diff --git a/apps/console/src/App.test.tsx b/apps/console/src/App.test.tsx
index 5598568..c86b9b5 100644
--- a/apps/console/src/App.test.tsx
+++ b/apps/console/src/App.test.tsx
@@ -211,6 +211,37 @@ describe('Mac-first application shell', () => {
     expect(document.activeElement).toBe(container.querySelector('.cc-toolbar-leading button'))
   })
 
+  // Real-Chrome regression: SettingsView has its own Escape handler
+  // (focus-trap Tab cycling lives there) alongside the shell's, and the
+  // shell's opener button (`.cc-settings-cta`) is also one of
+  // SETTINGS_FOCUS_FALLBACKS — so opening/closing Settings from that one
+  // button always "worked" even while the restore ran twice, masking the
+  // bug. Opening from an unrelated element (as ⌘, from anywhere does)
+  // exposes it: the second, stale restore fell through to the fallback
+  // selectors and stole focus back onto the sidebar's Settings button
+  // instead of leaving it on the real opener.
+  it('restores focus to the real opener after Escape, even when it is not a settings fallback', async () => {
+    await act(async () => root.render(
+      <ThemeModeProvider>
+        <StoreProvider><App /></StoreProvider>
+      </ThemeModeProvider>,
+    ))
+    await act(async () => { await Promise.resolve(); await Promise.resolve() })
+
+    await act(async () => button('Sources').click())
+    const opener = button('Browse files')
+    opener.focus()
+
+    await act(async () => window.dispatchEvent(new KeyboardEvent('keydown', { key: ',', metaKey: true, bubbles: true })))
+    expect(container.querySelector('.cc-settings-screen')).toBeTruthy()
+
+    await act(async () => window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true })))
+    await act(async () => { await new Promise((resolve) => setTimeout(resolve, 0)) })
+
+    expect(container.querySelector('.cc-settings-screen')).toBeNull()
+    expect(document.activeElement).toBe(opener)
+  })
+
   it('does not open Settings over the Connect Agent dialog', async () => {
     window.__CC_DESKTOP = {
       getApiToken: async () => 'test',
diff --git a/apps/console/src/App.tsx b/apps/console/src/App.tsx
index 1e3e4c2..673677b 100644
--- a/apps/console/src/App.tsx
+++ b/apps/console/src/App.tsx
@@ -17,8 +17,17 @@ import { ConnectAgentDialog } from './components/ConnectAgentDialog'
 import { SettingsView } from './components/SettingsView'
 import type { LiveErrorKind } from './api'
 import { CommandPalette, type PaletteCommand } from './components/CommandPalette'
+import { useOpenerFocus } from './components/useOpenerFocus'
 import { readBrowserGroupedViews, SEARCHABLE_VIEWS, viewForDestination } from './shell-navigation'
 
+// Stable across renders (useOpenerFocus's `restore` keys off this array's
+// identity) — must live outside the component, not be re-literaled inline.
+const SETTINGS_FOCUS_FALLBACKS = ['.cc-settings-cta', '.cc-toolbar-leading button']
+// The wizard can auto-open with no trigger at all (first run) or be reopened
+// from a button that only exists in one view (Sources' "Add Source"); the
+// sidebar toggle is the one control guaranteed to be on screen in every view.
+const WIZARD_FOCUS_FALLBACKS = ['.cc-toolbar-leading button']
+
 const ERROR_COPY: Record<LiveErrorKind, (msg: string) => string> = {
   unreachable: () => "Can't reach the ContextCake server. Start it with `npm run console:live`, or view the demo.",
   'bad-status': (msg) => msg,
@@ -83,7 +92,8 @@ export function App() {
   const [drawerOpen, setDrawerOpen] = useState(false)
   const [paletteOpen, setPaletteOpen] = useState(false)
   const [backgroundAnnouncement, setBackgroundAnnouncement] = useState('')
-  const settingsOpener = useRef<HTMLElement | null>(null)
+  const settingsFocus = useOpenerFocus(SETTINGS_FOCUS_FALLBACKS)
+  const wizardFocus = useOpenerFocus(WIZARD_FOCUS_FALLBACKS)
   const paletteOpener = useRef<HTMLElement | null>(null)
   const askOpener = useRef<HTMLElement | null>(null)
   const drawerOpener = useRef<HTMLElement | null>(null)
@@ -102,22 +112,23 @@ export function App() {
   const isDesktop = typeof window !== 'undefined' && Boolean(window.__CC_DESKTOP)
 
   useEffect(() => {
-    if (needsSetup && wizardOpen === undefined) setWizardOpen(true)
-  }, [needsSetup, wizardOpen])
+    if (needsSetup && wizardOpen === undefined) { wizardFocus.capture(); setWizardOpen(true) }
+  }, [needsSetup, wizardOpen, wizardFocus])
 
   const showWizard = wizardOpen === true
-  const closeWizard = () => setWizardOpen(false)
+  const closeWizard = () => { setWizardOpen(false); wizardFocus.restore() }
   // Handlers that reach a memoized child (Sidebar, Header, Sources, ChatPanel)
   // are stable identities. A fresh arrow function per render would re-render
   // the child through its memo and give the whole split back.
-  const reopenWizard = useCallback(() => setWizardOpen(true), [])
+  const reopenWizard = useCallback(() => { wizardFocus.capture(); setWizardOpen(true) }, [wizardFocus])
   const openConnect = useCallback(() => {
     if (sources.length === 0 && !sourceSetupComplete) {
+      wizardFocus.capture()
       setWizardOpen(true)
       return
     }
     setConnectOpen(true)
-  }, [sources.length, sourceSetupComplete])
+  }, [sources.length, sourceSetupComplete, wizardFocus])
   const openSettings = useCallback(() => {
     if (window.__CC_DESKTOP?.windows) {
       setDrawerOpen(false)
@@ -126,10 +137,10 @@ export function App() {
       window.__CC_DESKTOP.windows.openSettings().catch(() => {})
       return
     }
-    settingsOpener.current = document.activeElement instanceof HTMLElement ? document.activeElement : null
+    settingsFocus.capture()
     setDrawerOpen(false)
     setSettingsOpen(true)
-  }, [])
+  }, [settingsFocus])
   const openPalette = () => {
     paletteOpener.current = document.activeElement instanceof HTMLElement ? document.activeElement : null
     setDrawerOpen(false)
@@ -198,27 +209,7 @@ export function App() {
     { id: 'settings', label: 'Open Settings', shortcut: '⌘,', run: openSettings },
     { id: 'sidebar', label: 'Toggle Sidebar', run: toggleSidebar },
   ], [isDesktop, mode, openAskFromPalette, openConnect, openFilesScope, openSettings, reopenWizard, setView, sources, toggleSidebar])
-  const closeSettings = () => {
-    const opener = settingsOpener.current
-    setSettingsOpen(false)
-    window.requestAnimationFrame(() => {
-      const candidates = [
-        opener,
-        document.querySelector<HTMLElement>('.cc-settings-cta'),
-        document.querySelector<HTMLElement>('.cc-toolbar-leading button'),
-      ]
-      candidates.find((candidate) => {
-        if (!candidate?.isConnected) return false
-        if (!candidate.matches('button, a[href], input, select, textarea, [tabindex]:not([tabindex="-1"])')) return false
-        const rect = candidate.getBoundingClientRect()
-        const hasNoLayout = rect.width === 0 && rect.height === 0
-        const visible = hasNoLayout || (rect.width > 0 && rect.height > 0 && rect.right > 0 && rect.bottom > 0 && rect.left < window.innerWidth && rect.top < window.innerHeight)
-        if (visible) candidate.focus()
-        return visible
-      })
-      settingsOpener.current = null
-    })
-  }
+  const closeSettings = () => { setSettingsOpen(false); settingsFocus.restore() }
 
   // Announce transitions, not ticks. A live region that re-read a progress
   // counter every 900ms would make the app unusable with a screen reader; the
@@ -442,7 +433,7 @@ export function App() {
 
   return (
     <>
-      <div className="cc-app-layer" aria-hidden={(settingsOpen || paletteOpen) || undefined} inert={(settingsOpen || paletteOpen) || undefined}>{body}</div>
+      <div className="cc-app-layer" aria-hidden={(settingsOpen || paletteOpen || showWizard) || undefined} inert={(settingsOpen || paletteOpen || showWizard) || undefined}>{body}</div>
       {settingsOpen && <SettingsView appMode={mode} onClose={closeSettings} onIndexingChange={reload} />}
       {paletteOpen && <CommandPalette commands={paletteCommands} onClose={closePalette} />}
       {showWizard && <SetupWizard addingSource={sources.length > 0} onClose={closeWizard} onConnectAgent={isDesktop ? () => {
diff --git a/apps/console/src/App.wizard.test.tsx b/apps/console/src/App.wizard.test.tsx
new file mode 100644
index 0000000..6530321
--- /dev/null
+++ b/apps/console/src/App.wizard.test.tsx
@@ -0,0 +1,124 @@
+// @vitest-environment jsdom
+// The setup wizard's dialog contract (F25, F26): closing it returns focus to
+// whatever opened it, and the app shell behind it is inert while it is open —
+// the same contract Settings already had. Live-shaped data source so the
+// wizard opens in "add a source" mode (one source already present) rather
+// than the first-run narrative.
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { App } from './App'
+import { StoreProvider } from './store'
+import { ThemeModeProvider } from './theme-mode'
+
+const mocks = vi.hoisted(() => ({
+  graph: vi.fn(), resolveAll: vi.fn(), status: vi.fn(), conflictResolutions: vi.fn(),
+}))
+
+vi.mock('./api', async () => {
+  const actual = await vi.importActual<typeof import('./api')>('./api')
+  return {
+    ...actual,
+    createDataSource: () => ({
+      mode: 'live' as const,
+      graph: mocks.graph,
+      resolveAll: mocks.resolveAll,
+      resolve: vi.fn(),
+      listConcepts: vi.fn(),
+      status: mocks.status,
+      conflictResolutions: mocks.conflictResolutions,
+      resolveConflict: vi.fn(),
+    }),
+  }
+})
+
+let container: HTMLDivElement
+let root: Root
+
+function readyGraph() {
+  return {
+    totals: { sourceTokens: 0, resolvedTokens: 0, concepts: 0, sources: 1 },
+    indexing: false,
+    indexingSources: [],
+    generation: 1,
+    sources: [{
+      name: 'personal', level: 3, kind: 'files', conceptCount: 0, tokens: 0, latestUpdated: null,
+      status: 'ok', error: null,
+    }],
+    concepts: [],
+  }
+}
+
+function button(label: string): HTMLButtonElement {
+  const match = Array.from(container.querySelectorAll('button')).find((item) => item.textContent?.trim() === label)
+  if (!match) throw new Error(`Button not found: ${label}`)
+  return match
+}
+
+beforeEach(() => {
+  ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  window.history.replaceState(null, '', '/#/sources')
+  window.localStorage.clear()
+  delete window.__CC_DESKTOP
+  vi.stubGlobal('requestAnimationFrame', (cb: FrameRequestCallback) => window.setTimeout(() => cb(0), 0))
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  for (const mock of Object.values(mocks)) mock.mockReset()
+  mocks.graph.mockResolvedValue(readyGraph())
+  mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: false })
+  mocks.conflictResolutions.mockResolvedValue([])
+  mocks.status.mockResolvedValue(null)
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+  vi.unstubAllGlobals()
+})
+
+describe('the setup wizard as a dialog', () => {
+  it('inerts the app shell while open, and lifts it once closed', async () => {
+    await act(async () => root.render(<ThemeModeProvider><StoreProvider><App /></StoreProvider></ThemeModeProvider>))
+    await act(async () => { await Promise.resolve(); await Promise.resolve() })
+
+    const opener = button('Add Source')
+    opener.focus()
+    await act(async () => opener.click())
+
+    expect(container.querySelector('[aria-label="ContextCake setup"]')).toBeTruthy()
+    expect(container.querySelector('.cc-app-layer')?.hasAttribute('inert')).toBe(true)
+
+    await act(async () => button('Cancel').click())
+    expect(container.querySelector('[aria-label="ContextCake setup"]')).toBeNull()
+    expect(container.querySelector('.cc-app-layer')?.hasAttribute('inert')).toBe(false)
+  })
+
+  it('restores focus to the button that opened it', async () => {
+    await act(async () => root.render(<ThemeModeProvider><StoreProvider><App /></StoreProvider></ThemeModeProvider>))
+    await act(async () => { await Promise.resolve(); await Promise.resolve() })
+
+    const opener = button('Add Source')
+    opener.focus()
+    await act(async () => opener.click())
+    expect(container.querySelector('[aria-label="ContextCake setup"]')).toBeTruthy()
+
+    await act(async () => button('Cancel').click())
+    await act(async () => { await new Promise((resolve) => window.setTimeout(resolve, 0)) })
+    expect(document.activeElement).toBe(opener)
+  })
+
+  it('closes on Escape and still restores focus to the opener', async () => {
+    await act(async () => root.render(<ThemeModeProvider><StoreProvider><App /></StoreProvider></ThemeModeProvider>))
+    await act(async () => { await Promise.resolve(); await Promise.resolve() })
+
+    const opener = button('Add Source')
+    opener.focus()
+    await act(async () => opener.click())
+
+    await act(async () => window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true })))
+    await act(async () => { await new Promise((resolve) => window.setTimeout(resolve, 0)) })
+    expect(container.querySelector('[aria-label="ContextCake setup"]')).toBeNull()
+    expect(document.activeElement).toBe(opener)
+  })
+})
diff --git a/apps/console/src/api.test.ts b/apps/console/src/api.test.ts
index bb24363..eb65d5d 100644
--- a/apps/console/src/api.test.ts
+++ b/apps/console/src/api.test.ts
@@ -1,10 +1,18 @@
 // @vitest-environment jsdom
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
-  adaptConcept, adaptConflicts, adaptSources, apiFetch, LiveDataError, mergeSourceStatus, selectMode,
+  adaptConcept, adaptConflicts, adaptDiscrepancies, adaptSources, apiFetch, computeLevelBuckets, LiveDataError, mergeSourceStatus, selectMode,
   trivialConflictReason,
 } from './api'
-import type { GraphSummary, ResolvedConcept } from './types'
+import type { DiscrepancyRecord, GraphSummary, ResolvedConcept } from './types'
+
+// The rank-based level→lane mapping (see computeLevelBuckets in api.ts) needs
+// the full set of levels present across a resolve pass, not just the levels a
+// single test concept happens to carry. Every fixture below uses the
+// canonical trio of levels, so this single buckets value reproduces the old
+// fixed-threshold mapping (0 → company, 2 → team, 3 → personal) exactly —
+// tests that specifically exercise the rank behavior build their own.
+const STANDARD_BUCKETS = computeLevelBuckets([0, 2, 3])
 
 // ---- selectMode -------------------------------------------------------
 
@@ -106,6 +114,55 @@ describe('LiveSource error taxonomy', () => {
   })
 })
 
+describe('LiveSource.search', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn())
+  })
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('returns hits from /api/search on the happy path', async () => {
+    const { createDataSource } = await import('./api')
+    const hits = [{ id: 'decisions/primary-db', title: 'Primary database', score: 4.2, layers: ['team'], snippet: '...SingleStore for HTAP...' }]
+    vi.mocked(fetch).mockResolvedValue(new Response(JSON.stringify({ hits }), { status: 200 }))
+    const source = createDataSource('live')
+
+    await expect(source.search('singlestore')).resolves.toEqual(hits)
+    const [calledUrl] = vi.mocked(fetch).mock.calls[0]
+    expect(String(calledUrl)).toBe('/api/search?q=singlestore&limit=20')
+  })
+
+  it('encodes the query and honors a custom limit', async () => {
+    const { createDataSource } = await import('./api')
+    vi.mocked(fetch).mockResolvedValue(new Response(JSON.stringify({ hits: [] }), { status: 200 }))
+    const source = createDataSource('live')
+
+    await source.search('primary db?', 5)
+    const [calledUrl] = vi.mocked(fetch).mock.calls[0]
+    expect(String(calledUrl)).toBe(`/api/search?q=${encodeURIComponent('primary db?')}&limit=5`)
+  })
+
+  // The existing older-engine-fallback idiom (see status() above): a 404
+  // means this engine predates /api/search, and the signal is `null`, not a
+  // thrown error — the caller (store.search) decides what to do with that.
+  it('resolves to null on 404 — an engine older than this console', async () => {
+    const { createDataSource } = await import('./api')
+    vi.mocked(fetch).mockResolvedValue({ ok: false, status: 404, json: async () => ({}) } as Response)
+    const source = createDataSource('live')
+
+    await expect(source.search('anything')).resolves.toBeNull()
+  })
+
+  it('rethrows a non-404 failure — only the 404 case is a silent fallback signal here', async () => {
+    const { createDataSource } = await import('./api')
+    vi.mocked(fetch).mockResolvedValue({ ok: false, status: 500, json: async () => ({}) } as Response)
+    const source = createDataSource('live')
+
+    await expect(source.search('anything')).rejects.toMatchObject({ kind: 'bad-status', status: 500 })
+  })
+})
+
 describe('desktop API credential transport', () => {
   afterEach(() => {
     delete window.__CC_DESKTOP
@@ -196,6 +253,31 @@ describe('desktop API credential transport', () => {
 
 // ---- Adapters: raw engine types -> console view model -------------------
 
+describe('computeLevelBuckets', () => {
+  it('ranks the highest level present as personal, the next as team, the rest as company', () => {
+    const buckets = computeLevelBuckets([0, 1, 2, 3])
+    expect(buckets.get(3)).toBe('personal')
+    expect(buckets.get(2)).toBe('team')
+    expect(buckets.get(1)).toBe('company')
+    expect(buckets.get(0)).toBe('company')
+  })
+
+  it('puts the sole level present in the top lane rather than folding it into company', () => {
+    expect(computeLevelBuckets([1]).get(1)).toBe('personal')
+  })
+
+  it('promotes a second-place level to team even when it is not 2', () => {
+    expect(computeLevelBuckets([3, 1]).get(1)).toBe('team')
+    expect(computeLevelBuckets([5, 4]).get(4)).toBe('team')
+  })
+
+  it('ignores duplicate levels when ranking', () => {
+    const buckets = computeLevelBuckets([2, 2, 0, 0])
+    expect(buckets.get(2)).toBe('personal')
+    expect(buckets.get(0)).toBe('team')
+  })
+})
+
 describe('adaptConcept', () => {
   const sample: ResolvedConcept = {
     id: 'decisions/primary-db',
@@ -219,30 +301,37 @@ describe('adaptConcept', () => {
   }
 
   it('maps id, title, and type from frontmatter', () => {
-    const c = adaptConcept(sample)
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
     expect(c.id).toBe('decisions/primary-db')
     expect(c.title).toBe('Primary database')
     expect(c.type).toBe('decision')
   })
 
   it('orders contributing layers by precedence (personal, team, company)', () => {
-    const c = adaptConcept(sample)
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
     expect(c.layers).toEqual(['team', 'company'])
   })
 
+  it('carries the real contributor source names, winner first — a zero-section concept has no section to read one from', () => {
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
+    expect(c.contributorLayers).toEqual(['team', 'company'])
+    const empty: ResolvedConcept = { ...sample, sections: [] }
+    expect(adaptConcept(empty, STANDARD_BUCKETS).contributorLayers).toEqual(['team', 'company'])
+  })
+
   it('marks conflict true when any section has dissents', () => {
-    const c = adaptConcept(sample)
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
     expect(c.conflict).toBe(true)
   })
 
   it('marks draft only from OKF frontmatter (write.mjs stamps auto-captures)', () => {
     const stamped: ResolvedConcept = { ...sample, frontmatter: { ...sample.frontmatter, draft: true } }
-    expect(adaptConcept(stamped).draft).toBe(true)
-    expect(adaptConcept(sample).draft).toBe(false)
+    expect(adaptConcept(stamped, STANDARD_BUCKETS).draft).toBe(true)
+    expect(adaptConcept(sample, STANDARD_BUCKETS).draft).toBe(false)
     // A concept owned by a single layer is NOT draft — finished knowledge
     // commonly lives in exactly one layer.
     const solo: ResolvedConcept = { ...sample, contributors: [sample.contributors[0]], sections: [] }
-    expect(adaptConcept(solo).draft).toBe(false)
+    expect(adaptConcept(solo, STANDARD_BUCKETS).draft).toBe(false)
   })
 
   it('maps non-canonical layer names via contributor levels, not the name', () => {
@@ -266,16 +355,16 @@ describe('adaptConcept', () => {
         },
       ],
     }
-    const c = adaptConcept(custom)
+    const c = adaptConcept(custom, STANDARD_BUCKETS)
     expect(c.sections[0].winner).toBe('team')
     expect(c.layers).toEqual(['team', 'company'])
-    const cards = adaptConflicts([custom])
+    const cards = adaptConflicts([custom], [], STANDARD_BUCKETS)
     expect(cards[0].winner).toBe('team')
     expect(cards[0].contributions[0].layer).toBe('team')
   })
 
   it('maps section winner, value, and provenance date', () => {
-    const c = adaptConcept(sample)
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
     const s = c.sections[0]
     expect(s.name).toBe('Choice')
     expect(s.winner).toBe('team')
@@ -284,7 +373,7 @@ describe('adaptConcept', () => {
   })
 
   it('surfaces dissenting layers on the section, not hidden', () => {
-    const c = adaptConcept(sample)
+    const c = adaptConcept(sample, STANDARD_BUCKETS)
     const s = c.sections[0]
     expect(s.dissents).toHaveLength(1)
     expect(s.dissents?.[0]).toMatchObject({ layer: 'company', value: 'Postgres (org standard).', updated: '2025-06-01' })
@@ -295,7 +384,7 @@ describe('adaptConcept', () => {
       ...sample,
       sections: [{ ...sample.sections[0], suppressed: true, conflicts: undefined }],
     }
-    const c = adaptConcept(suppressed)
+    const c = adaptConcept(suppressed, STANDARD_BUCKETS)
     expect(c.sections[0].suppressed).toBe(true)
     expect(c.sections[0].dissents).toEqual([])
   })
@@ -394,7 +483,7 @@ describe('adaptConcept with headingless documents', () => {
   }
 
   it('names a headingless section by its key instead of throwing', () => {
-    const concept = adaptConcept(headless)
+    const concept = adaptConcept(headless, STANDARD_BUCKETS)
     expect(concept.sections[0].name).toBe('body')
   })
 
@@ -404,7 +493,7 @@ describe('adaptConcept with headingless documents', () => {
       contributors: [...headless.contributors, { layer: 'team', level: 2, updated: '2026-02-10' }],
       sections: [{ ...headless.sections[0], conflicts: [{ layer: 'team', updated: '2026-02-10', content: 'Talked to Priya on Tuesday.' }] }],
     }
-    const [conflict] = adaptConflicts([contested])
+    const [conflict] = adaptConflicts([contested], [], STANDARD_BUCKETS)
     expect(conflict.section).toBe('body')
     expect(conflict.title).toBe('body — 2026-02-11')
   })
@@ -539,6 +628,26 @@ describe('adaptSources', () => {
     expect(adaptSources(graph)[0].layer).toBe('personal')
   })
 
+  // The fixed-threshold mapping this replaced sent any level < 2 straight to
+  // 'company' — so a level-1 source sat in Company next to level 0, and the
+  // Team lane, with nothing at level 2, sat empty. Ranked among the levels
+  // that actually exist (3 and 1 here), level 1 is the *second* highest and
+  // now lands in 'team'.
+  it('ranks a level-1 source into team, not company, when a higher level exists', () => {
+    const graph: GraphSummary = {
+      totals: { sourceTokens: 10, resolvedTokens: 10, concepts: 2, sources: 2 },
+      sources: [
+        { name: 'personal', level: 3, kind: 'okf-local', conceptCount: 1, tokens: 10, latestUpdated: null, status: 'ok', error: null },
+        { name: 'messy-vault', level: 1, kind: 'files', conceptCount: 1, tokens: 10, latestUpdated: null, status: 'ok', error: null },
+      ],
+      concepts: [],
+    }
+    const [, vault] = adaptSources(graph)
+    expect(vault.name).toBe('messy-vault')
+    expect(vault.layer).toBe('team')
+    expect(vault.layer).not.toBe('company')
+  })
+
   it('never paints a zero-concept MCP source as serving (the false green)', () => {
     // A dead MCP child answers [] instead of throwing, so its row arrives
     // status 'ok' with nothing served — that must not read as healthy.
@@ -622,7 +731,7 @@ describe('adaptConflicts', () => {
         ],
       },
     ]
-    const out = adaptConflicts(concepts)
+    const out = adaptConflicts(concepts, [], STANDARD_BUCKETS)
     expect(out).toHaveLength(1)
     expect(out[0]).toMatchObject({
       id: 'decisions/primary-db::choice',
@@ -644,7 +753,7 @@ describe('adaptConflicts', () => {
         sections: [{ key: 'steps', heading: '## Steps {#steps}', content: 'Deploy.', sourceLayer: 'team', sourceUpdated: null }],
       },
     ]
-    expect(adaptConflicts(concepts)).toEqual([])
+    expect(adaptConflicts(concepts, [], STANDARD_BUCKETS)).toEqual([])
   })
 
   it('classifies formatting-only prose but never guesses when words or code change', () => {
@@ -671,11 +780,66 @@ describe('adaptConflicts', () => {
       reason: 'You chose the acme-eng answer.',
       actor: 'local-user',
       decidedAt: '2026-08-05T00:00:00.000Z',
-    }])
+    }], STANDARD_BUCKETS)
 
     expect(resolved.status).toBe('resolved')
     expect(resolved.winner).toBe('team')
     expect(resolved.contributions.map((item) => item.layer)).toEqual(['team', 'company'])
+    // F13 prerequisite: a resolved card carries the winning source directly,
+    // so the Conflicts source filter can match it even when the contributions
+    // snapshot it carries doesn't happen to include that source by name.
+    expect(resolved.effectiveSource).toBe('acme-eng')
+  })
+})
+
+describe('adaptDiscrepancies', () => {
+  function frontmatterRecord(overrides: Partial<DiscrepancyRecord> = {}): DiscrepancyRecord {
+    return {
+      id: 'frontmatter_value::decisions/primary-db::tags',
+      kind: 'frontmatter_value',
+      originalKind: 'frontmatter_value',
+      conceptId: 'decisions/primary-db',
+      conceptTitle: 'Primary database',
+      conceptType: 'concept',
+      key: 'tags',
+      label: 'tags',
+      revision: 'rev-1',
+      status: 'needs_review',
+      contributions: [
+        { source: 'team', level: 2, updated: '2026-01-01', value: 'oltp', fingerprint: 'fp1', effective: true },
+        { source: 'company', level: 0, updated: '2025-01-01', value: 'oltp', fingerprint: 'fp2', effective: false },
+      ],
+      effectiveSource: 'team',
+      effectiveValue: 'oltp',
+      winnerReason: 'team wins by configured layer precedence.',
+      owner: 'Unassigned',
+      priority: 'unassigned',
+      fresherDissent: false,
+      freshness: { effectiveUpdated: '2026-01-01', newestUpdated: '2026-01-01', hasNewerDissent: false },
+      affectedLinks: [],
+      sourceHealth: [],
+      history: [],
+      matchingRules: [],
+      ...overrides,
+    }
+  }
+
+  it('flags a discrepancy isList when any raw contribution value is an array — the engine 400s compose against it', () => {
+    const record = frontmatterRecord({
+      contributions: [
+        { source: 'team', level: 2, updated: '2026-01-01', value: ['postgres', 'oltp'], fingerprint: 'fp1', effective: true },
+        { source: 'company', level: 0, updated: '2025-01-01', value: ['mysql'], fingerprint: 'fp2', effective: false },
+      ],
+    })
+    const [card] = adaptDiscrepancies([record], true, STANDARD_BUCKETS)
+    expect(card.isList).toBe(true)
+    // The display value is still the honest stringified form, never the raw array.
+    expect(card.contributions[0].value).toBe(JSON.stringify(['postgres', 'oltp'], null, 2))
+  })
+
+  it('never flags isList for an ordinary string-valued frontmatter field', () => {
+    const [card] = adaptDiscrepancies([frontmatterRecord()], true, STANDARD_BUCKETS)
+    expect(card.isList).toBeUndefined()
   })
 })
 
@@ -700,9 +864,9 @@ describe('fresherDissent (C-b)', () => {
   }
 
   it('carries the section flag through adaptConcept onto the view section', () => {
-    const c = adaptConcept(conflicted({ fresherDissent: true }))
+    const c = adaptConcept(conflicted({ fresherDissent: true }), STANDARD_BUCKETS)
     expect(c.sections[0].fresherDissent).toBe(true)
-    expect(adaptConcept(conflicted({})).sections[0].fresherDissent).toBeUndefined()
+    expect(adaptConcept(conflicted({}), STANDARD_BUCKETS).sections[0].fresherDissent).toBeUndefined()
   })
 
   it('marks exactly the strictly-newer dissent contribution on the conflict card', () => {
@@ -714,7 +878,7 @@ describe('fresherDissent (C-b)', () => {
       ],
     })
     concept.contributors.push({ layer: 'company', level: 0, updated: '2025-01-01' })
-    const [card] = adaptConflicts([concept])
+    const [card] = adaptConflicts([concept], [], STANDARD_BUCKETS)
     expect(card.contributions[0].fresherDissent).toBeUndefined() // the winner is never its own dissent
     expect(card.contributions[1]).toMatchObject({ layer: 'team', fresherDissent: true })
     expect(card.contributions[2].fresherDissent).toBeUndefined() // older dissent stays unmarked
@@ -723,7 +887,7 @@ describe('fresherDissent (C-b)', () => {
   it('never marks a dissent when the engine did not flag the section', () => {
     // The engine owns the rule (it also knows about suppression and
     // formatting-equivalence); the console must not out-guess it.
-    const [card] = adaptConflicts([conflicted({})])
+    const [card] = adaptConflicts([conflicted({})], [], STANDARD_BUCKETS)
     expect(card.contributions.every((k) => k.fresherDissent === undefined)).toBe(true)
   })
 
@@ -737,7 +901,7 @@ describe('fresherDissent (C-b)', () => {
       ],
     })
     concept.contributors.push({ layer: 'company', level: 0, updated: '2026-06-01' })
-    const [card] = adaptConflicts([concept])
+    const [card] = adaptConflicts([concept], [], STANDARD_BUCKETS)
     expect(card.contributions[1].fresherDissent).toBeUndefined()
     expect(card.contributions[2].fresherDissent).toBe(true)
   })
@@ -748,13 +912,13 @@ describe('fresherDissent (C-b)', () => {
       sourceUpdated: null,
       conflicts: [{ layer: 'team', updated: '2026-06-01', content: 'Dated dissent.' }],
     })
-    const [card] = adaptConflicts([concept])
+    const [card] = adaptConflicts([concept], [], STANDARD_BUCKETS)
     expect(card.contributions[1].fresherDissent).toBeUndefined()
 
     const garbled = conflicted({
       fresherDissent: true,
       conflicts: [{ layer: 'team', updated: 'not-a-date', content: 'Undated dissent.' }],
     })
-    expect(adaptConflicts([garbled])[0].contributions[1].fresherDissent).toBeUndefined()
+    expect(adaptConflicts([garbled], [], STANDARD_BUCKETS)[0].contributions[1].fresherDissent).toBeUndefined()
   })
 })
diff --git a/apps/console/src/api.ts b/apps/console/src/api.ts
index 51bfc2c..c817eb0 100644
--- a/apps/console/src/api.ts
+++ b/apps/console/src/api.ts
@@ -15,7 +15,7 @@ import demoBundleRaw from './generated/demo-cascade.json'
 import type {
   ConflictResolutionRecord, DemoBundle, DiscrepanciesResponse, DiscrepancyDecisionRequest, DiscrepancyRecord,
   DiscrepancyRule, DiscrepancyRuleSuggestion, GraphSummary, GraphSource, ResolveConflictRequest,
-  ResolvedConcept, ResolvedSection, SourceStatus, StatusSummary,
+  ResolvedConcept, ResolvedSection, SearchHit, SourceStatus, StatusSummary,
 } from './types'
 import type { Concept, ConceptSection, Conflict, Dissent, Source } from './data'
 import type { LayerId } from './theme'
@@ -59,6 +59,14 @@ export interface DataSource {
    * to reading progress off the graph.
    */
   status(): Promise<StatusSummary | null>
+  /**
+   * Full-text search over section content (GET /api/search), for the
+   * Knowledge search box. `null` means the same thing it means for `status()`
+   * above: an engine too old to have the route. Demo mode never calls this —
+   * it has no engine behind it — so `DemoSource` answers `null` unconditionally
+   * rather than reading its own bundle.
+   */
+  search(query: string, limit?: number): Promise<SearchHit[] | null>
   conflictResolutions(): Promise<ConflictResolutionRecord[]>
   resolveConflict(request: ResolveConflictRequest): Promise<ConflictResolutionRecord>
   discrepancies(): Promise<DiscrepanciesResponse | null>
@@ -195,9 +203,12 @@ class DemoSource implements DataSource {
       })),
     }
   }
+  /** Demo mode is pure client-side substring filtering — no engine to search. */
+  async search(): Promise<SearchHit[] | null> { return null }
   async conflictResolutions(): Promise<ConflictResolutionRecord[]> { return this.resolutions }
   async discrepancies(): Promise<DiscrepanciesResponse> {
-    const conflicts = adaptConflicts(this.bundle.concepts, this.resolutions)
+    const buckets = computeLevelBuckets(this.bundle.graph.sources.map((s) => s.level))
+    const conflicts = adaptConflicts(this.bundle.concepts, this.resolutions, buckets)
     return {
       discrepancies: conflicts.map((conflict) => legacyConflictRecord(conflict)),
       coverageComplete: true, indexing: false, indexingSources: [], errors: [], generation: 1,
@@ -327,6 +338,19 @@ class LiveSource implements DataSource {
       throw error
     }
   }
+  async search(query: string, limit = 20): Promise<SearchHit[] | null> {
+    try {
+      return (await this.get<{ hits: SearchHit[] }>(`/api/search?q=${encodeURIComponent(query)}&limit=${limit}`)).hits
+    } catch (error) {
+      // Same older-engine idiom as status() above: a 404 means this engine has
+      // no /api/search route, and the caller falls back to the substring
+      // filter. Any other failure (network, timeout, malformed body) is the
+      // caller's problem too — it wraps this call and treats every rejection
+      // the same way, so nothing here needs to distinguish them.
+      if (error instanceof LiveDataError && error.kind === 'bad-status' && error.status === 404) return null
+      throw error
+    }
+  }
   async conflictResolutions(): Promise<ConflictResolutionRecord[]> {
     try {
       return (await this.get<{ resolutions: ConflictResolutionRecord[] }>('/api/conflict-resolutions')).resolutions
@@ -420,12 +444,34 @@ export function createDataSource(mode: Mode = selectMode()): DataSource {
 const LAYER_IDS: LayerId[] = ['company', 'team', 'personal']
 const isLayerId = (s: string): s is LayerId => (LAYER_IDS as string[]).includes(s)
 
-/** Map a source/layer name (falling back to level) to a console LayerId. */
-function layerOf(name: string, level: number): LayerId {
+/**
+ * Rank-based bucket assignment for one resolve pass. `LayerId` stays a
+ * closed, three-value union — styling in ~8 files depends on it — so an
+ * arbitrary manifest level still needs an honest lane without widening that
+ * type. The highest level actually present becomes 'personal', the next
+ * 'team', and everything else 'company'. That fixes the fixed-threshold bug
+ * where a lone level-1 source (nothing above it) read as 'company' with the
+ * Team lane sitting empty: ranked among the levels that actually exist, level
+ * 1 is the *second* highest and lands in 'team'.
+ *
+ * Must be computed once per resolve pass from every source in play (not per
+ * concept or per record) and threaded through every adapter below — computing
+ * it from a narrower slice would bucket the same source differently
+ * depending on what happened to touch it.
+ */
+export type LevelBuckets = ReadonlyMap<number, LayerId>
+
+export function computeLevelBuckets(levels: Iterable<number>): LevelBuckets {
+  const distinct = [...new Set(levels)].sort((a, b) => b - a)
+  const buckets = new Map<number, LayerId>()
+  distinct.forEach((level, rank) => buckets.set(level, rank === 0 ? 'personal' : rank === 1 ? 'team' : 'company'))
+  return buckets
+}
+
+/** Map a source/layer name (falling back to its rank bucket) to a console LayerId. */
+function layerOf(name: string, level: number, buckets: LevelBuckets): LayerId {
   if (isLayerId(name)) return name
-  if (level >= 3) return 'personal'
-  if (level === 2) return 'team'
-  return 'company'
+  return buckets.get(level) ?? 'company'
 }
 
 /**
@@ -478,10 +524,10 @@ function newerAtDayGranularity(dissentUpdated: string | null, winnerUpdated: str
 }
 
 /** A resolved section → the console's ConceptSection (with provenance + dissent). */
-function adaptSection(s: ResolvedSection, levels: Map<string, number>): ConceptSection {
-  const winner = layerOf(s.sourceLayer, levels.get(s.sourceLayer) ?? 0)
+function adaptSection(s: ResolvedSection, levels: Map<string, number>, buckets: LevelBuckets): ConceptSection {
+  const winner = layerOf(s.sourceLayer, levels.get(s.sourceLayer) ?? 0, buckets)
   const dissents: Dissent[] = (s.conflicts ?? []).map((c) => ({
-    layer: layerOf(c.layer, levels.get(c.layer) ?? 0),
+    layer: layerOf(c.layer, levels.get(c.layer) ?? 0, buckets),
     sourceLayer: c.layer,
     value: c.content,
     updated: c.updated,
@@ -499,11 +545,12 @@ function adaptSection(s: ResolvedSection, levels: Map<string, number>): ConceptS
   }
 }
 
-/** A resolved concept → the console's Concept. */
-export function adaptConcept(r: ResolvedConcept): Concept {
+/** A resolved concept → the console's Concept. `buckets` is the rank-based
+ *  level→lane assignment for this resolve pass (see `computeLevelBuckets`). */
+export function adaptConcept(r: ResolvedConcept, buckets: LevelBuckets): Concept {
   const levels = contributorLevels(r)
-  const layerIds = orderLayers(r.contributors.map((c) => layerOf(c.layer, c.level)))
-  const sections = r.sections.map((s) => adaptSection(s, levels))
+  const layerIds = orderLayers(r.contributors.map((c) => layerOf(c.layer, c.level, buckets)))
+  const sections = r.sections.map((s) => adaptSection(s, levels, buckets))
   return {
     id: r.id,
     title: (r.frontmatter?.title as string) ?? r.id,
@@ -515,6 +562,7 @@ export function adaptConcept(r: ResolvedConcept): Concept {
     // draft signal. Owning a concept in a single layer does not make it draft.
     draft: r.frontmatter?.draft === true,
     sections,
+    contributorLayers: r.contributors.map((c) => c.layer),
   }
 }
 
@@ -552,6 +600,7 @@ export function progressPercent(p: { loaded?: number; total?: number | null } |
 
 /** Graph sources → the console's Source[] (coverage/focus/status derived honestly). */
 export function adaptSources(g: GraphSummary): Source[] {
+  const buckets = computeLevelBuckets(g.sources.map((s) => s.level))
   return g.sources.map((s: GraphSource) => {
     const errored = s.status === 'error'
     // A remote source that can't reach its API doesn't throw — it answers with
@@ -587,7 +636,7 @@ export function adaptSources(g: GraphSummary): Source[] {
     return {
       name: s.name,
       kind: s.kind === 'mcp' ? 'mcp' : 'okf-local',
-      layer: layerOf(s.name, s.level),
+      layer: layerOf(s.name, s.level, buckets),
       // A source contributing nothing shouldn't show a full bar, however it
       // got there — errored, degraded to empty, or genuinely empty. While it
       // indexes the bar tracks real progress instead of standing in for it.
@@ -713,8 +762,10 @@ export function trivialConflictReason(values: string[]): string | null {
     : 'The answers use the same words in the same order; only formatting differs.'
 }
 
-/** Derive open conflicts plus resolved decisions retained by the local log. */
-export function adaptConflicts(concepts: ResolvedConcept[], resolutions: ConflictResolutionRecord[] = []): Conflict[] {
+/** Derive open conflicts plus resolved decisions retained by the local log.
+ *  `buckets` is the rank-based level→lane assignment for this resolve pass
+ *  (see `computeLevelBuckets`). */
+export function adaptConflicts(concepts: ResolvedConcept[], resolutions: ConflictResolutionRecord[] = [], buckets: LevelBuckets): Conflict[] {
   const out: Conflict[] = []
   const historyByConflict = new Map<string, ConflictResolutionRecord[]>()
   for (const resolution of resolutions) {
@@ -727,13 +778,13 @@ export function adaptConflicts(concepts: ResolvedConcept[], resolutions: Conflic
     const levels = contributorLevels(c)
     for (const s of c.sections) {
       if (!s.conflicts?.length) continue
-      const winner = layerOf(s.sourceLayer, levels.get(s.sourceLayer) ?? 0)
+      const winner = layerOf(s.sourceLayer, levels.get(s.sourceLayer) ?? 0, buckets)
       const id = `${c.id}::${s.key}`
       const history = historyByConflict.get(id) ?? []
       const contributions = [
         { layer: winner, sourceLayer: s.sourceLayer, value: s.content, updated: s.sourceUpdated ?? '' },
         ...s.conflicts.map((k) => ({
-          layer: layerOf(k.layer, levels.get(k.layer) ?? 0),
+          layer: layerOf(k.layer, levels.get(k.layer) ?? 0, buckets),
           sourceLayer: k.layer,
           value: k.content,
           updated: k.updated ?? '',
@@ -764,7 +815,7 @@ export function adaptConflicts(concepts: ResolvedConcept[], resolutions: Conflic
     if (out.some((item) => item.id === id)) continue
     const latest = history[history.length - 1]
     const contributions = latest.contributions.map((item) => ({
-      layer: layerOf(item.layer, item.level ?? (item.layer === 'personal' ? 3 : item.layer === 'team' ? 2 : 0)),
+      layer: layerOf(item.layer, item.level ?? (item.layer === 'personal' ? 3 : item.layer === 'team' ? 2 : 0), buckets),
       sourceLayer: item.layer,
       value: item.content,
       updated: item.updated ?? '',
@@ -776,10 +827,11 @@ export function adaptConflicts(concepts: ResolvedConcept[], resolutions: Conflic
       section: headingText(latest.sectionHeading),
       title: `${headingText(latest.sectionHeading)} — ${latest.title}`,
       status: 'resolved',
-      winner: layerOf(latest.chosen?.layer ?? latest.contributions[0]?.layer ?? '', latest.chosen?.level ?? latest.contributions[0]?.level ?? 0),
+      winner: layerOf(latest.chosen?.layer ?? latest.contributions[0]?.layer ?? '', latest.chosen?.level ?? latest.contributions[0]?.level ?? 0, buckets),
       contributions,
       safe: false,
       history,
+      effectiveSource: latest.chosen?.layer ?? latest.contributions[0]?.layer ?? null,
     })
   }
   return out
@@ -809,11 +861,20 @@ function legacyConflictRecord(conflict: Conflict): DiscrepancyRecord {
   }
 }
 
-/** Raw professional discrepancy records → the existing navigator view model. */
-export function adaptDiscrepancies(records: DiscrepancyRecord[], coverageComplete = true): Conflict[] {
+/** Raw professional discrepancy records → the existing navigator view model.
+ *  `buckets` is the rank-based level→lane assignment for this resolve pass
+ *  (see `computeLevelBuckets`). */
+export function adaptDiscrepancies(records: DiscrepancyRecord[], coverageComplete = true, buckets: LevelBuckets): Conflict[] {
   return records.map((record) => {
+    // The raw contribution value carries its real type (the engine never
+    // stringifies a list-typed frontmatter field before serving it) — check
+    // it BEFORE the display value below coerces every non-string into JSON
+    // text. `isList` rides with the discrepancy, not a contribution, because
+    // the engine's own compose guard (service.mjs) rejects the action for the
+    // whole field, not per-contributor.
+    const isList = record.contributions.some((item) => Array.isArray(item.value))
     const contributions = record.contributions.map((item) => ({
-      layer: layerOf(item.source, item.level), sourceLayer: item.source,
+      layer: layerOf(item.source, item.level, buckets), sourceLayer: item.source,
       value: typeof item.value === 'string' ? item.value : JSON.stringify(item.value, null, 2),
       updated: item.updated ?? '',
       ...(record.fresherDissent && !item.effective ? { fresherDissent: true } : {}),
@@ -823,13 +884,14 @@ export function adaptDiscrepancies(records: DiscrepancyRecord[], coverageComplet
       id: record.id, concept: record.conceptId, sectionKey: record.key,
       section: record.label, title: `${record.label} — ${record.conceptTitle}`,
       status: record.status === 'resolved' ? 'resolved' : 'open',
-      winner: layerOf(effective?.source ?? '', effective?.level ?? 0),
+      winner: layerOf(effective?.source ?? '', effective?.level ?? 0, buckets),
       contributions, safe: false, history: record.history,
       kind: record.kind, discrepancyStatus: record.status, revision: record.revision,
       owner: record.owner, priority: record.priority, winnerReason: record.winnerReason,
       effectiveSource: record.effectiveSource, coverageComplete, sourceHealth: record.sourceHealth,
       matchingRules: record.matchingRules, ruleConflict: record.ruleConflict, target: record.target,
       affectedLinks: record.affectedLinks,
+      ...(isList ? { isList: true } : {}),
     }
   })
 }
diff --git a/apps/console/src/components/ConceptDetail.test.tsx b/apps/console/src/components/ConceptDetail.test.tsx
new file mode 100644
index 0000000..711605e
--- /dev/null
+++ b/apps/console/src/components/ConceptDetail.test.tsx
@@ -0,0 +1,91 @@
+// @vitest-environment jsdom
+// ConceptDetail is shared by the Canvas slide-over and the Knowledge page. A
+// section's provenance line, its "suppressed by" note, and a dissent chip all
+// used to name the three-lane bucket (layerName(winner)/layerName(layer))
+// instead of the real source that produced the value — so two sources sharing
+// a lane (e.g. two personal-level MCP servers) were indistinguishable in the
+// inspector. Every place that used to print a lane name now prints
+// `sourceLayer`, the manifest's own name for the contributor.
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ConceptDetail } from './ConceptDetail'
+import type { Concept } from '../data'
+
+vi.mock('../layer-files', () => ({
+  filesRevalidation: () => 'rev',
+  useLayerFiles: () => ({ layers: [] }),
+}))
+
+const mocks = vi.hoisted(() => ({ store: null as unknown as Record<string, unknown> }))
+vi.mock('../store', () => {
+  const store = () => mocks.store
+  return { useStore: store, useStoreData: store, useStoreNav: store, useStoreInput: store }
+})
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  mocks.store = { mode: 'demo', sources: [], reloadKey: 0, openFilesScope: vi.fn() }
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+
+function concept(): Concept {
+  return {
+    id: 'decisions/primary-db',
+    title: 'Primary database',
+    type: 'decision',
+    layers: ['personal', 'team'],
+    sections: [
+      {
+        name: 'Choice',
+        winner: 'personal',
+        sourceLayer: 'maya-notes',
+        value: 'SingleStore for HTAP workloads.',
+        updated: '2026-08-01',
+        dissents: [
+          { layer: 'team', sourceLayer: 'acme-eng', value: 'Postgres (org standard).', updated: '2026-06-01' },
+        ],
+      },
+      {
+        name: 'Rollback plan',
+        winner: 'personal',
+        sourceLayer: 'maya-notes',
+        value: '',
+        suppressed: true,
+      },
+    ],
+  }
+}
+
+describe('ConceptDetail provenance', () => {
+  it('names the real contributing source, not the lane it renders in', async () => {
+    await act(async () => root.render(<ConceptDetail concept={concept()} />))
+    expect(container.textContent).toContain('maya-notes · 2026-08-01')
+    // The lane bucket name never appears as the section's provenance text —
+    // it stays a color cue (the dot) plus the top-of-panel layer chips.
+    expect(container.querySelector('code')).toBeTruthy()
+  })
+
+  it('names the real source in the suppressed-by note, not "personal"', async () => {
+    await act(async () => root.render(<ConceptDetail concept={concept()} />))
+    expect(container.textContent).toContain('suppressed by maya-notes')
+    expect(container.textContent).not.toContain('suppressed by personal')
+  })
+
+  it('names the real dissenting source on the dissent chip, keeping the lane color', async () => {
+    await act(async () => root.render(<ConceptDetail concept={concept()} />))
+    const chip = Array.from(container.querySelectorAll('span')).find((el) => el.textContent === 'acme-eng')
+    expect(chip, 'dissent chip should read the source name, not the lane').toBeTruthy()
+    expect(container.textContent).not.toContain('Team says')
+  })
+})
diff --git a/apps/console/src/components/ConceptDetail.tsx b/apps/console/src/components/ConceptDetail.tsx
index 6682187..6299ac5 100644
--- a/apps/console/src/components/ConceptDetail.tsx
+++ b/apps/console/src/components/ConceptDetail.tsx
@@ -1,6 +1,5 @@
 import { useMemo } from 'react'
 import { C, css, lc, MONO, conceptTypeStyle } from '../theme'
-import { layerName } from '../data'
 import type { Concept } from '../data'
 import { filesRevalidation, useLayerFiles } from '../layer-files'
 import { useStoreData } from '../store'
@@ -56,6 +55,38 @@ function OpenFile({ layer, path, conceptId }: { layer: string; path: string | un
   )
 }
 
+/**
+ * A concept with no sections is a dead end — the resolver produced an id and
+ * some frontmatter, but nothing to read. Rather than rendering an empty
+ * `<div>` with no explanation, name the situation and, where a source file is
+ * identifiable, offer a way to it: the winning contributor's file, or —
+ * absent a listing for it (an MCP or REST-read contributor keeps no file
+ * here) — a plain way into the Files tab, scoped to that source, so browsing
+ * is still one click away.
+ */
+function EmptyConcept({ concept, fileFor }: { concept: Concept; fileFor: (sourceLayer: string) => string | undefined }) {
+  const { openFilesScope } = useStoreData()
+  const winner = concept.contributorLayers?.[0]
+  const path = winner ? fileFor(winner) : undefined
+  return (
+    <div style={css(`display:flex; flex-direction:column; gap:10px; align-items:flex-start; padding:16px 0;`)}>
+      <p style={css('margin:0; font-size:13px; color:#57564F;')}>This concept has no sections — the file may be empty.</p>
+      {winner && (
+        path
+          ? <OpenFile layer={winner} path={path} conceptId={concept.id} />
+          : (
+            <button
+              type="button"
+              className="cc-h-bd-strong"
+              onClick={() => openFilesScope(winner)}
+              style={css(`flex:0 0 auto; padding:5px 11px; border:1px solid ${C.line}; border-radius:999px; background:${C.raised}; cursor:pointer; font:inherit; font-size:11px; font-weight:600; color:${C.caption};`)}
+            >Browse {winner} in Files</button>
+          )
+      )}
+    </div>
+  )
+}
+
 /** The resolved read of a concept — provenance chips per section + inline dissent.
  *  Shared by the Concepts view and the Canvas node slide-over. */
 export function ConceptDetail({ concept }: { concept: Concept }) {
@@ -77,10 +108,15 @@ export function ConceptDetail({ concept }: { concept: Concept }) {
       </div>
 
       <div style={css('display:flex; flex-direction:column;')}>
+        {concept.sections.length === 0 && <EmptyConcept concept={concept} fileFor={fileFor} />}
         {concept.sections.map((s) => {
           const col = lc(s.winner)
           const dissents = s.dissents ?? []
-          const provenance = `${layerName(s.winner)}${s.updated ? ' · ' + s.updated : ''}`
+          // The real source that won this section, not the three-lane bucket it
+          // renders in — two sources can share a lane, and only the source name
+          // says which one is behind the value. The colored dot beside the
+          // heading already carries the lane; this text carries provenance.
+          const provenance = `${s.sourceLayer}${s.updated ? ' · ' + s.updated : ''}`
           return (
             <div key={s.key ?? s.name} style={css('padding:16px 0; border-bottom:1px solid #EDEAE0;')}>
               <div style={css('display:flex; align-items:center; gap:9px; margin-bottom:8px;')}>
@@ -93,7 +129,7 @@ export function ConceptDetail({ concept }: { concept: Concept }) {
               {s.suppressed ? (
                 <div style={css('display:flex; align-items:center; gap:7px; font-size:12px; color:#8A8A82;')}>
                   <span aria-hidden="true">▢</span>
-                  <span>suppressed by {layerName(s.winner)}</span>
+                  <span>suppressed by {s.sourceLayer}</span>
                 </div>
               ) : (
                 <div style={css('font-size:13.5px; color:#1A1915; line-height:1.55;')}>{s.value}</div>
@@ -107,7 +143,7 @@ export function ConceptDetail({ concept }: { concept: Concept }) {
                       <div key={`${d.layer}-${i}`} style={css('display:flex; align-items:flex-start; gap:9px; padding:10px 12px; background:#FBF0DD; border:1px solid #E8C88C; border-radius:9px;')}>
                         <svg style={{ flex: '0 0 auto', marginTop: 1 }} width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="#C77D2A" strokeWidth="2.2" strokeLinecap="round"><path d="M12 8v5M12 16.5v.5" /><circle cx="12" cy="12" r="9" /></svg>
                         <div style={css('flex:1; font-size:12px; color:#5A3D12; line-height:1.45;')}>
-                          <span style={css(`display:inline-flex; align-items:center; font-family:${MONO}; font-size:9px; font-weight:600; letter-spacing:0.05em; text-transform:uppercase; padding:1px 6px; border-radius:999px; background:#FFFFFF; color:${dc.text}; border:1px solid ${dc.strokeE}; margin-right:2px;`)}>{layerName(d.layer)}</span> says <span style={{ color: 'var(--cc-amber-text2)' }}>"{d.value}"</span> — overridden here.
+                          <span style={css(`display:inline-flex; align-items:center; font-family:${MONO}; font-size:9px; font-weight:600; letter-spacing:0.05em; text-transform:uppercase; padding:1px 6px; border-radius:999px; background:#FFFFFF; color:${dc.text}; border:1px solid ${dc.strokeE}; margin-right:2px;`)}>{d.sourceLayer}</span> says <span style={{ color: 'var(--cc-amber-text2)' }}>"{d.value}"</span> — overridden here.
                         </div>
                         {d.updated && <span style={css(`flex:0 0 auto; font-family:${MONO}; font-size:10px; color:${C.amberText2};`)}>{d.updated}</span>}
                         <OpenFile layer={d.sourceLayer} path={fileFor(d.sourceLayer)} conceptId={concept.id} />
diff --git a/apps/console/src/components/FileTree.keyboard.test.tsx b/apps/console/src/components/FileTree.keyboard.test.tsx
new file mode 100644
index 0000000..db43ff5
--- /dev/null
+++ b/apps/console/src/components/FileTree.keyboard.test.tsx
@@ -0,0 +1,136 @@
+// @vitest-environment jsdom
+//
+// FileTree's own keyboard handling (APG tree pattern) is implemented in JS —
+// not relying on any browser default the way a native `<input type="radio">`
+// does — so unlike radio-group arrow navigation (see Conflicts.test.tsx),
+// jsdom CAN verify it: `onKeyDown` is a plain React handler reacting to a
+// dispatched `keydown` DOM event, trusted or not.
+//
+// A DOM-level accessibility audit flagged this tree as having no working
+// ArrowDown navigation (F22c). Manual verification in a real browser (Chrome,
+// via CDP-level keyboard input) found ArrowDown/ArrowUp/ArrowRight/
+// ArrowLeft/Home/End all already move focus correctly — ArrowDown from the
+// root row landed on its first child ("company" → "company/assets"), and End
+// reached the last visible row. These tests lock that in as a regression
+// guard rather than changing behavior that already works.
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { buildTree, FileTree, flattenTree } from './FileTree'
+import type { LayerFile, LayerFiles } from '../types'
+
+function file(layer: string, rel: string): LayerFile {
+  const name = rel.slice(rel.lastIndexOf('/') + 1)
+  const dot = name.lastIndexOf('.')
+  return {
+    path: `${layer}/${rel}`, name, rel,
+    ext: dot > 0 ? name.slice(dot) : '',
+    kind: 'text', markdown: rel.endsWith('.md'),
+  }
+}
+
+function layer(name: string, rels: string[]): LayerFiles {
+  return {
+    layer: name, kind: 'files', root: `/${name}`, fileCount: rels.length, truncated: false,
+    files: rels.map((rel) => file(name, rel)),
+  }
+}
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+
+function activeRow(): HTMLElement | null {
+  return container.querySelector('[role="treeitem"][tabindex="0"]')
+}
+
+async function press(key: string) {
+  await act(async () => {
+    activeRow()?.dispatchEvent(new KeyboardEvent('keydown', { key, bubbles: true, cancelable: true }))
+  })
+}
+
+describe('FileTree keyboard navigation', () => {
+  it('moves the roving tab stop with ArrowDown/ArrowUp and jumps with Home/End', async () => {
+    const entries = buildTree([layer('vault', ['assets/a.md', 'notes/b.md', 'notes/c.md'])])
+    await act(async () => root.render(
+      <FileTree entries={entries} expandAll selected={null} reveal={null} onSelect={() => {}} layerIds={new Map()} label="Sources" />,
+    ))
+
+    expect(activeRow()?.getAttribute('title')).toBe('vault')
+
+    await press('ArrowDown')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/assets')
+
+    await press('ArrowDown')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/assets/a.md')
+
+    await press('ArrowUp')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/assets')
+
+    await press('End')
+    const visible = flattenTree(entries, () => true)
+    expect(activeRow()?.getAttribute('title')).toBe(visible[visible.length - 1].path)
+
+    await press('Home')
+    expect(activeRow()?.getAttribute('title')).toBe('vault')
+  })
+
+  it('expands/collapses with ArrowRight/ArrowLeft and walks into and back out of a folder', async () => {
+    const entries = buildTree([layer('vault', ['notes/a.md'])])
+    await act(async () => root.render(
+      // Not expandAll: the folder starts collapsed except the layer root itself.
+      <FileTree entries={entries} expandAll={false} selected={null} reveal={null} onSelect={() => {}} layerIds={new Map()} label="Sources" />,
+    ))
+
+    await press('ArrowDown')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/notes')
+    expect(activeRow()?.getAttribute('aria-expanded')).toBe('false')
+
+    // Collapsed dir: ArrowRight expands it in place, without moving focus.
+    await press('ArrowRight')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/notes')
+    expect(activeRow()?.getAttribute('aria-expanded')).toBe('true')
+
+    // Expanded dir: ArrowRight now moves into the first child.
+    await press('ArrowRight')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/notes/a.md')
+
+    // ArrowLeft from a file row walks up to its parent directory.
+    await press('ArrowLeft')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/notes')
+
+    // ArrowLeft on the (still expanded) directory collapses it in place.
+    await press('ArrowLeft')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/notes')
+    expect(activeRow()?.getAttribute('aria-expanded')).toBe('false')
+  })
+
+  it('activates a file with Enter and Space', async () => {
+    const entries = buildTree([layer('vault', ['a.md', 'b.md'])])
+    const selected: string[] = []
+    await act(async () => root.render(
+      <FileTree entries={entries} expandAll selected={null} reveal={null} onSelect={(path) => selected.push(path)} layerIds={new Map()} label="Sources" />,
+    ))
+
+    await press('ArrowDown')
+    expect(activeRow()?.getAttribute('title')).toBe('vault/a.md')
+    await press('Enter')
+    expect(selected).toEqual(['vault/a.md'])
+
+    await press('ArrowDown')
+    await press(' ')
+    expect(selected).toEqual(['vault/a.md', 'vault/b.md'])
+  })
+})
diff --git a/apps/console/src/components/IndexingSettings.test.tsx b/apps/console/src/components/IndexingSettings.test.tsx
index f23f05a..fabc2a2 100644
--- a/apps/console/src/components/IndexingSettings.test.tsx
+++ b/apps/console/src/components/IndexingSettings.test.tsx
@@ -121,4 +121,23 @@ describe('IndexingSettings', () => {
 
     expect(container.textContent).toContain('running ContextCake engine')
   })
+
+  it('labels a millisecond setting with its unit and a human-scale reading, and leaves a count setting alone', async () => {
+    await act(async () => root.render(<IndexingSettings />))
+
+    // sourceBudgetMs (30000 in the default payload): unitless before this fix.
+    expect(field('sourceBudgetMs').nextElementSibling?.textContent).toBe('ms')
+    expect(container.textContent).toContain('30000 ms = 30 sec')
+
+    // maxDocFiles is a count, not a duration — no unit, no invented reading.
+    expect(field('maxDocFiles').nextElementSibling).toBeNull()
+    expect(container.textContent).not.toContain('10000 ms')
+  })
+
+  it('updates the human-scale reading as the field is edited', async () => {
+    await act(async () => root.render(<IndexingSettings />))
+
+    await type(field('sourceBudgetMs'), '120000')
+    expect(container.textContent).toContain('120000 ms = 2 min')
+  })
 })
diff --git a/apps/console/src/components/IndexingSettings.tsx b/apps/console/src/components/IndexingSettings.tsx
index b1d3738..2969f14 100644
--- a/apps/console/src/components/IndexingSettings.tsx
+++ b/apps/console/src/components/IndexingSettings.tsx
@@ -18,6 +18,26 @@ function format(n: number): string {
   return String(n)
 }
 
+/** Whether a setting's stored unit is milliseconds — its key names that, e.g. `sourceBudgetMs`. */
+function isMillisecondSetting(key: string): boolean {
+  return key.endsWith('Ms')
+}
+
+/**
+ * "120000 ms = 2 min" — the human-scale reading beside the raw number. The
+ * engine's catalog (settings.mjs) supplies `label`/`help` and never a unit or
+ * a friendlier scale, so that reading is computed here rather than asking the
+ * engine to speak console-specific UI copy.
+ */
+function humanizeMs(ms: number): string | null {
+  if (!Number.isFinite(ms) || ms < 0) return null
+  const round = (n: number) => Math.round(n * 10) / 10
+  if (ms < 1000) return `${ms} ms`
+  if (ms < 60_000) return `${round(ms / 1000)} sec`
+  if (ms < 3_600_000) return `${round(ms / 60_000)} min`
+  return `${round(ms / 3_600_000)} hr`
+}
+
 export function IndexingSettings({ onChanged }: { onChanged?: () => void }) {
   const [payload, setPayload] = useState<SettingsPayload | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
@@ -101,6 +121,9 @@ export function IndexingSettings({ onChanged }: { onChanged?: () => void }) {
         {payload.catalog.map((def) => {
           const row = rows[def.key]
           const isDefault = payload.stored[def.key] === undefined
+          const isMs = isMillisecondSetting(def.key)
+          const rowValue = row ? Number(row.value) : NaN
+          const humanized = isMs && Number.isFinite(rowValue) ? humanizeMs(rowValue) : null
           return (
             <div key={def.key} className="cc-settings-row">
               <div>
@@ -108,6 +131,7 @@ export function IndexingSettings({ onChanged }: { onChanged?: () => void }) {
                   <label htmlFor={`cc-set-${def.key}`}>{def.label}</label>
                 </strong>
                 <span>{def.help}</span>
+                {humanized && <p className="cc-settings-hint">{row?.value} ms = {humanized}</p>}
                 {row?.error && <p className="cc-settings-rowerr">{row.error}</p>}
               </div>
               <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
@@ -120,19 +144,23 @@ export function IndexingSettings({ onChanged }: { onChanged?: () => void }) {
                     title={`Reset to the default (${def.default.toLocaleString()})`}
                   >Reset</button>
                 )}
-                <input
-                  id={`cc-set-${def.key}`}
-                  className="cc-settings-number"
-                  type="number"
-                  inputMode="numeric"
-                  min={def.min}
-                  max={def.max}
-                  value={row?.value ?? ''}
-                  disabled={row?.saving}
-                  onChange={(e) => setRow(def.key, { value: e.target.value, error: null })}
-                  onBlur={() => save(def)}
-                  onKeyDown={(e) => { if (e.key === 'Enter') (e.target as HTMLInputElement).blur() }}
-                />
+                <div style={{ display: 'flex', alignItems: 'center', gap: 6 }}>
+                  <input
+                    id={`cc-set-${def.key}`}
+                    className="cc-settings-number"
+                    type="number"
+                    inputMode="numeric"
+                    min={def.min}
+                    max={def.max}
+                    aria-describedby={isMs ? `cc-set-${def.key}-unit` : undefined}
+                    value={row?.value ?? ''}
+                    disabled={row?.saving}
+                    onChange={(e) => setRow(def.key, { value: e.target.value, error: null })}
+                    onBlur={() => save(def)}
+                    onKeyDown={(e) => { if (e.key === 'Enter') (e.target as HTMLInputElement).blur() }}
+                  />
+                  {isMs && <span id={`cc-set-${def.key}-unit`} className="cc-settings-unit">ms</span>}
+                </div>
               </div>
             </div>
           )
diff --git a/apps/console/src/components/SettingsView.tsx b/apps/console/src/components/SettingsView.tsx
index 91a185d..181a11e 100644
--- a/apps/console/src/components/SettingsView.tsx
+++ b/apps/console/src/components/SettingsView.tsx
@@ -83,6 +83,12 @@ export function SettingsView({ appMode, onClose, onIndexingChange, surface = 'ov
     const root = rootRef.current
     focusables(root)[0]?.focus()
     const onKey = (event: KeyboardEvent) => {
+      // The shell's own Escape handler (App.tsx) already closes Settings and
+      // calls preventDefault() when settingsOpen — without this check, both
+      // handlers ran on every Escape press (confirmed in real Chrome), so
+      // onClose() fired twice and the focus-restore hook had to be made
+      // idempotent to tolerate it (see useOpenerFocus.ts).
+      if (event.defaultPrevented) return
       if (event.key === 'Escape') { event.preventDefault(); onClose?.(); return }
       if (event.key !== 'Tab') return
       const items = focusables(root)
diff --git a/apps/console/src/components/SetupWizard.test.tsx b/apps/console/src/components/SetupWizard.test.tsx
index a3c86c0..d101219 100644
--- a/apps/console/src/components/SetupWizard.test.tsx
+++ b/apps/console/src/components/SetupWizard.test.tsx
@@ -606,6 +606,39 @@ describe('SetupWizard add-a-source mode', () => {
     expect(container.querySelector('#wiz-add-level')?.textContent).toBe('3')
   })
 
+  // F22b: `role="radio"` buttons get no native arrow-key behavior — unlike a
+  // real `<input type="radio">`, there is no browser default for the browser
+  // to run — so ChoiceCards implements the APG roving-tabindex pattern by
+  // hand. Selection follows focus and only the selected card is a tab stop.
+  it('moves the source-kind selection with ArrowDown/ArrowRight and ArrowUp/ArrowLeft, wrapping at the ends', async () => {
+    await act(async () => root.render(<SetupWizard addingSource onClose={vi.fn()} />))
+
+    expect(sourceChoice('Markdown folder').getAttribute('tabindex')).toBe('0')
+    expect(sourceChoice('ContextCake folder').getAttribute('tabindex')).toBe('-1')
+
+    await act(async () => sourceChoice('Markdown folder').dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowDown', bubbles: true, cancelable: true })))
+    expect(sourceChoice('ContextCake folder').getAttribute('aria-checked')).toBe('true')
+    expect(sourceChoice('ContextCake folder').getAttribute('tabindex')).toBe('0')
+    expect(sourceChoice('Markdown folder').getAttribute('tabindex')).toBe('-1')
+    expect(document.activeElement).toBe(sourceChoice('ContextCake folder'))
+
+    // ArrowRight is the same direction as ArrowDown for this vertically
+    // stacked group, twice more to reach MCP server (index 3, wrapping never
+    // triggered yet).
+    await act(async () => sourceChoice('ContextCake folder').dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowRight', bubbles: true, cancelable: true })))
+    await act(async () => sourceChoice('GitHub repo').dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowRight', bubbles: true, cancelable: true })))
+    expect(sourceChoice('MCP server').getAttribute('aria-checked')).toBe('true')
+
+    // Past the last choice, ArrowDown wraps back to the first.
+    await act(async () => sourceChoice('MCP server').dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowDown', bubbles: true, cancelable: true })))
+    expect(sourceChoice('Markdown folder').getAttribute('aria-checked')).toBe('true')
+    expect(document.activeElement).toBe(sourceChoice('Markdown folder'))
+
+    // And ArrowUp from the first wraps back to the last.
+    await act(async () => sourceChoice('Markdown folder').dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowUp', bubbles: true, cancelable: true })))
+    expect(sourceChoice('MCP server').getAttribute('aria-checked')).toBe('true')
+  })
+
   it('accepts a second repo beside team under its own name (EARS)', async () => {
     await act(async () => root.render(<SetupWizard addingSource onClose={vi.fn()} />))
 
diff --git a/apps/console/src/components/SetupWizard.tsx b/apps/console/src/components/SetupWizard.tsx
index ff071e8..411ce19 100644
--- a/apps/console/src/components/SetupWizard.tsx
+++ b/apps/console/src/components/SetupWizard.tsx
@@ -345,7 +345,16 @@ function errorLine(message: string): React.ReactNode {
   return <p role="alert" style={css('margin:0; font-size:12px; color:var(--cc-amber-text); overflow-wrap:anywhere;')}>{message}</p>
 }
 
-/** Generic radio-card group (kind pickers, repo access). */
+/**
+ * Generic radio-card group (kind pickers, repo access). `role="radio"`
+ * buttons get no native arrow-key behavior — unlike real `<input
+ * type="radio">`s, the browser has nothing to do that for — so this
+ * implements the APG roving-tabindex pattern by hand: ArrowDown/ArrowRight
+ * moves to the next card (wrapping), ArrowUp/ArrowLeft to the previous, and
+ * selection follows focus. Only the selected card is a tab stop; the rest
+ * are reachable by arrow key once inside the group, same contract the file
+ * tree and the discrepancy list already use.
+ */
 function ChoiceCards<T extends string>({
   value, onChange, choices, label,
 }: {
@@ -354,8 +363,17 @@ function ChoiceCards<T extends string>({
   choices: Array<{ value: T; title: string; detail: string; badge?: string }>
   label: string
 }) {
+  const onKeyDown = (event: React.KeyboardEvent<HTMLDivElement>) => {
+    if (!['ArrowDown', 'ArrowRight', 'ArrowUp', 'ArrowLeft'].includes(event.key)) return
+    event.preventDefault()
+    const index = Math.max(0, choices.findIndex((choice) => choice.value === value))
+    const delta = event.key === 'ArrowDown' || event.key === 'ArrowRight' ? 1 : -1
+    const next = choices[(index + delta + choices.length) % choices.length]
+    onChange(next.value)
+    event.currentTarget.querySelector<HTMLButtonElement>(`[value="${next.value}"]`)?.focus()
+  }
   return (
-    <div role="radiogroup" aria-label={label} style={css('display:grid; gap:8px;')}>
+    <div role="radiogroup" aria-label={label} onKeyDown={onKeyDown} style={css('display:grid; gap:8px;')}>
       {choices.map((choice) => {
         const selected = value === choice.value
         return (
@@ -363,7 +381,9 @@ function ChoiceCards<T extends string>({
             key={choice.value}
             type="button"
             role="radio"
+            value={choice.value}
             aria-checked={selected}
+            tabIndex={selected ? 0 : -1}
             onClick={() => onChange(choice.value)}
             style={css(`display:grid; grid-template-columns:16px minmax(0,1fr); gap:10px; width:100%; padding:11px 12px; text-align:left; border-radius:10px; border:1px solid ${selected ? C.tealStroke : C.line}; background:${selected ? C.tealFill : C.surface}; color:${C.ink}; cursor:pointer; font:inherit; transition:border-color 150ms ease, background 150ms ease;`)}
           >
@@ -694,7 +714,10 @@ export function SetupWizard({
   const dialogRef = useRef<HTMLDivElement>(null)
 
   useEffect(() => {
-    const onKey = (e: KeyboardEvent) => { if (e.key === 'Escape') onClose() }
+    // Matches the defaultPrevented-first convention used everywhere else a
+    // shell-level and a dialog-level Escape handler could otherwise both act
+    // on the same keypress (see SettingsView's identical guard).
+    const onKey = (e: KeyboardEvent) => { if (!e.defaultPrevented && e.key === 'Escape') onClose() }
     window.addEventListener('keydown', onKey)
     return () => window.removeEventListener('keydown', onKey)
   }, [onClose])
diff --git a/apps/console/src/components/useOpenerFocus.ts b/apps/console/src/components/useOpenerFocus.ts
new file mode 100644
index 0000000..df544a8
--- /dev/null
+++ b/apps/console/src/components/useOpenerFocus.ts
@@ -0,0 +1,62 @@
+import { useCallback, useMemo, useRef } from 'react'
+
+const FOCUSABLE_SELECTOR = 'button, a[href], input, select, textarea, [tabindex]:not([tabindex="-1"])'
+
+/**
+ * Focus-return for an imperatively opened dialog (Settings, the setup
+ * wizard): `capture()` at the moment the dialog is told to open — before the
+ * state flip, while `document.activeElement` is still the trigger — and
+ * `restore()` right after the state flip that closes it.
+ *
+ * The opener is not always still there to focus: the wizard can auto-open
+ * with no button at all (first run), and any trigger can have scrolled out
+ * of the viewport or been unmounted underneath a still-open dialog. `restore`
+ * walks the captured opener first, then `fallbackSelectors` in order, and
+ * focuses the first candidate that is connected, focusable, and actually
+ * visible (a zero-size node is read as "not yet laid out" rather than
+ * hidden, so it is not excluded on that basis alone) — never <body>.
+ */
+export function useOpenerFocus(fallbackSelectors: readonly string[] = []) {
+  const openerRef = useRef<HTMLElement | null>(null)
+  // Separate from openerRef because `null` there is itself a valid captured
+  // state (no focusable activeElement, or the wizard's no-trigger first-run
+  // open) that still means "run the fallback search". This flag is what
+  // makes restore() idempotent: a real-Chrome repro found Settings closing
+  // via Escape called restore() TWICE — the shell's own Escape handler closes
+  // it, and SettingsView's internal Escape handler (fixed alongside this to
+  // check event.defaultPrevented) fired too. The first call reads the real
+  // opener and schedules a focus() for it; the second, with openerRef already
+  // nulled, fell through to the generic fallback selectors and — because
+  // rAF preserves scheduling order — its focus() ran *after* the first and
+  // silently overrode the correct target with the wrong one (or, once the
+  // fallback matched nothing at all in the ADD Source case, left focus on
+  // <body>). Gating on `pendingRef` makes a second, spurious restore() a
+  // no-op instead of a second, competing guess.
+  const pendingRef = useRef(false)
+
+  const capture = useCallback(() => {
+    openerRef.current = document.activeElement instanceof HTMLElement ? document.activeElement : null
+    pendingRef.current = true
+  }, [])
+
+  const restore = useCallback(() => {
+    if (!pendingRef.current) return
+    pendingRef.current = false
+    const opener = openerRef.current
+    openerRef.current = null
+    window.requestAnimationFrame(() => {
+      const candidates = [opener, ...fallbackSelectors.map((selector) => document.querySelector<HTMLElement>(selector))]
+      candidates.find((candidate) => {
+        if (!candidate?.isConnected) return false
+        if (!candidate.matches(FOCUSABLE_SELECTOR)) return false
+        const rect = candidate.getBoundingClientRect()
+        const hasNoLayout = rect.width === 0 && rect.height === 0
+        const visible = hasNoLayout || (rect.width > 0 && rect.height > 0 && rect.right > 0 && rect.bottom > 0 && rect.left < window.innerWidth && rect.top < window.innerHeight)
+        if (visible) candidate.focus()
+        return visible
+      })
+    })
+  }, [fallbackSelectors])
+
+  return useMemo(() => ({ capture, restore }), [capture, restore])
+}
diff --git a/apps/console/src/data.ts b/apps/console/src/data.ts
index dcac85b..c27737b 100644
--- a/apps/console/src/data.ts
+++ b/apps/console/src/data.ts
@@ -79,6 +79,13 @@ export interface Conflict {
   ruleConflict?: boolean
   target?: string
   affectedLinks?: string[]
+  /**
+   * True when any raw contribution behind this discrepancy is an array-typed
+   * frontmatter value (a list field). The engine 400s a compose against such
+   * a field (service.mjs), so the UI disables the compose disposition rather
+   * than letting the request round-trip into an error.
+   */
+  isList?: boolean
 }
 
 /** `sourceLayer` is the source's real name; `layer` is the lane it renders in. */
@@ -100,6 +107,13 @@ export interface ConceptSection {
 export interface Concept {
   id: string; title: string; type: string; layers: LayerId[]
   conflict?: boolean; draft?: boolean; sections: ConceptSection[]
+  /**
+   * The real source names behind this concept, winner first — kept
+   * separately from `layers` (the three-lane buckets) because a concept with
+   * zero sections has no `ConceptSection.sourceLayer` to read a contributor's
+   * real name from, and the "Open file" affordance needs one anyway.
+   */
+  contributorLayers?: string[]
 }
 
 export interface Activity {
diff --git a/apps/console/src/shell-navigation.ts b/apps/console/src/shell-navigation.ts
index 0427853..b11e07c 100644
--- a/apps/console/src/shell-navigation.ts
+++ b/apps/console/src/shell-navigation.ts
@@ -97,6 +97,21 @@ export function dispatchNavigationGuard(): boolean {
 
 export const SEARCHABLE_VIEWS = new Set<ViewId>(['concepts', 'files', 'sources', 'triage', 'conflicts'])
 
+/** Per-view document title, same names the command palette's "Go to …" entries use. */
+export const VIEW_TITLES: Record<ViewId, string> = {
+  overview: 'Home',
+  canvas: 'Cascade',
+  concepts: 'Knowledge: Concepts',
+  files: 'Knowledge: Files',
+  sources: 'Sources',
+  triage: 'Review: Queue',
+  conflicts: 'Review: Discrepancies',
+}
+
+export function titleForView(view: ViewId): string {
+  return `${VIEW_TITLES[view]} — ContextCake`
+}
+
 export function readBrowserGroupedViews(): { knowledgeView: KnowledgeSubview; reviewView: ReviewSubview } {
   try {
     return {
diff --git a/apps/console/src/store.test.tsx b/apps/console/src/store.test.tsx
index 2fbb79f..c77feb2 100644
--- a/apps/console/src/store.test.tsx
+++ b/apps/console/src/store.test.tsx
@@ -259,6 +259,11 @@ describe('store load state', () => {
       // Generation moves every tick (the engine counts documents into it), but
       // nothing that decides the payload changes until the snapshot lands.
       mocks.status
+        // Consumed by the WP-B bootstrap probe, immediately after readAll()
+        // commits — same generation and shape readAll() itself just saw, so
+        // the probe is a no-op and the three progress-only ticks below still
+        // land on the recurring poll() exactly as before.
+        .mockResolvedValueOnce(statusPayload({ generation: 1, indexing: true, loaded: 0, total: 3000 }))
         .mockResolvedValueOnce(statusPayload({ generation: 2, indexing: true, loaded: 400, total: 3000 }))
         .mockResolvedValueOnce(statusPayload({ generation: 3, indexing: true, loaded: 900, total: 3000 }))
         .mockResolvedValueOnce(statusPayload({ generation: 4, indexing: true, loaded: 1800, total: 3000 }))
@@ -354,19 +359,23 @@ describe('store load state', () => {
       expect(probe().dataset.count).toBe('1')
     })
 
-    it('stops polling while the window is hidden and resumes when it comes back', async () => {
-      mocks.graph.mockResolvedValue(graphPayload(['personal']))
-      mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: true, indexingSources: ['personal'] })
-      mocks.status.mockResolvedValue(statusPayload({ generation: 2, indexing: true, loaded: 10, total: 3000 }))
+    it('stops polling while the window is hidden when nothing is active, and resumes when it comes back', async () => {
+      // The cost optimization this pins: a hidden tab with nothing in flight
+      // must stay silent, exactly as before FIX 3 — only a hidden tab with
+      // real work active gets the new slower-but-still-polling behavior
+      // (see the next test).
+      mocks.graph.mockResolvedValue(graphPayload([]))
+      mocks.resolveAll.mockResolvedValue({ concepts: [conceptPayload('a')], errors: [], indexing: false })
+      mocks.status.mockResolvedValue(statusPayload({ generation: 2, indexing: false, conceptCount: 1 }))
 
       await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
-      await act(async () => { await vi.advanceTimersByTimeAsync(2_000) })
+      await act(async () => { await vi.advanceTimersByTimeAsync(11_000) })
       const whileVisible = mocks.status.mock.calls.length
       expect(whileVisible).toBeGreaterThan(0)
 
       const visibility = vi.spyOn(document, 'visibilityState', 'get').mockReturnValue('hidden')
       await act(async () => document.dispatchEvent(new Event('visibilitychange')))
-      await act(async () => { await vi.advanceTimersByTimeAsync(10_000) })
+      await act(async () => { await vi.advanceTimersByTimeAsync(30_000) })
       expect(mocks.status.mock.calls.length).toBe(whileVisible)
 
       visibility.mockReturnValue('visible')
@@ -375,6 +384,177 @@ describe('store load state', () => {
       expect(mocks.status.mock.calls.length).toBeGreaterThan(whileVisible)
       visibility.mockRestore()
     })
+
+    // FIX 3(a): schedule() used to be a flat no-op while hidden, so a
+    // backgrounded tab that was still indexing when it went hidden (or that
+    // started out hidden — see the WP-B bootstrap-probe test below) had
+    // nothing left to resume it, possibly forever. Real work in flight now
+    // keeps the loop polling through a hidden window, just at
+    // HIDDEN_ACTIVE_POLL_MS instead of the visible ACTIVE_POLL_MS cadence.
+    it('keeps polling, slower, while hidden when work is active — and recovers once the engine finishes', async () => {
+      mocks.graph.mockResolvedValue(graphPayload(['personal']))
+      mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: true, indexingSources: ['personal'] })
+      mocks.status.mockResolvedValue(statusPayload({ generation: 2, indexing: true, loaded: 10, total: 3000 }))
+
+      await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
+      await act(async () => { await vi.advanceTimersByTimeAsync(2_000) })
+      expect(probe().dataset.indexing).toBe('personal')
+
+      const visibility = vi.spyOn(document, 'visibilityState', 'get').mockReturnValue('hidden')
+      await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+      const whileHiddenStart = mocks.status.mock.calls.length
+
+      // Well past the visible cadence (900ms) but short of the hidden-active
+      // one: if hiding failed to slow the loop down, a poll would already
+      // have landed here.
+      await act(async () => { await vi.advanceTimersByTimeAsync(3_000) })
+      expect(mocks.status.mock.calls.length).toBe(whileHiddenStart)
+
+      // The engine finishes indexing while the tab is still hidden. FIX 3:
+      // the heavy graph+resolve-all refetch this would otherwise trigger is
+      // deferred while hidden — see the dedicated FIX 3 test below for the
+      // call-count proof. Only the cheap status signal lands here.
+      mocks.resolveAll.mockResolvedValue({ concepts: [conceptPayload('a')], errors: [], indexing: false })
+      mocks.status.mockResolvedValue(statusPayload({ generation: 9, indexing: false, conceptCount: 1 }))
+      await act(async () => { await vi.advanceTimersByTimeAsync(5_000) })
+
+      expect(mocks.status.mock.calls.length).toBeGreaterThan(whileHiddenStart)
+      // The status route's own indexingSources answers directly, independent
+      // of the deferred heavy refetch — a hidden tab still learns indexing is
+      // done without downloading the corpus to prove it.
+      expect(probe().dataset.indexing).toBe('')
+      // The resolved concept count is the deferred half: still stale.
+      expect(probe().dataset.count).toBe('0')
+
+      // Once idle (nothing active) AND still hidden, the loop goes fully
+      // silent — confirming the hidden polling wound back down rather than
+      // persisting after work finished.
+      const afterRecovery = mocks.status.mock.calls.length
+      await act(async () => { await vi.advanceTimersByTimeAsync(20_000) })
+      expect(mocks.status.mock.calls.length).toBe(afterRecovery)
+
+      // Returning to visible lands the deferred catch-up.
+      visibility.mockReturnValue('visible')
+      await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+      await act(async () => { await vi.advanceTimersByTimeAsync(50) })
+      expect(probe().dataset.count).toBe('1')
+
+      visibility.mockRestore()
+    })
+
+    // FIX 3: /api/graph and /api/resolve-all are the 620ms/150MB-on-a-real-vault
+    // payloads (see CLAUDE.md); a hidden tab has nobody to show them to. This
+    // pins the call counts directly, rather than through a derived dataset
+    // value, so a regression here fails on the exact thing that was expensive.
+    it('issues zero heavy payload calls while hidden, then exactly one catch-up refetch on return to visible (FIX 3)', async () => {
+      mocks.graph.mockResolvedValue(graphPayload(['personal']))
+      mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: true, indexingSources: ['personal'] })
+      mocks.status.mockResolvedValue(statusPayload({ generation: 2, indexing: true, loaded: 10, total: 3000 }))
+
+      await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
+      await act(async () => { await vi.advanceTimersByTimeAsync(2_000) })
+
+      const visibility = vi.spyOn(document, 'visibilityState', 'get').mockReturnValue('hidden')
+      await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+      const graphAtHidden = mocks.graph.mock.calls.length
+      const resolveAllAtHidden = mocks.resolveAll.mock.calls.length
+
+      // The snapshot lands while hidden: generation moves and indexing flips
+      // to done — exactly the condition that would normally earn a heavy
+      // refetch.
+      mocks.status.mockResolvedValue(statusPayload({ generation: 9, indexing: false, conceptCount: 1 }))
+      await act(async () => { await vi.advanceTimersByTimeAsync(20_000) })
+
+      expect(mocks.graph.mock.calls.length).toBe(graphAtHidden)
+      expect(mocks.resolveAll.mock.calls.length).toBe(resolveAllAtHidden)
+
+      mocks.resolveAll.mockResolvedValue({ concepts: [conceptPayload('a')], errors: [], indexing: false })
+      visibility.mockReturnValue('visible')
+      await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+      await act(async () => { await vi.advanceTimersByTimeAsync(50) })
+
+      expect(mocks.graph.mock.calls.length).toBe(graphAtHidden + 1)
+      expect(mocks.resolveAll.mock.calls.length).toBe(resolveAllAtHidden + 1)
+      expect(probe().dataset.count).toBe('1')
+      expect(probe().dataset.indexing).toBe('')
+
+      visibility.mockRestore()
+    })
+
+    // FIX 2: a failed pass tells us nothing about whether work is active, so
+    // it must not keep a hidden tab polling off a stale `activeState === true`
+    // from the last successful pass. Measured before this fix: 85 failed
+    // fetches in 10 simulated hidden minutes, no termination.
+    it('stops polling in a hidden tab once the engine starts failing, even though it was active a moment ago (FIX 2)', async () => {
+      mocks.graph.mockResolvedValue(graphPayload(['personal']))
+      mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: true, indexingSources: ['personal'] })
+      mocks.status.mockResolvedValue(statusPayload({ generation: 2, indexing: true, loaded: 10, total: 3000 }))
+
+      await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
+      await act(async () => { await vi.advanceTimersByTimeAsync(2_000) })
+      expect(probe().dataset.indexing).toBe('personal')
+
+      const visibility = vi.spyOn(document, 'visibilityState', 'get').mockReturnValue('hidden')
+      await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+
+      // The engine dies while the tab is hidden and stays dead.
+      mocks.status.mockRejectedValue(new Error('engine gone'))
+      const beforeFailures = mocks.status.mock.calls.length
+
+      // The already-scheduled hidden-active tick fires once, fails, and (per
+      // the fix) must not reschedule itself while hidden.
+      await act(async () => { await vi.advanceTimersByTimeAsync(10_000) })
+      const afterOneFailure = mocks.status.mock.calls.length
+      expect(afterOneFailure).toBeGreaterThan(beforeFailures)
+
+      // Simulates the full 10-minutes-hidden repro: nothing more should fire.
+      await act(async () => { await vi.advanceTimersByTimeAsync(600_000) })
+      expect(mocks.status.mock.calls.length).toBe(afterOneFailure)
+
+      visibility.mockRestore()
+    })
+
+    // WP-B: a page that first renders hidden (an embedded webview can
+    // misreport visibility) never gets a recurring poll at all — schedule()
+    // is a no-op while hidden, and nothing resumes the loop until
+    // visibilitychange fires. Without a probe that ignores hidden(), a page
+    // that loaded mid-index would sit on that stuck snapshot forever with no
+    // way to notice the engine actually finished.
+    it('probes /api/status once at bootstrap even when the page starts hidden, and recovers a stuck initial snapshot once visible', async () => {
+      const visibility = vi.spyOn(document, 'visibilityState', 'get').mockReturnValue('hidden')
+      try {
+        mocks.graph.mockResolvedValue(graphPayload(['personal']))
+        mocks.resolveAll
+          .mockResolvedValueOnce({ concepts: [], errors: [], indexing: true, indexingSources: ['personal'] })
+          .mockResolvedValue({ concepts: [conceptPayload('a')], errors: [], indexing: false })
+        // The engine actually finished by the time this page loaded — status
+        // disagrees with the graph's still-indexing snapshot from readAll().
+        mocks.status.mockResolvedValue(statusPayload({ generation: 9, indexing: false, conceptCount: 1 }))
+
+        await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
+
+        // Exactly one status call: the bootstrap probe. schedule() is a
+        // no-op while hidden, so nothing else could have called it.
+        expect(mocks.status.mock.calls.length).toBe(1)
+        // The status route's own indexingSources answers directly — a hidden
+        // tab learns indexing is done without the heavy refetch.
+        expect(probe().dataset.indexing).toBe('')
+        // FIX 3: the correction this probe would otherwise fetch immediately
+        // is deferred while hidden — count is still the stale readAll()
+        // snapshot from before the mismatch was noticed.
+        expect(probe().dataset.count).toBe('0')
+        expect(mocks.resolveAll.mock.calls.length).toBe(1)
+
+        // Becoming visible lands the deferred catch-up.
+        visibility.mockReturnValue('visible')
+        await act(async () => document.dispatchEvent(new Event('visibilitychange')))
+        await act(async () => { await vi.advanceTimersByTimeAsync(50) })
+        expect(mocks.resolveAll.mock.calls.length).toBe(2)
+        expect(probe().dataset.count).toBe('1')
+      } finally {
+        visibility.mockRestore()
+      }
+    })
   })
 
   it('does not treat an empty mid-index pass as a fatal error', async () => {
@@ -444,6 +624,19 @@ describe('store load state', () => {
   })
 })
 
+describe('document title', () => {
+  it('names the current view, and updates when the view changes', async () => {
+    mocks.graph.mockResolvedValue(graphPayload([]))
+    mocks.resolveAll.mockResolvedValue({ concepts: [], errors: [], indexing: false })
+
+    await act(async () => root.render(<StoreProvider><Probe /></StoreProvider>))
+    expect(document.title).toBe('Home — ContextCake')
+
+    await click('to sources')
+    expect(document.title).toBe('Sources — ContextCake')
+  })
+})
+
 // ---- Back/Forward vs. an unsaved file --------------------------------------
 //
 // Real session-history traversal, not a synthesized PopStateEvent: what these
diff --git a/apps/console/src/store.tsx b/apps/console/src/store.tsx
index 0b7edb1..754bad6 100644
--- a/apps/console/src/store.tsx
+++ b/apps/console/src/store.tsx
@@ -6,15 +6,15 @@ import {
   type Activity, type Concept, type Conflict, type Signal, type Source,
 } from './data'
 import {
-  adaptConcept, adaptConflicts, adaptDiscrepancies, adaptSources, createDataSource, LiveDataError, mergeSourceStatus,
+  adaptConcept, adaptConflicts, adaptDiscrepancies, adaptSources, computeLevelBuckets, createDataSource, LiveDataError, mergeSourceStatus,
   type Mode,
 } from './api'
 import type {
   DiscrepancyDecisionRequest, DiscrepancyRule, DiscrepancyRuleSuggestion,
-  GraphSummary, SourceStatus,
+  GraphSummary, SearchHit, SourceStatus, StatusSummary,
 } from './types'
 import type { LayerId, RouteId } from './theme'
-import { dispatchNavigationGuard, filesHash, isViewId, parseHash, type ViewId } from './shell-navigation'
+import { dispatchNavigationGuard, filesHash, isViewId, parseHash, titleForView, type ViewId } from './shell-navigation'
 
 export type { ViewId } from './shell-navigation'
 export type TriageTab = 'review' | 'captured' | 'ignored'
@@ -147,6 +147,18 @@ const ACTIVE_POLL_MS = 900
 const IDLE_POLL_MS = 5_000
 /** Backoff ceiling. There is deliberately no failure count that stops the loop. */
 const MAX_BACKOFF_MS = 5_000
+/**
+ * Cadence for a HIDDEN tab while the engine reports work in flight (indexing
+ * or refreshing). A hidden tab still goes fully silent once nothing is
+ * active — that cost optimization stays exactly as before — but a hidden tab
+ * that landed on a still-indexing snapshot used to have nothing left to
+ * resume it until visibilitychange fired, which could be never (a
+ * backgrounded tab the user doesn't return to for minutes). /api/status
+ * answers in 2-4ms, so ~8x the active cadence is cheap enough to run
+ * unattended and still finishes a bounded indexing pass in single-digit
+ * seconds instead of stalling indefinitely.
+ */
+const HIDDEN_ACTIVE_POLL_MS = 7_000
 
 /**
  * The part of the engine's status that decides what /api/graph and
@@ -232,6 +244,15 @@ export interface StoreData {
   /** Go to Concepts on one concept — the cross-link from the file behind it. */
   openConcept: (id: string) => void
   setQuery: (q: string) => void
+  /**
+   * Full-text search over section content (GET /api/search), for Knowledge's
+   * search box. Live mode only — callers gate on `mode` themselves; calling
+   * this in demo mode is a caller bug, not handled here. Never throws: a
+   * missing route or any other failure (network, timeout, malformed body)
+   * resolves to `null`, the signal to fall back to the substring filter
+   * silently rather than break the list.
+   */
+  search: (query: string, limit?: number) => Promise<SearchHit[] | null>
   openChat: () => void
   closeChat: () => void
   setChatInput: (v: string) => void
@@ -410,17 +431,36 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     // thing that knows what is in flight — and the shell needs to say so from
     // the first paint, not from the first poll a second later.
     let statusAnswered = false
+    // The last `active` a poll/bootstrap pass computed. Read by onVisibility
+    // to decide whether hiding the tab should stop the loop or just slow it
+    // down — see schedule() below.
+    let activeState = false
 
     const hidden = () => typeof document !== 'undefined' && document.visibilityState === 'hidden'
     const clearTimer = () => { if (timer !== undefined) { clearTimeout(timer); timer = undefined } }
-    const schedule = (ms: number) => {
+    /**
+     * `active` says whether the engine reported work in flight on the pass
+     * that's scheduling this tick — not just "not hidden". A hidden window
+     * with nothing active has nobody to tell, and visibilitychange resumes
+     * the loop when that changes — that cost optimization is unchanged. But
+     * a hidden window with work ACTIVE keeps polling anyway, at
+     * HIDDEN_ACTIVE_POLL_MS: without this, a tab that went hidden (or was
+     * hidden from first paint — see bootstrap's probe) while the engine was
+     * still indexing had nothing left to resume it, possibly forever.
+     * Demo mode has no engine behind it and nothing that can change either
+     * way.
+     */
+    const schedule = (ms: number, active = false) => {
       clearTimer()
-      // A hidden window has nobody to tell; visibilitychange resumes the loop.
-      // Demo mode has no engine behind it and nothing that can change.
-      if (cancelled || hidden() || source.mode === 'demo') return
-      // Re-checked on fire, not only on schedule: a tick queued a moment before
-      // the window was hidden would otherwise still land.
-      timer = setTimeout(() => { if (!hidden()) void poll() }, ms)
+      if (cancelled || source.mode === 'demo') return
+      if (hidden()) {
+        if (!active) return
+        ms = Math.max(ms, HIDDEN_ACTIVE_POLL_MS)
+      }
+      // Re-checked on fire, not only on schedule: a tick queued a moment
+      // before the window was hidden would otherwise still land — unless
+      // this tick was itself scheduled to keep running while hidden.
+      timer = setTimeout(() => { if (!hidden() || active) void poll() }, ms)
     }
 
     const applyIndexing = (next: string[]) => {
@@ -470,10 +510,16 @@ export function StoreProvider({ children }: { children: ReactNode }) {
       // can finish between them; use the later answer so a stale graph never
       // leaves the banner running after the work has landed.
       applyIndexing(indexing ? (resolvingSources ?? g.indexingSources ?? []) : [])
-      setConcepts(raw.map(adaptConcept))
+      // Rank-based level→lane buckets for this pass, computed once from every
+      // source in the graph and threaded through every adapter below — see
+      // computeLevelBuckets in api.ts for why a narrower computation (e.g. per
+      // concept) would bucket the same source differently depending on what
+      // happened to touch it.
+      const buckets = computeLevelBuckets(g.sources.map((s) => s.level))
+      setConcepts(raw.map((c) => adaptConcept(c, buckets)))
       const derivedConflicts = discrepancyPayload
-        ? adaptDiscrepancies(discrepancyPayload.discrepancies, discrepancyPayload.coverageComplete)
-        : adaptConflicts(raw, resolutionHistory)
+        ? adaptDiscrepancies(discrepancyPayload.discrepancies, discrepancyPayload.coverageComplete, buckets)
+        : adaptConflicts(raw, resolutionHistory, buckets)
       setConflicts(derivedConflicts)
       setDiscrepancyRules(rulePayload.rules)
       setDiscrepancyRuleSuggestions(rulePayload.suggestions)
@@ -509,6 +555,58 @@ export function StoreProvider({ children }: { children: ReactNode }) {
       return Boolean(indexing)
     }
 
+    /**
+     * One /api/status answer → task/indexing/source state, plus a heavy
+     * refetch when the part that decides the payload moved. Shared by the
+     * recurring `poll()` below and the one-off bootstrap probe further down,
+     * so the gate — "generation moved AND (content signature changed OR
+     * nothing in flight)" — is written in exactly one place rather than
+     * re-derived, loosely, wherever a status answer needs applying.
+     */
+    const applyStatus = async (status: StatusSummary): Promise<boolean> => {
+      statusAnswered = true
+      const rows: SourceStatus[] = status.sources ?? []
+      applyIndexing(status.indexingSources ?? [])
+      applyTasks(trackTasks(rows))
+      // Keep the per-source rows as current as the toolbar. Without this
+      // the Sources list holds whatever the last heavy refetch said —
+      // which, mid-index, is the phase the source started in.
+      setSources((prev) => mergeSourceStatus(prev, rows))
+      let active = Boolean(status.indexing) || rows.some((r) => r.refreshing)
+      const nextSignature = contentSignature(rows)
+      // `generation` also moves for a progress counter. Refetch when the
+      // part that decides the payload moved — a snapshot landing, a
+      // source erroring, a refresh finishing — or, while the engine is
+      // quiet, on any generation change at all (the file-edit case).
+      const moved = status.generation !== generation
+      const worthRefetching = refetchOwed || (moved && (nextSignature !== signature || !active))
+      if (worthRefetching && hidden()) {
+        // Owed, but deferred: a hidden tab has no one to show the corpus to,
+        // and CLAUDE.md clocks /api/resolve-all at 620ms/150MB on a 3,000-note
+        // vault — not a payload to issue on a timer nobody is watching. Mark
+        // it owed and leave `generation`/`signature` where they are so the
+        // gate stays open (worthRefetching stays true) on every status-only
+        // poll while still hidden, then land it in one shot: onVisibility's
+        // immediate poll() re-enters this same gate once visible, hidden()
+        // is now false, and the branch below actually runs readAll().
+        refetchOwed = true
+      } else if (worthRefetching) {
+        // Committing the gate here — before the heavy read — is how a
+        // failed refetch used to hide: the next poll saw nothing moved,
+        // skipped the retry, and then took the success path below,
+        // clearing the banner over pre-edit concepts. Nothing recovers
+        // from that on its own, because contentSignature deliberately
+        // excludes document content, so a pure edit never reopens the
+        // gate. readAll commits it, once it has actually landed.
+        refetchOwed = true
+        active = (await readAll(status.generation)) || active
+      } else {
+        generation = status.generation
+        signature = nextSignature
+      }
+      return active
+    }
+
     /** One cheap poll. Refetches the heavy payloads only when they moved. */
     const poll = async () => {
       if (cancelled || running) return
@@ -519,45 +617,15 @@ export function StoreProvider({ children }: { children: ReactNode }) {
           const status = await source.status()
           if (cancelled) return
           if (status === null) hasStatusRoute = false
-          else {
-            statusAnswered = true
-            const rows: SourceStatus[] = status.sources ?? []
-            applyIndexing(status.indexingSources ?? [])
-            applyTasks(trackTasks(rows))
-            // Keep the per-source rows as current as the toolbar. Without this
-            // the Sources list holds whatever the last heavy refetch said —
-            // which, mid-index, is the phase the source started in.
-            setSources((prev) => mergeSourceStatus(prev, rows))
-            active = Boolean(status.indexing) || rows.some((r) => r.refreshing)
-            const nextSignature = contentSignature(rows)
-            // `generation` also moves for a progress counter. Refetch when the
-            // part that decides the payload moved — a snapshot landing, a
-            // source erroring, a refresh finishing — or, while the engine is
-            // quiet, on any generation change at all (the file-edit case).
-            const moved = status.generation !== generation
-            const worthRefetching = refetchOwed || (moved && (nextSignature !== signature || !active))
-            if (worthRefetching) {
-              // Committing the gate here — before the heavy read — is how a
-              // failed refetch used to hide: the next poll saw nothing moved,
-              // skipped the retry, and then took the success path below,
-              // clearing the banner over pre-edit concepts. Nothing recovers
-              // from that on its own, because contentSignature deliberately
-              // excludes document content, so a pure edit never reopens the
-              // gate. readAll commits it, once it has actually landed.
-              refetchOwed = true
-              active = (await readAll(status.generation)) || active
-            } else {
-              generation = status.generation
-              signature = nextSignature
-            }
-          }
+          else active = await applyStatus(status)
         }
         if (!hasStatusRoute) active = await readAll()
         if (cancelled) return
         failures = 0
         setRefreshError(null)
         setLastRefreshAt(Date.now())
-        schedule(active ? ACTIVE_POLL_MS : IDLE_POLL_MS)
+        activeState = active
+        schedule(active ? ACTIVE_POLL_MS : IDLE_POLL_MS, active)
       } catch (e) {
         if (cancelled) return
         // Never give up, and never quietly retract what the page is saying.
@@ -566,7 +634,15 @@ export function StoreProvider({ children }: { children: ReactNode }) {
         // anyone to know — the exact impression this whole pass exists to fix.
         failures += 1
         setRefreshError(asLiveDataError(e))
-        schedule(Math.min(MAX_BACKOFF_MS, ACTIVE_POLL_MS * failures))
+        // A failure tells us nothing about whether work is still in flight —
+        // it is not evidence of "active", so it must not keep a HIDDEN tab
+        // polling forever off a stale `true` from the last successful pass.
+        // (Measured before this fix: 85 failed fetches in 10 simulated hidden
+        // minutes, no termination.) A VISIBLE tab is unaffected: schedule()
+        // always fires its next tick when the tab isn't hidden, regardless of
+        // `active` — only the hidden branch reads this value at all.
+        activeState = false
+        schedule(Math.min(MAX_BACKOFF_MS, ACTIVE_POLL_MS * failures), activeState)
       } finally {
         running = false
       }
@@ -575,11 +651,37 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     const bootstrap = async () => {
       running = true
       try {
-        const active = await readAll()
+        let active = await readAll()
         if (cancelled) return
         setRefreshError(null)
         setLastRefreshAt(Date.now())
-        schedule(active ? ACTIVE_POLL_MS : IDLE_POLL_MS)
+        // A page that first renders with document.visibilityState === 'hidden'
+        // (embedded webviews can misreport this) is exactly the case
+        // schedule()'s HIDDEN_ACTIVE_POLL_MS branch exists for: if the engine
+        // is still indexing at this instant — the common case on a large
+        // vault — a plain schedule(active) below would go silent forever
+        // while hidden, because active only reflects readAll()'s snapshot,
+        // taken before this probe. So this one extra probe runs regardless
+        // of hidden(), through the exact gate `poll()` uses (applyStatus),
+        // so it only pays for a heavy refetch when that gate says one is
+        // owed — and its OWN answer (not the earlier readAll()'s) is what
+        // schedule() below acts on, so work that started between the two
+        // calls is scheduled at ACTIVE_POLL_MS instead of IDLE_POLL_MS.
+        // Demo mode never probes — there is no engine behind it to ask.
+        if (source.mode === 'live' && hasStatusRoute) {
+          try {
+            const status = await source.status()
+            if (!cancelled) {
+              if (status === null) hasStatusRoute = false
+              else active = await applyStatus(status)
+            }
+          } catch {
+            // Non-fatal: readAll() above already left a good snapshot up, and
+            // the recurring loop retries on its own once it gets to run.
+          }
+        }
+        activeState = active
+        schedule(active ? ACTIVE_POLL_MS : IDLE_POLL_MS, active)
       } catch (e) {
         if (cancelled) return
         // A failure on a background refresh must not blow away a working page;
@@ -592,15 +694,33 @@ export function StoreProvider({ children }: { children: ReactNode }) {
         }
         failures += 1
         setRefreshError(asLiveDataError(e))
-        schedule(Math.min(MAX_BACKOFF_MS, ACTIVE_POLL_MS * failures))
+        // Same reasoning as poll()'s catch: a failure is not evidence of
+        // active work, so it must not keep a hidden tab polling forever.
+        activeState = false
+        schedule(Math.min(MAX_BACKOFF_MS, ACTIVE_POLL_MS * failures), activeState)
       } finally {
         running = false
       }
     }
 
-    const onVisibility = () => { if (hidden()) clearTimer(); else schedule(0) }
+    const onVisibility = () => {
+      if (hidden()) {
+        // Nothing active: go fully silent, same as before — the whole point
+        // of the cost optimization. Something active: re-schedule rather
+        // than clear, so the loop drops straight to HIDDEN_ACTIVE_POLL_MS
+        // instead of continuing to fire at the visible cadence until its
+        // already-queued tick happens to land.
+        if (activeState) schedule(ACTIVE_POLL_MS, true)
+        else clearTimer()
+      } else {
+        schedule(0, activeState)
+      }
+    }
     if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVisibility)
-    pollNowRef.current = () => { failures = 0; schedule(0) }
+    // An explicit user retry (the refresh-error banner) always fires
+    // immediately, hidden tab or not — it's a direct request, not the
+    // passive background loop the hidden-tab cadence rules are about.
+    pollNowRef.current = () => { failures = 0; schedule(0, true) }
 
     // A refresh must not replace an already-usable shell with a full-page
     // loader. Besides the visual regression, doing so unmounts the Files editor
@@ -680,6 +800,10 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     setViewState('concepts')
   }, [])
 
+  useEffect(() => {
+    document.title = titleForView(view)
+  }, [view])
+
   useEffect(() => {
     window.__CC_DESKTOP?.uiState?.set({
       lastView: view,
@@ -926,6 +1050,21 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     }
   }, [])
 
+  // `source.search` is on the DataSource interface, but several test harnesses
+  // stub a partial DataSource (see store.test.tsx) with no `search` at all —
+  // same reason `source.discrepancies` above is guarded rather than called
+  // directly. Any rejection (network, timeout, a malformed body) is caught
+  // here too: this is the one place that owns "never break the list",
+  // regardless of which layer the failure came from.
+  const search = useCallback(async (query: string, limit?: number): Promise<SearchHit[] | null> => {
+    if (!source.search) return null
+    try {
+      return await source.search(query, limit)
+    } catch {
+      return null
+    }
+  }, [source])
+
   const reload = useCallback(() => setReloadKey((k) => k + 1), [])
   const openChat = useCallback(() => setChatOpen(true), [])
   const closeChat = useCallback(() => setChatOpen(false), [])
@@ -945,7 +1084,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     mode, loading, load, error,
     concepts, sources, signals, conflicts, activity, loadErrors, resolvingConflict, resolutionError,
     discrepancyRules, discrepancyRuleSuggestions,
-    setView, setTriageTab, setSelSignal, setSelConflict, setSelConcept, setQuery,
+    setView, setTriageTab, setSelSignal, setSelConflict, setSelConcept, setQuery, search,
     setFilesScope, setFilesPath, openFilesScope, openConcept,
     openChat, closeChat, setChatInput,
     retryNow, route, resolveConflict, resolveSafeConflicts, decideDiscrepancy,
@@ -955,7 +1094,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     resolvingConflict, resolutionError, discrepancyRules, discrepancyRuleSuggestions,
     retryNow, route, resolveConflict, resolveSafeConflicts, decideDiscrepancy,
     approveRuleSuggestion, updateDiscrepancyRule, promoteDiscrepancyRule, setDiscrepancyPriority,
-    send, reload, reloadKey, setView, setSelConcept, setQuery, setFilesScope, setFilesPath,
+    send, reload, reloadKey, setView, setSelConcept, setQuery, search, setFilesScope, setFilesPath,
     openFilesScope, openConcept, openChat, closeChat])
 
   const nav = useMemo<StoreNav>(
diff --git a/apps/console/src/styles.css b/apps/console/src/styles.css
index 072488d..d6e4bda 100644
--- a/apps/console/src/styles.css
+++ b/apps/console/src/styles.css
@@ -1847,13 +1847,14 @@ textarea:focus-visible,
 .cc-decision-panel select { min-height: 44px; padding: 0 10px; }
 .cc-decision-panel textarea { min-height: 120px; padding: 10px; line-height: 1.5; resize: vertical; }
 .cc-compose, .cc-acknowledge { display: grid; gap: 8px; margin: 0 0 6px 28px; }
-.cc-compose > button { justify-self: start; min-height: 36px; }
+.cc-compose-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.cc-compose > button, .cc-compose-actions > button { justify-self: start; min-height: 36px; }
 .cc-compose-preview { padding: 12px; border: 1px solid var(--cc-line); border-radius: 8px; background: var(--cc-surface); }
 .cc-callout, .cc-rule-match { padding: 10px 12px; border-radius: 8px; background: var(--cc-neutral-fill); color: var(--cc-body); font-size: 11.5px; line-height: 1.45; }
 .cc-priority-assign { display: flex; align-items: center; gap: 10px; margin-top: 12px; color: var(--cc-caption); font-size: 11px; }
 .cc-priority-assign select { width: auto; min-width: 130px; }
 .cc-decision-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 14px; }
-.cc-decision-actions button, .cc-rules button, .cc-rule-preview button, .cc-compose > button { min-height: 44px; padding: 0 13px; border: 1px solid var(--cc-line-strong); border-radius: 8px; background: var(--cc-raised); color: var(--cc-body); font: inherit; font-size: 11.5px; font-weight: 650; cursor: pointer; }
+.cc-decision-actions button, .cc-rules button, .cc-rule-preview button, .cc-compose > button, .cc-compose-actions > button { min-height: 44px; padding: 0 13px; border: 1px solid var(--cc-line-strong); border-radius: 8px; background: var(--cc-raised); color: var(--cc-body); font: inherit; font-size: 11.5px; font-weight: 650; cursor: pointer; }
 .cc-decision-actions button:disabled, .cc-rules button:disabled { opacity: .5; cursor: not-allowed; }
 .cc-decision-actions .cc-button-primary { border-color: var(--cc-teal-stroke-e); background: var(--cc-teal-text); color: var(--cc-raised); }
 .cc-discrepancy-history { display: grid; gap: 9px; margin: 0; padding: 0; list-style: none; }
@@ -1953,6 +1954,8 @@ textarea:focus-visible,
   font-family: var(--cc-mono, ui-monospace, monospace);
 }
 .cc-settings-number:disabled { opacity: 0.55; cursor: not-allowed; }
+.cc-settings-unit { color: var(--cc-caption); font-size: 11.5px; font-weight: 600; }
+.cc-settings-hint { margin: 6px 0 0; font-size: 11.5px; color: var(--cc-caption); }
 .cc-settings-rowerr { margin: 6px 0 0; font-size: 11.5px; color: var(--cc-amber-text); }
 .cc-settings-reset {
   padding: 6px 12px; border-radius: 8px; cursor: pointer; font: inherit;
@@ -1984,6 +1987,7 @@ textarea:focus-visible,
   background: var(--cc-surface);
   text-align: center;
 }
+.cc-conflict-empty button { margin-top: 10px; min-height: 40px; padding: 0 14px; border: 1px solid var(--cc-line-strong); border-radius: 8px; background: var(--cc-raised); color: var(--cc-body); font: inherit; font-size: 11.5px; font-weight: 650; cursor: pointer; }
 .cc-conflict-summary {
   min-height: 72px;
   display: flex;
diff --git a/apps/console/src/types.ts b/apps/console/src/types.ts
index 5739935..2a59856 100644
--- a/apps/console/src/types.ts
+++ b/apps/console/src/types.ts
@@ -95,6 +95,21 @@ export interface StatusSummary {
   sources: SourceStatus[]
 }
 
+/**
+ * One hit from GET /api/search — BM25F over stemmed section content
+ * (`searchConcepts` in packages/core/src/search.mjs). `layers` names every
+ * contributing layer, best-scoring first; `snippet` is pre-extracted around
+ * the matched terms, so the console never has to re-tokenize the body.
+ * Hits arrive pre-sorted by score, highest first.
+ */
+export interface SearchHit {
+  id: string
+  title: string | null
+  score: number
+  layers: string[]
+  snippet: string
+}
+
 /** A source (layer) row in the graph summary. */
 export interface GraphSource {
   name: string
@@ -257,7 +272,7 @@ export interface ConflictResolutionRecord {
 export type DiscrepancyKind = 'section_content' | 'frontmatter_value' | 'broken_link' | 'changed_after_decision'
 export type DiscrepancyStatus = 'needs_review' | 'recommended' | 'auto_ready' | 'acknowledged' | 'resolved' | 'reopened' | 'blocked'
 export type DiscrepancyAction = 'choose_contribution' | 'compose' | 'acknowledge'
-export type AcknowledgementReason = 'different_scopes' | 'temporary_migration' | 'source_specific_authority' | 'other'
+export type AcknowledgementReason = 'different_scopes' | 'temporary_migration' | 'source_specific_authority' | 'target_missing' | 'other'
 
 export interface DiscrepancyContribution {
   source: string
diff --git a/apps/console/src/views/Canvas.test.tsx b/apps/console/src/views/Canvas.test.tsx
index 995548d..c267e5c 100644
--- a/apps/console/src/views/Canvas.test.tsx
+++ b/apps/console/src/views/Canvas.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { Concept } from '../data'
-import { computeLayout } from './Canvas'
+import { capConceptsPerLane, clampZoom, computeFitScale, computeLayout, countByLane, MAX_NODES_PER_LANE, MIN_SCALE } from './Canvas'
 
 function concept(id: string, layer: Concept['layers'][number], dissent?: Concept['layers'][number]): Concept {
   return {
@@ -36,6 +36,207 @@ describe('computeLayout', () => {
   })
 })
 
+describe('computeFitScale', () => {
+  // Fit and manual zoom used to have different floors (Fit ~0, manual 0.1):
+  // on a large cascade Fit would land far below what manual zoom could ever
+  // reach, so the first wheel notch after a Fit snapped the view back up —
+  // see "Fit and manual zoom share one floor" below for the exact repro this
+  // replaces. Fit and manual zoom now share MIN_SCALE, so a world too big to
+  // fit at that floor is *cropped*, not shrunk arbitrarily small.
+  it('floors at the shared MIN_SCALE for a world too large to fit otherwise', () => {
+    const result = computeFitScale(2000, 1200, 200_000, 100_000)
+    expect(result).not.toBeNull()
+    expect(result!.scale).toBe(MIN_SCALE)
+  })
+
+  it('still guards a not-yet-laid-out element', () => {
+    expect(computeFitScale(0, 0, 1000, 1000)).toBeNull()
+  })
+
+  // The cap (MAX_NODES_PER_LANE) is sized precisely so this never has to
+  // happen for real content — see the arithmetic in Canvas.tsx — but a
+  // shrunk viewport can still push a fully-saturated lane under the floor,
+  // and computeFitScale must degrade to "cropped" rather than "sub-pixel"
+  // when it does.
+  it('crops rather than shrinking arbitrarily small when even the floor cannot fit', () => {
+    const result = computeFitScale(600, 400, 200_000, 100_000)
+    expect(result).not.toBeNull()
+    expect(result!.scale).toBe(MIN_SCALE)
+  })
+})
+
+describe('clampZoom', () => {
+  it('floors a manual zoom at the shared MIN_SCALE', () => {
+    expect(clampZoom(0.05)).toBe(MIN_SCALE)
+    expect(clampZoom(0.001)).toBe(MIN_SCALE)
+  })
+
+  it('leaves a scale above the floor untouched', () => {
+    expect(clampZoom(0.3)).toBeCloseTo(0.3, 5)
+  })
+
+  it('still clamps at the top end', () => {
+    expect(clampZoom(50)).toBe(2)
+  })
+})
+
+describe('Fit and manual zoom share one floor (regression)', () => {
+  // This is the bug two adversarial reviewers independently confirmed on the
+  // branch: FIT_MIN_SCALE (~0) and MIN_MANUAL_SCALE (0.1) disagreed, so a Fit
+  // on a large cascade (3,000 concepts capped to 750 under the old
+  // MAX_NODES_PER_LANE=250, on a 1440x800 canvas) landed at scale 0.02296 —
+  // sub-pixel cards, a blank-looking canvas — and the very next wheel notch,
+  // in EITHER direction, clamped up to 0.1: zooming OUT magnified the view
+  // 4.4x under the cursor. The commit that introduced the split floor also
+  // deleted the test that had pinned "zoom out must not zoom in"; this
+  // restores that guarantee against the new shared floor instead.
+  it('a Fit that would drop below the shared floor gets floored there, and the next zoom-out does not jump', () => {
+    // Reconstructs the exact regression's inputs: a single lane fully
+    // saturated at the OLD per-lane cap (250), via the real layout code
+    // rather than a hand-derived worldW, so this stays honest if NODE_W/GAP_X
+    // ever change.
+    const saturated = Array.from({ length: 250 }, (_, i) => concept(`personal-${i}`, 'personal'))
+    const { worldW, worldH } = computeLayout(saturated)
+
+    const fit = computeFitScale(1440, 800, worldW, worldH)!
+    expect(fit).not.toBeNull()
+    expect(fit.scale).toBe(MIN_SCALE) // floored, not sub-pixel
+
+    // The zoom() handler's "zoom out" factor (1/1.2) applied to the just-fitted
+    // scale, then run through the same clamp a wheel-out or the − button uses.
+    const zoomedOut = clampZoom(fit.scale * (1 / 1.2))
+    expect(zoomedOut).toBe(fit.scale) // floored again, at the SAME value — no jump
+  })
+
+  // The cap this branch ships with (MAX_NODES_PER_LANE) is chosen so this
+  // scenario above cannot actually occur for content the app renders: a
+  // fully-saturated lane fits comfortably above the floor on a normal
+  // desktop viewport, so Fit never needs flooring and the first zoom action
+  // after it is a plain, un-clamped zoom.
+  it('a fully-saturated lane at the current cap fits above the floor on a normal desktop viewport', () => {
+    const saturated = Array.from({ length: MAX_NODES_PER_LANE }, (_, i) => concept(`personal-${i}`, 'personal'))
+    const { worldW, worldH } = computeLayout(saturated)
+
+    for (const width of [1280, 1440]) {
+      const fit = computeFitScale(width, 800, worldW, worldH)!
+      expect(fit.scale).toBeGreaterThan(MIN_SCALE)
+    }
+  })
+})
+
+describe('capConceptsPerLane', () => {
+  function many(layer: Concept['layers'][number], count: number): Concept[] {
+    return Array.from({ length: count }, (_, i) => concept(`${layer}-${i}`, layer))
+  }
+
+  it('passes a small cascade through unchanged', () => {
+    const input = [...many('personal', 3), ...many('team', 2)]
+    const result = capConceptsPerLane(input, 250)
+    expect(result.shown).toBe(5)
+    expect(result.total).toBe(5)
+    expect(result.concepts).toHaveLength(5)
+  })
+
+  it('slices each lane independently and reports per-lane + total counts', () => {
+    const input = [...many('personal', 400), ...many('team', 10), ...many('company', 5)]
+    const result = capConceptsPerLane(input, 250)
+    expect(result.laneCounts.personal).toEqual({ shown: 250, total: 400 })
+    expect(result.laneCounts.team).toEqual({ shown: 10, total: 10 })
+    expect(result.laneCounts.company).toEqual({ shown: 5, total: 5 })
+    expect(result.shown).toBe(250 + 10 + 5)
+    expect(result.total).toBe(415)
+    expect(result.concepts).toHaveLength(result.shown)
+  })
+
+  it('keeps the first N in incoming order (no cheap per-concept date to sort by)', () => {
+    const input = many('personal', 5)
+    const result = capConceptsPerLane(input, 3)
+    expect(result.concepts.map((c) => c.id)).toEqual(['personal-0', 'personal-1', 'personal-2'])
+  })
+
+  it('defaults to MAX_NODES_PER_LANE when no max is given', () => {
+    const input = many('personal', MAX_NODES_PER_LANE + 5)
+    const result = capConceptsPerLane(input)
+    expect(result.laneCounts.personal).toEqual({ shown: MAX_NODES_PER_LANE, total: MAX_NODES_PER_LANE + 5 })
+  })
+
+  it('does not crash on a concept with an empty layers array', () => {
+    // primaryLayer(c) is undefined for `layers: []` (sort()[0] of an empty
+    // array), so indexing straight into the byLane record and calling .push
+    // on the result used to throw and unmount the whole Cascade view.
+    const orphan: Concept = { ...concept('orphan', 'personal'), layers: [] }
+    let result: ReturnType<typeof capConceptsPerLane> | undefined
+    expect(() => { result = capConceptsPerLane([orphan]) }).not.toThrow()
+    expect(result!.concepts.map((c) => c.id)).toEqual(['orphan'])
+    expect(result!.laneCounts.company).toEqual({ shown: 1, total: 1 })
+  })
+})
+
+describe('countByLane', () => {
+  it('counts each concept into its primary lane', () => {
+    const input = [
+      concept('p1', 'personal'), concept('p2', 'personal'),
+      concept('t1', 'team'),
+      concept('c1', 'company'),
+    ]
+    expect(countByLane(input)).toEqual({ personal: 2, team: 1, company: 1 })
+  })
+
+  // F7: capConceptsPerLane falls back a layerless concept (empty `layers`
+  // array — primaryLayer(c) is undefined there) into the company lane's
+  // rendered cards. Before this fix, this count used `counts[primaryLayer(c)]
+  // += 1` directly, which wrote a stray "undefined" key and left company's
+  // header total not counting a concept that nonetheless occupied one of its
+  // rendered slots — so the header undercounted what was actually on screen.
+  it('falls back a layerless concept to company, matching capConceptsPerLane\'s rendering fallback', () => {
+    const orphan: Concept = { ...concept('orphan', 'personal'), layers: [] }
+    const counts = countByLane([orphan, concept('c1', 'company')])
+    expect(counts).toEqual({ personal: 0, team: 0, company: 2 })
+    expect(Object.keys(counts)).not.toContain('undefined')
+  })
+})
+
+describe('lane header honesty (F3)', () => {
+  // vi.doMock (not vi.mock) so this stays scoped to a resetModules() import —
+  // the legend test below needs the real StoreProvider, and a file-level mock
+  // of '../store' would break it.
+  afterEach(() => {
+    vi.doUnmock('../store')
+    vi.resetModules()
+  })
+
+  it('names the real source and level behind a lane instead of the static trio', async () => {
+    ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+    vi.resetModules()
+    vi.doMock('../store', () => {
+      const noop = () => {}
+      const state = {
+        mode: 'live', concepts: [], conflicts: [], sources: [{ name: 'messy-vault', layer: 'team', level: 1 }],
+        setSelConcept: noop, setSelConflict: noop, setView: noop,
+      }
+      const useState = () => state
+      return { useStore: useState, useStoreData: useState, useStoreNav: useState, useStoreInput: useState }
+    })
+    const { act } = await import('react')
+    const { createRoot } = await import('react-dom/client')
+    const { Canvas } = await import('./Canvas')
+
+    const container = document.createElement('div')
+    document.body.append(container)
+    const root = createRoot(container)
+    await act(async () => root.render(<Canvas />))
+
+    expect(container.textContent).toContain('messy-vault')
+    // The team lane's round badge shows the real level (1), not the static 2 —
+    // and the lane's static "runbooks, decisions, system docs" blurb is gone,
+    // replaced by the source name.
+    expect(container.textContent).not.toContain('runbooks, decisions, system docs')
+
+    await act(async () => root.unmount())
+    container.remove()
+  })
+})
+
 describe('the canvas legend', () => {
   it('stays translucent, because the graph moves underneath it', async () => {
     // Not a style preference: the legend is absolutely positioned over the
diff --git a/apps/console/src/views/Canvas.tsx b/apps/console/src/views/Canvas.tsx
index df77730..4cdfdb7 100644
--- a/apps/console/src/views/Canvas.tsx
+++ b/apps/console/src/views/Canvas.tsx
@@ -1,6 +1,6 @@
 import { memo, useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import { C, css, lc, MONO, type LayerId } from '../theme'
-import { layerLevel, layers, type Concept } from '../data'
+import { layerLevel, layerName, layers, type Concept } from '../data'
 import { LayerChip } from '../components/LayerChip'
 import { ConceptDetail } from '../components/ConceptDetail'
 import { useStoreData } from '../store'
@@ -13,6 +13,56 @@ const LANE_TOP = 60, LANE_H = 196, LANE_GAP = 16
 const LANE_INNER = LANE_H - LANE_GAP
 const NODE_DY = 46, GHOST_DY = 62
 
+// A real-DOM canvas with no virtualization: every node is a live element in
+// the pan/zoom transform, so a vault with thousands of concepts in one lane
+// stops being interactive well before it stops being legible. Cap what's
+// rendered rather than let the browser choke on it — Knowledge (unpaginated,
+// list-based) is where the rest is still reachable.
+//
+// The cap is sized so a fully-saturated lane's Fit never needs to drop below
+// MIN_SCALE on a normal desktop viewport (see MIN_SCALE below for both
+// numbers' arithmetic) — a smaller cap than the DOM could technically still
+// render, chosen for legibility rather than raw capacity. The "Showing N of
+// M · Browse everything in Knowledge" banner already tells the user this is
+// a partial view, which is what makes a smaller cap honest rather than a
+// silent loss.
+//
+// Worst case for layout is every concept landing in ONE lane: nodes that
+// share a primary lane always conflict (computeLayout never reuses a column
+// between two nodes with the same occupied-layer set), so N nodes in a
+// single lane cost N columns — there is no sharing to fall back on. That
+// makes worldW a function of N alone:
+//   worldW(N) = START_X + N*NODE_W + (N-1)*GAP_X + END_X = 134 + 242*N
+// Solving worldW(N) * MIN_SCALE <= (viewport width - 48) for the narrow end
+// of a normal desktop viewport (1280px, from the "~1280-1440px" range this
+// was measured against) gives N <= 24.9 — MAX_NODES_PER_LANE=25 lands at
+// scale 0.1992 (just under the floor); 24 lands at 0.2073, comfortably
+// above it at 1280px and with more room at 1440px. worldH is fixed at 648px
+// (3 lanes) regardless of N, so height is never the binding constraint here.
+export const MAX_NODES_PER_LANE = 24
+// The ONE floor shared by Fit and manual zoom (wheel / +/- controls). These
+// used to differ (Fit ~0, manual 0.1): a 3,000-concept vault's Fit landed at
+// scale 0.023 — cards rendered sub-pixel, the screenshot was a blank canvas
+// with one faint dashed line — and the first wheel notch in EITHER direction
+// then clamped up to the manual floor, magnifying the view 4x under the
+// cursor. Splitting the floors again would only resurrect that: the fix is
+// one shared number, low enough to still be a legible discrete card and no
+// lower.
+//
+// Derivation: a card narrower than ~40 screen px reads as a sliver, not a
+// rectangle — at MAX_NODES_PER_LANE's fully-saturated worst case, NODE_W
+// (214px) needs to render at >= ~40px for the card to be a visible,
+// color-coded shape (border + lane accent) rather than noise:
+//   40 / 214 ≈ 0.187, rounded up to 0.2 for a clean shared constant.
+// With the cap above, a saturated lane's Fit lands at ~0.207-0.234 (see its
+// derivation) — comfortably above 0.2, so in practice Fit never needs the
+// floor at all; it exists purely as the shared backstop both Fit and manual
+// zoom respect, so neither can ever clamp past the other.
+export const MIN_SCALE = 0.2
+const MAX_SCALE = 2
+
+const NUM = new Intl.NumberFormat()
+
 // lanes top→bottom: highest precedence (Personal) on top so "up = wins"
 const LANE_ORDER: LayerId[] = ['personal', 'team', 'company']
 const laneIndex = (id: LayerId) => LANE_ORDER.indexOf(id)
@@ -20,6 +70,67 @@ const laneY = (i: number) => LANE_TOP + i * LANE_H
 const primaryLayer = (c: Concept): LayerId =>
   c.layers.slice().sort((a, b) => layerLevel(b) - layerLevel(a))[0]
 
+/** Fit scale/pan for a `cw`×`ch` viewport around `worldW`×`worldH` content, or
+ *  `null` while the element is not yet laid out (see the caller's guard). */
+export function computeFitScale(cw: number, ch: number, worldW: number, worldH: number) {
+  if (cw < 40 || ch < 40) return null
+  const scale = Math.max(MIN_SCALE, Math.min(1, (cw - 48) / worldW, (ch - 48) / worldH))
+  return { scale, tx: (cw - worldW * scale) / 2, ty: Math.max(24, (ch - worldH * scale) / 2) }
+}
+
+/** Clamp a manual zoom (wheel or +/− button) to the app's zoom range. */
+export function clampZoom(scale: number): number {
+  return Math.min(MAX_SCALE, Math.max(MIN_SCALE, scale))
+}
+
+export interface LaneCapResult {
+  concepts: Concept[]
+  shown: number
+  total: number
+  laneCounts: Record<LayerId, { shown: number; total: number }>
+}
+
+/**
+ * Cap how many concepts land on the canvas per lane. Selection keeps the
+ * first N in resolve-all order: `Concept` carries no single "last updated"
+ * timestamp of its own (only per-section dates), and scanning every section
+ * of every concept just to sort would undercut the point of a cheap cap at
+ * the scale this exists for.
+ */
+export function capConceptsPerLane(concepts: Concept[], max = MAX_NODES_PER_LANE): LaneCapResult {
+  const byLane: Record<LayerId, Concept[]> = { company: [], team: [], personal: [] }
+  // primaryLayer(c) is undefined for a concept with an empty `layers` array
+  // (sort()[0] of []) despite its declared LayerId return type — a chaos
+  // input computeLayout already tolerates (it lays such a concept out off
+  // canvas via laneIndex's -1). Here it indexed straight into `byLane` and
+  // called .push on the resulting undefined, unmounting the whole view.
+  // Falling back to the company lane matches that existing tolerance.
+  for (const c of concepts) (byLane[primaryLayer(c)] ?? byLane.company).push(c)
+  const laneCounts = {} as Record<LayerId, { shown: number; total: number }>
+  const out: Concept[] = []
+  for (const id of LANE_ORDER) {
+    const all = byLane[id]
+    const shown = all.slice(0, max)
+    laneCounts[id] = { shown: shown.length, total: all.length }
+    out.push(...shown)
+  }
+  return { concepts: out, shown: out.length, total: concepts.length, laneCounts }
+}
+
+/**
+ * Full per-lane concept counts — honest even while the canvas only renders
+ * the capped subset (capConceptsPerLane). Shares capConceptsPerLane's
+ * company fallback for a concept with an empty `layers` array (primaryLayer
+ * returns undefined there): without it, such a concept indexed a stray
+ * "undefined" key here — consuming a company slot in the capped render
+ * while never appearing in company's header total.
+ */
+export function countByLane(concepts: Concept[]): Record<LayerId, number> {
+  const counts: Record<LayerId, number> = { company: 0, team: 0, personal: 0 }
+  for (const c of concepts) counts[primaryLayer(c) ?? 'company'] += 1
+  return counts
+}
+
 interface NodePos { c: Concept; x: number; y: number; conflict: boolean }
 interface GhostPos { key: string; parent: NodePos; layer: LayerId; value: string; x: number; y: number }
 
@@ -72,14 +183,27 @@ function edgePath(x1: number, y1: number, x2: number, y2: number) {
 }
 
 function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolean }) {
-  const { setSelConcept, setSelConflict, setView, conflicts, concepts } = useStoreData()
+  const { setSelConcept, setSelConflict, setView, conflicts, concepts, sources, mode } = useStoreData()
+  // Capped before layout: a real-DOM canvas with no virtualization stops
+  // being usable well before thousands of nodes finish laying out. Ghost
+  // (dissent) cards derive from `nodes` below, so they respect the cap too —
+  // there is no separate ghost list to cap.
+  const capped = useMemo(() => capConceptsPerLane(concepts), [concepts])
   // Memoized: pan/zoom re-renders every pointermove — don't re-lay-out for those.
-  const { nodes, ghosts, worldW, worldH } = useMemo(() => computeLayout(concepts), [concepts])
-  const laneCounts = useMemo(() => {
-    const counts: Record<LayerId, number> = { company: 0, team: 0, personal: 0 }
-    for (const c of concepts) counts[primaryLayer(c)] += 1
-    return counts
-  }, [concepts])
+  const { nodes, ghosts, worldW, worldH } = useMemo(() => computeLayout(capped.concepts), [capped.concepts])
+  // Full counts, not the capped subset — the lane header's "N concepts" stays
+  // an honest total even while the canvas itself only renders some of them.
+  const laneCounts = useMemo(() => countByLane(concepts), [concepts])
+  // Real (source name, level) pairs behind each lane, for honest lane headers
+  // (Fix F3): demo mode's sources are already the canonical company/team/
+  // personal trio, so this reduces to the static labels there — the fallback
+  // below only changes what a live, non-canonical cascade renders.
+  const laneSourceRows = useMemo(() => {
+    const rows: Record<LayerId, { name: string; level: number }[]> = { company: [], team: [], personal: [] }
+    if (mode === 'demo') return rows
+    for (const s of sources) rows[s.layer].push({ name: s.name, level: s.level })
+    return rows
+  }, [sources, mode])
 
   const wrapRef = useRef<HTMLDivElement>(null)
   const [view, setViewT] = useState({ tx: 40, ty: 20, scale: 1 })
@@ -94,13 +218,12 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
   const fit = useCallback(() => {
     const el = wrapRef.current
     if (!el) return
-    const cw = el.clientWidth, ch = el.clientHeight
-    // Guard against a not-yet-laid-out element (async data can populate before
-    // layout settles): a zero width would yield a negative scale that never
-    // self-corrects, collapsing the whole canvas to a speck.
-    if (cw < 40 || ch < 40) return
-    const scale = Math.max(0.2, Math.min(1, (cw - 48) / worldW, (ch - 48) / worldH))
-    setViewT({ scale, tx: (cw - worldW * scale) / 2, ty: Math.max(24, (ch - worldH * scale) / 2) })
+    // computeFitScale's own guard covers a not-yet-laid-out element (async
+    // data can populate before layout settles): a zero width would otherwise
+    // yield a negative scale that never self-corrects, collapsing the canvas
+    // to a speck.
+    const next = computeFitScale(el.clientWidth, el.clientHeight, worldW, worldH)
+    if (next) setViewT(next)
   }, [worldW, worldH])
 
   useLayoutEffect(() => { fit() }, [fit])
@@ -125,7 +248,7 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
       const rect = el.getBoundingClientRect()
       const px = e.clientX - rect.left, py = e.clientY - rect.top
       setViewT((v) => {
-        const next = Math.min(2, Math.max(0.4, v.scale * Math.exp(-e.deltaY * 0.0015)))
+        const next = clampZoom(v.scale * Math.exp(-e.deltaY * 0.0015))
         const wx = (px - v.tx) / v.scale, wy = (py - v.ty) / v.scale
         return { scale: next, tx: px - wx * next, ty: py - wy * next }
       })
@@ -185,7 +308,7 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
   }, [keyboardSuspended, openId, wideInspector])
   const zoom = (dir: number) => setViewT((v) => {
     const el = wrapRef.current!, px = el.clientWidth / 2, py = el.clientHeight / 2
-    const next = Math.min(2, Math.max(0.4, v.scale * (dir > 0 ? 1.2 : 1 / 1.2)))
+    const next = clampZoom(v.scale * (dir > 0 ? 1.2 : 1 / 1.2))
     const wx = (px - v.tx) / v.scale, wy = (py - v.ty) / v.scale
     return { scale: next, tx: px - wx * next, ty: py - wy * next }
   })
@@ -205,18 +328,27 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
         style={{ position: 'absolute', top: 0, left: 0, bottom: 0, right: wideInspector && openConceptObj ? 360 : 0, cursor: dragging ? 'grabbing' : 'grab', touchAction: 'none' }}
       >
         <div style={{ position: 'absolute', top: 0, left: 0, transformOrigin: '0 0', transform: `translate(${view.tx}px, ${view.ty}px) scale(${view.scale})`, width: worldW, height: worldH }}>
-          {/* lane backgrounds + labels */}
+          {/* lane backgrounds + labels — real levels and source names behind
+              each lane, not the static trio (F3): a level-1 source that ranks
+              into 'team' should say so, and two sources sharing a lane should
+              both be named rather than only the lane's generic blurb. */}
           {LANE_ORDER.map((id, i) => {
             const L = layers.find((l) => l.id === id)!
             const col = lc(id)
+            const rows = laneSourceRows[id]
+            const levels = [...new Set(rows.map((r) => r.level))].sort((a, b) => a - b)
+            const conventional = rows.some((r) => r.name === id)
+            const badgeText = levels.length ? levels.join('/') : String(L.level)
+            const primary = conventional || rows.length === 0 ? L.name : `L${levels.join('/')}`
+            const detail = rows.length ? rows.map((r) => r.name).join(', ') : L.members
             return (
               <div key={id} style={{ position: 'absolute', left: 0, top: laneY(i), width: worldW, height: LANE_INNER }}>
                 <div style={css(`position:absolute; inset:0; background:var(--cc-lane-bg); border:1px solid var(--cc-lane-line); border-radius:16px;`)} />
                 <div style={css(`position:absolute; left:18px; top:14px; display:flex; align-items:center; gap:10px;`)}>
-                  <span style={css(`display:grid; place-items:center; width:26px; height:26px; border-radius:999px; background:${C.raised}; border:2px solid ${col.strokeE}; color:${col.text}; font-family:${MONO}; font-weight:600; font-size:12px;`)}>{L.level}</span>
+                  <span style={css(`display:grid; place-items:center; width:26px; height:26px; border-radius:999px; background:${C.raised}; border:2px solid ${col.strokeE}; color:${col.text}; font-family:${MONO}; font-weight:600; font-size:12px;`)}>{badgeText}</span>
                   <div style={{ lineHeight: 1.15 }}>
-                    <div style={css(`font-size:13px; font-weight:600; color:${col.text};`)}>{L.name}</div>
-                    <div style={css(`font-size:10.5px; color:${C.caption}; font-family:${MONO};`)}>{L.members} · {laneCounts[id]} concept{laneCounts[id] === 1 ? '' : 's'}</div>
+                    <div style={css(`font-size:13px; font-weight:600; color:${col.text};`)}>{primary}</div>
+                    <div style={css(`font-size:10.5px; color:${C.caption}; font-family:${MONO};`)}>{detail} · {laneCounts[id]} concept{laneCounts[id] === 1 ? '' : 's'}</div>
                   </div>
                 </div>
               </div>
@@ -252,6 +384,7 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
                 onMouseEnter={() => setHoverId(g.parent.c.id)}
                 onMouseLeave={() => setHoverId(null)}
                 title="Layers disagree — open the conflict"
+                aria-label={`${g.parent.c.title} — ${layerName(g.layer)} dissents, has conflict`}
                 style={{ position: 'absolute', left: g.x, top: g.y, width: GHOST_W, height: GHOST_H, ...css(`display:flex; flex-direction:column; justify-content:center; gap:4px; text-align:left; padding:10px 12px; background:${C.surface}; border:1px dashed var(--cc-edge-conflict); border-radius:11px; cursor:pointer; font:inherit;`) }}
               >
                 <div style={css('display:flex; align-items:center; gap:7px;')}>
@@ -275,6 +408,7 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
                 onClick={(event) => openConcept(n.c, event.currentTarget)}
                 onMouseEnter={() => setHoverId(n.c.id)}
                 onMouseLeave={() => setHoverId(null)}
+                aria-label={`${n.c.title} — ${layerName(primaryLayer(n.c))}${n.conflict ? ', has conflict' : n.c.draft ? ', draft' : ''}`}
                 style={{ position: 'absolute', left: n.x, top: n.y, width: NODE_W, height: NODE_H, boxShadow: glow, ...css(`display:flex; flex-direction:column; gap:0; text-align:left; padding:12px 14px; background:${C.raised}; border:1px solid ${selected ? col.strokeE : C.line}; border-left:3px solid ${col.strokeE}; border-radius:12px; cursor:pointer; font:inherit;`) }}
               >
                 <div style={css('display:flex; align-items:center; gap:8px;')}>
@@ -314,17 +448,33 @@ function CanvasInner({ keyboardSuspended = false }: { keyboardSuspended?: boolea
 
       {/* zoom controls */}
       <div style={css(`position:absolute; right:20px; bottom:20px; display:flex; flex-direction:column; gap:6px;`)}>
-        {[['+', () => zoom(1)], ['−', () => zoom(-1)], ['⤢', fit]].map(([label, fn]) => (
+        {([['+', 'Zoom in', () => zoom(1)], ['−', 'Zoom out', () => zoom(-1)], ['⤢', 'Fit to view', fit]] as const).map(([label, name, fn]) => (
           <button
-            key={label as string}
+            key={name}
             className="cc-h-navbg"
-            onClick={fn as () => void}
-            title={label === '⤢' ? 'Fit' : label === '+' ? 'Zoom in' : 'Zoom out'}
+            onClick={fn}
+            title={name}
+            aria-label={name}
             style={css(`display:grid; place-items:center; width:36px; height:36px; background:${C.surface}; border:1px solid ${C.lineStrong}; border-radius:9px; cursor:pointer; color:${C.body}; font-size:16px; font-weight:500;`)}
-          >{label as string}</button>
+          >{label}</button>
         ))}
       </div>
 
+      {/* cap banner — a real-DOM canvas with no virtualization stops being
+          usable well before a large cascade finishes laying out (F7); this
+          says what's hidden and where the rest still is. */}
+      {capped.shown < capped.total && (
+        <div style={css(`position:absolute; left:20px; top:16px; display:flex; align-items:center; gap:8px; padding:8px 12px; background:var(--cc-header-bg); backdrop-filter:blur(10px); -webkit-backdrop-filter:blur(10px); border:1px solid ${C.line}; border-radius:9px; box-shadow:0 4px 16px var(--cc-shadow);`)}>
+          <span style={css(`font-size:11.5px; color:${C.caption};`)}>Showing {NUM.format(capped.shown)} of {NUM.format(capped.total)}</span>
+          <button
+            type="button"
+            className="cc-h-bd-strong"
+            onClick={() => setView('concepts')}
+            style={css(`padding:2px 9px; border:1px solid ${C.lineStrong}; border-radius:999px; background:${C.raised}; cursor:pointer; font:inherit; font-size:11px; font-weight:600; color:${C.body};`)}
+          >Browse everything in Knowledge</button>
+        </div>
+      )}
+
       {/* node detail slide-over */}
       {openConceptObj && (
         <div>
diff --git a/apps/console/src/views/Concepts.test.tsx b/apps/console/src/views/Concepts.test.tsx
new file mode 100644
index 0000000..e2b07de
--- /dev/null
+++ b/apps/console/src/views/Concepts.test.tsx
@@ -0,0 +1,314 @@
+// @vitest-environment jsdom
+// The Knowledge: Concepts list and its detail panel — including the
+// zero-section dead end (F18): a concept with no sections used to render an
+// empty panel with no explanation and no way out.
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { Concepts } from './Concepts'
+import type { Concept } from '../data'
+import type { SearchHit } from '../types'
+
+const mocks = vi.hoisted(() => ({ useStore: vi.fn(), useLayerFiles: vi.fn() }))
+vi.mock('../store', () => ({ useStore: mocks.useStore, useStoreData: mocks.useStore, useStoreNav: mocks.useStore, useStoreInput: mocks.useStore }))
+vi.mock('../layer-files', () => ({
+  filesRevalidation: () => 'rev',
+  useLayerFiles: mocks.useLayerFiles,
+}))
+
+let container: HTMLDivElement
+let root: Root
+
+function storeWith(concepts: Concept[], selConcept: string, openFilesScope = vi.fn()) {
+  return {
+    mode: 'demo', sources: [], reloadKey: 0,
+    query: '', concepts, selConcept,
+    setSelConcept: vi.fn(), openFilesScope,
+  }
+}
+
+function populated(): Concept {
+  return {
+    id: 'decisions/primary-db', title: 'Primary database', type: 'decision',
+    layers: ['personal'], contributorLayers: ['personal'],
+    sections: [{ name: 'Choice', winner: 'personal', sourceLayer: 'personal', value: 'SingleStore.', updated: '2026-01-01' }],
+  }
+}
+
+function empty(): Concept {
+  return {
+    id: 'decisions/empty-note', title: 'Empty note', type: 'note',
+    layers: ['personal'], contributorLayers: ['personal'], sections: [],
+  }
+}
+
+function button(label: string): HTMLButtonElement | undefined {
+  return Array.from(container.querySelectorAll('button')).find((item) => item.textContent === label)
+}
+
+beforeEach(() => {
+  ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  mocks.useLayerFiles.mockReturnValue({ layers: [] })
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+
+describe('a concept with no sections', () => {
+  it('shows a quiet note and an Open file affordance instead of an empty panel', async () => {
+    mocks.useStore.mockReturnValue(storeWith([empty()], 'decisions/empty-note'))
+    mocks.useLayerFiles.mockReturnValue({
+      layers: [{
+        layer: 'personal', kind: 'files', root: '/vault', fileCount: 1, truncated: false,
+        files: [{ path: 'personal/decisions/empty-note.md', name: 'empty-note.md', rel: 'decisions/empty-note.md', ext: '.md', kind: 'text', markdown: true }],
+      }],
+    })
+    await act(async () => root.render(<Concepts />))
+
+    expect(container.textContent).toContain('This concept has no sections — the file may be empty.')
+    expect(button('Open file')).toBeTruthy()
+  })
+
+  it('falls back to a Files-tab affordance when no file is listed for the winning contributor', async () => {
+    const openFilesScope = vi.fn()
+    mocks.useStore.mockReturnValue(storeWith([empty()], 'decisions/empty-note', openFilesScope))
+    await act(async () => root.render(<Concepts />))
+
+    const browse = button('Browse personal in Files')
+    expect(browse).toBeTruthy()
+    await act(async () => browse?.click())
+    expect(openFilesScope).toHaveBeenCalledWith('personal')
+  })
+
+  it('marks the concept "empty" in the list so it is triageable without opening it', async () => {
+    mocks.useStore.mockReturnValue(storeWith([populated(), empty()], 'decisions/primary-db'))
+    await act(async () => root.render(<Concepts />))
+
+    const rows = Array.from(container.querySelectorAll('.cc-navigator-detail > div > button'))
+    const emptyRow = rows.find((row) => row.textContent?.includes('Empty note'))
+    const populatedRow = rows.find((row) => row.textContent?.includes('Primary database'))
+    expect(emptyRow?.textContent).toContain('empty')
+    expect(populatedRow?.textContent).not.toContain('empty')
+  })
+})
+
+// WP-G: Knowledge search calls the engine's full-text /api/search in live
+// mode, debounced, while the instant title/id substring filter (above) keeps
+// serving the result until the engine answers or fails.
+describe('Knowledge search (live mode)', () => {
+  function liveStoreWith(concepts: Concept[], query: string, search = vi.fn()) {
+    return {
+      mode: 'live', sources: [], reloadKey: 0,
+      query, concepts, selConcept: concepts[0]?.id ?? '',
+      setSelConcept: vi.fn(), openFilesScope: vi.fn(), search,
+    }
+  }
+
+  function rows(): HTMLButtonElement[] {
+    return Array.from(container.querySelectorAll('.cc-navigator-detail > div > button'))
+  }
+
+  beforeEach(() => { vi.useFakeTimers() })
+  afterEach(() => { vi.useRealTimers() })
+
+  it('debounces the query before calling the engine search', async () => {
+    const search = vi.fn().mockResolvedValue([])
+    mocks.useStore.mockReturnValue(liveStoreWith([populated()], 'singlestore', search))
+    await act(async () => root.render(<Concepts />))
+
+    expect(search).not.toHaveBeenCalled()
+    await act(async () => { await vi.advanceTimersByTimeAsync(249) })
+    expect(search).not.toHaveBeenCalled()
+    await act(async () => { await vi.advanceTimersByTimeAsync(1) })
+    expect(search).toHaveBeenCalledTimes(1)
+    expect(search).toHaveBeenCalledWith('singlestore')
+  })
+
+  it('narrows and reorders the list to the engine hits once they land', async () => {
+    const a = populated()
+    const b: Concept = { ...populated(), id: 'decisions/other', title: 'Other decision' }
+    const search = vi.fn().mockResolvedValue([{ id: b.id, title: b.title, score: 5, layers: ['personal'], snippet: '' }])
+    mocks.useStore.mockReturnValue(liveStoreWith([a, b], 'other', search))
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+    const list = rows()
+    expect(list).toHaveLength(1)
+    expect(list[0].textContent).toContain(b.title)
+  })
+
+  it('shows a content-search hint, not the title-only one, when the engine finds nothing', async () => {
+    const search = vi.fn().mockResolvedValue([])
+    mocks.useStore.mockReturnValue(liveStoreWith([populated()], 'nomatch', search))
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+    expect(container.textContent).toContain('No matches in titles or content.')
+  })
+
+  it('falls back to the substring filter silently when the engine call fails', async () => {
+    // The store's search() action never throws — a failed engine call
+    // resolves to null, which is exactly what this exercises.
+    const search = vi.fn().mockResolvedValue(null)
+    mocks.useStore.mockReturnValue(liveStoreWith([populated()], 'primary', search))
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+    // Substring match on the title still renders; no error, no empty state.
+    expect(rows()).toHaveLength(1)
+    expect(container.textContent).toContain('Primary database')
+  })
+
+  it('never calls the engine search in demo mode', async () => {
+    const search = vi.fn()
+    mocks.useStore.mockReturnValue({ ...liveStoreWith([populated()], 'primary', search), mode: 'demo' })
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+    expect(search).not.toHaveBeenCalled()
+    // Demo mode still gets the plain substring result.
+    expect(rows()).toHaveLength(1)
+  })
+
+  // FIX 1: the engine has no prefix matching (BM25F over whole stemmed
+  // tokens), so a mid-word query the engine misses must not blank a list the
+  // substring filter would still populate.
+  it('keeps a substring match visible when the engine answers empty on a partial word', async () => {
+    const search = vi.fn().mockResolvedValue([])
+    mocks.useStore.mockReturnValue(liveStoreWith([populated()], 'prim', search))
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+    expect(search).toHaveBeenCalledWith('prim')
+    expect(rows()).toHaveLength(1)
+    expect(container.textContent).toContain('Primary database')
+    expect(container.textContent).not.toContain('No matching concepts')
+  })
+
+  // FIX 2: engineHits from the PREVIOUS query must not survive a query
+  // change — only the substring filter (recomputed synchronously) should
+  // render until the new debounced answer lands.
+  it('clears stale engine hits as soon as the query changes, before the new answer lands', async () => {
+    const a = populated()
+    const b: Concept = { ...populated(), id: 'decisions/other', title: 'Other decision' }
+    let resolveSecond: (hits: SearchHit[]) => void = () => {}
+    const search = vi.fn()
+      .mockResolvedValueOnce([{ id: a.id, title: a.title, score: 5, layers: ['personal'], snippet: '' }])
+      .mockImplementationOnce(() => new Promise<SearchHit[]>((resolve) => { resolveSecond = resolve }))
+    const store = liveStoreWith([a, b], 'primary', search)
+    mocks.useStore.mockReturnValue(store)
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+    expect(rows().map((r) => r.textContent)).toEqual([expect.stringContaining('Primary database')])
+
+    // Point the mocked store at a new query — `Concepts` is a props-less
+    // `memo`, so a second `root.render()` call would bail out without ever
+    // re-invoking it (verified: an external value change alone never
+    // reaches a props-less memoized component here — only the component's
+    // OWN state can force it to read the store hooks again). Dispatching the
+    // close-detail event it already listens for triggers exactly that kind
+    // of internal state update, forcing it to re-render and read the new
+    // query — the same thing a real query keystroke does via context in the
+    // live app.
+    mocks.useStore.mockReturnValue({ ...store, query: 'other' })
+    await act(async () => { window.dispatchEvent(new Event('contextcake:close-detail')) })
+
+    // `a`'s stale hit from the first search must be gone immediately — well
+    // before the new debounced search resolves. (The detail panel on the
+    // right keeps showing whatever is still selected — that's unrelated to
+    // this bug, so the assertion is scoped to the list rows.)
+    const list = rows().map((r) => r.textContent ?? '')
+    expect(list.some((text) => text.includes('Primary database'))).toBe(false)
+    expect(list.some((text) => text.includes('Other decision'))).toBe(true)
+
+    resolveSecond([])
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+  })
+
+  // FIX 5: the effect used to depend on both `q` (trimmed+lowercased) and
+  // `query` (raw), so a trailing space or a capitalization change — neither
+  // of which moves `q` — still re-ran it, and its setEngineHits(null) reset
+  // fired a second, identical search while dropping the list to substring
+  // order in between. Measured before the fix: 2 search calls for one
+  // meaningful query, with the ranked list blanked between them.
+  it('does not re-fire the search, or blank the ranked list, on a keystroke that leaves the normalized query unchanged', async () => {
+    const a = populated()
+    const b: Concept = { ...populated(), id: 'decisions/other', title: 'Other decision' }
+    // Engine ranks b above a — a different order than substring/insertion
+    // order — so a reset back to the substring list would be observable.
+    const search = vi.fn().mockResolvedValue([
+      { id: b.id, title: b.title, score: 5, layers: ['personal'], snippet: '' },
+      { id: a.id, title: a.title, score: 1, layers: ['personal'], snippet: '' },
+    ])
+    const store = liveStoreWith([a, b], 'alpha', search)
+    mocks.useStore.mockReturnValue(store)
+    await act(async () => root.render(<Concepts />))
+    await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+    expect(search).toHaveBeenCalledTimes(1)
+    expect(rows().map((r) => r.textContent)).toEqual([
+      expect.stringContaining(b.title),
+      expect.stringContaining(a.title),
+    ])
+
+    for (const nextQuery of ['alpha ', 'ALPHA']) {
+      mocks.useStore.mockReturnValue({ ...store, query: nextQuery })
+      await act(async () => { window.dispatchEvent(new Event('contextcake:close-detail')) })
+      // Still the engine's ranked order, immediately — never reset to
+      // substring order (which would be empty here) in between.
+      expect(rows().map((r) => r.textContent)).toEqual([
+        expect.stringContaining(b.title),
+        expect.stringContaining(a.title),
+      ])
+      expect(search).toHaveBeenCalledTimes(1)
+    }
+  })
+
+  // FIX 6: the union of engine hits + substring matches is right (it keeps
+  // partial words alive — see the FIX 1 test above), but when the engine
+  // answers precisely, its one ranked hit rendered visually indistinguishable
+  // from the substring-only rows beneath it.
+  describe('Top matches / Also contains divider', () => {
+    it('shows both labels when the engine half and the substring-only half are both non-empty', async () => {
+      const a = populated()
+      const b: Concept = { ...populated(), id: 'decisions/other-primary', title: 'Other primary' }
+      // The engine answers with only `a`; `b` reaches the list purely via the
+      // substring filter (its id/title also contain "primary").
+      const search = vi.fn().mockResolvedValue([{ id: a.id, title: a.title, score: 5, layers: ['personal'], snippet: '' }])
+      mocks.useStore.mockReturnValue(liveStoreWith([a, b], 'primary', search))
+      await act(async () => root.render(<Concepts />))
+      await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+      expect(rows()).toHaveLength(2)
+      expect(container.textContent).toContain('Top matches')
+      expect(container.textContent).toContain('Also contains')
+    })
+
+    it('hides both labels when the engine half is empty (substring-only)', async () => {
+      const search = vi.fn().mockResolvedValue([])
+      mocks.useStore.mockReturnValue(liveStoreWith([populated()], 'primary', search))
+      await act(async () => root.render(<Concepts />))
+      await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+      expect(rows()).toHaveLength(1)
+      expect(container.textContent).not.toContain('Top matches')
+      expect(container.textContent).not.toContain('Also contains')
+    })
+
+    it('hides both labels when the engine half already covers every row (nothing substring-only left)', async () => {
+      const a = populated()
+      const search = vi.fn().mockResolvedValue([{ id: a.id, title: a.title, score: 5, layers: ['personal'], snippet: '' }])
+      mocks.useStore.mockReturnValue(liveStoreWith([a], 'primary', search))
+      await act(async () => root.render(<Concepts />))
+      await act(async () => { await vi.advanceTimersByTimeAsync(250) })
+
+      expect(rows()).toHaveLength(1)
+      expect(container.textContent).not.toContain('Top matches')
+      expect(container.textContent).not.toContain('Also contains')
+    })
+  })
+})
diff --git a/apps/console/src/views/Concepts.tsx b/apps/console/src/views/Concepts.tsx
index a8de76d..f5bfac4 100644
--- a/apps/console/src/views/Concepts.tsx
+++ b/apps/console/src/views/Concepts.tsx
@@ -1,16 +1,84 @@
-import { memo, useEffect, useRef, useState } from 'react'
+import { Fragment, memo, useEffect, useRef, useState } from 'react'
 import { C, css, conceptTypeStyle, MONO } from '../theme'
 import { LayerChip } from '../components/LayerChip'
 import { ConceptDetail } from '../components/ConceptDetail'
 import { useDetailSurface } from '../components/useDetailSurface'
 import { useStoreData, useStoreInput, useStoreNav } from '../store'
+import type { Concept } from '../data'
+import type { SearchHit } from '../types'
+
+/** How long a keystroke waits before it becomes an /api/search request. */
+const SEARCH_DEBOUNCE_MS = 250
 
 function ConceptsInner() {
-  const { setSelConcept, concepts } = useStoreData()
+  const { setSelConcept, concepts, mode, search } = useStoreData()
   const { selConcept } = useStoreNav()
   const { query } = useStoreInput()
   const q = query.trim().toLowerCase()
-  const list = concepts.filter((c) => !q || `${c.title} ${c.id}`.toLowerCase().includes(q))
+  const substringList = concepts.filter((c) => !q || `${c.title} ${c.id}`.toLowerCase().includes(q))
+
+  // Engine full-text search (live mode only). `null` means "no answer to show
+  // yet" — either nothing has been typed, the debounced request is still in
+  // flight, or the engine failed/is too old — and the substring filter above
+  // is what renders in every one of those cases. A non-null array (possibly
+  // empty) is the engine's own answer. It is reset to `null` at the top of
+  // every run of this effect — not only when the query empties — so a query
+  // change immediately falls back to the substring list instead of rendering
+  // the PREVIOUS query's hits for the debounce window + round-trip.
+  const [engineHits, setEngineHits] = useState<SearchHit[] | null>(null)
+  useEffect(() => {
+    setEngineHits(null)
+    if (mode !== 'live' || !q) return
+    let cancelled = false
+    const timer = setTimeout(() => {
+      void search(query.trim()).then((hits) => { if (!cancelled) setEngineHits(hits) })
+    }, SEARCH_DEBOUNCE_MS)
+    return () => { cancelled = true; clearTimeout(timer) }
+    // `query` (raw) is read inside, deliberately not a dependency: depending
+    // on both `q` (trimmed+lowercased) and `query` re-ran this — and its
+    // setEngineHits(null) reset — on a trailing-space or capitalization-only
+    // keystroke that changes `query` but not the normalized search term,
+    // re-firing an identical search and blanking the ranked list in between.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [mode, q, search])
+
+  // A hit for a concept not in the loaded list is skipped rather than
+  // rendered as a dead row — resolve-all supplies the full set, so this only
+  // happens for a concept still resolving in the background.
+  const usingEngine = mode === 'live' && q !== '' && engineHits !== null
+  // Union, not replace: the engine is BM25F over whole stemmed tokens with no
+  // prefix matching, so typing "primary" one keystroke at a time returns zero
+  // hits until the word completes ("prim"/"prima"/"primar" all miss; only
+  // "primary" hits) — letting the engine's answer wholesale replace the
+  // substring list blanked the list mid-word. Engine hits render first, in
+  // the engine's own rank order (a relevance signal the substring filter
+  // doesn't have); any concept the substring filter also matches but the
+  // engine didn't return follows, deduped by id. So the "no matches" empty
+  // state below is only reachable when both lists come back empty.
+  // `rankedCount` is how many of `list`'s leading entries came from the
+  // engine half of the union above, vs. the substring-only tail — the split
+  // point the "Top matches" / "Also contains" divider renders at below.
+  let rankedCount = 0
+  const list = usingEngine
+    ? (() => {
+        const seen = new Set<string>()
+        const merged: Concept[] = []
+        for (const hit of engineHits) {
+          const match = concepts.find((c) => c.id === hit.id)
+          if (match && !seen.has(match.id)) { seen.add(match.id); merged.push(match); rankedCount += 1 }
+        }
+        for (const c of substringList) {
+          if (!seen.has(c.id)) { seen.add(c.id); merged.push(c) }
+        }
+        return merged
+      })()
+    : substringList
+  // Only when the engine answered precisely AND the substring filter still
+  // has something extra to say — a 1-hit engine answer next to 400
+  // substring-only ids otherwise renders as 401 undifferentiated rows, with
+  // the engine's precision visually indistinguishable from the noise below
+  // it.
+  const showMatchDivider = rankedCount > 0 && rankedCount < list.length
   const selCpt = concepts.find((c) => c.id === selConcept) || null
   const [detailOpen, setDetailOpen] = useState(Boolean(selConcept))
   const selectedButton = useRef<HTMLButtonElement | null>(null)
@@ -22,14 +90,21 @@ function ConceptsInner() {
   }, [])
 
   if (concepts.length === 0) return <div className="cc-ui-empty"><strong>No concepts yet</strong><p>Add or index a source to build the resolved cascade.</p></div>
-  if (list.length === 0) return <div className="cc-ui-empty"><strong>No matching concepts</strong><p>Try a title, concept ID, or type.</p></div>
+  if (list.length === 0) {
+    return (
+      <div className="cc-ui-empty">
+        <strong>No matching concepts</strong>
+        <p>{usingEngine ? 'No matches in titles or content.' : 'Try a title, concept ID, or type.'}</p>
+      </div>
+    )
+  }
 
   return (
     <div ref={detail.containerRef} className="cc-navigator-detail" style={css('display:grid; grid-template-columns:minmax(240px,280px) minmax(0,1fr); gap:12px; align-items:start;')}>
       <div style={css('display:flex; flex-direction:column; gap:8px;')}>
-        {list.map((c) => {
+        {list.map((c, i) => {
           const selected = c.id === selConcept
-          return (
+          const row = (
             <button
               key={c.id}
               className="cc-h-bd-strong"
@@ -41,6 +116,9 @@ function ConceptsInner() {
                 <span style={conceptTypeStyle(c.type)}>{c.type}</span>
                 {c.conflict && <span title="has conflict" style={css('width:7px; height:7px; border-radius:999px; background:#C77D2A;')} />}
                 {c.draft && <span style={css(`font-size:10px; font-family:${MONO}; color:#7A5A28;`)}>draft</span>}
+                {/* No sections to read — a dead end worth flagging here so it's
+                    triageable from the list, not only discovered by opening it. */}
+                {c.sections.length === 0 && <span title="This concept has no sections" style={css(`font-size:10px; font-family:${MONO}; color:#8A8A82;`)}>empty</span>}
               </div>
               <div style={css('font-weight:600; font-size:13.5px; margin-top:7px;')}>{c.title}</div>
               <code style={css(`display:block; font-family:${MONO}; font-size:11px; color:#8A8A82; margin-top:3px;`)}>{c.id}</code>
@@ -49,6 +127,28 @@ function ConceptsInner() {
               </div>
             </button>
           )
+          // Divider between the engine's ranked half and the substring-only
+          // tail (F6) — same small-caption idiom as Triage's "Why it routed
+          // here" / "Where it lands" pair. Only rendered when both halves are
+          // non-empty (showMatchDivider), so a plain substring list or an
+          // all-engine answer never grows an empty-handed label.
+          if (showMatchDivider && i === 0) {
+            return (
+              <Fragment key={c.id}>
+                <div style={css('font-size:11px; font-weight:600; letter-spacing:0.06em; text-transform:uppercase; color:#8A8A82;')}>Top matches</div>
+                {row}
+              </Fragment>
+            )
+          }
+          if (showMatchDivider && i === rankedCount) {
+            return (
+              <Fragment key={c.id}>
+                <div style={css('font-size:11px; font-weight:600; letter-spacing:0.06em; text-transform:uppercase; color:#8A8A82; margin-top:6px;')}>Also contains</div>
+                {row}
+              </Fragment>
+            )
+          }
+          return row
         })}
       </div>
 
diff --git a/apps/console/src/views/Conflicts.test.tsx b/apps/console/src/views/Conflicts.test.tsx
index dd5cbc2..a32913d 100644
--- a/apps/console/src/views/Conflicts.test.tsx
+++ b/apps/console/src/views/Conflicts.test.tsx
@@ -17,7 +17,7 @@ let root: Root
 
 function storeWith(conflicts: Conflict[], selConflict: string) {
   return {
-    mode: 'demo', query: '',
+    mode: 'demo', query: '', setQuery: vi.fn(),
     conflicts,
     selConflict,
     setSelConflict: vi.fn(),
@@ -90,6 +90,58 @@ const codeConflict: Conflict = {
   ],
 }
 
+const listConflict: Conflict = {
+  ...freshConflict,
+  id: 'decisions/primary-db::tags',
+  sectionKey: 'tags',
+  section: 'Tags',
+  title: 'Tags — Primary database',
+  kind: 'frontmatter_value',
+  isList: true,
+  contributions: [
+    { layer: 'personal', sourceLayer: 'personal', value: '["postgres","oltp"]', updated: '2026-05-12' },
+    { layer: 'team', sourceLayer: 'team', value: '["mysql"]', updated: '2026-06-01' },
+  ],
+}
+
+const brokenLinkConflict: Conflict = {
+  ...freshConflict,
+  id: 'decisions/primary-db::choice::missing-target',
+  kind: 'broken_link',
+  target: 'decisions/missing',
+  contributions: [
+    { layer: 'personal', sourceLayer: 'personal', value: 'decisions/missing', updated: '2026-05-12' },
+  ],
+}
+
+const companyContributorConflict: Conflict = {
+  ...freshConflict,
+  id: 'other/concept::field',
+  concept: 'other/concept',
+  sectionKey: 'field',
+  section: 'Field',
+  title: 'Field — Other concept',
+  contributions: [
+    { layer: 'company', sourceLayer: 'company', value: 'Company answer.', updated: '2026-05-12' },
+  ],
+}
+
+const resolvedViaEffectiveSource: Conflict = {
+  ...freshConflict,
+  id: 'decisions/primary-db::resolved-effective',
+  sectionKey: 'resolved-effective',
+  section: 'Resolved effective',
+  title: 'Resolved effective — Primary database',
+  status: 'resolved',
+  discrepancyStatus: 'resolved',
+  effectiveSource: 'company',
+  // Deliberately no 'company' contribution in the snapshot — the filter must
+  // still match on effectiveSource, not only the contributions array (F13).
+  contributions: [
+    { layer: 'team', sourceLayer: 'team', value: 'Postgres.', updated: '2026-01-01' },
+  ],
+}
+
 beforeEach(() => {
   ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
   container = document.createElement('div')
@@ -156,4 +208,190 @@ describe('Discrepancy Center', () => {
     await act(async () => { reason.value = 'different_scopes'; reason.dispatchEvent(new Event('change', { bubbles: true })) })
     expect(submit.disabled).toBe(false)
   })
+
+  it('gives every disposition radio the same name so they behave as one group', async () => {
+    mocks.useStore.mockReturnValue(storeWith([safeConflict], safeConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const radios = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]'))
+    expect(radios.length).toBeGreaterThan(1)
+    expect(new Set(radios.map((input) => input.name)).size).toBe(1)
+    expect(radios[0].name).not.toBe('')
+  })
+
+  // F22a: does ArrowDown move focus/selection between the disposition radios?
+  //
+  // jsdom cannot answer this directly — same-name radio-group arrow
+  // navigation is a browser default action implemented well below the DOM
+  // event layer (Blink's RadioInputType::handleKeydownEvent), not something
+  // triggered by dispatching a keydown event, trusted or not. A jsdom probe
+  // (`input.dispatchEvent(new KeyboardEvent('keydown', {key:'ArrowDown'}))`
+  // on a bare same-name radio pair, no framework involved) confirmed jsdom
+  // does not implement it — focus and `checked` were unchanged after the
+  // dispatch, so a "does ArrowDown move focus" assertion here would only
+  // test jsdom's fidelity, not this component.
+  //
+  // Manually verified instead, in a real Chromium tab (CDP-level keyboard
+  // input, not a synthetic DOM event) against the running app: focusing the
+  // first `cc-disposition` radio and pressing the real ArrowDown key moved
+  // both focus and `checked` to the second radio. No extra keydown handling
+  // was added — native same-name-radio-group behavior already covers this,
+  // which is exactly what the structural preconditions below exist to keep
+  // true: same `name`, no `<form>` boundary between them (an explicit form
+  // owner would scope the group to elements sharing THAT owner), and no
+  // radio hidden in a way (`display:none`, `disabled`) that would pull it out
+  // of the group's focus order.
+  it('keeps the disposition radios in one native focus-navigable group (no form owner, none display:none or disabled)', async () => {
+    mocks.useStore.mockReturnValue(storeWith([safeConflict], safeConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const radios = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"][name="cc-disposition"]'))
+    expect(radios.length).toBeGreaterThan(1)
+    for (const radio of radios) {
+      expect(radio.form).toBeNull()
+      expect(radio.disabled).toBe(false)
+      expect(getComputedStyle(radio).display).not.toBe('none')
+    }
+  })
+
+  it('starts the compose field empty and submits exactly what was typed, never the old value plus new text', async () => {
+    const store = storeWith([freshConflict], freshConflict.id)
+    mocks.useStore.mockReturnValue(store)
+    await act(async () => root.render(<Conflicts />))
+
+    const composeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    await act(async () => composeRadio.click())
+
+    const textarea = container.querySelector<HTMLTextAreaElement>('textarea[aria-label="Reconciled Markdown"]')!
+    expect(textarea.value).toBe('')
+    expect(textarea.placeholder).toContain('Write the reconciled answer')
+
+    const submit = Array.from(container.querySelectorAll<HTMLButtonElement>('button')).find((button) => button.textContent?.includes('Simulate reconciled answer'))!
+    expect(submit.disabled).toBe(true)
+
+    await act(async () => {
+      const setter = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, 'value')?.set
+      setter?.call(textarea, 'Only the freshly typed reconciliation.')
+      textarea.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    expect(submit.disabled).toBe(false)
+
+    await act(async () => submit.click())
+    expect(store.decideDiscrepancy).toHaveBeenCalledWith(expect.objectContaining({ content: 'Only the freshly typed reconciliation.' }))
+  })
+
+  it('resets the compose field to empty when the selected conflict changes', async () => {
+    // Conflicts is a props-less memo (see the note at the bottom of this
+    // file's subject) and the store hooks are mocked as plain functions, not
+    // reactive context — so a second root.render() with the same (empty)
+    // props bails out via memo and never re-invokes the component. Force a
+    // genuine remount, the same way a real navigation to a different
+    // discrepancy would, to exercise the conflict.id-keyed reset effect.
+    mocks.useStore.mockReturnValue(storeWith([freshConflict, staleConflict], freshConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const composeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    await act(async () => composeRadio.click())
+    const textarea = container.querySelector<HTMLTextAreaElement>('textarea[aria-label="Reconciled Markdown"]')!
+    await act(async () => {
+      const setter = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, 'value')?.set
+      setter?.call(textarea, 'Draft for the first conflict.')
+      textarea.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    expect(textarea.value).toBe('Draft for the first conflict.')
+
+    await act(async () => root.unmount())
+    root = createRoot(container)
+    mocks.useStore.mockReturnValue(storeWith([freshConflict, staleConflict], staleConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const composeRadioAfter = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    await act(async () => composeRadioAfter.click())
+    const textareaAfter = container.querySelector<HTMLTextAreaElement>('textarea[aria-label="Reconciled Markdown"]')!
+    expect(textareaAfter.value).toBe('')
+  })
+
+  it('offers to start the compose field from the winning contributor without prefilling it automatically', async () => {
+    mocks.useStore.mockReturnValue(storeWith([freshConflict], freshConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const composeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    await act(async () => composeRadio.click())
+
+    const textarea = container.querySelector<HTMLTextAreaElement>('textarea[aria-label="Reconciled Markdown"]')!
+    expect(textarea.value).toBe('')
+    const startButton = Array.from(container.querySelectorAll<HTMLButtonElement>('button')).find((button) => button.textContent?.startsWith('Start from'))!
+    expect(startButton).toBeTruthy()
+
+    await act(async () => startButton.click())
+    expect(textarea.value).toBe('SingleStore.')
+  })
+
+  it('disables compose for an array-typed frontmatter discrepancy and explains why', async () => {
+    mocks.useStore.mockReturnValue(storeWith([listConflict], listConflict.id))
+    await act(async () => root.render(<Conflicts />))
+
+    const composeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    expect(composeRadio.disabled).toBe(true)
+    expect(container.textContent).toContain('This field is a list — pick an existing answer or edit the file directly.')
+  })
+
+  it('labels a frontmatter compose field "Reconciled value" and hides the Markdown preview affordance', async () => {
+    const listConflictComposable: Conflict = { ...listConflict, isList: false }
+    mocks.useStore.mockReturnValue(storeWith([listConflictComposable], listConflictComposable.id))
+    await act(async () => root.render(<Conflicts />))
+
+    const composeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Write a reconciled answer'))!
+    await act(async () => composeRadio.click())
+
+    expect(container.querySelector('[aria-label="Reconciled value"]')).toBeTruthy()
+    expect(container.querySelector('[aria-label="Reconciled Markdown"]')).toBeFalsy()
+    expect(container.textContent).not.toContain('Preview Markdown')
+  })
+
+  it('offers "Target not created yet" for a broken-link discrepancy', async () => {
+    mocks.useStore.mockReturnValue(storeWith([brokenLinkConflict], brokenLinkConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const acknowledgeRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Keep the scoped difference'))!
+    await act(async () => acknowledgeRadio.click())
+    const options = Array.from(container.querySelectorAll<HTMLOptionElement>('[aria-label="Acknowledgement reason"] option')).map((option) => option.textContent)
+    expect(options).toContain('Target not created yet')
+  })
+
+  it('never offers "Target not created yet" for a non-broken-link discrepancy', async () => {
+    mocks.useStore.mockReturnValue(storeWith([freshConflict], freshConflict.id))
+    await act(async () => root.render(<Conflicts />))
+    const otherRadio = Array.from(container.querySelectorAll<HTMLInputElement>('input[type="radio"]')).find((input) => input.parentElement?.textContent?.includes('Keep the scoped difference'))!
+    await act(async () => otherRadio.click())
+    const otherOptions = Array.from(container.querySelectorAll<HTMLOptionElement>('[aria-label="Acknowledgement reason"] option')).map((option) => option.textContent)
+    expect(otherOptions).not.toContain('Target not created yet')
+  })
+
+  it('names the active search in the empty state and clears it on request', async () => {
+    const store = storeWith([freshConflict], freshConflict.id)
+    store.query = 'nothing will match this'
+    mocks.useStore.mockReturnValue(store)
+    await act(async () => root.render(<Conflicts />))
+
+    expect(container.textContent).toContain('No matches for "nothing will match this" in this status.')
+    const clear = Array.from(container.querySelectorAll<HTMLButtonElement>('button')).find((button) => button.textContent === 'Clear search')!
+    await act(async () => clear.click())
+    expect(store.setQuery).toHaveBeenCalledWith('')
+  })
+
+  it('still shows the generic empty state when no search is active', async () => {
+    mocks.useStore.mockReturnValue(storeWith([], ''))
+    await act(async () => root.render(<Conflicts />))
+    expect(container.textContent).toContain('No discrepancies in this view')
+    expect(container.textContent).not.toContain('No matches for')
+  })
+
+  it('matches a resolved discrepancy on effectiveSource even when its contribution snapshot lacks that source (F13)', async () => {
+    mocks.useStore.mockReturnValue(storeWith([companyContributorConflict, resolvedViaEffectiveSource], resolvedViaEffectiveSource.id))
+    await act(async () => root.render(<Conflicts />))
+
+    const resolvedTab = Array.from(container.querySelectorAll<HTMLButtonElement>('button')).find((button) => button.textContent === 'Resolved')!
+    await act(async () => resolvedTab.click())
+    expect(container.textContent).toContain('Resolved effective')
+
+    const sourceSelect = container.querySelector<HTMLSelectElement>('[aria-label="Source"]')!
+    await act(async () => { sourceSelect.value = 'company'; sourceSelect.dispatchEvent(new Event('change', { bubbles: true })) })
+
+    expect(container.textContent).toContain('Resolved effective')
+  })
 })
diff --git a/apps/console/src/views/Conflicts.tsx b/apps/console/src/views/Conflicts.tsx
index 587fde5..47daff2 100644
--- a/apps/console/src/views/Conflicts.tsx
+++ b/apps/console/src/views/Conflicts.tsx
@@ -19,6 +19,11 @@ const REASONS: { value: AcknowledgementReason; label: string }[] = [
   { value: 'source_specific_authority', label: 'Source-specific authority' },
   { value: 'other', label: 'Other' },
 ]
+// Broken-link-only: acknowledging why a link target doesn't exist yet is a
+// distinct reason from the general four above. The engine's allowedReasons
+// set (service.mjs) already accepts this value — verified before adding it
+// here, since the UI must never offer a reason the API would 400.
+const TARGET_MISSING_REASON: { value: AcknowledgementReason; label: string } = { value: 'target_missing', label: 'Target not created yet' }
 
 function formatDate(value?: string | null) {
   if (!value) return 'Date not recorded'
@@ -140,17 +145,32 @@ function DecisionPanel({ conflict, onClose }: { conflict: Conflict; onClose: ()
   const { mode, decideDiscrepancy, setDiscrepancyPriority, resolvingConflict, resolutionError, openFilesScope } = useStoreData()
   const [action, setAction] = useState<'choose_contribution' | 'compose' | 'acknowledge'>('choose_contribution')
   const [selectedSource, setSelectedSource] = useState(conflict.effectiveSource ?? conflict.contributions[0]?.sourceLayer ?? '')
-  const [content, setContent] = useState(conflict.contributions[0]?.value ?? '')
+  // Starts EMPTY, never pre-filled with an existing contributor's value. A
+  // compose field seeded with the old answer let a caret-position edit submit
+  // old+new concatenated as the "reconciled" content — real on-disk
+  // corruption in QA. "Start from <source>" below is the only way old content
+  // enters this field, and it is an explicit click, never automatic.
+  const [content, setContent] = useState('')
   const [reasonCode, setReasonCode] = useState<AcknowledgementReason | ''>('')
   const [note, setNote] = useState('')
   const [preview, setPreview] = useState(false)
   const busy = resolvingConflict === conflict.id
   const cannotWrite = conflict.kind === 'broken_link'
+  // The engine 400s a compose against an array-typed frontmatter value (a
+  // list field) — service.mjs rejects it outright. Disable the disposition
+  // here instead of round-tripping into that error.
+  const composeDisabled = conflict.kind === 'frontmatter_value' && conflict.isList === true
+  const isFrontmatterValue = conflict.kind === 'frontmatter_value'
+  const winningSource = conflict.effectiveSource ?? conflict.contributions[0]?.sourceLayer ?? null
+  const winningValue = conflict.contributions.find((item) => item.sourceLayer === winningSource)?.value
+  const reasonOptions = conflict.kind === 'broken_link'
+    ? [...REASONS.slice(0, -1), TARGET_MISSING_REASON, REASONS[REASONS.length - 1]]
+    : REASONS
 
   useEffect(() => {
     setAction('choose_contribution')
     setSelectedSource(conflict.effectiveSource ?? conflict.contributions[0]?.sourceLayer ?? '')
-    setContent(conflict.contributions[0]?.value ?? '')
+    setContent('')
     setReasonCode('')
     setNote('')
     setPreview(false)
@@ -171,12 +191,29 @@ function DecisionPanel({ conflict, onClose }: { conflict: Conflict; onClose: ()
       {resolutionError && <div className="cc-conflict-error" role="alert"><strong>Decision not applied.</strong> {resolutionError.message}</div>}
       <fieldset>
         <legend>Choose a safe disposition</legend>
-        <label><input type="radio" checked={action === 'choose_contribution'} disabled={cannotWrite} onChange={() => setAction('choose_contribution')} /> <span><strong>Use this answer everywhere</strong><small>Propagate one existing answer to every writable contributor.</small></span></label>
+        <label><input type="radio" name="cc-disposition" checked={action === 'choose_contribution'} disabled={cannotWrite} onChange={() => setAction('choose_contribution')} /> <span><strong>Use this answer everywhere</strong><small>Propagate one existing answer to every writable contributor.</small></span></label>
         {action === 'choose_contribution' && <select aria-label="Answer to use" value={selectedSource} onChange={(event) => setSelectedSource(event.target.value)}>{conflict.contributions.map((item) => <option key={item.sourceLayer} value={item.sourceLayer}>{item.sourceLayer}</option>)}</select>}
-        <label><input type="radio" checked={action === 'compose'} disabled={cannotWrite} onChange={() => setAction('compose')} /> <span><strong>Write a reconciled answer</strong><small>Compose a new Markdown value and propagate it to writable contributors.</small></span></label>
-        {action === 'compose' && <div className="cc-compose"><textarea aria-label="Reconciled Markdown" value={content} onChange={(event) => setContent(event.target.value)} /><button type="button" onClick={() => setPreview((value) => !value)}>{preview ? 'Edit Markdown' : 'Preview Markdown'}</button>{preview && <Markdown className="cc-compose-preview" source={content} />}</div>}
-        <label><input type="radio" checked={action === 'acknowledge'} onChange={() => setAction('acknowledge')} /> <span><strong>Keep the scoped difference</strong><small>Write no source content; record why the difference is intentional.</small></span></label>
-        {action === 'acknowledge' && <div className="cc-acknowledge"><select aria-label="Acknowledgement reason" value={reasonCode} onChange={(event) => setReasonCode(event.target.value as AcknowledgementReason)}><option value="">Choose a required reason…</option>{REASONS.map((reason) => <option key={reason.value} value={reason.value}>{reason.label}</option>)}</select><textarea aria-label="Optional local note" placeholder="Optional local note (never learned into a rule)" value={note} onChange={(event) => setNote(event.target.value)} /></div>}
+        <label><input type="radio" name="cc-disposition" checked={action === 'compose'} disabled={cannotWrite || composeDisabled} onChange={() => setAction('compose')} /> <span><strong>Write a reconciled answer</strong><small>{isFrontmatterValue ? 'Compose a new value and propagate it to writable contributors.' : 'Compose a new Markdown value and propagate it to writable contributors.'}</small></span></label>
+        {composeDisabled && <p className="cc-callout">This field is a list — pick an existing answer or edit the file directly.</p>}
+        {action === 'compose' && (
+          <div className="cc-compose">
+            <textarea
+              aria-label={isFrontmatterValue ? 'Reconciled value' : 'Reconciled Markdown'}
+              placeholder="Write the reconciled answer — it replaces every writable contributor's value"
+              value={content}
+              onChange={(event) => setContent(event.target.value)}
+            />
+            <div className="cc-compose-actions">
+              {winningSource && typeof winningValue === 'string' && !content && (
+                <button type="button" onClick={() => setContent(winningValue)}>Start from {winningSource}</button>
+              )}
+              {!isFrontmatterValue && <button type="button" onClick={() => setPreview((value) => !value)}>{preview ? 'Edit Markdown' : 'Preview Markdown'}</button>}
+            </div>
+            {!isFrontmatterValue && preview && <Markdown className="cc-compose-preview" source={content} />}
+          </div>
+        )}
+        <label><input type="radio" name="cc-disposition" checked={action === 'acknowledge'} onChange={() => setAction('acknowledge')} /> <span><strong>Keep the scoped difference</strong><small>Write no source content; record why the difference is intentional.</small></span></label>
+        {action === 'acknowledge' && <div className="cc-acknowledge"><select aria-label="Acknowledgement reason" value={reasonCode} onChange={(event) => setReasonCode(event.target.value as AcknowledgementReason)}><option value="">Choose a required reason…</option>{reasonOptions.map((reason) => <option key={reason.value} value={reason.value}>{reason.label}</option>)}</select><textarea aria-label="Optional local note" placeholder="Optional local note (never learned into a rule)" value={note} onChange={(event) => setNote(event.target.value)} /></div>}
       </fieldset>
       {cannotWrite && <p className="cc-callout">Broken links require a source edit. Open the contributing file, or acknowledge why this link is intentionally unresolved.</p>}
       {!!conflict.affectedLinks?.length && (
@@ -187,7 +224,7 @@ function DecisionPanel({ conflict, onClose }: { conflict: Conflict; onClose: ()
       )}
       <label className="cc-priority-assign"><span>Review priority</span><select aria-label="Assign priority" value={conflict.priority ?? 'unassigned'} onChange={(event) => void setDiscrepancyPriority(conflict.id, event.target.value)}><option value="unassigned">Unassigned</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option></select></label>
       <div className="cc-decision-actions">
-        <button type="button" className="cc-button-primary" disabled={busy || (action === 'acknowledge' && !reasonCode) || (action === 'compose' && !content.trim()) || (action === 'choose_contribution' && cannotWrite)} onClick={() => void submit()}>
+        <button type="button" className="cc-button-primary" disabled={busy || (action === 'acknowledge' && !reasonCode) || (action === 'compose' && (composeDisabled || !content.trim())) || (action === 'choose_contribution' && cannotWrite)} onClick={() => void submit()}>
           {busy ? 'Applying…' : mode === 'demo' ? action === 'choose_contribution' ? `Simulate using ${selectedSource}` : action === 'compose' ? 'Simulate reconciled answer' : 'Simulate acknowledgement' : action === 'choose_contribution' ? `Use ${selectedSource} everywhere` : action === 'compose' ? 'Write reconciled answer' : 'Acknowledge difference'}
         </button>
         {conflict.contributions.map((item) => <button type="button" key={item.sourceLayer} onClick={() => openFilesScope(item.sourceLayer)}>Open {item.sourceLayer} files</button>)}
@@ -215,7 +252,7 @@ function Rules() {
 }
 
 function ConflictsInner() {
-  const { mode, conflicts, setSelConflict } = useStoreData()
+  const { mode, conflicts, setSelConflict, setQuery } = useStoreData()
   const { selConflict } = useStoreNav()
   const { query } = useStoreInput()
   const [status, setStatus] = useState('actionable')
@@ -237,7 +274,7 @@ function ConflictsInner() {
     const statusMatch = status === 'all' || (status === 'actionable' ? ['needs_review', 'reopened'].includes(displayStatus) : status === 'automated' ? ['auto_ready', 'blocked'].includes(displayStatus) : displayStatus === status)
     return statusMatch && (kind === 'all' || item.kind === kind)
       && (owner === 'all' || (item.owner ?? 'Unassigned') === owner)
-      && (source === 'all' || item.contributions.some((entry) => entry.sourceLayer === source))
+      && (source === 'all' || item.effectiveSource === source || item.contributions.some((entry) => entry.sourceLayer === source))
       && (priority === 'all' || (item.priority ?? 'unassigned') === priority)
       && (!newerOnly || item.contributions.some((entry) => entry.fresherDissent))
       && (!normalizedQuery || [item.concept, item.title, item.section, item.owner, item.kind, ...item.contributions.flatMap((entry) => [entry.sourceLayer, entry.value])].some((value) => String(value ?? '').toLowerCase().includes(normalizedQuery)))
@@ -270,7 +307,9 @@ function ConflictsInner() {
       <div ref={detail.containerRef} className="cc-conflict-layout cc-navigator-detail">
         <div ref={listRef} className="cc-conflict-list" role="listbox" aria-label="Discrepancies" onKeyDown={onListKeyDown}>
           {visible.map((item) => { const selectedRow = item.id === selected?.id; const displayStatus = item.discrepancyStatus ?? 'needs_review'; return <button type="button" role="option" aria-selected={selectedRow} tabIndex={selectedRow ? 0 : -1} key={item.id} className="cc-conflict-row" data-selected={selectedRow} onClick={(event) => { selectedButton.current = event.currentTarget; setSelConflict(item.id); setDetailOpen(true) }}><span className="cc-conflict-row-top"><span className="cc-kind-pill">{KIND_LABEL[item.kind ?? 'section_content']}</span><span className="cc-conflict-row-status">{STATUS_LABEL[displayStatus]}</span></span><span className="cc-conflict-row-title">{item.section}</span><code>{item.concept}</code><span className="cc-conflict-row-foot"><span>{item.owner ?? 'Unassigned'} · {item.priority ?? 'unassigned'} priority</span><span>{item.contributions.length} sources</span></span></button> })}
-          {!visible.length && <div className="cc-conflict-empty"><strong>No discrepancies in this view</strong><p>Adjust the filters or return to Needs review.</p></div>}
+          {!visible.length && (normalizedQuery
+            ? <div className="cc-conflict-empty"><strong>No matches for &quot;{query.trim()}&quot; in this status.</strong><p>The search keeps filtering across status tabs until cleared.</p><button type="button" onClick={() => setQuery('')}>Clear search</button></div>
+            : <div className="cc-conflict-empty"><strong>No discrepancies in this view</strong><p>Adjust the filters or return to Needs review.</p></div>)}
         </div>
         {selected && <section ref={detail.panelRef} {...detail.panelProps} className="cc-conflict-detail cc-navigator-detail-panel" data-open={detailOpen || undefined} aria-label={`${selected.title} discrepancy detail`}><button type="button" className="cc-detail-close" onClick={() => { setDetailOpen(false); requestAnimationFrame(() => selectedButton.current?.focus({ preventScroll: true })) }}>Close</button><div className="cc-discrepancy-path"><code>{selected.concept}</code><span>{selected.section}</span></div><div className="cc-discrepancy-title"><div><span className="cc-kind-pill">{KIND_LABEL[selected.kind ?? 'section_content']}</span><h2>Why this needs attention</h2></div><span className="cc-status-large">{STATUS_LABEL[selected.discrepancyStatus ?? 'needs_review']}</span></div><p className="cc-discrepancy-explanation">{selected.kind === 'broken_link' ? `The effective content links to ${selected.target}, but no settled source currently provides that concept.` : selected.kind === 'frontmatter_value' ? `Multiple contributors author different values for “${selected.section}”.` : selected.kind === 'changed_after_decision' ? 'A contributor changed after the previous decision, so the discrepancy reopened automatically.' : `Multiple contributors give materially different answers for “${selected.section}”.`}</p><div className="cc-evidence-grid"><div><span>Effective source</span><strong>{selected.effectiveSource ?? 'None'}</strong></div><div><span>Why it won</span><strong>{selected.winnerReason}</strong></div><div><span>Owner</span><strong>{selected.owner ?? 'Unassigned'}</strong></div><div><span>Source health</span><strong>{selected.sourceHealth?.every((item) => item?.status === 'ok') ? 'All healthy' : 'Needs attention'}</strong></div></div>{selected.ruleConflict && <div className="cc-conflict-error" role="alert"><strong>Rule conflict.</strong> Matching rules disagree, so no automatic action will run.</div>}{selected.matchingRules?.map((rule) => <div className="cc-rule-match" key={rule.id}>Matched {rule.scope} {rule.mode} rule <code>{rule.id}</code> from {rule.evidenceDecisionIds.length} decisions.</div>)}<section><h3>Compare every answer</h3><div className="cc-answer-stack">{selected.contributions.map((choice) => <SourceAnswer key={choice.sourceLayer} choice={choice} effective={selected.contributions.find((item) => item.sourceLayer === selected.effectiveSource)?.value ?? selected.contributions[0]?.value ?? ''} isEffective={choice.sourceLayer === selected.effectiveSource} />)}</div></section>{!['resolved', 'acknowledged'].includes(selected.discrepancyStatus ?? '') && <DecisionPanel conflict={selected} onClose={() => setDetailOpen(false)} />}<section><h3>Decision history</h3>{mode === 'demo' && <p className="cc-muted">Simulation history resets on reload.</p>}<History conflict={selected} /></section></section>}
       </div>
diff --git a/apps/console/src/views/Overview.test.tsx b/apps/console/src/views/Overview.test.tsx
index 7b9e063..e25d6ae 100644
--- a/apps/console/src/views/Overview.test.tsx
+++ b/apps/console/src/views/Overview.test.tsx
@@ -42,3 +42,34 @@ it('shows a calm resolved state when nothing needs review', async () => {
   await act(async () => root.render(<Overview />))
   expect(container.textContent).toContain('Nothing needs review')
 })
+
+// F3: the Cascade summary used to render the static company/team/personal
+// blurb and level no matter what actually fed a lane. A level-1 source with
+// no name matching its lane should read as itself — its real name and level —
+// not the generic "runbooks, decisions, system docs" / "2" it happened to
+// inherit from the lane it ranked into.
+it('names the real source and level behind a lane instead of the static blurb', async () => {
+  mocks.useStore.mockReturnValue({
+    mode: 'live', setView: mocks.setView,
+    signals: [], conflicts: [],
+    sources: [{ name: 'messy-vault', status: 'synced', layer: 'team', level: 1, conceptCount: 4 }],
+    concepts: [], activity: [], loadErrors: [],
+  })
+  await act(async () => root.render(<Overview />))
+  expect(container.textContent).toContain('messy-vault')
+  expect(container.textContent).toContain('1')
+  expect(container.textContent).not.toContain('runbooks, decisions, system docs')
+})
+
+// Demo mode's sources are already the canonical trio; the honest-labeling
+// pass must not disturb its existing static blurb.
+it('keeps the static cascade blurb in demo mode', async () => {
+  mocks.useStore.mockReturnValue({
+    mode: 'demo', setView: mocks.setView,
+    signals: [], conflicts: [],
+    sources: [{ name: 'team', status: 'synced', layer: 'team', level: 2, conceptCount: 4 }],
+    concepts: [], activity: [], loadErrors: [],
+  })
+  await act(async () => root.render(<Overview />))
+  expect(container.textContent).toContain('runbooks, decisions, system docs')
+})
diff --git a/apps/console/src/views/Overview.tsx b/apps/console/src/views/Overview.tsx
index 7b209e4..2fab787 100644
--- a/apps/console/src/views/Overview.tsx
+++ b/apps/console/src/views/Overview.tsx
@@ -40,7 +40,16 @@ function OverviewInner() {
         <div className="cc-section-heading"><div><h2 id="cc-cascade-summary">Cascade summary</h2><p>Higher layers win only for the sections they define; everything else is inherited.</p></div><button type="button" onClick={() => setView('canvas')}>Open Cascade</button></div>
         <div className="cc-cascade-summary">{[...layers].sort((a, b) => b.level - a.level).map((layer) => {
           const count = concepts.filter((concept) => concept.layers.includes(layer.id)).length
-          return <div key={layer.id}><span className="cc-cascade-level">{layer.level}</span><LayerChip id={layer.id} /><span>{layer.sub}</span><strong>{count} concept{count === 1 ? '' : 's'}</strong></div>
+          // Real levels and source names behind this lane (F3), not the static
+          // trio: a level-1 source that ranks into 'team' should say so here
+          // too, not just on the Canvas. Demo mode's sources are already the
+          // canonical company/team/personal trio, so this falls back to the
+          // static blurb there unchanged.
+          const rows = mode === 'demo' ? [] : sources.filter((source) => source.layer === layer.id)
+          const levels = [...new Set(rows.map((row) => row.level).filter((level): level is number => typeof level === 'number'))].sort((a, b) => a - b)
+          const levelLabel = levels.length ? levels.join('/') : String(layer.level)
+          const sourceLabel = rows.length ? rows.map((row) => row.name).join(', ') : layer.sub
+          return <div key={layer.id}><span className="cc-cascade-level">{levelLabel}</span><LayerChip id={layer.id} /><span>{sourceLabel}</span><strong>{count} concept{count === 1 ? '' : 's'}</strong></div>
         })}</div>
       </section>
 
diff --git a/apps/console/src/views/Sources.test.tsx b/apps/console/src/views/Sources.test.tsx
index b8c4bae..d0dd121 100644
--- a/apps/console/src/views/Sources.test.tsx
+++ b/apps/console/src/views/Sources.test.tsx
@@ -93,6 +93,12 @@ function ok(body: Record<string, unknown> = { ok: true }) {
   return new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } })
 }
 
+/** The metadata `dl`'s value cell for a given label ("Last success", "Last error", …). */
+function metadataValue(label: string): string | null {
+  const dt = Array.from(container.querySelectorAll('.cc-source-metadata dt')).find((item) => item.textContent === label)
+  return dt?.nextElementSibling?.textContent ?? null
+}
+
 beforeEach(() => {
   ;(globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT: boolean }).IS_REACT_ACT_ENVIRONMENT = true
   container = document.createElement('div')
@@ -126,6 +132,28 @@ describe('Sources rows', () => {
     expect(container.textContent).toContain('github · level 2')
   })
 
+  it('shows the error string in the Last error field, not just its date', async () => {
+    await mount([src({
+      name: 'acme-docs', sourceKind: 'github', level: 2, layer: 'team', status: 'degraded',
+      error: 'GitHub API 403 on /repos/acme/payments',
+      lastSuccessAt: '2026-07-28T09:00:00.000Z', lastErrorAt: '2026-07-28T10:05:00.000Z',
+    })])
+
+    expect(metadataValue('Last error')).toContain('GitHub API 403 on /repos/acme/payments')
+    expect(metadataValue('Last error')).not.toBe('None')
+    // The date is not the fact that matters here, but it's still worth keeping
+    // beside the message rather than dropping it.
+    expect(metadataValue('Last error')).toContain(new Date('2026-07-28T10:05:00.000Z').toLocaleString())
+    expect(metadataValue('Last success')).toBe(new Date('2026-07-28T09:00:00.000Z').toLocaleString())
+  })
+
+  it('reports "None" for Last error and "Not yet" for Last success on a source with neither', async () => {
+    await mount([src({ name: 'fresh' })])
+
+    expect(metadataValue('Last error')).toBe('None')
+    expect(metadataValue('Last success')).toBe('Not yet')
+  })
+
   it('surfaces missing and host-mismatched credentials without exposing a secret', async () => {
     await mount([
       src({ name: 'missing', authAlias: 'github.com/octocat', authState: 'missing-token' }),
diff --git a/apps/console/src/views/Sources.tsx b/apps/console/src/views/Sources.tsx
index ab3caa7..5ad1ee3 100644
--- a/apps/console/src/views/Sources.tsx
+++ b/apps/console/src/views/Sources.tsx
@@ -93,6 +93,18 @@ function fmtTime(iso: string): string {
   return Number.isNaN(t.getTime()) ? iso : t.toLocaleString()
 }
 
+/**
+ * The "Last error" metadata line. `lastErrorAt` alone used to render here — a
+ * bare date beside a live `s.error` string one field down, so a source that
+ * was actively failing still read "None" at a glance. The message is the
+ * fact that matters; the date is context for it, not a substitute.
+ */
+function lastErrorSummary(s: Source): string {
+  if (s.error) return s.lastErrorAt ? `${s.error} · ${fmtTime(s.lastErrorAt)}` : s.error
+  if (s.lastErrorAt) return fmtTime(s.lastErrorAt)
+  return 'None'
+}
+
 /** Sync applies to REST github layers and to clone-backed layers (origin set). */
 function canSync(s: Source): boolean {
   return !s.quarantined && (s.sourceKind === 'github' || Boolean(s.origin))
@@ -398,7 +410,7 @@ export function Sources({ onAddSource }: { onAddSource?: () => void }) {
 
             <dl className="cc-source-metadata">
               <div><dt>Last success</dt><dd>{s.lastSuccessAt ? fmtTime(s.lastSuccessAt) : 'Not yet'}</dd></div>
-              <div><dt>Last error</dt><dd>{s.lastErrorAt ? fmtTime(s.lastErrorAt) : 'None'}</dd></div>
+              <div><dt>Last error</dt><dd>{lastErrorSummary(s)}</dd></div>
               {/* "Not supported for this source kind" would be answering the
                   wrong question on an entry that is not a source at all. */}
               {!s.quarantined && <div><dt>Sync</dt><dd>{canSync(s) ? 'Available' : 'Not supported for this source kind'}</dd></div>}
diff --git a/package.json b/package.json
index bf51f7a..36412c8 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "Federated team knowledge with cascading layer precedence — OKF-compatible, MCP-ready.",
   "type": "module",
   "scripts": {
-    "test": "bash packages/core/tests/smoke-test.sh && bash packages/core/tests/resolver-test.sh && bash packages/core/tests/source-test.sh && bash packages/core/tests/files-source-test.sh && bash packages/core/tests/github-source-test.sh && node --test packages/core/tests/tokens.test.mjs && node --test packages/core/tests/git-auth.test.mjs && node --test packages/core/tests/manifest.test.mjs && node --test packages/core/tests/index-keys.test.mjs && node --test packages/core/tests/cache-source.test.mjs && node --test packages/core/tests/search.test.mjs && node --test packages/core/tests/conflict-resolutions.test.mjs && node --test packages/core/tests/discrepancies.test.mjs && node --test packages/core/tests/discrepancy-transactions.test.mjs && bash packages/core/tests/profile-runtime-test.sh && bash packages/core/tests/pack-test.sh && bash packages/core/tests/git-sync-test.sh && bash packages/core/tests/capture-test.sh && bash packages/core/tests/team-sync-mcp-test.sh && bash packages/core/tests/playground-test.sh && bash packages/core/tests/service-test.sh && bash packages/core/tests/mcp-respawn-test.sh && bash packages/core/tests/setup-robustness-test.sh && npm run eval && npm run test:metrics && npm run test:release-workflow && bash packages/core/tests/index-stability-test.sh && bash packages/core/tests/index-lifecycle-test.sh && bash packages/core/tests/graph-latency-test.sh",
+    "test": "bash packages/core/tests/smoke-test.sh && bash packages/core/tests/resolver-test.sh && bash packages/core/tests/source-test.sh && bash packages/core/tests/files-source-test.sh && bash packages/core/tests/github-source-test.sh && node --test packages/core/tests/tokens.test.mjs && node --test packages/core/tests/git-auth.test.mjs && node --test packages/core/tests/manifest.test.mjs && node --test packages/core/tests/index-keys.test.mjs && node --test packages/core/tests/cache-source.test.mjs && node --test packages/core/tests/layer-files.test.mjs && node --test packages/core/tests/search.test.mjs && node --test packages/core/tests/conflict-resolutions.test.mjs && node --test packages/core/tests/discrepancies.test.mjs && node --test packages/core/tests/discrepancy-transactions.test.mjs && bash packages/core/tests/profile-runtime-test.sh && bash packages/core/tests/pack-test.sh && bash packages/core/tests/git-sync-test.sh && bash packages/core/tests/capture-test.sh && bash packages/core/tests/team-sync-mcp-test.sh && bash packages/core/tests/playground-test.sh && bash packages/core/tests/service-test.sh && bash packages/core/tests/mcp-respawn-test.sh && bash packages/core/tests/setup-robustness-test.sh && npm run eval && npm run test:metrics && npm run test:release-workflow && bash packages/core/tests/index-stability-test.sh && bash packages/core/tests/index-lifecycle-test.sh && bash packages/core/tests/graph-latency-test.sh",
     "eval": "node packages/core/eval/run.mjs",
     "mcp": "node mcp-server.mjs",
     "playground": "node apps/playground/server.mjs",
diff --git a/packages/core/src/discrepancies.mjs b/packages/core/src/discrepancies.mjs
index 425ce03..234bdcf 100644
--- a/packages/core/src/discrepancies.mjs
+++ b/packages/core/src/discrepancies.mjs
@@ -90,16 +90,31 @@ export function buildDiscrepancies(concepts, {
   // current output. Keep its evidence discoverable from the append-only log so
   // "resolved" never means "forgotten". A current finding always wins this
   // projection (including a reopened finding after a later source edit).
+  // decisionMap indexes a decision under BOTH its canonical discrepancyId and
+  // its legacy conflictId, so this loop would otherwise visit the same decided
+  // discrepancy twice and emit two resolved rows for one resolution. Dedupe on
+  // the canonical id — discrepancyId when the decision recorded one, else the
+  // map key itself.
   const currentIds = new Set(out.map((item) => item.id));
+  const seenCanonical = new Set();
   for (const [id, history] of decisionsById) {
     if (!id.includes("::") || currentIds.has(id)) continue;
     const latest = history.at(-1);
     if (latest?.schemaVersion !== 2 || latest.action === "acknowledge") continue;
+    const canonicalId = latest.discrepancyId ?? id;
+    // A current finding always wins this projection (including a reopened
+    // finding after a later source edit) — decisionsById indexes the same
+    // decision under both discrepancyId and the legacy conflictId, so a
+    // decision whose legacy key merely doesn't collide with `currentIds` (the
+    // canonical id it resolves to does) must still be skipped here, or the
+    // live row above and this resolved-history row emit the same id twice.
+    if (seenCanonical.has(canonicalId) || currentIds.has(canonicalId)) continue;
+    seenCanonical.add(canonicalId);
     const contributions = (latest.contributions ?? []).map((item) => contribution(
       item.layer, item.level, item.updated, item.content, item.layer === latest.chosen?.layer,
     ));
     out.push({
-      id, legacyId: latest.conflictId, kind: latest.discrepancyKind ?? "section_content",
+      id: canonicalId, legacyId: latest.conflictId, kind: latest.discrepancyKind ?? "section_content",
       originalKind: latest.discrepancyKind ?? "section_content", conceptId: latest.conceptId,
       conceptTitle: latest.title ?? latest.conceptId, conceptType: latest.conceptType ?? "concept",
       key: latest.sectionKey ?? latest.fieldKey ?? latest.linkTarget ?? "unknown",
diff --git a/packages/core/src/discrepancy-rules.mjs b/packages/core/src/discrepancy-rules.mjs
index 0ca81d1..0212724 100644
--- a/packages/core/src/discrepancy-rules.mjs
+++ b/packages/core/src/discrepancy-rules.mjs
@@ -127,7 +127,7 @@ function validateRule(rule) {
   if (rule.action.type === "prefer_source") {
     if (typeof rule.action.source !== "string" || !sources.includes(rule.action.source)) throw new Error("Invalid preferred source");
   } else if (rule.action.type === "acknowledge") {
-    if (!["different_scopes", "temporary_migration", "source_specific_authority", "other"].includes(rule.action.reasonCode)) {
+    if (!["different_scopes", "temporary_migration", "source_specific_authority", "target_missing", "other"].includes(rule.action.reasonCode)) {
       throw new Error("Invalid acknowledgement reason");
     }
   } else throw new Error("Invalid discrepancy rule action");
diff --git a/packages/core/src/layer-files.mjs b/packages/core/src/layer-files.mjs
index 64eccab..76ab8ba 100644
--- a/packages/core/src/layer-files.mjs
+++ b/packages/core/src/layer-files.mjs
@@ -8,7 +8,8 @@
 //   GET  /api/files                 → { layers: [{ layer, kind, root, fileCount, files[] }] }
 //   GET  /api/file?path=<l>/<rel>   → { path, layer, rel, ext, kind, editable, text? }
 //   GET  /api/file/raw?path=…       → the bytes (images/PDF preview)
-//   PUT  /api/file                  → { path, text, modified? } overwrite an existing text file
+//   PUT  /api/file                  → { path, text, modified } overwrite an existing text file
+//                                      (modified required unless force: true)
 //   PUT  /api/section               → write one resolved section across layers
 //
 // Every path is resolved against its layer root and checked with
@@ -90,7 +91,20 @@ async function walkAll(root, limits) {
   while (stack.length > 0) {
     const dir = stack.pop();
     let dirents;
-    try { dirents = await fsp.readdir(dir, { withFileTypes: true }); } catch { continue; }
+    try {
+      dirents = await fsp.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      // The layer ROOT failing to read is a different fact from an ordinary
+      // subdirectory vanishing mid-walk — same distinction okf-local's
+      // walkDocs draws for the indexer. Losing the root means there is
+      // nothing left behind this layer at all, not the empty-folder answer a
+      // deleted folder used to get, indistinguishable from one that was
+      // simply never populated.
+      if (dir === root && (err.code === "ENOENT" || err.code === "ENOTDIR")) {
+        throw new Error(`Layer folder no longer exists: ${root}`);
+      }
+      continue;
+    }
     for (const dirent of dirents) {
       if (dirent.name.startsWith(".") || dirent.name === "node_modules") continue;
       if (++scanned > maxEntries) { truncated = true; break; }
@@ -109,19 +123,33 @@ async function walkAll(root, limits) {
 export async function listFilesApi(roots, limits) {
   const layers = [];
   for (const [layer, { root, kind }] of roots) {
-    const { files, truncated } = await walkAll(root, limits);
-    layers.push({
-      layer,
-      kind,
-      root,
-      fileCount: files.length,
-      truncated,
-      files: files.map((abs) => {
-        const rel = toPosix(path.relative(root, abs));
-        const ext = path.extname(abs).toLowerCase();
-        return { path: `${layer}/${rel}`, name: path.basename(abs), rel, ext, kind: fileKind(ext), markdown: MARKDOWN_EXT.has(ext) };
-      }),
-    });
+    try {
+      const { files, truncated } = await walkAll(root, limits);
+      layers.push({
+        layer,
+        kind,
+        root,
+        fileCount: files.length,
+        truncated,
+        // Additive, and null on the common path: a layer whose folder is
+        // genuinely empty (or a subfolder that merely vanished mid-walk, which
+        // walkAll already skips over) is not an error and says so.
+        error: null,
+        files: files.map((abs) => {
+          const rel = toPosix(path.relative(root, abs));
+          const ext = path.extname(abs).toLowerCase();
+          return { path: `${layer}/${rel}`, name: path.basename(abs), rel, ext, kind: fileKind(ext), markdown: MARKDOWN_EXT.has(ext) };
+        }),
+      });
+    } catch (err) {
+      // Read around, never crash the whole listing: one layer whose folder
+      // moved or was deleted must not blank every other layer's files. The row
+      // still appears — with `error` set and `fileCount: 0` — rather than
+      // silently taking on the empty-folder shape a genuinely empty layer
+      // reports, which used to read as "add a note and it appears here" for a
+      // folder that no longer exists.
+      layers.push({ layer, kind, root, fileCount: 0, truncated: false, error: err.message, files: [] });
+    }
   }
   return { layers };
 }
@@ -185,8 +213,18 @@ export async function writeFileApi(rawBody, roots) {
   let stat;
   try { stat = await fsp.stat(abs); } catch { throw httpError(404, `Refusing to create new files: ${apiPath}`); }
   if (!stat.isFile()) throw httpError(400, `Not a file: ${apiPath}`);
-  if (body.modified !== undefined && body.modified !== stat.mtime.toISOString()) {
-    throw httpError(409, `This file changed on disk after you opened it. Reopen ${apiPath} and merge your edit.`);
+  // `modified` used to be optional, which meant a client that forgot to send
+  // it silently skipped the stale-editor check below and overwrote whatever
+  // changed on disk since it last read the file. It is required now — the
+  // caller must either name the version it read (from GET /api/file) or say
+  // out loud that it means to overwrite regardless.
+  if (body.force !== true) {
+    if (body.modified === undefined) {
+      throw httpError(400, `Provide modified: the file's last-read modified timestamp (from GET /api/file), or force: true to overwrite deliberately.`);
+    }
+    if (body.modified !== stat.mtime.toISOString()) {
+      throw httpError(409, `This file changed on disk after you opened it. Reopen ${apiPath} and merge your edit.`);
+    }
   }
   await fsp.writeFile(abs, body.text, "utf8");
   const after = await fsp.stat(abs);
diff --git a/packages/core/src/service.mjs b/packages/core/src/service.mjs
index 7ed4b56..2bf0e59 100644
--- a/packages/core/src/service.mjs
+++ b/packages/core/src/service.mjs
@@ -30,6 +30,7 @@ import { probeDocs, MAX_DOC_BYTES } from "./sources/okf-local.mjs";
 import { FILES_EXTENSIONS } from "./sources/files.mjs";
 import { createMcpSource } from "./sources/mcp.mjs";
 import { mergeConcepts, resolveConcept } from "./resolver.mjs";
+import { searchConcepts, tokenizeQuery } from "./search.mjs";
 import { countTokens, conceptText, warmTokenizer, TOKENIZER } from "./tokenize.mjs";
 import { resolveSettings, walkLimitsFrom, validateSettingsPatch, settingsCatalog } from "./settings.mjs";
 import {
@@ -148,7 +149,7 @@ async function snapshotSource(source, entry, signal = null) {
   // `notes` rides along the same way: what a walk had to leave out — a document
   // over the size cap, a subtree it lacks permission to read — belongs on the
   // snapshot, because the row the user sees is built from the snapshot.
-  const notes = { skipped: [], unreadable: [] };
+  const notes = { skipped: [], unreadable: [], hidden: 0 };
   const ids = typeof source.listConceptIds === "function" ? await source.listConceptIds({ signal, notes }) : [];
   throwIfAborted();
   entry.phase = "loading";
@@ -178,7 +179,7 @@ async function snapshotSource(source, entry, signal = null) {
   // buildGraph key a memo on live state instead of on invalidation events.
   return {
     ids, concepts, tokens, tokensById, gen: ++SNAPSHOT_SEQ,
-    skipped: notes.skipped, unreadable: notes.unreadable,
+    skipped: notes.skipped, unreadable: notes.unreadable, hidden: notes.hidden,
   };
 }
 
@@ -243,6 +244,28 @@ function snapshotView(source, snap) {
   };
 }
 
+// The same idea, shaped for search.mjs's adapter contract instead of
+// resolveConcept's: searchConcepts walks listConceptIds() itself (it has no
+// other way to know what to score), so this view answers that from the
+// snapshot's own id list rather than reopening the source it was read from.
+function searchSnapshotView(source, snap) {
+  return {
+    name: source.name,
+    level: source.level,
+    async listConceptIds() { return snap.ids; },
+    async loadConcept(id) { return snap.concepts.get(id) ?? null; },
+  };
+}
+
+// The identity a memoized read is keyed on: which sources contributed, and
+// which generation of each. A snapshot is immutable once assigned, so this
+// string changes exactly when an answer built from these sources would —
+// shared by every reader of the background index that memoizes on it
+// (buildResolvedIndex, search) rather than each re-deriving its own key.
+function contributingKey(contributing) {
+  return JSON.stringify(contributing.map((p) => [p.source.name, p.source.level, p.snap.gen]));
+}
+
 // The watcher must filter exactly what the walk filters, or a file the index
 // would never read still costs a full re-index. This is walkDocs' skip rule
 // (dot-entries and node_modules), applied to the path fs.watch reports.
@@ -365,6 +388,14 @@ export function createEngineService({
   // key built from the current (name, level, generation) triple cannot outlive
   // what it describes.
   let graphMemo = null;      // { key, promise } — the O(corpus) half of /api/graph
+  // { key, hits: Map<"query limit", Promise<hits>> } — GET /api/search. One
+  // query against unchanged content answers from the map; the whole map is
+  // replaced (not merged) the instant `key` moves, same as graphMemo, because
+  // a stale hit list is worse than a slow one. A promise lives in the map
+  // before it settles, so two requests for the same query while a build is in
+  // flight join it instead of running the corpus scan twice.
+  let searchMemo = null;
+  const SEARCH_MEMO_CAP = 200; // distinct queries per content generation before the map is dropped, not the search
   let conceptTokens = new Map(); // concept id -> { sig, tokens } for merged concepts
   // Monotonic counter behind /api/status. Bumped whenever the signature of what
   // the heavy routes would return changes, so a client can poll cheaply and
@@ -519,6 +550,7 @@ export function createEngineService({
     for (const entry of indexes.values()) entry.cancel?.();
     indexes = new Map();
     graphMemo = null;
+    searchMemo = null;
     conceptTokens = new Map();
     if (prev) for (const s of prev.sources) s.close?.();
   }
@@ -616,7 +648,9 @@ export function createEngineService({
    * instead of cancelling, and the entry owes exactly one follow-up when this
    * pass lands (see scheduleFollowUp for when it actually runs).
    */
-  function startIndex(source, key, settings, { validity = null, previousSnap = null, passes = 1 } = {}) {
+  function startIndex(source, key, settings, {
+    validity = null, previousSnap = null, previousSuccessAt = null, passes = 1,
+  } = {}) {
     const controller = new AbortController();
     const refreshing = previousSnap !== null;
     const entry = {
@@ -626,6 +660,10 @@ export function createEngineService({
       loaded: 0,
       total: null,
       snap: previousSnap,
+      // Carried across a refresh/rename the same way `snap` is, so a source
+      // with no health() of its own does not forget its last real success the
+      // moment a follow-up pass starts.
+      lastSuccessAt: previousSuccessAt,
       validity,
       // Whether a pass is in flight, tracked separately from `status` — which
       // now says "ready" through a background refresh — because every decision
@@ -657,6 +695,15 @@ export function createEngineService({
         entry.snap = snap;
         entry.status = "ready";
         entry.phase = "ready";
+        // A pass resolving is not proof the source was actually reachable —
+        // sources/github.mjs (and any adapter with health()) warn-and-continue
+        // on an API failure, returning [] rather than throwing, so the promise
+        // above still fulfills against a down repo. Only stamp our own record
+        // of success when the adapter's health() agrees the underlying read
+        // worked; a source with no health() of its own (okf-local, files) has
+        // no such signal to defer to, so it stamps unconditionally as before.
+        const health = typeof source.health === "function" ? source.health() : null;
+        if (!health || health.ok !== false) entry.lastSuccessAt = new Date().toISOString();
       })
       .catch((err) => {
         if (indexes.get(entry.key) !== entry) return;
@@ -733,6 +780,7 @@ export function createEngineService({
     indexes.set(key, startIndex(open.sources[i], key, open.settings, {
       validity: open.validities[i],
       previousSnap: entry.snap,
+      previousSuccessAt: entry.lastSuccessAt,
       passes: entry.passes + 1,
     }));
   }
@@ -811,6 +859,7 @@ export function createEngineService({
       indexes.set(key, startIndex(source, key, open.settings, {
         validity: open.validities[i],
         previousSnap: previous?.snap ?? null,
+        previousSuccessAt: previous?.lastSuccessAt ?? null,
         passes: (previous?.passes ?? 0) + 1,
       }));
     });
@@ -938,6 +987,12 @@ export function createEngineService({
       error: entry.error,
       progress: indexProgress(entry),
       health: typeof source.health === "function" ? source.health() : null,
+      // The index's own record of the last successful pass, kept for sources
+      // with no health() of their own (okf-local, files): without it a local
+      // layer's lastSuccessAt read null forever, even after every index since
+      // boot succeeded, because health (the field graph/status prefer first)
+      // never exists for those adapters.
+      lastSuccessAt: entry.lastSuccessAt,
     };
   }
 
@@ -976,6 +1031,7 @@ export function createEngineService({
       if (p === "/api/status") { json(res, 200, statusApi()); return true; }
       if (p === "/api/resolve") { json(res, 200, await resolveOne(url.searchParams.get("concept"))); return true; }
       if (p === "/api/resolve-all") { json(res, 200, await resolveAllApi(waitParam(url))); return true; }
+      if (p === "/api/search") { json(res, 200, await searchApi(url, waitParam(url))); return true; }
       if (p === "/api/discrepancies" && req.method === "GET") {
         json(res, 200, await discrepanciesApi(waitParam(url)));
         return true;
@@ -1115,7 +1171,7 @@ export function createEngineService({
     const contributing = perSource.filter((p) => p.snap);
     const { concepts, resolvedTokens, latestPerSource } = await resolvedIndex(contributing);
 
-    const sourcesOut = perSource.map(({ source: s, snap, status, error, progress, health }) => {
+    const sourcesOut = perSource.map(({ source: s, snap, status, error, progress, health, lastSuccessAt }) => {
       const meta = layerMeta.get(s.name) ?? {};
       const kind = s.quarantinedKind ?? meta.source ?? "okf-local";
       // `health` was read with the rest of this row (see pinEntry): whether the
@@ -1180,10 +1236,22 @@ export function createEngineService({
         warnings: warningMessages.length,
         warningMessages: warningMessages.slice(0, 10),
         indexing: progress,
+        // Dotfiles/dot-dirs skipped by the walk — a count, not a listing.
+        skippedHidden: snap?.hidden ?? 0,
         // Enough for "last synced X, failed Y ago" without a second request.
-        // Null on sources that keep no health (local bundles, MCP children).
+        // lastErrorAt is null on sources that keep no health of their own
+        // (local bundles, MCP children) — there is nothing to have failed.
+        // lastSuccessAt prefers health()'s own record, but openSources()
+        // builds a fresh adapter on every manifest change, so a source that
+        // hasn't issued a request on THIS instance yet (its index entry was
+        // adopted, not re-read) reports null from health() even though it is
+        // serving a perfectly good snapshot. The entry's own lastSuccessAt is
+        // the fallback for exactly that case, and it is trustworthy now that
+        // startIndex only stamps it when health() (if the adapter has one)
+        // agreed the pass was a real success — never for a warn-and-continue
+        // that resolved by returning [] against an unreachable repo.
         lastErrorAt: health?.lastErrorAt ?? null,
-        lastSuccessAt: health?.lastSuccessAt ?? null,
+        lastSuccessAt: health?.lastSuccessAt ?? lastSuccessAt ?? null,
       };
     });
 
@@ -1227,7 +1295,7 @@ export function createEngineService({
    * throw this away.
    */
   async function resolvedIndex(contributing) {
-    const key = JSON.stringify(contributing.map((p) => [p.source.name, p.source.level, p.snap.gen]));
+    const key = contributingKey(contributing);
     if (!graphMemo || graphMemo.key !== key) {
       // Shared by every caller that arrives during a cold build: the console
       // polls this route while indexing, and a second request must join the
@@ -1371,6 +1439,10 @@ export function createEngineService({
         // re-reading behind it. Never a reason to show a source as unready.
         refreshing: progress.refreshing,
         error: degraded ? health.lastError : error ?? null,
+        // Dotfiles/dot-dirs are still skipped silently — this only makes the
+        // count visible, never what is inside them. Additive, and already
+        // computed by the walk, so it costs nothing on this cheap route.
+        skippedHidden: snap?.hidden ?? 0,
       };
     });
     // A source with nothing to serve yet. A source refreshing behind a good
@@ -1397,6 +1469,65 @@ export function createEngineService({
     return resolved;
   }
 
+  // Unlike resolveOne, this reads the background index rather than live
+  // sources: a naive per-request implementation re-walked every layer's disk
+  // (or MCP graph) and rebuilt a BM25 index over the whole corpus on every
+  // keystroke the console debounced through here — the same shape of cost the
+  // engine already refuses to pay per request for /api/graph and countTokens.
+  // search.mjs is still the only ranking module the retrieval eval scores, so
+  // this route never reimplements any part of it: it hands searchConcepts an
+  // adapter-shaped view over already-loaded snapshot concepts (searchSnapshotView)
+  // instead of the live sources array, which is the one substitution that
+  // keeps the ranking byte-identical while removing the disk/MCP reads.
+  async function searchApi(url, waitMs = 0) {
+    const query = url.searchParams.get("q");
+    if (typeof query !== "string" || !query.trim()) throw httpError(400, "Provide ?q=<query>");
+    let limit = 10;
+    const rawLimit = url.searchParams.get("limit");
+    if (rawLimit !== null) {
+      const n = Number(rawLimit);
+      if (!Number.isFinite(n) || n <= 0) throw httpError(400, "limit must be a positive number");
+      limit = Math.min(Math.floor(n), 50);
+    }
+    if (waitMs > 0) await awaitIndexes(waitMs);
+    // Answer from whatever is indexed right now, same as buildGraph: a source
+    // still on its first pass has no snapshot yet and simply contributes
+    // nothing, rather than failing the request or blocking on it. This route
+    // has no rows to carry that signal on, so it says so directly, with the
+    // same fields and meaning /api/graph and /api/resolve-all use — otherwise
+    // a search box on a big vault reads "no results" indistinguishably from a
+    // genuinely empty vault for the whole first index.
+    const { entries } = ensureIndexes();
+    const pinned = entries.map(pinEntry);
+    const contributing = pinned.filter((p) => p.snap);
+    const pending = pinned.filter((p) => p.progress.status === "indexing").map((p) => p.source.name);
+    const indexing = pending.length > 0;
+    // A query with no searchable token (all punctuation, e.g. "!!!") is a
+    // search that legitimately finds nothing — searchConcepts throws on it
+    // instead, because the MCP tools it also backs treat that as caller
+    // misuse. A search box gets the same honest empty answer any other
+    // no-match query gets, not a 500.
+    if (tokenizeQuery(query).length === 0) return { hits: [], indexing, indexingSources: pending };
+    const key = contributingKey(contributing);
+    if (!searchMemo || searchMemo.key !== key) searchMemo = { key, hits: new Map() };
+    const cacheKey = `${query}${limit}`;
+    let promise = searchMemo.hits.get(cacheKey);
+    if (!promise) {
+      const views = contributing.map((p) => searchSnapshotView(p.source, p.snap));
+      promise = searchConcepts(views, { query, limit }).catch((err) => {
+        if (searchMemo?.hits.get(cacheKey) === promise) searchMemo.hits.delete(cacheKey);
+        throw err;
+      });
+      // A safety valve against unbounded growth under sustained distinct
+      // queries against unchanged content — not expected in normal debounced
+      // typing (repeats dominate), but nothing here ever evicts on its own.
+      if (searchMemo.hits.size >= SEARCH_MEMO_CAP) searchMemo.hits.clear();
+      searchMemo.hits.set(cacheKey, promise);
+    }
+    const hits = await promise;
+    return { hits, indexing, indexingSources: pending };
+  }
+
   function decorateResolvedDispositions(resolved, decisions) {
     for (const section of resolved.sections) {
       if (!section.conflicts?.length) continue;
@@ -1783,7 +1914,10 @@ export function createEngineService({
     if (!discrepancy || body.revision !== discrepancy.revision) {
       throw httpError(409, "This discrepancy changed after you opened it. Reload before deciding it.");
     }
-    const allowedReasons = new Set(["different_scopes", "temporary_migration", "source_specific_authority", "other"]);
+    // target_missing is broken-link-shaped: acknowledging why a link target
+    // will never resolve (the concept was retired, renamed elsewhere, etc.)
+    // needs a reason distinct from a genuine scoped disagreement.
+    const allowedReasons = new Set(["different_scopes", "temporary_migration", "source_specific_authority", "target_missing", "other"]);
     if (action === "acknowledge" && !allowedReasons.has(reasonCode)) throw httpError(400, "Choose why this scoped difference should remain");
     const chosen = action === "choose_contribution"
       ? discrepancy.contributions.find((item) => item.source === selectedSource)
@@ -1828,6 +1962,16 @@ export function createEngineService({
       return { ok: true, decision: await conflictResolutionLog.append(decision), written: [] };
     }
     if (originalKind === "broken_link") throw httpError(409, "Open the source file to repair this link, or acknowledge the scoped difference.");
+    // renderScalar's scalar branch would rewrite a YAML list OR map as a
+    // quoted string (a plain object stringifies to "[object Object]" through
+    // the same String(value) call an array would otherwise skip) — silently
+    // downgrading the field's type in every writable layer. Compose only ever
+    // produces a string, so a structured-value field has no safe reconciled
+    // answer to write.
+    if (originalKind === "frontmatter_value" && action === "compose"
+      && discrepancy.contributions.some((item) => typeof item.value === "object" && item.value !== null)) {
+      throw httpError(400, "This field holds a structured value (list or map); compose isn't available for it — use \"Use this answer everywhere\" or edit the file directly.");
+    }
 
     const value = action === "compose" ? content : chosen.value;
     const writableSources = discrepancy.contributions.map((item) => item.source).filter((source) => fileRoots().has(source));
diff --git a/packages/core/src/sources/cache.mjs b/packages/core/src/sources/cache.mjs
index 0cede63..fb26af9 100644
--- a/packages/core/src/sources/cache.mjs
+++ b/packages/core/src/sources/cache.mjs
@@ -89,13 +89,18 @@ export function withCache(source, { ttlMs = 300000, cacheDir = null, namespace =
     async listConceptIds(options = {}) {
       const notes = options?.notes ?? null;
       const entry = await cached("list.v2", async () => {
-        const collected = { skipped: [], unreadable: [] };
+        const collected = { skipped: [], unreadable: [], hidden: 0 };
         const ids = await source.listConceptIds({ ...options, notes: collected });
         return { ids, notes: collected };
       });
       if (notes) {
         for (const item of entry.notes?.skipped ?? []) notes.skipped?.push(item);
         for (const item of entry.notes?.unreadable ?? []) notes.unreadable?.push(item);
+        // A count, not a list — unlike skipped/unreadable this only ever holds
+        // a number (see okf-local's walkDocs), so a cache hit has to add it
+        // rather than push, or a layer's hidden count would read 0 on every
+        // read except the one that actually walked the disk.
+        notes.hidden = (notes.hidden ?? 0) + (entry.notes?.hidden ?? 0);
       }
       return entry.ids;
     },
diff --git a/packages/core/src/sources/okf-local.mjs b/packages/core/src/sources/okf-local.mjs
index 3e427f2..573153a 100644
--- a/packages/core/src/sources/okf-local.mjs
+++ b/packages/core/src/sources/okf-local.mjs
@@ -372,6 +372,7 @@ export async function walkDocs(root, extensions, limits = null, { signal = null,
   const { maxFiles, maxEntries } = { ...defaultWalkLimits(), ...(limits ?? {}) };
   const files = [];
   let scanned = 0;
+  let hiddenSkipped = 0;
   const stack = [root];
   while (stack.length > 0) {
     throwIfAborted(signal);
@@ -380,10 +381,18 @@ export async function walkDocs(root, extensions, limits = null, { signal = null,
     try {
       dirents = await fsp.readdir(current, { withFileTypes: true });
     } catch (err) {
-      // Skipping is still right — one locked folder must not fail the whole
-      // layer — but a folder we are not ALLOWED to read is a different fact
-      // from a folder with nothing in it, and only one of them is worth saying.
-      // A missing root is already reported as an empty source.
+      // The layer ROOT failing to read is a different fact from an ordinary
+      // subdirectory going missing mid-walk: the root is the whole source, so
+      // losing it means there is nothing left behind this layer at all — not
+      // the empty-folder answer a deleted vault used to get, indistinguishable
+      // from one that was simply never populated.
+      if (current === root && (err.code === "ENOENT" || err.code === "ENOTDIR")) {
+        throw new Error(`Layer folder no longer exists: ${root}`);
+      }
+      // Skipping is still right for everything else — one locked or vanished
+      // subfolder must not fail the whole layer — but a folder we are not
+      // ALLOWED to read is a different fact from a folder with nothing in it,
+      // and only one of them is worth saying.
       if (err.code === "EACCES" || err.code === "EPERM") {
         notes?.unreadable.push({ rel: relTo(root, current), code: err.code });
       }
@@ -391,7 +400,8 @@ export async function walkDocs(root, extensions, limits = null, { signal = null,
     }
     const candidates = [];
     for (const dirent of dirents) {
-      if (dirent.name.startsWith(".") || dirent.name === "node_modules") continue;
+      if (dirent.name.startsWith(".")) { hiddenSkipped += 1; continue; }
+      if (dirent.name === "node_modules") continue;
       scanned += 1;
       if (scanned > maxEntries) {
         throw new Error(
@@ -421,6 +431,10 @@ export async function walkDocs(root, extensions, limits = null, { signal = null,
       }
     }
   }
+  // A skip an entry never mentions is a skip nobody can act on. Counted, not
+  // itemized — one number per source is enough to say "this is deliberate",
+  // and the walk never descends into a dot-dir to name what is inside it.
+  if (notes) notes.hidden = (notes.hidden ?? 0) + hiddenSkipped;
   return files.sort();
 }
 
diff --git a/packages/core/tests/cache-source.test.mjs b/packages/core/tests/cache-source.test.mjs
index 51862de..4549211 100644
--- a/packages/core/tests/cache-source.test.mjs
+++ b/packages/core/tests/cache-source.test.mjs
@@ -27,6 +27,8 @@ function recordingSource() {
       calls.push(options);
       options?.notes?.skipped.push({ rel: "huge.md", bytes: 99_000_000 });
       options?.notes?.unreadable.push({ rel: "locked", code: "EACCES" });
+      // A count, not a list — matches how okf-local's walkDocs reports it.
+      if (options?.notes) options.notes.hidden = (options.notes.hidden ?? 0) + 3;
       return ["a", "b"];
     },
     async loadConcept(id) { return { id, sections: [] }; },
@@ -60,6 +62,24 @@ test("what the walk could not read survives the wrapper, and the cache hit", asy
   assert.deepEqual(second, first, "warnings vanished on the cached read");
 });
 
+test("the hidden count survives the wrapper, and does not reset on a cache hit", async () => {
+  // hidden is a running total (see okf-local's walkDocs), not a list like
+  // skipped/unreadable — replaying it has to add rather than push, or a
+  // cached layer's skippedHidden count flickers to 0 on every read but the
+  // one that actually walked the disk.
+  const source = recordingSource();
+  const cached = withCache(source, { ttlMs: 60_000 });
+
+  const first = { skipped: [], unreadable: [], hidden: 0 };
+  await cached.listConceptIds({ notes: first });
+  assert.equal(first.hidden, 3, "the hidden count from the walk never reached the caller");
+
+  const second = { skipped: [], unreadable: [], hidden: 0 };
+  await cached.listConceptIds({ notes: second });
+  assert.equal(source.calls.length, 1, "the memo did not hit");
+  assert.equal(second.hidden, 3, "the hidden count reset to 0 on the cached read");
+});
+
 test("a cached local layer still reports its skipped documents", async () => {
   // The end-to-end shape of the same failure: a real folder, a real oversized
   // file, read through the wrapper a layer's `cache` block would install.
diff --git a/packages/core/tests/discrepancies.test.mjs b/packages/core/tests/discrepancies.test.mjs
index d3f7401..de39e69 100644
--- a/packages/core/tests/discrepancies.test.mjs
+++ b/packages/core/tests/discrepancies.test.mjs
@@ -35,6 +35,38 @@ test("builds section, frontmatter, and settled broken-link discrepancies", () =>
   assert.equal(section.contributions.length, 2);
 });
 
+test("frontmatter_value discrepancies preserve a map-valued contribution as a real object", () => {
+  // No on-disk YAML syntax in this engine's own parsers produces a genuine
+  // map value today (parseYamlScalar only recognizes `[...]` arrays), but
+  // buildDiscrepancies operates on whatever a source's already-parsed
+  // frontmatter object hands it — a future or foreign adapter that DOES
+  // produce a map must not have its shape coerced on the way to a
+  // discrepancy row. service.mjs's compose guard depends on exactly this:
+  // it refuses compose when `typeof item.value === "object" && item.value
+  // !== null`, which only catches a map if this projection leaves it alone
+  // (a guard narrowed back to Array.isArray, as it once was, would let a
+  // map slip through and let renderScalar mangle it — see service.mjs).
+  const mapConcept = {
+    ...concept,
+    frontmatterConflicts: [{
+      key: "review",
+      winner: { layer: "team", level: 2, updated: "2026-08-01", value: { approved: true } },
+      contributions: [
+        { layer: "team", level: 2, updated: "2026-08-01", value: { approved: true } },
+        { layer: "company", level: 0, updated: "2026-07-01", value: { approved: false } },
+      ],
+    }],
+  };
+  const result = buildDiscrepancies([mapConcept], { coverageComplete: false });
+  const review = result.discrepancies.find((item) => item.key === "review");
+  assert.ok(review, "expected a frontmatter_value discrepancy for the map field");
+  for (const item of review.contributions) {
+    assert.equal(Array.isArray(item.value), false);
+    assert.deepEqual(item.value, item.effective ? { approved: true } : { approved: false });
+  }
+  assert.equal(review.contributions.some((item) => typeof item.value === "object" && item.value !== null), true);
+});
+
 test("does not manufacture broken links with incomplete coverage", () => {
   const result = buildDiscrepancies([concept], { coverageComplete: false });
   assert.equal(result.discrepancies.some((item) => item.kind === "broken_link"), false);
@@ -103,6 +135,78 @@ test("conflicting matching rules disable automation and surface the ambiguity",
   assert.equal(item.status, "needs_review");
 });
 
+test("a resolved section_content decision emits exactly one record, under its canonical id", () => {
+  // schemaVersion-2, non-acknowledge, committed decision carrying BOTH the
+  // canonical discrepancyId and the legacy conflictId. decisionMap indexes it
+  // under both keys, so the resolved-record reconstruction must dedupe by
+  // canonical id or this becomes two rows for one resolution (F12).
+  const decisions = [{
+    schemaVersion: 2, id: "d1",
+    discrepancyId: "section_content::decisions/settled::choice",
+    conflictId: "decisions/settled::choice",
+    action: "choose_contribution", transactionState: "committed",
+    conceptId: "decisions/settled", title: "Settled", conceptType: "decision",
+    sectionKey: "choice", sectionHeading: "Choice", owner: "Platform",
+    chosen: { layer: "team", content: "Use Postgres.", updated: "2026-08-01" },
+    contributions: [
+      { layer: "team", level: 2, content: "Use Postgres.", updated: "2026-08-01" },
+      { layer: "company", level: 0, content: "Use MySQL.", updated: "2026-07-01" },
+    ],
+  }];
+  // No current conflict for this concept — buildDiscrepancies' first pass
+  // produces nothing for it, so the decision is only visible through the
+  // resolved-record reconstruction loop this test targets.
+  const settled = { ...concept, id: "decisions/settled", sections: [], frontmatterConflicts: [] };
+  const result = buildDiscrepancies([settled], { decisions, coverageComplete: false });
+  const rows = result.discrepancies.filter((item) => item.conceptId === "decisions/settled");
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].id, "section_content::decisions/settled::choice");
+  assert.equal(rows[0].legacyId, "decisions/settled::choice");
+  assert.equal(rows[0].status, "resolved");
+});
+
+test("a live section conflict is not duplicated by its own committed decision (both ids present)", () => {
+  // schemaVersion-2, non-acknowledge, committed decision carrying BOTH the
+  // canonical discrepancyId and the legacy conflictId, for a concept whose
+  // section is STILL in conflict — so the first pass emits a live row AND the
+  // resolved-record reconstruction loop visits this decision under its legacy
+  // key. That legacy key doesn't collide with currentIds, but the canonical id
+  // it resolves to does — dedupe has to check the canonical id, or this
+  // concept+section ends up with two rows sharing one id (F13).
+  const decisions = [{
+    schemaVersion: 2, id: "d1",
+    discrepancyId: "section_content::decisions/db::choice",
+    conflictId: "decisions/db::choice",
+    action: "choose_contribution", transactionState: "committed",
+    conceptId: "decisions/db", title: "Database", conceptType: "decision",
+    sectionKey: "choice", sectionHeading: "Choice", owner: "Platform",
+    chosen: { layer: "team", content: "Use Postgres.", updated: "2026-08-01" },
+    // Recorded fingerprints differ from what's on disk now, so the live
+    // section reopens rather than resolving quietly.
+    contributions: [
+      { layer: "team", level: 2, content: "Use Postgres.", updated: "2026-08-01" },
+      { layer: "company", level: 0, content: "Use MySQL.", updated: "2026-07-01" },
+    ],
+  }];
+  const result = buildDiscrepancies([concept], { decisions, coverageComplete: false });
+  const rows = result.discrepancies.filter((item) => item.conceptId === "decisions/db" && item.key === "choice");
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].status, "reopened");
+  const ids = result.discrepancies.map((item) => item.id);
+  assert.equal(ids.length, new Set(ids).size);
+});
+
+test("active-discrepancy decoration still finds a decision by its legacy id", () => {
+  // finalize() looks a discrepancy's history up by discrepancyId first, then
+  // falls back to legacyId — the same fallback the dedupe above must not break.
+  const decisions = [{
+    schemaVersion: 2, id: "d1", conflictId: "decisions/db::choice", action: "acknowledge", reasonCode: "other",
+  }];
+  const result = buildDiscrepancies([concept], { decisions, coverageComplete: false });
+  const section = result.discrepancies.find((item) => item.originalKind === "section_content");
+  assert.equal(section.status, "acknowledged");
+});
+
 test("serialized shared rules contain structural metadata only", () => {
   const text = serializeRuleDocument([{
     id: "r1", scope: "local", mode: "automatic", enabled: true,
diff --git a/packages/core/tests/discrepancy-transactions.test.mjs b/packages/core/tests/discrepancy-transactions.test.mjs
index 1664383..80cb0b1 100644
--- a/packages/core/tests/discrepancy-transactions.test.mjs
+++ b/packages/core/tests/discrepancy-transactions.test.mjs
@@ -1,10 +1,12 @@
 import assert from "node:assert/strict";
 import fsp from "node:fs/promises";
+import http from "node:http";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
-import { stageSectionTransaction } from "../src/layer-files.mjs";
+import { stageSectionTransaction, stageFrontmatterTransaction } from "../src/layer-files.mjs";
 import { createDiscrepancyTransactionJournal } from "../src/conflict-resolutions.mjs";
+import { createEngineService } from "../src/service.mjs";
 
 const document = (value) => `---\ntype: decision\ntitle: Database\n---\n\n# Database\n\n## Choice {#choice}\n\n${value}\n`;
 
@@ -77,6 +79,118 @@ test("startup recovery preserves a write confirmed by the committed decision log
   } finally { await fsp.rm(dir, { recursive: true, force: true }); }
 });
 
+test("stageSectionTransaction commit writes exactly the new content, no fragment of old content (F10)", async () => {
+  const { dir, roots } = await fixture();
+  try {
+    const staged = await stageSectionTransaction(JSON.stringify({
+      conceptId: "database", sectionKey: "choice", layers: ["team", "company"],
+      content: "Use SQLite for embedded deployments.", expectedContent: { team: "Postgres", company: "MySQL" }, requireAll: true,
+    }), roots, "tx-happy-path");
+    await staged.commit();
+    await staged.cleanup();
+    for (const { root } of roots.values()) {
+      const text = await fsp.readFile(path.join(root, "database.md"), "utf8");
+      assert.match(text, /## Choice \{#choice\}\n\nUse SQLite for embedded deployments\.\n/);
+      assert.doesNotMatch(text, /Postgres/);
+      assert.doesNotMatch(text, /MySQL/);
+    }
+  } finally { await fsp.rm(dir, { recursive: true, force: true }); }
+});
+
+test("compose on a scalar frontmatter field replaces cleanly on disk", async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), "cc-discrepancy-fm-"));
+  try {
+    const roots = new Map();
+    for (const [name, owner] of [["team", "Platform"], ["company", "Architecture"]]) {
+      const root = path.join(dir, name);
+      await fsp.mkdir(root);
+      await fsp.writeFile(
+        path.join(root, "governed.md"),
+        `---\ntype: decision\ntitle: Governed\nowner: ${owner}\n---\n\n# Governed\n\n## Pick {#pick}\n\nsame everywhere\n`,
+      );
+      roots.set(name, { root, kind: "okf-local" });
+    }
+    const staged = await stageFrontmatterTransaction(JSON.stringify({
+      conceptId: "governed", key: "owner", layers: ["team", "company"], value: "Composed Owner",
+      expectedValues: { team: "Platform", company: "Architecture" },
+    }), roots, "tx-compose-scalar");
+    await staged.commit();
+    await staged.cleanup();
+    for (const name of ["team", "company"]) {
+      const text = await fsp.readFile(path.join(dir, name, "governed.md"), "utf8");
+      assert.equal(text, `---\ntype: decision\ntitle: Governed\nowner: "Composed Owner"\n---\n\n# Governed\n\n## Pick {#pick}\n\nsame everywhere\n`);
+    }
+  } finally { await fsp.rm(dir, { recursive: true, force: true }); }
+});
+
+test("stageFrontmatterTransaction/replaceFrontmatterValue round-trip an array value without downgrading its type", async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), "cc-discrepancy-array-rt-"));
+  try {
+    const root = path.join(dir, "team");
+    await fsp.mkdir(root);
+    await fsp.writeFile(path.join(root, "governed.md"), "---\ntype: decision\ntitle: Governed\ntags: [a, b]\n---\n\n# Governed\n\n## Pick {#pick}\n\nx\n");
+    const roots = new Map([["team", { root, kind: "okf-local" }]]);
+    const staged = await stageFrontmatterTransaction(JSON.stringify({
+      conceptId: "governed", key: "tags", layers: ["team"], value: ["x", "y", "z"],
+      expectedValues: { team: ["a", "b"] },
+    }), roots, "tx-array-rt");
+    await staged.commit();
+    await staged.cleanup();
+    const text = await fsp.readFile(path.join(root, "governed.md"), "utf8");
+    assert.match(text, /^tags: \["x", "y", "z"\]$/m);
+  } finally { await fsp.rm(dir, { recursive: true, force: true }); }
+});
+
+test("applyDiscrepancyDecision refuses compose on an array-typed frontmatter field with a 400 (F11)", async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), "cc-discrepancy-array-guard-"));
+  let svc = null;
+  let server = null;
+  try {
+    const teamDir = path.join(dir, "team");
+    const companyDir = path.join(dir, "company");
+    await fsp.mkdir(teamDir);
+    await fsp.mkdir(companyDir);
+    const doc = (tags) => `---\ntype: decision\ntitle: Governed\ntags: [${tags.join(", ")}]\n---\n\n# Governed\n\n## Pick {#pick}\n\nsame everywhere\n`;
+    await fsp.writeFile(path.join(teamDir, "governed.md"), doc(["a", "b"]));
+    await fsp.writeFile(path.join(companyDir, "governed.md"), doc(["c", "d"]));
+    const manifestPath = path.join(dir, "manifest.json");
+    await fsp.writeFile(manifestPath, JSON.stringify({
+      layers: [
+        { name: "team", level: 2, path: teamDir },
+        { name: "company", level: 0, path: companyDir },
+      ],
+    }));
+    svc = createEngineService({ manifestPath, token: null });
+    server = http.createServer(async (req, res) => {
+      if (await svc.handleRequest(req, res)) return;
+      res.writeHead(404); res.end();
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const base = `http://127.0.0.1:${server.address().port}`;
+
+    const dset = await (await fetch(`${base}/api/discrepancies?wait=15000`)).json();
+    const disc = dset.discrepancies.find((item) => item.originalKind === "frontmatter_value" && item.conceptId === "governed");
+    assert.ok(disc, "expected a frontmatter_value discrepancy over the tags field");
+
+    const res = await fetch(`${base}/api/discrepancy-decisions`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ discrepancyId: disc.id, revision: disc.revision, action: "compose", content: "merged" }),
+    });
+    assert.equal(res.status, 400);
+    const body = await res.json();
+    assert.match(body.error, /list/i);
+
+    // The refusal must be a pure guard: nothing written, files untouched.
+    const teamText = await fsp.readFile(path.join(teamDir, "governed.md"), "utf8");
+    assert.match(teamText, /tags: \[a, b\]/);
+  } finally {
+    svc?.close();
+    server?.close();
+    await fsp.rm(dir, { recursive: true, force: true });
+  }
+});
+
 test("failed startup recovery records recovery_required and rejects", async () => {
   const { dir, roots } = await fixture();
   try {
diff --git a/packages/core/tests/files-source-test.sh b/packages/core/tests/files-source-test.sh
index d72b388..ec6ecfd 100755
--- a/packages/core/tests/files-source-test.sh
+++ b/packages/core/tests/files-source-test.sh
@@ -285,6 +285,37 @@ for evil in "../secret" ".." "/etc/passwd" "a/.." "decisions/../../secret"; do
   [ "$out" = "null" ] || fail "traversal id '$evil' should load as null" "$out"
 done
 
+# --- 5b. A vanished (or never-existed) layer root is a status error, not an --
+# empty read (F19). walkDocs used to catch-and-continue on ANY readdir failure,
+# including the layer ROOT itself — so a deleted source folder came back as an
+# empty listing, indistinguishable from a layer that was genuinely empty. The
+# root failing is different: there is nothing behind this source at all.
+
+cat > "$tmpdir/vanished.mjs" <<EOF
+import { createFilesSource } from "${sources_dir}/files.mjs";
+import { createOkfLocalSource } from "${sources_dir}/okf-local.mjs";
+const root = process.argv[2];
+const out = {};
+for (const [kind, make] of [["files", createFilesSource], ["okf-local", createOkfLocalSource]]) {
+  const source = make({ name: kind, level: 2, root });
+  try {
+    await source.listConceptIds({});
+    out[kind] = "NO-THROW";
+  } catch (err) {
+    out[kind] = err.message;
+  }
+}
+console.log(JSON.stringify(out));
+EOF
+vanished_out="$(node "$tmpdir/vanished.mjs" "$tmpdir/does-not-exist-root")"
+for kind in files okf-local; do
+  node -e '
+    const msg = JSON.parse(process.argv[1])[process.argv[2]];
+    if (msg === "NO-THROW") { console.error("should throw rather than list as empty"); process.exit(1); }
+    if (!msg.includes(process.argv[3])) { console.error("error should name the missing folder: " + msg); process.exit(1); }
+  ' "$vanished_out" "$kind" "$tmpdir/does-not-exist-root" || fail "vanished layer root ($kind)" "$vanished_out"
+done
+
 # --- 6. Cache wrapper: memoization, sync(), TTL expiry, disk round-trip -------
 
 cat > "$tmpdir/cache.mjs" <<EOF
@@ -334,4 +365,4 @@ EOF
 cache_out="$(node "$tmpdir/cache.mjs" "$docs" "$tmpdir/cache")"
 grep -q 'CACHE-OK' <<<"$cache_out" || fail "cache wrapper behavior" "$cache_out"
 
-echo "files source test passed (plain md/mdx/txt synthesis + OKF delegation + cascade + traversal guard + cache)"
+echo "files source test passed (plain md/mdx/txt synthesis + OKF delegation + cascade + traversal guard + vanished root + cache)"
diff --git a/packages/core/tests/layer-files.test.mjs b/packages/core/tests/layer-files.test.mjs
new file mode 100644
index 0000000..a44d6a8
--- /dev/null
+++ b/packages/core/tests/layer-files.test.mjs
@@ -0,0 +1,60 @@
+// GET /api/files must not read a deleted layer folder as an empty one.
+//
+// walkAll used to swallow ENOENT on the walk root the same way it swallows an
+// ordinary subdirectory vanishing mid-walk, so a layer whose folder had been
+// moved or removed reported fileCount: 0 with no error — indistinguishable
+// from a folder that genuinely has nothing in it. okf-local's walkDocs
+// already draws this distinction for the indexer; this pins the same
+// distinction for the file-browsing APIs.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { listFilesApi } from "../src/layer-files.mjs";
+
+test("a genuinely empty layer folder reports zero files with no error", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cc-files-empty-"));
+  try {
+    const roots = new Map([["empty", { root, kind: "files" }]]);
+    const { layers } = await listFilesApi(roots);
+    assert.equal(layers.length, 1);
+    assert.equal(layers[0].fileCount, 0);
+    assert.equal(layers[0].error, null, "a genuinely empty folder must not be reported as an error");
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("a layer whose folder was deleted reports an error instead of a silent empty folder", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cc-files-gone-"));
+  fs.rmSync(root, { recursive: true, force: true }); // gone before the walk ever runs
+  const roots = new Map([["gone", { root, kind: "files" }]]);
+  const { layers } = await listFilesApi(roots);
+  assert.equal(layers.length, 1);
+  assert.equal(layers[0].fileCount, 0);
+  assert.deepEqual(layers[0].files, []);
+  assert.match(layers[0].error ?? "", /no longer exists/, "a vanished layer folder must say so, not read as empty");
+});
+
+test("one vanished layer does not blank the listing for a healthy sibling", async () => {
+  const healthyRoot = fs.mkdtempSync(path.join(os.tmpdir(), "cc-files-healthy-"));
+  const goneRoot = fs.mkdtempSync(path.join(os.tmpdir(), "cc-files-gone2-"));
+  fs.writeFileSync(path.join(healthyRoot, "note.md"), "# Note\n\n## Body\n\nhello.\n");
+  fs.rmSync(goneRoot, { recursive: true, force: true });
+  try {
+    const roots = new Map([
+      ["gone", { root: goneRoot, kind: "files" }],
+      ["healthy", { root: healthyRoot, kind: "files" }],
+    ]);
+    const { layers } = await listFilesApi(roots);
+    const gone = layers.find((l) => l.layer === "gone");
+    const healthy = layers.find((l) => l.layer === "healthy");
+    assert.ok(gone.error, "the vanished layer reports an error");
+    assert.equal(healthy.fileCount, 1, "the healthy sibling still lists its file");
+    assert.equal(healthy.error, null);
+  } finally {
+    fs.rmSync(healthyRoot, { recursive: true, force: true });
+  }
+});
diff --git a/packages/core/tests/service-test.sh b/packages/core/tests/service-test.sh
index d78abc1..3bce8bd 100755
--- a/packages/core/tests/service-test.sh
+++ b/packages/core/tests/service-test.sh
@@ -126,14 +126,43 @@ code 401 "$(C -H 'Authorization: Bearer      ' "$BASE/api/graph")" "all-whitespa
 G="$(curl -s "${AUTH[@]}" "$BASE/api/graph?wait=15000" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const g=JSON.parse(s);process.stdout.write(`${g.tokenizer}:${g.totals.sources}:${g.totals.sourceTokens>0}`)})')"
 [ "$G" = "o200k_base:1:true" ] && pass "graph payload intact behind auth" || fail "graph payload ($G)"
 # A source with no health of its own (a local bundle) reports plain "ok" and
-# null health fields — "degraded" is reserved for an adapter that says so.
-H="$(curl -s "${AUTH[@]}" "$BASE/api/graph" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const x=JSON.parse(s).sources[0];process.stdout.write(`${x.status}:${x.error}:${x.lastErrorAt}:${x.lastSuccessAt}`)})')"
-[ "$H" = "ok:null:null:null" ] && pass "healthless source reports plain ok" || fail "local source health shape ($H)"
+# no error — "degraded" is reserved for an adapter that says so. lastSuccessAt
+# still gets set, from the index's own record of its last successful pass
+# rather than from health() (which this source has none of). Checked as a
+# genuine ISO timestamp, not just non-null, so a fallback that leaked some
+# other truthy value would still be caught.
+H="$(curl -s "${AUTH[@]}" "$BASE/api/graph" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const x=JSON.parse(s).sources[0];const iso=typeof x.lastSuccessAt==="string"&&new Date(x.lastSuccessAt).toISOString()===x.lastSuccessAt;process.stdout.write(`${x.status}:${x.error}:${x.lastErrorAt}:${iso}`)})')"
+[ "$H" = "ok:null:null:true" ] && pass "healthless source reports plain ok, with a precise ISO lastSuccessAt" || fail "local source health shape ($H)"
 code 401 "$(C "$BASE/api/resolve?concept=note")" "resolve without header rejected"
 code 200 "$(C "${AUTH[@]}" "$BASE/api/resolve?concept=note")" "resolve with Bearer accepted"
 code 401 "$(C "$BASE/api/host-only")" "unknown /api/* path still gated without token"
 code 401 "$(C "$BASE/api/files")" "layer file API gated without token"
 
+echo "GET /api/search (F4)"
+code 401 "$(C "$BASE/api/search?q=hello")" "search without header rejected"
+code 400 "$(C "${AUTH[@]}" "$BASE/api/search")" "search with no q is refused"
+code 400 "$(C "${AUTH[@]}" "$BASE/api/search?q=")" "search with an empty q is refused"
+SR="$(curl -s "${AUTH[@]}" "$BASE/api/search?q=hello")"
+[ "$(JQ 'String(d.hits.length > 0 && d.hits[0].id === "note")' <<<"$SR")" = "true" ] && pass "search finds the seeded concept" || fail "search hit ($SR)"
+[ "$(JQ 'String(Array.isArray(d.hits[0].layers))' <<<"$SR")" = "true" ] && pass "hits carry the shape searchConcepts returns" || fail "search hit shape ($SR)"
+code 200 "$(C "${AUTH[@]}" "$BASE/api/search?q=hello&limit=1")" "search honors an explicit limit"
+code 400 "$(C "${AUTH[@]}" "$BASE/api/search?q=hello&limit=-1")" "a non-positive limit is refused"
+
+echo "hidden-entry skips are counted, never indexed (F17)"
+mkdir -p "$TMP/hidden/.obsidian" "$TMP/hidden/.git"
+printf '# Visible\n\n## Body\n\nvisible content.\n' > "$TMP/hidden/visible.md"
+printf '# Should never index\n\n## Body\n\nhidden content.\n' > "$TMP/hidden/.obsidian/workspace.md"
+code 200 "$(C -X POST "${AUTH[@]}" -H 'content-type: application/json' -d "{\"kind\":\"files\",\"name\":\"hidden\",\"level\":1,\"path\":\"$TMP/hidden\"}" "$BASE/api/sources")" "add a source with dot-dirs beside real content"
+HID=""
+for _ in $(seq 1 60); do
+  HID="$(curl -s "${AUTH[@]}" "$BASE/api/status")"
+  [ "$(JQ 'd.sources.find((s) => s.name === "hidden")?.status ?? ""' <<<"$HID")" = "ok" ] && break
+  sleep 0.1
+done
+[ "$(JQ 'String(d.sources.find((s) => s.name === "hidden")?.conceptCount)' <<<"$HID")" = "1" ] && pass "only the visible document is indexed" || fail "hidden folder indexed wrong count ($HID)"
+[ "$(JQ 'String(d.sources.find((s) => s.name === "hidden")?.skippedHidden >= 2)' <<<"$HID")" = "true" ] && pass "/api/status counts the skipped dot-dirs" || fail "skippedHidden missing or wrong ($HID)"
+code 200 "$(C -X DELETE "${AUTH[@]}" "$BASE/api/sources?name=hidden")" "cleanup hidden-entry source"
+
 echo "console mount is static UI, not gated data"
 curl -s "$BASE/console/" | grep -q CONSOLE_OK && pass "/console/ serves without auth" || fail "/console/ without auth"
 
@@ -328,6 +357,13 @@ G="$(curl -s "${AUTH[@]}" "$BASE/api/graph?wait=15000")"
 ROW="$(JQ 'JSON.stringify((({kind,conceptCount,status}) => ({kind,conceptCount,status}))(d.sources.find((s) => s.name === "gr") ?? {}))' <<<"$G")"
 [ "$ROW" = '{"kind":"github","conceptCount":0,"status":"degraded"}' ] && pass "the REST layer's graph row appears (degraded offline/online: repo is unreachable)" || fail "github-rest graph row ($ROW)"
 [ "$(JQ 'String(d.sources.find((s) => s.name === "gr").lastErrorAt !== null)' <<<"$G")" = "true" ] && pass "health rides the row (lastErrorAt set)" || fail "lastErrorAt missing ($G)"
+# An adapter WITH health() (github) must never have its never-succeeded null
+# papered over by the index's own "the pass resolved" bookkeeping — that
+# bookkeeping is true even when the pass resolved by warning and returning []
+# against an unreachable repo. True whether this sandbox resolves the repo as
+# "degraded" or (offline) leaks through as "ok" above — either way the repo
+# was never actually read, so lastSuccessAt must stay null in both cases.
+[ "$(JQ 'JSON.stringify(d.sources.find((s) => s.name === "gr").lastSuccessAt)' <<<"$G")" = "null" ] && pass "an unreachable github source never fabricates a lastSuccessAt" || fail "github lastSuccessAt fabricated ($G)"
 SYNC="$(curl -s -X POST "${AUTH[@]}" "$BASE/api/sources/sync?name=gr")"
 code 502 "$(C -X POST "${AUTH[@]}" "$BASE/api/sources/sync?name=gr")" "sync reaches the REST branch and reports the real failure"
 JQ 'd.error' <<<"$SYNC" | grep -q 'Sync failed' && pass "sync failure names itself instead of a false green" || fail "sync error copy ($SYNC)"
@@ -905,4 +941,226 @@ else
   fail "could not enter the window this assertion needs — the remote layer did not land during the graph build, so nothing below was actually gated ($PIN)"
 fi
 
-[ "$FAILED" = 0 ] && echo "service test passed (bearer gate + allowMutations + fall-through + CRUD reload + console mount + github-rest + v2 reads + mcp health + clone cleanup + section guard + credential injection + graph-cache freshness + /api/status + pinned generation + quarantine repair)" || { echo "service test FAILED"; exit 1; }
+echo "lastSuccessAt: a fresh adapter must not disown a healthy entry's real timestamp"
+# openSources() rebuilds every adapter on any manifest change (fresh `index`,
+# fresh health()), while the background index entry it hands the new adapter
+# to is carried over untouched when nothing about the layer itself changed.
+# Before the fix, /api/graph read lastSuccessAt from health() alone, so a
+# healthy remote source flipped to "never read" the moment an unrelated
+# source was added — with zero new requests and the source still serving 3
+# concepts fine. Driven against local fake GitHub APIs (not api.github.com)
+# so both directions are deterministic with or without network access:
+#   - a repo that always answers 200 (the "good" layer)
+#   - a repo whose apiBase is a port nothing listens on (the "down" layer,
+#     ECONNREFUSED — instant and network-independent, unlike a probe that
+#     depends on a real unreachable slug behaving the same online and off)
+cat > "$TMP/lastsuccessat.mjs" <<'EOF'
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+const { createEngineService } = await import(pathToFileURL(process.env.SERVICE_MJS).href);
+
+const dir = process.argv[2];
+
+let apiCalls = 0;
+const FILE = "# Doc\n\n## Body\n\nfixture body.\n";
+const api = http.createServer((req, res) => {
+  apiCalls++;
+  const url = new URL(req.url, "http://localhost");
+  const json = (body) => { res.writeHead(200, { "content-type": "application/json" }); res.end(JSON.stringify(body)); };
+  if (url.pathname === "/repos/acme/good") return json({ default_branch: "main", pushed_at: "2026-07-01T00:00:00Z" });
+  if (url.pathname === "/repos/acme/good/git/trees/main") {
+    return json({ truncated: false, tree: [{ path: "README.md", type: "blob", size: FILE.length }] });
+  }
+  if (url.pathname === "/repos/acme/good/commits") return json([{ commit: { committer: { date: "2026-06-15T00:00:00Z" } } }]);
+  if (url.pathname === "/repos/acme/good/contents/README.md") {
+    res.writeHead(200, { "content-type": "text/plain", "content-length": Buffer.byteLength(FILE) });
+    return res.end(FILE);
+  }
+  res.writeHead(404, { "content-type": "application/json" });
+  res.end(JSON.stringify({ message: "Not Found" }));
+});
+await new Promise((r) => api.listen(0, "127.0.0.1", r));
+const apiBase = `http://127.0.0.1:${api.address().port}`;
+
+// A port nothing listens on: an instant, deterministic connection refusal
+// standing in for an unreachable repo, without depending on real network
+// access (a sandboxed test run has none).
+const deadServer = http.createServer();
+await new Promise((r) => deadServer.listen(0, "127.0.0.1", r));
+const deadApiBase = `http://127.0.0.1:${deadServer.address().port}`;
+await new Promise((r) => deadServer.close(r));
+
+const manifestPath = path.join(dir, "lastsuccessat-manifest.json");
+fs.writeFileSync(manifestPath, JSON.stringify({ layers: [
+  { name: "gh-good", level: 1, source: "github", repo: "acme/good", apiBase, paths: ["README.md"] },
+  { name: "gh-down", level: 1, source: "github", repo: "acme/down", apiBase: deadApiBase, paths: ["README.md"] },
+] }));
+
+const svc = createEngineService({ manifestPath });
+const server = http.createServer(async (req, res) => {
+  if (await svc.handleRequest(req, res)) return;
+  res.writeHead(404); res.end();
+});
+await new Promise((r) => server.listen(0, "127.0.0.1", r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const graph = async () => (await fetch(base + "/api/graph?wait=8000")).json();
+
+const g1 = await graph();
+const good1 = g1.sources.find((s) => s.name === "gh-good");
+const down1 = g1.sources.find((s) => s.name === "gh-down");
+const callsAfterFirstRead = apiCalls;
+
+// The unrelated manifest change the finding is about: adding a local layer
+// that has nothing to do with either GitHub layer.
+const localDir = path.join(dir, "lastsuccessat-unrelated");
+fs.mkdirSync(localDir, { recursive: true });
+fs.writeFileSync(path.join(localDir, "n.md"), "# N\n\n## Body\n\nlocal.\n");
+await fetch(base + "/api/sources", {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ kind: "files", name: "unrelated", level: 3, path: localDir }),
+});
+
+const g2 = await graph();
+const good2 = g2.sources.find((s) => s.name === "gh-good");
+const down2 = g2.sources.find((s) => s.name === "gh-down");
+
+svc.close(); server.close(); api.close();
+// good1's lastSuccessAt can legitimately differ from good2's by a few ms even
+// with ZERO new requests: good1 may read it from the still-live first adapter's
+// own health() (index.at, stamped mid-pass when the tree fetch resolved),
+// while good2's fresh post-rebuild adapter has never read anything and falls
+// back to the entry's own stamp (set once the whole pass finished loading and
+// tokenizing every concept, a little later in the same pass). Both are real
+// timestamps from the one successful read — the bug this pins is the fresh
+// adapter's health() clobbering that fallback with a bare null, not a few
+// milliseconds of skew between two honest clocks on the same event.
+const closeInTime = good1?.lastSuccessAt != null && good2?.lastSuccessAt != null
+  && Math.abs(new Date(good2.lastSuccessAt) - new Date(good1.lastSuccessAt)) < 5000;
+console.log(JSON.stringify({
+  goodFirstOk: good1?.status === "ok",
+  goodFirstIso: typeof good1?.lastSuccessAt === "string" && new Date(good1.lastSuccessAt).toISOString() === good1.lastSuccessAt,
+  downFirstDegraded: down1?.status === "degraded",
+  downFirstNullSuccess: down1?.lastSuccessAt === null,
+  downFirstHasErrorAt: typeof down1?.lastErrorAt === "string",
+  callsAfterFirstRead,
+  callsAfterUnrelatedAdd: apiCalls,
+  goodKeptTimestamp: closeInTime,
+  downStillNull: down2?.lastSuccessAt === null,
+}));
+EOF
+LSA="$(node "$TMP/lastsuccessat.mjs" "$TMP" 2>&1 | tail -1)"
+grep -q '"goodFirstOk":true' <<<"$LSA" && pass "a reachable github layer reads ok" || fail "reachable github layer did not read ok ($LSA)"
+grep -q '"goodFirstIso":true' <<<"$LSA" && pass "a reachable github layer stamps a real ISO lastSuccessAt" || fail "reachable github layer did not stamp lastSuccessAt ($LSA)"
+grep -q '"downFirstDegraded":true' <<<"$LSA" && pass "an unreachable github layer (dead port) reads degraded" || fail "unreachable github layer not degraded ($LSA)"
+grep -q '"downFirstNullSuccess":true' <<<"$LSA" && pass "an unreachable github layer never fabricates a lastSuccessAt on its first pass" || fail "unreachable github layer fabricated lastSuccessAt ($LSA)"
+grep -q '"downFirstHasErrorAt":true' <<<"$LSA" && pass "an unreachable github layer reports lastErrorAt" || fail "unreachable github layer missing lastErrorAt ($LSA)"
+grep -q '"goodKeptTimestamp":true' <<<"$LSA" \
+  && pass "a healthy github source still reports a real lastSuccessAt across an unrelated manifest change" \
+  || fail "REGRESSION: an unrelated manifest change made a healthy github source read 'never read' ($LSA)"
+CALLS_BEFORE="$(JQ 'd.callsAfterFirstRead' <<<"$LSA" 2>/dev/null)"
+[ "$(node -e '
+  const d = JSON.parse(process.argv[1]);
+  process.stdout.write(String(d.callsAfterUnrelatedAdd === d.callsAfterFirstRead));
+' "$LSA")" = "true" ] && pass "the unrelated manifest change made zero new requests to the github fixture" || fail "an unrelated manifest change re-read a github layer that did not change ($LSA)"
+grep -q '"downStillNull":true' <<<"$LSA" && pass "an unreachable github source still reports null lastSuccessAt after an unrelated manifest change" || fail "unreachable github source's lastSuccessAt changed after an unrelated change ($LSA)"
+
+echo "/api/search: partial-index honesty and a token-free query"
+# /api/search used to answer from whatever snapshots happened to exist yet,
+# with no signal that the index was incomplete, and to ignore ?wait= entirely
+# — the one route in this file that did not follow the rule /api/graph and
+# /api/resolve-all already follow (CLAUDE.md: aggregate reads report
+# indexing/indexingSources, and ?wait= is how a caller asks for a settled
+# answer). Driven with an MCP source gated on a marker file so "still on its
+# first pass" is deterministic rather than a race against a real disk walk.
+cat > "$TMP/search-blocked.mjs" <<EOF
+import readline from "node:readline";
+import fs from "node:fs";
+const RELEASE = $(node -e 'console.log(JSON.stringify(process.argv[1]))' "$TMP/search-blocked-release");
+const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+const write = (o) => process.stdout.write(JSON.stringify(o) + "\n");
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+rl.on("line", async (line) => {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
+  if (msg.method === "initialize") return write({ jsonrpc: "2.0", id: msg.id, result: { protocolVersion: "2025-06-18", capabilities: { tools: {} }, serverInfo: { name: "blocked", version: "0" } } });
+  if (msg.method === "notifications/initialized") return;
+  if (msg.method === "tools/list") return write({ jsonrpc: "2.0", id: msg.id, result: { tools: [{ name: "list_nodes" }, { name: "get_node" }] } });
+  if (msg.method === "tools/call") {
+    const { name } = msg.params ?? {};
+    if (name === "list_nodes") {
+      while (!fs.existsSync(RELEASE)) await sleep(30);
+      return write({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text: JSON.stringify({ nodes: ["needle"] }) }] } });
+    }
+    if (name === "get_node") {
+      return write({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text: JSON.stringify({ node: "needle", title: "Needle", kind: "note", facts: [{ topic: "Body", text: "a very particular searchable needle term.", lastTouched: "2026-06-01" }] }) }] } });
+    }
+  }
+});
+EOF
+cat > "$TMP/search-partial.mjs" <<'EOF'
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+const { createEngineService } = await import(pathToFileURL(process.env.SERVICE_MJS).href);
+
+const dir = process.argv[2];
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const RELEASE = path.join(dir, "search-blocked-release");
+const childPath = path.join(dir, "search-blocked.mjs");
+
+const manifestPath = path.join(dir, "search-blocked-manifest.json");
+fs.writeFileSync(manifestPath, JSON.stringify({
+  layers: [{ name: "blocked", level: 1, source: "mcp", command: "node", args: [childPath] }],
+}));
+
+const svc = createEngineService({ manifestPath });
+const server = http.createServer(async (req, res) => {
+  if (await svc.handleRequest(req, res)) return;
+  res.writeHead(404); res.end();
+});
+await new Promise((r) => server.listen(0, "127.0.0.1", r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const getJson = async (p) => { const r = await fetch(base + p); return { status: r.status, body: await r.json() }; };
+
+// The first pass is already in flight the instant ensureIndexes runs inside
+// this very request, so the first call both starts it and observes it
+// mid-flight — deterministic, not a race.
+const early = await getJson("/api/search?q=needle");
+
+const waited = getJson("/api/search?q=needle&wait=15000");
+await sleep(400);
+fs.writeFileSync(RELEASE, "go");
+const late = await waited;
+
+const punctuation = await getJson("/api/search?q=" + encodeURIComponent("!!!"));
+
+svc.close(); server.close();
+console.log(JSON.stringify({
+  earlyStatus: early.status,
+  earlyHits: early.body.hits?.length ?? -1,
+  earlyIndexing: early.body.indexing,
+  earlyIndexingSources: early.body.indexingSources,
+  lateStatus: late.status,
+  lateHitsFound: (late.body.hits ?? []).some((h) => h.id === "needle"),
+  lateIndexing: late.body.indexing,
+  punctuationStatus: punctuation.status,
+  punctuationHits: punctuation.body.hits,
+  punctuationIndexing: punctuation.body.indexing,
+}));
+EOF
+SRCH="$(node "$TMP/search-partial.mjs" "$TMP" 2>&1 | tail -1)"
+grep -q '"earlyStatus":200' <<<"$SRCH" && pass "a search mid-first-index still answers 200" || fail "search mid-index did not answer 200 ($SRCH)"
+grep -q '"earlyHits":0' <<<"$SRCH" && pass "a search against an unindexed source answers no hits, not a crash" || fail "search mid-index hit count wrong ($SRCH)"
+grep -q '"earlyIndexing":true' <<<"$SRCH" && pass "search reports indexing:true while its only source is still on its first pass" || fail "search hid a partial index ($SRCH)"
+grep -q '"earlyIndexingSources":\["blocked"\]' <<<"$SRCH" && pass "search names the still-indexing source" || fail "search did not name the pending source ($SRCH)"
+grep -q '"lateStatus":200' <<<"$SRCH" && pass "?wait= eventually answers 200" || fail "waited search did not answer 200 ($SRCH)"
+grep -q '"lateHitsFound":true' <<<"$SRCH" && pass "?wait= holds for the index to settle, then returns the real hit" || fail "?wait= on /api/search did not wait for the index ($SRCH)"
+grep -q '"lateIndexing":false' <<<"$SRCH" && pass "once settled, search reports indexing:false" || fail "search still claimed indexing after ?wait= settled ($SRCH)"
+grep -q '"punctuationStatus":200' <<<"$SRCH" && pass "a query with no searchable token answers 200, not 500" || fail "a token-free query still 500s ($SRCH)"
+grep -q '"punctuationHits":\[\]' <<<"$SRCH" && pass "a token-free query answers an empty hit list" || fail "a token-free query did not answer an empty hit list ($SRCH)"
+
+[ "$FAILED" = 0 ] && echo "service test passed (bearer gate + allowMutations + fall-through + CRUD reload + console mount + github-rest + v2 reads + mcp health + clone cleanup + section guard + credential injection + graph-cache freshness + /api/status + pinned generation + quarantine repair + lastSuccessAt correctness + partial-index search)" || { echo "service test FAILED"; exit 1; }
diff --git a/packages/core/tests/setup-robustness-test.sh b/packages/core/tests/setup-robustness-test.sh
index 21ce95c..cab0cea 100644
--- a/packages/core/tests/setup-robustness-test.sh
+++ b/packages/core/tests/setup-robustness-test.sh
@@ -244,9 +244,12 @@ printf '# Meeting notes\n\n## Decision\n\nExternal edit wins.\n' > "$TMP/notes/m
 STALE_BODY="{\"path\":\"notes/meeting.md\",\"text\":\"stale editor text\",\"modified\":\"$(JQ 'd.modified' <<<"$OPEN")\"}"
 code 409 "$(C -X PUT -H 'content-type: application/json' -d "$STALE_BODY" "$BASE/api/file")" "a stale editor cannot overwrite an external edit"
 grep -q 'External edit wins' "$TMP/notes/meeting.md" && pass "the external edit remains intact after the conflict" || fail "stale save overwrote disk"
-# Restore the fixture for the indexed-read assertions below. Omitting modified
-# remains a supported compatibility path for older playground clients.
-code 200 "$(C -X PUT -H 'content-type: application/json' -d "{\"path\":\"notes/meeting.md\",\"text\":\"# Meeting notes\n\n## Decision\n\nShip on Monday.\n\"}" "$BASE/api/file")" "legacy save without a revision remains supported"
+# modified is required (F20) — a save that names neither modified nor force
+# is refused rather than blindly overwriting whatever is on disk.
+code 400 "$(C -X PUT -H 'content-type: application/json' -d "{\"path\":\"notes/meeting.md\",\"text\":\"# Meeting notes\n\n## Decision\n\nShip on Monday.\n\"}" "$BASE/api/file")" "a save without modified or force is refused"
+# Restore the fixture for the indexed-read assertions below. force: true is
+# the deliberate-overwrite escape hatch that replaces the old "omit modified" path.
+code 200 "$(C -X PUT -H 'content-type: application/json' -d "{\"path\":\"notes/meeting.md\",\"text\":\"# Meeting notes\n\n## Decision\n\nShip on Monday.\n\",\"force\":true}" "$BASE/api/file")" "force:true restores the fixture despite no modified"
 code 404 "$(C -X PUT -H 'content-type: application/json' -d '{"path":"notes/brand-new.md","text":"nope"}' "$BASE/api/file")" "the editor refuses to create new files"
 code 403 "$(C "$BASE/api/file?path=notes/../../escape.md")" "traversal out of a layer root blocked"
 code 404 "$(C "$BASE/api/file?path=nosuchlayer/x.md")" "unknown layer rejected"
diff --git a/specs/contextcake-distribution/design.md b/specs/contextcake-distribution/design.md
index 6f5f1cb..0bb6926 100644
--- a/specs/contextcake-distribution/design.md
+++ b/specs/contextcake-distribution/design.md
@@ -95,6 +95,14 @@ auth on every `/api/*` route** (random per-launch token, requested by the
 preload through exact-window/exact-origin IPC) — loopback + Origin checks alone don't isolate other
 local users on shared Macs.
 
+`PUT /api/file` is a breaking change from the earlier playground-only version:
+`modified` (the file's last-read mtime, from `GET /api/file`) is now required,
+or the call must say `force: true` to overwrite deliberately. It used to be
+optional, which meant a caller that simply forgot to send it silently skipped
+the stale-editor guard and overwrote whatever had changed on disk — exactly
+the case the guard exists for. There is no compatibility path for a caller
+that omits both; it now gets a 400 instead of a silent overwrite.
+
 ## 5. User data layout (spec §5 "config preservation")
 
 | Path | Contents | Touched by updates? |