.sources.map((source) => [source.id, source]))
     assert.ok([...byKind.values()].some((source) => source.kind === 'app' && source.label === 'local-app' && source.parent_id === 'apps'))
     assert.ok([...byKind.values()].some((source) => source.kind === 'folder' && source.label === 'cache' && source.parent_id === 'pinokio'))
-    assert.ok([...byKind.values()].some((source) => source.kind === 'external' && source.label === 'linked-models' && source.parent_id === 'external'))
+    assert.ok([...byKind.values()].some((source) =>
+      source.kind === 'external' &&
+      source.label === path.basename(canonicalExternal) &&
+      source.root === canonicalExternal &&
+      source.parent_id === 'external'))
   })
 })