diff --git a/.gitignore b/.gitignore
index 3519e84..e50c79a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,6 +38,7 @@ local_backup_*
 #docs/
 mockups/
 docs/superpowers/*
+.superpowers/
 
 # ── Local utilities ──
 config_backup.py
diff --git a/app/ideas/routes.py b/app/ideas/routes.py
index a74e49c..0280e31 100644
--- a/app/ideas/routes.py
+++ b/app/ideas/routes.py
@@ -170,12 +170,16 @@ def inbox():
             'purpose': idea.idea_purpose or 'investment',
             'state': display_state,
             'age_days': idea_ages.get(idea.id, 0),
-            'thesis': (idea.thesis_summary[:80] + '...') if idea.thesis_summary and len(idea.thesis_summary) > 80 else (idea.thesis_summary or ''),
+            'thesis': idea.thesis_summary or '',
+            'notes': idea.initial_notes or '',
             'source': idea.source or '',
             'action': action,
             'edit_url': url_for('ideas.edit_idea', idea_id=idea.id),
         })
-    ideas_json = json.dumps(ideas_data)
+    # Escape '<' so a thesis/name/notes value containing '</script>' cannot
+    # terminate the inline <script> block this is rendered into. json.dumps
+    # does not do this, and the page CSP allows unsafe-inline.
+    ideas_json = json.dumps(ideas_data).replace('<', '\\u003c')
 
     # Serialize ALL checklists for the evaluation modal (pro users can switch)
     checklists_json = json.dumps({
@@ -190,6 +194,7 @@ def inbox():
             } for c in cl.criteria.order_by(KillCriterion.order).all()]
         } for cl in all_kill_checklists
     })
+    checklists_json = checklists_json.replace('<', '\\u003c')
 
     response = make_response(render_template('inbox.html',
                           title="Idea Inbox",
diff --git a/app/ideas/templates/inbox.html b/app/ideas/templates/inbox.html
index 15a26e4..811a15f 100644
--- a/app/ideas/templates/inbox.html
+++ b/app/ideas/templates/inbox.html
@@ -145,6 +145,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
 {% include 'components/_tabulator_js.html' %}
 {% if idea_count > 0 %}
 <script src="{{ url_for('static', filename='js/data-table-component.js') }}"></script>
+<script src="{{ url_for('static', filename='js/thesis-hover-card.js') }}"></script>
 <script>
 const ideasData = {{ ideas_json|safe }};
 const checklistsData = {{ checklists_json|safe }};
@@ -155,6 +156,16 @@ <h5 class="modal-title" id="evaluateModalLabel">
 let currentChecklistId = defaultChecklistId;
 const savedAnswers = {};
 
+/* ── HTML escaping — formatters build markup by concatenation ── */
+function escapeHtml(value) {
+    return String(value == null ? '' : value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
 /* ── Modal lifecycle: reset button + save answers on every hide ── */
 document.getElementById('evaluateModal').addEventListener('hidden.bs.modal', function() {
     if (currentEvalIdeaId) {
@@ -179,8 +190,10 @@ <h5 class="modal-title" id="evaluateModalLabel">
                     widthGrow: 2,
                     formatter: function(cell) {
                         const row = cell.getRow().getData();
-                        const ticker = row.ticker ? '<br><span class="rcl-cell-ticker">' + row.ticker + '</span>' : '';
-                        return '<strong>' + cell.getValue() + '</strong>' + ticker;
+                        const ticker = row.ticker
+                            ? '<br><span class="rcl-cell-ticker">' + escapeHtml(row.ticker) + '</span>'
+                            : '';
+                        return '<strong>' + escapeHtml(cell.getValue()) + '</strong>' + ticker;
                     }
                 },
                 {
@@ -239,9 +252,20 @@ <h5 class="modal-title" id="evaluateModalLabel">
                     minWidth: 180,
                     widthGrow: 2,
                     formatter: function(cell) {
+                        const row = cell.getRow().getData();
                         const val = cell.getValue();
-                        if (!val) return '<span class="table-cell-muted">&mdash;</span>';
-                        return '<span class="idea-thesis-cell">' + val + '</span>';
+                        const hasDetail = !!(val || row.notes);
+                        if (!hasDetail) return '<span class="table-cell-muted">&mdash;</span>';
+                        // An idea can carry notes without a thesis — still worth opening.
+                        const preview = val || 'Notes only';
+                        // No aria-label: on role="button" it would override
+                        // name-from-content, and the cell's text IS the thesis —
+                        // screen readers must keep announcing it.
+                        return '<span class="idea-thesis-cell has-detail"' +
+                               ' data-idea-id="' + row.id + '"' +
+                               ' tabindex="0" role="button" aria-expanded="false"' +
+                               ' aria-controls="thesis-hover-card">' +
+                               escapeHtml(preview) + '</span>';
                     }
                 },
                 {
@@ -252,7 +276,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
                     formatter: function(cell) {
                         const val = cell.getValue();
                         if (!val) return '<span class="table-cell-muted">&mdash;</span>';
-                        return '<span class="idea-source-cell">' + val + '</span>';
+                        return '<span class="idea-source-cell">' + escapeHtml(val) + '</span>';
                     }
                 },
                 {
@@ -267,17 +291,16 @@ <h5 class="modal-title" id="evaluateModalLabel">
                         var html = '<div class="idea-actions" style="justify-content: flex-end;">';
 
                         if (action.type === 'evaluate') {
-                            html += '<button class="idea-action-btn action-kill" onclick="openEvaluateModal(' + row.id + ', \'' + row.name.replace(/'/g, "\\'") + '\', \'' + action.url + '\')">';
-                            html += '<i class="bi ' + action.icon + '"></i> ' + action.label;
+                            html += '<button type="button" class="idea-action-btn action-kill" data-evaluate-id="' + row.id + '">';
+                            html += '<i class="bi ' + escapeHtml(action.icon) + '"></i> ' + escapeHtml(action.label);
                             html += '</button>';
                         } else {
-                            var btnClass = 'action-promote';
-                            html += '<a href="' + action.url + '" class="idea-action-btn ' + btnClass + '">';
-                            html += '<i class="bi ' + action.icon + '"></i> ' + action.label;
+                            html += '<a href="' + escapeHtml(action.url) + '" class="idea-action-btn action-promote">';
+                            html += '<i class="bi ' + escapeHtml(action.icon) + '"></i> ' + escapeHtml(action.label);
                             html += '</a>';
                         }
 
-                        html += '<a href="' + row.edit_url + '" class="idea-action-btn action-edit">';
+                        html += '<a href="' + escapeHtml(row.edit_url) + '" class="idea-action-btn action-edit">';
                         html += '<i class="bi bi-pencil"></i>';
                         html += '</a>';
                         html += '</div>';
@@ -296,6 +319,32 @@ <h5 class="modal-title" id="evaluateModalLabel">
         document.getElementById('inbox-state-filter').addEventListener('change', applyFilters);
         document.getElementById('inbox-purpose-filter').addEventListener('change', applyFilters);
 
+        /* Delegated — Tabulator rebuilds rows on sort/filter/paginate. */
+        document.getElementById('inbox-table').addEventListener('click', function(e) {
+            var btn = e.target.closest('[data-evaluate-id]');
+            if (!btn) return;
+            var id = parseInt(btn.getAttribute('data-evaluate-id'), 10);
+            var row = ideasData.filter(function(d) { return d.id === id; })[0];
+            if (row) openEvaluateModal(row.id, row.name, row.action.url);
+        });
+
+        /* ── Thesis hover card ── */
+        const ideaMap = {};
+        ideasData.forEach(function(d) {
+            ideaMap[d.id] = { thesis: d.thesis, notes: d.notes };
+        });
+
+        const thesisCard = initThesisHoverCard({
+            container: '#inbox-table',
+            lookup: function(id) { return ideaMap[id]; }
+        });
+
+        // Sorting, filtering and paging rebuild rows — drop the card rather
+        // than leave it floating over whatever now occupies that position.
+        inboxTable.on('renderComplete', function() {
+            if (thesisCard) thesisCard.close();
+        });
+
         function applyFilters() {
             var searchVal = document.getElementById('inbox-search').value.toLowerCase().trim();
             var stateVal = document.getElementById('inbox-state-filter').value;
@@ -308,6 +357,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
                     data.name.toLowerCase().indexOf(searchVal) !== -1 ||
                     (data.ticker && data.ticker.toLowerCase().indexOf(searchVal) !== -1) ||
                     (data.thesis && data.thesis.toLowerCase().indexOf(searchVal) !== -1) ||
+                    (data.notes && data.notes.toLowerCase().indexOf(searchVal) !== -1) ||
                     (data.source && data.source.toLowerCase().indexOf(searchVal) !== -1);
                 return stateMatch && purposeMatch && searchMatch;
             });
@@ -345,7 +395,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
         var html = '';
         for (var clId in checklistsData) {
             var selected = (clId === currentChecklistId) ? ' selected' : '';
-            html += '<option value="' + clId + '"' + selected + '>' + checklistsData[clId].name + '</option>';
+            html += '<option value="' + clId + '"' + selected + '>' + escapeHtml(checklistsData[clId].name) + '</option>';
         }
         selectEl.innerHTML = html;
     }
@@ -378,10 +428,10 @@ <h5 class="modal-title" id="evaluateModalLabel">
         html += '<div class="' + cardClass + '" data-criterion-id="' + c.id + '">';
         html += '  <div class="eval-criterion-header">';
         html += '    <span class="eval-criterion-number">' + (i + 1) + '</span>';
-        html += '    <span class="eval-criterion-question">' + c.question + '</span>';
+        html += '    <span class="eval-criterion-question">' + escapeHtml(c.question) + '</span>';
         html += '  </div>';
         if (c.help_text) {
-            html += '  <div class="eval-criterion-help"><i class="bi bi-info-circle"></i> ' + c.help_text + '</div>';
+            html += '  <div class="eval-criterion-help"><i class="bi bi-info-circle"></i> ' + escapeHtml(c.help_text) + '</div>';
         }
         html += '  <div class="eval-criterion-actions">';
         html += '    <label class="eval-toggle eval-toggle-pass">';
@@ -393,7 +443,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
         html += '      <span><i class="bi bi-x-circle"></i> Fail</span>';
         html += '    </label>';
         html += '  </div>';
-        html += '  <textarea class="eval-notes" placeholder="Notes (optional)" data-criterion-id="' + c.id + '">' + notesVal + '</textarea>';
+        html += '  <textarea class="eval-notes" placeholder="Notes (optional)" data-criterion-id="' + c.id + '">' + escapeHtml(notesVal) + '</textarea>';
         html += '</div>';
     });
 
@@ -405,7 +455,7 @@ <h5 class="modal-title" id="evaluateModalLabel">
     html += '  </button>';
     html += '  <div class="eval-quick-kill-form" id="quick-kill-form">';
     html += '    <label>Why are you killing this idea?</label>';
-    html += '    <textarea class="eval-quick-kill-reason" id="quick-kill-reason" placeholder="e.g. CEO just resigned, regulatory risk too high, lost conviction...">' + savedQuickKill + '</textarea>';
+    html += '    <textarea class="eval-quick-kill-reason" id="quick-kill-reason" placeholder="e.g. CEO just resigned, regulatory risk too high, lost conviction...">' + escapeHtml(savedQuickKill) + '</textarea>';
     html += '    <button class="eval-quick-kill-btn" id="quick-kill-btn" onclick="submitQuickKill()">';
     html += '      <i class="bi bi-x-circle"></i> Kill Idea';
     html += '    </button>';
diff --git a/app/static/css/modules/_idea-inbox.css b/app/static/css/modules/_idea-inbox.css
index 37e5409..24686d3 100644
--- a/app/static/css/modules/_idea-inbox.css
+++ b/app/static/css/modules/_idea-inbox.css
@@ -144,16 +144,42 @@
     background: var(--success-500);
 }
 
-/* Thesis preview */
+/* Thesis preview — also the trigger for the hover card */
 .idea-thesis-cell {
+    /* display:block makes the whole cell a hover target. It also activates
+       overflow/text-overflow, which do not apply to inline boxes — so the
+       ellipsis is now drawn here, at the true cell width. No max-width: the
+       Thesis column uses widthGrow:2, and a fixed cap would truncate short of
+       the column edge and leave dead space. */
+    display: block;
     font-size: 0.8125rem;
     color: var(--gray-500);
-    max-width: 280px;
     overflow: hidden;
     text-overflow: ellipsis;
     white-space: nowrap;
 }
 
+/* Only cells that actually have a thesis or notes read as interactive. */
+.idea-thesis-cell.has-detail {
+    cursor: help;
+    text-decoration: underline;
+    text-decoration-style: dotted;
+    text-decoration-color: var(--gray-400);
+    text-underline-offset: 3px;
+}
+
+.idea-thesis-cell.has-detail:hover,
+.idea-thesis-cell.has-detail.is-active {
+    color: var(--gray-900);
+    text-decoration-color: var(--accent-color);
+}
+
+.idea-thesis-cell.has-detail:focus-visible {
+    outline: 2px solid var(--accent-color);
+    outline-offset: 2px;
+    border-radius: 2px;
+}
+
 /* Age cell */
 .idea-age {
     font-family: 'Space Mono', monospace;
@@ -558,3 +584,113 @@
     opacity: 0.5;
     cursor: not-allowed;
 }
+
+/* ── THESIS HOVER CARD ───────────────────────────── */
+/*
+   Mounted on <body>, not inside the cell — Tabulator sets overflow:hidden on
+   .tabulator-cell, which would clip it. z-index sits below Bootstrap's modal
+   backdrop (1050) so the card can never float over the evaluate modal.
+*/
+
+.thesis-card {
+    position: fixed;
+    z-index: 1041;   /* above the topbar/companion rail (1040), below the modal backdrop (1050) */
+    width: 360px;
+    max-width: calc(100vw - 2rem);
+    background: #fff;
+    border: 1px solid var(--border-light);
+    border-radius: var(--radius-lg);
+    box-shadow: 0 12px 32px rgba(17, 24, 39, 0.16),
+                0 2px 6px rgba(17, 24, 39, 0.06);
+    opacity: 0;
+    visibility: hidden;
+    transform: translateY(-4px);
+    transition: opacity 0.12s ease, transform 0.12s ease;
+}
+
+.thesis-card.is-open {
+    opacity: 1;
+    visibility: visible;
+    transform: translateY(0);
+}
+
+.thesis-card.is-pinned {
+    border-color: var(--accent-color);
+    box-shadow: 0 12px 32px rgba(45, 106, 79, 0.20),
+                0 0 0 3px rgba(45, 106, 79, 0.10);
+}
+
+.thesis-card .tc-scroll {
+    max-height: 320px;
+    overflow-y: auto;
+    overscroll-behavior: contain;   /* don't chain to the page at the end of the scroll */
+    padding: 0.9rem 1rem;
+}
+
+.thesis-card .tc-scroll:focus-visible {
+    outline: 2px solid var(--accent-color);
+    outline-offset: -2px;
+}
+
+.thesis-card .tc-sec + .tc-sec {
+    margin-top: 0.85rem;
+    padding-top: 0.85rem;
+    border-top: 1px solid var(--border-light);
+}
+
+.thesis-card .tc-label {
+    margin: 0 0 0.35rem;
+    font-size: 0.625rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.07em;
+    color: var(--gray-400);
+}
+
+.thesis-card .tc-body {
+    margin: 0;
+    font-size: 0.8125rem;
+    line-height: 1.65;
+    color: var(--gray-700);
+    white-space: pre-wrap;        /* capture-time line breaks are meaningful */
+    overflow-wrap: anywhere;      /* a pasted URL must not force a sideways scrollbar */
+}
+
+.thesis-card .tc-foot {
+    display: none;           /* JS switches to flex when pinned or overflowing */
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.5rem;
+    padding: 0.5rem 0.75rem 0.55rem;
+    border-top: 1px solid var(--border-light);
+    background: var(--gray-50);
+    border-radius: 0 0 var(--radius-lg) var(--radius-lg);
+}
+
+.thesis-card .tc-hint {
+    font-size: 0.6875rem;
+    color: var(--gray-500);
+}
+
+.thesis-card .tc-close {
+    padding: 0.25rem 0.55rem;
+    border: 1px solid var(--border-light);
+    border-radius: 6px;
+    background: #fff;
+    font-size: 0.6875rem;
+    font-weight: 600;
+    color: var(--gray-700);
+    cursor: pointer;
+}
+
+.thesis-card .tc-close:hover {
+    background: var(--gray-100);
+}
+
+@media (prefers-reduced-motion: reduce) {
+    .thesis-card,
+    .thesis-card.is-open {
+        transition: none;
+        transform: none;
+    }
+}
diff --git a/app/static/js/thesis-hover-card.js b/app/static/js/thesis-hover-card.js
new file mode 100644
index 0000000..f072e4c
--- /dev/null
+++ b/app/static/js/thesis-hover-card.js
@@ -0,0 +1,317 @@
+/**
+ * =============================================================================
+ * THESIS HOVER CARD
+ * =============================================================================
+ *
+ * Floating detail view for the idea inbox thesis column. Hover opens it,
+ * click pins it (which is also the only way to reach it on touch).
+ *
+ * Two constraints drive the design:
+ *
+ *   1. Tabulator sets `overflow: hidden` on `.tabulator-cell`, so a card
+ *      rendered inside the cell is clipped. The card is mounted on
+ *      `document.body` and positioned `fixed`.
+ *   2. Tabulator virtualises rows — sorting, filtering, paginating and
+ *      scrolling destroy and rebuild row DOM. All listeners are delegated to
+ *      a stable container so nothing ever needs re-binding.
+ *
+ * Usage:
+ *   var card = initThesisHoverCard({
+ *       container: '#inbox-table',
+ *       lookup: function (id) { return ideaMap[id]; }
+ *   });
+ *   card.close();
+ */
+(function (window, document) {
+    'use strict';
+
+    var CLOSE_DELAY = 120;   // ms grace to travel from cell to card
+    var EDGE_GAP = 8;        // px clearance from the viewport edge
+    var TRIGGER = '.idea-thesis-cell.has-detail';
+
+    function escapeHtml(value) {
+        return String(value == null ? '' : value)
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;');
+    }
+
+    function initThesisHoverCard(options) {
+        var container = typeof options.container === 'string'
+            ? document.querySelector(options.container)
+            : options.container;
+        if (!container) return null;
+
+        var lookup = options.lookup;
+        var card, scrollEl, footEl, hintEl, closeBtn;
+        var pinned = false;
+        var pinnedByFocus = false;
+        var activeTrigger = null;
+        var closeTimer = null;
+        var pointerDown = false;
+        var suppressFocusPin = false;
+
+        function build() {
+            card = document.createElement('div');
+            card.className = 'thesis-card';
+            card.id = 'thesis-hover-card';
+            card.setAttribute('role', 'dialog');
+            card.setAttribute('aria-label', 'Idea thesis and notes');
+            card.innerHTML =
+                '<div class="tc-scroll" tabindex="0"></div>' +
+                '<div class="tc-foot">' +
+                '<span class="tc-hint"></span>' +
+                '<button type="button" class="tc-close">Close</button>' +
+                '</div>';
+            document.body.appendChild(card);
+
+            scrollEl = card.querySelector('.tc-scroll');
+            footEl = card.querySelector('.tc-foot');
+            hintEl = card.querySelector('.tc-hint');
+            closeBtn = card.querySelector('.tc-close');
+
+            // Keep it open while the pointer is inside, so it can be scrolled.
+            card.addEventListener('pointerenter', function () {
+                clearTimeout(closeTimer);
+            });
+            card.addEventListener('pointerleave', function () {
+                if (!pinned) close();
+            });
+            closeBtn.addEventListener('click', close);
+        }
+
+        function render(trigger) {
+            var data = lookup(trigger.getAttribute('data-idea-id')) || {};
+            if (!data.thesis && !data.notes) return false;
+            var html = '';
+            if (data.thesis) {
+                html += '<div class="tc-sec">' +
+                        '<p class="tc-label">Initial thesis</p>' +
+                        '<p class="tc-body">' + escapeHtml(data.thesis) + '</p>' +
+                        '</div>';
+            }
+            if (data.notes) {
+                html += '<div class="tc-sec">' +
+                        '<p class="tc-label">Initial notes</p>' +
+                        '<p class="tc-body">' + escapeHtml(data.notes) + '</p>' +
+                        '</div>';
+            }
+            scrollEl.innerHTML = html;
+            scrollEl.scrollTop = 0;
+            return true;
+        }
+
+        function updateFooter() {
+            // Only advertise scrolling when the content actually overflows.
+            var overflows = scrollEl.scrollHeight > scrollEl.clientHeight + 1;
+            if (pinned) {
+                hintEl.textContent = 'Escape or click outside to close';
+            } else if (overflows) {
+                hintEl.textContent = 'Scroll for more · click to pin';
+            }
+            footEl.style.display = (pinned || overflows) ? 'flex' : 'none';
+            closeBtn.style.display = pinned ? '' : 'none';
+        }
+
+        function place(trigger) {
+            var rect = trigger.getBoundingClientRect();
+            // Measure off-screen before committing to a position.
+            card.style.left = '-9999px';
+            card.style.top = '0px';
+            var height = card.offsetHeight;
+            var width = card.offsetWidth;
+
+            // Prefer below; flip above when it would cross the bottom edge.
+            var top = rect.bottom + EDGE_GAP;
+            if (top + height > window.innerHeight - EDGE_GAP) {
+                var above = rect.top - height - EDGE_GAP;
+                top = above >= EDGE_GAP
+                    ? above
+                    : Math.max(EDGE_GAP, window.innerHeight - height - EDGE_GAP);
+            }
+
+            // Left-align to the cell; shift back inside on the right edge.
+            var left = Math.min(rect.left, window.innerWidth - width - EDGE_GAP);
+            card.style.left = Math.max(EDGE_GAP, left) + 'px';
+            card.style.top = top + 'px';
+        }
+
+        function open(trigger) {
+            clearTimeout(closeTimer);
+            // Render FIRST. With nothing to show, leave every bit of state
+            // untouched — marking the trigger active and aria-expanded with no
+            // card visible would strand it, and activeTrigger would keep the
+            // scroll handler repositioning a hidden card.
+            if (!render(trigger)) return false;
+            if (activeTrigger && activeTrigger !== trigger) {
+                activeTrigger.classList.remove('is-active');
+                activeTrigger.setAttribute('aria-expanded', 'false');
+            }
+            activeTrigger = trigger;
+            trigger.classList.add('is-active');
+            trigger.setAttribute('aria-expanded', 'true');
+            card.classList.add('is-open');
+            // Footer first: it changes the card's height, and place() must flip
+            // against the final height or a card near the bottom edge overflows.
+            updateFooter();
+            place(trigger);
+            return true;
+        }
+
+        function close() {
+            clearTimeout(closeTimer);
+            pinned = false;
+            pinnedByFocus = false;
+            card.classList.remove('is-open', 'is-pinned');
+            if (activeTrigger) {
+                activeTrigger.classList.remove('is-active');
+                activeTrigger.setAttribute('aria-expanded', 'false');
+            }
+            activeTrigger = null;
+        }
+
+        function pin(trigger, byFocus) {
+            pinned = true;
+            pinnedByFocus = !!byFocus;
+            // Both flags set before open(), so its updateFooter()/place() pass
+            // sees the final pinned geometry and needs no second correction.
+            card.classList.add('is-pinned');
+            if (!open(trigger)) {
+                // Nothing to show. Roll back, or pinned stays true forever and
+                // the pointerover handler's early return kills hover for good.
+                pinned = false;
+                pinnedByFocus = false;
+                card.classList.remove('is-pinned');
+            }
+        }
+
+        function triggerFrom(event) {
+            return event.target.closest ? event.target.closest(TRIGGER) : null;
+        }
+
+        function toggle(trigger) {
+            if (pinned && trigger === activeTrigger) close();
+            else pin(trigger, false);
+        }
+
+        build();
+
+        container.addEventListener('pointerover', function (e) {
+            if (pinned || e.pointerType !== 'mouse') return;
+            var trigger = triggerFrom(e);
+            if (!trigger) return;
+            // Re-entering the same trigger inside the close delay must cancel the
+            // pending close — open() only clears the timer when switching triggers.
+            clearTimeout(closeTimer);
+            if (trigger !== activeTrigger) open(trigger);
+        });
+
+        container.addEventListener('pointerout', function (e) {
+            if (pinned || e.pointerType !== 'mouse') return;
+            var trigger = triggerFrom(e);
+            if (!trigger) return;
+            var to = e.relatedTarget;
+            if (to && (card.contains(to) || trigger.contains(to))) return;
+            closeTimer = setTimeout(close, CLOSE_DELAY);
+        });
+
+        container.addEventListener('click', function (e) {
+            var trigger = triggerFrom(e);
+            if (!trigger) return;
+            e.preventDefault();
+            toggle(trigger);
+        });
+
+        container.addEventListener('keydown', function (e) {
+            if (e.key !== 'Enter' && e.key !== ' ') return;
+            var trigger = triggerFrom(e);
+            if (!trigger) return;
+            e.preventDefault();
+            if (pinned && trigger === activeTrigger) {
+                close();
+                return;
+            }
+            pin(trigger, false);
+            // A non-focusable scroll region cannot be scrolled by keyboard, and
+            // the card sits at the end of <body> so Tab never reaches it. Hand
+            // focus over when there is more content than fits.
+            if (pinned && scrollEl.scrollHeight > scrollEl.clientHeight + 1) scrollEl.focus();
+        });
+
+        // A mouse click focuses the trigger too (it is tabindex="0"), and the
+        // event order is pointerdown → focus → focusin → pointerup → click.
+        // Without this guard, focusin would pin and the following click would
+        // toggle straight back off, making click-to-pin do nothing at all.
+        container.addEventListener('pointerdown', function () {
+            pointerDown = true;
+        });
+        document.addEventListener('pointerup', function () {
+            pointerDown = false;
+        });
+        // A pointerup released outside the window never reaches this document.
+        // Without these the flag sticks and the keyboard-arrival pin stays dead.
+        document.addEventListener('pointercancel', function () {
+            pointerDown = false;
+        });
+        window.addEventListener('blur', function () {
+            pointerDown = false;
+        });
+
+        // Keyboard arrival pins, so the card cannot evaporate mid-read.
+        container.addEventListener('focusin', function (e) {
+            if (pinned || pointerDown || suppressFocusPin) return;
+            var trigger = triggerFrom(e);
+            if (trigger) pin(trigger, true);
+        });
+
+        container.addEventListener('focusout', function (e) {
+            if (!pinnedByFocus) return;
+            var to = e.relatedTarget;
+            if (to && card.contains(to)) return;
+            close();
+        });
+
+        document.addEventListener('click', function (e) {
+            if (!pinned || card.contains(e.target)) return;
+            if (e.target.closest && e.target.closest(TRIGGER)) return;
+            close();
+        });
+
+        document.addEventListener('keydown', function (e) {
+            if (e.key !== 'Escape' || !activeTrigger) return;
+            var trigger = activeTrigger;
+            // Restore focus only when it is already inside the widget. Focusing a
+            // trigger the user never focused (the plain hover case) fires focusin
+            // and would immediately re-pin the card we are trying to close.
+            var restoreFocus = document.activeElement === trigger ||
+                               card.contains(document.activeElement);
+            close();
+            if (restoreFocus && trigger && trigger.focus) {
+                // focus() fires focusin synchronously, which would re-pin the card
+                // we just closed. Suppress the pin for this one restoring focus.
+                suppressFocusPin = true;
+                trigger.focus();
+                suppressFocusPin = false;
+            }
+        });
+
+        // Capture phase so this still works if the card is ever reused inside a
+        // scrolling container. Close rather than let the card drift off-screen
+        // when its trigger scrolls out of view.
+        window.addEventListener('scroll', function () {
+            if (!activeTrigger) return;
+            var rect = activeTrigger.getBoundingClientRect();
+            if (rect.bottom < 0 || rect.top > window.innerHeight) {
+                close();
+                return;
+            }
+            place(activeTrigger);
+        }, true);
+
+        return { close: close, element: card };
+    }
+
+    window.initThesisHoverCard = initThesisHoverCard;
+})(window, document);
diff --git a/unittests/test_ideas_inbox_thesis.py b/unittests/test_ideas_inbox_thesis.py
new file mode 100644
index 0000000..fbe6541
--- /dev/null
+++ b/unittests/test_ideas_inbox_thesis.py
@@ -0,0 +1,123 @@
+# StartWithA
+# Copyright (C) 2024-2026 Kiran Mathews
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+"""The inbox must ship the whole thesis and notes to the browser.
+
+The page used to truncate the thesis to 80 characters server-side, which made
+the full text unreachable and silently broke search for terms past that cut.
+"""
+
+import json
+import re
+
+import pytest
+
+from app import db
+from app.models import IdeaPipeline, KillChecklist, KillCriterion, User
+
+# Roughly 440 characters — comfortably past the old 80-character cut.
+LONG_THESIS = (
+    'The RBI embargo on new digital onboarding was lifted in February, but the '
+    'market is still applying the discount it opened during the ban. '
+) * 4
+
+# json.dumps writes a single line, so a line-anchored match is exact.
+IDEAS_DATA_RE = re.compile(r'^const ideasData = (.+);$', re.M)
+
+
+def _extract_ideas(html):
+    match = IDEAS_DATA_RE.search(html)
+    assert match, 'ideasData was not rendered into the inbox page'
+    return json.loads(match.group(1))
+
+
+@pytest.fixture
+def inbox_client(client_logged_in):
+    """Logged-in client whose user already owns a kill checklist.
+
+    Without one, `inbox()` creates a default and redirects to its edit page.
+    Also gives the user a username: `client_logged_in`'s user has none, and
+    the base template's topbar avatar (`current_user.username[:2]`) blows up
+    on a full page render without it. Every other consumer of
+    `client_logged_in` only hits JSON API routes, so this gap was latent.
+    """
+    client, user_id = client_logged_in
+    db.session.get(User, user_id).username = 'tester'
+    checklist = KillChecklist(user_id=user_id, name='Default', is_default=True)
+    db.session.add(checklist)
+    db.session.flush()
+    db.session.add(KillCriterion(
+        kill_checklist_id=checklist.id, question='Do I understand it?', order=0))
+    db.session.commit()
+    return client, user_id
+
+
+def test_thesis_is_sent_untruncated(inbox_client):
+    client, user_id = inbox_client
+    db.session.add(IdeaPipeline(
+        user_id=user_id, name='Kotak Mahindra Bank', status='inbox',
+        thesis_summary=LONG_THESIS))
+    db.session.commit()
+
+    ideas = _extract_ideas(client.get('/ideas/inbox').get_data(as_text=True))
+
+    assert len(ideas) == 1
+    assert ideas[0]['thesis'] == LONG_THESIS
+    assert '...' not in ideas[0]['thesis']
+
+
+def test_initial_notes_are_serialised(inbox_client):
+    client, user_id = inbox_client
+    db.session.add(IdeaPipeline(
+        user_id=user_id, name='Nvidia', status='inbox',
+        thesis_summary='Inference demand is mispriced.',
+        initial_notes='Cross-check TSMC CoWoS capacity before promoting.'))
+    db.session.commit()
+
+    ideas = _extract_ideas(client.get('/ideas/inbox').get_data(as_text=True))
+
+    assert ideas[0]['notes'] == 'Cross-check TSMC CoWoS capacity before promoting.'
+
+
+def test_absent_thesis_and_notes_become_empty_strings(inbox_client):
+    client, user_id = inbox_client
+    db.session.add(IdeaPipeline(
+        user_id=user_id, name='Tata Motors', status='inbox'))
+    db.session.commit()
+
+    ideas = _extract_ideas(client.get('/ideas/inbox').get_data(as_text=True))
+
+    assert ideas[0]['thesis'] == ''
+    assert ideas[0]['notes'] == ''
+
+
+def test_script_tag_in_user_text_cannot_break_out_of_the_json_block(inbox_client):
+    """json.dumps does not escape '<', and the payload renders inside <script>.
+
+    Without escaping, an idea named 'x</script>...' terminates the script
+    element and anything after it executes.
+    """
+    client, user_id = inbox_client
+    db.session.add(IdeaPipeline(
+        user_id=user_id, name='x</script><script>alert(1)</script>',
+        status='inbox', thesis_summary='</script> in the thesis too'))
+    db.session.commit()
+
+    html = client.get('/ideas/inbox').get_data(as_text=True)
+
+    # The raw sequence must not survive into the rendered page at all.
+    assert '</script><script>alert(1)' not in html
+    assert '\\u003c/script>' in html
diff --git a/unittests/test_inbox_markup_contract.py b/unittests/test_inbox_markup_contract.py
new file mode 100644
index 0000000..b4f4207
--- /dev/null
+++ b/unittests/test_inbox_markup_contract.py
@@ -0,0 +1,121 @@
+# StartWithA
+# Copyright (C) 2024-2026 Kiran Mathews
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+"""Static contract checks on the inbox template. No app or DB needed.
+
+The Tabulator formatters build HTML by string concatenation, so every
+interpolation of user-controlled text has to go through escapeHtml.
+"""
+
+import os
+
+INBOX = os.path.join(
+    os.path.dirname(__file__), '..', 'app/ideas/templates/inbox.html')
+
+
+def _inbox():
+    return open(INBOX, encoding='utf-8').read()
+
+
+def test_escape_helper_is_defined():
+    assert 'function escapeHtml(' in _inbox()
+
+
+def test_escape_helper_covers_all_five_dangerous_characters():
+    s = _inbox()
+    for pattern in ('&amp;', '&lt;', '&gt;', '&quot;', '&#39;'):
+        assert pattern in s, f'escapeHtml does not emit {pattern}'
+
+
+def test_name_and_ticker_are_escaped():
+    s = _inbox()
+    assert 'escapeHtml(cell.getValue())' in s
+    assert 'escapeHtml(row.ticker)' in s
+
+
+def test_source_is_escaped():
+    assert "'<span class=\"idea-source-cell\">' + escapeHtml(val)" in _inbox()
+
+
+def test_idea_name_is_not_interpolated_into_an_inline_onclick():
+    """A name containing a backslash or double quote used to break the button."""
+    s = _inbox()
+    assert 'onclick="openEvaluateModal(' not in s
+    assert 'data-evaluate-id=' in s
+
+
+def test_hover_card_script_is_loaded():
+    assert "filename='js/thesis-hover-card.js'" in _inbox()
+
+
+def test_hover_card_is_initialised_against_the_table():
+    s = _inbox()
+    assert 'initThesisHoverCard(' in s
+    assert "container: '#inbox-table'" in s
+
+
+def test_thesis_cell_carries_the_id_and_accessibility_hooks():
+    s = _inbox()
+    assert 'idea-thesis-cell has-detail' in s
+    assert 'data-idea-id=' in s
+    assert 'tabindex="0"' in s
+    assert 'aria-expanded="false"' in s
+    assert 'aria-controls="thesis-hover-card"' in s
+
+
+def test_card_closes_when_tabulator_rebuilds_rows():
+    """A sort or filter would otherwise strand the card over the wrong row."""
+    s = _inbox()
+    assert "'renderComplete'" in s
+    assert 'thesisCard.close()' in s
+
+
+def test_notes_are_searchable():
+    assert 'data.notes.toLowerCase().indexOf(searchVal)' in _inbox()
+
+
+def test_ideas_with_neither_thesis_nor_notes_are_inert():
+    """No affordance when there is nothing to show."""
+    assert 'const hasDetail = !!(val || row.notes);' in _inbox()
+
+
+def test_thesis_formatter_escapes_the_preview_text():
+    """The thesis cell was the last unescaped sink among the formatters.
+
+    The preview is the idea's own thesis. Dropping this escapeHtml call
+    reopens the hole, so pin it.
+    """
+    assert 'escapeHtml(preview)' in _inbox()
+
+
+def test_thesis_trigger_has_no_aria_label():
+    """aria-label on role="button" overrides name-from-content.
+
+    The cell's text IS the thesis, so an aria-label would stop screen readers
+    announcing it — strictly less access than before this feature existed.
+    """
+    assert 'aria-label="Show thesis and notes for' not in _inbox()
+
+
+def test_evaluate_modal_escapes_user_text():
+    """The modal render path builds innerHTML by concatenation too."""
+    s = _inbox()
+    for expr in ('escapeHtml(checklistsData[clId].name)',
+                 'escapeHtml(c.question)',
+                 'escapeHtml(c.help_text)',
+                 'escapeHtml(notesVal)',
+                 'escapeHtml(savedQuickKill)'):
+        assert expr in s, f'unescaped sink: {expr}'
diff --git a/unittests/test_thesis_hover_card_contract.py b/unittests/test_thesis_hover_card_contract.py
new file mode 100644
index 0000000..22161e4
--- /dev/null
+++ b/unittests/test_thesis_hover_card_contract.py
@@ -0,0 +1,159 @@
+# StartWithA
+# Copyright (C) 2024-2026 Kiran Mathews
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+"""Static contract checks on the thesis hover card. No app or DB needed.
+
+Guards the properties that are easy to regress silently: escaping, event
+delegation (Tabulator virtualises rows), the mouse-only hover gate, and the
+body mount that keeps the card out of the cell's overflow:hidden.
+"""
+
+import os
+import re
+
+JS = os.path.join(
+    os.path.dirname(__file__), '..', 'app/static/js/thesis-hover-card.js')
+
+
+def _js():
+    return open(JS, encoding='utf-8').read()
+
+
+CSS = os.path.join(
+    os.path.dirname(__file__), '..', 'app/static/css/modules/_idea-inbox.css')
+
+
+def _css():
+    return open(CSS, encoding='utf-8').read()
+
+
+def test_exposes_the_init_entry_point():
+    assert 'window.initThesisHoverCard' in _js()
+
+
+def test_user_text_is_escaped_before_insertion():
+    s = _js()
+    assert 'function escapeHtml(' in s
+    assert 'escapeHtml(data.thesis)' in s
+    assert 'escapeHtml(data.notes)' in s
+
+
+def test_listeners_are_delegated_on_the_container():
+    """Per-element bindings would go stale on every Tabulator re-render."""
+    s = _js()
+    for event in ('pointerover', 'pointerout', 'click', 'keydown', 'focusin'):
+        assert "container.addEventListener('%s'" % event in s
+
+
+def test_hover_is_gated_on_a_mouse_pointer():
+    """Touch taps must not fire a phantom hover."""
+    assert "e.pointerType !== 'mouse'" in _js()
+
+
+def test_card_is_mounted_on_the_body():
+    """Tabulator cells are overflow:hidden — an in-cell card would be clipped."""
+    assert 'document.body.appendChild(card)' in _js()
+
+
+def test_escape_closes_and_returns_focus_to_the_trigger():
+    s = _js()
+    assert "e.key !== 'Escape'" in s
+    assert 'trigger.focus()' in s
+
+
+def test_card_is_announced_to_assistive_technology():
+    s = _js()
+    assert "setAttribute('role', 'dialog')" in s
+    assert "'aria-label'" in s
+
+
+def test_trigger_selector_matches_the_css_module():
+    assert '.idea-thesis-cell.has-detail' in _js()
+
+
+def test_focus_pin_is_suppressed_during_a_mouse_click():
+    """The trigger is tabindex=0, so a click focuses it before the click fires.
+
+    Order is pointerdown -> focus -> focusin -> pointerup -> click. Without a
+    guard, focusin pins and the click toggles straight back off, so clicking
+    a thesis cell would appear to do nothing.
+    """
+    s = _js()
+    assert 'pointerDown = true;' in s
+    assert re.search(r'if \(pinned \|\| pointerDown[^)]*\) return;', s), \
+        'the focusin guard must still consult pointerDown'
+    # Without every reset, the flag sticks true and keyboard-arrival pinning
+    # dies silently — the suite would stay green.
+    for reset in ("document.addEventListener('pointerup'",
+                  "document.addEventListener('pointercancel'",
+                  "window.addEventListener('blur'"):
+        assert reset in s, f'missing pointerDown reset: {reset}'
+
+
+def test_escape_refocus_cannot_re_pin_the_card():
+    """Escape restores focus to the trigger, and focus() fires focusin.
+
+    Without an explicit suppression flag that focusin re-pins the card that
+    Escape just closed — the bug this guards against.
+    """
+    s = _js()
+    assert 'suppressFocusPin' in s
+    assert 'suppressFocusPin = true;' in s
+    assert 'suppressFocusPin = false;' in s
+
+
+def test_scroll_region_is_capped_so_the_card_never_exceeds_the_viewport():
+    assert 'max-height: 320px' in _css()
+
+
+def test_trigger_signals_that_it_is_interactive():
+    s = _css()
+    assert '.idea-thesis-cell.has-detail' in s
+    assert 'cursor: help' in s
+    assert 'text-decoration-style: dotted' in s
+
+
+def test_card_sits_below_the_bootstrap_modal_layer():
+    """Bootstrap's modal backdrop is 1050 — the card must never cover it.
+
+    Pin the invariant, not the literal. The exact value may legitimately move
+    (it was raised from 1040 to clear the topbar and companion rail), but it
+    must stay under the backdrop or the card floats over the evaluate modal.
+    """
+    match = re.search(r'\.thesis-card\s*\{[^}]*?z-index:\s*(\d+)', _css(), re.S)
+    assert match, '.thesis-card must declare a z-index'
+    z_index = int(match.group(1))
+    assert 1040 <= z_index < 1050, (
+        f'z-index {z_index} must clear the 1040 tier but stay below the 1050 backdrop')
+
+
+def test_keyboard_focus_is_visible_on_the_trigger():
+    assert ':focus-visible' in _css()
+
+
+def test_motion_is_suppressed_when_the_user_asks_for_it():
+    assert 'prefers-reduced-motion' in _css()
+
+
+def test_scroll_region_is_keyboard_reachable():
+    """A non-focusable scroll region cannot be scrolled by keyboard in Chromium.
+
+    The card sits at the end of <body>, so Tab never reaches it either — focus
+    has to be handed over explicitly when the content overflows.
+    """
+    s = _js()
+    assert 'class="tc-scroll" tabindex="0"' in s
+    assert 'scrollEl.focus();' in s